?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
waf:lib/replace fix up libintl related checks
[Samba.git] / source3 / winbindd / idmap_ad.c
blobb92e3a976c93eb5248bcdbd9e082c4175476cdce
1 /*
2 * idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
3 *
4 * Unix SMB/CIFS implementation.
5 *
6 * Winbind ADS backend functions
7 *
8 * Copyright (C) Andrew Tridgell 2001
9 * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
10 * Copyright (C) Gerald (Jerry) Carter 2004-2007
11 * Copyright (C) Luke Howard 2001-2004
12 * Copyright (C) Michael Adam 2008,2010
13 *
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 3 of the License, or
17 * (at your option) any later version.
18 *
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
23 *
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 */
27
28 #include "includes.h"
29 #include "winbindd.h"
30 #include "../libds/common/flags.h"
31 #include "ads.h"
32 #include "libads/ldap_schema.h"
33 #include "nss_info.h"
34 #include "secrets.h"
35 #include "idmap.h"
36 #include "../libcli/ldap/ldap_ndr.h"
37 #include "../libcli/security/security.h"
38
39 #undef DBGC_CLASS
40 #define DBGC_CLASS DBGC_IDMAP
41
42 #define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
43
44 #define IDMAP_AD_MAX_IDS 30
45 #define CHECK_ALLOC_DONE(mem) do { \
46 if (!mem) { \
47 DEBUG(0, ("Out of memory!\n")); \
48 ret = NT_STATUS_NO_MEMORY; \
49 goto done; \
50 } \
51 } while (0)
52
53 struct idmap_ad_context {
54 ADS_STRUCT *ads;
55 struct posix_schema *ad_schema;
56 enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
57 };
58
59 /************************************************************************
60 ***********************************************************************/
61
62 static ADS_STATUS ad_idmap_cached_connection_internal(struct idmap_domain *dom)
63 {
64 ADS_STRUCT *ads;
65 ADS_STATUS status;
66 fstring dc_name;
67 struct sockaddr_storage dc_ip;
68 struct idmap_ad_context *ctx;
69 char *ldap_server = NULL;
70 char *realm = NULL;
71 struct winbindd_domain *wb_dom;
72
73 DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
74 dom->name));
75
76 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
77
78 if (ctx->ads != NULL) {
79
80 time_t expire;
81 time_t now = time(NULL);
82
83 ads = ctx->ads;
84
85 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
86
87 /* check for a valid structure */
88 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
89 (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
90
91 if ( ads->config.realm && (expire > time(NULL))) {
92 return ADS_SUCCESS;
93 } else {
94 /* we own this ADS_STRUCT so make sure it goes away */
95 DEBUG(7,("Deleting expired krb5 credential cache\n"));
96 ads->is_mine = True;
97 ads_destroy( &ads );
98 ads_kdestroy(WINBIND_CCACHE_NAME);
99 ctx->ads = NULL;
100 }
101 }
102
103 /* we don't want this to affect the users ccache */
104 setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
105
106 /*
107 * At this point we only have the NetBIOS domain name.
108 * Check if we can get server nam and realm from SAF cache
109 * and the domain list.
110 */
111 ldap_server = saf_fetch(dom->name);
112 DEBUG(10, ("ldap_server from saf cache: '%s'\n", ldap_server?ldap_server:""));
113
114 wb_dom = find_domain_from_name_noinit(dom->name);
115 if (wb_dom == NULL) {
116 DEBUG(10, ("find_domain_from_name_noinit did not find domain '%s'\n",
117 dom->name));
118 realm = NULL;
119 } else {
120 DEBUG(10, ("find_domain_from_name_noinit found realm '%s' for "
121 " domain '%s'\n", wb_dom->alt_name, dom->name));
122 realm = wb_dom->alt_name;
123 }
124
125 if ( (ads = ads_init(realm, dom->name, ldap_server)) == NULL ) {
126 DEBUG(1,("ads_init failed\n"));
127 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
128 }
129
130 /* the machine acct password might have change - fetch it every time */
131 SAFE_FREE(ads->auth.password);
132 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
133
134 SAFE_FREE(ads->auth.realm);
135 ads->auth.realm = SMB_STRDUP(lp_realm());
136
137 /* setup server affinity */
138
139 get_dc_name(dom->name, realm, dc_name, &dc_ip );
140
141 status = ads_connect(ads);
142 if (!ADS_ERR_OK(status)) {
143 DEBUG(1, ("ad_idmap_cached_connection_internal: failed to "
144 "connect to AD\n"));
145 ads_destroy(&ads);
146 return status;
147 }
148
149 ads->is_mine = False;
150
151 ctx->ads = ads;
152
153 return ADS_SUCCESS;
154 }
155
156 /************************************************************************
157 ***********************************************************************/
158
159 static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
160 {
161 ADS_STATUS status;
162 struct idmap_ad_context * ctx;
163
164 status = ad_idmap_cached_connection_internal(dom);
165 if (!ADS_ERR_OK(status)) {
166 return status;
167 }
168
169 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
170
171 /* if we have a valid ADS_STRUCT and the schema model is
172 defined, then we can return here. */
173
174 if ( ctx->ad_schema ) {
175 return ADS_SUCCESS;
176 }
177
178 /* Otherwise, set the schema model */
179
180 if ( (ctx->ad_map_type == WB_POSIX_MAP_SFU) ||
181 (ctx->ad_map_type == WB_POSIX_MAP_SFU20) ||
182 (ctx->ad_map_type == WB_POSIX_MAP_RFC2307) )
183 {
184 status = ads_check_posix_schema_mapping(
185 ctx, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
186 if ( !ADS_ERR_OK(status) ) {
187 DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
188 }
189 }
190
191 return status;
192 }
193
194 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
195 {
196 if (ctx->ads != NULL) {
197 /* we own this ADS_STRUCT so make sure it goes away */
198 ctx->ads->is_mine = True;
199 ads_destroy( &ctx->ads );
200 ctx->ads = NULL;
201 }
202 return 0;
203 }
204
205 /************************************************************************
206 ***********************************************************************/
207
208 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
209 {
210 struct idmap_ad_context *ctx;
211 char *config_option;
212 const char *schema_mode = NULL;
213
214 ctx = talloc_zero(dom, struct idmap_ad_context);
215 if (ctx == NULL) {
216 DEBUG(0, ("Out of memory!\n"));
217 return NT_STATUS_NO_MEMORY;
218 }
219 talloc_set_destructor(ctx, idmap_ad_context_destructor);
220
221 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
222 if (config_option == NULL) {
223 DEBUG(0, ("Out of memory!\n"));
224 talloc_free(ctx);
225 return NT_STATUS_NO_MEMORY;
226 }
227
228 /* default map type */
229 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
230
231 /* schema mode */
232 schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
233 if ( schema_mode && schema_mode[0] ) {
234 if ( strequal(schema_mode, "sfu") )
235 ctx->ad_map_type = WB_POSIX_MAP_SFU;
236 else if ( strequal(schema_mode, "sfu20" ) )
237 ctx->ad_map_type = WB_POSIX_MAP_SFU20;
238 else if ( strequal(schema_mode, "rfc2307" ) )
239 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
240 else
241 DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
242 schema_mode));
243 }
244
245 dom->private_data = ctx;
246
247 talloc_free(config_option);
248
249 return NT_STATUS_OK;
250 }
251
252 /************************************************************************
253 Search up to IDMAP_AD_MAX_IDS entries in maps for a match.
254 ***********************************************************************/
255
256 static struct id_map *find_map_by_id(struct id_map **maps, enum id_type type, uint32_t id)
257 {
258 int i;
259
260 for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
261 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
262 return maps[i];
263 }
264 }
265
266 return NULL;
267 }
268
269 /************************************************************************
270 Search up to IDMAP_AD_MAX_IDS entries in maps for a match
271 ***********************************************************************/
272
273 static struct id_map *find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
274 {
275 int i;
276
277 for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
278 if (dom_sid_equal(maps[i]->sid, sid)) {
279 return maps[i];
280 }
281 }
282
283 return NULL;
284 }
285
286 /************************************************************************
287 ***********************************************************************/
288
289 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
290 {
291 NTSTATUS ret;
292 TALLOC_CTX *memctx;
293 struct idmap_ad_context *ctx;
294 ADS_STATUS rc;
295 const char *attrs[] = { "sAMAccountType",
296 "objectSid",
297 NULL, /* uidnumber */
298 NULL, /* gidnumber */
299 NULL };
300 LDAPMessage *res = NULL;
301 LDAPMessage *entry = NULL;
302 char *filter = NULL;
303 int idx = 0;
304 int bidx = 0;
305 int count;
306 int i;
307 char *u_filter = NULL;
308 char *g_filter = NULL;
309
310 /* initialize the status to avoid suprise */
311 for (i = 0; ids[i]; i++) {
312 ids[i]->status = ID_UNKNOWN;
313 }
314
315 /* Only do query if we are online */
316 if (idmap_is_offline()) {
317 return NT_STATUS_FILE_IS_OFFLINE;
318 }
319
320 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
321
322 if ( (memctx = talloc_new(ctx)) == NULL ) {
323 DEBUG(0, ("Out of memory!\n"));
324 return NT_STATUS_NO_MEMORY;
325 }
326
327 rc = ad_idmap_cached_connection(dom);
328 if (!ADS_ERR_OK(rc)) {
329 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
330 ret = NT_STATUS_UNSUCCESSFUL;
331 /* ret = ads_ntstatus(rc); */
332 goto done;
333 }
334
335 attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
336 attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
337
338 again:
339 bidx = idx;
340 for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
341 switch (ids[idx]->xid.type) {
342 case ID_TYPE_UID:
343 if ( ! u_filter) {
344 u_filter = talloc_asprintf(memctx, "(&(|"
345 "(sAMAccountType=%d)"
346 "(sAMAccountType=%d)"
347 "(sAMAccountType=%d))(|",
348 ATYPE_NORMAL_ACCOUNT,
349 ATYPE_WORKSTATION_TRUST,
350 ATYPE_INTERDOMAIN_TRUST);
351 }
352 u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
353 ctx->ad_schema->posix_uidnumber_attr,
354 (unsigned long)ids[idx]->xid.id);
355 CHECK_ALLOC_DONE(u_filter);
356 break;
357
358 case ID_TYPE_GID:
359 if ( ! g_filter) {
360 g_filter = talloc_asprintf(memctx, "(&(|"
361 "(sAMAccountType=%d)"
362 "(sAMAccountType=%d))(|",
363 ATYPE_SECURITY_GLOBAL_GROUP,
364 ATYPE_SECURITY_LOCAL_GROUP);
365 }
366 g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
367 ctx->ad_schema->posix_gidnumber_attr,
368 (unsigned long)ids[idx]->xid.id);
369 CHECK_ALLOC_DONE(g_filter);
370 break;
371
372 default:
373 DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
374 ids[idx]->status = ID_UNKNOWN;
375 continue;
376 }
377 }
378 filter = talloc_asprintf(memctx, "(|");
379 CHECK_ALLOC_DONE(filter);
380 if ( u_filter) {
381 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
382 CHECK_ALLOC_DONE(filter);
383 TALLOC_FREE(u_filter);
384 }
385 if ( g_filter) {
386 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
387 CHECK_ALLOC_DONE(filter);
388 TALLOC_FREE(g_filter);
389 }
390 filter = talloc_asprintf_append_buffer(filter, ")");
391 CHECK_ALLOC_DONE(filter);
392
393 rc = ads_search_retry(ctx->ads, &res, filter, attrs);
394 if (!ADS_ERR_OK(rc)) {
395 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
396 ret = NT_STATUS_UNSUCCESSFUL;
397 goto done;
398 }
399
400 if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
401 DEBUG(10, ("No IDs found\n"));
402 }
403
404 entry = res;
405 for (i = 0; (i < count) && entry; i++) {
406 struct dom_sid sid;
407 enum id_type type;
408 struct id_map *map;
409 uint32_t id;
410 uint32_t atype;
411
412 if (i == 0) { /* first entry */
413 entry = ads_first_entry(ctx->ads, entry);
414 } else { /* following ones */
415 entry = ads_next_entry(ctx->ads, entry);
416 }
417
418 if ( !entry ) {
419 DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
420 break;
421 }
422
423 /* first check if the SID is present */
424 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
425 DEBUG(2, ("Could not retrieve SID from entry\n"));
426 continue;
427 }
428
429 /* get type */
430 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
431 DEBUG(1, ("could not get SAM account type\n"));
432 continue;
433 }
434
435 switch (atype & 0xF0000000) {
436 case ATYPE_SECURITY_GLOBAL_GROUP:
437 case ATYPE_SECURITY_LOCAL_GROUP:
438 type = ID_TYPE_GID;
439 break;
440 case ATYPE_NORMAL_ACCOUNT:
441 case ATYPE_WORKSTATION_TRUST:
442 case ATYPE_INTERDOMAIN_TRUST:
443 type = ID_TYPE_UID;
444 break;
445 default:
446 DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
447 continue;
448 }
449
450 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
451 ctx->ad_schema->posix_uidnumber_attr :
452 ctx->ad_schema->posix_gidnumber_attr,
453 &id))
454 {
455 DEBUG(1, ("Could not get SID for unix ID %u\n", (unsigned) id));
456 continue;
457 }
458
459 if (!idmap_unix_id_is_in_range(id, dom)) {
460 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
461 id, dom->low_id, dom->high_id));
462 continue;
463 }
464
465 map = find_map_by_id(&ids[bidx], type, id);
466 if (!map) {
467 DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
468 continue;
469 }
470
471 sid_copy(map->sid, &sid);
472
473 /* mapped */
474 map->status = ID_MAPPED;
475
476 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
477 (unsigned long)map->xid.id,
478 map->xid.type));
479 }
480
481 if (res) {
482 ads_msgfree(ctx->ads, res);
483 }
484
485 if (ids[idx]) { /* still some values to map */
486 goto again;
487 }
488
489 ret = NT_STATUS_OK;
490
491 /* mark all unknown/expired ones as unmapped */
492 for (i = 0; ids[i]; i++) {
493 if (ids[i]->status != ID_MAPPED)
494 ids[i]->status = ID_UNMAPPED;
495 }
496
497 done:
498 talloc_free(memctx);
499 return ret;
500 }
501
502 /************************************************************************
503 ***********************************************************************/
504
505 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
506 {
507 NTSTATUS ret;
508 TALLOC_CTX *memctx;
509 struct idmap_ad_context *ctx;
510 ADS_STATUS rc;
511 const char *attrs[] = { "sAMAccountType",
512 "objectSid",
513 NULL, /* attr_uidnumber */
514 NULL, /* attr_gidnumber */
515 NULL };
516 LDAPMessage *res = NULL;
517 LDAPMessage *entry = NULL;
518 char *filter = NULL;
519 int idx = 0;
520 int bidx = 0;
521 int count;
522 int i;
523 char *sidstr;
524
525 /* initialize the status to avoid suprise */
526 for (i = 0; ids[i]; i++) {
527 ids[i]->status = ID_UNKNOWN;
528 }
529
530 /* Only do query if we are online */
531 if (idmap_is_offline()) {
532 return NT_STATUS_FILE_IS_OFFLINE;
533 }
534
535 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
536
537 if ( (memctx = talloc_new(ctx)) == NULL ) {
538 DEBUG(0, ("Out of memory!\n"));
539 return NT_STATUS_NO_MEMORY;
540 }
541
542 rc = ad_idmap_cached_connection(dom);
543 if (!ADS_ERR_OK(rc)) {
544 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
545 ret = NT_STATUS_UNSUCCESSFUL;
546 /* ret = ads_ntstatus(rc); */
547 goto done;
548 }
549
550 if (ctx->ad_schema == NULL) {
551 DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
552 ret = NT_STATUS_UNSUCCESSFUL;
553 goto done;
554 }
555
556 attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
557 attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
558
559 again:
560 filter = talloc_asprintf(memctx, "(&(|"
561 "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
562 "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
563 ")(|",
564 ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
565 ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
566
567 CHECK_ALLOC_DONE(filter);
568
569 bidx = idx;
570 for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
571
572 ids[idx]->status = ID_UNKNOWN;
573
574 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[idx]->sid);
575 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
576
577 TALLOC_FREE(sidstr);
578 CHECK_ALLOC_DONE(filter);
579 }
580 filter = talloc_asprintf_append_buffer(filter, "))");
581 CHECK_ALLOC_DONE(filter);
582 DEBUG(10, ("Filter: [%s]\n", filter));
583
584 rc = ads_search_retry(ctx->ads, &res, filter, attrs);
585 if (!ADS_ERR_OK(rc)) {
586 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
587 ret = NT_STATUS_UNSUCCESSFUL;
588 goto done;
589 }
590
591 if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
592 DEBUG(10, ("No IDs found\n"));
593 }
594
595 entry = res;
596 for (i = 0; (i < count) && entry; i++) {
597 struct dom_sid sid;
598 enum id_type type;
599 struct id_map *map;
600 uint32_t id;
601 uint32_t atype;
602
603 if (i == 0) { /* first entry */
604 entry = ads_first_entry(ctx->ads, entry);
605 } else { /* following ones */
606 entry = ads_next_entry(ctx->ads, entry);
607 }
608
609 if ( !entry ) {
610 DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
611 break;
612 }
613
614 /* first check if the SID is present */
615 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
616 DEBUG(2, ("Could not retrieve SID from entry\n"));
617 continue;
618 }
619
620 map = find_map_by_sid(&ids[bidx], &sid);
621 if (!map) {
622 DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
623 continue;
624 }
625
626 /* get type */
627 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
628 DEBUG(1, ("could not get SAM account type\n"));
629 continue;
630 }
631
632 switch (atype & 0xF0000000) {
633 case ATYPE_SECURITY_GLOBAL_GROUP:
634 case ATYPE_SECURITY_LOCAL_GROUP:
635 type = ID_TYPE_GID;
636 break;
637 case ATYPE_NORMAL_ACCOUNT:
638 case ATYPE_WORKSTATION_TRUST:
639 case ATYPE_INTERDOMAIN_TRUST:
640 type = ID_TYPE_UID;
641 break;
642 default:
643 DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
644 continue;
645 }
646
647 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
648 ctx->ad_schema->posix_uidnumber_attr :
649 ctx->ad_schema->posix_gidnumber_attr,
650 &id))
651 {
652 DEBUG(1, ("Could not get unix ID for SID %s\n",
653 sid_string_dbg(map->sid)));
654 continue;
655 }
656 if (!idmap_unix_id_is_in_range(id, dom)) {
657 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
658 id, dom->low_id, dom->high_id));
659 continue;
660 }
661
662 /* mapped */
663 map->xid.type = type;
664 map->xid.id = id;
665 map->status = ID_MAPPED;
666
667 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
668 (unsigned long)map->xid.id,
669 map->xid.type));
670 }
671
672 if (res) {
673 ads_msgfree(ctx->ads, res);
674 }
675
676 if (ids[idx]) { /* still some values to map */
677 goto again;
678 }
679
680 ret = NT_STATUS_OK;
681
682 /* mark all unknown/expired ones as unmapped */
683 for (i = 0; ids[i]; i++) {
684 if (ids[i]->status != ID_MAPPED)
685 ids[i]->status = ID_UNMAPPED;
686 }
687
688 done:
689 talloc_free(memctx);
690 return ret;
691 }
692
693 /*
694 * nss_info_{sfu,sfu20,rfc2307}
695 */
696
697 /************************************************************************
698 Initialize the {sfu,sfu20,rfc2307} state
699 ***********************************************************************/
700
701 static const char *wb_posix_map_unknown_string = "WB_POSIX_MAP_UNKNOWN";
702 static const char *wb_posix_map_template_string = "WB_POSIX_MAP_TEMPLATE";
703 static const char *wb_posix_map_sfu_string = "WB_POSIX_MAP_SFU";
704 static const char *wb_posix_map_sfu20_string = "WB_POSIX_MAP_SFU20";
705 static const char *wb_posix_map_rfc2307_string = "WB_POSIX_MAP_RFC2307";
706 static const char *wb_posix_map_unixinfo_string = "WB_POSIX_MAP_UNIXINFO";
707
708 static const char *ad_map_type_string(enum wb_posix_mapping map_type)
709 {
710 switch (map_type) {
711 case WB_POSIX_MAP_TEMPLATE:
712 return wb_posix_map_template_string;
713 case WB_POSIX_MAP_SFU:
714 return wb_posix_map_sfu_string;
715 case WB_POSIX_MAP_SFU20:
716 return wb_posix_map_sfu20_string;
717 case WB_POSIX_MAP_RFC2307:
718 return wb_posix_map_rfc2307_string;
719 case WB_POSIX_MAP_UNIXINFO:
720 return wb_posix_map_unixinfo_string;
721 default:
722 return wb_posix_map_unknown_string;
723 }
724 }
725
726 static NTSTATUS nss_ad_generic_init(struct nss_domain_entry *e,
727 enum wb_posix_mapping new_ad_map_type)
728 {
729 struct idmap_domain *dom;
730 struct idmap_ad_context *ctx;
731
732 if (e->state != NULL) {
733 dom = talloc_get_type(e->state, struct idmap_domain);
734 } else {
735 dom = talloc_zero(e, struct idmap_domain);
736 if (dom == NULL) {
737 DEBUG(0, ("Out of memory!\n"));
738 return NT_STATUS_NO_MEMORY;
739 }
740 e->state = dom;
741 }
742
743 if (e->domain != NULL) {
744 dom->name = talloc_strdup(dom, e->domain);
745 if (dom->name == NULL) {
746 DEBUG(0, ("Out of memory!\n"));
747 return NT_STATUS_NO_MEMORY;
748 }
749 }
750
751 if (dom->private_data != NULL) {
752 ctx = talloc_get_type(dom->private_data,
753 struct idmap_ad_context);
754 } else {
755 ctx = talloc_zero(dom, struct idmap_ad_context);
756 if (ctx == NULL) {
757 DEBUG(0, ("Out of memory!\n"));
758 return NT_STATUS_NO_MEMORY;
759 }
760 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
761 dom->private_data = ctx;
762 }
763
764 if ((ctx->ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
765 (ctx->ad_map_type != new_ad_map_type))
766 {
767 DEBUG(2, ("nss_ad_generic_init: "
768 "Warning: overriding previously set posix map type "
769 "%s for domain %s with map type %s.\n",
770 ad_map_type_string(ctx->ad_map_type),
771 dom->name,
772 ad_map_type_string(new_ad_map_type)));
773 }
774
775 ctx->ad_map_type = new_ad_map_type;
776
777 return NT_STATUS_OK;
778 }
779
780 static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
781 {
782 return nss_ad_generic_init(e, WB_POSIX_MAP_SFU);
783 }
784
785 static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
786 {
787 return nss_ad_generic_init(e, WB_POSIX_MAP_SFU20);
788 }
789
790 static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
791 {
792 return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
793 }
794
795
796 /************************************************************************
797 ***********************************************************************/
798
799 static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
800 const struct dom_sid *sid,
801 TALLOC_CTX *mem_ctx,
802 const char **homedir,
803 const char **shell,
804 const char **gecos,
805 uint32 *gid )
806 {
807 const char *attrs[] = {NULL, /* attr_homedir */
808 NULL, /* attr_shell */
809 NULL, /* attr_gecos */
810 NULL, /* attr_gidnumber */
811 NULL };
812 char *filter = NULL;
813 LDAPMessage *msg_internal = NULL;
814 ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
815 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
816 char *sidstr = NULL;
817 struct idmap_domain *dom;
818 struct idmap_ad_context *ctx;
819
820 DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
821 sid_string_dbg(sid), e->domain?e->domain:"NULL"));
822
823 /* Only do query if we are online */
824 if (idmap_is_offline()) {
825 return NT_STATUS_FILE_IS_OFFLINE;
826 }
827
828 dom = talloc_get_type(e->state, struct idmap_domain);
829 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
830
831 ads_status = ad_idmap_cached_connection(dom);
832 if (!ADS_ERR_OK(ads_status)) {
833 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
834 }
835
836 if (!ctx->ad_schema) {
837 DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
838 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
839 }
840
841 if (!sid || !homedir || !shell || !gecos) {
842 return NT_STATUS_INVALID_PARAMETER;
843 }
844
845 /* Have to do our own query */
846
847 DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
848 "own query\n"));
849
850 attrs[0] = ctx->ad_schema->posix_homedir_attr;
851 attrs[1] = ctx->ad_schema->posix_shell_attr;
852 attrs[2] = ctx->ad_schema->posix_gecos_attr;
853 attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
854
855 sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
856 filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
857 TALLOC_FREE(sidstr);
858
859 if (!filter) {
860 nt_status = NT_STATUS_NO_MEMORY;
861 goto done;
862 }
863
864 ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
865 if (!ADS_ERR_OK(ads_status)) {
866 nt_status = ads_ntstatus(ads_status);
867 goto done;
868 }
869
870 *homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
871 *shell = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
872 *gecos = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
873
874 if (gid) {
875 if (!ads_pull_uint32(ctx->ads, msg_internal, ctx->ad_schema->posix_gidnumber_attr, gid))
876 *gid = (uint32)-1;
877 }
878
879 nt_status = NT_STATUS_OK;
880
881 done:
882 if (msg_internal) {
883 ads_msgfree(ctx->ads, msg_internal);
884 }
885
886 return nt_status;
887 }
888
889 /**********************************************************************
890 *********************************************************************/
891
892 static NTSTATUS nss_ad_map_to_alias(TALLOC_CTX *mem_ctx,
893 struct nss_domain_entry *e,
894 const char *name,
895 char **alias)
896 {
897 const char *attrs[] = {NULL, /* attr_uid */
898 NULL };
899 char *filter = NULL;
900 LDAPMessage *msg = NULL;
901 ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
902 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
903 struct idmap_domain *dom;
904 struct idmap_ad_context *ctx = NULL;
905
906 /* Check incoming parameters */
907
908 if ( !e || !e->domain || !name || !*alias) {
909 nt_status = NT_STATUS_INVALID_PARAMETER;
910 goto done;
911 }
912
913 /* Only do query if we are online */
914
915 if (idmap_is_offline()) {
916 nt_status = NT_STATUS_FILE_IS_OFFLINE;
917 goto done;
918 }
919
920 dom = talloc_get_type(e->state, struct idmap_domain);
921 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
922
923 ads_status = ad_idmap_cached_connection(dom);
924 if (!ADS_ERR_OK(ads_status)) {
925 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
926 }
927
928 if (!ctx->ad_schema) {
929 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
930 goto done;
931 }
932
933 attrs[0] = ctx->ad_schema->posix_uid_attr;
934
935 filter = talloc_asprintf(mem_ctx,
936 "(sAMAccountName=%s)",
937 name);
938 if (!filter) {
939 nt_status = NT_STATUS_NO_MEMORY;
940 goto done;
941 }
942
943 ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
944 if (!ADS_ERR_OK(ads_status)) {
945 nt_status = ads_ntstatus(ads_status);
946 goto done;
947 }
948
949 *alias = ads_pull_string(ctx->ads, mem_ctx, msg, ctx->ad_schema->posix_uid_attr);
950
951 if (!*alias) {
952 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
953 }
954
955 nt_status = NT_STATUS_OK;
956
957 done:
958 if (filter) {
959 talloc_destroy(filter);
960 }
961 if (msg) {
962 ads_msgfree(ctx->ads, msg);
963 }
964
965 return nt_status;
966 }
967
968 /**********************************************************************
969 *********************************************************************/
970
971 static NTSTATUS nss_ad_map_from_alias( TALLOC_CTX *mem_ctx,
972 struct nss_domain_entry *e,
973 const char *alias,
974 char **name )
975 {
976 const char *attrs[] = {"sAMAccountName",
977 NULL };
978 char *filter = NULL;
979 LDAPMessage *msg = NULL;
980 ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
981 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
982 char *username;
983 struct idmap_domain *dom;
984 struct idmap_ad_context *ctx = NULL;
985
986 /* Check incoming parameters */
987
988 if ( !alias || !name) {
989 nt_status = NT_STATUS_INVALID_PARAMETER;
990 goto done;
991 }
992
993 /* Only do query if we are online */
994
995 if (idmap_is_offline()) {
996 nt_status = NT_STATUS_FILE_IS_OFFLINE;
997 goto done;
998 }
999
1000 dom = talloc_get_type(e->state, struct idmap_domain);
1001 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
1002
1003 ads_status = ad_idmap_cached_connection(dom);
1004 if (!ADS_ERR_OK(ads_status)) {
1005 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1006 }
1007
1008 if (!ctx->ad_schema) {
1009 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
1010 goto done;
1011 }
1012
1013 filter = talloc_asprintf(mem_ctx,
1014 "(%s=%s)",
1015 ctx->ad_schema->posix_uid_attr,
1016 alias);
1017 if (!filter) {
1018 nt_status = NT_STATUS_NO_MEMORY;
1019 goto done;
1020 }
1021
1022 ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
1023 if (!ADS_ERR_OK(ads_status)) {
1024 nt_status = ads_ntstatus(ads_status);
1025 goto done;
1026 }
1027
1028 username = ads_pull_string(ctx->ads, mem_ctx, msg,
1029 "sAMAccountName");
1030 if (!username) {
1031 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1032 }
1033
1034 *name = talloc_asprintf(mem_ctx, "%s\\%s",
1035 lp_workgroup(),
1036 username);
1037 if (!*name) {
1038 nt_status = NT_STATUS_NO_MEMORY;
1039 goto done;
1040 }
1041
1042 nt_status = NT_STATUS_OK;
1043
1044 done:
1045 if (filter) {
1046 talloc_destroy(filter);
1047 }
1048 if (msg) {
1049 ads_msgfree(ctx->ads, msg);
1050 }
1051
1052 return nt_status;
1053 }
1054
1055 /************************************************************************
1056 Function dispatch tables for the idmap and nss plugins
1057 ***********************************************************************/
1058
1059 static struct idmap_methods ad_methods = {
1060 .init = idmap_ad_initialize,
1061 .unixids_to_sids = idmap_ad_unixids_to_sids,
1062 .sids_to_unixids = idmap_ad_sids_to_unixids,
1063 };
1064
1065 /* The SFU and RFC2307 NSS plugins share everything but the init
1066 function which sets the intended schema model to use */
1067
1068 static struct nss_info_methods nss_rfc2307_methods = {
1069 .init = nss_rfc2307_init,
1070 .get_nss_info = nss_ad_get_info,
1071 .map_to_alias = nss_ad_map_to_alias,
1072 .map_from_alias = nss_ad_map_from_alias,
1073 };
1074
1075 static struct nss_info_methods nss_sfu_methods = {
1076 .init = nss_sfu_init,
1077 .get_nss_info = nss_ad_get_info,
1078 .map_to_alias = nss_ad_map_to_alias,
1079 .map_from_alias = nss_ad_map_from_alias,
1080 };
1081
1082 static struct nss_info_methods nss_sfu20_methods = {
1083 .init = nss_sfu20_init,
1084 .get_nss_info = nss_ad_get_info,
1085 .map_to_alias = nss_ad_map_to_alias,
1086 .map_from_alias = nss_ad_map_from_alias,
1087 };
1088
1089
1090
1091 /************************************************************************
1092 Initialize the plugins
1093 ***********************************************************************/
1094
1095 NTSTATUS samba_init_module(void)
1096 {
1097 static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
1098 static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
1099 static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
1100 static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
1101
1102 /* Always register the AD method first in order to get the
1103 idmap_domain interface called */
1104
1105 if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
1106 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
1107 "ad", &ad_methods);
1108 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
1109 return status_idmap_ad;
1110 }
1111
1112 if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
1113 status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1114 "rfc2307", &nss_rfc2307_methods );
1115 if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
1116 return status_nss_rfc2307;
1117 }
1118
1119 if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
1120 status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1121 "sfu", &nss_sfu_methods );
1122 if ( !NT_STATUS_IS_OK(status_nss_sfu) )
1123 return status_nss_sfu;
1124 }
1125
1126 if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
1127 status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1128 "sfu20", &nss_sfu20_methods );
1129 if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
1130 return status_nss_sfu20;
1131 }
1132
1133 return NT_STATUS_OK;
1134 }
1135
Samba GIT mirror