From 972efa0a5e548ab9e8bbae20acbaea58f60f12ce Mon Sep 17 00:00:00 2001 From: Jeremy Allison Date: Fri, 30 May 2008 23:50:17 -0700 Subject: [PATCH] Split the winbindd_passdb backend into a 'builtin' and a 'sam' backend. This allows winbindd when running on a Samba PDC to correctly answer wbinfo -u lists and other queries. Jeremy. (cherry picked from commit ce45c773543c6687669fb6a9dd062a6a7e45b409) --- source/winbindd/winbindd_cache.c | 6 +- source/winbindd/winbindd_ndr.c | 9 +- source/winbindd/winbindd_passdb.c | 441 +++++++++++++++++++++++++++++--------- source/winbindd/winbindd_util.c | 8 +- 4 files changed, 349 insertions(+), 115 deletions(-) diff --git a/source/winbindd/winbindd_cache.c b/source/winbindd/winbindd_cache.c index 020338165ba..a11e96e5625 100644 --- a/source/winbindd/winbindd_cache.c +++ b/source/winbindd/winbindd_cache.c @@ -8,7 +8,7 @@ Copyright (C) Volker Lendecke 2005 Copyright (C) Guenther Deschner 2005 Copyright (C) Michael Adam 2007 - + This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or @@ -37,7 +37,7 @@ extern bool opt_nocache; #ifdef HAVE_ADS extern struct winbindd_methods ads_methods; #endif -extern struct winbindd_methods passdb_methods; +extern struct winbindd_methods builtin_passdb_methods; /* * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES. @@ -137,7 +137,7 @@ static struct winbind_cache *get_cache(struct winbindd_domain *domain) /* We have to know what type of domain we are dealing with first. */ if (domain->internal) { - domain->backend = &passdb_methods; + domain->backend = &builtin_passdb_methods; domain->initialized = True; } if ( !domain->initialized ) { diff --git a/source/winbindd/winbindd_ndr.c b/source/winbindd/winbindd_ndr.c index 9d1502afa73..3e3ca3225c6 100644 --- a/source/winbindd/winbindd_ndr.c +++ b/source/winbindd/winbindd_ndr.c @@ -74,7 +74,8 @@ void ndr_print_winbindd_cm_conn(struct ndr_print *ndr, extern struct winbindd_methods ads_methods; #endif extern struct winbindd_methods msrpc_methods; -extern struct winbindd_methods passdb_methods; +extern struct winbindd_methods builtin_passdb_methods; +extern struct winbindd_methods sam_passdb_methods; extern struct winbindd_methods reconnect_methods; extern struct winbindd_methods cache_methods; @@ -97,8 +98,10 @@ void ndr_print_winbindd_methods(struct ndr_print *ndr, } else if (r == &ads_methods) { ndr_print_string(ndr, name, "ads_methods"); #endif - } else if (r == &passdb_methods) { - ndr_print_string(ndr, name, "passdb_methods"); + } else if (r == &builtin_passdb_methods) { + ndr_print_string(ndr, name, "builtin_passdb_methods"); + } else if (r == &sam_passdb_methods) { + ndr_print_string(ndr, name, "sam_passdb_methods"); } else if (r == &reconnect_methods) { ndr_print_string(ndr, name, "reconnect_methods"); } else if (r == &cache_methods) { diff --git a/source/winbindd/winbindd_passdb.c b/source/winbindd/winbindd_passdb.c index 7c1d7bd71b1..8b2016c0310 100644 --- a/source/winbindd/winbindd_passdb.c +++ b/source/winbindd/winbindd_passdb.c @@ -6,6 +6,7 @@ Copyright (C) Tim Potter 2000-2001,2003 Copyright (C) Simo Sorce 2003 Copyright (C) Volker Lendecke 2004 + Copyright (C) Jeremy Allison 2008 This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by @@ -27,20 +28,6 @@ #undef DBGC_CLASS #define DBGC_CLASS DBGC_WINBIND -/* Query display info for a domain. This returns enough information plus a - bit extra to give an overview of domain users for the User Manager - application. */ -static NTSTATUS query_user_list(struct winbindd_domain *domain, - TALLOC_CTX *mem_ctx, - uint32 *num_entries, - WINBIND_USERINFO **info) -{ - /* We don't have users */ - *num_entries = 0; - *info = NULL; - return NT_STATUS_OK; -} - /* list all domain groups */ static NTSTATUS enum_dom_groups(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, @@ -167,16 +154,75 @@ static NTSTATUS rids_to_names(struct winbindd_domain *domain, char ***names, enum lsa_SidType **types) { - return NT_STATUS_UNSUCCESSFUL; -} + size_t i; + bool have_mapped; + bool have_unmapped; -/* Lookup user information from a rid or username. */ -static NTSTATUS query_user(struct winbindd_domain *domain, - TALLOC_CTX *mem_ctx, - const DOM_SID *user_sid, - WINBIND_USERINFO *user_info) -{ - return NT_STATUS_NO_SUCH_USER; + *domain_name = NULL; + *names = NULL; + *types = NULL; + + if (!num_rids) { + return NT_STATUS_OK; + } + + /* Paranoia check */ + if (!sid_check_is_in_builtin(sid) && + !sid_check_is_in_our_domain(sid) && + !sid_check_is_in_unix_users(sid) && + !sid_check_is_unix_users(sid) && + !sid_check_is_in_unix_groups(sid) && + !sid_check_is_unix_groups(sid) && + !sid_check_is_in_wellknown_domain(sid)) + { + DEBUG(0, ("Possible deadlock: Trying to lookup SID %s with " + "passdb backend\n", sid_string_dbg(sid))); + return NT_STATUS_NONE_MAPPED; + } + + *names = TALLOC_ARRAY(mem_ctx, char *, num_rids); + *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids); + + if ((*names == NULL) || (*types == NULL)) { + return NT_STATUS_NO_MEMORY; + } + + have_mapped = have_unmapped = false; + + for (i=0; iaccount_name ); + (*info)[i].full_name = talloc_strdup(mem_ctx, e->fullname ); + (*info)[i].homedir = NULL; + (*info)[i].shell = NULL; + sid_compose(&(*info)[i].user_sid, &domain->sid, e->rid); + + /* For the moment we set the primary group for + every user to be the Domain Users group. + There are serious problems with determining + the actual primary group for large domains. + This should really be made into a 'winbind + force group' smb.conf parameter or + something like that. */ + + sid_compose(&(*info)[i].group_sid, &domain->sid, + DOMAIN_GROUP_RID_USERS); + } + + pdb_search_destroy(ps); + return NT_STATUS_OK; +} + +/* Lookup user information from a rid or username. */ +static NTSTATUS sam_query_user(struct winbindd_domain *domain, + TALLOC_CTX *mem_ctx, + const DOM_SID *user_sid, + WINBIND_USERINFO *user_info) +{ + struct samu *sampass = NULL; + + ZERO_STRUCTP(user_info); + + if (!sid_check_is_in_our_domain(user_sid)) { + return NT_STATUS_NO_SUCH_USER; + } + + DEBUG(10,("sam_query_user: getting samu info for sid %s\n", + sid_string_dbg(user_sid) )); + + if (!(sampass = samu_new(mem_ctx))) { + return NT_STATUS_NO_MEMORY; + } + + if (!pdb_getsampwsid(sampass, user_sid)) { + TALLOC_FREE(sampass); + return NT_STATUS_NO_SUCH_USER; + } + + if (pdb_get_group_sid(sampass) == NULL) { + TALLOC_FREE(sampass); + return NT_STATUS_NO_SUCH_GROUP; + } + + DEBUG(10,("sam_query_user: group sid %s\n", + sid_string_dbg(sampass->group_sid) )); + + sid_copy(&user_info->user_sid, user_sid); + sid_copy(&user_info->group_sid, sampass->group_sid); + + user_info->acct_name = talloc_strdup(mem_ctx, sampass->username ? + sampass->username : ""); + user_info->full_name = talloc_strdup(mem_ctx, sampass->full_name ? + sampass->full_name : ""); + user_info->homedir = talloc_strdup(mem_ctx, sampass->home_dir ? + sampass->home_dir : ""); + if (sampass->unix_pw && sampass->unix_pw->pw_shell) { + user_info->shell = talloc_strdup(mem_ctx, sampass->unix_pw->pw_shell); + } else { + user_info->shell = talloc_strdup(mem_ctx, ""); + } + user_info->primary_gid = sampass->unix_pw ? sampass->unix_pw->pw_gid : (gid_t)-1; + + TALLOC_FREE(sampass); + return NT_STATUS_OK; +} + /* Lookup group membership given a rid. */ -static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, +static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, const DOM_SID *group_sid, uint32 *num_names, DOM_SID **sid_mem, char ***names, @@ -320,83 +605,8 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain, return NT_STATUS_OK; } -/* find the sequence number for a domain */ -static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq) -{ - bool result; - time_t seq_num; - - result = pdb_get_seq_num(&seq_num); - if (!result) { - *seq = 1; - } - - *seq = (int) seq_num; - /* *seq = 1; */ - return NT_STATUS_OK; -} - -static NTSTATUS lockout_policy(struct winbindd_domain *domain, - TALLOC_CTX *mem_ctx, - struct samr_DomInfo12 *policy) -{ - /* actually we have that */ - return NT_STATUS_NOT_IMPLEMENTED; -} - -static NTSTATUS password_policy(struct winbindd_domain *domain, - TALLOC_CTX *mem_ctx, - struct samr_DomInfo1 *policy) -{ - uint32 min_pass_len,pass_hist,password_properties; - time_t u_expire, u_min_age; - NTTIME nt_expire, nt_min_age; - uint32 account_policy_temp; - - if ((policy = TALLOC_ZERO_P(mem_ctx, struct samr_DomInfo1)) == NULL) { - return NT_STATUS_NO_MEMORY; - } - - if (!pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp)) { - return NT_STATUS_ACCESS_DENIED; - } - min_pass_len = account_policy_temp; - - if (!pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp)) { - return NT_STATUS_ACCESS_DENIED; - } - pass_hist = account_policy_temp; - - if (!pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp)) { - return NT_STATUS_ACCESS_DENIED; - } - password_properties = account_policy_temp; - - if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp)) { - return NT_STATUS_ACCESS_DENIED; - } - u_expire = account_policy_temp; - - if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp)) { - return NT_STATUS_ACCESS_DENIED; - } - u_min_age = account_policy_temp; - - unix_to_nt_time_abs(&nt_expire, u_expire); - unix_to_nt_time_abs(&nt_min_age, u_min_age); - - init_samr_DomInfo1(policy, - (uint16)min_pass_len, - (uint16)pass_hist, - password_properties, - nt_expire, - nt_min_age); - - return NT_STATUS_OK; -} - /* get a list of trusted domains */ -static NTSTATUS trusted_domains(struct winbindd_domain *domain, +static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx, uint32 *num_domains, char ***names, @@ -453,20 +663,39 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain, } /* the rpc backend methods are exposed via this structure */ -struct winbindd_methods passdb_methods = { - False, - query_user_list, +struct winbindd_methods builtin_passdb_methods = { + false, + builtin_query_user_list, + enum_dom_groups, + enum_local_groups, + name_to_sid, + sid_to_name, + rids_to_names, + builtin_query_user, + lookup_usergroups, + lookup_useraliases, + builtin_lookup_groupmem, + sequence_number, + lockout_policy, + password_policy, + builtin_trusted_domains, +}; + +/* the rpc backend methods are exposed via this structure */ +struct winbindd_methods sam_passdb_methods = { + false, + sam_query_user_list, enum_dom_groups, enum_local_groups, name_to_sid, sid_to_name, rids_to_names, - query_user, + sam_query_user, lookup_usergroups, lookup_useraliases, - lookup_groupmem, + sam_lookup_groupmem, sequence_number, lockout_policy, password_policy, - trusted_domains, + sam_trusted_domains, }; diff --git a/source/winbindd/winbindd_util.c b/source/winbindd/winbindd_util.c index 9008cf8122b..6a96070f427 100644 --- a/source/winbindd/winbindd_util.c +++ b/source/winbindd/winbindd_util.c @@ -27,7 +27,9 @@ #define DBGC_CLASS DBGC_WINBIND extern struct winbindd_methods cache_methods; -extern struct winbindd_methods passdb_methods; +extern struct winbindd_methods builtin_passdb_methods; +extern struct winbindd_methods sam_passdb_methods; + /** * @file winbindd_util.c @@ -695,7 +697,7 @@ bool init_domain_list(void) /* BUILTIN domain */ - domain = add_trusted_domain("BUILTIN", NULL, &passdb_methods, + domain = add_trusted_domain("BUILTIN", NULL, &builtin_passdb_methods, &global_sid_Builtin); if (domain) { setup_domain_child(domain, @@ -705,7 +707,7 @@ bool init_domain_list(void) /* Local SAM */ domain = add_trusted_domain(get_global_sam_name(), NULL, - &passdb_methods, get_global_sam_sid()); + &sam_passdb_methods, get_global_sam_sid()); if (domain) { if ( role != ROLE_DOMAIN_MEMBER ) { domain->primary = True; -- 2.11.4.GIT