2 Unix SMB/CIFS implementation.
4 Winbind daemon for ntdom nss module
6 Copyright (C) Tim Potter 2000-2001
7 Copyright (C) 2001 by Martin Pool <mbp@samba.org>
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #define DBGC_CLASS DBGC_WINBIND
29 extern struct winbindd_methods cache_methods
;
30 extern struct winbindd_methods builtin_passdb_methods
;
31 extern struct winbindd_methods sam_passdb_methods
;
35 * @file winbindd_util.c
37 * Winbind daemon for NT domain authentication nss module.
41 /* The list of trusted domains. Note that the list can be deleted and
42 recreated using the init_domain_list() function so pointers to
43 individual winbindd_domain structures cannot be made. Keep a copy of
44 the domain name instead. */
46 static struct winbindd_domain
*_domain_list
= NULL
;
48 struct winbindd_domain
*domain_list(void)
52 if ((!_domain_list
) && (!init_domain_list())) {
53 smb_panic("Init_domain_list failed");
59 /* Free all entries in the trusted domain list */
61 void free_domain_list(void)
63 struct winbindd_domain
*domain
= _domain_list
;
66 struct winbindd_domain
*next
= domain
->next
;
68 DLIST_REMOVE(_domain_list
, domain
);
74 static bool is_internal_domain(const DOM_SID
*sid
)
79 return (sid_check_is_domain(sid
) || sid_check_is_builtin(sid
));
82 static bool is_in_internal_domain(const DOM_SID
*sid
)
87 return (sid_check_is_in_our_domain(sid
) || sid_check_is_in_builtin(sid
));
91 /* Add a trusted domain to our list of domains */
92 static struct winbindd_domain
*add_trusted_domain(const char *domain_name
, const char *alt_name
,
93 struct winbindd_methods
*methods
,
96 struct winbindd_domain
*domain
;
97 const char *alternative_name
= NULL
;
98 char *idmap_config_option
;
100 const char **ignored_domains
, **dom
;
102 ignored_domains
= lp_parm_string_list(-1, "winbind", "ignore domains", NULL
);
103 for (dom
=ignored_domains
; dom
&& *dom
; dom
++) {
104 if (gen_fnmatch(*dom
, domain_name
) == 0) {
105 DEBUG(2,("Ignoring domain '%s'\n", domain_name
));
110 /* ignore alt_name if we are not in an AD domain */
112 if ( (lp_security() == SEC_ADS
) && alt_name
&& *alt_name
) {
113 alternative_name
= alt_name
;
116 /* We can't call domain_list() as this function is called from
117 init_domain_list() and we'll get stuck in a loop. */
118 for (domain
= _domain_list
; domain
; domain
= domain
->next
) {
119 if (strequal(domain_name
, domain
->name
) ||
120 strequal(domain_name
, domain
->alt_name
))
125 if (alternative_name
&& *alternative_name
)
127 if (strequal(alternative_name
, domain
->name
) ||
128 strequal(alternative_name
, domain
->alt_name
))
136 if (is_null_sid(sid
)) {
140 if (sid_equal(sid
, &domain
->sid
)) {
146 /* See if we found a match. Check if we need to update the
149 if ( domain
&& sid
) {
150 if ( sid_equal( &domain
->sid
, &global_sid_NULL
) )
151 sid_copy( &domain
->sid
, sid
);
156 /* Create new domain entry */
158 if ((domain
= SMB_MALLOC_P(struct winbindd_domain
)) == NULL
)
163 ZERO_STRUCTP(domain
);
165 fstrcpy(domain
->name
, domain_name
);
166 if (alternative_name
) {
167 fstrcpy(domain
->alt_name
, alternative_name
);
170 domain
->methods
= methods
;
171 domain
->backend
= NULL
;
172 domain
->internal
= is_internal_domain(sid
);
173 domain
->sequence_number
= DOM_SEQUENCE_NONE
;
174 domain
->last_seq_check
= 0;
175 domain
->initialized
= False
;
176 domain
->online
= is_internal_domain(sid
);
177 domain
->check_online_timeout
= 0;
178 domain
->dc_probe_pid
= (pid_t
)-1;
180 sid_copy(&domain
->sid
, sid
);
183 /* Link to domain list */
184 DLIST_ADD_END(_domain_list
, domain
, struct winbindd_domain
*);
186 wcache_tdc_add_domain( domain
);
188 idmap_config_option
= talloc_asprintf(talloc_tos(), "idmap config %s",
190 if (idmap_config_option
== NULL
) {
191 DEBUG(0, ("talloc failed, not looking for idmap config\n"));
195 param
= lp_parm_const_string(-1, idmap_config_option
, "range", NULL
);
197 DEBUG(10, ("%s : range = %s\n", idmap_config_option
,
198 param
? param
: "not defined"));
201 unsigned low_id
, high_id
;
202 if (sscanf(param
, "%u - %u", &low_id
, &high_id
) != 2) {
203 DEBUG(1, ("invalid range syntax in %s: %s\n",
204 idmap_config_option
, param
));
207 if (low_id
> high_id
) {
208 DEBUG(1, ("invalid range in %s: %s\n",
209 idmap_config_option
, param
));
212 domain
->have_idmap_config
= true;
213 domain
->id_range_low
= low_id
;
214 domain
->id_range_high
= high_id
;
219 DEBUG(2,("Added domain %s %s %s\n",
220 domain
->name
, domain
->alt_name
,
221 &domain
->sid
?sid_string_dbg(&domain
->sid
):""));
226 /********************************************************************
227 rescan our domains looking for new trusted domains
228 ********************************************************************/
230 struct trustdom_state
{
234 struct winbindd_response
*response
;
237 static void trustdom_recv(void *private_data
, bool success
);
238 static void rescan_forest_root_trusts( void );
239 static void rescan_forest_trusts( void );
241 static void add_trusted_domains( struct winbindd_domain
*domain
)
244 struct winbindd_request
*request
;
245 struct winbindd_response
*response
;
246 uint32 fr_flags
= (NETR_TRUST_FLAG_TREEROOT
|NETR_TRUST_FLAG_IN_FOREST
);
248 struct trustdom_state
*state
;
250 mem_ctx
= talloc_init("add_trusted_domains");
251 if (mem_ctx
== NULL
) {
252 DEBUG(0, ("talloc_init failed\n"));
256 request
= TALLOC_ZERO_P(mem_ctx
, struct winbindd_request
);
257 response
= TALLOC_P(mem_ctx
, struct winbindd_response
);
258 state
= TALLOC_P(mem_ctx
, struct trustdom_state
);
260 if ((request
== NULL
) || (response
== NULL
) || (state
== NULL
)) {
261 DEBUG(0, ("talloc failed\n"));
262 talloc_destroy(mem_ctx
);
266 state
->mem_ctx
= mem_ctx
;
267 state
->response
= response
;
269 /* Flags used to know how to continue the forest trust search */
271 state
->primary
= domain
->primary
;
272 state
->forest_root
= ((domain
->domain_flags
& fr_flags
) == fr_flags
);
274 request
->length
= sizeof(*request
);
275 request
->cmd
= WINBINDD_LIST_TRUSTDOM
;
277 async_domain_request(mem_ctx
, domain
, request
, response
,
278 trustdom_recv
, state
);
281 static void trustdom_recv(void *private_data
, bool success
)
283 struct trustdom_state
*state
=
284 talloc_get_type_abort(private_data
, struct trustdom_state
);
285 struct winbindd_response
*response
= state
->response
;
288 if ((!success
) || (response
->result
!= WINBINDD_OK
)) {
289 DEBUG(1, ("Could not receive trustdoms\n"));
290 talloc_destroy(state
->mem_ctx
);
294 p
= (char *)response
->extra_data
.data
;
296 while ((p
!= NULL
) && (*p
!= '\0')) {
297 char *q
, *sidstr
, *alt_name
;
299 struct winbindd_domain
*domain
;
300 char *alternate_name
= NULL
;
302 alt_name
= strchr(p
, '\\');
303 if (alt_name
== NULL
) {
304 DEBUG(0, ("Got invalid trustdom response\n"));
311 sidstr
= strchr(alt_name
, '\\');
312 if (sidstr
== NULL
) {
313 DEBUG(0, ("Got invalid trustdom response\n"));
320 q
= strchr(sidstr
, '\n');
324 if (!string_to_sid(&sid
, sidstr
)) {
325 /* Allow NULL sid for sibling domains */
326 if ( strcmp(sidstr
,"S-0-0") == 0) {
327 sid_copy( &sid
, &global_sid_NULL
);
329 DEBUG(0, ("Got invalid trustdom response\n"));
334 /* use the real alt_name if we have one, else pass in NULL */
336 if ( !strequal( alt_name
, "(null)" ) )
337 alternate_name
= alt_name
;
339 /* If we have an existing domain structure, calling
340 add_trusted_domain() will update the SID if
341 necessary. This is important because we need the
342 SID for sibling domains */
344 if ( find_domain_from_name_noinit(p
) != NULL
) {
345 domain
= add_trusted_domain(p
, alternate_name
,
349 domain
= add_trusted_domain(p
, alternate_name
,
353 setup_domain_child(domain
,
363 Cases to consider when scanning trusts:
364 (a) we are calling from a child domain (primary && !forest_root)
365 (b) we are calling from the root of the forest (primary && forest_root)
366 (c) we are calling from a trusted forest domain (!primary
370 if ( state
->primary
) {
371 /* If this is our primary domain and we are not in the
372 forest root, we have to scan the root trusts first */
374 if ( !state
->forest_root
)
375 rescan_forest_root_trusts();
377 rescan_forest_trusts();
379 } else if ( state
->forest_root
) {
380 /* Once we have done root forest trust search, we can
381 go on to search the trusted forests */
383 rescan_forest_trusts();
386 talloc_destroy(state
->mem_ctx
);
391 /********************************************************************
392 Scan the trusts of our forest root
393 ********************************************************************/
395 static void rescan_forest_root_trusts( void )
397 struct winbindd_tdc_domain
*dom_list
= NULL
;
398 size_t num_trusts
= 0;
401 /* The only transitive trusts supported by Windows 2003 AD are
402 (a) Parent-Child, (b) Tree-Root, and (c) Forest. The
403 first two are handled in forest and listed by
404 DsEnumerateDomainTrusts(). Forest trusts are not so we
405 have to do that ourselves. */
407 if ( !wcache_tdc_fetch_list( &dom_list
, &num_trusts
) )
410 for ( i
=0; i
<num_trusts
; i
++ ) {
411 struct winbindd_domain
*d
= NULL
;
413 /* Find the forest root. Don't necessarily trust
414 the domain_list() as our primary domain may not
415 have been initialized. */
417 if ( !(dom_list
[i
].trust_flags
& NETR_TRUST_FLAG_TREEROOT
) ) {
421 /* Here's the forest root */
423 d
= find_domain_from_name_noinit( dom_list
[i
].domain_name
);
426 d
= add_trusted_domain( dom_list
[i
].domain_name
,
427 dom_list
[i
].dns_name
,
436 DEBUG(10,("rescan_forest_root_trusts: Following trust path "
437 "for domain tree root %s (%s)\n",
438 d
->name
, d
->alt_name
));
440 d
->domain_flags
= dom_list
[i
].trust_flags
;
441 d
->domain_type
= dom_list
[i
].trust_type
;
442 d
->domain_trust_attribs
= dom_list
[i
].trust_attribs
;
444 add_trusted_domains( d
);
449 TALLOC_FREE( dom_list
);
454 /********************************************************************
455 scan the transitive forest trusts (not our own)
456 ********************************************************************/
459 static void rescan_forest_trusts( void )
461 struct winbindd_domain
*d
= NULL
;
462 struct winbindd_tdc_domain
*dom_list
= NULL
;
463 size_t num_trusts
= 0;
466 /* The only transitive trusts supported by Windows 2003 AD are
467 (a) Parent-Child, (b) Tree-Root, and (c) Forest. The
468 first two are handled in forest and listed by
469 DsEnumerateDomainTrusts(). Forest trusts are not so we
470 have to do that ourselves. */
472 if ( !wcache_tdc_fetch_list( &dom_list
, &num_trusts
) )
475 for ( i
=0; i
<num_trusts
; i
++ ) {
476 uint32 flags
= dom_list
[i
].trust_flags
;
477 uint32 type
= dom_list
[i
].trust_type
;
478 uint32 attribs
= dom_list
[i
].trust_attribs
;
480 d
= find_domain_from_name_noinit( dom_list
[i
].domain_name
);
482 /* ignore our primary and internal domains */
484 if ( d
&& (d
->internal
|| d
->primary
) )
487 if ( (flags
& NETR_TRUST_FLAG_INBOUND
) &&
488 (type
== NETR_TRUST_TYPE_UPLEVEL
) &&
489 (attribs
== NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
) )
491 /* add the trusted domain if we don't know
495 d
= add_trusted_domain( dom_list
[i
].domain_name
,
496 dom_list
[i
].dns_name
,
505 DEBUG(10,("Following trust path for domain %s (%s)\n",
506 d
->name
, d
->alt_name
));
507 add_trusted_domains( d
);
511 TALLOC_FREE( dom_list
);
516 /*********************************************************************
517 The process of updating the trusted domain list is a three step
520 (b) ask the root domain in our forest
521 (c) ask the a DC in any Win2003 trusted forests
522 *********************************************************************/
524 void rescan_trusted_domains(struct tevent_context
*ev
, struct tevent_timer
*te
,
525 struct timeval now
, void *private_data
)
529 /* I use to clear the cache here and start over but that
530 caused problems in child processes that needed the
531 trust dom list early on. Removing it means we
532 could have some trusted domains listed that have been
533 removed from our primary domain's DC until a full
534 restart. This should be ok since I think this is what
535 Windows does as well. */
537 /* this will only add new domains we didn't already know about
538 in the domain_list()*/
540 add_trusted_domains( find_our_domain() );
542 te
= tevent_add_timer(
543 ev
, NULL
, timeval_current_ofs(WINBINDD_RESCAN_FREQ
, 0),
544 rescan_trusted_domains
, NULL
);
546 * If te == NULL, there's not much we can do here. Don't fail, the
547 * only thing we miss is new trusted domains.
553 enum winbindd_result
winbindd_dual_init_connection(struct winbindd_domain
*domain
,
554 struct winbindd_cli_state
*state
)
556 /* Ensure null termination */
557 state
->request
->domain_name
558 [sizeof(state
->request
->domain_name
)-1]='\0';
559 state
->request
->data
.init_conn
.dcname
560 [sizeof(state
->request
->data
.init_conn
.dcname
)-1]='\0';
562 if (strlen(state
->request
->data
.init_conn
.dcname
) > 0) {
563 fstrcpy(domain
->dcname
, state
->request
->data
.init_conn
.dcname
);
566 if (domain
->internal
) {
567 domain
->initialized
= true;
569 init_dc_connection(domain
);
572 if (!domain
->initialized
) {
573 /* If we return error here we can't do any cached authentication,
574 but we may be in disconnected mode and can't initialize correctly.
575 Do what the previous code did and just return without initialization,
576 once we go online we'll re-initialize.
578 DEBUG(5, ("winbindd_dual_init_connection: %s returning without initialization "
579 "online = %d\n", domain
->name
, (int)domain
->online
));
582 fstrcpy(state
->response
->data
.domain_info
.name
, domain
->name
);
583 fstrcpy(state
->response
->data
.domain_info
.alt_name
, domain
->alt_name
);
584 sid_to_fstring(state
->response
->data
.domain_info
.sid
, &domain
->sid
);
586 state
->response
->data
.domain_info
.native_mode
587 = domain
->native_mode
;
588 state
->response
->data
.domain_info
.active_directory
589 = domain
->active_directory
;
590 state
->response
->data
.domain_info
.primary
596 /* Look up global info for the winbind daemon */
597 bool init_domain_list(void)
599 struct winbindd_domain
*domain
;
600 int role
= lp_server_role();
602 /* Free existing list */
607 domain
= add_trusted_domain("BUILTIN", NULL
, &builtin_passdb_methods
,
608 &global_sid_Builtin
);
610 setup_domain_child(domain
,
616 domain
= add_trusted_domain(get_global_sam_name(), NULL
,
617 &sam_passdb_methods
, get_global_sam_sid());
619 if ( role
!= ROLE_DOMAIN_MEMBER
) {
620 domain
->primary
= True
;
622 setup_domain_child(domain
,
626 /* Add ourselves as the first entry. */
628 if ( role
== ROLE_DOMAIN_MEMBER
) {
631 if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid
)) {
632 DEBUG(0, ("Could not fetch our SID - did we join?\n"));
636 domain
= add_trusted_domain( lp_workgroup(), lp_realm(),
637 &cache_methods
, &our_sid
);
639 domain
->primary
= True
;
640 setup_domain_child(domain
,
643 /* Even in the parent winbindd we'll need to
644 talk to the DC, so try and see if we can
645 contact it. Theoretically this isn't neccessary
646 as the init_dc_connection() in init_child_recv()
647 will do this, but we can start detecting the DC
649 set_domain_online_request(domain
);
656 void check_domain_trusted( const char *name
, const DOM_SID
*user_sid
)
658 struct winbindd_domain
*domain
;
662 /* Check if we even care */
664 if (!lp_allow_trusted_domains())
667 domain
= find_domain_from_name_noinit( name
);
671 sid_copy( &dom_sid
, user_sid
);
672 if ( !sid_split_rid( &dom_sid
, &rid
) )
675 /* add the newly discovered trusted domain */
677 domain
= add_trusted_domain( name
, NULL
, &cache_methods
,
683 /* assume this is a trust from a one-way transitive
686 domain
->active_directory
= True
;
687 domain
->domain_flags
= NETR_TRUST_FLAG_OUTBOUND
;
688 domain
->domain_type
= NETR_TRUST_TYPE_UPLEVEL
;
689 domain
->internal
= False
;
690 domain
->online
= True
;
692 setup_domain_child(domain
,
695 wcache_tdc_add_domain( domain
);
701 * Given a domain name, return the struct winbindd domain info for it
703 * @note Do *not* pass lp_workgroup() to this function. domain_list
704 * may modify it's value, and free that pointer. Instead, our local
705 * domain may be found by calling find_our_domain().
709 * @return The domain structure for the named domain, if it is working.
712 struct winbindd_domain
*find_domain_from_name_noinit(const char *domain_name
)
714 struct winbindd_domain
*domain
;
716 /* Search through list */
718 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
719 if (strequal(domain_name
, domain
->name
) ||
720 (domain
->alt_name
[0] &&
721 strequal(domain_name
, domain
->alt_name
))) {
731 struct winbindd_domain
*find_domain_from_name(const char *domain_name
)
733 struct winbindd_domain
*domain
;
735 domain
= find_domain_from_name_noinit(domain_name
);
740 if (!domain
->initialized
)
741 init_dc_connection(domain
);
746 /* Given a domain sid, return the struct winbindd domain info for it */
748 struct winbindd_domain
*find_domain_from_sid_noinit(const DOM_SID
*sid
)
750 struct winbindd_domain
*domain
;
752 /* Search through list */
754 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
755 if (sid_compare_domain(sid
, &domain
->sid
) == 0)
764 /* Given a domain sid, return the struct winbindd domain info for it */
766 struct winbindd_domain
*find_domain_from_sid(const DOM_SID
*sid
)
768 struct winbindd_domain
*domain
;
770 domain
= find_domain_from_sid_noinit(sid
);
775 if (!domain
->initialized
)
776 init_dc_connection(domain
);
781 struct winbindd_domain
*find_our_domain(void)
783 struct winbindd_domain
*domain
;
785 /* Search through list */
787 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
792 smb_panic("Could not find our domain");
796 struct winbindd_domain
*find_root_domain(void)
798 struct winbindd_domain
*ours
= find_our_domain();
803 if ( strlen(ours
->forest_name
) == 0 )
806 return find_domain_from_name( ours
->forest_name
);
809 struct winbindd_domain
*find_builtin_domain(void)
812 struct winbindd_domain
*domain
;
814 string_to_sid(&sid
, "S-1-5-32");
815 domain
= find_domain_from_sid(&sid
);
817 if (domain
== NULL
) {
818 smb_panic("Could not find BUILTIN domain");
824 /* Find the appropriate domain to lookup a name or SID */
826 struct winbindd_domain
*find_lookup_domain_from_sid(const DOM_SID
*sid
)
828 /* SIDs in the S-1-22-{1,2} domain should be handled by our passdb */
830 if ( sid_check_is_in_unix_groups(sid
) ||
831 sid_check_is_unix_groups(sid
) ||
832 sid_check_is_in_unix_users(sid
) ||
833 sid_check_is_unix_users(sid
) )
835 return find_domain_from_sid(get_global_sam_sid());
838 /* A DC can't ask the local smbd for remote SIDs, here winbindd is the
839 * one to contact the external DC's. On member servers the internal
840 * domains are different: These are part of the local SAM. */
842 DEBUG(10, ("find_lookup_domain_from_sid(%s)\n", sid_string_dbg(sid
)));
844 if (IS_DC
|| is_internal_domain(sid
) || is_in_internal_domain(sid
)) {
845 DEBUG(10, ("calling find_domain_from_sid\n"));
846 return find_domain_from_sid(sid
);
849 /* On a member server a query for SID or name can always go to our
852 DEBUG(10, ("calling find_our_domain\n"));
853 return find_our_domain();
856 struct winbindd_domain
*find_lookup_domain_from_name(const char *domain_name
)
858 if ( strequal(domain_name
, unix_users_domain_name() ) ||
859 strequal(domain_name
, unix_groups_domain_name() ) )
862 * The "Unix User" and "Unix Group" domain our handled by
865 return find_domain_from_name_noinit( get_global_sam_name() );
868 if (IS_DC
|| strequal(domain_name
, "BUILTIN") ||
869 strequal(domain_name
, get_global_sam_name()))
870 return find_domain_from_name_noinit(domain_name
);
873 return find_our_domain();
876 /* Lookup a sid in a domain from a name */
878 bool winbindd_lookup_sid_by_name(TALLOC_CTX
*mem_ctx
,
879 enum winbindd_cmd orig_cmd
,
880 struct winbindd_domain
*domain
,
881 const char *domain_name
,
882 const char *name
, DOM_SID
*sid
,
883 enum lsa_SidType
*type
)
888 * For all but LOOKUPNAME we have to avoid nss calls to avoid
891 result
= domain
->methods
->name_to_sid(
892 domain
, mem_ctx
, domain_name
, name
,
893 orig_cmd
== WINBINDD_LOOKUPNAME
? 0 : LOOKUP_NAME_NO_NSS
,
896 /* Return sid and type if lookup successful */
897 if (!NT_STATUS_IS_OK(result
)) {
898 *type
= SID_NAME_UNKNOWN
;
901 return NT_STATUS_IS_OK(result
);
905 * @brief Lookup a name in a domain from a sid.
907 * @param sid Security ID you want to look up.
908 * @param name On success, set to the name corresponding to @p sid.
909 * @param dom_name On success, set to the 'domain name' corresponding to @p sid.
910 * @param type On success, contains the type of name: alias, group or
912 * @retval True if the name exists, in which case @p name and @p type
913 * are set, otherwise False.
915 bool winbindd_lookup_name_by_sid(TALLOC_CTX
*mem_ctx
,
916 struct winbindd_domain
*domain
,
920 enum lsa_SidType
*type
)
929 result
= domain
->methods
->sid_to_name(domain
, mem_ctx
, sid
, dom_name
, name
, type
);
931 /* Return name and type if successful */
933 if (NT_STATUS_IS_OK(result
)) {
937 *type
= SID_NAME_UNKNOWN
;
942 /* Free state information held for {set,get,end}{pw,gr}ent() functions */
944 void free_getent_state(struct getent_state
*state
)
946 struct getent_state
*temp
;
948 /* Iterate over state list */
952 while(temp
!= NULL
) {
953 struct getent_state
*next
= temp
->next
;
955 /* Free sam entries then list entry */
957 SAFE_FREE(state
->sam_entries
);
958 DLIST_REMOVE(state
, state
);
965 /* Is this a domain which we may assume no DOMAIN\ prefix? */
967 static bool assume_domain(const char *domain
)
969 /* never assume the domain on a standalone server */
971 if ( lp_server_role() == ROLE_STANDALONE
)
974 /* domain member servers may possibly assume for the domain name */
976 if ( lp_server_role() == ROLE_DOMAIN_MEMBER
) {
977 if ( !strequal(lp_workgroup(), domain
) )
980 if ( lp_winbind_use_default_domain() || lp_winbind_trusted_domains_only() )
984 /* only left with a domain controller */
986 if ( strequal(get_global_sam_name(), domain
) ) {
993 /* Parse a string of the form DOMAIN\user into a domain and a user */
995 bool parse_domain_user(const char *domuser
, fstring domain
, fstring user
)
997 char *p
= strchr(domuser
,*lp_winbind_separator());
1000 fstrcpy(user
, domuser
);
1002 if ( assume_domain(lp_workgroup())) {
1003 fstrcpy(domain
, lp_workgroup());
1004 } else if ((p
= strchr(domuser
, '@')) != NULL
) {
1005 fstrcpy(domain
, p
+ 1);
1006 user
[PTR_DIFF(p
, domuser
)] = 0;
1012 fstrcpy(domain
, domuser
);
1013 domain
[PTR_DIFF(p
, domuser
)] = 0;
1021 bool parse_domain_user_talloc(TALLOC_CTX
*mem_ctx
, const char *domuser
,
1022 char **domain
, char **user
)
1024 fstring fstr_domain
, fstr_user
;
1025 if (!parse_domain_user(domuser
, fstr_domain
, fstr_user
)) {
1028 *domain
= talloc_strdup(mem_ctx
, fstr_domain
);
1029 *user
= talloc_strdup(mem_ctx
, fstr_user
);
1030 return ((*domain
!= NULL
) && (*user
!= NULL
));
1033 /* add a domain user name to a buffer */
1034 void parse_add_domuser(void *buf
, char *domuser
, int *len
)
1040 p
= strchr(domuser
, *lp_winbind_separator());
1044 fstrcpy(domain
, domuser
);
1045 domain
[PTR_DIFF(p
, domuser
)] = 0;
1048 if (assume_domain(domain
)) {
1051 *len
-= (PTR_DIFF(p
, domuser
));
1055 safe_strcpy((char *)buf
, user
, *len
);
1058 /* Ensure an incoming username from NSS is fully qualified. Replace the
1059 incoming fstring with DOMAIN <separator> user. Returns the same
1060 values as parse_domain_user() but also replaces the incoming username.
1061 Used to ensure all names are fully qualified within winbindd.
1062 Used by the NSS protocols of auth, chauthtok, logoff and ccache_ntlm_auth.
1063 The protocol definitions of auth_crap, chng_pswd_auth_crap
1064 really should be changed to use this instead of doing things
1067 bool canonicalize_username(fstring username_inout
, fstring domain
, fstring user
)
1069 if (!parse_domain_user(username_inout
, domain
, user
)) {
1072 slprintf(username_inout
, sizeof(fstring
) - 1, "%s%c%s",
1073 domain
, *lp_winbind_separator(),
1079 Fill DOMAIN\\USERNAME entry accounting 'winbind use default domain' and
1080 'winbind separator' options.
1082 - omit DOMAIN when 'winbind use default domain = true' and DOMAIN is
1085 If we are a PDC or BDC, and this is for our domain, do likewise.
1087 Also, if omit DOMAIN if 'winbind trusted domains only = true', as the
1088 username is then unqualified in unix
1090 We always canonicalize as UPPERCASE DOMAIN, lowercase username.
1092 void fill_domain_username(fstring name
, const char *domain
, const char *user
, bool can_assume
)
1096 fstrcpy(tmp_user
, user
);
1097 strlower_m(tmp_user
);
1099 if (can_assume
&& assume_domain(domain
)) {
1100 strlcpy(name
, tmp_user
, sizeof(fstring
));
1102 slprintf(name
, sizeof(fstring
) - 1, "%s%c%s",
1103 domain
, *lp_winbind_separator(),
1109 * talloc version of fill_domain_username()
1110 * return NULL on talloc failure.
1112 char *fill_domain_username_talloc(TALLOC_CTX
*mem_ctx
,
1117 char *tmp_user
, *name
;
1119 tmp_user
= talloc_strdup(mem_ctx
, user
);
1120 strlower_m(tmp_user
);
1122 if (can_assume
&& assume_domain(domain
)) {
1125 name
= talloc_asprintf(mem_ctx
, "%s%c%s",
1127 *lp_winbind_separator(),
1129 TALLOC_FREE(tmp_user
);
1136 * Winbindd socket accessor functions
1139 const char *get_winbind_pipe_dir(void)
1141 return lp_parm_const_string(-1, "winbindd", "socket dir", WINBINDD_SOCKET_DIR
);
1144 char *get_winbind_priv_pipe_dir(void)
1146 return lock_path(WINBINDD_PRIV_SOCKET_SUBDIR
);
1149 /* Open the winbindd socket */
1151 static int _winbindd_socket
= -1;
1152 static int _winbindd_priv_socket
= -1;
1154 int open_winbindd_socket(void)
1156 if (_winbindd_socket
== -1) {
1157 _winbindd_socket
= create_pipe_sock(
1158 get_winbind_pipe_dir(), WINBINDD_SOCKET_NAME
, 0755);
1159 DEBUG(10, ("open_winbindd_socket: opened socket fd %d\n",
1163 return _winbindd_socket
;
1166 int open_winbindd_priv_socket(void)
1168 if (_winbindd_priv_socket
== -1) {
1169 _winbindd_priv_socket
= create_pipe_sock(
1170 get_winbind_priv_pipe_dir(), WINBINDD_SOCKET_NAME
, 0750);
1171 DEBUG(10, ("open_winbindd_priv_socket: opened socket fd %d\n",
1172 _winbindd_priv_socket
));
1175 return _winbindd_priv_socket
;
1179 * Client list accessor functions
1182 static struct winbindd_cli_state
*_client_list
;
1183 static int _num_clients
;
1185 /* Return list of all connected clients */
1187 struct winbindd_cli_state
*winbindd_client_list(void)
1189 return _client_list
;
1192 /* Add a connection to the list */
1194 void winbindd_add_client(struct winbindd_cli_state
*cli
)
1196 DLIST_ADD(_client_list
, cli
);
1200 /* Remove a client from the list */
1202 void winbindd_remove_client(struct winbindd_cli_state
*cli
)
1204 DLIST_REMOVE(_client_list
, cli
);
1208 /* Close all open clients */
1210 void winbindd_kill_all_clients(void)
1212 struct winbindd_cli_state
*cl
= winbindd_client_list();
1214 DEBUG(10, ("winbindd_kill_all_clients: going postal\n"));
1217 struct winbindd_cli_state
*next
;
1220 winbindd_remove_client(cl
);
1225 /* Return number of open clients */
1227 int winbindd_num_clients(void)
1229 return _num_clients
;
1232 NTSTATUS
lookup_usergroups_cached(struct winbindd_domain
*domain
,
1233 TALLOC_CTX
*mem_ctx
,
1234 const DOM_SID
*user_sid
,
1235 uint32
*p_num_groups
, DOM_SID
**user_sids
)
1237 struct netr_SamInfo3
*info3
= NULL
;
1238 NTSTATUS status
= NT_STATUS_NO_MEMORY
;
1239 size_t num_groups
= 0;
1241 DEBUG(3,(": lookup_usergroups_cached\n"));
1246 info3
= netsamlogon_cache_get(mem_ctx
, user_sid
);
1248 if (info3
== NULL
) {
1249 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1252 if (info3
->base
.groups
.count
== 0) {
1254 return NT_STATUS_UNSUCCESSFUL
;
1257 /* Skip Domain local groups outside our domain.
1258 We'll get these from the getsidaliases() RPC call. */
1259 status
= sid_array_from_info3(mem_ctx
, info3
,
1264 if (!NT_STATUS_IS_OK(status
)) {
1270 *p_num_groups
= num_groups
;
1271 status
= (user_sids
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1273 DEBUG(3,(": lookup_usergroups_cached succeeded\n"));
1278 /*********************************************************************
1279 We use this to remove spaces from user and group names
1280 ********************************************************************/
1282 NTSTATUS
normalize_name_map(TALLOC_CTX
*mem_ctx
,
1283 struct winbindd_domain
*domain
,
1289 if (!name
|| !normalized
) {
1290 return NT_STATUS_INVALID_PARAMETER
;
1293 if (!lp_winbind_normalize_names()) {
1294 return NT_STATUS_PROCEDURE_NOT_FOUND
;
1297 /* Alias support and whitespace replacement are mutually
1300 nt_status
= resolve_username_to_alias(mem_ctx
, domain
,
1302 if (NT_STATUS_IS_OK(nt_status
)) {
1303 /* special return code to let the caller know we
1304 mapped to an alias */
1305 return NT_STATUS_FILE_RENAMED
;
1308 /* check for an unreachable domain */
1310 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
1311 DEBUG(5,("normalize_name_map: Setting domain %s offline\n",
1313 set_domain_offline(domain
);
1317 /* deal with whitespace */
1319 *normalized
= talloc_strdup(mem_ctx
, name
);
1320 if (!(*normalized
)) {
1321 return NT_STATUS_NO_MEMORY
;
1324 all_string_sub( *normalized
, " ", "_", 0 );
1326 return NT_STATUS_OK
;
1329 /*********************************************************************
1330 We use this to do the inverse of normalize_name_map()
1331 ********************************************************************/
1333 NTSTATUS
normalize_name_unmap(TALLOC_CTX
*mem_ctx
,
1338 struct winbindd_domain
*domain
= find_our_domain();
1340 if (!name
|| !normalized
) {
1341 return NT_STATUS_INVALID_PARAMETER
;
1344 if (!lp_winbind_normalize_names()) {
1345 return NT_STATUS_PROCEDURE_NOT_FOUND
;
1348 /* Alias support and whitespace replacement are mutally
1351 /* When mapping from an alias to a username, we don't know the
1352 domain. But we only need a domain structure to cache
1353 a successful lookup , so just our own domain structure for
1356 nt_status
= resolve_alias_to_username(mem_ctx
, domain
,
1358 if (NT_STATUS_IS_OK(nt_status
)) {
1359 /* Special return code to let the caller know we mapped
1361 return NT_STATUS_FILE_RENAMED
;
1364 /* check for an unreachable domain */
1366 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
1367 DEBUG(5,("normalize_name_unmap: Setting domain %s offline\n",
1369 set_domain_offline(domain
);
1373 /* deal with whitespace */
1375 *normalized
= talloc_strdup(mem_ctx
, name
);
1376 if (!(*normalized
)) {
1377 return NT_STATUS_NO_MEMORY
;
1380 all_string_sub(*normalized
, "_", " ", 0);
1382 return NT_STATUS_OK
;
1385 /*********************************************************************
1386 ********************************************************************/
1388 bool winbindd_can_contact_domain(struct winbindd_domain
*domain
)
1390 struct winbindd_tdc_domain
*tdc
= NULL
;
1391 TALLOC_CTX
*frame
= talloc_stackframe();
1394 /* We can contact the domain if it is our primary domain */
1396 if (domain
->primary
) {
1400 /* Trust the TDC cache and not the winbindd_domain flags */
1402 if ((tdc
= wcache_tdc_fetch_domain(frame
, domain
->name
)) == NULL
) {
1403 DEBUG(10,("winbindd_can_contact_domain: %s not found in cache\n",
1408 /* Can always contact a domain that is in out forest */
1410 if (tdc
->trust_flags
& NETR_TRUST_FLAG_IN_FOREST
) {
1416 * On a _member_ server, we cannot contact the domain if it
1417 * is running AD and we have no inbound trust.
1421 domain
->active_directory
&&
1422 ((tdc
->trust_flags
& NETR_TRUST_FLAG_INBOUND
) != NETR_TRUST_FLAG_INBOUND
))
1424 DEBUG(10, ("winbindd_can_contact_domain: %s is an AD domain "
1425 "and we have no inbound trust.\n", domain
->name
));
1429 /* Assume everything else is ok (probably not true but what
1435 talloc_destroy(frame
);
1440 /*********************************************************************
1441 ********************************************************************/
1443 bool winbindd_internal_child(struct winbindd_child
*child
)
1445 if ((child
== idmap_child()) || (child
== locator_child())) {
1452 #ifdef HAVE_KRB5_LOCATE_PLUGIN_H
1454 /*********************************************************************
1455 ********************************************************************/
1457 static void winbindd_set_locator_kdc_env(const struct winbindd_domain
*domain
)
1460 char addr
[INET6_ADDRSTRLEN
];
1461 const char *kdc
= NULL
;
1464 if (!domain
|| !domain
->alt_name
|| !*domain
->alt_name
) {
1468 if (domain
->initialized
&& !domain
->active_directory
) {
1469 DEBUG(lvl
,("winbindd_set_locator_kdc_env: %s not AD\n",
1474 print_sockaddr(addr
, sizeof(addr
), &domain
->dcaddr
);
1477 DEBUG(lvl
,("winbindd_set_locator_kdc_env: %s no DC IP\n",
1479 kdc
= domain
->dcname
;
1482 if (!kdc
|| !*kdc
) {
1483 DEBUG(lvl
,("winbindd_set_locator_kdc_env: %s no DC at all\n",
1488 if (asprintf_strupper_m(&var
, "%s_%s", WINBINDD_LOCATOR_KDC_ADDRESS
,
1489 domain
->alt_name
) == -1) {
1493 DEBUG(lvl
,("winbindd_set_locator_kdc_env: setting var: %s to: %s\n",
1496 setenv(var
, kdc
, 1);
1500 /*********************************************************************
1501 ********************************************************************/
1503 void winbindd_set_locator_kdc_envs(const struct winbindd_domain
*domain
)
1505 struct winbindd_domain
*our_dom
= find_our_domain();
1507 winbindd_set_locator_kdc_env(domain
);
1509 if (domain
!= our_dom
) {
1510 winbindd_set_locator_kdc_env(our_dom
);
1514 /*********************************************************************
1515 ********************************************************************/
1517 void winbindd_unset_locator_kdc_env(const struct winbindd_domain
*domain
)
1521 if (!domain
|| !domain
->alt_name
|| !*domain
->alt_name
) {
1525 if (asprintf_strupper_m(&var
, "%s_%s", WINBINDD_LOCATOR_KDC_ADDRESS
,
1526 domain
->alt_name
) == -1) {
1535 void winbindd_set_locator_kdc_envs(const struct winbindd_domain
*domain
)
1540 void winbindd_unset_locator_kdc_env(const struct winbindd_domain
*domain
)
1545 #endif /* HAVE_KRB5_LOCATE_PLUGIN_H */
1547 void set_auth_errors(struct winbindd_response
*resp
, NTSTATUS result
)
1549 resp
->data
.auth
.nt_status
= NT_STATUS_V(result
);
1550 fstrcpy(resp
->data
.auth
.nt_status_string
, nt_errstr(result
));
1552 /* we might have given a more useful error above */
1553 if (*resp
->data
.auth
.error_string
== '\0')
1554 fstrcpy(resp
->data
.auth
.error_string
,
1555 get_friendly_nt_error_msg(result
));
1556 resp
->data
.auth
.pam_error
= nt_status_to_pam(result
);