2 Unix SMB/CIFS implementation.
4 Map SIDs to unixids and back
6 Copyright (C) Kai Blin 2008
7 Copyright (C) Andrew Bartlett 2012
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "auth/auth.h"
25 #include "librpc/gen_ndr/ndr_security.h"
26 #include "lib/util_unixsids.h"
29 #include "param/param.h"
30 #include "winbind/idmap.h"
31 #include "libcli/security/security.h"
32 #include "libcli/ldap/ldap_ndr.h"
33 #include "dsdb/samdb/samdb.h"
34 #include "../libds/common/flags.h"
37 * Get uid/gid bounds from idmap database
39 * \param idmap_ctx idmap context to use
40 * \param low lower uid/gid bound is stored here
41 * \param high upper uid/gid bound is stored here
42 * \return 0 on success, nonzero on failure
44 static int idmap_get_bounds(struct idmap_context
*idmap_ctx
, uint32_t *low
,
48 struct ldb_context
*ldb
= idmap_ctx
->ldb_ctx
;
50 struct ldb_result
*res
= NULL
;
51 TALLOC_CTX
*tmp_ctx
= talloc_new(idmap_ctx
);
52 uint32_t lower_bound
= (uint32_t) -1;
53 uint32_t upper_bound
= (uint32_t) -1;
55 dn
= ldb_dn_new(tmp_ctx
, ldb
, "CN=CONFIG");
56 if (dn
== NULL
) goto failed
;
58 ret
= ldb_search(ldb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, NULL
, NULL
);
59 if (ret
!= LDB_SUCCESS
) goto failed
;
61 if (res
->count
!= 1) {
66 lower_bound
= ldb_msg_find_attr_as_uint(res
->msgs
[0], "lowerBound", -1);
67 if (lower_bound
!= (uint32_t) -1) {
74 upper_bound
= ldb_msg_find_attr_as_uint(res
->msgs
[0], "upperBound", -1);
75 if (upper_bound
!= (uint32_t) -1) {
89 * Add a dom_sid structure to a ldb_message
90 * \param idmap_ctx idmap context to use
91 * \param mem_ctx talloc context to use
92 * \param ldb_message ldb message to add dom_sid to
93 * \param attr_name name of the attribute to store the dom_sid in
94 * \param sid dom_sid to store
95 * \return 0 on success, an ldb error code on failure.
97 static int idmap_msg_add_dom_sid(struct idmap_context
*idmap_ctx
,
98 TALLOC_CTX
*mem_ctx
, struct ldb_message
*msg
,
99 const char *attr_name
, const struct dom_sid
*sid
)
102 enum ndr_err_code ndr_err
;
104 ndr_err
= ndr_push_struct_blob(&val
, mem_ctx
, sid
,
105 (ndr_push_flags_fn_t
)ndr_push_dom_sid
);
107 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
111 return ldb_msg_add_value(msg
, attr_name
, &val
, NULL
);
115 * Get a dom_sid structure from a ldb message.
117 * \param mem_ctx talloc context to allocate dom_sid memory in
118 * \param msg ldb_message to get dom_sid from
119 * \param attr_name key that has the dom_sid as data
120 * \return dom_sid structure on success, NULL on failure
122 static struct dom_sid
*idmap_msg_get_dom_sid(TALLOC_CTX
*mem_ctx
,
123 struct ldb_message
*msg
, const char *attr_name
)
126 const struct ldb_val
*val
;
127 enum ndr_err_code ndr_err
;
129 val
= ldb_msg_find_ldb_val(msg
, attr_name
);
134 sid
= talloc(mem_ctx
, struct dom_sid
);
139 ndr_err
= ndr_pull_struct_blob(val
, sid
, sid
,
140 (ndr_pull_flags_fn_t
)ndr_pull_dom_sid
);
141 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
150 * Initialize idmap context
152 * talloc_free to close.
154 * \param mem_ctx talloc context to use.
155 * \return allocated idmap_context on success, NULL on error
157 struct idmap_context
*idmap_init(TALLOC_CTX
*mem_ctx
,
158 struct tevent_context
*ev_ctx
,
159 struct loadparm_context
*lp_ctx
)
161 struct idmap_context
*idmap_ctx
;
163 idmap_ctx
= talloc(mem_ctx
, struct idmap_context
);
164 if (idmap_ctx
== NULL
) {
168 idmap_ctx
->lp_ctx
= lp_ctx
;
170 idmap_ctx
->ldb_ctx
= ldb_wrap_connect(idmap_ctx
, ev_ctx
, lp_ctx
,
172 system_session(lp_ctx
),
174 if (idmap_ctx
->ldb_ctx
== NULL
) {
178 idmap_ctx
->samdb
= samdb_connect(idmap_ctx
, ev_ctx
, lp_ctx
, system_session(lp_ctx
), 0);
179 if (idmap_ctx
->samdb
== NULL
) {
180 DEBUG(0, ("Failed to load sam.ldb in idmap_init\n"));
186 TALLOC_FREE(idmap_ctx
);
191 * Convert an unixid to the corresponding SID
193 * \param idmap_ctx idmap context to use
194 * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
196 * \param unixid pointer to a unixid struct to convert
197 * \param sid pointer that will take the struct dom_sid pointer if the mapping
199 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
200 * possible or some other NTSTATUS that is more descriptive on failure.
203 static NTSTATUS
idmap_xid_to_sid(struct idmap_context
*idmap_ctx
,
205 struct unixid
*unixid
,
206 struct dom_sid
**sid
)
209 NTSTATUS status
= NT_STATUS_NONE_MAPPED
;
210 struct ldb_context
*ldb
= idmap_ctx
->ldb_ctx
;
211 struct ldb_result
*res
= NULL
;
212 struct ldb_message
*msg
;
213 const struct dom_sid
*unix_sid
;
214 struct dom_sid
*new_sid
;
215 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
218 const char *sam_attrs
[] = {"objectSid", NULL
};
221 * First check against our local DB, to see if this user has a
222 * mapping there. This means that the Samba4 AD DC behaves
223 * much like a winbindd member server running idmap_ad
226 switch (unixid
->type
) {
228 if (lpcfg_parm_bool(idmap_ctx
->lp_ctx
, NULL
, "idmap_ldb", "use rfc2307", false)) {
229 ret
= dsdb_search_one(idmap_ctx
->samdb
, tmp_ctx
, &msg
,
230 ldb_get_default_basedn(idmap_ctx
->samdb
),
233 "(&(|(sAMaccountType=%u)(sAMaccountType=%u)(sAMaccountType=%u))"
234 "(uidNumber=%u)(objectSid=*))",
235 ATYPE_ACCOUNT
, ATYPE_WORKSTATION_TRUST
, ATYPE_INTERDOMAIN_TRUST
, unixid
->id
);
237 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
238 ret
= LDB_ERR_NO_SUCH_OBJECT
;
241 if (ret
== LDB_ERR_CONSTRAINT_VIOLATION
) {
242 DEBUG(1, ("Search for uidNumber=%lu gave duplicate results, failing to map to a SID!\n",
243 (unsigned long)unixid
->id
));
244 status
= NT_STATUS_NONE_MAPPED
;
246 } else if (ret
== LDB_SUCCESS
) {
247 *sid
= samdb_result_dom_sid(mem_ctx
, msg
, "objectSid");
249 DEBUG(1, ("Search for uidNumber=%lu did not return an objectSid!\n",
250 (unsigned long)unixid
->id
));
251 status
= NT_STATUS_NONE_MAPPED
;
254 talloc_free(tmp_ctx
);
256 } else if (ret
!= LDB_ERR_NO_SUCH_OBJECT
) {
257 DEBUG(1, ("Search for uidNumber=%lu gave '%s', failing to map to a SID!\n",
258 (unsigned long)unixid
->id
, ldb_errstring(idmap_ctx
->samdb
)));
259 status
= NT_STATUS_NONE_MAPPED
;
263 id_type
= "ID_TYPE_UID";
266 if (lpcfg_parm_bool(idmap_ctx
->lp_ctx
, NULL
, "idmap_ldb", "use rfc2307", false)) {
267 ret
= dsdb_search_one(idmap_ctx
->samdb
, tmp_ctx
, &msg
,
268 ldb_get_default_basedn(idmap_ctx
->samdb
),
271 "(&(|(sAMaccountType=%u)(sAMaccountType=%u))(gidNumber=%u))",
272 ATYPE_SECURITY_GLOBAL_GROUP
, ATYPE_SECURITY_LOCAL_GROUP
,
275 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
276 ret
= LDB_ERR_NO_SUCH_OBJECT
;
278 if (ret
== LDB_ERR_CONSTRAINT_VIOLATION
) {
279 DEBUG(1, ("Search for gidNumber=%lu gave duplicate results, failing to map to a SID!\n",
280 (unsigned long)unixid
->id
));
281 status
= NT_STATUS_NONE_MAPPED
;
283 } else if (ret
== LDB_SUCCESS
) {
284 *sid
= samdb_result_dom_sid(mem_ctx
, msg
, "objectSid");
286 DEBUG(1, ("Search for gidNumber=%lu did not return an objectSid!\n",
287 (unsigned long)unixid
->id
));
288 status
= NT_STATUS_NONE_MAPPED
;
291 talloc_free(tmp_ctx
);
293 } else if (ret
!= LDB_ERR_NO_SUCH_OBJECT
) {
294 DEBUG(1, ("Search for gidNumber=%lu gave '%s', failing to map to a SID!\n",
295 (unsigned long)unixid
->id
, ldb_errstring(idmap_ctx
->samdb
)));
296 status
= NT_STATUS_NONE_MAPPED
;
300 id_type
= "ID_TYPE_GID";
303 DEBUG(1, ("unixid->type must be type gid or uid (got %u) for lookup with id %lu\n",
304 (unsigned)unixid
->type
, (unsigned long)unixid
->id
));
305 status
= NT_STATUS_NONE_MAPPED
;
309 ret
= ldb_search(ldb
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
310 NULL
, "(&(|(type=ID_TYPE_BOTH)(type=%s))"
311 "(xidNumber=%u))", id_type
, unixid
->id
);
312 if (ret
!= LDB_SUCCESS
) {
313 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb
)));
314 status
= NT_STATUS_NONE_MAPPED
;
318 if (res
->count
== 1) {
319 const char *type
= ldb_msg_find_attr_as_string(res
->msgs
[0],
322 *sid
= idmap_msg_get_dom_sid(mem_ctx
, res
->msgs
[0],
325 DEBUG(1, ("Failed to get sid from db: %u\n", ret
));
326 status
= NT_STATUS_NONE_MAPPED
;
331 DEBUG(1, ("Invalid type for mapping entry.\n"));
332 talloc_free(tmp_ctx
);
333 return NT_STATUS_NONE_MAPPED
;
336 if (strcmp(type
, "ID_TYPE_BOTH") == 0) {
337 unixid
->type
= ID_TYPE_BOTH
;
338 } else if (strcmp(type
, "ID_TYPE_UID") == 0) {
339 unixid
->type
= ID_TYPE_UID
;
341 unixid
->type
= ID_TYPE_GID
;
344 talloc_free(tmp_ctx
);
348 DEBUG(6, ("xid not found in idmap db, create S-1-22- SID.\n"));
350 /* For local users/groups , we just create a rid = uid/gid */
351 if (unixid
->type
== ID_TYPE_UID
) {
352 unix_sid
= &global_sid_Unix_Users
;
354 unix_sid
= &global_sid_Unix_Groups
;
357 new_sid
= dom_sid_add_rid(mem_ctx
, unix_sid
, unixid
->id
);
358 if (new_sid
== NULL
) {
359 status
= NT_STATUS_NO_MEMORY
;
364 talloc_free(tmp_ctx
);
368 talloc_free(tmp_ctx
);
374 * Map a SID to an unixid struct.
376 * If no mapping exists, a new mapping will be created.
378 * \param idmap_ctx idmap context to use
379 * \param mem_ctx talloc context to use
380 * \param sid SID to map to an unixid struct
381 * \param unixid pointer to a unixid struct
382 * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
383 * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
386 static NTSTATUS
idmap_sid_to_xid(struct idmap_context
*idmap_ctx
,
388 const struct dom_sid
*sid
,
389 struct unixid
*unixid
)
392 NTSTATUS status
= NT_STATUS_NONE_MAPPED
;
393 struct ldb_context
*ldb
= idmap_ctx
->ldb_ctx
;
395 struct ldb_message
*hwm_msg
, *map_msg
, *sam_msg
;
396 struct ldb_result
*res
= NULL
;
398 uint32_t low
, high
, hwm
, new_xid
;
399 char *sid_string
, *unixid_string
, *hwm_string
;
400 bool hwm_entry_exists
;
401 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
402 const char *sam_attrs
[] = {"uidNumber", "gidNumber", "samAccountType", NULL
};
404 if (sid_check_is_in_unix_users(sid
)) {
406 DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
407 status
= dom_sid_split_rid(tmp_ctx
, sid
, NULL
, &rid
);
408 if (!NT_STATUS_IS_OK(status
)) {
409 talloc_free(tmp_ctx
);
414 unixid
->type
= ID_TYPE_UID
;
416 talloc_free(tmp_ctx
);
420 if (sid_check_is_in_unix_groups(sid
)) {
422 DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
423 status
= dom_sid_split_rid(tmp_ctx
, sid
, NULL
, &rid
);
424 if (!NT_STATUS_IS_OK(status
)) {
425 talloc_free(tmp_ctx
);
430 unixid
->type
= ID_TYPE_GID
;
432 talloc_free(tmp_ctx
);
437 * First check against our local DB, to see if this user has a
438 * mapping there. This means that the Samba4 AD DC behaves
439 * much like a winbindd member server running idmap_ad
442 if (lpcfg_parm_bool(idmap_ctx
->lp_ctx
, NULL
, "idmap_ldb", "use rfc2307", false)) {
443 ret
= dsdb_search_one(idmap_ctx
->samdb
, tmp_ctx
, &sam_msg
,
444 ldb_get_default_basedn(idmap_ctx
->samdb
),
445 LDB_SCOPE_SUBTREE
, sam_attrs
, 0,
447 "(|(sAMaccountType=%u)(sAMaccountType=%u)(sAMaccountType=%u)"
448 "(sAMaccountType=%u)(sAMaccountType=%u))"
449 "(|(uidNumber=*)(gidNumber=*)))",
450 dom_sid_string(tmp_ctx
, sid
),
451 ATYPE_ACCOUNT
, ATYPE_WORKSTATION_TRUST
, ATYPE_INTERDOMAIN_TRUST
,
452 ATYPE_SECURITY_GLOBAL_GROUP
, ATYPE_SECURITY_LOCAL_GROUP
);
454 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
455 ret
= LDB_ERR_NO_SUCH_OBJECT
;
458 if (ret
== LDB_ERR_CONSTRAINT_VIOLATION
) {
459 DEBUG(1, ("Search for objectSid=%s gave duplicate results, failing to map to a unix ID!\n",
460 dom_sid_string(tmp_ctx
, sid
)));
461 status
= NT_STATUS_NONE_MAPPED
;
463 } else if (ret
== LDB_SUCCESS
) {
464 uint32_t account_type
= ldb_msg_find_attr_as_uint(sam_msg
, "sAMaccountType", 0);
465 if ((account_type
== ATYPE_ACCOUNT
) ||
466 (account_type
== ATYPE_WORKSTATION_TRUST
) ||
467 (account_type
== ATYPE_INTERDOMAIN_TRUST
))
469 const struct ldb_val
*v
= ldb_msg_find_ldb_val(sam_msg
, "uidNumber");
471 unixid
->type
= ID_TYPE_UID
;
472 unixid
->id
= ldb_msg_find_attr_as_uint(sam_msg
, "uidNumber", -1);
473 talloc_free(tmp_ctx
);
477 } else if ((account_type
== ATYPE_SECURITY_GLOBAL_GROUP
) ||
478 (account_type
== ATYPE_SECURITY_LOCAL_GROUP
))
480 const struct ldb_val
*v
= ldb_msg_find_ldb_val(sam_msg
, "gidNumber");
482 unixid
->type
= ID_TYPE_GID
;
483 unixid
->id
= ldb_msg_find_attr_as_uint(sam_msg
, "gidNumber", -1);
484 talloc_free(tmp_ctx
);
488 } else if (ret
!= LDB_ERR_NO_SUCH_OBJECT
) {
489 DEBUG(1, ("Search for objectSid=%s gave '%s', failing to map to a SID!\n",
490 dom_sid_string(tmp_ctx
, sid
), ldb_errstring(idmap_ctx
->samdb
)));
492 status
= NT_STATUS_NONE_MAPPED
;
496 ret
= ldb_search(ldb
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
497 NULL
, "(&(objectClass=sidMap)(objectSid=%s))",
498 ldap_encode_ndr_dom_sid(tmp_ctx
, sid
));
499 if (ret
!= LDB_SUCCESS
) {
500 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb
)));
501 talloc_free(tmp_ctx
);
502 return NT_STATUS_NONE_MAPPED
;
505 if (res
->count
== 1) {
506 const char *type
= ldb_msg_find_attr_as_string(res
->msgs
[0],
508 new_xid
= ldb_msg_find_attr_as_uint(res
->msgs
[0], "xidNumber",
510 if (new_xid
== (uint32_t) -1) {
511 DEBUG(1, ("Invalid xid mapping.\n"));
512 talloc_free(tmp_ctx
);
513 return NT_STATUS_NONE_MAPPED
;
517 DEBUG(1, ("Invalid type for mapping entry.\n"));
518 talloc_free(tmp_ctx
);
519 return NT_STATUS_NONE_MAPPED
;
522 unixid
->id
= new_xid
;
524 if (strcmp(type
, "ID_TYPE_BOTH") == 0) {
525 unixid
->type
= ID_TYPE_BOTH
;
526 } else if (strcmp(type
, "ID_TYPE_UID") == 0) {
527 unixid
->type
= ID_TYPE_UID
;
529 unixid
->type
= ID_TYPE_GID
;
532 talloc_free(tmp_ctx
);
536 DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
538 trans
= ldb_transaction_start(ldb
);
539 if (trans
!= LDB_SUCCESS
) {
540 status
= NT_STATUS_NONE_MAPPED
;
544 /* Redo the search to make sure noone changed the mapping while we
546 ret
= ldb_search(ldb
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
547 NULL
, "(&(objectClass=sidMap)(objectSid=%s))",
548 ldap_encode_ndr_dom_sid(tmp_ctx
, sid
));
549 if (ret
!= LDB_SUCCESS
) {
550 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb
)));
551 status
= NT_STATUS_NONE_MAPPED
;
555 if (res
->count
> 0) {
556 DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
557 status
= NT_STATUS_RETRY
;
561 ret
= idmap_get_bounds(idmap_ctx
, &low
, &high
);
562 if (ret
!= LDB_SUCCESS
) {
563 status
= NT_STATUS_NONE_MAPPED
;
567 dn
= ldb_dn_new(tmp_ctx
, ldb
, "CN=CONFIG");
569 status
= NT_STATUS_NO_MEMORY
;
573 ret
= ldb_search(ldb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, NULL
, NULL
);
574 if (ret
!= LDB_SUCCESS
) {
575 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb
)));
576 status
= NT_STATUS_NONE_MAPPED
;
580 if (res
->count
!= 1) {
581 DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
582 status
= NT_STATUS_NONE_MAPPED
;
586 hwm
= ldb_msg_find_attr_as_uint(res
->msgs
[0], "xidNumber", -1);
587 if (hwm
== (uint32_t)-1) {
589 hwm_entry_exists
= false;
591 hwm_entry_exists
= true;
595 DEBUG(1, ("Out of xids to allocate.\n"));
596 status
= NT_STATUS_NONE_MAPPED
;
600 hwm_msg
= ldb_msg_new(tmp_ctx
);
601 if (hwm_msg
== NULL
) {
602 DEBUG(1, ("Out of memory when creating ldb_message\n"));
603 status
= NT_STATUS_NO_MEMORY
;
612 hwm_string
= talloc_asprintf(tmp_ctx
, "%u", hwm
);
613 if (hwm_string
== NULL
) {
614 status
= NT_STATUS_NO_MEMORY
;
618 sid_string
= dom_sid_string(tmp_ctx
, sid
);
619 if (sid_string
== NULL
) {
620 status
= NT_STATUS_NO_MEMORY
;
624 unixid_string
= talloc_asprintf(tmp_ctx
, "%u", new_xid
);
625 if (unixid_string
== NULL
) {
626 status
= NT_STATUS_NO_MEMORY
;
630 if (hwm_entry_exists
) {
631 struct ldb_message_element
*els
;
632 struct ldb_val
*vals
;
634 /* We're modifying the entry, not just adding a new one. */
635 els
= talloc_array(tmp_ctx
, struct ldb_message_element
, 2);
637 status
= NT_STATUS_NO_MEMORY
;
641 vals
= talloc_array(tmp_ctx
, struct ldb_val
, 2);
643 status
= NT_STATUS_NO_MEMORY
;
647 hwm_msg
->num_elements
= 2;
648 hwm_msg
->elements
= els
;
650 els
[0].num_values
= 1;
651 els
[0].values
= &vals
[0];
652 els
[0].flags
= LDB_FLAG_MOD_DELETE
;
653 els
[0].name
= talloc_strdup(tmp_ctx
, "xidNumber");
654 if (els
[0].name
== NULL
) {
655 status
= NT_STATUS_NO_MEMORY
;
659 els
[1].num_values
= 1;
660 els
[1].values
= &vals
[1];
661 els
[1].flags
= LDB_FLAG_MOD_ADD
;
662 els
[1].name
= els
[0].name
;
664 vals
[0].data
= (uint8_t *)unixid_string
;
665 vals
[0].length
= strlen(unixid_string
);
666 vals
[1].data
= (uint8_t *)hwm_string
;
667 vals
[1].length
= strlen(hwm_string
);
669 ret
= ldb_msg_add_empty(hwm_msg
, "xidNumber", LDB_FLAG_MOD_ADD
,
671 if (ret
!= LDB_SUCCESS
) {
672 status
= NT_STATUS_NONE_MAPPED
;
676 ret
= ldb_msg_add_string(hwm_msg
, "xidNumber", hwm_string
);
677 if (ret
!= LDB_SUCCESS
)
679 status
= NT_STATUS_NONE_MAPPED
;
684 ret
= ldb_modify(ldb
, hwm_msg
);
685 if (ret
!= LDB_SUCCESS
) {
686 DEBUG(1, ("Updating the xid high water mark failed: %s\n",
687 ldb_errstring(ldb
)));
688 status
= NT_STATUS_NONE_MAPPED
;
692 map_msg
= ldb_msg_new(tmp_ctx
);
693 if (map_msg
== NULL
) {
694 status
= NT_STATUS_NO_MEMORY
;
698 map_msg
->dn
= ldb_dn_new_fmt(tmp_ctx
, ldb
, "CN=%s", sid_string
);
699 if (map_msg
->dn
== NULL
) {
700 status
= NT_STATUS_NO_MEMORY
;
704 ret
= ldb_msg_add_string(map_msg
, "xidNumber", unixid_string
);
705 if (ret
!= LDB_SUCCESS
) {
706 status
= NT_STATUS_NONE_MAPPED
;
710 ret
= idmap_msg_add_dom_sid(idmap_ctx
, tmp_ctx
, map_msg
, "objectSid",
712 if (ret
!= LDB_SUCCESS
) {
713 status
= NT_STATUS_NONE_MAPPED
;
717 ret
= ldb_msg_add_string(map_msg
, "objectClass", "sidMap");
718 if (ret
!= LDB_SUCCESS
) {
719 status
= NT_STATUS_NONE_MAPPED
;
723 ret
= ldb_msg_add_string(map_msg
, "type", "ID_TYPE_BOTH");
724 if (ret
!= LDB_SUCCESS
) {
725 status
= NT_STATUS_NONE_MAPPED
;
729 ret
= ldb_msg_add_string(map_msg
, "cn", sid_string
);
730 if (ret
!= LDB_SUCCESS
) {
731 status
= NT_STATUS_NONE_MAPPED
;
735 ret
= ldb_add(ldb
, map_msg
);
736 if (ret
!= LDB_SUCCESS
) {
737 DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb
)));
738 status
= NT_STATUS_NONE_MAPPED
;
742 trans
= ldb_transaction_commit(ldb
);
743 if (trans
!= LDB_SUCCESS
) {
744 DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb
)));
745 status
= NT_STATUS_NONE_MAPPED
;
749 unixid
->id
= new_xid
;
750 unixid
->type
= ID_TYPE_BOTH
;
751 talloc_free(tmp_ctx
);
755 if (trans
== LDB_SUCCESS
) ldb_transaction_cancel(ldb
);
756 talloc_free(tmp_ctx
);
761 * Convert an array of unixids to the corresponding array of SIDs
763 * \param idmap_ctx idmap context to use
764 * \param mem_ctx talloc context the memory for the dom_sids is allocated
766 * \param count length of id_mapping array.
767 * \param id array of id_mappings.
768 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
769 * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
773 NTSTATUS
idmap_xids_to_sids(struct idmap_context
*idmap_ctx
,
777 unsigned int i
, error_count
= 0;
780 for (i
= 0; id
&& id
[i
]; i
++) {
781 status
= idmap_xid_to_sid(idmap_ctx
, mem_ctx
,
782 &id
[i
]->xid
, &id
[i
]->sid
);
783 if (NT_STATUS_EQUAL(status
, NT_STATUS_RETRY
)) {
784 status
= idmap_xid_to_sid(idmap_ctx
, mem_ctx
,
788 if (!NT_STATUS_IS_OK(status
)) {
789 DEBUG(1, ("idmapping xid_to_sid failed for id[%d]=%lu: %s\n",
790 i
, (unsigned long)id
[i
]->xid
.id
, nt_errstr(status
)));
792 id
[i
]->status
= ID_UNMAPPED
;
794 id
[i
]->status
= ID_MAPPED
;
798 if (error_count
== i
) {
799 /* Mapping did not work at all. */
800 return NT_STATUS_NONE_MAPPED
;
801 } else if (error_count
> 0) {
802 /* Some mappings worked, some did not. */
803 return STATUS_SOME_UNMAPPED
;
810 * Convert an array of SIDs to the corresponding array of unixids
812 * \param idmap_ctx idmap context to use
813 * \param mem_ctx talloc context the memory for the unixids is allocated
815 * \param count length of id_mapping array.
816 * \param id array of id_mappings.
817 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
818 * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
822 NTSTATUS
idmap_sids_to_xids(struct idmap_context
*idmap_ctx
,
826 unsigned int i
, error_count
= 0;
829 for (i
= 0; id
&& id
[i
]; i
++) {
830 status
= idmap_sid_to_xid(idmap_ctx
, mem_ctx
,
831 id
[i
]->sid
, &id
[i
]->xid
);
832 if (NT_STATUS_EQUAL(status
, NT_STATUS_RETRY
)) {
833 status
= idmap_sid_to_xid(idmap_ctx
, mem_ctx
,
837 if (!NT_STATUS_IS_OK(status
)) {
838 char *str
= dom_sid_string(mem_ctx
, id
[i
]->sid
);
839 DEBUG(1, ("idmapping sid_to_xid failed for id[%d]=%s: %s\n",
840 i
, str
, nt_errstr(status
)));
843 id
[i
]->status
= ID_UNMAPPED
;
845 id
[i
]->status
= ID_MAPPED
;
849 if (error_count
== i
) {
850 /* Mapping did not work at all. */
851 return NT_STATUS_NONE_MAPPED
;
852 } else if (error_count
> 0) {
853 /* Some mappings worked, some did not. */
854 return STATUS_SOME_UNMAPPED
;