source/nsswitch/winbindd_passdb.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind rpc backend functions
   5
   6    Copyright (C) Tim Potter 2000-2001,2003
   7    Copyright (C) Simo Sorce 2003
   8    Copyright (C) Volker Lendecke 2004
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27
  28 #undef DBGC_CLASS
  29 #define DBGC_CLASS DBGC_WINBIND
  30
  31 /* Query display info for a domain.  This returns enough information plus a
  32    bit extra to give an overview of domain users for the User Manager
  33    application. */
  34 static NTSTATUS query_user_list(struct winbindd_domain *domain,
  35                                TALLOC_CTX *mem_ctx,
  36                                uint32 *num_entries,
  37                                WINBIND_USERINFO **info)
  38 {
  39         /* We don't have users */
  40         *num_entries = 0;
  41         *info = NULL;
  42         return NT_STATUS_OK;
  43 }
  44
  45 /* list all domain groups */
  46 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
  47                                 TALLOC_CTX *mem_ctx,
  48                                 uint32 *num_entries,
  49                                 struct acct_info **info)
  50 {
  51         /* We don't have domain groups */
  52         *num_entries = 0;
  53         *info = NULL;
  54         return NT_STATUS_OK;
  55 }
  56
  57 /* List all domain groups */
  58
  59 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
  60                                 TALLOC_CTX *mem_ctx,
  61                                 uint32 *num_entries,
  62                                 struct acct_info **info)
  63 {
  64         struct pdb_search *search;
  65         struct samr_displayentry *aliases;
  66         int i;
  67         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
  68
  69         search = pdb_search_aliases(&domain->sid);
  70         if (search == NULL) goto done;
  71
  72         *num_entries = pdb_search_entries(search, 0, 0xffffffff, &aliases);
  73         if (*num_entries == 0) goto done;
  74
  75         *info = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
  76         if (*info == NULL) {
  77                 result = NT_STATUS_NO_MEMORY;
  78                 goto done;
  79         }
  80
  81         for (i=0; i<*num_entries; i++) {
  82                 fstrcpy((*info)[i].acct_name, aliases[i].account_name);
  83                 fstrcpy((*info)[i].acct_desc, aliases[i].description);
  84                 (*info)[i].rid = aliases[i].rid;
  85         }
  86
  87         result = NT_STATUS_OK;
  88  done:
  89         pdb_search_destroy(search);
  90         return result;
  91 }
  92
  93 /* convert a single name to a sid in a domain */
  94 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
  95                             TALLOC_CTX *mem_ctx,
  96                             const char *domain_name,
  97                             const char *name,
  98                             DOM_SID *sid,
  99                             enum lsa_SidType *type)
 100 {
 101         DEBUG(10, ("Finding name %s\n", name));
 102
 103         if ( !lookup_name( mem_ctx, name, LOOKUP_NAME_ALL,
 104                 NULL, NULL, sid, type ) )
 105         {
 106                 return NT_STATUS_NONE_MAPPED;
 107         }
 108
 109         return NT_STATUS_OK;
 110 }
 111
 112 /*
 113   convert a domain SID to a user or group name
 114 */
 115 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
 116                             TALLOC_CTX *mem_ctx,
 117                             const DOM_SID *sid,
 118                             char **domain_name,
 119                             char **name,
 120                             enum lsa_SidType *type)
 121 {
 122         const char *dom, *nam;
 123
 124         DEBUG(10, ("Converting SID %s\n", sid_string_static(sid)));
 125
 126         /* Paranoia check */
 127         if (!sid_check_is_in_builtin(sid) &&
 128             !sid_check_is_in_our_domain(sid) &&
 129             !sid_check_is_in_unix_users(sid) &&
 130             !sid_check_is_unix_users(sid) &&
 131             !sid_check_is_in_unix_groups(sid) &&
 132             !sid_check_is_unix_groups(sid) )
 133         {
 134                 DEBUG(0, ("Possible deadlock: Trying to lookup SID %s with "
 135                           "passdb backend\n", sid_string_static(sid)));
 136                 return NT_STATUS_NONE_MAPPED;
 137         }
 138
 139         if (!lookup_sid(mem_ctx, sid, &dom, &nam, type)) {
 140                 return NT_STATUS_NONE_MAPPED;
 141         }
 142
 143         *domain_name = talloc_strdup(mem_ctx, dom);
 144         *name = talloc_strdup(mem_ctx, nam);
 145
 146         return NT_STATUS_OK;
 147 }
 148
 149 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
 150                               TALLOC_CTX *mem_ctx,
 151                               const DOM_SID *sid,
 152                               uint32 *rids,
 153                               size_t num_rids,
 154                               char **domain_name,
 155                               char ***names,
 156                               enum lsa_SidType **types)
 157 {
 158         return NT_STATUS_UNSUCCESSFUL;
 159 }
 160
 161 /* Lookup user information from a rid or username. */
 162 static NTSTATUS query_user(struct winbindd_domain *domain,
 163                            TALLOC_CTX *mem_ctx,
 164                            const DOM_SID *user_sid,
 165                            WINBIND_USERINFO *user_info)
 166 {
 167         return NT_STATUS_NO_SUCH_USER;
 168 }
 169
 170 /* Lookup groups a user is a member of.  I wish Unix had a call like this! */
 171 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 172                                   TALLOC_CTX *mem_ctx,
 173                                   const DOM_SID *user_sid,
 174                                   uint32 *num_groups, DOM_SID **user_gids)
 175 {
 176         NTSTATUS result;
 177         DOM_SID *groups = NULL;
 178         gid_t *gids = NULL;
 179         size_t ngroups = 0;
 180         struct samu *user;
 181
 182         if ( (user = samu_new(mem_ctx)) == NULL ) {
 183                 return NT_STATUS_NO_MEMORY;
 184         }
 185
 186         if ( !pdb_getsampwsid( user, user_sid ) ) {
 187                 return NT_STATUS_NO_SUCH_USER;
 188         }
 189
 190         result = pdb_enum_group_memberships( mem_ctx, user, &groups, &gids, &ngroups );
 191
 192         TALLOC_FREE( user );
 193
 194         *num_groups = (uint32)ngroups;
 195         *user_gids = groups;
 196
 197         return result;
 198 }
 199
 200 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
 201                                    TALLOC_CTX *mem_ctx,
 202                                    uint32 num_sids, const DOM_SID *sids,
 203                                    uint32 *p_num_aliases, uint32 **rids)
 204 {
 205         NTSTATUS result;
 206         size_t num_aliases = 0;
 207
 208         result = pdb_enum_alias_memberships(mem_ctx, &domain->sid,
 209                                             sids, num_sids, rids, &num_aliases);
 210
 211         *p_num_aliases = num_aliases;
 212         return result;
 213 }
 214
 215 /* Lookup group membership given a rid.   */
 216 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 217                                 TALLOC_CTX *mem_ctx,
 218                                 const DOM_SID *group_sid, uint32 *num_names,
 219                                 DOM_SID **sid_mem, char ***names,
 220                                 uint32 **name_types)
 221 {
 222         size_t i, num_members, num_mapped;
 223         uint32 *rids;
 224         NTSTATUS result;
 225         const DOM_SID **sids;
 226         struct lsa_dom_info *lsa_domains;
 227         struct lsa_name_info *lsa_names;
 228         TALLOC_CTX *tmp_ctx;
 229
 230         if (!sid_check_is_in_our_domain(group_sid)) {
 231                 /* There's no groups, only aliases in BUILTIN */
 232                 return NT_STATUS_NO_SUCH_GROUP;
 233         }
 234
 235         if (!(tmp_ctx = talloc_init("lookup_groupmem"))) {
 236                 return NT_STATUS_NO_MEMORY;
 237         }
 238
 239         result = pdb_enum_group_members(tmp_ctx, group_sid, &rids,
 240                                         &num_members);
 241         if (!NT_STATUS_IS_OK(result)) {
 242                 TALLOC_FREE(tmp_ctx);
 243                 return result;
 244         }
 245
 246         if (num_members == 0) {
 247                 *num_names = 0;
 248                 *sid_mem = NULL;
 249                 *names = NULL;
 250                 *name_types = NULL;
 251                 TALLOC_FREE(tmp_ctx);
 252                 return NT_STATUS_OK;
 253         }
 254
 255         *sid_mem = TALLOC_ARRAY(mem_ctx, DOM_SID, num_members);
 256         *names = TALLOC_ARRAY(mem_ctx, char *, num_members);
 257         *name_types = TALLOC_ARRAY(mem_ctx, uint32, num_members);
 258         sids = TALLOC_ARRAY(tmp_ctx, const DOM_SID *, num_members);
 259
 260         if (((*sid_mem) == NULL) || ((*names) == NULL) ||
 261             ((*name_types) == NULL) || (sids == NULL)) {
 262                 TALLOC_FREE(tmp_ctx);
 263                 return NT_STATUS_NO_MEMORY;
 264         }
 265
 266         /*
 267          * Prepare an array of sid pointers for the lookup_sids calling
 268          * convention.
 269          */
 270
 271         for (i=0; i<num_members; i++) {
 272                 DOM_SID *sid = &((*sid_mem)[i]);
 273                 if (!sid_compose(sid, &domain->sid, rids[i])) {
 274                         TALLOC_FREE(tmp_ctx);
 275                         return NT_STATUS_INTERNAL_ERROR;
 276                 }
 277                 sids[i] = sid;
 278         }
 279
 280         result = lookup_sids(tmp_ctx, num_members, sids, 1,
 281                              &lsa_domains, &lsa_names);
 282         if (!NT_STATUS_IS_OK(result)) {
 283                 TALLOC_FREE(tmp_ctx);
 284                 return result;
 285         }
 286
 287         num_mapped = 0;
 288         for (i=0; i<num_members; i++) {
 289                 if (lsa_names[i].type != SID_NAME_USER) {
 290                         DEBUG(2, ("Got %s as group member -- ignoring\n",
 291                                   sid_type_lookup(lsa_names[i].type)));
 292                         continue;
 293                 }
 294                 if (!((*names)[i] = talloc_strdup((*names),
 295                                                   lsa_names[i].name))) {
 296                         TALLOC_FREE(tmp_ctx);
 297                         return NT_STATUS_NO_MEMORY;
 298                 }
 299
 300                 (*name_types)[i] = lsa_names[i].type;
 301
 302                 num_mapped += 1;
 303         }
 304
 305         *num_names = num_mapped;
 306
 307         TALLOC_FREE(tmp_ctx);
 308         return NT_STATUS_OK;
 309 }
 310
 311 /* find the sequence number for a domain */
 312 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
 313 {
 314         BOOL result;
 315         time_t seq_num;
 316
 317         result = pdb_get_seq_num(&seq_num);
 318         if (!result) {
 319                 *seq = 1;
 320         }
 321
 322         *seq = (int) seq_num;
 323         /* *seq = 1; */
 324         return NT_STATUS_OK;
 325 }
 326
 327 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
 328                                TALLOC_CTX *mem_ctx,
 329                                SAM_UNK_INFO_12 *policy)
 330 {
 331         /* actually we have that */
 332         return NT_STATUS_NOT_IMPLEMENTED;
 333 }
 334
 335 static NTSTATUS password_policy(struct winbindd_domain *domain,
 336                                 TALLOC_CTX *mem_ctx,
 337                                 SAM_UNK_INFO_1 *policy)
 338 {
 339         uint32 min_pass_len,pass_hist,password_properties;
 340         time_t u_expire, u_min_age;
 341         NTTIME nt_expire, nt_min_age;
 342         uint32 account_policy_temp;
 343
 344         if ((policy = TALLOC_ZERO_P(mem_ctx, SAM_UNK_INFO_1)) == NULL) {
 345                 return NT_STATUS_NO_MEMORY;
 346         }
 347
 348         if (!pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp)) {
 349                 return NT_STATUS_ACCESS_DENIED;
 350         }
 351         min_pass_len = account_policy_temp;
 352
 353         if (!pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp)) {
 354                 return NT_STATUS_ACCESS_DENIED;
 355         }
 356         pass_hist = account_policy_temp;
 357
 358         if (!pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp)) {
 359                 return NT_STATUS_ACCESS_DENIED;
 360         }
 361         password_properties = account_policy_temp;
 362
 363         if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp)) {
 364                 return NT_STATUS_ACCESS_DENIED;
 365         }
 366         u_expire = account_policy_temp;
 367
 368         if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp)) {
 369                 return NT_STATUS_ACCESS_DENIED;
 370         }
 371         u_min_age = account_policy_temp;
 372
 373         unix_to_nt_time_abs(&nt_expire, u_expire);
 374         unix_to_nt_time_abs(&nt_min_age, u_min_age);
 375
 376         init_unk_info1(policy, (uint16)min_pass_len, (uint16)pass_hist,
 377                        password_properties, nt_expire, nt_min_age);
 378
 379         return NT_STATUS_OK;
 380 }
 381
 382 /* get a list of trusted domains */
 383 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
 384                                 TALLOC_CTX *mem_ctx,
 385                                 uint32 *num_domains,
 386                                 char ***names,
 387                                 char ***alt_names,
 388                                 DOM_SID **dom_sids)
 389 {
 390         NTSTATUS nt_status;
 391         struct trustdom_info **domains;
 392         int i;
 393         TALLOC_CTX *tmp_ctx;
 394
 395         *num_domains = 0;
 396         *names = NULL;
 397         *alt_names = NULL;
 398         *dom_sids = NULL;
 399
 400         if (!(tmp_ctx = talloc_init("trusted_domains"))) {
 401                 return NT_STATUS_NO_MEMORY;
 402         }
 403
 404         nt_status = pdb_enum_trusteddoms(tmp_ctx, num_domains, &domains);
 405         if (!NT_STATUS_IS_OK(nt_status)) {
 406                 TALLOC_FREE(tmp_ctx);
 407                 return nt_status;
 408         }
 409
 410         if (*num_domains) {
 411                 *names = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
 412                 *alt_names = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
 413                 *dom_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
 414
 415                 if ((*alt_names == NULL) || (*names == NULL) || (*dom_sids == NULL)) {
 416                         TALLOC_FREE(tmp_ctx);
 417                         return NT_STATUS_NO_MEMORY;
 418                 }
 419         } else {
 420                 *names = NULL;
 421                 *alt_names = NULL;
 422                 *dom_sids = NULL;
 423         }
 424
 425         for (i=0; i<*num_domains; i++) {
 426                 (*alt_names)[i] = NULL;
 427                 if (!((*names)[i] = talloc_strdup((*names),
 428                                                   domains[i]->name))) {
 429                         TALLOC_FREE(tmp_ctx);
 430                         return NT_STATUS_NO_MEMORY;
 431                 }
 432                 sid_copy(&(*dom_sids)[i], &domains[i]->sid);
 433         }
 434
 435         TALLOC_FREE(tmp_ctx);
 436         return NT_STATUS_OK;
 437 }
 438
 439 /* the rpc backend methods are exposed via this structure */
 440 struct winbindd_methods passdb_methods = {
 441         False,
 442         query_user_list,
 443         enum_dom_groups,
 444         enum_local_groups,
 445         name_to_sid,
 446         sid_to_name,
 447         rids_to_names,
 448         query_user,
 449         lookup_usergroups,
 450         lookup_useraliases,
 451         lookup_groupmem,
 452         sequence_number,
 453         lockout_policy,
 454         password_policy,
 455         trusted_domains,
 456 };