source3/winbindd/idmap_ad.c

   1 /*
   2  *  idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
   3  *
   4  * Unix SMB/CIFS implementation.
   5  *
   6  * Winbind ADS backend functions
   7  *
   8  * Copyright (C) Andrew Tridgell 2001
   9  * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
  10  * Copyright (C) Gerald (Jerry) Carter 2004-2007
  11  * Copyright (C) Luke Howard 2001-2004
  12  * Copyright (C) Michael Adam 2008,2010
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 3 of the License, or
  17  * (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  26  */
  27
  28 #include "includes.h"
  29 #include "winbindd.h"
  30 #include "../libds/common/flags.h"
  31 #include "ads.h"
  32 #include "libads/ldap_schema.h"
  33 #include "nss_info.h"
  34 #include "secrets.h"
  35 #include "idmap.h"
  36 #include "../libcli/ldap/ldap_ndr.h"
  37 #include "../libcli/security/security.h"
  38
  39 #undef DBGC_CLASS
  40 #define DBGC_CLASS DBGC_IDMAP
  41
  42 #define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
  43
  44 #define CHECK_ALLOC_DONE(mem) do { \
  45      if (!mem) { \
  46            DEBUG(0, ("Out of memory!\n")); \
  47            ret = NT_STATUS_NO_MEMORY; \
  48            goto done; \
  49       } \
  50 } while (0)
  51
  52 struct idmap_ad_context {
  53         ADS_STRUCT *ads;
  54         struct posix_schema *ad_schema;
  55         enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
  56 };
  57
  58 /************************************************************************
  59  ***********************************************************************/
  60
  61 static ADS_STATUS ad_idmap_cached_connection_internal(struct idmap_domain *dom)
  62 {
  63         ADS_STRUCT *ads;
  64         ADS_STATUS status;
  65         fstring dc_name;
  66         struct sockaddr_storage dc_ip;
  67         struct idmap_ad_context *ctx;
  68         char *ldap_server = NULL;
  69         char *realm = NULL;
  70         struct winbindd_domain *wb_dom;
  71
  72         DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
  73                    dom->name));
  74
  75         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
  76
  77         if (ctx->ads != NULL) {
  78
  79                 time_t expire;
  80                 time_t now = time(NULL);
  81
  82                 ads = ctx->ads;
  83
  84                 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
  85
  86                 /* check for a valid structure */
  87                 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
  88                           (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
  89
  90                 if ( ads->config.realm && (expire > time(NULL))) {
  91                         return ADS_SUCCESS;
  92                 } else {
  93                         /* we own this ADS_STRUCT so make sure it goes away */
  94                         DEBUG(7,("Deleting expired krb5 credential cache\n"));
  95                         ads->is_mine = True;
  96                         ads_destroy( &ads );
  97                         ads_kdestroy(WINBIND_CCACHE_NAME);
  98                         ctx->ads = NULL;
  99                 }
 100         }
 101
 102         /* we don't want this to affect the users ccache */
 103         setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
 104
 105         /*
 106          * At this point we only have the NetBIOS domain name.
 107          * Check if we can get server nam and realm from SAF cache
 108          * and the domain list.
 109          */
 110         ldap_server = saf_fetch(dom->name);
 111         DEBUG(10, ("ldap_server from saf cache: '%s'\n", ldap_server?ldap_server:""));
 112
 113         wb_dom = find_domain_from_name_noinit(dom->name);
 114         if (wb_dom == NULL) {
 115                 DEBUG(10, ("find_domain_from_name_noinit did not find domain '%s'\n",
 116                            dom->name));
 117                 realm = NULL;
 118         } else {
 119                 DEBUG(10, ("find_domain_from_name_noinit found realm '%s' for "
 120                           " domain '%s'\n", wb_dom->alt_name, dom->name));
 121                 realm = wb_dom->alt_name;
 122         }
 123
 124         if ( (ads = ads_init(realm, dom->name, ldap_server)) == NULL ) {
 125                 DEBUG(1,("ads_init failed\n"));
 126                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
 127         }
 128
 129         /* the machine acct password might have change - fetch it every time */
 130         SAFE_FREE(ads->auth.password);
 131         ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 132
 133         SAFE_FREE(ads->auth.realm);
 134         ads->auth.realm = SMB_STRDUP(lp_realm());
 135
 136         /* setup server affinity */
 137
 138         get_dc_name(dom->name, realm, dc_name, &dc_ip );
 139
 140         status = ads_connect(ads);
 141         if (!ADS_ERR_OK(status)) {
 142                 DEBUG(1, ("ad_idmap_cached_connection_internal: failed to "
 143                           "connect to AD\n"));
 144                 ads_destroy(&ads);
 145                 return status;
 146         }
 147
 148         ads->is_mine = False;
 149
 150         ctx->ads = ads;
 151
 152         return ADS_SUCCESS;
 153 }
 154
 155 /************************************************************************
 156  ***********************************************************************/
 157
 158 static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
 159 {
 160         ADS_STATUS status;
 161         struct idmap_ad_context * ctx;
 162
 163         status = ad_idmap_cached_connection_internal(dom);
 164         if (!ADS_ERR_OK(status)) {
 165                 return status;
 166         }
 167
 168         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 169
 170         /* if we have a valid ADS_STRUCT and the schema model is
 171            defined, then we can return here. */
 172
 173         if ( ctx->ad_schema ) {
 174                 return ADS_SUCCESS;
 175         }
 176
 177         /* Otherwise, set the schema model */
 178
 179         if ( (ctx->ad_map_type ==  WB_POSIX_MAP_SFU) ||
 180              (ctx->ad_map_type ==  WB_POSIX_MAP_SFU20) ||
 181              (ctx->ad_map_type ==  WB_POSIX_MAP_RFC2307) )
 182         {
 183                 status = ads_check_posix_schema_mapping(
 184                         ctx, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
 185                 if ( !ADS_ERR_OK(status) ) {
 186                         DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
 187                 }
 188         }
 189
 190         return status;
 191 }
 192
 193 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
 194 {
 195         if (ctx->ads != NULL) {
 196                 /* we own this ADS_STRUCT so make sure it goes away */
 197                 ctx->ads->is_mine = True;
 198                 ads_destroy( &ctx->ads );
 199                 ctx->ads = NULL;
 200         }
 201         return 0;
 202 }
 203
 204 /************************************************************************
 205  ***********************************************************************/
 206
 207 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
 208 {
 209         struct idmap_ad_context *ctx;
 210         char *config_option;
 211         const char *schema_mode = NULL;
 212
 213         ctx = talloc_zero(dom, struct idmap_ad_context);
 214         if (ctx == NULL) {
 215                 DEBUG(0, ("Out of memory!\n"));
 216                 return NT_STATUS_NO_MEMORY;
 217         }
 218         talloc_set_destructor(ctx, idmap_ad_context_destructor);
 219
 220         config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
 221         if (config_option == NULL) {
 222                 DEBUG(0, ("Out of memory!\n"));
 223                 talloc_free(ctx);
 224                 return NT_STATUS_NO_MEMORY;
 225         }
 226
 227         /* default map type */
 228         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 229
 230         /* schema mode */
 231         schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
 232         if ( schema_mode && schema_mode[0] ) {
 233                 if ( strequal(schema_mode, "sfu") )
 234                         ctx->ad_map_type = WB_POSIX_MAP_SFU;
 235                 else if ( strequal(schema_mode, "sfu20" ) )
 236                         ctx->ad_map_type = WB_POSIX_MAP_SFU20;
 237                 else if ( strequal(schema_mode, "rfc2307" ) )
 238                         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 239                 else
 240                         DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
 241                                  schema_mode));
 242         }
 243
 244         dom->private_data = ctx;
 245
 246         talloc_free(config_option);
 247
 248         return NT_STATUS_OK;
 249 }
 250
 251 /************************************************************************
 252  ***********************************************************************/
 253
 254 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 255 {
 256         NTSTATUS ret;
 257         TALLOC_CTX *memctx;
 258         struct idmap_ad_context *ctx;
 259         ADS_STATUS rc;
 260         const char *attrs[] = { "sAMAccountType",
 261                                 "objectSid",
 262                                 NULL, /* uidnumber */
 263                                 NULL, /* gidnumber */
 264                                 NULL };
 265         LDAPMessage *res = NULL;
 266         LDAPMessage *entry = NULL;
 267         char *filter = NULL;
 268         int idx = 0;
 269         int bidx = 0;
 270         int count;
 271         int i;
 272         char *u_filter = NULL;
 273         char *g_filter = NULL;
 274
 275         /* initialize the status to avoid suprise */
 276         for (i = 0; ids[i]; i++) {
 277                 ids[i]->status = ID_UNKNOWN;
 278         }
 279
 280         /* Only do query if we are online */
 281         if (idmap_is_offline()) {
 282                 return NT_STATUS_FILE_IS_OFFLINE;
 283         }
 284
 285         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 286
 287         if ( (memctx = talloc_new(ctx)) == NULL ) {
 288                 DEBUG(0, ("Out of memory!\n"));
 289                 return NT_STATUS_NO_MEMORY;
 290         }
 291
 292         rc = ad_idmap_cached_connection(dom);
 293         if (!ADS_ERR_OK(rc)) {
 294                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 295                 ret = NT_STATUS_UNSUCCESSFUL;
 296                 /* ret = ads_ntstatus(rc); */
 297                 goto done;
 298         }
 299
 300         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 301         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 302
 303 again:
 304         bidx = idx;
 305         for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 306                 switch (ids[idx]->xid.type) {
 307                 case ID_TYPE_UID:
 308                         if ( ! u_filter) {
 309                                 u_filter = talloc_asprintf(memctx, "(&(|"
 310                                                            "(sAMAccountType=%d)"
 311                                                            "(sAMAccountType=%d)"
 312                                                            "(sAMAccountType=%d))(|",
 313                                                            ATYPE_NORMAL_ACCOUNT,
 314                                                            ATYPE_WORKSTATION_TRUST,
 315                                                            ATYPE_INTERDOMAIN_TRUST);
 316                         }
 317                         u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
 318                                                           ctx->ad_schema->posix_uidnumber_attr,
 319                                                           (unsigned long)ids[idx]->xid.id);
 320                         CHECK_ALLOC_DONE(u_filter);
 321                         break;
 322
 323                 case ID_TYPE_GID:
 324                         if ( ! g_filter) {
 325                                 g_filter = talloc_asprintf(memctx, "(&(|"
 326                                                            "(sAMAccountType=%d)"
 327                                                            "(sAMAccountType=%d))(|",
 328                                                            ATYPE_SECURITY_GLOBAL_GROUP,
 329                                                            ATYPE_SECURITY_LOCAL_GROUP);
 330                         }
 331                         g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
 332                                                           ctx->ad_schema->posix_gidnumber_attr,
 333                                                           (unsigned long)ids[idx]->xid.id);
 334                         CHECK_ALLOC_DONE(g_filter);
 335                         break;
 336
 337                 default:
 338                         DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
 339                         ids[idx]->status = ID_UNKNOWN;
 340                         continue;
 341                 }
 342         }
 343         filter = talloc_asprintf(memctx, "(|");
 344         CHECK_ALLOC_DONE(filter);
 345         if ( u_filter) {
 346                 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
 347                 CHECK_ALLOC_DONE(filter);
 348                         TALLOC_FREE(u_filter);
 349         }
 350         if ( g_filter) {
 351                 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
 352                 CHECK_ALLOC_DONE(filter);
 353                 TALLOC_FREE(g_filter);
 354         }
 355         filter = talloc_asprintf_append_buffer(filter, ")");
 356         CHECK_ALLOC_DONE(filter);
 357
 358         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 359         if (!ADS_ERR_OK(rc)) {
 360                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 361                 ret = NT_STATUS_UNSUCCESSFUL;
 362                 goto done;
 363         }
 364
 365         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 366                 DEBUG(10, ("No IDs found\n"));
 367         }
 368
 369         entry = res;
 370         for (i = 0; (i < count) && entry; i++) {
 371                 struct dom_sid sid;
 372                 enum id_type type;
 373                 struct id_map *map;
 374                 uint32_t id;
 375                 uint32_t atype;
 376
 377                 if (i == 0) { /* first entry */
 378                         entry = ads_first_entry(ctx->ads, entry);
 379                 } else { /* following ones */
 380                         entry = ads_next_entry(ctx->ads, entry);
 381                 }
 382
 383                 if ( !entry ) {
 384                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 385                         break;
 386                 }
 387
 388                 /* first check if the SID is present */
 389                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 390                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 391                         continue;
 392                 }
 393
 394                 /* get type */
 395                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 396                         DEBUG(1, ("could not get SAM account type\n"));
 397                         continue;
 398                 }
 399
 400                 switch (atype & 0xF0000000) {
 401                 case ATYPE_SECURITY_GLOBAL_GROUP:
 402                 case ATYPE_SECURITY_LOCAL_GROUP:
 403                         type = ID_TYPE_GID;
 404                         break;
 405                 case ATYPE_NORMAL_ACCOUNT:
 406                 case ATYPE_WORKSTATION_TRUST:
 407                 case ATYPE_INTERDOMAIN_TRUST:
 408                         type = ID_TYPE_UID;
 409                         break;
 410                 default:
 411                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 412                         continue;
 413                 }
 414
 415                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 416                                                  ctx->ad_schema->posix_uidnumber_attr :
 417                                                  ctx->ad_schema->posix_gidnumber_attr,
 418                                      &id))
 419                 {
 420                         DEBUG(1, ("Could not get unix ID\n"));
 421                         continue;
 422                 }
 423
 424                 if (!idmap_unix_id_is_in_range(id, dom)) {
 425                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 426                                 id, dom->low_id, dom->high_id));
 427                         continue;
 428                 }
 429
 430                 map = idmap_find_map_by_id(&ids[bidx], type, id);
 431                 if (!map) {
 432                         DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
 433                         continue;
 434                 }
 435
 436                 sid_copy(map->sid, &sid);
 437
 438                 /* mapped */
 439                 map->status = ID_MAPPED;
 440
 441                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 442                            (unsigned long)map->xid.id,
 443                            map->xid.type));
 444         }
 445
 446         if (res) {
 447                 ads_msgfree(ctx->ads, res);
 448         }
 449
 450         if (ids[idx]) { /* still some values to map */
 451                 goto again;
 452         }
 453
 454         ret = NT_STATUS_OK;
 455
 456         /* mark all unknown/expired ones as unmapped */
 457         for (i = 0; ids[i]; i++) {
 458                 if (ids[i]->status != ID_MAPPED)
 459                         ids[i]->status = ID_UNMAPPED;
 460         }
 461
 462 done:
 463         talloc_free(memctx);
 464         return ret;
 465 }
 466
 467 /************************************************************************
 468  ***********************************************************************/
 469
 470 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 471 {
 472         NTSTATUS ret;
 473         TALLOC_CTX *memctx;
 474         struct idmap_ad_context *ctx;
 475         ADS_STATUS rc;
 476         const char *attrs[] = { "sAMAccountType",
 477                                 "objectSid",
 478                                 NULL, /* attr_uidnumber */
 479                                 NULL, /* attr_gidnumber */
 480                                 NULL };
 481         LDAPMessage *res = NULL;
 482         LDAPMessage *entry = NULL;
 483         char *filter = NULL;
 484         int idx = 0;
 485         int bidx = 0;
 486         int count;
 487         int i;
 488         char *sidstr;
 489
 490         /* initialize the status to avoid suprise */
 491         for (i = 0; ids[i]; i++) {
 492                 ids[i]->status = ID_UNKNOWN;
 493         }
 494
 495         /* Only do query if we are online */
 496         if (idmap_is_offline()) {
 497                 return NT_STATUS_FILE_IS_OFFLINE;
 498         }
 499
 500         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 501
 502         if ( (memctx = talloc_new(ctx)) == NULL ) {
 503                 DEBUG(0, ("Out of memory!\n"));
 504                 return NT_STATUS_NO_MEMORY;
 505         }
 506
 507         rc = ad_idmap_cached_connection(dom);
 508         if (!ADS_ERR_OK(rc)) {
 509                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 510                 ret = NT_STATUS_UNSUCCESSFUL;
 511                 /* ret = ads_ntstatus(rc); */
 512                 goto done;
 513         }
 514
 515         if (ctx->ad_schema == NULL) {
 516                 DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
 517                 ret = NT_STATUS_UNSUCCESSFUL;
 518                 goto done;
 519         }
 520
 521         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 522         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 523
 524 again:
 525         filter = talloc_asprintf(memctx, "(&(|"
 526                                  "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
 527                                  "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
 528                                  ")(|",
 529                                  ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
 530                                  ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
 531
 532         CHECK_ALLOC_DONE(filter);
 533
 534         bidx = idx;
 535         for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 536
 537                 ids[idx]->status = ID_UNKNOWN;
 538
 539                 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[idx]->sid);
 540                 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
 541
 542                 TALLOC_FREE(sidstr);
 543                 CHECK_ALLOC_DONE(filter);
 544         }
 545         filter = talloc_asprintf_append_buffer(filter, "))");
 546         CHECK_ALLOC_DONE(filter);
 547         DEBUG(10, ("Filter: [%s]\n", filter));
 548
 549         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 550         if (!ADS_ERR_OK(rc)) {
 551                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 552                 ret = NT_STATUS_UNSUCCESSFUL;
 553                 goto done;
 554         }
 555
 556         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 557                 DEBUG(10, ("No IDs found\n"));
 558         }
 559
 560         entry = res;
 561         for (i = 0; (i < count) && entry; i++) {
 562                 struct dom_sid sid;
 563                 enum id_type type;
 564                 struct id_map *map;
 565                 uint32_t id;
 566                 uint32_t atype;
 567
 568                 if (i == 0) { /* first entry */
 569                         entry = ads_first_entry(ctx->ads, entry);
 570                 } else { /* following ones */
 571                         entry = ads_next_entry(ctx->ads, entry);
 572                 }
 573
 574                 if ( !entry ) {
 575                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 576                         break;
 577                 }
 578
 579                 /* first check if the SID is present */
 580                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 581                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 582                         continue;
 583                 }
 584
 585                 map = idmap_find_map_by_sid(&ids[bidx], &sid);
 586                 if (!map) {
 587                         DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
 588                         continue;
 589                 }
 590
 591                 /* get type */
 592                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 593                         DEBUG(1, ("could not get SAM account type\n"));
 594                         continue;
 595                 }
 596
 597                 switch (atype & 0xF0000000) {
 598                 case ATYPE_SECURITY_GLOBAL_GROUP:
 599                 case ATYPE_SECURITY_LOCAL_GROUP:
 600                         type = ID_TYPE_GID;
 601                         break;
 602                 case ATYPE_NORMAL_ACCOUNT:
 603                 case ATYPE_WORKSTATION_TRUST:
 604                 case ATYPE_INTERDOMAIN_TRUST:
 605                         type = ID_TYPE_UID;
 606                         break;
 607                 default:
 608                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 609                         continue;
 610                 }
 611
 612                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 613                                                  ctx->ad_schema->posix_uidnumber_attr :
 614                                                  ctx->ad_schema->posix_gidnumber_attr,
 615                                      &id))
 616                 {
 617                         DEBUG(1, ("Could not get unix ID\n"));
 618                         continue;
 619                 }
 620                 if (!idmap_unix_id_is_in_range(id, dom)) {
 621                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 622                                 id, dom->low_id, dom->high_id));
 623                         continue;
 624                 }
 625
 626                 /* mapped */
 627                 map->xid.type = type;
 628                 map->xid.id = id;
 629                 map->status = ID_MAPPED;
 630
 631                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 632                            (unsigned long)map->xid.id,
 633                            map->xid.type));
 634         }
 635
 636         if (res) {
 637                 ads_msgfree(ctx->ads, res);
 638         }
 639
 640         if (ids[idx]) { /* still some values to map */
 641                 goto again;
 642         }
 643
 644         ret = NT_STATUS_OK;
 645
 646         /* mark all unknown/expired ones as unmapped */
 647         for (i = 0; ids[i]; i++) {
 648                 if (ids[i]->status != ID_MAPPED)
 649                         ids[i]->status = ID_UNMAPPED;
 650         }
 651
 652 done:
 653         talloc_free(memctx);
 654         return ret;
 655 }
 656
 657 /*
 658  * nss_info_{sfu,sfu20,rfc2307}
 659  */
 660
 661 /************************************************************************
 662  Initialize the {sfu,sfu20,rfc2307} state
 663  ***********************************************************************/
 664
 665 static const char *wb_posix_map_unknown_string = "WB_POSIX_MAP_UNKNOWN";
 666 static const char *wb_posix_map_template_string = "WB_POSIX_MAP_TEMPLATE";
 667 static const char *wb_posix_map_sfu_string = "WB_POSIX_MAP_SFU";
 668 static const char *wb_posix_map_sfu20_string = "WB_POSIX_MAP_SFU20";
 669 static const char *wb_posix_map_rfc2307_string = "WB_POSIX_MAP_RFC2307";
 670 static const char *wb_posix_map_unixinfo_string = "WB_POSIX_MAP_UNIXINFO";
 671
 672 static const char *ad_map_type_string(enum wb_posix_mapping map_type)
 673 {
 674         switch (map_type) {
 675                 case WB_POSIX_MAP_TEMPLATE:
 676                         return wb_posix_map_template_string;
 677                 case WB_POSIX_MAP_SFU:
 678                         return wb_posix_map_sfu_string;
 679                 case WB_POSIX_MAP_SFU20:
 680                         return wb_posix_map_sfu20_string;
 681                 case WB_POSIX_MAP_RFC2307:
 682                         return wb_posix_map_rfc2307_string;
 683                 case WB_POSIX_MAP_UNIXINFO:
 684                         return wb_posix_map_unixinfo_string;
 685                 default:
 686                         return wb_posix_map_unknown_string;
 687         }
 688 }
 689
 690 static NTSTATUS nss_ad_generic_init(struct nss_domain_entry *e,
 691                                     enum wb_posix_mapping new_ad_map_type)
 692 {
 693         struct idmap_domain *dom;
 694         struct idmap_ad_context *ctx;
 695
 696         if (e->state != NULL) {
 697                 dom = talloc_get_type(e->state, struct idmap_domain);
 698         } else {
 699                 dom = talloc_zero(e, struct idmap_domain);
 700                 if (dom == NULL) {
 701                         DEBUG(0, ("Out of memory!\n"));
 702                         return NT_STATUS_NO_MEMORY;
 703                 }
 704                 e->state = dom;
 705         }
 706
 707         if (e->domain != NULL) {
 708                 dom->name = talloc_strdup(dom, e->domain);
 709                 if (dom->name == NULL) {
 710                         DEBUG(0, ("Out of memory!\n"));
 711                         return NT_STATUS_NO_MEMORY;
 712                 }
 713         }
 714
 715         if (dom->private_data != NULL) {
 716                 ctx = talloc_get_type(dom->private_data,
 717                                       struct idmap_ad_context);
 718         } else {
 719                 ctx = talloc_zero(dom, struct idmap_ad_context);
 720                 if (ctx == NULL) {
 721                         DEBUG(0, ("Out of memory!\n"));
 722                         return NT_STATUS_NO_MEMORY;
 723                 }
 724                 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 725                 dom->private_data = ctx;
 726         }
 727
 728         if ((ctx->ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
 729             (ctx->ad_map_type != new_ad_map_type))
 730         {
 731                 DEBUG(2, ("nss_ad_generic_init: "
 732                           "Warning: overriding previously set posix map type "
 733                           "%s for domain %s with map type %s.\n",
 734                           ad_map_type_string(ctx->ad_map_type),
 735                           dom->name,
 736                           ad_map_type_string(new_ad_map_type)));
 737         }
 738
 739         ctx->ad_map_type = new_ad_map_type;
 740
 741         return NT_STATUS_OK;
 742 }
 743
 744 static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
 745 {
 746         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU);
 747 }
 748
 749 static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
 750 {
 751         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU20);
 752 }
 753
 754 static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
 755 {
 756         return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
 757 }
 758
 759
 760 /************************************************************************
 761  ***********************************************************************/
 762
 763 static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
 764                                   const struct dom_sid *sid,
 765                                   TALLOC_CTX *mem_ctx,
 766                                   const char **homedir,
 767                                   const char **shell,
 768                                   const char **gecos,
 769                                   uint32 *gid )
 770 {
 771         const char *attrs[] = {NULL, /* attr_homedir */
 772                                NULL, /* attr_shell */
 773                                NULL, /* attr_gecos */
 774                                NULL, /* attr_gidnumber */
 775                                NULL };
 776         char *filter = NULL;
 777         LDAPMessage *msg_internal = NULL;
 778         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 779         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 780         char *sidstr = NULL;
 781         struct idmap_domain *dom;
 782         struct idmap_ad_context *ctx;
 783
 784         DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
 785                    sid_string_dbg(sid), e->domain?e->domain:"NULL"));
 786
 787         /* Only do query if we are online */
 788         if (idmap_is_offline()) {
 789                 return NT_STATUS_FILE_IS_OFFLINE;
 790         }
 791
 792         dom = talloc_get_type(e->state, struct idmap_domain);
 793         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 794
 795         ads_status = ad_idmap_cached_connection(dom);
 796         if (!ADS_ERR_OK(ads_status)) {
 797                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 798         }
 799
 800         if (!ctx->ad_schema) {
 801                 DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
 802                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 803         }
 804
 805         if (!sid || !homedir || !shell || !gecos) {
 806                 return NT_STATUS_INVALID_PARAMETER;
 807         }
 808
 809         /* Have to do our own query */
 810
 811         DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
 812                    "own query\n"));
 813
 814         attrs[0] = ctx->ad_schema->posix_homedir_attr;
 815         attrs[1] = ctx->ad_schema->posix_shell_attr;
 816         attrs[2] = ctx->ad_schema->posix_gecos_attr;
 817         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 818
 819         sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
 820         filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
 821         TALLOC_FREE(sidstr);
 822
 823         if (!filter) {
 824                 nt_status = NT_STATUS_NO_MEMORY;
 825                 goto done;
 826         }
 827
 828         ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
 829         if (!ADS_ERR_OK(ads_status)) {
 830                 nt_status = ads_ntstatus(ads_status);
 831                 goto done;
 832         }
 833
 834         *homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
 835         *shell   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
 836         *gecos   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
 837
 838         if (gid) {
 839                 if (!ads_pull_uint32(ctx->ads, msg_internal, ctx->ad_schema->posix_gidnumber_attr, gid))
 840                         *gid = (uint32)-1;
 841         }
 842
 843         nt_status = NT_STATUS_OK;
 844
 845 done:
 846         if (msg_internal) {
 847                 ads_msgfree(ctx->ads, msg_internal);
 848         }
 849
 850         return nt_status;
 851 }
 852
 853 /**********************************************************************
 854  *********************************************************************/
 855
 856 static NTSTATUS nss_ad_map_to_alias(TALLOC_CTX *mem_ctx,
 857                                     struct nss_domain_entry *e,
 858                                     const char *name,
 859                                     char **alias)
 860 {
 861         const char *attrs[] = {NULL, /* attr_uid */
 862                                NULL };
 863         char *filter = NULL;
 864         LDAPMessage *msg = NULL;
 865         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 866         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 867         struct idmap_domain *dom;
 868         struct idmap_ad_context *ctx = NULL;
 869
 870         /* Check incoming parameters */
 871
 872         if ( !e || !e->domain || !name || !*alias) {
 873                 nt_status = NT_STATUS_INVALID_PARAMETER;
 874                 goto done;
 875         }
 876
 877         /* Only do query if we are online */
 878
 879         if (idmap_is_offline()) {
 880                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
 881                 goto done;
 882         }
 883
 884         dom = talloc_get_type(e->state, struct idmap_domain);
 885         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 886
 887         ads_status = ad_idmap_cached_connection(dom);
 888         if (!ADS_ERR_OK(ads_status)) {
 889                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 890         }
 891
 892         if (!ctx->ad_schema) {
 893                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
 894                 goto done;
 895         }
 896
 897         attrs[0] = ctx->ad_schema->posix_uid_attr;
 898
 899         filter = talloc_asprintf(mem_ctx,
 900                                  "(sAMAccountName=%s)",
 901                                  name);
 902         if (!filter) {
 903                 nt_status = NT_STATUS_NO_MEMORY;
 904                 goto done;
 905         }
 906
 907         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
 908         if (!ADS_ERR_OK(ads_status)) {
 909                 nt_status = ads_ntstatus(ads_status);
 910                 goto done;
 911         }
 912
 913         *alias = ads_pull_string(ctx->ads, mem_ctx, msg, ctx->ad_schema->posix_uid_attr);
 914
 915         if (!*alias) {
 916                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 917         }
 918
 919         nt_status = NT_STATUS_OK;
 920
 921 done:
 922         if (filter) {
 923                 talloc_destroy(filter);
 924         }
 925         if (msg) {
 926                 ads_msgfree(ctx->ads, msg);
 927         }
 928
 929         return nt_status;
 930 }
 931
 932 /**********************************************************************
 933  *********************************************************************/
 934
 935 static NTSTATUS nss_ad_map_from_alias( TALLOC_CTX *mem_ctx,
 936                                              struct nss_domain_entry *e,
 937                                              const char *alias,
 938                                              char **name )
 939 {
 940         const char *attrs[] = {"sAMAccountName",
 941                                NULL };
 942         char *filter = NULL;
 943         LDAPMessage *msg = NULL;
 944         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 945         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 946         char *username;
 947         struct idmap_domain *dom;
 948         struct idmap_ad_context *ctx = NULL;
 949
 950         /* Check incoming parameters */
 951
 952         if ( !alias || !name) {
 953                 nt_status = NT_STATUS_INVALID_PARAMETER;
 954                 goto done;
 955         }
 956
 957         /* Only do query if we are online */
 958
 959         if (idmap_is_offline()) {
 960                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
 961                 goto done;
 962         }
 963
 964         dom = talloc_get_type(e->state, struct idmap_domain);
 965         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 966
 967         ads_status = ad_idmap_cached_connection(dom);
 968         if (!ADS_ERR_OK(ads_status)) {
 969                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 970         }
 971
 972         if (!ctx->ad_schema) {
 973                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
 974                 goto done;
 975         }
 976
 977         filter = talloc_asprintf(mem_ctx,
 978                                  "(%s=%s)",
 979                                  ctx->ad_schema->posix_uid_attr,
 980                                  alias);
 981         if (!filter) {
 982                 nt_status = NT_STATUS_NO_MEMORY;
 983                 goto done;
 984         }
 985
 986         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
 987         if (!ADS_ERR_OK(ads_status)) {
 988                 nt_status = ads_ntstatus(ads_status);
 989                 goto done;
 990         }
 991
 992         username = ads_pull_string(ctx->ads, mem_ctx, msg,
 993                                    "sAMAccountName");
 994         if (!username) {
 995                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 996         }
 997
 998         *name = talloc_asprintf(mem_ctx, "%s\\%s",
 999                                 lp_workgroup(),
1000                                 username);
1001         if (!*name) {
1002                 nt_status = NT_STATUS_NO_MEMORY;
1003                 goto done;
1004         }
1005
1006         nt_status = NT_STATUS_OK;
1007
1008 done:
1009         if (filter) {
1010                 talloc_destroy(filter);
1011         }
1012         if (msg) {
1013                 ads_msgfree(ctx->ads, msg);
1014         }
1015
1016         return nt_status;
1017 }
1018
1019 /************************************************************************
1020  Function dispatch tables for the idmap and nss plugins
1021  ***********************************************************************/
1022
1023 static struct idmap_methods ad_methods = {
1024         .init            = idmap_ad_initialize,
1025         .unixids_to_sids = idmap_ad_unixids_to_sids,
1026         .sids_to_unixids = idmap_ad_sids_to_unixids,
1027 };
1028
1029 /* The SFU and RFC2307 NSS plugins share everything but the init
1030    function which sets the intended schema model to use */
1031
1032 static struct nss_info_methods nss_rfc2307_methods = {
1033         .init           = nss_rfc2307_init,
1034         .get_nss_info   = nss_ad_get_info,
1035         .map_to_alias   = nss_ad_map_to_alias,
1036         .map_from_alias = nss_ad_map_from_alias,
1037 };
1038
1039 static struct nss_info_methods nss_sfu_methods = {
1040         .init           = nss_sfu_init,
1041         .get_nss_info   = nss_ad_get_info,
1042         .map_to_alias   = nss_ad_map_to_alias,
1043         .map_from_alias = nss_ad_map_from_alias,
1044 };
1045
1046 static struct nss_info_methods nss_sfu20_methods = {
1047         .init           = nss_sfu20_init,
1048         .get_nss_info   = nss_ad_get_info,
1049         .map_to_alias   = nss_ad_map_to_alias,
1050         .map_from_alias = nss_ad_map_from_alias,
1051 };
1052
1053
1054
1055 /************************************************************************
1056  Initialize the plugins
1057  ***********************************************************************/
1058
1059 NTSTATUS samba_init_module(void)
1060 {
1061         static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
1062         static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
1063         static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
1064         static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
1065
1066         /* Always register the AD method first in order to get the
1067            idmap_domain interface called */
1068
1069         if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
1070                 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
1071                                                      "ad", &ad_methods);
1072                 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
1073                         return status_idmap_ad;
1074         }
1075
1076         if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
1077                 status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1078                                                             "rfc2307",  &nss_rfc2307_methods );
1079                 if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
1080                         return status_nss_rfc2307;
1081         }
1082
1083         if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
1084                 status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1085                                                         "sfu",  &nss_sfu_methods );
1086                 if ( !NT_STATUS_IS_OK(status_nss_sfu) )
1087                         return status_nss_sfu;
1088         }
1089
1090         if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
1091                 status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1092                                                         "sfu20",  &nss_sfu20_methods );
1093                 if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
1094                         return status_nss_sfu20;
1095         }
1096
1097         return NT_STATUS_OK;
1098 }
1099