source/sam/idmap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    ID Mapping
   4    Copyright (C) Tim Potter 2000
   5    Copyright (C) Anthony Liguori <aliguor@us.ibm.com>   2003
   6    Copyright (C) Simo Sorce 2003
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 2 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program; if not, write to the Free Software
  20    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
  21
  22 #include "includes.h"
  23
  24 #undef DBGC_CLASS
  25 #define DBGC_CLASS DBGC_IDMAP
  26
  27 static struct {
  28
  29         const char *name;
  30         /* Function to create a member of the idmap_methods list */
  31         NTSTATUS (*reg_meth)(struct idmap_methods **methods);
  32         struct idmap_methods *methods;
  33
  34 } remote_idmap_functions[] = {
  35         { NULL, NULL, NULL }
  36 };
  37
  38 static struct idmap_methods *local_map;
  39 static struct idmap_methods *remote_map;
  40
  41 static struct idmap_methods *get_methods(const char *name)
  42 {
  43         int i = 0;
  44         struct idmap_methods *ret = NULL;
  45
  46         while (remote_idmap_functions[i].name && strcmp(remote_idmap_functions[i].name, name)) {
  47                 i++;
  48         }
  49
  50         if (remote_idmap_functions[i].name) {
  51
  52                 if (!remote_idmap_functions[i].methods) {
  53                         remote_idmap_functions[i].reg_meth(&remote_idmap_functions[i].methods);
  54                 }
  55
  56                 ret = remote_idmap_functions[i].methods;
  57         }
  58
  59         return ret;
  60 }
  61
  62 /* Initialize backend */
  63 BOOL idmap_init(void)
  64 {
  65         const char *remote_backend = lp_idmap_backend();
  66
  67         if (!local_map) {
  68                 idmap_reg_tdb(&local_map);
  69                 if (NT_STATUS_IS_ERR(local_map->init())) {
  70                         DEBUG(0, ("idmap_init: could not load or create local backend!\n"));
  71                         return False;
  72                 }
  73         }
  74
  75         if (!remote_map && remote_backend && *remote_backend != 0) {
  76                 DEBUG(3, ("idmap_init: using '%s' as remote backend\n", remote_backend));
  77
  78                 remote_map = get_methods(remote_backend);
  79                 if (!remote_map) {
  80                         DEBUG(0, ("idmap_init: could not load remote backend '%s'\n", remote_backend));
  81                         return False;
  82                 }
  83                 remote_map->init();
  84         }
  85
  86         return True;
  87 }
  88
  89 NTSTATUS idmap_set_mapping(const DOM_SID *sid, unid_t id, int id_type)
  90 {
  91         NTSTATUS ret;
  92
  93         if (!lp_idmap_only()) {
  94                 if (id_type & ID_USERID) {
  95                         uid_t low, high;
  96                         if (!lp_idmap_uid(&low, &high)) {
  97                                 DEBUG(0, ("idmap uid range missing or invalid\n"));
  98                                 DEBUGADD(0, ("idmap will be unable to map SIDs\n"));
  99                                 return NT_STATUS_UNSUCCESSFUL;
 100                         }
 101                         if (low > id.uid || high < id.uid) {
 102                                 DEBUG(0, ("uid not in range and idmap only is flase - not storing the mapping\n"));
 103                                 return NT_STATUS_UNSUCCESSFUL;
 104                         }
 105                 } else if (id_type & ID_GROUPID) {
 106                         gid_t low, high;
 107                         if (!lp_idmap_gid(&low, &high)) {
 108                                 DEBUG(0, ("idmap gid range missing or invalid\n"));
 109                                 DEBUGADD(0, ("idmap will be unable to map SIDs\n"));
 110                                 return NT_STATUS_UNSUCCESSFUL;
 111                         }
 112                         if (low > id.gid || high < id.gid) {
 113                                 DEBUG(0, ("uid not in range and idmap only is flase - not storing the mapping\n"));
 114                                 return NT_STATUS_UNSUCCESSFUL;
 115                         }
 116                 } else {
 117                         DEBUG(0, ("Wrong ID Type, mapping failed!"));
 118                         return NT_STATUS_UNSUCCESSFUL;
 119                 }
 120         }
 121
 122         ret = local_map->set_mapping(sid, id, id_type);
 123         if (NT_STATUS_IS_ERR(ret)) {
 124                 DEBUG (0, ("idmap_set_mapping: Error, unable to modify local cache!\n"));
 125                 DEBUGADD(0, ("Error: %s", nt_errstr(ret)));
 126                 return ret;
 127         }
 128
 129         /* Being able to update the remote cache is seldomly right.
 130            Generally this is a forbidden operation. */
 131         if (!(id_type & ID_CACHE) && (remote_map != NULL)) {
 132                 remote_map->set_mapping(sid, id, id_type);
 133                 if (NT_STATUS_IS_ERR(ret)) {
 134                         DEBUG (0, ("idmap_set_mapping: Error, unable to modify remote cache!\n"));
 135                         DEBUGADD(0, ("Error: %s", nt_errstr(ret)));
 136                 }
 137         }
 138
 139         return ret;
 140 }
 141
 142 /* Get ID from SID */
 143 NTSTATUS idmap_get_id_from_sid(unid_t *id, int *id_type, const DOM_SID *sid)
 144 {
 145         NTSTATUS ret;
 146         int loc_type;
 147
 148         loc_type = *id_type;
 149         if (remote_map) { /* We have a central remote idmap */
 150                 loc_type |= ID_NOMAP;
 151         }
 152         ret = local_map->get_id_from_sid(id, &loc_type, sid);
 153         if (NT_STATUS_IS_ERR(ret)) {
 154                 if (remote_map) {
 155                         ret = remote_map->get_id_from_sid(id, id_type, sid);
 156                         if (NT_STATUS_IS_ERR(ret)) {
 157                                 DEBUG(3, ("idmap_get_id_from_sid: error fetching id!\n"));
 158                                 return ret;
 159                         } else {
 160                                 loc_type |= ID_CACHE;
 161                                 idmap_set_mapping(sid, *id, loc_type);
 162                         }
 163                 }
 164         } else {
 165                 *id_type = loc_type & ID_TYPEMASK;
 166         }
 167
 168         return ret;
 169 }
 170
 171 /* Get SID from ID */
 172 NTSTATUS idmap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type)
 173 {
 174         NTSTATUS ret;
 175         int loc_type;
 176
 177         loc_type = id_type;
 178         if (remote_map) {
 179                 loc_type = id_type | ID_NOMAP;
 180         }
 181         ret = local_map->get_sid_from_id(sid, id, loc_type);
 182         if (NT_STATUS_IS_ERR(ret)) {
 183                 if (remote_map) {
 184                         ret = remote_map->get_sid_from_id(sid, id, id_type);
 185                         if (NT_STATUS_IS_ERR(ret)) {
 186                                 DEBUG(3, ("idmap_get_sid_from_id: unable to fetch sid!\n"));
 187                                 return ret;
 188                         } else {
 189                                 loc_type |= ID_CACHE;
 190                                 idmap_set_mapping(sid, id, loc_type);
 191                         }
 192                 }
 193         }
 194
 195         return ret;
 196 }
 197
 198 /* Close backend */
 199 NTSTATUS idmap_close(void)
 200 {
 201         NTSTATUS ret;
 202
 203         ret = local_map->close();
 204         if (NT_STATUS_IS_ERR(ret)) {
 205                 DEBUG(3, ("idmap_close: failed to close local cache!\n"));
 206         }
 207
 208         if (remote_map) {
 209                 ret = remote_map->close();
 210                 if (NT_STATUS_IS_ERR(ret)) {
 211                         DEBUG(3, ("idmap_close: failed to close remote idmap repository!\n"));
 212                 }
 213         }
 214
 215         return ret;
 216 }
 217
 218 /* Dump backend status */
 219 void idmap_status(void)
 220 {
 221         local_map->status();
 222         if (remote_map) remote_map->status();
 223 }
 224