2 Unix SMB/CIFS implementation.
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003
7 Copyright (C) Jeremy Allison 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 #define DBGC_CLASS DBGC_IDMAP
32 struct idmap_backend
{
34 struct idmap_methods
*methods
;
35 struct idmap_backend
*prev
, *next
;
38 struct idmap_alloc_backend
{
40 struct idmap_alloc_methods
*methods
;
41 struct idmap_alloc_backend
*prev
, *next
;
44 struct idmap_cache_ctx
;
46 static TALLOC_CTX
*idmap_ctx
= NULL
;
47 static struct idmap_cache_ctx
*idmap_cache
;
49 static struct idmap_backend
*backends
= NULL
;
50 static struct idmap_domain
**idmap_domains
= NULL
;
51 static int num_domains
= 0;
52 static int pdb_dom_num
= -1;
53 static int def_dom_num
= -1;
55 static struct idmap_alloc_backend
*alloc_backends
= NULL
;
56 static struct idmap_alloc_methods
*alloc_methods
= NULL
;
58 #define IDMAP_CHECK_RET(ret) do { if ( ! NT_STATUS_IS_OK(ret)) { DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); goto done; } } while(0)
59 #define IDMAP_CHECK_ALLOC(mem) do { if (!mem) { DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; goto done; } } while(0)
61 static struct idmap_methods
*get_methods(struct idmap_backend
*be
, const char *name
)
63 struct idmap_backend
*b
;
65 for (b
= be
; b
; b
= b
->next
) {
66 if (strequal(b
->name
, name
)) {
74 static struct idmap_alloc_methods
*get_alloc_methods(struct idmap_alloc_backend
*be
, const char *name
)
76 struct idmap_alloc_backend
*b
;
78 for (b
= be
; b
; b
= b
->next
) {
79 if (strequal(b
->name
, name
)) {
87 /**********************************************************************
88 Allow a module to register itself as a method.
89 **********************************************************************/
91 NTSTATUS
smb_register_idmap(int version
, const char *name
, struct idmap_methods
*methods
)
93 struct idmap_methods
*test
;
94 struct idmap_backend
*entry
;
97 return NT_STATUS_INTERNAL_DB_ERROR
;
100 if ((version
!= SMB_IDMAP_INTERFACE_VERSION
)) {
101 DEBUG(0, ("Failed to register idmap module.\n"
102 "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
103 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
104 "Please recompile against the current version of samba!\n",
105 version
, SMB_IDMAP_INTERFACE_VERSION
));
106 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
109 if (!name
|| !name
[0] || !methods
) {
110 DEBUG(0,("Called with NULL pointer or empty name!\n"));
111 return NT_STATUS_INVALID_PARAMETER
;
114 test
= get_methods(backends
, name
);
116 DEBUG(0,("Idmap module %s already registered!\n", name
));
117 return NT_STATUS_OBJECT_NAME_COLLISION
;
120 entry
= talloc(idmap_ctx
, struct idmap_backend
);
122 DEBUG(0,("Out of memory!\n"));
123 return NT_STATUS_NO_MEMORY
;
125 entry
->name
= talloc_strdup(idmap_ctx
, name
);
126 if ( ! entry
->name
) {
127 DEBUG(0,("Out of memory!\n"));
128 return NT_STATUS_NO_MEMORY
;
130 entry
->methods
= methods
;
132 DLIST_ADD(backends
, entry
);
133 DEBUG(5, ("Successfully added idmap backend '%s'\n", name
));
137 /**********************************************************************
138 Allow a module to register itself as a method.
139 **********************************************************************/
141 NTSTATUS
smb_register_idmap_alloc(int version
, const char *name
, struct idmap_alloc_methods
*methods
)
143 struct idmap_alloc_methods
*test
;
144 struct idmap_alloc_backend
*entry
;
147 return NT_STATUS_INTERNAL_DB_ERROR
;
150 if ((version
!= SMB_IDMAP_INTERFACE_VERSION
)) {
151 DEBUG(0, ("Failed to register idmap alloc module.\n"
152 "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
153 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
154 "Please recompile against the current version of samba!\n",
155 version
, SMB_IDMAP_INTERFACE_VERSION
));
156 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
159 if (!name
|| !name
[0] || !methods
) {
160 DEBUG(0,("Called with NULL pointer or empty name!\n"));
161 return NT_STATUS_INVALID_PARAMETER
;
164 test
= get_alloc_methods(alloc_backends
, name
);
166 DEBUG(0,("idmap_alloc module %s already registered!\n", name
));
167 return NT_STATUS_OBJECT_NAME_COLLISION
;
170 entry
= talloc(idmap_ctx
, struct idmap_alloc_backend
);
172 DEBUG(0,("Out of memory!\n"));
173 return NT_STATUS_NO_MEMORY
;
175 entry
->name
= talloc_strdup(idmap_ctx
, name
);
176 if ( ! entry
->name
) {
177 DEBUG(0,("Out of memory!\n"));
178 return NT_STATUS_NO_MEMORY
;
180 entry
->methods
= methods
;
182 DLIST_ADD(alloc_backends
, entry
);
183 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name
));
187 static int close_domain_destructor(struct idmap_domain
*dom
)
191 ret
= dom
->methods
->close_fn(dom
);
192 if (!NT_STATUS_IS_OK(ret
)) {
193 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom
->name
));
199 /**************************************************************************
201 **************************************************************************/
203 NTSTATUS
idmap_close(void)
205 /* close the alloc backend first before freeing idmap_ctx */
207 alloc_methods
->close_fn();
208 alloc_methods
= NULL
;
210 alloc_backends
= NULL
;
212 /* this talloc_free call will fire the talloc destructors
213 * that will free all active backends resources */
214 TALLOC_FREE(idmap_ctx
);
216 idmap_domains
= NULL
;
222 /**********************************************************************
223 Initialise idmap cache and a remote backend (if configured).
224 **********************************************************************/
226 static const char *idmap_default_domain
[] = { "default domain", NULL
};
228 NTSTATUS
idmap_init(void)
231 struct idmap_domain
*dom
;
232 char *compat_backend
= NULL
;
233 char *compat_params
= NULL
;
234 const char **dom_list
= NULL
;
236 BOOL default_already_defined
= False
;
237 BOOL pri_dom_is_in_list
= False
;
245 if ( (idmap_ctx
= talloc_named_const(NULL
, 0, "idmap_ctx")) == NULL
) {
246 return NT_STATUS_NO_MEMORY
;
249 if ( (idmap_cache
= idmap_cache_init(idmap_ctx
)) == NULL
) {
250 return NT_STATUS_UNSUCCESSFUL
;
255 dom_list
= lp_idmap_domains();
257 if ( dom_list
&& lp_idmap_backend() ) {
258 DEBUG(0, ("WARNING: idmap backend and idmap domains are "
259 "mutually excusive!\n"));
260 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
261 } else if ( lp_idmap_backend() ) {
262 const char **compat_list
= lp_idmap_backend();
266 DEBUG(0, ("WARNING: idmap backend is deprecated!\n"));
269 if ( (compat_backend
= talloc_strdup( idmap_ctx
, *compat_list
)) == NULL
) {
270 ret
= NT_STATUS_NO_MEMORY
;
274 /* strip any leading idmap_ prefix of */
275 if (strncmp(*compat_list
, "idmap_", 6) == 0 ) {
276 q
= *compat_list
+= 6;
277 DEBUG(0, ("WARNING: idmap backend uses obsolete and deprecated 'idmap_' prefix.\n"));
278 DEBUGADD(0, (" Please replace 'idmap_%s' by '%s' in %s\n", p
, p
, dyn_CONFIGFILE
));
279 compat_backend
= talloc_strdup( idmap_ctx
, q
);
281 compat_backend
= talloc_strdup( idmap_ctx
, *compat_list
);
284 /* separate the backend and module arguements */
285 if ((p
= strchr(compat_backend
, ':')) != NULL
) {
287 compat_params
= p
+ 1;
292 dom_list
= idmap_default_domain
;
295 /***************************
296 * initialize idmap domains
298 DEBUG(1, ("Initializing idmap domains\n"));
300 for (i
= 0; dom_list
[i
]; i
++) {
301 const char *parm_backend
;
304 if (strequal(dom_list
[i
], lp_workgroup())) {
305 pri_dom_is_in_list
= True
;
309 dom
= talloc_zero(idmap_ctx
, struct idmap_domain
);
310 IDMAP_CHECK_ALLOC(dom
);
312 dom
->name
= talloc_strdup(dom
, dom_list
[i
]);
313 IDMAP_CHECK_ALLOC(dom
->name
);
315 config_option
= talloc_asprintf(dom
, "idmap config %s", dom
->name
);
316 IDMAP_CHECK_ALLOC(config_option
);
318 /* default or specific ? */
320 dom
->default_domain
= lp_parm_bool(-1, config_option
, "default", False
);
322 if (dom
->default_domain
||
323 strequal(dom_list
[i
], idmap_default_domain
[0])) {
325 /* make sure this is set even when we match idmap_default_domain[0] */
326 dom
->default_domain
= True
;
328 if (default_already_defined
) {
329 DEBUG(1, ("ERROR: Multiple domains defined as default!\n"));
330 ret
= NT_STATUS_INVALID_PARAMETER
;
334 default_already_defined
= True
;
338 dom
->readonly
= lp_parm_bool(-1, config_option
, "readonly", False
);
340 /* find associated backend (default: tdb) */
342 parm_backend
= talloc_strdup(idmap_ctx
, compat_backend
);
344 parm_backend
= talloc_strdup(idmap_ctx
,
345 lp_parm_const_string(-1, config_option
, "backend", "tdb"));
347 IDMAP_CHECK_ALLOC(parm_backend
);
349 /* get the backend methods for this domain */
350 dom
->methods
= get_methods(backends
, parm_backend
);
352 if ( ! dom
->methods
) {
353 ret
= smb_probe_module("idmap", parm_backend
);
354 if (NT_STATUS_IS_OK(ret
)) {
355 dom
->methods
= get_methods(backends
, parm_backend
);
358 if ( ! dom
->methods
) {
359 DEBUG(0, ("ERROR: Could not get methods for backend %s\n", parm_backend
));
360 ret
= NT_STATUS_UNSUCCESSFUL
;
364 /* check the set_mapping function exists otherwise mark the module as readonly */
365 if ( ! dom
->methods
->set_mapping
) {
366 dom
->readonly
= True
;
369 /* now that we have methods, set the destructor for this domain */
370 talloc_set_destructor(dom
, close_domain_destructor
);
372 /* Finally instance a backend copy for this domain */
373 ret
= dom
->methods
->init(dom
, compat_params
);
374 if ( ! NT_STATUS_IS_OK(ret
)) {
375 DEBUG(0, ("ERROR: Initialization failed for backend %s (domain %s)\n",
376 parm_backend
, dom
->name
));
377 ret
= NT_STATUS_UNSUCCESSFUL
;
380 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
, struct idmap_domain
*, i
+1);
381 if ( ! idmap_domains
) {
382 DEBUG(0, ("Out of memory!\n"));
383 ret
= NT_STATUS_NO_MEMORY
;
386 idmap_domains
[i
] = dom
;
388 if (dom
->default_domain
) { /* save default domain position for future uses */
392 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
393 dom
->name
, parm_backend
,
394 dom
->default_domain
?"":"not ", dom
->readonly
?"":"not "));
396 talloc_free(config_option
);
399 /* save the number of domains we have */
402 /* automatically add idmap_nss backend if needed */
403 if ((lp_server_role() == ROLE_DOMAIN_MEMBER
) &&
404 ( ! pri_dom_is_in_list
) &&
405 lp_winbind_trusted_domains_only()) {
407 dom
= talloc_zero(idmap_ctx
, struct idmap_domain
);
408 IDMAP_CHECK_ALLOC(dom
);
410 dom
->name
= talloc_strdup(dom
, lp_workgroup());
411 IDMAP_CHECK_ALLOC(dom
->name
);
413 dom
->default_domain
= False
;
414 dom
->readonly
= True
;
416 /* get the backend methods for passdb */
417 dom
->methods
= get_methods(backends
, "nss");
419 /* (the nss module is always statically linked) */
420 if ( ! dom
->methods
) {
421 DEBUG(0, ("ERROR: Could not get methods for idmap_nss ?!\n"));
422 ret
= NT_STATUS_UNSUCCESSFUL
;
426 /* now that we have methods, set the destructor for this domain */
427 talloc_set_destructor(dom
, close_domain_destructor
);
429 /* Finally instance a backend copy for this domain */
430 ret
= dom
->methods
->init(dom
, compat_params
);
431 if ( ! NT_STATUS_IS_OK(ret
)) {
432 DEBUG(0, ("ERROR: Initialization failed for idmap_nss ?!\n"));
433 ret
= NT_STATUS_UNSUCCESSFUL
;
437 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
, struct idmap_domain
*, num_domains
+1);
438 if ( ! idmap_domains
) {
439 DEBUG(0, ("Out of memory!\n"));
440 ret
= NT_STATUS_NO_MEMORY
;
443 idmap_domains
[num_domains
] = dom
;
445 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n", dom
->name
));
450 /**** automatically add idmap_passdb backend ****/
451 dom
= talloc_zero(idmap_ctx
, struct idmap_domain
);
452 IDMAP_CHECK_ALLOC(dom
);
454 dom
->name
= talloc_strdup(dom
, get_global_sam_name());
455 IDMAP_CHECK_ALLOC(dom
->name
);
457 dom
->default_domain
= False
;
458 dom
->readonly
= True
;
460 /* get the backend methods for passdb */
461 dom
->methods
= get_methods(backends
, "passdb");
463 /* (the passdb module is always statically linked) */
464 if ( ! dom
->methods
) {
465 DEBUG(0, ("ERROR: Could not get methods for idmap_passdb ?!\n"));
466 ret
= NT_STATUS_UNSUCCESSFUL
;
470 /* now that we have methods, set the destructor for this domain */
471 talloc_set_destructor(dom
, close_domain_destructor
);
473 /* Finally instance a backend copy for this domain */
474 ret
= dom
->methods
->init(dom
, compat_params
);
475 if ( ! NT_STATUS_IS_OK(ret
)) {
476 DEBUG(0, ("ERROR: Initialization failed for idmap_passdb ?!\n"));
477 ret
= NT_STATUS_UNSUCCESSFUL
;
481 idmap_domains
= talloc_realloc(idmap_ctx
, idmap_domains
, struct idmap_domain
*, num_domains
+1);
482 if ( ! idmap_domains
) {
483 DEBUG(0, ("Out of memory!\n"));
484 ret
= NT_STATUS_NO_MEMORY
;
487 idmap_domains
[num_domains
] = dom
;
489 /* needed to handle special BUILTIN and wellknown SIDs cases */
490 pdb_dom_num
= num_domains
;
492 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n", dom
->name
));
495 /**** finished adding idmap_passdb backend ****/
497 /* sort domains so that the default is the last one */
498 if (def_dom_num
!= num_domains
-1) { /* default is not last, move it */
499 struct idmap_domain
*tmp
;
501 if (pdb_dom_num
> def_dom_num
) {
504 } else if (pdb_dom_num
== def_dom_num
) { /* ?? */
505 pdb_dom_num
= num_domains
- 1;
508 tmp
= idmap_domains
[def_dom_num
];
510 for (i
= def_dom_num
; i
< num_domains
-1; i
++) {
511 idmap_domains
[i
] = idmap_domains
[i
+1];
513 idmap_domains
[i
] = tmp
;
518 /***************************
519 * initialize alloc module
521 DEBUG(1, ("Initializing idmap alloc module\n"));
524 alloc_backend
= talloc_strdup(idmap_ctx
, compat_backend
);
526 char *ab
= lp_idmap_alloc_backend();
528 if (ab
&& (ab
[0] != '\0')) {
529 alloc_backend
= talloc_strdup(idmap_ctx
, lp_idmap_alloc_backend());
531 alloc_backend
= talloc_strdup(idmap_ctx
, "tdb");
534 IDMAP_CHECK_ALLOC(alloc_backend
);
536 alloc_methods
= get_alloc_methods(alloc_backends
, alloc_backend
);
537 if ( ! alloc_methods
) {
538 ret
= smb_probe_module("idmap", alloc_backend
);
539 if (NT_STATUS_IS_OK(ret
)) {
540 alloc_methods
= get_alloc_methods(alloc_backends
, alloc_backend
);
543 if ( ! alloc_methods
) {
544 DEBUG(0, ("ERROR: Could not get methods for alloc backend %s\n", alloc_backend
));
545 ret
= NT_STATUS_UNSUCCESSFUL
;
549 ret
= alloc_methods
->init(compat_params
);
550 if ( ! NT_STATUS_IS_OK(ret
)) {
551 DEBUG(0, ("ERROR: Initialization failed for alloc backend %s\n", alloc_backend
));
552 ret
= NT_STATUS_UNSUCCESSFUL
;
556 /* cleanpu temporary strings */
557 TALLOC_FREE( compat_backend
);
562 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
567 /**************************************************************************
568 idmap allocator interface functions
569 **************************************************************************/
571 NTSTATUS
idmap_allocate_uid(struct unixid
*id
)
575 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
579 id
->type
= ID_TYPE_UID
;
580 return alloc_methods
->allocate_id(id
);
583 NTSTATUS
idmap_allocate_gid(struct unixid
*id
)
587 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
591 id
->type
= ID_TYPE_GID
;
592 return alloc_methods
->allocate_id(id
);
595 NTSTATUS
idmap_set_uid_hwm(struct unixid
*id
)
599 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
603 id
->type
= ID_TYPE_UID
;
604 return alloc_methods
->set_id_hwm(id
);
607 NTSTATUS
idmap_set_gid_hwm(struct unixid
*id
)
611 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
615 id
->type
= ID_TYPE_GID
;
616 return alloc_methods
->set_id_hwm(id
);
619 /******************************************************************************
620 Lookup an idmap_domain give a full user or group SID
621 ******************************************************************************/
623 static struct idmap_domain
* find_idmap_domain_from_sid( DOM_SID
*account_sid
)
627 struct winbindd_domain
*domain
= NULL
;
630 /* 1. Handle BUILTIN or Special SIDs and prevent them from
631 falling into the default domain space (if we have a
632 configured passdb backend. */
634 if ( (pdb_dom_num
!= -1) &&
635 (sid_check_is_in_builtin(account_sid
) ||
636 sid_check_is_in_wellknown_domain(account_sid
)) )
638 return idmap_domains
[pdb_dom_num
];
641 /* 2. Lookup the winbindd_domain from the account_sid */
643 sid_copy( &domain_sid
, account_sid
);
644 sid_split_rid( &domain_sid
, &rid
);
645 domain
= find_domain_from_sid_noinit( &domain_sid
);
647 for (i
= 0; domain
&& i
< num_domains
; i
++) {
648 if ( strequal( idmap_domains
[i
]->name
, domain
->name
) ) {
649 return idmap_domains
[i
];
653 /* 3. Fall back to the default domain */
655 if ( def_dom_num
!= -1 ) {
656 return idmap_domains
[def_dom_num
];
662 /******************************************************************************
663 Lookup an index given an idmap_domain pointer
664 ******************************************************************************/
666 static uint32
find_idmap_domain_index( struct idmap_domain
*id_domain
)
670 for (i
= 0; i
< num_domains
; i
++) {
671 if ( idmap_domains
[i
] == id_domain
)
679 /*********************************************************
680 Check if creating a mapping is permitted for the domain
681 *********************************************************/
683 static NTSTATUS
idmap_can_map(const struct id_map
*map
, struct idmap_domain
**ret_dom
)
685 struct idmap_domain
*dom
;
687 /* Check we do not create mappings for our own local domain, or BUILTIN or special SIDs */
688 if ((sid_compare_domain(map
->sid
, get_global_sam_sid()) == 0) ||
689 sid_check_is_in_builtin(map
->sid
) ||
690 sid_check_is_in_wellknown_domain(map
->sid
)) {
691 DEBUG(10, ("We are not supposed to create mappings for our own domains (local, builtin, specials)\n"));
692 return NT_STATUS_UNSUCCESSFUL
;
695 /* Special check for trusted domain only = Yes */
696 if (lp_winbind_trusted_domains_only()) {
697 struct winbindd_domain
*wdom
= find_our_domain();
698 if (wdom
&& (sid_compare_domain(map
->sid
, &wdom
->sid
) == 0)) {
699 DEBUG(10, ("We are not supposed to create mappings for our primary domain when <trusted domain only> is True\n"));
700 DEBUGADD(10, ("Leave [%s] unmapped\n", sid_string_static(map
->sid
)));
701 return NT_STATUS_UNSUCCESSFUL
;
705 if ( (dom
= find_idmap_domain_from_sid( map
->sid
)) == NULL
) {
706 /* huh, couldn't find a suitable domain, let's just leave it unmapped */
707 DEBUG(10, ("Could not find idmap backend for SID %s", sid_string_static(map
->sid
)));
708 return NT_STATUS_NO_SUCH_DOMAIN
;
712 /* ouch the domain is read only, let's just leave it unmapped */
713 DEBUG(10, ("idmap backend for SID %s is READONLY!\n", sid_string_static(map
->sid
)));
714 return NT_STATUS_UNSUCCESSFUL
;
721 static NTSTATUS
idmap_new_mapping(TALLOC_CTX
*ctx
, struct id_map
*map
)
724 struct idmap_domain
*dom
;
725 const char *domname
, *name
;
726 enum lsa_SidType sid_type
;
729 ret
= idmap_can_map(map
, &dom
);
730 if ( ! NT_STATUS_IS_OK(ret
)) {
731 return NT_STATUS_NONE_MAPPED
;
734 /* by default calls to winbindd are disabled
735 the following call will not recurse so this is safe */
737 wbret
= winbind_lookup_sid(ctx
, map
->sid
, &domname
, &name
, &sid_type
);
740 /* check if this is a valid SID and then map it */
744 ret
= idmap_allocate_uid(&map
->xid
);
745 if ( ! NT_STATUS_IS_OK(ret
)) {
746 /* can't allocate id, let's just leave it unmapped */
747 DEBUG(2, ("uid allocation failed! Can't create mapping\n"));
748 return NT_STATUS_NONE_MAPPED
;
751 case SID_NAME_DOM_GRP
:
753 case SID_NAME_WKN_GRP
:
754 ret
= idmap_allocate_gid(&map
->xid
);
755 if ( ! NT_STATUS_IS_OK(ret
)) {
756 /* can't allocate id, let's just leave it unmapped */
757 DEBUG(2, ("gid allocation failed! Can't create mapping\n"));
758 return NT_STATUS_NONE_MAPPED
;
762 /* invalid sid, let's just leave it unmapped */
763 DEBUG(10, ("SID %s is UNKNOWN, skip mapping\n", sid_string_static(map
->sid
)));
764 return NT_STATUS_NONE_MAPPED
;
767 /* ok, got a new id, let's set a mapping */
768 map
->status
= ID_MAPPED
;
770 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
771 sid_string_static(map
->sid
),
772 (map
->xid
.type
== ID_TYPE_UID
) ? "UID" : "GID",
773 (unsigned long)map
->xid
.id
));
774 ret
= dom
->methods
->set_mapping(dom
, map
);
776 if ( ! NT_STATUS_IS_OK(ret
)) {
777 /* something wrong here :-( */
778 DEBUG(2, ("Failed to commit mapping\n!"));
780 /* TODO: would it make sense to have an "unalloc_id function?" */
782 return NT_STATUS_NONE_MAPPED
;
785 DEBUG(2,("Invalid SID, not mapping %s (type %d)\n",
786 sid_string_static(map
->sid
), sid_type
));
787 return NT_STATUS_NONE_MAPPED
;
793 static NTSTATUS
idmap_backends_set_mapping(const struct id_map
*map
)
795 struct idmap_domain
*dom
;
798 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
799 sid_string_static(map
->sid
),
800 (map
->xid
.type
== ID_TYPE_UID
) ? "UID" : "GID",
801 (unsigned long)map
->xid
.id
));
803 ret
= idmap_can_map(map
, &dom
);
804 if ( ! NT_STATUS_IS_OK(ret
)) {
808 DEBUG(10,("set_mapping for domain %s\n", dom
->name
));
810 return dom
->methods
->set_mapping(dom
, map
);
813 static NTSTATUS
idmap_backends_unixids_to_sids(struct id_map
**ids
)
815 struct idmap_domain
*dom
;
816 struct id_map
**unmapped
;
817 struct id_map
**_ids
;
823 DEBUG(1, ("Invalid list of maps\n"));
824 return NT_STATUS_INVALID_PARAMETER
;
827 ctx
= talloc_named_const(NULL
, 0, "idmap_backends_unixids_to_sids ctx");
829 DEBUG(0, ("Out of memory!\n"));
830 return NT_STATUS_NO_MEMORY
;
833 DEBUG(10, ("Query backends to map ids->sids\n"));
835 /* start from the default (the last one) and then if there are still
836 * unmapped entries cycle through the others */
840 /* make sure all maps are marked as in UNKNOWN status */
841 for (i
= 0; _ids
[i
]; i
++) {
842 _ids
[i
]->status
= ID_UNKNOWN
;
846 for (n
= num_domains
-1; n
>= 0; n
--) { /* cycle backwards */
848 dom
= idmap_domains
[n
];
850 DEBUG(10, ("Query sids from domain %s\n", dom
->name
));
852 ret
= dom
->methods
->unixids_to_sids(dom
, _ids
);
853 IDMAP_CHECK_RET(ret
);
857 for (i
= 0, u
= 0; _ids
[i
]; i
++) {
858 if (_ids
[i
]->status
== ID_UNKNOWN
|| _ids
[i
]->status
== ID_UNMAPPED
) {
859 unmapped
= talloc_realloc(ctx
, unmapped
, struct id_map
*, u
+ 2);
860 IDMAP_CHECK_ALLOC(unmapped
);
861 unmapped
[u
] = _ids
[i
];
866 /* terminate the unmapped list */
868 } else { /* no more entries, get out */
877 /* there are still unmapped ids, map them to the unix users/groups domains */
878 for (i
= 0; unmapped
[i
]; i
++) {
879 switch (unmapped
[i
]->xid
.type
) {
881 uid_to_unix_users_sid((uid_t
)unmapped
[i
]->xid
.id
, unmapped
[i
]->sid
);
882 unmapped
[i
]->status
= ID_MAPPED
;
885 gid_to_unix_groups_sid((gid_t
)unmapped
[i
]->xid
.id
, unmapped
[i
]->sid
);
886 unmapped
[i
]->status
= ID_MAPPED
;
888 default: /* what?! */
889 unmapped
[i
]->status
= ID_UNKNOWN
;
902 static NTSTATUS
idmap_backends_sids_to_unixids(struct id_map
**ids
)
904 struct id_map
***dom_ids
;
905 struct idmap_domain
*dom
;
910 if ( (ctx
= talloc_named_const(NULL
, 0, "be_sids_to_ids")) == NULL
) {
911 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
912 return NT_STATUS_NO_MEMORY
;
915 DEBUG(10, ("Query backends to map sids->ids\n"));
917 /* split list per domain */
919 dom_ids
= talloc_zero_array(ctx
, struct id_map
**, num_domains
);
920 IDMAP_CHECK_ALLOC(dom_ids
);
921 counters
= talloc_zero_array(ctx
, int, num_domains
);
923 /* partition the requests by domain */
925 for (i
= 0; ids
[i
]; i
++) {
928 /* make sure they are unknown to start off */
929 ids
[i
]->status
= ID_UNKNOWN
;
931 if ( (dom
= find_idmap_domain_from_sid( ids
[i
]->sid
)) == NULL
) {
932 /* no vailable idmap_domain. Move on */
936 DEBUG(10,("SID %s is being handled by %s\n",
937 sid_string_static(ids
[i
]->sid
),
938 dom
? dom
->name
: "none" ));
940 idx
= find_idmap_domain_index( dom
);
941 SMB_ASSERT( idx
!= -1 );
943 dom_ids
[idx
] = talloc_realloc(ctx
, dom_ids
[idx
],
944 struct id_map
*, counters
[idx
] + 2);
945 IDMAP_CHECK_ALLOC(dom_ids
[idx
]);
947 dom_ids
[idx
][counters
[idx
]] = ids
[i
];
949 dom_ids
[idx
][counters
[idx
]] = NULL
;
952 /* All the ids have been dispatched in the right queues.
953 Let's cycle through the filled ones */
955 for (i
= 0; i
< num_domains
; i
++) {
957 dom
= idmap_domains
[i
];
958 DEBUG(10, ("Query ids from domain %s\n", dom
->name
));
959 ret
= dom
->methods
->sids_to_unixids(dom
, dom_ids
[i
]);
960 IDMAP_CHECK_RET(ret
);
964 /* ok all the backends have been contacted at this point */
965 /* let's see if we have any unmapped SID left and act accordingly */
967 for (i
= 0; ids
[i
]; i
++) {
968 if (ids
[i
]->status
== ID_UNKNOWN
|| ids
[i
]->status
== ID_UNMAPPED
) {
969 /* ok this is an unmapped one, see if we can map it */
970 ret
= idmap_new_mapping(ctx
, ids
[i
]);
971 if (NT_STATUS_IS_OK(ret
)) {
972 /* successfully mapped */
973 ids
[i
]->status
= ID_MAPPED
;
974 } else if (NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
)) {
975 /* could not map it */
976 ids
[i
]->status
= ID_UNMAPPED
;
978 /* Something very bad happened down there */
979 ids
[i
]->status
= ID_UNKNOWN
;
991 /**************************************************************************
992 idmap interface functions
993 **************************************************************************/
995 NTSTATUS
idmap_unixids_to_sids(struct id_map
**ids
)
999 struct id_map
**bids
;
1003 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1007 if (!ids
|| !*ids
) {
1008 DEBUG(1, ("Invalid list of maps\n"));
1009 return NT_STATUS_INVALID_PARAMETER
;
1012 ctx
= talloc_named_const(NULL
, 0, "idmap_unixids_to_sids ctx");
1014 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1015 return NT_STATUS_NO_MEMORY
;
1018 /* no ids to be asked to the backends by default */
1022 for (i
= 0; ids
[i
]; i
++) {
1024 if ( ! ids
[i
]->sid
) {
1025 DEBUG(1, ("invalid null SID in id_map array"));
1027 return NT_STATUS_INVALID_PARAMETER
;
1030 ret
= idmap_cache_map_id(idmap_cache
, ids
[i
]);
1032 if ( ! NT_STATUS_IS_OK(ret
)) {
1035 /* alloc space for ids to be resolved by backends (realloc ten by ten) */
1036 bids
= talloc_array(ctx
, struct id_map
*, 10);
1038 DEBUG(1, ("Out of memory!\n"));
1040 return NT_STATUS_NO_MEMORY
;
1045 /* add this id to the ones to be retrieved from the backends */
1049 /* check if we need to allocate new space on the rids array */
1052 bids
= talloc_realloc(ctx
, bids
, struct id_map
*, bn
);
1054 DEBUG(1, ("Out of memory!\n"));
1056 return NT_STATUS_NO_MEMORY
;
1060 /* make sure the last element is NULL */
1065 /* let's see if there is any id mapping to be retieved from the backends */
1067 ret
= idmap_backends_unixids_to_sids(bids
);
1068 IDMAP_CHECK_RET(ret
);
1070 /* update the cache */
1071 for (i
= 0; i
< bi
; i
++) {
1072 if (bids
[i
]->status
== ID_MAPPED
) {
1073 ret
= idmap_cache_set(idmap_cache
, bids
[i
]);
1074 } else if (bids
[i
]->status
== ID_UNKNOWN
) {
1075 /* return an expired entry in the cache or an unknown */
1076 /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
1077 * for disconnected mode */
1078 idmap_cache_map_id(idmap_cache
, ids
[i
]);
1079 } else { /* unmapped */
1080 ret
= idmap_cache_set_negative_id(idmap_cache
, bids
[i
]);
1082 IDMAP_CHECK_RET(ret
);
1092 NTSTATUS
idmap_sids_to_unixids(struct id_map
**ids
)
1096 struct id_map
**bids
;
1100 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1104 if (!ids
|| !*ids
) {
1105 DEBUG(1, ("Invalid list of maps\n"));
1106 return NT_STATUS_INVALID_PARAMETER
;
1109 ctx
= talloc_named_const(NULL
, 0, "idmap_sids_to_unixids ctx");
1111 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1112 return NT_STATUS_NO_MEMORY
;
1115 /* no ids to be asked to the backends by default */
1119 for (i
= 0; ids
[i
]; i
++) {
1121 if ( ! ids
[i
]->sid
) {
1122 DEBUG(1, ("invalid null SID in id_map array\n"));
1124 return NT_STATUS_INVALID_PARAMETER
;
1127 ret
= idmap_cache_map_sid(idmap_cache
, ids
[i
]);
1129 if ( ! NT_STATUS_IS_OK(ret
)) {
1132 /* alloc space for ids to be resolved by backends (realloc ten by ten) */
1133 bids
= talloc_array(ctx
, struct id_map
*, 10);
1135 DEBUG(1, ("Out of memory!\n"));
1137 return NT_STATUS_NO_MEMORY
;
1142 /* add this id to the ones to be retrieved from the backends */
1146 /* check if we need to allocate new space on the ids array */
1149 bids
= talloc_realloc(ctx
, bids
, struct id_map
*, bn
);
1151 DEBUG(1, ("Out of memory!\n"));
1153 return NT_STATUS_NO_MEMORY
;
1157 /* make sure the last element is NULL */
1162 /* let's see if there is any id mapping to be retieved from the backends */
1164 ret
= idmap_backends_sids_to_unixids(bids
);
1165 IDMAP_CHECK_RET(ret
);
1167 /* update the cache */
1168 for (i
= 0; bids
[i
]; i
++) {
1169 if (bids
[i
]->status
== ID_MAPPED
) {
1170 ret
= idmap_cache_set(idmap_cache
, bids
[i
]);
1171 } else if (bids
[i
]->status
== ID_UNKNOWN
) {
1172 /* return an expired entry in the cache or an unknown */
1173 /* this handles a previous NT_STATUS_SYNCHRONIZATION_REQUIRED
1174 * for disconnected mode */
1175 idmap_cache_map_id(idmap_cache
, ids
[i
]);
1177 ret
= idmap_cache_set_negative_sid(idmap_cache
, bids
[i
]);
1179 IDMAP_CHECK_RET(ret
);
1189 NTSTATUS
idmap_set_mapping(const struct id_map
*id
)
1194 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1199 if ((id
->sid
== NULL
) || (id
->status
!= ID_MAPPED
)) {
1200 DEBUG(1, ("NULL SID or unmapped entry\n"));
1201 return NT_STATUS_INVALID_PARAMETER
;
1204 /* TODO: check uid/gid range ? */
1206 ctx
= talloc_named_const(NULL
, 0, "idmap_set_mapping ctx");
1208 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1209 return NT_STATUS_NO_MEMORY
;
1212 /* set the new mapping */
1213 ret
= idmap_backends_set_mapping(id
);
1214 IDMAP_CHECK_RET(ret
);
1216 /* set the mapping in the cache */
1217 ret
= idmap_cache_set(idmap_cache
, id
);
1218 IDMAP_CHECK_RET(ret
);
1225 /**************************************************************************
1226 Dump backend status.
1227 **************************************************************************/
1229 void idmap_dump_maps(char *logfile
)
1232 struct unixid allid
;
1233 struct id_map
*maps
;
1238 if (! NT_STATUS_IS_OK(ret
= idmap_init())) {
1242 dump
= fopen(logfile
, "w");
1244 DEBUG(0, ("Unable to open open stream for file [%s], errno: %d\n", logfile
, errno
));
1248 allid
.type
= ID_TYPE_UID
;
1250 alloc_methods
->get_id_hwm(&allid
);
1251 fprintf(dump
, "USER HWM %lu\n", (unsigned long)allid
.id
);
1253 allid
.type
= ID_TYPE_GID
;
1255 alloc_methods
->get_id_hwm(&allid
);
1256 fprintf(dump
, "GROUP HWM %lu\n", (unsigned long)allid
.id
);
1258 maps
= talloc(idmap_ctx
, struct id_map
);
1261 for (i
= 0; i
< num_domains
; i
++) {
1262 if (idmap_domains
[i
]->methods
->dump_data
) {
1263 idmap_domains
[i
]->methods
->dump_data(idmap_domains
[i
], &maps
, &num_maps
);
1267 for (i
= 0; i
< num_maps
; i
++) {
1268 switch (maps
[i
].xid
.type
) {
1270 fprintf(dump
, "UID %lu %s\n",
1271 (unsigned long)maps
[i
].xid
.id
,
1272 sid_string_static(maps
[i
].sid
));
1275 fprintf(dump
, "GID %lu %s\n",
1276 (unsigned long)maps
[i
].xid
.id
,
1277 sid_string_static(maps
[i
].sid
));
1286 char *idmap_fetch_secret(const char *backend
, bool alloc
,
1287 const char *domain
, const char *identity
)
1293 r
= asprintf(&tmp
, "IDMAP_ALLOC_%s", backend
);
1295 r
= asprintf(&tmp
, "IDMAP_%s_%s", backend
, domain
);
1301 strupper_m(tmp
); /* make sure the key is case insensitive */
1302 ret
= secrets_fetch_generic(tmp
, identity
);