?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix trusted users on a DC that uses the old idmap syntax. There was no default backen...
[Samba/bb.git] / source / winbindd / idmap.c
blob10807e6640dc95641ead2cacd1eb76e743727bea
1 /*
2 Unix SMB/CIFS implementation.
3 ID Mapping
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003-2007
7 Copyright (C) Jeremy Allison 2006
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "winbindd.h"
25
26 #undef DBGC_CLASS
27 #define DBGC_CLASS DBGC_IDMAP
28
29 static_decl_idmap;
30
31 struct idmap_backend {
32 const char *name;
33 struct idmap_methods *methods;
34 struct idmap_backend *prev, *next;
35 };
36
37 struct idmap_alloc_backend {
38 const char *name;
39 struct idmap_alloc_methods *methods;
40 struct idmap_alloc_backend *prev, *next;
41 };
42
43 struct idmap_cache_ctx;
44
45 struct idmap_alloc_context {
46 const char *params;
47 struct idmap_alloc_methods *methods;
48 bool initialized;
49 };
50
51 static TALLOC_CTX *idmap_ctx = NULL;
52 static struct idmap_cache_ctx *idmap_cache;
53
54 static struct idmap_backend *backends = NULL;
55 static struct idmap_domain **idmap_domains = NULL;
56 static int num_domains = 0;
57 static int pdb_dom_num = -1;
58 static int def_dom_num = -1;
59
60 static struct idmap_alloc_backend *alloc_backends = NULL;
61 static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
62
63 #define IDMAP_CHECK_RET(ret) do { \
64 if ( ! NT_STATUS_IS_OK(ret)) { \
65 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
66 goto done; \
67 } } while(0)
68 #define IDMAP_REPORT_RET(ret) do { \
69 if ( ! NT_STATUS_IS_OK(ret)) { \
70 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
71 } } while(0)
72 #define IDMAP_CHECK_ALLOC(mem) do { \
73 if (!mem) { \
74 DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; \
75 goto done; \
76 } } while(0)
77
78 static struct idmap_methods *get_methods(struct idmap_backend *be,
79 const char *name)
80 {
81 struct idmap_backend *b;
82
83 for (b = be; b; b = b->next) {
84 if (strequal(b->name, name)) {
85 return b->methods;
86 }
87 }
88
89 return NULL;
90 }
91
92 static struct idmap_alloc_methods *get_alloc_methods(
93 struct idmap_alloc_backend *be,
94 const char *name)
95 {
96 struct idmap_alloc_backend *b;
97
98 for (b = be; b; b = b->next) {
99 if (strequal(b->name, name)) {
100 return b->methods;
101 }
102 }
103
104 return NULL;
105 }
106
107 bool idmap_is_offline(void)
108 {
109 return ( lp_winbind_offline_logon() &&
110 get_global_winbindd_state_offline() );
111 }
112
113 /**********************************************************************
114 Allow a module to register itself as a method.
115 **********************************************************************/
116
117 NTSTATUS smb_register_idmap(int version, const char *name,
118 struct idmap_methods *methods)
119 {
120 struct idmap_methods *test;
121 struct idmap_backend *entry;
122
123 if (!idmap_ctx) {
124 return NT_STATUS_INTERNAL_DB_ERROR;
125 }
126
127 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
128 DEBUG(0, ("Failed to register idmap module.\n"
129 "The module was compiled against "
130 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
131 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
132 "Please recompile against the current version "
133 "of samba!\n",
134 version, SMB_IDMAP_INTERFACE_VERSION));
135 return NT_STATUS_OBJECT_TYPE_MISMATCH;
136 }
137
138 if (!name || !name[0] || !methods) {
139 DEBUG(0,("Called with NULL pointer or empty name!\n"));
140 return NT_STATUS_INVALID_PARAMETER;
141 }
142
143 test = get_methods(backends, name);
144 if (test) {
145 DEBUG(0,("Idmap module %s already registered!\n", name));
146 return NT_STATUS_OBJECT_NAME_COLLISION;
147 }
148
149 entry = talloc(idmap_ctx, struct idmap_backend);
150 if ( ! entry) {
151 DEBUG(0,("Out of memory!\n"));
152 return NT_STATUS_NO_MEMORY;
153 }
154 entry->name = talloc_strdup(idmap_ctx, name);
155 if ( ! entry->name) {
156 DEBUG(0,("Out of memory!\n"));
157 return NT_STATUS_NO_MEMORY;
158 }
159 entry->methods = methods;
160
161 DLIST_ADD(backends, entry);
162 DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
163 return NT_STATUS_OK;
164 }
165
166 /**********************************************************************
167 Allow a module to register itself as a method.
168 **********************************************************************/
169
170 NTSTATUS smb_register_idmap_alloc(int version, const char *name,
171 struct idmap_alloc_methods *methods)
172 {
173 struct idmap_alloc_methods *test;
174 struct idmap_alloc_backend *entry;
175
176 if (!idmap_ctx) {
177 return NT_STATUS_INTERNAL_DB_ERROR;
178 }
179
180 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
181 DEBUG(0, ("Failed to register idmap alloc module.\n"
182 "The module was compiled against "
183 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
184 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
185 "Please recompile against the current version "
186 "of samba!\n",
187 version, SMB_IDMAP_INTERFACE_VERSION));
188 return NT_STATUS_OBJECT_TYPE_MISMATCH;
189 }
190
191 if (!name || !name[0] || !methods) {
192 DEBUG(0,("Called with NULL pointer or empty name!\n"));
193 return NT_STATUS_INVALID_PARAMETER;
194 }
195
196 test = get_alloc_methods(alloc_backends, name);
197 if (test) {
198 DEBUG(0,("idmap_alloc module %s already registered!\n", name));
199 return NT_STATUS_OBJECT_NAME_COLLISION;
200 }
201
202 entry = talloc(idmap_ctx, struct idmap_alloc_backend);
203 if ( ! entry) {
204 DEBUG(0,("Out of memory!\n"));
205 return NT_STATUS_NO_MEMORY;
206 }
207 entry->name = talloc_strdup(idmap_ctx, name);
208 if ( ! entry->name) {
209 DEBUG(0,("Out of memory!\n"));
210 return NT_STATUS_NO_MEMORY;
211 }
212 entry->methods = methods;
213
214 DLIST_ADD(alloc_backends, entry);
215 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
216 return NT_STATUS_OK;
217 }
218
219 static int close_domain_destructor(struct idmap_domain *dom)
220 {
221 NTSTATUS ret;
222
223 ret = dom->methods->close_fn(dom);
224 if (!NT_STATUS_IS_OK(ret)) {
225 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
226 }
227
228 return 0;
229 }
230
231 /**************************************************************************
232 Shutdown.
233 **************************************************************************/
234
235 NTSTATUS idmap_close(void)
236 {
237 /* close the alloc backend first before freeing idmap_ctx */
238 if (idmap_alloc_ctx) {
239 idmap_alloc_ctx->methods->close_fn();
240 idmap_alloc_ctx->methods = NULL;
241 }
242 alloc_backends = NULL;
243
244 /* this talloc_free call will fire the talloc destructors
245 * that will free all active backends resources */
246 TALLOC_FREE(idmap_ctx);
247 idmap_cache = NULL;
248 idmap_domains = NULL;
249 backends = NULL;
250
251 return NT_STATUS_OK;
252 }
253
254 /****************************************************************************
255 ****************************************************************************/
256
257 NTSTATUS idmap_init_cache(void)
258 {
259 /* Always initialize the cache. We'll have to delay initialization
260 of backends if we are offline */
261
262 if ( idmap_ctx ) {
263 return NT_STATUS_OK;
264 }
265
266 if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
267 return NT_STATUS_NO_MEMORY;
268 }
269
270 if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
271 return NT_STATUS_UNSUCCESSFUL;
272 }
273
274 return NT_STATUS_OK;
275 }
276
277 /****************************************************************************
278 ****************************************************************************/
279
280 NTSTATUS idmap_init(void)
281 {
282 NTSTATUS ret;
283 static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
284 struct idmap_domain *dom;
285 char *compat_backend = NULL;
286 char *compat_params = NULL;
287 const char **dom_list = NULL;
288 const char *default_domain = NULL;
289 char *alloc_backend = NULL;
290 bool default_already_defined = False;
291 bool pri_dom_is_in_list = False;
292 int compat = 0;
293 int i;
294
295 ret = idmap_init_cache();
296 if (!NT_STATUS_IS_OK(ret))
297 return ret;
298
299 if (NT_STATUS_IS_OK(idmap_init_status)) {
300 return NT_STATUS_OK;
301 }
302
303 /* We can't reliably call intialization code here unless
304 we are online. But return NT_STATUS_OK so the upper
305 level code doesn't abort idmap lookups. */
306
307 if ( get_global_winbindd_state_offline() ) {
308 idmap_init_status = NT_STATUS_FILE_IS_OFFLINE;
309 return NT_STATUS_OK;
310 }
311
312 static_init_idmap;
313
314 dom_list = lp_idmap_domains();
315
316 if ( lp_idmap_backend() ) {
317 const char **compat_list = lp_idmap_backend();
318 char *p = NULL;
319 const char *q = NULL;
320
321 if ( dom_list ) {
322 DEBUG(0, ("WARNING: idmap backend and idmap domains are"
323 " mutually exclusive!\n"));
324 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
325 } else {
326 compat = 1;
327
328 compat_backend = talloc_strdup(idmap_ctx, *compat_list);
329
330 /* strip any leading idmap_ prefix of */
331 if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
332 q = *compat_list += 6;
333 DEBUG(0, ("WARNING: idmap backend uses obsolete"
334 " and deprecated 'idmap_' prefix.\n"
335 "Please replace 'idmap_%s' by '%s' in"
336 " %s\n", q, q, get_dyn_CONFIGFILE()));
337 compat_backend = talloc_strdup(idmap_ctx, q);
338 } else {
339 compat_backend = talloc_strdup(idmap_ctx,
340 *compat_list);
341 }
342
343 if (compat_backend == NULL ) {
344 ret = NT_STATUS_NO_MEMORY;
345 goto done;
346 }
347
348 /* separate the backend and module arguements */
349 if ((p = strchr(compat_backend, ':')) != NULL) {
350 *p = '\0';
351 compat_params = p + 1;
352 }
353 }
354 } else if ( !dom_list ) {
355 /* Back compatible: without idmap domains and explicit
356 idmap backend. Taking default idmap backend: tdb */
357
358 compat = 1;
359 compat_backend = talloc_strdup( idmap_ctx, "tdb");
360 compat_params = compat_backend;
361 }
362
363 if ( ! dom_list) {
364 /* generate a list with our main domain */
365 const char ** dl;
366
367 dl = talloc_array(idmap_ctx, const char *, 2);
368 if (dl == NULL) {
369 ret = NT_STATUS_NO_MEMORY;
370 goto done;
371 }
372 dl[0] = talloc_strdup(dl, lp_workgroup());
373 if (dl[0] == NULL) {
374 ret = NT_STATUS_NO_MEMORY;
375 goto done;
376 }
377
378 /* terminate */
379 dl[1] = NULL;
380
381 dom_list = dl;
382 default_domain = dl[0];
383 }
384
385 /***************************
386 * initialize idmap domains
387 */
388 DEBUG(1, ("Initializing idmap domains\n"));
389
390 for (i=0, num_domains=0; dom_list[i]; i++) {
391 const char *parm_backend;
392 char *config_option;
393
394 /* ignore BUILTIN and local MACHINE domains */
395 if (strequal(dom_list[i], "BUILTIN")
396 || strequal(dom_list[i], get_global_sam_name()))
397 {
398 DEBUG(0,("idmap_init: Ignoring domain %s\n",
399 dom_list[i]));
400 continue;
401 }
402
403 if ((dom_list[i] != default_domain) &&
404 strequal(dom_list[i], lp_workgroup())) {
405 pri_dom_is_in_list = True;
406 }
407 /* init domain */
408
409 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
410 IDMAP_CHECK_ALLOC(dom);
411
412 dom->name = talloc_strdup(dom, dom_list[i]);
413 IDMAP_CHECK_ALLOC(dom->name);
414
415 config_option = talloc_asprintf(dom, "idmap config %s",
416 dom->name);
417 IDMAP_CHECK_ALLOC(config_option);
418
419 /* default or specific ? */
420
421 dom->default_domain = lp_parm_bool(-1, config_option,
422 "default", False);
423
424 if (dom->default_domain ||
425 (default_domain && strequal(dom_list[i], default_domain))) {
426
427 /* make sure this is set even when we match
428 * default_domain */
429 dom->default_domain = True;
430
431 if (default_already_defined) {
432 DEBUG(1, ("ERROR: Multiple domains defined as"
433 " default!\n"));
434 ret = NT_STATUS_INVALID_PARAMETER;
435 goto done;
436 }
437
438 default_already_defined = True;
439
440 }
441
442 dom->readonly = lp_parm_bool(-1, config_option,
443 "readonly", False);
444
445 /* find associated backend (default: tdb) */
446 if (compat) {
447 parm_backend = talloc_strdup(idmap_ctx, compat_backend);
448 } else {
449 parm_backend = talloc_strdup(idmap_ctx,
450 lp_parm_const_string(
451 -1, config_option,
452 "backend", "tdb"));
453 }
454 IDMAP_CHECK_ALLOC(parm_backend);
455
456 /* get the backend methods for this domain */
457 dom->methods = get_methods(backends, parm_backend);
458
459 if ( ! dom->methods) {
460 ret = smb_probe_module("idmap", parm_backend);
461 if (NT_STATUS_IS_OK(ret)) {
462 dom->methods = get_methods(backends,
463 parm_backend);
464 }
465 }
466 if ( ! dom->methods) {
467 DEBUG(0, ("ERROR: Could not get methods for "
468 "backend %s\n", parm_backend));
469 ret = NT_STATUS_UNSUCCESSFUL;
470 goto done;
471 }
472
473 /* check the set_mapping function exists otherwise mark the
474 * module as readonly */
475 if ( ! dom->methods->set_mapping) {
476 DEBUG(5, ("Forcing to readonly, as this module can't"
477 " store arbitrary mappings.\n"));
478 dom->readonly = True;
479 }
480
481 /* now that we have methods,
482 * set the destructor for this domain */
483 talloc_set_destructor(dom, close_domain_destructor);
484
485 if (compat_params) {
486 dom->params = talloc_strdup(dom, compat_params);
487 IDMAP_CHECK_ALLOC(dom->params);
488 } else {
489 dom->params = NULL;
490 }
491
492 /* Finally instance a backend copy for this domain */
493 ret = dom->methods->init(dom);
494 if ( ! NT_STATUS_IS_OK(ret)) {
495 DEBUG(0, ("ERROR: Initialization failed for backend "
496 "%s (domain %s), deferred!\n",
497 parm_backend, dom->name));
498 }
499 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
500 struct idmap_domain *, i+1);
501 if ( ! idmap_domains) {
502 DEBUG(0, ("Out of memory!\n"));
503 ret = NT_STATUS_NO_MEMORY;
504 goto done;
505 }
506 idmap_domains[num_domains] = dom;
507
508 /* save default domain position for future uses */
509 if (dom->default_domain) {
510 def_dom_num = num_domains;
511 }
512
513 /* Bump counter to next available slot */
514
515 num_domains++;
516
517 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
518 dom->name, parm_backend,
519 dom->default_domain?"":"not ",
520 dom->readonly?"":"not "));
521
522 talloc_free(config_option);
523 }
524
525 /* on DCs we need to add idmap_tdb as the default backend if compat is
526 * defined (when the old implicit configuration is used)
527 * This is not done in the previous loop a on member server we exclude
528 * the local domain. But on a DC the local domain is the only domain
529 * available therefore we are left with no default domain */
530 if (((lp_server_role() == ROLE_DOMAIN_PDC) ||
531 (lp_server_role() == ROLE_DOMAIN_BDC)) &&
532 ((num_domains == 0) && (compat == 1))) {
533
534 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
535 IDMAP_CHECK_ALLOC(dom);
536
537 dom->name = talloc_strdup(dom, "__default__");
538 IDMAP_CHECK_ALLOC(dom->name);
539
540 dom->default_domain = True;
541 dom->readonly = False;
542
543 /* get the backend methods for this domain */
544 dom->methods = get_methods(backends, compat_backend);
545
546 if ( ! dom->methods) {
547 ret = smb_probe_module("idmap", compat_backend);
548 if (NT_STATUS_IS_OK(ret)) {
549 dom->methods = get_methods(backends,
550 compat_backend);
551 }
552 }
553 if ( ! dom->methods) {
554 DEBUG(0, ("ERROR: Could not get methods for "
555 "backend %s\n", compat_backend));
556 ret = NT_STATUS_UNSUCCESSFUL;
557 goto done;
558 }
559
560 /* now that we have methods,
561 * set the destructor for this domain */
562 talloc_set_destructor(dom, close_domain_destructor);
563
564 dom->params = talloc_strdup(dom, compat_params);
565 IDMAP_CHECK_ALLOC(dom->params);
566
567 /* Finally instance a backend copy for this domain */
568 ret = dom->methods->init(dom);
569 if ( ! NT_STATUS_IS_OK(ret)) {
570 DEBUG(0, ("ERROR: Initialization failed for backend "
571 "%s (domain %s), deferred!\n",
572 compat_backend, dom->name));
573 }
574 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
575 struct idmap_domain *, 2);
576 if ( ! idmap_domains) {
577 DEBUG(0, ("Out of memory!\n"));
578 ret = NT_STATUS_NO_MEMORY;
579 goto done;
580 }
581 idmap_domains[num_domains] = dom;
582
583 def_dom_num = num_domains;
584
585 /* Bump counter to next available slot */
586
587 num_domains++;
588
589 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
590 dom->name, compat_backend,
591 dom->default_domain?"":"not ",
592 dom->readonly?"":"not "));
593 }
594
595 /* automatically add idmap_nss backend if needed */
596 if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
597 ( ! pri_dom_is_in_list) &&
598 lp_winbind_trusted_domains_only()) {
599
600 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
601 IDMAP_CHECK_ALLOC(dom);
602
603 dom->name = talloc_strdup(dom, lp_workgroup());
604 IDMAP_CHECK_ALLOC(dom->name);
605
606 dom->default_domain = False;
607 dom->readonly = True;
608
609 /* get the backend methods for passdb */
610 dom->methods = get_methods(backends, "nss");
611
612 /* (the nss module is always statically linked) */
613 if ( ! dom->methods) {
614 DEBUG(0, ("ERROR: No methods for idmap_nss ?!\n"));
615 ret = NT_STATUS_UNSUCCESSFUL;
616 goto done;
617 }
618
619 /* now that we have methods,
620 * set the destructor for this domain */
621 talloc_set_destructor(dom, close_domain_destructor);
622
623 if (compat_params) {
624 dom->params = talloc_strdup(dom, compat_params);
625 IDMAP_CHECK_ALLOC(dom->params);
626 } else {
627 dom->params = NULL;
628 }
629
630 /* Finally instance a backend copy for this domain */
631 ret = dom->methods->init(dom);
632 if ( ! NT_STATUS_IS_OK(ret)) {
633 DEBUG(0, ("ERROR: Init. failed for idmap_nss ?!\n"));
634 ret = NT_STATUS_UNSUCCESSFUL;
635 goto done;
636 }
637
638 idmap_domains = talloc_realloc(idmap_ctx,
639 idmap_domains,
640 struct idmap_domain *,
641 num_domains+1);
642 if ( ! idmap_domains) {
643 DEBUG(0, ("Out of memory!\n"));
644 ret = NT_STATUS_NO_MEMORY;
645 goto done;
646 }
647 idmap_domains[num_domains] = dom;
648
649 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n",
650 dom->name ));
651
652 num_domains++;
653 }
654
655 /**** automatically add idmap_passdb backend ****/
656 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
657 IDMAP_CHECK_ALLOC(dom);
658
659 dom->name = talloc_strdup(dom, get_global_sam_name());
660 IDMAP_CHECK_ALLOC(dom->name);
661
662 dom->default_domain = False;
663 dom->readonly = True;
664
665 /* get the backend methods for passdb */
666 dom->methods = get_methods(backends, "passdb");
667
668 /* (the passdb module is always statically linked) */
669 if ( ! dom->methods) {
670 DEBUG(0, ("ERROR: No methods for idmap_passdb ?!\n"));
671 ret = NT_STATUS_UNSUCCESSFUL;
672 goto done;
673 }
674
675 /* now that we have methods, set the destructor for this domain */
676 talloc_set_destructor(dom, close_domain_destructor);
677
678 if (compat_params) {
679 dom->params = talloc_strdup(dom, compat_params);
680 IDMAP_CHECK_ALLOC(dom->params);
681 } else {
682 dom->params = NULL;
683 }
684
685 /* Finally instance a backend copy for this domain */
686 ret = dom->methods->init(dom);
687 if ( ! NT_STATUS_IS_OK(ret)) {
688 DEBUG(0, ("ERROR: Init. failed for idmap_passdb ?!\n"));
689 ret = NT_STATUS_UNSUCCESSFUL;
690 goto done;
691 }
692
693 idmap_domains = talloc_realloc(idmap_ctx,
694 idmap_domains,
695 struct idmap_domain *,
696 num_domains+1);
697 if ( ! idmap_domains) {
698 DEBUG(0, ("Out of memory!\n"));
699 ret = NT_STATUS_NO_MEMORY;
700 goto done;
701 }
702 idmap_domains[num_domains] = dom;
703
704 /* needed to handle special BUILTIN and wellknown SIDs cases */
705 pdb_dom_num = num_domains;
706
707 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n",
708 dom->name));
709
710 num_domains++;
711 /**** finished adding idmap_passdb backend ****/
712
713 /* sort domains so that the default is the last one */
714 /* don't sort if no default domain defined */
715 if (def_dom_num != -1 && def_dom_num != num_domains-1) {
716 /* default is not last, move it */
717 struct idmap_domain *tmp;
718
719 if (pdb_dom_num > def_dom_num) {
720 pdb_dom_num --;
721
722 } else if (pdb_dom_num == def_dom_num) { /* ?? */
723 pdb_dom_num = num_domains - 1;
724 }
725
726 tmp = idmap_domains[def_dom_num];
727
728 for (i = def_dom_num; i < num_domains-1; i++) {
729 idmap_domains[i] = idmap_domains[i+1];
730 }
731 idmap_domains[i] = tmp;
732 def_dom_num = i;
733 }
734
735
736 /* Initialize alloc module */
737
738 DEBUG(3, ("Initializing idmap alloc module\n"));
739
740 alloc_backend = NULL;
741 if (compat) {
742 alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
743 } else {
744 char *ab = lp_idmap_alloc_backend();
745
746 if (ab && (ab[0] != '\0')) {
747 alloc_backend = talloc_strdup(idmap_ctx,
748 lp_idmap_alloc_backend());
749 }
750 }
751
752 if ( alloc_backend ) {
753
754 idmap_alloc_ctx = TALLOC_ZERO_P(idmap_ctx,
755 struct idmap_alloc_context);
756 IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
757
758 idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends,
759 alloc_backend);
760 if ( ! idmap_alloc_ctx->methods) {
761 ret = smb_probe_module("idmap", alloc_backend);
762 if (NT_STATUS_IS_OK(ret)) {
763 idmap_alloc_ctx->methods =
764 get_alloc_methods(alloc_backends,
765 alloc_backend);
766 }
767 }
768 if (idmap_alloc_ctx->methods) {
769
770 if (compat_params) {
771 idmap_alloc_ctx->params =
772 talloc_strdup(idmap_alloc_ctx,
773 compat_params);
774 IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
775 } else {
776 idmap_alloc_ctx->params = NULL;
777 }
778
779 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
780 if ( ! NT_STATUS_IS_OK(ret)) {
781 DEBUG(0, ("ERROR: Initialization failed for "
782 "alloc backend %s, deferred!\n",
783 alloc_backend));
784 } else {
785 idmap_alloc_ctx->initialized = True;
786 }
787 } else {
788 DEBUG(2, ("idmap_init: Unable to get methods for "
789 "alloc backend %s\n",
790 alloc_backend));
791 /* certain compat backends are just readonly */
792 if ( compat ) {
793 TALLOC_FREE(idmap_alloc_ctx);
794 ret = NT_STATUS_OK;
795 } else {
796 ret = NT_STATUS_UNSUCCESSFUL;
797 }
798 }
799 }
800
801 /* cleanpu temporary strings */
802 TALLOC_FREE( compat_backend );
803
804 idmap_init_status = NT_STATUS_OK;
805
806 return ret;
807
808 done:
809 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
810 idmap_close();
811
812 return ret;
813 }
814
815 static NTSTATUS idmap_alloc_init(void)
816 {
817 NTSTATUS ret;
818
819 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
820 return ret;
821 }
822
823 if ( ! idmap_alloc_ctx) {
824 return NT_STATUS_NOT_SUPPORTED;
825 }
826
827 if ( ! idmap_alloc_ctx->initialized) {
828 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
829 if ( ! NT_STATUS_IS_OK(ret)) {
830 DEBUG(0, ("ERROR: Initialization failed for alloc "
831 "backend, deferred!\n"));
832 return ret;
833 } else {
834 idmap_alloc_ctx->initialized = True;
835 }
836 }
837
838 return NT_STATUS_OK;
839 }
840
841 /**************************************************************************
842 idmap allocator interface functions
843 **************************************************************************/
844
845 NTSTATUS idmap_allocate_uid(struct unixid *id)
846 {
847 NTSTATUS ret;
848
849 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
850 return ret;
851 }
852
853 id->type = ID_TYPE_UID;
854 return idmap_alloc_ctx->methods->allocate_id(id);
855 }
856
857 NTSTATUS idmap_allocate_gid(struct unixid *id)
858 {
859 NTSTATUS ret;
860
861 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
862 return ret;
863 }
864
865 id->type = ID_TYPE_GID;
866 return idmap_alloc_ctx->methods->allocate_id(id);
867 }
868
869 NTSTATUS idmap_set_uid_hwm(struct unixid *id)
870 {
871 NTSTATUS ret;
872
873 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
874 return ret;
875 }
876
877 id->type = ID_TYPE_UID;
878 return idmap_alloc_ctx->methods->set_id_hwm(id);
879 }
880
881 NTSTATUS idmap_set_gid_hwm(struct unixid *id)
882 {
883 NTSTATUS ret;
884
885 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
886 return ret;
887 }
888
889 id->type = ID_TYPE_GID;
890 return idmap_alloc_ctx->methods->set_id_hwm(id);
891 }
892
893 /******************************************************************************
894 Lookup an idmap_domain give a full user or group SID
895 ******************************************************************************/
896
897 static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
898 {
899 DOM_SID domain_sid;
900 uint32 rid;
901 struct winbindd_domain *domain = NULL;
902 int i;
903
904 /* 1. Handle BUILTIN or Special SIDs and prevent them from
905 falling into the default domain space (if we have a
906 configured passdb backend. */
907
908 if ( (pdb_dom_num != -1) &&
909 (sid_check_is_in_builtin(account_sid) ||
910 sid_check_is_in_wellknown_domain(account_sid) ||
911 sid_check_is_in_unix_groups(account_sid) ||
912 sid_check_is_in_unix_users(account_sid)) )
913 {
914 return idmap_domains[pdb_dom_num];
915 }
916
917 /* 2. Lookup the winbindd_domain from the account_sid */
918
919 sid_copy( &domain_sid, account_sid );
920 sid_split_rid( &domain_sid, &rid );
921 domain = find_domain_from_sid_noinit( &domain_sid );
922
923 for (i = 0; domain && i < num_domains; i++) {
924 if ( strequal( idmap_domains[i]->name, domain->name ) ) {
925 return idmap_domains[i];
926 }
927 }
928
929 /* 3. Fall back to the default domain */
930
931 if ( def_dom_num != -1 ) {
932 return idmap_domains[def_dom_num];
933 }
934
935 return NULL;
936 }
937
938 /******************************************************************************
939 Lookup an index given an idmap_domain pointer
940 ******************************************************************************/
941
942 static uint32 find_idmap_domain_index( struct idmap_domain *id_domain)
943 {
944 int i;
945
946 for (i = 0; i < num_domains; i++) {
947 if ( idmap_domains[i] == id_domain )
948 return i;
949 }
950
951 return -1;
952 }
953
954
955 /*********************************************************
956 Check if creating a mapping is permitted for the domain
957 *********************************************************/
958
959 static NTSTATUS idmap_can_map(const struct id_map *map,
960 struct idmap_domain **ret_dom)
961 {
962 struct idmap_domain *dom;
963
964 /* Check we do not create mappings for our own local domain,
965 * or BUILTIN or special SIDs */
966 if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
967 sid_check_is_in_builtin(map->sid) ||
968 sid_check_is_in_wellknown_domain(map->sid) ||
969 sid_check_is_in_unix_users(map->sid) ||
970 sid_check_is_in_unix_groups(map->sid) )
971 {
972 DEBUG(10, ("We are not supposed to create mappings for our own "
973 "domains (local, builtin, specials)\n"));
974 return NT_STATUS_UNSUCCESSFUL;
975 }
976
977 /* Special check for trusted domain only = Yes */
978 if (lp_winbind_trusted_domains_only()) {
979 struct winbindd_domain *wdom = find_our_domain();
980 if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
981 DEBUG(10, ("We are not supposed to create mappings for "
982 "our primary domain when <trusted domain "
983 "only> is True\n"));
984 DEBUGADD(10, ("Leave [%s] unmapped\n",
985 sid_string_dbg(map->sid)));
986 return NT_STATUS_UNSUCCESSFUL;
987 }
988 }
989
990 if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
991 /* huh, couldn't find a suitable domain,
992 * let's just leave it unmapped */
993 DEBUG(10, ("Could not find idmap backend for SID %s\n",
994 sid_string_dbg(map->sid)));
995 return NT_STATUS_NO_SUCH_DOMAIN;
996 }
997
998 if (dom->readonly) {
999 /* ouch the domain is read only,
1000 * let's just leave it unmapped */
1001 DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
1002 sid_string_dbg(map->sid)));
1003 return NT_STATUS_UNSUCCESSFUL;
1004 }
1005
1006 *ret_dom = dom;
1007 return NT_STATUS_OK;
1008 }
1009
1010 static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
1011 {
1012 NTSTATUS ret;
1013 struct idmap_domain *dom;
1014
1015 /* If we are offline we cannot lookup SIDs, deny mapping */
1016 if (idmap_is_offline()) {
1017 return NT_STATUS_FILE_IS_OFFLINE;
1018 }
1019
1020 ret = idmap_can_map(map, &dom);
1021 if ( ! NT_STATUS_IS_OK(ret)) {
1022 return NT_STATUS_NONE_MAPPED;
1023 }
1024
1025 /* check if this is a valid SID and then map it */
1026 switch (map->xid.type) {
1027 case ID_TYPE_UID:
1028 ret = idmap_allocate_uid(&map->xid);
1029 if ( ! NT_STATUS_IS_OK(ret)) {
1030 /* can't allocate id, let's just leave it unmapped */
1031 DEBUG(2, ("uid allocation failed! "
1032 "Can't create mapping\n"));
1033 return NT_STATUS_NONE_MAPPED;
1034 }
1035 break;
1036 case ID_TYPE_GID:
1037 ret = idmap_allocate_gid(&map->xid);
1038 if ( ! NT_STATUS_IS_OK(ret)) {
1039 /* can't allocate id, let's just leave it unmapped */
1040 DEBUG(2, ("gid allocation failed! "
1041 "Can't create mapping\n"));
1042 return NT_STATUS_NONE_MAPPED;
1043 }
1044 break;
1045 default:
1046 /* invalid sid, let's just leave it unmapped */
1047 DEBUG(3,("idmap_new_mapping: Refusing to create a "
1048 "mapping for an unspecified ID type.\n"));
1049 return NT_STATUS_NONE_MAPPED;
1050 }
1051
1052 /* ok, got a new id, let's set a mapping */
1053 map->status = ID_MAPPED;
1054
1055 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
1056 sid_string_dbg(map->sid),
1057 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
1058 (unsigned long)map->xid.id));
1059 ret = dom->methods->set_mapping(dom, map);
1060
1061 if ( ! NT_STATUS_IS_OK(ret)) {
1062 /* something wrong here :-( */
1063 DEBUG(2, ("Failed to commit mapping\n!"));
1064
1065 /* TODO: would it make sense to have an "unalloc_id function?" */
1066
1067 return NT_STATUS_NONE_MAPPED;
1068 }
1069
1070 return NT_STATUS_OK;
1071 }
1072
1073 static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
1074 {
1075 struct idmap_domain *dom;
1076 NTSTATUS ret;
1077
1078 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
1079 sid_string_dbg(map->sid),
1080 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
1081 (unsigned long)map->xid.id));
1082
1083 ret = idmap_can_map(map, &dom);
1084 if ( ! NT_STATUS_IS_OK(ret)) {
1085 return ret;
1086 }
1087
1088 DEBUG(10,("set_mapping for domain %s\n", dom->name ));
1089
1090 return dom->methods->set_mapping(dom, map);
1091 }
1092
1093 static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
1094 {
1095 struct idmap_domain *dom;
1096 struct id_map **unmapped;
1097 struct id_map **_ids;
1098 TALLOC_CTX *ctx;
1099 NTSTATUS ret;
1100 int i, u, n;
1101
1102 if (!ids || !*ids) {
1103 DEBUG(1, ("Invalid list of maps\n"));
1104 return NT_STATUS_INVALID_PARAMETER;
1105 }
1106
1107 ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
1108 if ( ! ctx) {
1109 DEBUG(0, ("Out of memory!\n"));
1110 return NT_STATUS_NO_MEMORY;
1111 }
1112
1113 DEBUG(10, ("Query backends to map ids->sids\n"));
1114
1115 /* start from the default (the last one) and then if there are still
1116 * unmapped entries cycle through the others */
1117
1118 _ids = ids;
1119
1120 unmapped = NULL;
1121 for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
1122
1123 dom = idmap_domains[n];
1124
1125 DEBUG(10, ("Query sids from domain %s\n", dom->name));
1126
1127 ret = dom->methods->unixids_to_sids(dom, _ids);
1128 IDMAP_REPORT_RET(ret);
1129
1130 unmapped = NULL;
1131
1132 for (i = 0, u = 0; _ids[i]; i++) {
1133 if (_ids[i]->status != ID_MAPPED) {
1134 unmapped = talloc_realloc(ctx, unmapped,
1135 struct id_map *, u + 2);
1136 IDMAP_CHECK_ALLOC(unmapped);
1137 unmapped[u] = _ids[i];
1138 u++;
1139 }
1140 }
1141 if (unmapped) {
1142 /* terminate the unmapped list */
1143 unmapped[u] = NULL;
1144 } else { /* no more entries, get out */
1145 break;
1146 }
1147
1148 _ids = unmapped;
1149
1150 }
1151
1152 if (unmapped) {
1153 /* there are still unmapped ids,
1154 * map them to the unix users/groups domains */
1155 /* except for expired entries,
1156 * these will be returned as valid (offline mode) */
1157 for (i = 0; unmapped[i]; i++) {
1158 if (unmapped[i]->status == ID_EXPIRED) continue;
1159 switch (unmapped[i]->xid.type) {
1160 case ID_TYPE_UID:
1161 uid_to_unix_users_sid(
1162 (uid_t)unmapped[i]->xid.id,
1163 unmapped[i]->sid);
1164 unmapped[i]->status = ID_MAPPED;
1165 break;
1166 case ID_TYPE_GID:
1167 gid_to_unix_groups_sid(
1168 (gid_t)unmapped[i]->xid.id,
1169 unmapped[i]->sid);
1170 unmapped[i]->status = ID_MAPPED;
1171 break;
1172 default: /* what?! */
1173 unmapped[i]->status = ID_UNKNOWN;
1174 break;
1175 }
1176 }
1177 }
1178
1179 ret = NT_STATUS_OK;
1180
1181 done:
1182 talloc_free(ctx);
1183 return ret;
1184 }
1185
1186 static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
1187 {
1188 struct id_map ***dom_ids;
1189 struct idmap_domain *dom;
1190 TALLOC_CTX *ctx;
1191 NTSTATUS ret;
1192 int i, *counters;
1193
1194 if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
1195 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1196 return NT_STATUS_NO_MEMORY;
1197 }
1198
1199 DEBUG(10, ("Query backends to map sids->ids\n"));
1200
1201 /* split list per domain */
1202 if (num_domains == 0) {
1203 DEBUG(1, ("No domains available?\n"));
1204 return NT_STATUS_UNSUCCESSFUL;
1205 }
1206
1207 dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
1208 IDMAP_CHECK_ALLOC(dom_ids);
1209 counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
1210 IDMAP_CHECK_ALLOC(counters);
1211
1212 /* partition the requests by domain */
1213
1214 for (i = 0; ids[i]; i++) {
1215 uint32 idx;
1216
1217 if ((dom = find_idmap_domain_from_sid(ids[i]->sid)) == NULL) {
1218 /* no available idmap_domain. Move on */
1219 continue;
1220 }
1221
1222 DEBUG(10,("SID %s is being handled by %s\n",
1223 sid_string_dbg(ids[i]->sid),
1224 dom ? dom->name : "none" ));
1225
1226 idx = find_idmap_domain_index( dom );
1227 SMB_ASSERT( idx != -1 );
1228
1229 dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
1230 struct id_map *,
1231 counters[idx] + 2);
1232 IDMAP_CHECK_ALLOC(dom_ids[idx]);
1233
1234 dom_ids[idx][counters[idx]] = ids[i];
1235 counters[idx]++;
1236 dom_ids[idx][counters[idx]] = NULL;
1237 }
1238
1239 /* All the ids have been dispatched in the right queues.
1240 Let's cycle through the filled ones */
1241
1242 for (i = 0; i < num_domains; i++) {
1243 if (dom_ids[i]) {
1244 dom = idmap_domains[i];
1245 DEBUG(10, ("Query ids from domain %s\n", dom->name));
1246 ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
1247 IDMAP_REPORT_RET(ret);
1248 }
1249 }
1250
1251 /* ok all the backends have been contacted at this point */
1252 /* let's see if we have any unmapped SID left and act accordingly */
1253
1254 for (i = 0; ids[i]; i++) {
1255 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1256 * was not able to confirm/deny (offline mode) */
1257 if (ids[i]->status == ID_UNKNOWN ||
1258 ids[i]->status == ID_UNMAPPED) {
1259 /* ok this is an unmapped one, see if we can map it */
1260 ret = idmap_new_mapping(ctx, ids[i]);
1261 if (NT_STATUS_IS_OK(ret)) {
1262 /* successfully mapped */
1263 ids[i]->status = ID_MAPPED;
1264 } else
1265 if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
1266 /* could not map it */
1267 ids[i]->status = ID_UNMAPPED;
1268 } else {
1269 /* Something very bad happened down there
1270 * OR we are offline */
1271 ids[i]->status = ID_UNKNOWN;
1272 }
1273 }
1274 }
1275
1276 ret = NT_STATUS_OK;
1277
1278 done:
1279 talloc_free(ctx);
1280 return ret;
1281 }
1282
1283 /**************************************************************************
1284 idmap interface functions
1285 **************************************************************************/
1286
1287 NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
1288 {
1289 TALLOC_CTX *ctx;
1290 NTSTATUS ret;
1291 struct id_map **bids;
1292 int i, bi;
1293 int bn = 0;
1294 struct winbindd_domain *our_domain = find_our_domain();
1295
1296 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1297 return ret;
1298 }
1299
1300 if (!ids || !*ids) {
1301 DEBUG(1, ("Invalid list of maps\n"));
1302 return NT_STATUS_INVALID_PARAMETER;
1303 }
1304
1305 ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
1306 if ( ! ctx) {
1307 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1308 return NT_STATUS_NO_MEMORY;
1309 }
1310
1311 /* no ids to be asked to the backends by default */
1312 bids = NULL;
1313 bi = 0;
1314
1315 for (i = 0; ids[i]; i++) {
1316
1317 if ( ! ids[i]->sid) {
1318 DEBUG(1, ("invalid null SID in id_map array"));
1319 talloc_free(ctx);
1320 return NT_STATUS_INVALID_PARAMETER;
1321 }
1322
1323 ret = idmap_cache_map_id(idmap_cache, ids[i]);
1324
1325 if ( ! NT_STATUS_IS_OK(ret)) {
1326
1327 if ( ! bids) {
1328 /* alloc space for ids to be resolved by
1329 * backends (realloc ten by ten) */
1330 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1331 if ( ! bids) {
1332 DEBUG(1, ("Out of memory!\n"));
1333 talloc_free(ctx);
1334 return NT_STATUS_NO_MEMORY;
1335 }
1336 bn = 10;
1337 }
1338
1339 /* add this id to the ones to be retrieved
1340 * from the backends */
1341 bids[bi] = ids[i];
1342 bi++;
1343
1344 /* check if we need to allocate new space
1345 * on the rids array */
1346 if (bi == bn) {
1347 bn += 10;
1348 bids = talloc_realloc(ctx, bids,
1349 struct id_map *, bn);
1350 if ( ! bids) {
1351 DEBUG(1, ("Out of memory!\n"));
1352 talloc_free(ctx);
1353 return NT_STATUS_NO_MEMORY;
1354 }
1355 }
1356
1357 /* make sure the last element is NULL */
1358 bids[bi] = NULL;
1359 }
1360 }
1361
1362 /* let's see if there is any id mapping to be retieved
1363 * from the backends */
1364 if (bi) {
1365 /* Only do query if we are online */
1366 if ( IS_DOMAIN_OFFLINE(our_domain) ) {
1367 ret = NT_STATUS_FILE_IS_OFFLINE;
1368 goto done;
1369 }
1370
1371 ret = idmap_backends_unixids_to_sids(bids);
1372 IDMAP_CHECK_RET(ret);
1373
1374 /* update the cache */
1375 for (i = 0; i < bi; i++) {
1376 if (bids[i]->status == ID_MAPPED) {
1377 ret = idmap_cache_set(idmap_cache, bids[i]);
1378 } else if (bids[i]->status == ID_EXPIRED) {
1379 /* the cache returned an expired entry and the
1380 * backend was not able to clear the situation
1381 * (offline). This handles a previous
1382 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1383 * for disconnected mode, */
1384 bids[i]->status = ID_MAPPED;
1385 } else if (bids[i]->status == ID_UNKNOWN) {
1386 /* something bad here. We were not able to
1387 * handle this for some reason, mark it as
1388 * unmapped and hope next time things will
1389 * settle down. */
1390 bids[i]->status = ID_UNMAPPED;
1391 } else { /* unmapped */
1392 ret = idmap_cache_set_negative_id(idmap_cache,
1393 bids[i]);
1394 }
1395 IDMAP_CHECK_RET(ret);
1396 }
1397 }
1398
1399 ret = NT_STATUS_OK;
1400 done:
1401 talloc_free(ctx);
1402 return ret;
1403 }
1404
1405 NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
1406 {
1407 TALLOC_CTX *ctx;
1408 NTSTATUS ret;
1409 struct id_map **bids;
1410 int i, bi;
1411 int bn = 0;
1412 struct winbindd_domain *our_domain = find_our_domain();
1413
1414 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1415 return ret;
1416 }
1417
1418 if (!ids || !*ids) {
1419 DEBUG(1, ("Invalid list of maps\n"));
1420 return NT_STATUS_INVALID_PARAMETER;
1421 }
1422
1423 ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
1424 if ( ! ctx) {
1425 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1426 return NT_STATUS_NO_MEMORY;
1427 }
1428
1429 /* no ids to be asked to the backends by default */
1430 bids = NULL;
1431 bi = 0;
1432
1433 for (i = 0; ids[i]; i++) {
1434
1435 if ( ! ids[i]->sid) {
1436 DEBUG(1, ("invalid null SID in id_map array\n"));
1437 talloc_free(ctx);
1438 return NT_STATUS_INVALID_PARAMETER;
1439 }
1440
1441 ret = idmap_cache_map_sid(idmap_cache, ids[i]);
1442
1443 if ( ! NT_STATUS_IS_OK(ret)) {
1444
1445 if ( ! bids) {
1446 /* alloc space for ids to be resolved
1447 by backends (realloc ten by ten) */
1448 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1449 if ( ! bids) {
1450 DEBUG(1, ("Out of memory!\n"));
1451 talloc_free(ctx);
1452 return NT_STATUS_NO_MEMORY;
1453 }
1454 bn = 10;
1455 }
1456
1457 /* add this id to the ones to be retrieved
1458 * from the backends */
1459 bids[bi] = ids[i];
1460 bi++;
1461
1462 /* check if we need to allocate new space
1463 * on the ids array */
1464 if (bi == bn) {
1465 bn += 10;
1466 bids = talloc_realloc(ctx, bids,
1467 struct id_map *, bn);
1468 if ( ! bids) {
1469 DEBUG(1, ("Out of memory!\n"));
1470 talloc_free(ctx);
1471 return NT_STATUS_NO_MEMORY;
1472 }
1473 }
1474
1475 /* make sure the last element is NULL */
1476 bids[bi] = NULL;
1477 }
1478 }
1479
1480 /* let's see if there is any id mapping to be retieved
1481 * from the backends */
1482 if (bids) {
1483 /* Only do query if we are online */
1484 if ( IS_DOMAIN_OFFLINE(our_domain) ) {
1485 ret = NT_STATUS_FILE_IS_OFFLINE;
1486 goto done;
1487 }
1488
1489 ret = idmap_backends_sids_to_unixids(bids);
1490 IDMAP_CHECK_RET(ret);
1491
1492 /* update the cache */
1493 for (i = 0; bids[i]; i++) {
1494 if (bids[i]->status == ID_MAPPED) {
1495 ret = idmap_cache_set(idmap_cache, bids[i]);
1496 } else if (bids[i]->status == ID_EXPIRED) {
1497 /* the cache returned an expired entry and the
1498 * backend was not able to clear the situation
1499 * (offline). This handles a previous
1500 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1501 * for disconnected mode, */
1502 bids[i]->status = ID_MAPPED;
1503 } else if (bids[i]->status == ID_UNKNOWN) {
1504 /* something bad here. We were not able to
1505 * handle this for some reason, mark it as
1506 * unmapped and hope next time things will
1507 * settle down. */
1508 bids[i]->status = ID_UNMAPPED;
1509 } else { /* unmapped */
1510 ret = idmap_cache_set_negative_sid(idmap_cache,
1511 bids[i]);
1512 }
1513 IDMAP_CHECK_RET(ret);
1514 }
1515 }
1516
1517 ret = NT_STATUS_OK;
1518 done:
1519 talloc_free(ctx);
1520 return ret;
1521 }
1522
1523 NTSTATUS idmap_set_mapping(const struct id_map *id)
1524 {
1525 TALLOC_CTX *ctx;
1526 NTSTATUS ret;
1527
1528 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1529 return ret;
1530 }
1531
1532 /* sanity checks */
1533 if ((id->sid == NULL) || (id->status != ID_MAPPED)) {
1534 DEBUG(1, ("NULL SID or unmapped entry\n"));
1535 return NT_STATUS_INVALID_PARAMETER;
1536 }
1537
1538 /* TODO: check uid/gid range ? */
1539
1540 ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
1541 if ( ! ctx) {
1542 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1543 return NT_STATUS_NO_MEMORY;
1544 }
1545
1546 /* set the new mapping */
1547 ret = idmap_backends_set_mapping(id);
1548 IDMAP_CHECK_RET(ret);
1549
1550 /* set the mapping in the cache */
1551 ret = idmap_cache_set(idmap_cache, id);
1552 IDMAP_CHECK_RET(ret);
1553
1554 done:
1555 talloc_free(ctx);
1556 return ret;
1557 }
1558
1559 char *idmap_fetch_secret(const char *backend, bool alloc,
1560 const char *domain, const char *identity)
1561 {
1562 char *tmp, *ret;
1563 int r;
1564
1565 if (alloc) {
1566 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
1567 } else {
1568 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
1569 }
1570
1571 if (r < 0)
1572 return NULL;
1573
1574 strupper_m(tmp); /* make sure the key is case insensitive */
1575 ret = secrets_fetch_generic(tmp, identity);
1576
1577 SAFE_FREE(tmp);
1578
1579 return ret;
1580 }
1581