2 Unix SMB/CIFS implementation.
4 Map SIDs to unixids and back
6 Copyright (C) Kai Blin 2008
7 Copyright (C) Andrew Bartlett 2012
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "auth/auth.h"
25 #include "librpc/gen_ndr/ndr_security.h"
28 #include "param/param.h"
29 #include "winbind/idmap.h"
30 #include "libcli/security/security.h"
31 #include "libcli/ldap/ldap_ndr.h"
32 #include "dsdb/samdb/samdb.h"
33 #include "../libds/common/flags.h"
36 * Get uid/gid bounds from idmap database
38 * \param idmap_ctx idmap context to use
39 * \param low lower uid/gid bound is stored here
40 * \param high upper uid/gid bound is stored here
41 * \return 0 on success, nonzero on failure
43 static int idmap_get_bounds(struct idmap_context
*idmap_ctx
, uint32_t *low
,
47 struct ldb_context
*ldb
= idmap_ctx
->ldb_ctx
;
49 struct ldb_result
*res
= NULL
;
50 TALLOC_CTX
*tmp_ctx
= talloc_new(idmap_ctx
);
51 uint32_t lower_bound
= (uint32_t) -1;
52 uint32_t upper_bound
= (uint32_t) -1;
54 dn
= ldb_dn_new(tmp_ctx
, ldb
, "CN=CONFIG");
55 if (dn
== NULL
) goto failed
;
57 ret
= ldb_search(ldb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, NULL
, NULL
);
58 if (ret
!= LDB_SUCCESS
) goto failed
;
60 if (res
->count
!= 1) {
65 lower_bound
= ldb_msg_find_attr_as_uint(res
->msgs
[0], "lowerBound", -1);
66 if (lower_bound
!= (uint32_t) -1) {
73 upper_bound
= ldb_msg_find_attr_as_uint(res
->msgs
[0], "upperBound", -1);
74 if (upper_bound
!= (uint32_t) -1) {
88 * Add a dom_sid structure to a ldb_message
89 * \param idmap_ctx idmap context to use
90 * \param mem_ctx talloc context to use
91 * \param ldb_message ldb message to add dom_sid to
92 * \param attr_name name of the attribute to store the dom_sid in
93 * \param sid dom_sid to store
94 * \return 0 on success, an ldb error code on failure.
96 static int idmap_msg_add_dom_sid(struct idmap_context
*idmap_ctx
,
97 TALLOC_CTX
*mem_ctx
, struct ldb_message
*msg
,
98 const char *attr_name
, const struct dom_sid
*sid
)
101 enum ndr_err_code ndr_err
;
103 ndr_err
= ndr_push_struct_blob(&val
, mem_ctx
, sid
,
104 (ndr_push_flags_fn_t
)ndr_push_dom_sid
);
106 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
110 return ldb_msg_add_value(msg
, attr_name
, &val
, NULL
);
114 * Get a dom_sid structure from a ldb message.
116 * \param mem_ctx talloc context to allocate dom_sid memory in
117 * \param msg ldb_message to get dom_sid from
118 * \param attr_name key that has the dom_sid as data
119 * \return dom_sid structure on success, NULL on failure
121 static struct dom_sid
*idmap_msg_get_dom_sid(TALLOC_CTX
*mem_ctx
,
122 struct ldb_message
*msg
, const char *attr_name
)
125 const struct ldb_val
*val
;
126 enum ndr_err_code ndr_err
;
128 val
= ldb_msg_find_ldb_val(msg
, attr_name
);
133 sid
= talloc(mem_ctx
, struct dom_sid
);
138 ndr_err
= ndr_pull_struct_blob(val
, sid
, sid
,
139 (ndr_pull_flags_fn_t
)ndr_pull_dom_sid
);
140 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
149 * Initialize idmap context
151 * talloc_free to close.
153 * \param mem_ctx talloc context to use.
154 * \return allocated idmap_context on success, NULL on error
156 struct idmap_context
*idmap_init(TALLOC_CTX
*mem_ctx
,
157 struct tevent_context
*ev_ctx
,
158 struct loadparm_context
*lp_ctx
)
160 struct idmap_context
*idmap_ctx
;
162 idmap_ctx
= talloc(mem_ctx
, struct idmap_context
);
163 if (idmap_ctx
== NULL
) {
167 idmap_ctx
->lp_ctx
= lp_ctx
;
169 idmap_ctx
->ldb_ctx
= ldb_wrap_connect(mem_ctx
, ev_ctx
, lp_ctx
,
171 system_session(lp_ctx
),
173 if (idmap_ctx
->ldb_ctx
== NULL
) {
177 idmap_ctx
->unix_groups_sid
= dom_sid_parse_talloc(mem_ctx
, "S-1-22-2");
178 if (idmap_ctx
->unix_groups_sid
== NULL
) {
182 idmap_ctx
->unix_users_sid
= dom_sid_parse_talloc(mem_ctx
, "S-1-22-1");
183 if (idmap_ctx
->unix_users_sid
== NULL
) {
187 idmap_ctx
->samdb
= samdb_connect(idmap_ctx
, ev_ctx
, lp_ctx
, system_session(lp_ctx
), 0);
188 if (idmap_ctx
->samdb
== NULL
) {
189 DEBUG(0, ("Failed to load sam.ldb in idmap_init\n"));
197 * Convert an unixid to the corresponding SID
199 * \param idmap_ctx idmap context to use
200 * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
202 * \param unixid pointer to a unixid struct to convert
203 * \param sid pointer that will take the struct dom_sid pointer if the mapping
205 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
206 * possible or some other NTSTATUS that is more descriptive on failure.
209 static NTSTATUS
idmap_xid_to_sid(struct idmap_context
*idmap_ctx
,
211 struct unixid
*unixid
,
212 struct dom_sid
**sid
)
215 NTSTATUS status
= NT_STATUS_NONE_MAPPED
;
216 struct ldb_context
*ldb
= idmap_ctx
->ldb_ctx
;
217 struct ldb_result
*res
= NULL
;
218 struct ldb_message
*msg
;
219 struct dom_sid
*unix_sid
, *new_sid
;
220 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
223 const char *sam_attrs
[] = {"objectSid", NULL
};
226 * First check against our local DB, to see if this user has a
227 * mapping there. This means that the Samba4 AD DC behaves
228 * much like a winbindd member server running idmap_ad
231 switch (unixid
->type
) {
233 if (lpcfg_parm_bool(idmap_ctx
->lp_ctx
, NULL
, "idmap_ldb", "use rfc2307", false)) {
234 ret
= dsdb_search_one(idmap_ctx
->samdb
, tmp_ctx
, &msg
,
235 ldb_get_default_basedn(idmap_ctx
->samdb
),
238 "(&(|(sAMaccountType=%u)(sAMaccountType=%u)(sAMaccountType=%u))"
239 "(uidNumber=%u)(objectSid=*))",
240 ATYPE_ACCOUNT
, ATYPE_WORKSTATION_TRUST
, ATYPE_INTERDOMAIN_TRUST
, unixid
->id
);
242 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
243 ret
= LDB_ERR_NO_SUCH_OBJECT
;
246 if (ret
== LDB_ERR_CONSTRAINT_VIOLATION
) {
247 DEBUG(1, ("Search for uidNumber=%lu gave duplicate results, failing to map to a SID!\n",
248 (unsigned long)unixid
->id
));
249 status
= NT_STATUS_NONE_MAPPED
;
251 } else if (ret
== LDB_SUCCESS
) {
252 *sid
= samdb_result_dom_sid(mem_ctx
, msg
, "objectSid");
254 DEBUG(1, ("Search for uidNumber=%lu did not return an objectSid!\n",
255 (unsigned long)unixid
->id
));
256 status
= NT_STATUS_NONE_MAPPED
;
259 talloc_free(tmp_ctx
);
261 } else if (ret
!= LDB_ERR_NO_SUCH_OBJECT
) {
262 DEBUG(1, ("Search for uidNumber=%lu gave '%s', failing to map to a SID!\n",
263 (unsigned long)unixid
->id
, ldb_errstring(idmap_ctx
->samdb
)));
264 status
= NT_STATUS_NONE_MAPPED
;
268 id_type
= "ID_TYPE_UID";
271 if (lpcfg_parm_bool(idmap_ctx
->lp_ctx
, NULL
, "idmap_ldb", "use rfc2307", false)) {
272 ret
= dsdb_search_one(idmap_ctx
->samdb
, tmp_ctx
, &msg
,
273 ldb_get_default_basedn(idmap_ctx
->samdb
),
276 "(&(|(sAMaccountType=%u)(sAMaccountType=%u))(gidNumber=%u))",
277 ATYPE_SECURITY_GLOBAL_GROUP
, ATYPE_SECURITY_LOCAL_GROUP
,
280 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
281 ret
= LDB_ERR_NO_SUCH_OBJECT
;
283 if (ret
== LDB_ERR_CONSTRAINT_VIOLATION
) {
284 DEBUG(1, ("Search for gidNumber=%lu gave duplicate results, failing to map to a SID!\n",
285 (unsigned long)unixid
->id
));
286 status
= NT_STATUS_NONE_MAPPED
;
288 } else if (ret
== LDB_SUCCESS
) {
289 *sid
= samdb_result_dom_sid(mem_ctx
, msg
, "objectSid");
291 DEBUG(1, ("Search for gidNumber=%lu did not return an objectSid!\n",
292 (unsigned long)unixid
->id
));
293 status
= NT_STATUS_NONE_MAPPED
;
296 talloc_free(tmp_ctx
);
298 } else if (ret
!= LDB_ERR_NO_SUCH_OBJECT
) {
299 DEBUG(1, ("Search for gidNumber=%lu gave '%s', failing to map to a SID!\n",
300 (unsigned long)unixid
->id
, ldb_errstring(idmap_ctx
->samdb
)));
301 status
= NT_STATUS_NONE_MAPPED
;
305 id_type
= "ID_TYPE_GID";
308 DEBUG(1, ("unixid->type must be type gid or uid (got %u) for lookup with id %lu\n",
309 (unsigned)unixid
->type
, (unsigned long)unixid
->id
));
310 status
= NT_STATUS_NONE_MAPPED
;
314 ret
= ldb_search(ldb
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
315 NULL
, "(&(|(type=ID_TYPE_BOTH)(type=%s))"
316 "(xidNumber=%u))", id_type
, unixid
->id
);
317 if (ret
!= LDB_SUCCESS
) {
318 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb
)));
319 status
= NT_STATUS_NONE_MAPPED
;
323 if (res
->count
== 1) {
324 const char *type
= ldb_msg_find_attr_as_string(res
->msgs
[0],
327 *sid
= idmap_msg_get_dom_sid(mem_ctx
, res
->msgs
[0],
330 DEBUG(1, ("Failed to get sid from db: %u\n", ret
));
331 status
= NT_STATUS_NONE_MAPPED
;
336 DEBUG(1, ("Invalid type for mapping entry.\n"));
337 talloc_free(tmp_ctx
);
338 return NT_STATUS_NONE_MAPPED
;
341 if (strcmp(type
, "ID_TYPE_BOTH") == 0) {
342 unixid
->type
= ID_TYPE_BOTH
;
343 } else if (strcmp(type
, "ID_TYPE_UID") == 0) {
344 unixid
->type
= ID_TYPE_UID
;
346 unixid
->type
= ID_TYPE_GID
;
349 talloc_free(tmp_ctx
);
353 DEBUG(6, ("xid not found in idmap db, create S-1-22- SID.\n"));
355 /* For local users/groups , we just create a rid = uid/gid */
356 if (unixid
->type
== ID_TYPE_UID
) {
357 unix_sid
= dom_sid_parse_talloc(tmp_ctx
, "S-1-22-1");
359 unix_sid
= dom_sid_parse_talloc(tmp_ctx
, "S-1-22-2");
361 if (unix_sid
== NULL
) {
362 status
= NT_STATUS_NO_MEMORY
;
366 new_sid
= dom_sid_add_rid(mem_ctx
, unix_sid
, unixid
->id
);
367 if (new_sid
== NULL
) {
368 status
= NT_STATUS_NO_MEMORY
;
373 talloc_free(tmp_ctx
);
377 talloc_free(tmp_ctx
);
383 * Map a SID to an unixid struct.
385 * If no mapping exists, a new mapping will be created.
387 * \param idmap_ctx idmap context to use
388 * \param mem_ctx talloc context to use
389 * \param sid SID to map to an unixid struct
390 * \param unixid pointer to a unixid struct
391 * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
392 * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
395 static NTSTATUS
idmap_sid_to_xid(struct idmap_context
*idmap_ctx
,
397 const struct dom_sid
*sid
,
398 struct unixid
*unixid
)
401 NTSTATUS status
= NT_STATUS_NONE_MAPPED
;
402 struct ldb_context
*ldb
= idmap_ctx
->ldb_ctx
;
404 struct ldb_message
*hwm_msg
, *map_msg
, *sam_msg
;
405 struct ldb_result
*res
= NULL
;
407 uint32_t low
, high
, hwm
, new_xid
;
408 char *sid_string
, *unixid_string
, *hwm_string
;
409 bool hwm_entry_exists
;
410 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
411 const char *sam_attrs
[] = {"uidNumber", "gidNumber", "samAccountType", NULL
};
413 if (dom_sid_in_domain(idmap_ctx
->unix_users_sid
, sid
)) {
415 DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
416 status
= dom_sid_split_rid(tmp_ctx
, sid
, NULL
, &rid
);
417 if (!NT_STATUS_IS_OK(status
)) {
418 talloc_free(tmp_ctx
);
423 unixid
->type
= ID_TYPE_UID
;
425 talloc_free(tmp_ctx
);
429 if (dom_sid_in_domain(idmap_ctx
->unix_groups_sid
, sid
)) {
431 DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
432 status
= dom_sid_split_rid(tmp_ctx
, sid
, NULL
, &rid
);
433 if (!NT_STATUS_IS_OK(status
)) {
434 talloc_free(tmp_ctx
);
439 unixid
->type
= ID_TYPE_GID
;
441 talloc_free(tmp_ctx
);
446 * First check against our local DB, to see if this user has a
447 * mapping there. This means that the Samba4 AD DC behaves
448 * much like a winbindd member server running idmap_ad
451 if (lpcfg_parm_bool(idmap_ctx
->lp_ctx
, NULL
, "idmap_ldb", "use rfc2307", false)) {
452 ret
= dsdb_search_one(idmap_ctx
->samdb
, tmp_ctx
, &sam_msg
,
453 ldb_get_default_basedn(idmap_ctx
->samdb
),
454 LDB_SCOPE_SUBTREE
, sam_attrs
, 0,
456 "(|(sAMaccountType=%u)(sAMaccountType=%u)(sAMaccountType=%u)"
457 "(sAMaccountType=%u)(sAMaccountType=%u))"
458 "(|(uidNumber=*)(gidNumber=*)))",
459 dom_sid_string(tmp_ctx
, sid
),
460 ATYPE_ACCOUNT
, ATYPE_WORKSTATION_TRUST
, ATYPE_INTERDOMAIN_TRUST
,
461 ATYPE_SECURITY_GLOBAL_GROUP
, ATYPE_SECURITY_LOCAL_GROUP
);
463 /* If we are not to use the rfc2307 attributes, we just emulate a non-match */
464 ret
= LDB_ERR_NO_SUCH_OBJECT
;
467 if (ret
== LDB_ERR_CONSTRAINT_VIOLATION
) {
468 DEBUG(1, ("Search for objectSid=%s gave duplicate results, failing to map to a unix ID!\n",
469 dom_sid_string(tmp_ctx
, sid
)));
470 status
= NT_STATUS_NONE_MAPPED
;
472 } else if (ret
== LDB_SUCCESS
) {
473 uint32_t account_type
= ldb_msg_find_attr_as_uint(sam_msg
, "sAMaccountType", 0);
474 if ((account_type
== ATYPE_ACCOUNT
) ||
475 (account_type
== ATYPE_WORKSTATION_TRUST
) ||
476 (account_type
== ATYPE_INTERDOMAIN_TRUST
))
478 const struct ldb_val
*v
= ldb_msg_find_ldb_val(sam_msg
, "uidNumber");
480 unixid
->type
= ID_TYPE_UID
;
481 unixid
->id
= ldb_msg_find_attr_as_uint(sam_msg
, "uidNumber", -1);
482 talloc_free(tmp_ctx
);
486 } else if ((account_type
== ATYPE_SECURITY_GLOBAL_GROUP
) ||
487 (account_type
== ATYPE_SECURITY_LOCAL_GROUP
))
489 const struct ldb_val
*v
= ldb_msg_find_ldb_val(sam_msg
, "gidNumber");
491 unixid
->type
= ID_TYPE_GID
;
492 unixid
->id
= ldb_msg_find_attr_as_uint(sam_msg
, "gidNumber", -1);
493 talloc_free(tmp_ctx
);
497 } else if (ret
!= LDB_ERR_NO_SUCH_OBJECT
) {
498 DEBUG(1, ("Search for objectSid=%s gave '%s', failing to map to a SID!\n",
499 dom_sid_string(tmp_ctx
, sid
), ldb_errstring(idmap_ctx
->samdb
)));
501 status
= NT_STATUS_NONE_MAPPED
;
505 ret
= ldb_search(ldb
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
506 NULL
, "(&(objectClass=sidMap)(objectSid=%s))",
507 ldap_encode_ndr_dom_sid(tmp_ctx
, sid
));
508 if (ret
!= LDB_SUCCESS
) {
509 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb
)));
510 talloc_free(tmp_ctx
);
511 return NT_STATUS_NONE_MAPPED
;
514 if (res
->count
== 1) {
515 const char *type
= ldb_msg_find_attr_as_string(res
->msgs
[0],
517 new_xid
= ldb_msg_find_attr_as_uint(res
->msgs
[0], "xidNumber",
519 if (new_xid
== (uint32_t) -1) {
520 DEBUG(1, ("Invalid xid mapping.\n"));
521 talloc_free(tmp_ctx
);
522 return NT_STATUS_NONE_MAPPED
;
526 DEBUG(1, ("Invalid type for mapping entry.\n"));
527 talloc_free(tmp_ctx
);
528 return NT_STATUS_NONE_MAPPED
;
531 unixid
->id
= new_xid
;
533 if (strcmp(type
, "ID_TYPE_BOTH") == 0) {
534 unixid
->type
= ID_TYPE_BOTH
;
535 } else if (strcmp(type
, "ID_TYPE_UID") == 0) {
536 unixid
->type
= ID_TYPE_UID
;
538 unixid
->type
= ID_TYPE_GID
;
541 talloc_free(tmp_ctx
);
545 DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
547 trans
= ldb_transaction_start(ldb
);
548 if (trans
!= LDB_SUCCESS
) {
549 status
= NT_STATUS_NONE_MAPPED
;
553 /* Redo the search to make sure noone changed the mapping while we
555 ret
= ldb_search(ldb
, tmp_ctx
, &res
, NULL
, LDB_SCOPE_SUBTREE
,
556 NULL
, "(&(objectClass=sidMap)(objectSid=%s))",
557 ldap_encode_ndr_dom_sid(tmp_ctx
, sid
));
558 if (ret
!= LDB_SUCCESS
) {
559 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb
)));
560 status
= NT_STATUS_NONE_MAPPED
;
564 if (res
->count
> 0) {
565 DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
566 status
= NT_STATUS_RETRY
;
570 ret
= idmap_get_bounds(idmap_ctx
, &low
, &high
);
571 if (ret
!= LDB_SUCCESS
) {
572 status
= NT_STATUS_NONE_MAPPED
;
576 dn
= ldb_dn_new(tmp_ctx
, ldb
, "CN=CONFIG");
578 status
= NT_STATUS_NO_MEMORY
;
582 ret
= ldb_search(ldb
, tmp_ctx
, &res
, dn
, LDB_SCOPE_BASE
, NULL
, NULL
);
583 if (ret
!= LDB_SUCCESS
) {
584 DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb
)));
585 status
= NT_STATUS_NONE_MAPPED
;
589 if (res
->count
!= 1) {
590 DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
591 status
= NT_STATUS_NONE_MAPPED
;
595 hwm
= ldb_msg_find_attr_as_uint(res
->msgs
[0], "xidNumber", -1);
596 if (hwm
== (uint32_t)-1) {
598 hwm_entry_exists
= false;
600 hwm_entry_exists
= true;
604 DEBUG(1, ("Out of xids to allocate.\n"));
605 status
= NT_STATUS_NONE_MAPPED
;
609 hwm_msg
= ldb_msg_new(tmp_ctx
);
610 if (hwm_msg
== NULL
) {
611 DEBUG(1, ("Out of memory when creating ldb_message\n"));
612 status
= NT_STATUS_NO_MEMORY
;
621 hwm_string
= talloc_asprintf(tmp_ctx
, "%u", hwm
);
622 if (hwm_string
== NULL
) {
623 status
= NT_STATUS_NO_MEMORY
;
627 sid_string
= dom_sid_string(tmp_ctx
, sid
);
628 if (sid_string
== NULL
) {
629 status
= NT_STATUS_NO_MEMORY
;
633 unixid_string
= talloc_asprintf(tmp_ctx
, "%u", new_xid
);
634 if (unixid_string
== NULL
) {
635 status
= NT_STATUS_NO_MEMORY
;
639 if (hwm_entry_exists
) {
640 struct ldb_message_element
*els
;
641 struct ldb_val
*vals
;
643 /* We're modifying the entry, not just adding a new one. */
644 els
= talloc_array(tmp_ctx
, struct ldb_message_element
, 2);
646 status
= NT_STATUS_NO_MEMORY
;
650 vals
= talloc_array(tmp_ctx
, struct ldb_val
, 2);
652 status
= NT_STATUS_NO_MEMORY
;
656 hwm_msg
->num_elements
= 2;
657 hwm_msg
->elements
= els
;
659 els
[0].num_values
= 1;
660 els
[0].values
= &vals
[0];
661 els
[0].flags
= LDB_FLAG_MOD_DELETE
;
662 els
[0].name
= talloc_strdup(tmp_ctx
, "xidNumber");
663 if (els
[0].name
== NULL
) {
664 status
= NT_STATUS_NO_MEMORY
;
668 els
[1].num_values
= 1;
669 els
[1].values
= &vals
[1];
670 els
[1].flags
= LDB_FLAG_MOD_ADD
;
671 els
[1].name
= els
[0].name
;
673 vals
[0].data
= (uint8_t *)unixid_string
;
674 vals
[0].length
= strlen(unixid_string
);
675 vals
[1].data
= (uint8_t *)hwm_string
;
676 vals
[1].length
= strlen(hwm_string
);
678 ret
= ldb_msg_add_empty(hwm_msg
, "xidNumber", LDB_FLAG_MOD_ADD
,
680 if (ret
!= LDB_SUCCESS
) {
681 status
= NT_STATUS_NONE_MAPPED
;
685 ret
= ldb_msg_add_string(hwm_msg
, "xidNumber", hwm_string
);
686 if (ret
!= LDB_SUCCESS
)
688 status
= NT_STATUS_NONE_MAPPED
;
693 ret
= ldb_modify(ldb
, hwm_msg
);
694 if (ret
!= LDB_SUCCESS
) {
695 DEBUG(1, ("Updating the xid high water mark failed: %s\n",
696 ldb_errstring(ldb
)));
697 status
= NT_STATUS_NONE_MAPPED
;
701 map_msg
= ldb_msg_new(tmp_ctx
);
702 if (map_msg
== NULL
) {
703 status
= NT_STATUS_NO_MEMORY
;
707 map_msg
->dn
= ldb_dn_new_fmt(tmp_ctx
, ldb
, "CN=%s", sid_string
);
708 if (map_msg
->dn
== NULL
) {
709 status
= NT_STATUS_NO_MEMORY
;
713 ret
= ldb_msg_add_string(map_msg
, "xidNumber", unixid_string
);
714 if (ret
!= LDB_SUCCESS
) {
715 status
= NT_STATUS_NONE_MAPPED
;
719 ret
= idmap_msg_add_dom_sid(idmap_ctx
, tmp_ctx
, map_msg
, "objectSid",
721 if (ret
!= LDB_SUCCESS
) {
722 status
= NT_STATUS_NONE_MAPPED
;
726 ret
= ldb_msg_add_string(map_msg
, "objectClass", "sidMap");
727 if (ret
!= LDB_SUCCESS
) {
728 status
= NT_STATUS_NONE_MAPPED
;
732 ret
= ldb_msg_add_string(map_msg
, "type", "ID_TYPE_BOTH");
733 if (ret
!= LDB_SUCCESS
) {
734 status
= NT_STATUS_NONE_MAPPED
;
738 ret
= ldb_msg_add_string(map_msg
, "cn", sid_string
);
739 if (ret
!= LDB_SUCCESS
) {
740 status
= NT_STATUS_NONE_MAPPED
;
744 ret
= ldb_add(ldb
, map_msg
);
745 if (ret
!= LDB_SUCCESS
) {
746 DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb
)));
747 status
= NT_STATUS_NONE_MAPPED
;
751 trans
= ldb_transaction_commit(ldb
);
752 if (trans
!= LDB_SUCCESS
) {
753 DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb
)));
754 status
= NT_STATUS_NONE_MAPPED
;
758 unixid
->id
= new_xid
;
759 unixid
->type
= ID_TYPE_BOTH
;
760 talloc_free(tmp_ctx
);
764 if (trans
== LDB_SUCCESS
) ldb_transaction_cancel(ldb
);
765 talloc_free(tmp_ctx
);
770 * Convert an array of unixids to the corresponding array of SIDs
772 * \param idmap_ctx idmap context to use
773 * \param mem_ctx talloc context the memory for the dom_sids is allocated
775 * \param count length of id_mapping array.
776 * \param id array of id_mappings.
777 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
778 * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
782 NTSTATUS
idmap_xids_to_sids(struct idmap_context
*idmap_ctx
,
786 unsigned int i
, error_count
= 0;
789 for (i
= 0; id
&& id
[i
]; i
++) {
790 status
= idmap_xid_to_sid(idmap_ctx
, mem_ctx
,
791 &id
[i
]->xid
, &id
[i
]->sid
);
792 if (NT_STATUS_EQUAL(status
, NT_STATUS_RETRY
)) {
793 status
= idmap_xid_to_sid(idmap_ctx
, mem_ctx
,
797 if (!NT_STATUS_IS_OK(status
)) {
798 DEBUG(1, ("idmapping xid_to_sid failed for id[%d]=%lu: %s\n",
799 i
, (unsigned long)id
[i
]->xid
.id
, nt_errstr(status
)));
801 id
[i
]->status
= ID_UNMAPPED
;
803 id
[i
]->status
= ID_MAPPED
;
807 if (error_count
== i
) {
808 /* Mapping did not work at all. */
809 return NT_STATUS_NONE_MAPPED
;
810 } else if (error_count
> 0) {
811 /* Some mappings worked, some did not. */
812 return STATUS_SOME_UNMAPPED
;
819 * Convert an array of SIDs to the corresponding array of unixids
821 * \param idmap_ctx idmap context to use
822 * \param mem_ctx talloc context the memory for the unixids is allocated
824 * \param count length of id_mapping array.
825 * \param id array of id_mappings.
826 * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
827 * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
831 NTSTATUS
idmap_sids_to_xids(struct idmap_context
*idmap_ctx
,
835 unsigned int i
, error_count
= 0;
838 for (i
= 0; id
&& id
[i
]; i
++) {
839 status
= idmap_sid_to_xid(idmap_ctx
, mem_ctx
,
840 id
[i
]->sid
, &id
[i
]->xid
);
841 if (NT_STATUS_EQUAL(status
, NT_STATUS_RETRY
)) {
842 status
= idmap_sid_to_xid(idmap_ctx
, mem_ctx
,
846 if (!NT_STATUS_IS_OK(status
)) {
847 char *str
= dom_sid_string(mem_ctx
, id
[i
]->sid
);
848 DEBUG(1, ("idmapping sid_to_xid failed for id[%d]=%s: %s\n",
849 i
, str
, nt_errstr(status
)));
852 id
[i
]->status
= ID_UNMAPPED
;
854 id
[i
]->status
= ID_MAPPED
;
858 if (error_count
== i
) {
859 /* Mapping did not work at all. */
860 return NT_STATUS_NONE_MAPPED
;
861 } else if (error_count
> 0) {
862 /* Some mappings worked, some did not. */
863 return STATUS_SOME_UNMAPPED
;