source3/winbindd/idmap_ldap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    idmap LDAP backend
   5
   6    Copyright (C) Tim Potter             2000
   7    Copyright (C) Jim McDonough <jmcd@us.ibm.com>        2003
   8    Copyright (C) Gerald Carter          2003
   9    Copyright (C) Simo Sorce             2003-2007
  10    Copyright (C) Michael Adam           2010
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "secrets.h"
  29 #include "idmap.h"
  30 #include "idmap_rw.h"
  31 #include "../libcli/security/security.h"
  32
  33 #undef DBGC_CLASS
  34 #define DBGC_CLASS DBGC_IDMAP
  35
  36 #include <lber.h>
  37 #include <ldap.h>
  38
  39 #include "smbldap.h"
  40 #include "passdb/pdb_ldap_schema.h"
  41
  42 struct idmap_ldap_context {
  43         struct smbldap_state *smbldap_state;
  44         char *url;
  45         char *suffix;
  46         char *user_dn;
  47         bool anon;
  48         struct idmap_rw_ops *rw_ops;
  49 };
  50
  51 #define CHECK_ALLOC_DONE(mem) do { \
  52         if (!mem) { \
  53                 DEBUG(0, ("Out of memory!\n")); \
  54                 ret = NT_STATUS_NO_MEMORY; \
  55                 goto done; \
  56         } } while (0)
  57
  58 /**********************************************************************
  59  IDMAP ALLOC TDB BACKEND
  60 **********************************************************************/
  61
  62 /*********************************************************************
  63  ********************************************************************/
  64
  65 static NTSTATUS get_credentials( TALLOC_CTX *mem_ctx,
  66                                  struct smbldap_state *ldap_state,
  67                                  struct idmap_domain *dom,
  68                                  char **dn )
  69 {
  70         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
  71         char *secret = NULL;
  72         const char *tmp = NULL;
  73         char *user_dn = NULL;
  74         bool anon = False;
  75
  76         /* assume anonymous if we don't have a specified user */
  77
  78         tmp = idmap_config_const_string(dom->name, "ldap_user_dn", NULL);
  79
  80         if ( tmp ) {
  81                 secret = idmap_fetch_secret("ldap", dom->name, tmp);
  82                 if (!secret) {
  83                         DEBUG(0, ("get_credentials: Unable to fetch "
  84                                   "auth credentials for %s in %s\n",
  85                                   tmp, (dom==NULL)?"ALLOC":dom->name));
  86                         ret = NT_STATUS_ACCESS_DENIED;
  87                         goto done;
  88                 }
  89                 *dn = talloc_strdup(mem_ctx, tmp);
  90                 CHECK_ALLOC_DONE(*dn);
  91         } else {
  92                 if (!fetch_ldap_pw(&user_dn, &secret)) {
  93                         DEBUG(2, ("get_credentials: Failed to lookup ldap "
  94                                   "bind creds. Using anonymous connection.\n"));
  95                         anon = True;
  96                         *dn = NULL;
  97                 } else {
  98                         *dn = talloc_strdup(mem_ctx, user_dn);
  99                         SAFE_FREE( user_dn );
 100                         CHECK_ALLOC_DONE(*dn);
 101                 }
 102         }
 103
 104         smbldap_set_creds(ldap_state, anon, *dn, secret);
 105         ret = NT_STATUS_OK;
 106
 107 done:
 108         SAFE_FREE(secret);
 109
 110         return ret;
 111 }
 112
 113
 114 /**********************************************************************
 115  Verify the sambaUnixIdPool entry in the directory.
 116 **********************************************************************/
 117
 118 static NTSTATUS verify_idpool(struct idmap_domain *dom)
 119 {
 120         NTSTATUS ret;
 121         TALLOC_CTX *mem_ctx;
 122         LDAPMessage *result = NULL;
 123         LDAPMod **mods = NULL;
 124         const char **attr_list;
 125         char *filter;
 126         int count;
 127         int rc;
 128         struct idmap_ldap_context *ctx;
 129
 130         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 131
 132         mem_ctx = talloc_new(ctx);
 133         if (mem_ctx == NULL) {
 134                 DEBUG(0, ("Out of memory!\n"));
 135                 return NT_STATUS_NO_MEMORY;
 136         }
 137
 138         filter = talloc_asprintf(mem_ctx, "(objectclass=%s)", LDAP_OBJ_IDPOOL);
 139         CHECK_ALLOC_DONE(filter);
 140
 141         attr_list = get_attr_list(mem_ctx, idpool_attr_list);
 142         CHECK_ALLOC_DONE(attr_list);
 143
 144         rc = smbldap_search(ctx->smbldap_state,
 145                                 ctx->suffix,
 146                                 LDAP_SCOPE_SUBTREE,
 147                                 filter,
 148                                 attr_list,
 149                                 0,
 150                                 &result);
 151
 152         if (rc != LDAP_SUCCESS) {
 153                 DEBUG(1, ("Unable to verify the idpool, "
 154                           "cannot continue initialization!\n"));
 155                 return NT_STATUS_UNSUCCESSFUL;
 156         }
 157
 158         count = ldap_count_entries(smbldap_get_ldap(ctx->smbldap_state),
 159                                    result);
 160
 161         ldap_msgfree(result);
 162
 163         if ( count > 1 ) {
 164                 DEBUG(0,("Multiple entries returned from %s (base == %s)\n",
 165                         filter, ctx->suffix));
 166                 ret = NT_STATUS_UNSUCCESSFUL;
 167                 goto done;
 168         }
 169         else if (count == 0) {
 170                 char *uid_str, *gid_str;
 171
 172                 uid_str = talloc_asprintf(mem_ctx, "%lu",
 173                                 (unsigned long)dom->low_id);
 174                 gid_str = talloc_asprintf(mem_ctx, "%lu",
 175                                 (unsigned long)dom->low_id);
 176
 177                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 178                                 "objectClass", LDAP_OBJ_IDPOOL);
 179                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 180                                 get_attr_key2string(idpool_attr_list,
 181                                                     LDAP_ATTR_UIDNUMBER),
 182                                 uid_str);
 183                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 184                                 get_attr_key2string(idpool_attr_list,
 185                                                     LDAP_ATTR_GIDNUMBER),
 186                                 gid_str);
 187                 if (mods) {
 188                         rc = smbldap_modify(ctx->smbldap_state,
 189                                                 ctx->suffix,
 190                                                 mods);
 191                         ldap_mods_free(mods, True);
 192                 } else {
 193                         ret = NT_STATUS_UNSUCCESSFUL;
 194                         goto done;
 195                 }
 196         }
 197
 198         ret = (rc == LDAP_SUCCESS)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
 199 done:
 200         talloc_free(mem_ctx);
 201         return ret;
 202 }
 203
 204 /********************************
 205  Allocate a new uid or gid
 206 ********************************/
 207
 208 static NTSTATUS idmap_ldap_allocate_id_internal(struct idmap_domain *dom,
 209                                                 struct unixid *xid)
 210 {
 211         TALLOC_CTX *mem_ctx;
 212         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 213         int rc = LDAP_SERVER_DOWN;
 214         int count = 0;
 215         LDAPMessage *result = NULL;
 216         LDAPMessage *entry = NULL;
 217         LDAPMod **mods = NULL;
 218         char *id_str;
 219         char *new_id_str;
 220         char *filter = NULL;
 221         const char *dn = NULL;
 222         const char **attr_list;
 223         const char *type;
 224         struct idmap_ldap_context *ctx;
 225
 226         /* Only do query if we are online */
 227         if (idmap_is_offline()) {
 228                 return NT_STATUS_FILE_IS_OFFLINE;
 229         }
 230
 231         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 232
 233         mem_ctx = talloc_new(ctx);
 234         if (!mem_ctx) {
 235                 DEBUG(0, ("Out of memory!\n"));
 236                 return NT_STATUS_NO_MEMORY;
 237         }
 238
 239         /* get type */
 240         switch (xid->type) {
 241
 242         case ID_TYPE_UID:
 243                 type = get_attr_key2string(idpool_attr_list,
 244                                            LDAP_ATTR_UIDNUMBER);
 245                 break;
 246
 247         case ID_TYPE_GID:
 248                 type = get_attr_key2string(idpool_attr_list,
 249                                            LDAP_ATTR_GIDNUMBER);
 250                 break;
 251
 252         default:
 253                 DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
 254                 return NT_STATUS_INVALID_PARAMETER;
 255         }
 256
 257         filter = talloc_asprintf(mem_ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
 258         CHECK_ALLOC_DONE(filter);
 259
 260         attr_list = get_attr_list(mem_ctx, idpool_attr_list);
 261         CHECK_ALLOC_DONE(attr_list);
 262
 263         DEBUG(10, ("Search of the id pool (filter: %s)\n", filter));
 264
 265         rc = smbldap_search(ctx->smbldap_state,
 266                            ctx->suffix,
 267                            LDAP_SCOPE_SUBTREE, filter,
 268                            attr_list, 0, &result);
 269
 270         if (rc != LDAP_SUCCESS) {
 271                 DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
 272                 goto done;
 273         }
 274
 275         smbldap_talloc_autofree_ldapmsg(mem_ctx, result);
 276
 277         count = ldap_count_entries(smbldap_get_ldap(ctx->smbldap_state),
 278                                    result);
 279         if (count != 1) {
 280                 DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
 281                 goto done;
 282         }
 283
 284         entry = ldap_first_entry(smbldap_get_ldap(ctx->smbldap_state), result);
 285
 286         dn = smbldap_talloc_dn(mem_ctx,
 287                                smbldap_get_ldap(ctx->smbldap_state),
 288                                entry);
 289         if ( ! dn) {
 290                 goto done;
 291         }
 292
 293         id_str = smbldap_talloc_single_attribute(
 294                                 smbldap_get_ldap(ctx->smbldap_state),
 295                                 entry, type, mem_ctx);
 296         if (id_str == NULL) {
 297                 DEBUG(0,("%s attribute not found\n", type));
 298                 ret = NT_STATUS_UNSUCCESSFUL;
 299                 goto done;
 300         }
 301
 302         xid->id = strtoul(id_str, NULL, 10);
 303
 304         /* make sure we still have room to grow */
 305
 306         switch (xid->type) {
 307         case ID_TYPE_UID:
 308                 if (xid->id > dom->high_id) {
 309                         DEBUG(0,("Cannot allocate uid above %lu!\n",
 310                                  (unsigned long)dom->high_id));
 311                         goto done;
 312                 }
 313                 break;
 314
 315         case ID_TYPE_GID:
 316                 if (xid->id > dom->high_id) {
 317                         DEBUG(0,("Cannot allocate gid above %lu!\n",
 318                                  (unsigned long)dom->high_id));
 319                         goto done;
 320                 }
 321                 break;
 322
 323         default:
 324                 /* impossible */
 325                 goto done;
 326         }
 327
 328         new_id_str = talloc_asprintf(mem_ctx, "%lu", (unsigned long)xid->id + 1);
 329         if ( ! new_id_str) {
 330                 DEBUG(0,("Out of memory\n"));
 331                 ret = NT_STATUS_NO_MEMORY;
 332                 goto done;
 333         }
 334
 335         smbldap_set_mod(&mods, LDAP_MOD_DELETE, type, id_str);
 336         smbldap_set_mod(&mods, LDAP_MOD_ADD, type, new_id_str);
 337
 338         if (mods == NULL) {
 339                 DEBUG(0,("smbldap_set_mod() failed.\n"));
 340                 goto done;
 341         }
 342
 343         DEBUG(10, ("Try to atomically increment the id (%s -> %s)\n",
 344                    id_str, new_id_str));
 345
 346         rc = smbldap_modify(ctx->smbldap_state, dn, mods);
 347
 348         ldap_mods_free(mods, True);
 349
 350         if (rc != LDAP_SUCCESS) {
 351                 DEBUG(1,("Failed to allocate new %s. "
 352                          "smbldap_modify() failed.\n", type));
 353                 goto done;
 354         }
 355
 356         ret = NT_STATUS_OK;
 357
 358 done:
 359         talloc_free(mem_ctx);
 360         return ret;
 361 }
 362
 363 /**
 364  * Allocate a new unix-ID.
 365  * For now this is for the default idmap domain only.
 366  * Should be extended later on.
 367  */
 368 static NTSTATUS idmap_ldap_allocate_id(struct idmap_domain *dom,
 369                                        struct unixid *id)
 370 {
 371         NTSTATUS ret;
 372
 373         if (!strequal(dom->name, "*")) {
 374                 DEBUG(3, ("idmap_ldap_allocate_id: "
 375                           "Refusing allocation of a new unixid for domain'%s'. "
 376                           "This is only supported for the default "
 377                           "domain \"*\".\n",
 378                            dom->name));
 379                 return NT_STATUS_NOT_IMPLEMENTED;
 380         }
 381
 382         ret = idmap_ldap_allocate_id_internal(dom, id);
 383
 384         return ret;
 385 }
 386
 387
 388 /**********************************************************************
 389  IDMAP MAPPING LDAP BACKEND
 390 **********************************************************************/
 391
 392 static int idmap_ldap_close_destructor(struct idmap_ldap_context *ctx)
 393 {
 394         smbldap_free_struct(&ctx->smbldap_state);
 395         DEBUG(5,("The connection to the LDAP server was closed\n"));
 396         /* maybe free the results here --metze */
 397
 398         return 0;
 399 }
 400
 401 /********************************
 402  Initialise idmap database.
 403 ********************************/
 404
 405 static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
 406                                        const struct id_map *map);
 407
 408 static NTSTATUS idmap_ldap_db_init(struct idmap_domain *dom)
 409 {
 410         NTSTATUS ret;
 411         struct idmap_ldap_context *ctx = NULL;
 412         const char *tmp = NULL;
 413
 414         /* Only do init if we are online */
 415         if (idmap_is_offline()) {
 416                 return NT_STATUS_FILE_IS_OFFLINE;
 417         }
 418
 419         ctx = talloc_zero(dom, struct idmap_ldap_context);
 420         if ( ! ctx) {
 421                 DEBUG(0, ("Out of memory!\n"));
 422                 return NT_STATUS_NO_MEMORY;
 423         }
 424
 425         tmp = idmap_config_const_string(dom->name, "ldap_url", NULL);
 426
 427         if ( ! tmp) {
 428                 DEBUG(1, ("ERROR: missing idmap ldap url\n"));
 429                 ret = NT_STATUS_UNSUCCESSFUL;
 430                 goto done;
 431         }
 432
 433         ctx->url = talloc_strdup(ctx, tmp);
 434
 435         trim_char(ctx->url, '\"', '\"');
 436
 437         tmp = idmap_config_const_string(dom->name, "ldap_base_dn", NULL);
 438         if ( ! tmp || ! *tmp) {
 439                 tmp = lp_ldap_idmap_suffix(talloc_tos());
 440                 if ( ! tmp) {
 441                         DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
 442                         ret = NT_STATUS_UNSUCCESSFUL;
 443                         goto done;
 444                 }
 445         }
 446
 447         ctx->suffix = talloc_strdup(ctx, tmp);
 448         CHECK_ALLOC_DONE(ctx->suffix);
 449
 450         ctx->rw_ops = talloc_zero(ctx, struct idmap_rw_ops);
 451         CHECK_ALLOC_DONE(ctx->rw_ops);
 452
 453         ctx->rw_ops->get_new_id = idmap_ldap_allocate_id_internal;
 454         ctx->rw_ops->set_mapping = idmap_ldap_set_mapping;
 455
 456         /* get_credentials deals with setting up creds */
 457
 458         ret = smbldap_init(ctx, server_event_context(), ctx->url,
 459                            false, NULL, NULL, &ctx->smbldap_state);
 460         if (!NT_STATUS_IS_OK(ret)) {
 461                 DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n", ctx->url));
 462                 goto done;
 463         }
 464
 465         ret = get_credentials( ctx, ctx->smbldap_state,
 466                                dom, &ctx->user_dn );
 467         if ( !NT_STATUS_IS_OK(ret) ) {
 468                 DEBUG(1,("idmap_ldap_db_init: Failed to get connection "
 469                          "credentials (%s)\n", nt_errstr(ret)));
 470                 goto done;
 471         }
 472
 473         /*
 474          * Set the destructor on the context, so that resources are
 475          * properly freed when the context is released.
 476          */
 477         talloc_set_destructor(ctx, idmap_ldap_close_destructor);
 478
 479         dom->private_data = ctx;
 480
 481         ret = verify_idpool(dom);
 482         if (!NT_STATUS_IS_OK(ret)) {
 483                 DEBUG(1, ("idmap_ldap_db_init: failed to verify ID pool (%s)\n",
 484                          nt_errstr(ret)));
 485                 goto done;
 486         }
 487
 488         return NT_STATUS_OK;
 489
 490 /*failed */
 491 done:
 492         talloc_free(ctx);
 493         return ret;
 494 }
 495
 496 /**
 497  * set a mapping.
 498  */
 499
 500 /* TODO: change this:  This function cannot be called to modify a mapping,
 501  * only set a new one */
 502
 503 static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
 504                                        const struct id_map *map)
 505 {
 506         NTSTATUS ret;
 507         TALLOC_CTX *memctx;
 508         struct idmap_ldap_context *ctx;
 509         LDAPMessage *entry = NULL;
 510         LDAPMod **mods = NULL;
 511         const char *type;
 512         char *id_str;
 513         char *sid;
 514         char *dn;
 515         int rc = -1;
 516
 517         /* Only do query if we are online */
 518         if (idmap_is_offline()) {
 519                 return NT_STATUS_FILE_IS_OFFLINE;
 520         }
 521
 522         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 523
 524         switch(map->xid.type) {
 525         case ID_TYPE_UID:
 526                 type = get_attr_key2string(sidmap_attr_list,
 527                                            LDAP_ATTR_UIDNUMBER);
 528                 break;
 529
 530         case ID_TYPE_GID:
 531                 type = get_attr_key2string(sidmap_attr_list,
 532                                            LDAP_ATTR_GIDNUMBER);
 533                 break;
 534
 535         default:
 536                 return NT_STATUS_INVALID_PARAMETER;
 537         }
 538
 539         memctx = talloc_new(ctx);
 540         if ( ! memctx) {
 541                 DEBUG(0, ("Out of memory!\n"));
 542                 return NT_STATUS_NO_MEMORY;
 543         }
 544
 545         id_str = talloc_asprintf(memctx, "%lu", (unsigned long)map->xid.id);
 546         CHECK_ALLOC_DONE(id_str);
 547
 548         sid = talloc_strdup(memctx, sid_string_talloc(memctx, map->sid));
 549         CHECK_ALLOC_DONE(sid);
 550
 551         dn = talloc_asprintf(memctx, "%s=%s,%s",
 552                         get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
 553                         sid,
 554                         ctx->suffix);
 555         CHECK_ALLOC_DONE(dn);
 556
 557         smbldap_set_mod(&mods, LDAP_MOD_ADD,
 558                         "objectClass", LDAP_OBJ_IDMAP_ENTRY);
 559
 560         smbldap_make_mod(smbldap_get_ldap(ctx->smbldap_state),
 561                          entry, &mods, type, id_str);
 562
 563         smbldap_make_mod(smbldap_get_ldap(ctx->smbldap_state), entry, &mods,
 564                          get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
 565                          sid);
 566
 567         if ( ! mods) {
 568                 DEBUG(2, ("ERROR: No mods?\n"));
 569                 ret = NT_STATUS_UNSUCCESSFUL;
 570                 goto done;
 571         }
 572
 573         /* TODO: remove conflicting mappings! */
 574
 575         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SID_ENTRY);
 576
 577         DEBUG(10, ("Set DN %s (%s -> %s)\n", dn, sid, id_str));
 578
 579         rc = smbldap_add(ctx->smbldap_state, dn, mods);
 580         ldap_mods_free(mods, True);
 581
 582         if (rc != LDAP_SUCCESS) {
 583                 char *ld_error = NULL;
 584                 ldap_get_option(smbldap_get_ldap(ctx->smbldap_state),
 585                                 LDAP_OPT_ERROR_STRING, &ld_error);
 586                 DEBUG(0,("ldap_set_mapping_internals: Failed to add %s to %lu "
 587                          "mapping [%s]\n", sid,
 588                          (unsigned long)map->xid.id, type));
 589                 DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n",
 590                         ld_error ? ld_error : "(NULL)", ldap_err2string (rc)));
 591                 if (ld_error) {
 592                         ldap_memfree(ld_error);
 593                 }
 594                 ret = NT_STATUS_UNSUCCESSFUL;
 595                 goto done;
 596         }
 597
 598         DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to "
 599                   "%lu [%s]\n", sid, (unsigned long)map->xid.id, type));
 600
 601         ret = NT_STATUS_OK;
 602
 603 done:
 604         talloc_free(memctx);
 605         return ret;
 606 }
 607
 608 /**
 609  * Create a new mapping for an unmapped SID, also allocating a new ID.
 610  * If possible, this should be run inside a transaction to make the
 611  * action atomic.
 612  */
 613 static NTSTATUS idmap_ldap_new_mapping(struct idmap_domain *dom, struct id_map *map)
 614 {
 615         NTSTATUS ret;
 616         struct idmap_ldap_context *ctx;
 617
 618         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 619
 620         ret = idmap_rw_new_mapping(dom, ctx->rw_ops, map);
 621
 622         return ret;
 623 }
 624
 625 /**********************************
 626  lookup a set of unix ids.
 627 **********************************/
 628
 629 static NTSTATUS idmap_ldap_unixids_to_sids(struct idmap_domain *dom,
 630                                            struct id_map **ids)
 631 {
 632         NTSTATUS ret;
 633         TALLOC_CTX *memctx;
 634         struct idmap_ldap_context *ctx;
 635         LDAPMessage *result = NULL;
 636         LDAPMessage *entry = NULL;
 637         const char *uidNumber;
 638         const char *gidNumber;
 639         const char **attr_list;
 640         char *filter = NULL;
 641         bool multi = False;
 642         int idx = 0;
 643         int bidx = 0;
 644         int count;
 645         int rc;
 646         int i;
 647
 648         /* Only do query if we are online */
 649         if (idmap_is_offline()) {
 650                 return NT_STATUS_FILE_IS_OFFLINE;
 651         }
 652
 653         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 654
 655         memctx = talloc_new(ctx);
 656         if ( ! memctx) {
 657                 DEBUG(0, ("Out of memory!\n"));
 658                 return NT_STATUS_NO_MEMORY;
 659         }
 660
 661         uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
 662         gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
 663
 664         attr_list = get_attr_list(memctx, sidmap_attr_list);
 665
 666         if ( ! ids[1]) {
 667                 /* if we are requested just one mapping use the simple filter */
 668
 669                 filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%lu))",
 670                                 LDAP_OBJ_IDMAP_ENTRY,
 671                                 (ids[0]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
 672                                 (unsigned long)ids[0]->xid.id);
 673                 CHECK_ALLOC_DONE(filter);
 674                 DEBUG(10, ("Filter: [%s]\n", filter));
 675         } else {
 676                 /* multiple mappings */
 677                 multi = True;
 678         }
 679
 680         for (i = 0; ids[i]; i++) {
 681                 ids[i]->status = ID_UNKNOWN;
 682         }
 683
 684 again:
 685         if (multi) {
 686
 687                 talloc_free(filter);
 688                 filter = talloc_asprintf(memctx,
 689                                          "(&(objectClass=%s)(|",
 690                                          LDAP_OBJ_IDMAP_ENTRY);
 691                 CHECK_ALLOC_DONE(filter);
 692
 693                 bidx = idx;
 694                 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 695                         filter = talloc_asprintf_append_buffer(filter, "(%s=%lu)",
 696                                         (ids[idx]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
 697                                         (unsigned long)ids[idx]->xid.id);
 698                         CHECK_ALLOC_DONE(filter);
 699                 }
 700                 filter = talloc_asprintf_append_buffer(filter, "))");
 701                 CHECK_ALLOC_DONE(filter);
 702                 DEBUG(10, ("Filter: [%s]\n", filter));
 703         } else {
 704                 bidx = 0;
 705                 idx = 1;
 706         }
 707
 708         rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
 709                 filter, attr_list, 0, &result);
 710
 711         if (rc != LDAP_SUCCESS) {
 712                 DEBUG(3,("Failure looking up ids (%s)\n", ldap_err2string(rc)));
 713                 ret = NT_STATUS_UNSUCCESSFUL;
 714                 goto done;
 715         }
 716
 717         count = ldap_count_entries(smbldap_get_ldap(ctx->smbldap_state),
 718                                    result);
 719
 720         if (count == 0) {
 721                 DEBUG(10, ("NO SIDs found\n"));
 722         }
 723
 724         for (i = 0; i < count; i++) {
 725                 char *sidstr = NULL;
 726                 char *tmp = NULL;
 727                 enum id_type type;
 728                 struct id_map *map;
 729                 uint32_t id;
 730
 731                 if (i == 0) { /* first entry */
 732                         entry = ldap_first_entry(
 733                                 smbldap_get_ldap(ctx->smbldap_state), result);
 734                 } else { /* following ones */
 735                         entry = ldap_next_entry(
 736                                 smbldap_get_ldap(ctx->smbldap_state), entry);
 737                 }
 738                 if ( ! entry) {
 739                         DEBUG(2, ("ERROR: Unable to fetch ldap entries "
 740                                   "from results\n"));
 741                         break;
 742                 }
 743
 744                 /* first check if the SID is present */
 745                 sidstr = smbldap_talloc_single_attribute(
 746                                 smbldap_get_ldap(ctx->smbldap_state),
 747                                 entry, LDAP_ATTRIBUTE_SID, memctx);
 748                 if ( ! sidstr) { /* no sid, skip entry */
 749                         DEBUG(2, ("WARNING SID not found on entry\n"));
 750                         continue;
 751                 }
 752
 753                 /* now try to see if it is a uid, if not try with a gid
 754                  * (gid is more common, but in case both uidNumber and
 755                  * gidNumber are returned the SID is mapped to the uid
 756                  *not the gid) */
 757                 type = ID_TYPE_UID;
 758                 tmp = smbldap_talloc_single_attribute(
 759                                 smbldap_get_ldap(ctx->smbldap_state),
 760                                 entry, uidNumber, memctx);
 761                 if ( ! tmp) {
 762                         type = ID_TYPE_GID;
 763                         tmp = smbldap_talloc_single_attribute(
 764                                         smbldap_get_ldap(ctx->smbldap_state),
 765                                         entry, gidNumber, memctx);
 766                 }
 767                 if ( ! tmp) { /* wow very strange entry, how did it match ? */
 768                         DEBUG(5, ("Unprobable match on (%s), no uidNumber, "
 769                                   "nor gidNumber returned\n", sidstr));
 770                         TALLOC_FREE(sidstr);
 771                         continue;
 772                 }
 773
 774                 id = strtoul(tmp, NULL, 10);
 775                 if (!idmap_unix_id_is_in_range(id, dom)) {
 776                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
 777                                   "Filtered!\n", id,
 778                                   dom->low_id, dom->high_id));
 779                         TALLOC_FREE(sidstr);
 780                         TALLOC_FREE(tmp);
 781                         continue;
 782                 }
 783                 TALLOC_FREE(tmp);
 784
 785                 map = idmap_find_map_by_id(&ids[bidx], type, id);
 786                 if (!map) {
 787                         DEBUG(2, ("WARNING: couldn't match sid (%s) "
 788                                   "with requested ids\n", sidstr));
 789                         TALLOC_FREE(sidstr);
 790                         continue;
 791                 }
 792
 793                 if ( ! string_to_sid(map->sid, sidstr)) {
 794                         DEBUG(2, ("ERROR: Invalid SID on entry\n"));
 795                         TALLOC_FREE(sidstr);
 796                         continue;
 797                 }
 798
 799                 if (map->status == ID_MAPPED) {
 800                         DEBUG(1, ("WARNING: duplicate %s mapping in LDAP. "
 801                               "overwriting mapping %u -> %s with %u -> %s\n",
 802                               (type == ID_TYPE_UID) ? "UID" : "GID",
 803                               id, sid_string_dbg(map->sid), id, sidstr));
 804                 }
 805
 806                 TALLOC_FREE(sidstr);
 807
 808                 /* mapped */
 809                 map->status = ID_MAPPED;
 810
 811                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 812                            (unsigned long)map->xid.id, map->xid.type));
 813         }
 814
 815         /* free the ldap results */
 816         if (result) {
 817                 ldap_msgfree(result);
 818                 result = NULL;
 819         }
 820
 821         if (multi && ids[idx]) { /* still some values to map */
 822                 goto again;
 823         }
 824
 825         ret = NT_STATUS_OK;
 826
 827         /* mark all unknwon/expired ones as unmapped */
 828         for (i = 0; ids[i]; i++) {
 829                 if (ids[i]->status != ID_MAPPED)
 830                         ids[i]->status = ID_UNMAPPED;
 831         }
 832
 833 done:
 834         talloc_free(memctx);
 835         return ret;
 836 }
 837
 838 /**********************************
 839  lookup a set of sids.
 840 **********************************/
 841
 842 static NTSTATUS idmap_ldap_sids_to_unixids(struct idmap_domain *dom,
 843                                            struct id_map **ids)
 844 {
 845         LDAPMessage *entry = NULL;
 846         NTSTATUS ret;
 847         TALLOC_CTX *memctx;
 848         struct idmap_ldap_context *ctx;
 849         LDAPMessage *result = NULL;
 850         const char *uidNumber;
 851         const char *gidNumber;
 852         const char **attr_list;
 853         char *filter = NULL;
 854         bool multi = False;
 855         int idx = 0;
 856         int bidx = 0;
 857         int count;
 858         int rc;
 859         int i;
 860
 861         /* Only do query if we are online */
 862         if (idmap_is_offline()) {
 863                 return NT_STATUS_FILE_IS_OFFLINE;
 864         }
 865
 866         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 867
 868         memctx = talloc_new(ctx);
 869         if ( ! memctx) {
 870                 DEBUG(0, ("Out of memory!\n"));
 871                 return NT_STATUS_NO_MEMORY;
 872         }
 873
 874         uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
 875         gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
 876
 877         attr_list = get_attr_list(memctx, sidmap_attr_list);
 878
 879         if ( ! ids[1]) {
 880                 /* if we are requested just one mapping use the simple filter */
 881
 882                 filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%s))",
 883                                 LDAP_OBJ_IDMAP_ENTRY,
 884                                 LDAP_ATTRIBUTE_SID,
 885                                 sid_string_talloc(memctx, ids[0]->sid));
 886                 CHECK_ALLOC_DONE(filter);
 887                 DEBUG(10, ("Filter: [%s]\n", filter));
 888         } else {
 889                 /* multiple mappings */
 890                 multi = True;
 891         }
 892
 893         for (i = 0; ids[i]; i++) {
 894                 ids[i]->status = ID_UNKNOWN;
 895         }
 896
 897 again:
 898         if (multi) {
 899
 900                 TALLOC_FREE(filter);
 901                 filter = talloc_asprintf(memctx,
 902                                          "(&(objectClass=%s)(|",
 903                                          LDAP_OBJ_IDMAP_ENTRY);
 904                 CHECK_ALLOC_DONE(filter);
 905
 906                 bidx = idx;
 907                 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 908                         filter = talloc_asprintf_append_buffer(filter, "(%s=%s)",
 909                                         LDAP_ATTRIBUTE_SID,
 910                                         sid_string_talloc(memctx,
 911                                                           ids[idx]->sid));
 912                         CHECK_ALLOC_DONE(filter);
 913                 }
 914                 filter = talloc_asprintf_append_buffer(filter, "))");
 915                 CHECK_ALLOC_DONE(filter);
 916                 DEBUG(10, ("Filter: [%s]", filter));
 917         } else {
 918                 bidx = 0;
 919                 idx = 1;
 920         }
 921
 922         rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
 923                 filter, attr_list, 0, &result);
 924
 925         if (rc != LDAP_SUCCESS) {
 926                 DEBUG(3,("Failure looking up sids (%s)\n",
 927                          ldap_err2string(rc)));
 928                 ret = NT_STATUS_UNSUCCESSFUL;
 929                 goto done;
 930         }
 931
 932         count = ldap_count_entries(smbldap_get_ldap(ctx->smbldap_state),
 933                                    result);
 934
 935         if (count == 0) {
 936                 DEBUG(10, ("NO SIDs found\n"));
 937         }
 938
 939         for (i = 0; i < count; i++) {
 940                 char *sidstr = NULL;
 941                 char *tmp = NULL;
 942                 enum id_type type;
 943                 struct id_map *map;
 944                 struct dom_sid sid;
 945                 uint32_t id;
 946
 947                 if (i == 0) { /* first entry */
 948                         entry = ldap_first_entry(
 949                                 smbldap_get_ldap(ctx->smbldap_state), result);
 950                 } else { /* following ones */
 951                         entry = ldap_next_entry(
 952                                 smbldap_get_ldap(ctx->smbldap_state), entry);
 953                 }
 954                 if ( ! entry) {
 955                         DEBUG(2, ("ERROR: Unable to fetch ldap entries "
 956                                   "from results\n"));
 957                         break;
 958                 }
 959
 960                 /* first check if the SID is present */
 961                 sidstr = smbldap_talloc_single_attribute(
 962                                 smbldap_get_ldap(ctx->smbldap_state),
 963                                 entry, LDAP_ATTRIBUTE_SID, memctx);
 964                 if ( ! sidstr) { /* no sid ??, skip entry */
 965                         DEBUG(2, ("WARNING SID not found on entry\n"));
 966                         continue;
 967                 }
 968
 969                 if ( ! string_to_sid(&sid, sidstr)) {
 970                         DEBUG(2, ("ERROR: Invalid SID on entry\n"));
 971                         TALLOC_FREE(sidstr);
 972                         continue;
 973                 }
 974
 975                 map = idmap_find_map_by_sid(&ids[bidx], &sid);
 976                 if (!map) {
 977                         DEBUG(2, ("WARNING: couldn't find entry sid (%s) "
 978                                   "in ids", sidstr));
 979                         TALLOC_FREE(sidstr);
 980                         continue;
 981                 }
 982
 983                 /* now try to see if it is a uid, if not try with a gid
 984                  * (gid is more common, but in case both uidNumber and
 985                  * gidNumber are returned the SID is mapped to the uid
 986                  * not the gid) */
 987                 type = ID_TYPE_UID;
 988                 tmp = smbldap_talloc_single_attribute(
 989                                 smbldap_get_ldap(ctx->smbldap_state),
 990                                 entry, uidNumber, memctx);
 991                 if ( ! tmp) {
 992                         type = ID_TYPE_GID;
 993                         tmp = smbldap_talloc_single_attribute(
 994                                         smbldap_get_ldap(ctx->smbldap_state),
 995                                         entry, gidNumber, memctx);
 996                 }
 997                 if ( ! tmp) { /* no ids ?? */
 998                         DEBUG(5, ("no uidNumber, "
 999                                   "nor gidNumber attributes found\n"));
1000                         TALLOC_FREE(sidstr);
1001                         continue;
1002                 }
1003
1004                 id = strtoul(tmp, NULL, 10);
1005                 if (!idmap_unix_id_is_in_range(id, dom)) {
1006                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1007                                   "Filtered!\n", id,
1008                                   dom->low_id, dom->high_id));
1009                         TALLOC_FREE(sidstr);
1010                         TALLOC_FREE(tmp);
1011                         continue;
1012                 }
1013                 TALLOC_FREE(tmp);
1014
1015                 if (map->status == ID_MAPPED) {
1016                         DEBUG(1, ("WARNING: duplicate %s mapping in LDAP. "
1017                               "overwriting mapping %s -> %u with %s -> %u\n",
1018                               (type == ID_TYPE_UID) ? "UID" : "GID",
1019                               sidstr, map->xid.id, sidstr, id));
1020                 }
1021
1022                 TALLOC_FREE(sidstr);
1023
1024                 /* mapped */
1025                 map->xid.type = type;
1026                 map->xid.id = id;
1027                 map->status = ID_MAPPED;
1028
1029                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1030                            (unsigned long)map->xid.id, map->xid.type));
1031         }
1032
1033         /* free the ldap results */
1034         if (result) {
1035                 ldap_msgfree(result);
1036                 result = NULL;
1037         }
1038
1039         if (multi && ids[idx]) { /* still some values to map */
1040                 goto again;
1041         }
1042
1043         /*
1044          *  try to create new mappings for unmapped sids
1045          */
1046         for (i = 0; ids[i]; i++) {
1047                 if (ids[i]->status != ID_MAPPED) {
1048                         ids[i]->status = ID_UNMAPPED;
1049                         if (ids[i]->sid != NULL) {
1050                                 ret = idmap_ldap_new_mapping(dom, ids[i]);
1051                                 if (!NT_STATUS_IS_OK(ret)) {
1052                                         goto done;
1053                                 }
1054                         }
1055                 }
1056         }
1057
1058         ret = NT_STATUS_OK;
1059
1060 done:
1061         talloc_free(memctx);
1062         return ret;
1063 }
1064
1065 /**********************************
1066  Close the idmap ldap instance
1067 **********************************/
1068
1069 static struct idmap_methods idmap_ldap_methods = {
1070
1071         .init = idmap_ldap_db_init,
1072         .unixids_to_sids = idmap_ldap_unixids_to_sids,
1073         .sids_to_unixids = idmap_ldap_sids_to_unixids,
1074         .allocate_id = idmap_ldap_allocate_id,
1075 };
1076
1077 NTSTATUS idmap_ldap_init(TALLOC_CTX *);
1078 NTSTATUS idmap_ldap_init(TALLOC_CTX *ctx)
1079 {
1080         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1081                                   &idmap_ldap_methods);
1082 }
1083