2 Unix SMB/CIFS implementation.
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Gerald (Jerry) Carter 2003
6 Copyright (C) Volker Lendecke 2005
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 /*****************************************************************
25 Dissect a user-provided name into domain, name, sid and type.
27 If an explicit domain name was given in the form domain\user, it
28 has to try that. If no explicit domain name was given, we have
30 *****************************************************************/
32 bool lookup_name(TALLOC_CTX
*mem_ctx
,
33 const char *full_name
, int flags
,
34 const char **ret_domain
, const char **ret_name
,
35 DOM_SID
*ret_sid
, enum lsa_SidType
*ret_type
)
39 const char *domain
= NULL
;
40 const char *name
= NULL
;
43 enum lsa_SidType type
;
44 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
46 if (tmp_ctx
== NULL
) {
47 DEBUG(0, ("talloc_new failed\n"));
51 p
= strchr_m(full_name
, '\\');
54 domain
= talloc_strndup(tmp_ctx
, full_name
,
55 PTR_DIFF(p
, full_name
));
56 name
= talloc_strdup(tmp_ctx
, p
+1);
58 domain
= talloc_strdup(tmp_ctx
, "");
59 name
= talloc_strdup(tmp_ctx
, full_name
);
62 if ((domain
== NULL
) || (name
== NULL
)) {
63 DEBUG(0, ("talloc failed\n"));
68 DEBUG(10,("lookup_name: %s => %s (domain), %s (name)\n",
69 full_name
, domain
, name
));
70 DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags
));
72 if ((flags
& LOOKUP_NAME_DOMAIN
) &&
73 strequal(domain
, get_global_sam_name()))
76 /* It's our own domain, lookup the name in passdb */
77 if (lookup_global_sam_name(name
, flags
, &rid
, &type
)) {
78 sid_copy(&sid
, get_global_sam_sid());
79 sid_append_rid(&sid
, rid
);
86 if ((flags
& LOOKUP_NAME_BUILTIN
) &&
87 strequal(domain
, builtin_domain_name()))
89 /* Explicit request for a name in BUILTIN */
90 if (lookup_builtin_name(name
, &rid
)) {
91 sid_copy(&sid
, &global_sid_Builtin
);
92 sid_append_rid(&sid
, rid
);
93 type
= SID_NAME_ALIAS
;
100 /* Try the explicit winbind lookup first, don't let it guess the
101 * domain yet at this point yet. This comes later. */
103 if ((domain
[0] != '\0') &&
104 (flags
& ~(LOOKUP_NAME_DOMAIN
|LOOKUP_NAME_ISOLATED
)) &&
105 (winbind_lookup_name(domain
, name
, &sid
, &type
))) {
109 if (!(flags
& LOOKUP_NAME_EXPLICIT
) && strequal(domain
, unix_users_domain_name())) {
110 if (lookup_unix_user_name(name
, &sid
)) {
111 type
= SID_NAME_USER
;
114 TALLOC_FREE(tmp_ctx
);
118 if (!(flags
& LOOKUP_NAME_EXPLICIT
) && strequal(domain
, unix_groups_domain_name())) {
119 if (lookup_unix_group_name(name
, &sid
)) {
120 type
= SID_NAME_DOM_GRP
;
123 TALLOC_FREE(tmp_ctx
);
127 if ((domain
[0] == '\0') && (!(flags
& LOOKUP_NAME_ISOLATED
))) {
128 TALLOC_FREE(tmp_ctx
);
132 /* Now the guesswork begins, we haven't been given an explicit
133 * domain. Try the sequence as documented on
134 * http://msdn.microsoft.com/library/en-us/secmgmt/security/lsalookupnames.asp
135 * November 27, 2005 */
137 /* 1. well-known names */
139 if ((flags
& LOOKUP_NAME_WKN
) &&
140 lookup_wellknown_name(tmp_ctx
, name
, &sid
, &domain
))
142 type
= SID_NAME_WKN_GRP
;
146 /* 2. Builtin domain as such */
148 if ((flags
& (LOOKUP_NAME_BUILTIN
|LOOKUP_NAME_REMOTE
)) &&
149 strequal(name
, builtin_domain_name()))
151 /* Swap domain and name */
152 tmp
= name
; name
= domain
; domain
= tmp
;
153 sid_copy(&sid
, &global_sid_Builtin
);
154 type
= SID_NAME_DOMAIN
;
158 /* 3. Account domain */
160 if ((flags
& LOOKUP_NAME_DOMAIN
) &&
161 strequal(name
, get_global_sam_name()))
163 if (!secrets_fetch_domain_sid(name
, &sid
)) {
164 DEBUG(3, ("Could not fetch my SID\n"));
165 TALLOC_FREE(tmp_ctx
);
168 /* Swap domain and name */
169 tmp
= name
; name
= domain
; domain
= tmp
;
170 type
= SID_NAME_DOMAIN
;
174 /* 4. Primary domain */
176 if ((flags
& LOOKUP_NAME_DOMAIN
) && !IS_DC
&&
177 strequal(name
, lp_workgroup()))
179 if (!secrets_fetch_domain_sid(name
, &sid
)) {
180 DEBUG(3, ("Could not fetch the domain SID\n"));
181 TALLOC_FREE(tmp_ctx
);
184 /* Swap domain and name */
185 tmp
= name
; name
= domain
; domain
= tmp
;
186 type
= SID_NAME_DOMAIN
;
190 /* 5. Trusted domains as such, to me it looks as if members don't do
191 this, tested an XP workstation in a NT domain -- vl */
193 if ((flags
& LOOKUP_NAME_REMOTE
) && IS_DC
&&
194 (pdb_get_trusteddom_pw(name
, NULL
, &sid
, NULL
)))
196 /* Swap domain and name */
197 tmp
= name
; name
= domain
; domain
= tmp
;
198 type
= SID_NAME_DOMAIN
;
202 /* 6. Builtin aliases */
204 if ((flags
& LOOKUP_NAME_BUILTIN
) &&
205 lookup_builtin_name(name
, &rid
))
207 domain
= talloc_strdup(tmp_ctx
, builtin_domain_name());
208 sid_copy(&sid
, &global_sid_Builtin
);
209 sid_append_rid(&sid
, rid
);
210 type
= SID_NAME_ALIAS
;
214 /* 7. Local systems' SAM (DCs don't have a local SAM) */
215 /* 8. Primary SAM (On members, this is the domain) */
217 /* Both cases are done by looking at our passdb */
219 if ((flags
& LOOKUP_NAME_DOMAIN
) &&
220 lookup_global_sam_name(name
, flags
, &rid
, &type
))
222 domain
= talloc_strdup(tmp_ctx
, get_global_sam_name());
223 sid_copy(&sid
, get_global_sam_sid());
224 sid_append_rid(&sid
, rid
);
228 /* Now our local possibilities are exhausted. */
230 if (!(flags
& LOOKUP_NAME_REMOTE
)) {
231 TALLOC_FREE(tmp_ctx
);
235 /* If we are not a DC, we have to ask in our primary domain. Let
236 * winbind do that. */
239 (winbind_lookup_name(lp_workgroup(), name
, &sid
, &type
))) {
240 domain
= talloc_strdup(tmp_ctx
, lp_workgroup());
244 /* 9. Trusted domains */
246 /* If we're a DC we have to ask all trusted DC's. Winbind does not do
247 * that (yet), but give it a chance. */
249 if (IS_DC
&& winbind_lookup_name("", name
, &sid
, &type
)) {
252 enum lsa_SidType domain_type
;
254 if (type
== SID_NAME_DOMAIN
) {
255 /* Swap name and type */
256 tmp
= name
; name
= domain
; domain
= tmp
;
260 /* Here we have to cope with a little deficiency in the
261 * winbind API: We have to ask it again for the name of the
262 * domain it figured out itself. Maybe fix that later... */
264 sid_copy(&dom_sid
, &sid
);
265 sid_split_rid(&dom_sid
, &tmp_rid
);
267 if (!winbind_lookup_sid(tmp_ctx
, &dom_sid
, &domain
, NULL
,
269 (domain_type
!= SID_NAME_DOMAIN
)) {
270 DEBUG(2, ("winbind could not find the domain's name "
271 "it just looked up for us\n"));
272 TALLOC_FREE(tmp_ctx
);
278 /* 10. Don't translate */
280 /* 11. Ok, windows would end here. Samba has two more options:
281 Unmapped users and unmapped groups */
283 if (!(flags
& LOOKUP_NAME_EXPLICIT
) && lookup_unix_user_name(name
, &sid
)) {
284 domain
= talloc_strdup(tmp_ctx
, unix_users_domain_name());
285 type
= SID_NAME_USER
;
289 if (!(flags
& LOOKUP_NAME_EXPLICIT
) && lookup_unix_group_name(name
, &sid
)) {
290 domain
= talloc_strdup(tmp_ctx
, unix_groups_domain_name());
291 type
= SID_NAME_DOM_GRP
;
296 * Ok, all possibilities tried. Fail.
299 TALLOC_FREE(tmp_ctx
);
303 if ((domain
== NULL
) || (name
== NULL
)) {
304 DEBUG(0, ("talloc failed\n"));
305 TALLOC_FREE(tmp_ctx
);
310 * Hand over the results to the talloc context we've been given.
313 if ((ret_name
!= NULL
) &&
314 !(*ret_name
= talloc_strdup(mem_ctx
, name
))) {
315 DEBUG(0, ("talloc failed\n"));
316 TALLOC_FREE(tmp_ctx
);
320 if (ret_domain
!= NULL
) {
322 if (!(tmp_dom
= talloc_strdup(mem_ctx
, domain
))) {
323 DEBUG(0, ("talloc failed\n"));
324 TALLOC_FREE(tmp_ctx
);
328 *ret_domain
= tmp_dom
;
331 if (ret_sid
!= NULL
) {
332 sid_copy(ret_sid
, &sid
);
335 if (ret_type
!= NULL
) {
339 TALLOC_FREE(tmp_ctx
);
343 /************************************************************************
344 Names from smb.conf can be unqualified. eg. valid users = foo
345 These names should never map to a remote name. Try global_sam_name()\foo,
346 and then "Unix Users"\foo (or "Unix Groups"\foo).
347 ************************************************************************/
349 bool lookup_name_smbconf(TALLOC_CTX
*mem_ctx
,
350 const char *full_name
, int flags
,
351 const char **ret_domain
, const char **ret_name
,
352 DOM_SID
*ret_sid
, enum lsa_SidType
*ret_type
)
354 char *qualified_name
;
357 /* NB. No winbindd_separator here as lookup_name needs \\' */
358 if ((p
= strchr_m(full_name
, *lp_winbind_separator())) != NULL
) {
360 /* The name is already qualified with a domain. */
362 if (*lp_winbind_separator() != '\\') {
365 /* lookup_name() needs '\\' as a separator */
367 tmp
= talloc_strdup(mem_ctx
, full_name
);
371 tmp
[p
- full_name
] = '\\';
375 return lookup_name(mem_ctx
, full_name
, flags
,
376 ret_domain
, ret_name
,
380 /* Try with our own SAM name. */
381 qualified_name
= talloc_asprintf(mem_ctx
, "%s\\%s",
382 get_global_sam_name(),
384 if (!qualified_name
) {
388 if (lookup_name(mem_ctx
, qualified_name
, flags
,
389 ret_domain
, ret_name
,
390 ret_sid
, ret_type
)) {
394 /* Finally try with "Unix Users" or "Unix Group" */
395 qualified_name
= talloc_asprintf(mem_ctx
, "%s\\%s",
396 flags
& LOOKUP_NAME_GROUP
?
397 unix_groups_domain_name() :
398 unix_users_domain_name(),
400 if (!qualified_name
) {
404 return lookup_name(mem_ctx
, qualified_name
, flags
,
405 ret_domain
, ret_name
,
409 static bool wb_lookup_rids(TALLOC_CTX
*mem_ctx
,
410 const DOM_SID
*domain_sid
,
411 int num_rids
, uint32
*rids
,
412 const char **domain_name
,
413 const char **names
, enum lsa_SidType
*types
)
416 const char **my_names
;
417 enum lsa_SidType
*my_types
;
420 if (!(tmp_ctx
= talloc_init("wb_lookup_rids"))) {
424 if (!winbind_lookup_rids(tmp_ctx
, domain_sid
, num_rids
, rids
,
425 domain_name
, &my_names
, &my_types
)) {
427 for (i
=0; i
<num_rids
; i
++) {
429 types
[i
] = SID_NAME_UNKNOWN
;
431 TALLOC_FREE(tmp_ctx
);
435 if (!(*domain_name
= talloc_strdup(mem_ctx
, *domain_name
))) {
436 TALLOC_FREE(tmp_ctx
);
441 * winbind_lookup_rids allocates its own array. We've been given the
442 * array, so copy it over
445 for (i
=0; i
<num_rids
; i
++) {
446 if (my_names
[i
] == NULL
) {
447 TALLOC_FREE(tmp_ctx
);
450 if (!(names
[i
] = talloc_strdup(names
, my_names
[i
]))) {
451 TALLOC_FREE(tmp_ctx
);
454 types
[i
] = my_types
[i
];
456 TALLOC_FREE(tmp_ctx
);
460 static bool lookup_rids(TALLOC_CTX
*mem_ctx
, const DOM_SID
*domain_sid
,
461 int num_rids
, uint32_t *rids
,
462 const char **domain_name
,
463 const char ***names
, enum lsa_SidType
**types
)
467 DEBUG(10, ("lookup_rids called for domain sid '%s'\n",
468 sid_string_dbg(domain_sid
)));
471 *names
= TALLOC_ARRAY(mem_ctx
, const char *, num_rids
);
472 *types
= TALLOC_ARRAY(mem_ctx
, enum lsa_SidType
, num_rids
);
474 if ((*names
== NULL
) || (*types
== NULL
)) {
482 if (sid_check_is_domain(domain_sid
)) {
485 if (*domain_name
== NULL
) {
486 *domain_name
= talloc_strdup(
487 mem_ctx
, get_global_sam_name());
490 if (*domain_name
== NULL
) {
495 result
= pdb_lookup_rids(domain_sid
, num_rids
, rids
,
499 return (NT_STATUS_IS_OK(result
) ||
500 NT_STATUS_EQUAL(result
, NT_STATUS_NONE_MAPPED
) ||
501 NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
));
504 if (sid_check_is_builtin(domain_sid
)) {
506 if (*domain_name
== NULL
) {
507 *domain_name
= talloc_strdup(
508 mem_ctx
, builtin_domain_name());
511 if (*domain_name
== NULL
) {
515 for (i
=0; i
<num_rids
; i
++) {
516 if (lookup_builtin_rid(*names
, rids
[i
],
518 if ((*names
)[i
] == NULL
) {
521 (*types
)[i
] = SID_NAME_ALIAS
;
523 (*types
)[i
] = SID_NAME_UNKNOWN
;
529 if (sid_check_is_wellknown_domain(domain_sid
, NULL
)) {
530 for (i
=0; i
<num_rids
; i
++) {
532 sid_copy(&sid
, domain_sid
);
533 sid_append_rid(&sid
, rids
[i
]);
534 if (lookup_wellknown_sid(mem_ctx
, &sid
,
535 domain_name
, &(*names
)[i
])) {
536 if ((*names
)[i
] == NULL
) {
539 (*types
)[i
] = SID_NAME_WKN_GRP
;
541 (*types
)[i
] = SID_NAME_UNKNOWN
;
547 if (sid_check_is_unix_users(domain_sid
)) {
548 if (*domain_name
== NULL
) {
549 *domain_name
= talloc_strdup(
550 mem_ctx
, unix_users_domain_name());
551 if (*domain_name
== NULL
) {
555 for (i
=0; i
<num_rids
; i
++) {
556 (*names
)[i
] = talloc_strdup(
557 (*names
), uidtoname(rids
[i
]));
558 if ((*names
)[i
] == NULL
) {
561 (*types
)[i
] = SID_NAME_USER
;
566 if (sid_check_is_unix_groups(domain_sid
)) {
567 if (*domain_name
== NULL
) {
568 *domain_name
= talloc_strdup(
569 mem_ctx
, unix_groups_domain_name());
570 if (*domain_name
== NULL
) {
574 for (i
=0; i
<num_rids
; i
++) {
575 (*names
)[i
] = talloc_strdup(
576 (*names
), gidtoname(rids
[i
]));
577 if ((*names
)[i
] == NULL
) {
580 (*types
)[i
] = SID_NAME_DOM_GRP
;
585 return wb_lookup_rids(mem_ctx
, domain_sid
, num_rids
, rids
,
586 domain_name
, *names
, *types
);
590 * Is the SID a domain as such? If yes, lookup its name.
593 static bool lookup_as_domain(const DOM_SID
*sid
, TALLOC_CTX
*mem_ctx
,
597 enum lsa_SidType type
;
599 if (sid_check_is_domain(sid
)) {
600 *name
= talloc_strdup(mem_ctx
, get_global_sam_name());
604 if (sid_check_is_builtin(sid
)) {
605 *name
= talloc_strdup(mem_ctx
, builtin_domain_name());
609 if (sid_check_is_wellknown_domain(sid
, &tmp
)) {
610 *name
= talloc_strdup(mem_ctx
, tmp
);
614 if (sid_check_is_unix_users(sid
)) {
615 *name
= talloc_strdup(mem_ctx
, unix_users_domain_name());
619 if (sid_check_is_unix_groups(sid
)) {
620 *name
= talloc_strdup(mem_ctx
, unix_groups_domain_name());
624 if (sid
->num_auths
!= 4) {
625 /* This can't be a domain */
630 uint32 i
, num_domains
;
631 struct trustdom_info
**domains
;
633 /* This is relatively expensive, but it happens only on DCs
634 * and for SIDs that have 4 sub-authorities and thus look like
637 if (!NT_STATUS_IS_OK(pdb_enum_trusteddoms(mem_ctx
,
643 for (i
=0; i
<num_domains
; i
++) {
644 if (sid_equal(sid
, &domains
[i
]->sid
)) {
645 *name
= talloc_strdup(mem_ctx
,
653 if (winbind_lookup_sid(mem_ctx
, sid
, &tmp
, NULL
, &type
) &&
654 (type
== SID_NAME_DOMAIN
)) {
663 * This tries to implement the rather weird rules for the lsa_lookup level
666 * This is as close as we can get to what W2k3 does. With this we survive the
667 * RPC-LSALOOKUP samba4 test as of 2006-01-08. NT4 as a PDC is a bit more
668 * different, but I assume that's just being too liberal. For example, W2k3
669 * replies to everything else but the levels 1-6 with INVALID_PARAMETER
670 * whereas NT4 does the same as level 1 (I think). I did not fully test that
671 * with NT4, this is what w2k3 does.
673 * Level 1: Ask everywhere
674 * Level 2: Ask domain and trusted domains, no builtin and wkn
675 * Level 3: Only ask domain
676 * Level 4: W2k3ad: Only ask AD trusts
677 * Level 5: Only ask transitive forest trusts
681 static bool check_dom_sid_to_level(const DOM_SID
*sid
, int level
)
690 ret
= (!sid_check_is_builtin(sid
) &&
691 !sid_check_is_wellknown_domain(sid
, NULL
));
696 ret
= sid_check_is_domain(sid
);
703 DEBUG(10, ("%s SID %s in level %d\n",
704 ret
? "Accepting" : "Rejecting",
705 sid_string_dbg(sid
), level
));
710 * Lookup a bunch of SIDs. This is modeled after lsa_lookup_sids with
711 * references to domains, it is explicitly made for this.
713 * This attempts to be as efficient as possible: It collects all SIDs
714 * belonging to a domain and hands them in bulk to the appropriate lookup
715 * function. In particular pdb_lookup_rids with ldapsam_trusted benefits
716 * *hugely* from this. Winbind is going to be extended with a lookup_rids
717 * interface as well, so on a DC we can do a bulk lsa_lookuprids to the
721 NTSTATUS
lookup_sids(TALLOC_CTX
*mem_ctx
, int num_sids
,
722 const DOM_SID
**sids
, int level
,
723 struct lsa_dom_info
**ret_domains
,
724 struct lsa_name_info
**ret_names
)
727 NTSTATUS result
= NT_STATUS_UNSUCCESSFUL
;
728 struct lsa_name_info
*name_infos
;
729 struct lsa_dom_info
*dom_infos
= NULL
;
733 if (!(tmp_ctx
= talloc_new(mem_ctx
))) {
734 DEBUG(0, ("talloc_new failed\n"));
735 return NT_STATUS_NO_MEMORY
;
739 name_infos
= TALLOC_ARRAY(mem_ctx
, struct lsa_name_info
, num_sids
);
740 if (name_infos
== NULL
) {
741 result
= NT_STATUS_NO_MEMORY
;
748 dom_infos
= TALLOC_ZERO_ARRAY(mem_ctx
, struct lsa_dom_info
,
750 if (dom_infos
== NULL
) {
751 result
= NT_STATUS_NO_MEMORY
;
755 /* First build up the data structures:
757 * dom_infos is a list of domains referenced in the list of
758 * SIDs. Later we will walk the list of domains and look up the RIDs
761 * name_infos is a shadow-copy of the SIDs array to collect the real
764 * dom_info->idxs is an index into the name_infos array. The
765 * difficulty we have here is that we need to keep the SIDs the client
766 * asked for in the same order for the reply
769 for (i
=0; i
<num_sids
; i
++) {
772 const char *domain_name
= NULL
;
774 sid_copy(&sid
, sids
[i
]);
775 name_infos
[i
].type
= SID_NAME_USE_NONE
;
777 if (lookup_as_domain(&sid
, name_infos
, &domain_name
)) {
778 /* We can't push that through the normal lookup
779 * process, as this would reference illegal
782 * For example S-1-5-32 would end up referencing
783 * domain S-1-5- with RID 32 which is clearly wrong.
785 if (domain_name
== NULL
) {
786 result
= NT_STATUS_NO_MEMORY
;
790 name_infos
[i
].rid
= 0;
791 name_infos
[i
].type
= SID_NAME_DOMAIN
;
792 name_infos
[i
].name
= NULL
;
794 if (sid_check_is_builtin(&sid
)) {
795 /* Yes, W2k3 returns "BUILTIN" both as domain
797 name_infos
[i
].name
= talloc_strdup(
798 name_infos
, builtin_domain_name());
799 if (name_infos
[i
].name
== NULL
) {
800 result
= NT_STATUS_NO_MEMORY
;
805 /* This is a normal SID with rid component */
806 if (!sid_split_rid(&sid
, &rid
)) {
807 result
= NT_STATUS_INVALID_PARAMETER
;
812 if (!check_dom_sid_to_level(&sid
, level
)) {
813 name_infos
[i
].rid
= 0;
814 name_infos
[i
].type
= SID_NAME_UNKNOWN
;
815 name_infos
[i
].name
= NULL
;
819 for (j
=0; j
<MAX_REF_DOMAINS
; j
++) {
820 if (!dom_infos
[j
].valid
) {
823 if (sid_equal(&sid
, &dom_infos
[j
].sid
)) {
828 if (j
== MAX_REF_DOMAINS
) {
829 /* TODO: What's the right error message here? */
830 result
= NT_STATUS_NONE_MAPPED
;
834 if (!dom_infos
[j
].valid
) {
835 /* We found a domain not yet referenced, create a new
837 dom_infos
[j
].valid
= true;
838 sid_copy(&dom_infos
[j
].sid
, &sid
);
840 if (domain_name
!= NULL
) {
841 /* This name was being found above in the case
842 * when we found a domain SID */
844 talloc_strdup(dom_infos
, domain_name
);
845 if (dom_infos
[j
].name
== NULL
) {
846 result
= NT_STATUS_NO_MEMORY
;
850 /* lookup_rids will take care of this */
851 dom_infos
[j
].name
= NULL
;
855 name_infos
[i
].dom_idx
= j
;
857 if (name_infos
[i
].type
== SID_NAME_USE_NONE
) {
858 name_infos
[i
].rid
= rid
;
860 ADD_TO_ARRAY(dom_infos
, int, i
, &dom_infos
[j
].idxs
,
861 &dom_infos
[j
].num_idxs
);
863 if (dom_infos
[j
].idxs
== NULL
) {
864 result
= NT_STATUS_NO_MEMORY
;
870 /* Iterate over the domains found */
872 for (i
=0; i
<MAX_REF_DOMAINS
; i
++) {
874 const char *domain_name
= NULL
;
876 enum lsa_SidType
*types
;
877 struct lsa_dom_info
*dom
= &dom_infos
[i
];
880 /* No domains left, we're done */
885 if (!(rids
= TALLOC_ARRAY(tmp_ctx
, uint32
, dom
->num_idxs
))) {
886 result
= NT_STATUS_NO_MEMORY
;
893 for (j
=0; j
<dom
->num_idxs
; j
++) {
894 rids
[j
] = name_infos
[dom
->idxs
[j
]].rid
;
897 if (!lookup_rids(tmp_ctx
, &dom
->sid
,
898 dom
->num_idxs
, rids
, &domain_name
,
900 result
= NT_STATUS_NO_MEMORY
;
904 if (!(dom
->name
= talloc_strdup(dom_infos
, domain_name
))) {
905 result
= NT_STATUS_NO_MEMORY
;
909 for (j
=0; j
<dom
->num_idxs
; j
++) {
910 int idx
= dom
->idxs
[j
];
911 name_infos
[idx
].type
= types
[j
];
912 if (types
[j
] != SID_NAME_UNKNOWN
) {
913 name_infos
[idx
].name
=
914 talloc_strdup(name_infos
, names
[j
]);
915 if (name_infos
[idx
].name
== NULL
) {
916 result
= NT_STATUS_NO_MEMORY
;
920 name_infos
[idx
].name
= NULL
;
925 *ret_domains
= dom_infos
;
926 *ret_names
= name_infos
;
927 TALLOC_FREE(tmp_ctx
);
931 TALLOC_FREE(dom_infos
);
932 TALLOC_FREE(name_infos
);
933 TALLOC_FREE(tmp_ctx
);
937 /*****************************************************************
938 *THE CANONICAL* convert SID to name function.
939 *****************************************************************/
941 bool lookup_sid(TALLOC_CTX
*mem_ctx
, const DOM_SID
*sid
,
942 const char **ret_domain
, const char **ret_name
,
943 enum lsa_SidType
*ret_type
)
945 struct lsa_dom_info
*domain
;
946 struct lsa_name_info
*name
;
950 DEBUG(10, ("lookup_sid called for SID '%s'\n", sid_string_dbg(sid
)));
952 if (!(tmp_ctx
= talloc_new(mem_ctx
))) {
953 DEBUG(0, ("talloc_new failed\n"));
957 if (!NT_STATUS_IS_OK(lookup_sids(tmp_ctx
, 1, &sid
, 1,
962 if (name
->type
== SID_NAME_UNKNOWN
) {
966 if ((ret_domain
!= NULL
) &&
967 !(*ret_domain
= talloc_strdup(mem_ctx
, domain
->name
))) {
971 if ((ret_name
!= NULL
) &&
972 !(*ret_name
= talloc_strdup(mem_ctx
, name
->name
))) {
976 if (ret_type
!= NULL
) {
977 *ret_type
= name
->type
;
984 DEBUG(10, ("Sid %s -> %s\\%s(%d)\n", sid_string_dbg(sid
),
985 domain
->name
, name
->name
, name
->type
));
987 DEBUG(10, ("failed to lookup sid %s\n", sid_string_dbg(sid
)));
989 TALLOC_FREE(tmp_ctx
);
993 /*****************************************************************
994 Id mapping cache. This is to avoid Winbind mappings already
995 seen by smbd to be queried too frequently, keeping winbindd
996 busy, and blocking smbd while winbindd is busy with other
997 stuff. Written by Michael Steffens <michael.steffens@hp.com>,
998 modified to use linked lists by jra.
999 *****************************************************************/
1001 /*****************************************************************
1002 Find a SID given a uid.
1003 *****************************************************************/
1005 static bool fetch_sid_from_uid_cache(DOM_SID
*psid
, uid_t uid
)
1007 DATA_BLOB cache_value
;
1009 if (!memcache_lookup(NULL
, UID_SID_CACHE
,
1010 data_blob_const(&uid
, sizeof(uid
)),
1015 memcpy(psid
, cache_value
.data
, MIN(sizeof(*psid
), cache_value
.length
));
1016 SMB_ASSERT(cache_value
.length
>= offsetof(struct dom_sid
, id_auth
));
1017 SMB_ASSERT(cache_value
.length
== ndr_size_dom_sid(psid
, 0));
1022 /*****************************************************************
1023 Find a uid given a SID.
1024 *****************************************************************/
1026 static bool fetch_uid_from_cache( uid_t
*puid
, const DOM_SID
*psid
)
1028 DATA_BLOB cache_value
;
1030 if (!memcache_lookup(NULL
, SID_UID_CACHE
,
1031 data_blob_const(psid
, ndr_size_dom_sid(psid
, 0)),
1036 SMB_ASSERT(cache_value
.length
== sizeof(*puid
));
1037 memcpy(puid
, cache_value
.data
, sizeof(*puid
));
1042 /*****************************************************************
1043 Store uid to SID mapping in cache.
1044 *****************************************************************/
1046 void store_uid_sid_cache(const DOM_SID
*psid
, uid_t uid
)
1048 memcache_add(NULL
, SID_UID_CACHE
,
1049 data_blob_const(psid
, ndr_size_dom_sid(psid
, 0)),
1050 data_blob_const(&uid
, sizeof(uid
)));
1051 memcache_add(NULL
, UID_SID_CACHE
,
1052 data_blob_const(&uid
, sizeof(uid
)),
1053 data_blob_const(psid
, ndr_size_dom_sid(psid
, 0)));
1056 /*****************************************************************
1057 Find a SID given a gid.
1058 *****************************************************************/
1060 static bool fetch_sid_from_gid_cache(DOM_SID
*psid
, gid_t gid
)
1062 DATA_BLOB cache_value
;
1064 if (!memcache_lookup(NULL
, GID_SID_CACHE
,
1065 data_blob_const(&gid
, sizeof(gid
)),
1070 memcpy(psid
, cache_value
.data
, MIN(sizeof(*psid
), cache_value
.length
));
1071 SMB_ASSERT(cache_value
.length
>= offsetof(struct dom_sid
, id_auth
));
1072 SMB_ASSERT(cache_value
.length
== ndr_size_dom_sid(psid
, 0));
1077 /*****************************************************************
1078 Find a gid given a SID.
1079 *****************************************************************/
1081 static bool fetch_gid_from_cache(gid_t
*pgid
, const DOM_SID
*psid
)
1083 DATA_BLOB cache_value
;
1085 if (!memcache_lookup(NULL
, SID_UID_CACHE
,
1086 data_blob_const(psid
, ndr_size_dom_sid(psid
, 0)),
1091 SMB_ASSERT(cache_value
.length
== sizeof(*pgid
));
1092 memcpy(pgid
, cache_value
.data
, sizeof(*pgid
));
1097 /*****************************************************************
1098 Store gid to SID mapping in cache.
1099 *****************************************************************/
1101 void store_gid_sid_cache(const DOM_SID
*psid
, gid_t gid
)
1103 memcache_add(NULL
, SID_GID_CACHE
,
1104 data_blob_const(psid
, ndr_size_dom_sid(psid
, 0)),
1105 data_blob_const(&gid
, sizeof(gid
)));
1106 memcache_add(NULL
, GID_SID_CACHE
,
1107 data_blob_const(&gid
, sizeof(gid
)),
1108 data_blob_const(psid
, ndr_size_dom_sid(psid
, 0)));
1111 /*****************************************************************
1112 *THE LEGACY* convert uid_t to SID function.
1113 *****************************************************************/
1115 static void legacy_uid_to_sid(DOM_SID
*psid
, uid_t uid
)
1123 ret
= pdb_uid_to_rid(uid
, &rid
);
1127 /* This is a mapped user */
1128 sid_copy(psid
, get_global_sam_sid());
1129 sid_append_rid(psid
, rid
);
1133 /* This is an unmapped user */
1135 uid_to_unix_users_sid(uid
, psid
);
1138 DEBUG(10,("LEGACY: uid %u -> sid %s\n", (unsigned int)uid
,
1139 sid_string_dbg(psid
)));
1141 store_uid_sid_cache(psid
, uid
);
1145 /*****************************************************************
1146 *THE LEGACY* convert gid_t to SID function.
1147 *****************************************************************/
1149 static void legacy_gid_to_sid(DOM_SID
*psid
, gid_t gid
)
1156 ret
= pdb_gid_to_sid(gid
, psid
);
1160 /* This is a mapped group */
1164 /* This is an unmapped group */
1166 gid_to_unix_groups_sid(gid
, psid
);
1169 DEBUG(10,("LEGACY: gid %u -> sid %s\n", (unsigned int)gid
,
1170 sid_string_dbg(psid
)));
1172 store_gid_sid_cache(psid
, gid
);
1176 /*****************************************************************
1177 *THE LEGACY* convert SID to uid function.
1178 *****************************************************************/
1180 static bool legacy_sid_to_uid(const DOM_SID
*psid
, uid_t
*puid
)
1182 enum lsa_SidType type
;
1185 if (sid_peek_check_rid(get_global_sam_sid(), psid
, &rid
)) {
1190 ret
= pdb_sid_to_id(psid
, &id
, &type
);
1194 if (type
!= SID_NAME_USER
) {
1195 DEBUG(5, ("sid %s is a %s, expected a user\n",
1196 sid_string_dbg(psid
),
1197 sid_type_lookup(type
)));
1204 /* This was ours, but it was not mapped. Fail */
1207 DEBUG(10,("LEGACY: mapping failed for sid %s\n",
1208 sid_string_dbg(psid
)));
1212 DEBUG(10,("LEGACY: sid %s -> uid %u\n", sid_string_dbg(psid
),
1213 (unsigned int)*puid
));
1215 store_uid_sid_cache(psid
, *puid
);
1219 /*****************************************************************
1220 *THE LEGACY* convert SID to gid function.
1221 Group mapping is used for gids that maps to Wellknown SIDs
1222 *****************************************************************/
1224 static bool legacy_sid_to_gid(const DOM_SID
*psid
, gid_t
*pgid
)
1229 enum lsa_SidType type
;
1231 if ((sid_check_is_in_builtin(psid
) ||
1232 sid_check_is_in_wellknown_domain(psid
))) {
1236 ret
= pdb_getgrsid(&map
, *psid
);
1243 DEBUG(10,("LEGACY: mapping failed for sid %s\n",
1244 sid_string_dbg(psid
)));
1248 if (sid_peek_check_rid(get_global_sam_sid(), psid
, &rid
)) {
1252 ret
= pdb_sid_to_id(psid
, &id
, &type
);
1256 if ((type
!= SID_NAME_DOM_GRP
) &&
1257 (type
!= SID_NAME_ALIAS
)) {
1258 DEBUG(5, ("LEGACY: sid %s is a %s, expected "
1259 "a group\n", sid_string_dbg(psid
),
1260 sid_type_lookup(type
)));
1267 /* This was ours, but it was not mapped. Fail */
1270 DEBUG(10,("LEGACY: mapping failed for sid %s\n",
1271 sid_string_dbg(psid
)));
1275 DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_dbg(psid
),
1276 (unsigned int)*pgid
));
1278 store_gid_sid_cache(psid
, *pgid
);
1283 /*****************************************************************
1284 *THE CANONICAL* convert uid_t to SID function.
1285 *****************************************************************/
1287 void uid_to_sid(DOM_SID
*psid
, uid_t uid
)
1289 bool expired
= true;
1293 if (fetch_sid_from_uid_cache(psid
, uid
))
1296 /* Check the winbindd cache directly. */
1297 ret
= idmap_cache_find_uid2sid(uid
, psid
, &expired
);
1299 if (!ret
|| expired
|| (ret
&& is_null_sid(psid
))) {
1300 /* Not in cache. Ask winbindd. */
1301 if (!winbind_uid_to_sid(psid
, uid
)) {
1302 if (!winbind_ping()) {
1303 legacy_uid_to_sid(psid
, uid
);
1307 DEBUG(5, ("uid_to_sid: winbind failed to find a sid for uid %u\n",
1313 DEBUG(10,("uid %u -> sid %s\n", (unsigned int)uid
,
1314 sid_string_dbg(psid
)));
1316 store_uid_sid_cache(psid
, uid
);
1320 /*****************************************************************
1321 *THE CANONICAL* convert gid_t to SID function.
1322 *****************************************************************/
1324 void gid_to_sid(DOM_SID
*psid
, gid_t gid
)
1326 bool expired
= true;
1330 if (fetch_sid_from_gid_cache(psid
, gid
))
1333 /* Check the winbindd cache directly. */
1334 ret
= idmap_cache_find_gid2sid(gid
, psid
, &expired
);
1336 if (!ret
|| expired
|| (ret
&& is_null_sid(psid
))) {
1337 /* Not in cache. Ask winbindd. */
1338 if (!winbind_gid_to_sid(psid
, gid
)) {
1339 if (!winbind_ping()) {
1340 legacy_gid_to_sid(psid
, gid
);
1344 DEBUG(5, ("gid_to_sid: winbind failed to find a sid for gid %u\n",
1350 DEBUG(10,("gid %u -> sid %s\n", (unsigned int)gid
,
1351 sid_string_dbg(psid
)));
1353 store_gid_sid_cache(psid
, gid
);
1357 /*****************************************************************
1358 *THE CANONICAL* convert SID to uid function.
1359 *****************************************************************/
1361 bool sid_to_uid(const DOM_SID
*psid
, uid_t
*puid
)
1363 bool expired
= true;
1368 if (fetch_uid_from_cache(puid
, psid
))
1371 if (fetch_gid_from_cache(&gid
, psid
)) {
1375 /* Optimize for the Unix Users Domain
1376 * as the conversion is straightforward */
1377 if (sid_peek_check_rid(&global_sid_Unix_Users
, psid
, &rid
)) {
1381 /* return here, don't cache */
1382 DEBUG(10,("sid %s -> uid %u\n", sid_string_dbg(psid
),
1383 (unsigned int)*puid
));
1387 /* Check the winbindd cache directly. */
1388 ret
= idmap_cache_find_sid2uid(psid
, puid
, &expired
);
1390 if (!ret
|| expired
|| (ret
&& (*puid
== (uid_t
)-1))) {
1391 /* Not in cache. Ask winbindd. */
1392 if (!winbind_sid_to_uid(puid
, psid
)) {
1393 if (!winbind_ping()) {
1394 return legacy_sid_to_uid(psid
, puid
);
1397 DEBUG(5, ("winbind failed to find a uid for sid %s\n",
1398 sid_string_dbg(psid
)));
1403 /* TODO: Here would be the place to allocate both a gid and a uid for
1404 * the SID in question */
1406 DEBUG(10,("sid %s -> uid %u\n", sid_string_dbg(psid
),
1407 (unsigned int)*puid
));
1409 store_uid_sid_cache(psid
, *puid
);
1413 /*****************************************************************
1414 *THE CANONICAL* convert SID to gid function.
1415 Group mapping is used for gids that maps to Wellknown SIDs
1416 *****************************************************************/
1418 bool sid_to_gid(const DOM_SID
*psid
, gid_t
*pgid
)
1420 bool expired
= true;
1425 if (fetch_gid_from_cache(pgid
, psid
))
1428 if (fetch_uid_from_cache(&uid
, psid
))
1431 /* Optimize for the Unix Groups Domain
1432 * as the conversion is straightforward */
1433 if (sid_peek_check_rid(&global_sid_Unix_Groups
, psid
, &rid
)) {
1437 /* return here, don't cache */
1438 DEBUG(10,("sid %s -> gid %u\n", sid_string_dbg(psid
),
1439 (unsigned int)*pgid
));
1443 /* Check the winbindd cache directly. */
1444 ret
= idmap_cache_find_sid2gid(psid
, pgid
, &expired
);
1446 if (!ret
|| expired
|| (ret
&& (*pgid
== (gid_t
)-1))) {
1447 /* Not in cache or negative. Ask winbindd. */
1448 /* Ask winbindd if it can map this sid to a gid.
1449 * (Idmap will check it is a valid SID and of the right type) */
1451 if ( !winbind_sid_to_gid(pgid
, psid
) ) {
1452 if (!winbind_ping()) {
1453 return legacy_sid_to_gid(psid
, pgid
);
1456 DEBUG(10,("winbind failed to find a gid for sid %s\n",
1457 sid_string_dbg(psid
)));
1462 DEBUG(10,("sid %s -> gid %u\n", sid_string_dbg(psid
),
1463 (unsigned int)*pgid
));
1465 store_gid_sid_cache(psid
, *pgid
);