2 Unix SMB/CIFS implementation.
4 Python wrapper for winbind client functions.
6 Copyright (C) Tim Potter 2002-2003
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 #include "py_winbind.h"
25 * Exceptions raised by this module
28 PyObject
*winbind_error
; /* A winbind call returned WINBINDD_ERROR */
30 /* Prototypes from common.h */
32 NSS_STATUS
winbindd_request_response(int req_type
,
33 struct winbindd_request
*request
,
34 struct winbindd_response
*response
);
37 * Name <-> SID conversion
40 /* Convert a name to a sid */
42 static PyObject
*py_name_to_sid(PyObject
*self
, PyObject
*args
)
45 struct winbindd_request request
;
46 struct winbindd_response response
;
51 if (!PyArg_ParseTuple(args
, "s", &name
))
55 ZERO_STRUCT(response
);
57 sep
= lp_winbind_separator();
59 if ((p
= strchr(name
, sep
[0]))) {
61 fstrcpy(request
.data
.name
.dom_name
, name
);
62 fstrcpy(request
.data
.name
.name
, p
+ 1);
64 fstrcpy(request
.data
.name
.dom_name
, lp_workgroup());
65 fstrcpy(request
.data
.name
.name
, name
);
68 if (winbindd_request_response(WINBINDD_LOOKUPNAME
, &request
, &response
)
69 != NSS_STATUS_SUCCESS
) {
70 PyErr_SetString(winbind_error
, "lookup failed");
74 result
= PyString_FromString(response
.data
.sid
.sid
);
79 /* Convert a sid to a name */
81 static PyObject
*py_sid_to_name(PyObject
*self
, PyObject
*args
)
83 struct winbindd_request request
;
84 struct winbindd_response response
;
88 if (!PyArg_ParseTuple(args
, "s", &sid
))
92 ZERO_STRUCT(response
);
94 fstrcpy(request
.data
.sid
, sid
);
96 if (winbindd_request_response(WINBINDD_LOOKUPSID
, &request
, &response
)
97 != NSS_STATUS_SUCCESS
) {
98 PyErr_SetString(winbind_error
, "lookup failed");
102 asprintf(&name
, "%s%s%s", response
.data
.name
.dom_name
,
103 lp_winbind_separator(), response
.data
.name
.name
);
105 result
= PyString_FromString(name
);
113 * Enumerate users/groups
116 /* Enumerate domain users */
118 static PyObject
*py_enum_domain_users(PyObject
*self
, PyObject
*args
)
120 struct winbindd_response response
;
123 if (!PyArg_ParseTuple(args
, ""))
126 ZERO_STRUCT(response
);
128 if (winbindd_request_response(WINBINDD_LIST_USERS
, NULL
, &response
)
129 != NSS_STATUS_SUCCESS
) {
130 PyErr_SetString(winbind_error
, "lookup failed");
134 result
= PyList_New(0);
136 if (response
.extra_data
.data
) {
137 const char *extra_data
= response
.extra_data
.data
;
140 while (next_token(&extra_data
, name
, ",", sizeof(fstring
)))
141 PyList_Append(result
, PyString_FromString(name
));
147 /* Enumerate domain groups */
149 static PyObject
*py_enum_domain_groups(PyObject
*self
, PyObject
*args
)
151 struct winbindd_response response
;
152 PyObject
*result
= NULL
;
154 if (!PyArg_ParseTuple(args
, ""))
157 ZERO_STRUCT(response
);
159 if (winbindd_request_response(WINBINDD_LIST_GROUPS
, NULL
, &response
)
160 != NSS_STATUS_SUCCESS
) {
161 PyErr_SetString(winbind_error
, "lookup failed");
165 result
= PyList_New(0);
167 if (response
.extra_data
.data
) {
168 const char *extra_data
= response
.extra_data
.data
;
171 while (next_token(&extra_data
, name
, ",", sizeof(fstring
)))
172 PyList_Append(result
, PyString_FromString(name
));
179 * Miscellaneous domain related
182 /* Enumerate domain groups */
184 static PyObject
*py_enum_trust_dom(PyObject
*self
, PyObject
*args
)
186 struct winbindd_response response
;
187 PyObject
*result
= NULL
;
189 if (!PyArg_ParseTuple(args
, ""))
192 ZERO_STRUCT(response
);
194 if (winbindd_request_response(WINBINDD_LIST_TRUSTDOM
, NULL
, &response
)
195 != NSS_STATUS_SUCCESS
) {
196 PyErr_SetString(winbind_error
, "lookup failed");
200 result
= PyList_New(0);
202 if (response
.extra_data
.data
) {
203 const char *extra_data
= response
.extra_data
.data
;
206 while (next_token(&extra_data
, name
, ",", sizeof(fstring
)))
207 PyList_Append(result
, PyString_FromString(name
));
213 /* Check machine account password */
215 static PyObject
*py_check_secret(PyObject
*self
, PyObject
*args
)
217 struct winbindd_response response
;
219 if (!PyArg_ParseTuple(args
, ""))
222 ZERO_STRUCT(response
);
224 if (winbindd_request_response(WINBINDD_CHECK_MACHACC
, NULL
, &response
)
225 != NSS_STATUS_SUCCESS
) {
226 PyErr_SetString(winbind_error
, "lookup failed");
230 return PyInt_FromLong(response
.data
.num_entries
);
234 * Return a dictionary consisting of all the winbind related smb.conf
235 * parameters. This is stored in the module object.
238 static PyObject
*py_config_dict(void)
244 if (!(result
= PyDict_New()))
247 /* Various string parameters */
249 PyDict_SetItemString(result
, "workgroup",
250 PyString_FromString(lp_workgroup()));
252 PyDict_SetItemString(result
, "separator",
253 PyString_FromString(lp_winbind_separator()));
255 PyDict_SetItemString(result
, "template_homedir",
256 PyString_FromString(lp_template_homedir()));
258 PyDict_SetItemString(result
, "template_shell",
259 PyString_FromString(lp_template_shell()));
261 /* idmap uid/gid range */
263 if (lp_idmap_uid(&ulow
, &uhi
)) {
264 PyDict_SetItemString(result
, "uid_low", PyInt_FromLong(ulow
));
265 PyDict_SetItemString(result
, "uid_high", PyInt_FromLong(uhi
));
268 if (lp_idmap_gid(&glow
, &ghi
)) {
269 PyDict_SetItemString(result
, "gid_low", PyInt_FromLong(glow
));
270 PyDict_SetItemString(result
, "gid_high", PyInt_FromLong(ghi
));
280 /* Convert a uid to a SID */
282 static PyObject
*py_uid_to_sid(PyObject
*self
, PyObject
*args
)
284 struct winbindd_request request
;
285 struct winbindd_response response
;
288 if (!PyArg_ParseTuple(args
, "i", &id
))
291 ZERO_STRUCT(request
);
292 ZERO_STRUCT(response
);
294 request
.data
.uid
= id
;
296 if (winbindd_request_response(WINBINDD_UID_TO_SID
, &request
, &response
)
297 != NSS_STATUS_SUCCESS
) {
298 PyErr_SetString(winbind_error
, "lookup failed");
302 return PyString_FromString(response
.data
.sid
.sid
);
305 /* Convert a gid to a SID */
307 static PyObject
*py_gid_to_sid(PyObject
*self
, PyObject
*args
)
309 struct winbindd_request request
;
310 struct winbindd_response response
;
313 if (!PyArg_ParseTuple(args
, "i", &id
))
316 ZERO_STRUCT(request
);
317 ZERO_STRUCT(response
);
319 request
.data
.gid
= id
;
321 if (winbindd_request_response(WINBINDD_GID_TO_SID
, &request
, &response
)
322 != NSS_STATUS_SUCCESS
) {
323 PyErr_SetString(winbind_error
, "lookup failed");
327 return PyString_FromString(response
.data
.sid
.sid
);
330 /* Convert a sid to a uid */
332 static PyObject
*py_sid_to_uid(PyObject
*self
, PyObject
*args
)
334 struct winbindd_request request
;
335 struct winbindd_response response
;
338 if (!PyArg_ParseTuple(args
, "s", &sid
))
341 ZERO_STRUCT(request
);
342 ZERO_STRUCT(response
);
344 fstrcpy(request
.data
.sid
, sid
);
346 if (winbindd_request_response(WINBINDD_SID_TO_UID
, &request
, &response
)
347 != NSS_STATUS_SUCCESS
) {
348 PyErr_SetString(winbind_error
, "lookup failed");
352 return PyInt_FromLong(response
.data
.uid
);
355 /* Convert a sid to a gid */
357 static PyObject
*py_sid_to_gid(PyObject
*self
, PyObject
*args
)
359 struct winbindd_request request
;
360 struct winbindd_response response
;
363 if (!PyArg_ParseTuple(args
, "s", &sid
))
366 ZERO_STRUCT(request
);
367 ZERO_STRUCT(response
);
369 fstrcpy(request
.data
.sid
, sid
);
371 if (winbindd_request_response(WINBINDD_SID_TO_GID
, &request
, &response
)
372 != NSS_STATUS_SUCCESS
) {
373 PyErr_SetString(winbind_error
, "lookup failed");
377 return PyInt_FromLong(response
.data
.gid
);
381 * PAM authentication functions
384 /* Plaintext authentication */
386 static PyObject
*py_auth_plaintext(PyObject
*self
, PyObject
*args
)
388 struct winbindd_request request
;
389 struct winbindd_response response
;
390 char *username
, *password
;
392 if (!PyArg_ParseTuple(args
, "ss", &username
, &password
))
395 ZERO_STRUCT(request
);
396 ZERO_STRUCT(response
);
398 fstrcpy(request
.data
.auth
.user
, username
);
399 fstrcpy(request
.data
.auth
.pass
, password
);
401 if (winbindd_request_response(WINBINDD_PAM_AUTH
, &request
, &response
)
402 != NSS_STATUS_SUCCESS
) {
403 PyErr_SetString(winbind_error
, "lookup failed");
407 return PyInt_FromLong(response
.data
.auth
.nt_status
);
410 /* Challenge/response authentication */
412 static PyObject
*py_auth_crap(PyObject
*self
, PyObject
*args
, PyObject
*kw
)
414 static char *kwlist
[] =
415 {"username", "password", "use_lm_hash", "use_nt_hash", NULL
};
416 struct winbindd_request request
;
417 struct winbindd_response response
;
418 char *username
, *password
;
419 int use_lm_hash
= 1, use_nt_hash
= 1;
421 if (!PyArg_ParseTupleAndKeywords(
422 args
, kw
, "ss|ii", kwlist
, &username
, &password
,
423 &use_lm_hash
, &use_nt_hash
))
426 ZERO_STRUCT(request
);
427 ZERO_STRUCT(response
);
429 if (push_utf8_fstring(request
.data
.auth_crap
.user
, username
) == -1) {
430 PyErr_SetString(winbind_error
, "unable to create utf8 string");
434 generate_random_buffer(request
.data
.auth_crap
.chal
, 8);
437 SMBencrypt((uchar
*)password
, request
.data
.auth_crap
.chal
,
438 (uchar
*)request
.data
.auth_crap
.lm_resp
);
439 request
.data
.auth_crap
.lm_resp_len
= 24;
443 SMBNTencrypt((uchar
*)password
, request
.data
.auth_crap
.chal
,
444 (uchar
*)request
.data
.auth_crap
.nt_resp
);
445 request
.data
.auth_crap
.nt_resp_len
= 24;
448 if (winbindd_request_response(WINBINDD_PAM_AUTH_CRAP
, &request
, &response
)
449 != NSS_STATUS_SUCCESS
) {
450 PyErr_SetString(winbind_error
, "lookup failed");
454 return PyInt_FromLong(response
.data
.auth
.nt_status
);
457 #if 0 /* Include when auth_smbd merged to HEAD */
459 /* Challenge/response authentication, with secret */
461 static PyObject
*py_auth_smbd(PyObject
*self
, PyObject
*args
, PyObject
*kw
)
463 static char *kwlist
[] =
464 {"username", "password", "use_lm_hash", "use_nt_hash", NULL
};
465 struct winbindd_request request
;
466 struct winbindd_response response
;
467 char *username
, *password
;
468 int use_lm_hash
= 1, use_nt_hash
= 1;
470 if (!PyArg_ParseTupleAndKeywords(
471 args
, kw
, "ss|ii", kwlist
, &username
, &password
,
472 &use_lm_hash
, &use_nt_hash
))
475 ZERO_STRUCT(request
);
476 ZERO_STRUCT(response
);
478 if (push_utf8_fstring(request
.data
.auth_crap
.user
, username
) == -1) {
479 PyErr_SetString("unable to create utf8 string");
483 generate_random_buffer(request
.data
.smbd_auth_crap
.chal
, 8);
486 SMBencrypt((uchar
*)password
,
487 request
.data
.smbd_auth_crap
.chal
,
488 (uchar
*)request
.data
.smbd_auth_crap
.lm_resp
);
489 request
.data
.smbd_auth_crap
.lm_resp_len
= 24;
493 SMBNTencrypt((uchar
*)password
,
494 request
.data
.smbd_auth_crap
.chal
,
495 (uchar
*)request
.data
.smbd_auth_crap
.nt_resp
);
496 request
.data
.smbd_auth_crap
.nt_resp_len
= 24;
499 if (!secrets_fetch_trust_account_password(
500 lp_workgroup(), request
.data
.smbd_auth_crap
.proof
, NULL
)) {
502 winbind_error
, "unable to fetch domain secret");
508 if (winbindd_request_response(WINBINDD_SMBD_AUTH_CRAP
, &request
, &response
)
509 != NSS_STATUS_SUCCESS
) {
510 PyErr_SetString(winbind_error
, "lookup failed");
514 return PyInt_FromLong(response
.data
.auth
.nt_status
);
519 /* Get user info from name */
521 static PyObject
*py_getpwnam(PyObject
*self
, PyObject
*args
)
523 struct winbindd_request request
;
524 struct winbindd_response response
;
528 if (!PyArg_ParseTuple(args
, "s", &username
))
531 ZERO_STRUCT(request
);
532 ZERO_STRUCT(response
);
534 fstrcpy(request
.data
.username
, username
);
536 if (winbindd_request_response(WINBINDD_GETPWNAM
, &request
, &response
)
537 != NSS_STATUS_SUCCESS
) {
538 PyErr_SetString(winbind_error
, "lookup failed");
542 if (!py_from_winbind_passwd(&result
, &response
)) {
550 /* Get user info from uid */
552 static PyObject
*py_getpwuid(PyObject
*self
, PyObject
*args
)
554 struct winbindd_request request
;
555 struct winbindd_response response
;
559 if (!PyArg_ParseTuple(args
, "i", &uid
))
562 ZERO_STRUCT(request
);
563 ZERO_STRUCT(response
);
565 request
.data
.uid
= uid
;
567 if (winbindd_request_response(WINBINDD_GETPWUID
, &request
, &response
)
568 != NSS_STATUS_SUCCESS
) {
569 PyErr_SetString(winbind_error
, "lookup failed");
573 if (!py_from_winbind_passwd(&result
, &response
)) {
582 * Method dispatch table
585 static PyMethodDef winbind_methods
[] = {
587 { "getpwnam", (PyCFunction
)py_getpwnam
, METH_VARARGS
, "getpwnam(3)" },
588 { "getpwuid", (PyCFunction
)py_getpwuid
, METH_VARARGS
, "getpwuid(3)" },
590 /* Name <-> SID conversion */
592 { "name_to_sid", (PyCFunction
)py_name_to_sid
, METH_VARARGS
,
593 "name_to_sid(s) -> string\n"
595 "Return the SID for a name.\n"
599 ">>> winbind.name_to_sid('FOO/Administrator')\n"
600 "'S-1-5-21-406022937-1377575209-526660263-500' " },
602 { "sid_to_name", (PyCFunction
)py_sid_to_name
, METH_VARARGS
,
603 "sid_to_name(s) -> string\n"
605 "Return the name for a SID.\n"
609 ">>> import winbind\n"
610 ">>> winbind.sid_to_name('S-1-5-21-406022937-1377575209-526660263-500')\n"
611 "'FOO/Administrator' " },
613 /* Enumerate users/groups */
615 { "enum_domain_users", (PyCFunction
)py_enum_domain_users
, METH_VARARGS
,
616 "enum_domain_users() -> list of strings\n"
618 "Return a list of domain users.\n"
622 ">>> winbind.enum_domain_users()\n"
623 "['FOO/Administrator', 'FOO/anna', 'FOO/Anne Elk', 'FOO/build', \n"
624 "'FOO/foo', 'FOO/foo2', 'FOO/foo3', 'FOO/Guest', 'FOO/user1', \n"
625 "'FOO/whoops-ptang'] " },
627 { "enum_domain_groups", (PyCFunction
)py_enum_domain_groups
,
629 "enum_domain_groups() -> list of strings\n"
631 "Return a list of domain groups.\n"
635 ">>> winbind.enum_domain_groups()\n"
636 "['FOO/cows', 'FOO/Domain Admins', 'FOO/Domain Guests', \n"
637 "'FOO/Domain Users'] " },
641 { "uid_to_sid", (PyCFunction
)py_uid_to_sid
, METH_VARARGS
,
642 "uid_to_sid(int) -> string\n"
644 "Return the SID for a UNIX uid.\n"
648 ">>> winbind.uid_to_sid(10000) \n"
649 "'S-1-5-21-406022937-1377575209-526660263-500' " },
651 { "gid_to_sid", (PyCFunction
)py_gid_to_sid
, METH_VARARGS
,
652 "gid_to_sid(int) -> string\n"
654 "Return the UNIX gid for a SID.\n"
658 ">>> winbind.gid_to_sid(10001)\n"
659 "'S-1-5-21-406022937-1377575209-526660263-512' " },
661 { "sid_to_uid", (PyCFunction
)py_sid_to_uid
, METH_VARARGS
,
662 "sid_to_uid(string) -> int\n"
664 "Return the UNIX uid for a SID.\n"
668 ">>> winbind.sid_to_uid('S-1-5-21-406022937-1377575209-526660263-500')\n"
671 { "sid_to_gid", (PyCFunction
)py_sid_to_gid
, METH_VARARGS
,
672 "sid_to_gid(string) -> int\n"
674 "Return the UNIX gid corresponding to a SID.\n"
678 ">>> winbind.sid_to_gid('S-1-5-21-406022937-1377575209-526660263-512')\n"
683 { "check_secret", (PyCFunction
)py_check_secret
, METH_VARARGS
,
684 "check_secret() -> int\n"
686 "Check the machine trust account password. The NT status is returned\n"
687 "with zero indicating success. " },
689 { "enum_trust_dom", (PyCFunction
)py_enum_trust_dom
, METH_VARARGS
,
690 "enum_trust_dom() -> list of strings\n"
692 "Return a list of trusted domains. The domain the server is a member \n"
693 "of is not included.\n"
697 ">>> winbind.enum_trust_dom()\n"
698 "['NPSD-TEST2', 'SP2NDOM'] " },
700 /* PAM authorisation functions */
702 { "auth_plaintext", (PyCFunction
)py_auth_plaintext
, METH_VARARGS
,
703 "auth_plaintext(s, s) -> int\n"
705 "Authenticate a username and password using plaintext authentication.\n"
706 "The NT status code is returned with zero indicating success." },
708 { "auth_crap", (PyCFunction
)py_auth_crap
, METH_VARARGS
| METH_KEYWORDS
,
709 "auth_crap(s, s) -> int\n"
711 "Authenticate a username and password using the challenge/response\n"
712 "protocol. The NT status code is returned with zero indicating\n"
715 #if 0 /* Include when smbd_auth merged to HEAD */
717 { "auth_smbd", (PyCFunction
)py_auth_crap
, METH_VARARGS
,
718 "auth_smbd(s, s) -> int\n"
720 "Authenticate a username and password using the challenge/response\n"
721 "protocol but using the domain secret to prove we are root. The NT \n"
722 "status code is returned with zero indicating success." },
729 static struct const_vals
{
733 } module_const_vals
[] = {
735 /* Well known RIDs */
737 { "DOMAIN_USER_RID_ADMIN", DOMAIN_USER_RID_ADMIN
,
738 "Well-known RID for Administrator user" },
740 { "DOMAIN_USER_RID_GUEST", DOMAIN_USER_RID_GUEST
,
741 "Well-known RID for Guest user" },
743 { "DOMAIN_GROUP_RID_ADMINS", DOMAIN_GROUP_RID_ADMINS
,
744 "Well-known RID for Domain Admins group" },
746 { "DOMAIN_GROUP_RID_USERS", DOMAIN_GROUP_RID_USERS
,
747 "Well-known RID for Domain Users group" },
749 { "DOMAIN_GROUP_RID_GUESTS", DOMAIN_GROUP_RID_GUESTS
,
750 "Well-known RID for Domain Guests group" },
755 static void const_init(PyObject
*dict
)
757 struct const_vals
*tmp
;
760 for (tmp
= module_const_vals
; tmp
->name
; tmp
++) {
761 obj
= PyInt_FromLong(tmp
->value
);
762 PyDict_SetItemString(dict
, tmp
->name
, obj
);
768 * Module initialisation
771 static char winbind_module__doc__
[] =
772 "A python extension to winbind client functions.";
774 void initwinbind(void)
776 PyObject
*module
, *dict
;
778 /* Initialise module */
780 module
= Py_InitModule3("winbind", winbind_methods
,
781 winbind_module__doc__
);
783 dict
= PyModule_GetDict(module
);
785 winbind_error
= PyErr_NewException("winbind.error", NULL
, NULL
);
786 PyDict_SetItemString(dict
, "error", winbind_error
);
788 /* Do samba initialisation */
792 /* Initialise constants */
796 /* Insert configuration dictionary */
798 PyDict_SetItemString(dict
, "config", py_config_dict());