?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:kdc Fill in more data fields
[Samba/ekacnet.git] / source3 / winbindd / winbindd_ads.c
blobf647a3ffaf19d8db53ad8ec227aaab41e31b36f5
1 /*
2 Unix SMB/CIFS implementation.
3
4 Winbind ADS backend functions
5
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
8 Copyright (C) Gerald (Jerry) Carter 2004
9
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
14
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
19
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
23
24 #include "includes.h"
25 #include "winbindd.h"
26 #include "../librpc/gen_ndr/cli_netlogon.h"
27
28 #ifdef HAVE_ADS
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_WINBIND
32
33 extern struct winbindd_methods reconnect_methods;
34
35 /*
36 return our ads connections structure for a domain. We keep the connection
37 open to make things faster
38 */
39 static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
40 {
41 ADS_STRUCT *ads;
42 ADS_STATUS status;
43 fstring dc_name;
44 struct sockaddr_storage dc_ss;
45
46 DEBUG(10,("ads_cached_connection\n"));
47
48 if (domain->private_data) {
49
50 time_t expire;
51 time_t now = time(NULL);
52
53 /* check for a valid structure */
54 ads = (ADS_STRUCT *)domain->private_data;
55
56 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
57
58 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
59 (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
60
61 if ( ads->config.realm && (expire > now)) {
62 return ads;
63 } else {
64 /* we own this ADS_STRUCT so make sure it goes away */
65 DEBUG(7,("Deleting expired krb5 credential cache\n"));
66 ads->is_mine = True;
67 ads_destroy( &ads );
68 ads_kdestroy("MEMORY:winbind_ccache");
69 domain->private_data = NULL;
70 }
71 }
72
73 /* we don't want this to affect the users ccache */
74 setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
75
76 ads = ads_init(domain->alt_name, domain->name, NULL);
77 if (!ads) {
78 DEBUG(1,("ads_init for domain %s failed\n", domain->name));
79 return NULL;
80 }
81
82 /* the machine acct password might have change - fetch it every time */
83
84 SAFE_FREE(ads->auth.password);
85 SAFE_FREE(ads->auth.realm);
86
87 if ( IS_DC ) {
88
89 if ( !pdb_get_trusteddom_pw( domain->name, &ads->auth.password, NULL, NULL ) ) {
90 ads_destroy( &ads );
91 return NULL;
92 }
93 ads->auth.realm = SMB_STRDUP( ads->server.realm );
94 strupper_m( ads->auth.realm );
95 }
96 else {
97 struct winbindd_domain *our_domain = domain;
98
99 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
100
101 /* always give preference to the alt_name in our
102 primary domain if possible */
103
104 if ( !domain->primary )
105 our_domain = find_our_domain();
106
107 if ( our_domain->alt_name[0] != '\0' ) {
108 ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
109 strupper_m( ads->auth.realm );
110 }
111 else
112 ads->auth.realm = SMB_STRDUP( lp_realm() );
113 }
114
115 ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME;
116
117 /* Setup the server affinity cache. We don't reaally care
118 about the name. Just setup affinity and the KRB5_CONFIG
119 file. */
120
121 get_dc_name( ads->server.workgroup, ads->server.realm, dc_name, &dc_ss );
122
123 status = ads_connect(ads);
124 if (!ADS_ERR_OK(status) || !ads->config.realm) {
125 DEBUG(1,("ads_connect for domain %s failed: %s\n",
126 domain->name, ads_errstr(status)));
127 ads_destroy(&ads);
128
129 /* if we get ECONNREFUSED then it might be a NT4
130 server, fall back to MSRPC */
131 if (status.error_type == ENUM_ADS_ERROR_SYSTEM &&
132 status.err.rc == ECONNREFUSED) {
133 /* 'reconnect_methods' is the MS-RPC backend. */
134 DEBUG(1,("Trying MSRPC methods\n"));
135 domain->backend = &reconnect_methods;
136 }
137 return NULL;
138 }
139
140 /* set the flag that says we don't own the memory even
141 though we do so that ads_destroy() won't destroy the
142 structure we pass back by reference */
143
144 ads->is_mine = False;
145
146 domain->private_data = (void *)ads;
147 return ads;
148 }
149
150
151 /* Query display info for a realm. This is the basic user list fn */
152 static NTSTATUS query_user_list(struct winbindd_domain *domain,
153 TALLOC_CTX *mem_ctx,
154 uint32 *num_entries,
155 struct wbint_userinfo **info)
156 {
157 ADS_STRUCT *ads = NULL;
158 const char *attrs[] = { "*", NULL };
159 int i, count;
160 ADS_STATUS rc;
161 LDAPMessage *res = NULL;
162 LDAPMessage *msg = NULL;
163 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
164
165 *num_entries = 0;
166
167 DEBUG(3,("ads: query_user_list\n"));
168
169 if ( !winbindd_can_contact_domain( domain ) ) {
170 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
171 domain->name));
172 return NT_STATUS_OK;
173 }
174
175 ads = ads_cached_connection(domain);
176
177 if (!ads) {
178 domain->last_status = NT_STATUS_SERVER_DISABLED;
179 goto done;
180 }
181
182 rc = ads_search_retry(ads, &res, "(objectCategory=user)", attrs);
183 if (!ADS_ERR_OK(rc) || !res) {
184 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
185 goto done;
186 }
187
188 count = ads_count_replies(ads, res);
189 if (count == 0) {
190 DEBUG(1,("query_user_list: No users found\n"));
191 goto done;
192 }
193
194 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct wbint_userinfo, count);
195 if (!*info) {
196 status = NT_STATUS_NO_MEMORY;
197 goto done;
198 }
199
200 i = 0;
201
202 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
203 const char *name;
204 const char *gecos = NULL;
205 const char *homedir = NULL;
206 const char *shell = NULL;
207 uint32 group;
208 uint32 atype;
209 DOM_SID user_sid;
210 gid_t primary_gid = (gid_t)-1;
211
212 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
213 ds_atype_map(atype) != SID_NAME_USER) {
214 DEBUG(1,("Not a user account? atype=0x%x\n", atype));
215 continue;
216 }
217
218 name = ads_pull_username(ads, mem_ctx, msg);
219
220 if ( ads_pull_sid( ads, msg, "objectSid", &user_sid ) ) {
221 status = nss_get_info_cached( domain, &user_sid, mem_ctx,
222 ads, msg, &homedir, &shell, &gecos,
223 &primary_gid );
224 }
225
226 if (gecos == NULL) {
227 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
228 }
229
230 if (!ads_pull_sid(ads, msg, "objectSid",
231 &(*info)[i].user_sid)) {
232 DEBUG(1,("No sid for %s !?\n", name));
233 continue;
234 }
235 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
236 DEBUG(1,("No primary group for %s !?\n", name));
237 continue;
238 }
239
240 (*info)[i].acct_name = name;
241 (*info)[i].full_name = gecos;
242 (*info)[i].homedir = homedir;
243 (*info)[i].shell = shell;
244 (*info)[i].primary_gid = primary_gid;
245 sid_compose(&(*info)[i].group_sid, &domain->sid, group);
246 i++;
247 }
248
249 (*num_entries) = i;
250 status = NT_STATUS_OK;
251
252 DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries)));
253
254 done:
255 if (res)
256 ads_msgfree(ads, res);
257
258 return status;
259 }
260
261 /* list all domain groups */
262 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
263 TALLOC_CTX *mem_ctx,
264 uint32 *num_entries,
265 struct acct_info **info)
266 {
267 ADS_STRUCT *ads = NULL;
268 const char *attrs[] = {"userPrincipalName", "sAMAccountName",
269 "name", "objectSid", NULL};
270 int i, count;
271 ADS_STATUS rc;
272 LDAPMessage *res = NULL;
273 LDAPMessage *msg = NULL;
274 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
275 const char *filter;
276 bool enum_dom_local_groups = False;
277
278 *num_entries = 0;
279
280 DEBUG(3,("ads: enum_dom_groups\n"));
281
282 if ( !winbindd_can_contact_domain( domain ) ) {
283 DEBUG(10,("enum_dom_groups: No incoming trust for domain %s\n",
284 domain->name));
285 return NT_STATUS_OK;
286 }
287
288 /* only grab domain local groups for our domain */
289 if ( domain->active_directory && strequal(lp_realm(), domain->alt_name) ) {
290 enum_dom_local_groups = True;
291 }
292
293 /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
294 * rollup-fixes:
295 *
296 * According to Section 5.1(4) of RFC 2251 if a value of a type is it's
297 * default value, it MUST be absent. In case of extensible matching the
298 * "dnattr" boolean defaults to FALSE and so it must be only be present
299 * when set to TRUE.
300 *
301 * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
302 * filter using bitwise matching rule then the buggy AD fails to decode
303 * the extensible match. As a workaround set it to TRUE and thereby add
304 * the dnAttributes "dn" field to cope with those older AD versions.
305 * It should not harm and won't put any additional load on the AD since
306 * none of the dn components have a bitmask-attribute.
307 *
308 * Thanks to Ralf Haferkamp for input and testing - Guenther */
309
310 filter = talloc_asprintf(mem_ctx, "(&(objectCategory=group)(&(groupType:dn:%s:=%d)(!(groupType:dn:%s:=%d))))",
311 ADS_LDAP_MATCHING_RULE_BIT_AND, GROUP_TYPE_SECURITY_ENABLED,
312 ADS_LDAP_MATCHING_RULE_BIT_AND,
313 enum_dom_local_groups ? GROUP_TYPE_BUILTIN_LOCAL_GROUP : GROUP_TYPE_RESOURCE_GROUP);
314
315 if (filter == NULL) {
316 status = NT_STATUS_NO_MEMORY;
317 goto done;
318 }
319
320 ads = ads_cached_connection(domain);
321
322 if (!ads) {
323 domain->last_status = NT_STATUS_SERVER_DISABLED;
324 goto done;
325 }
326
327 rc = ads_search_retry(ads, &res, filter, attrs);
328 if (!ADS_ERR_OK(rc) || !res) {
329 DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc)));
330 goto done;
331 }
332
333 count = ads_count_replies(ads, res);
334 if (count == 0) {
335 DEBUG(1,("enum_dom_groups: No groups found\n"));
336 goto done;
337 }
338
339 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
340 if (!*info) {
341 status = NT_STATUS_NO_MEMORY;
342 goto done;
343 }
344
345 i = 0;
346
347 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
348 char *name, *gecos;
349 DOM_SID sid;
350 uint32 rid;
351
352 name = ads_pull_username(ads, mem_ctx, msg);
353 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
354 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
355 DEBUG(1,("No sid for %s !?\n", name));
356 continue;
357 }
358
359 if (!sid_peek_check_rid(&domain->sid, &sid, &rid)) {
360 DEBUG(1,("No rid for %s !?\n", name));
361 continue;
362 }
363
364 fstrcpy((*info)[i].acct_name, name);
365 fstrcpy((*info)[i].acct_desc, gecos);
366 (*info)[i].rid = rid;
367 i++;
368 }
369
370 (*num_entries) = i;
371
372 status = NT_STATUS_OK;
373
374 DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries)));
375
376 done:
377 if (res)
378 ads_msgfree(ads, res);
379
380 return status;
381 }
382
383 /* list all domain local groups */
384 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
385 TALLOC_CTX *mem_ctx,
386 uint32 *num_entries,
387 struct acct_info **info)
388 {
389 /*
390 * This is a stub function only as we returned the domain
391 * local groups in enum_dom_groups() if the domain->native field
392 * was true. This is a simple performance optimization when
393 * using LDAP.
394 *
395 * if we ever need to enumerate domain local groups separately,
396 * then this optimization in enum_dom_groups() will need
397 * to be split out
398 */
399 *num_entries = 0;
400
401 return NT_STATUS_OK;
402 }
403
404 /* convert a single name to a sid in a domain - use rpc methods */
405 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
406 TALLOC_CTX *mem_ctx,
407 const char *domain_name,
408 const char *name,
409 uint32_t flags,
410 DOM_SID *sid,
411 enum lsa_SidType *type)
412 {
413 return reconnect_methods.name_to_sid(domain, mem_ctx,
414 domain_name, name, flags,
415 sid, type);
416 }
417
418 /* convert a domain SID to a user or group name - use rpc methods */
419 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
420 TALLOC_CTX *mem_ctx,
421 const DOM_SID *sid,
422 char **domain_name,
423 char **name,
424 enum lsa_SidType *type)
425 {
426 return reconnect_methods.sid_to_name(domain, mem_ctx, sid,
427 domain_name, name, type);
428 }
429
430 /* convert a list of rids to names - use rpc methods */
431 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
432 TALLOC_CTX *mem_ctx,
433 const DOM_SID *sid,
434 uint32 *rids,
435 size_t num_rids,
436 char **domain_name,
437 char ***names,
438 enum lsa_SidType **types)
439 {
440 return reconnect_methods.rids_to_names(domain, mem_ctx, sid,
441 rids, num_rids,
442 domain_name, names, types);
443 }
444
445 /* If you are looking for "dn_lookup": Yes, it used to be here!
446 * It has gone now since it was a major speed bottleneck in
447 * lookup_groupmem (its only use). It has been replaced by
448 * an rpc lookup sids call... R.I.P. */
449
450 /* Lookup user information from a rid */
451 static NTSTATUS query_user(struct winbindd_domain *domain,
452 TALLOC_CTX *mem_ctx,
453 const DOM_SID *sid,
454 struct wbint_userinfo *info)
455 {
456 ADS_STRUCT *ads = NULL;
457 const char *attrs[] = { "*", NULL };
458 ADS_STATUS rc;
459 int count;
460 LDAPMessage *msg = NULL;
461 char *ldap_exp;
462 char *sidstr;
463 uint32 group_rid;
464 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
465 struct netr_SamInfo3 *user = NULL;
466 gid_t gid;
467
468 DEBUG(3,("ads: query_user\n"));
469
470 info->homedir = NULL;
471 info->shell = NULL;
472 info->primary_gid = (gid_t)-1;
473
474 /* try netsamlogon cache first */
475
476 if ( (user = netsamlogon_cache_get( mem_ctx, sid )) != NULL )
477 {
478 DEBUG(5,("query_user: Cache lookup succeeded for %s\n",
479 sid_string_dbg(sid)));
480
481 sid_compose(&info->user_sid, &domain->sid, user->base.rid);
482 sid_compose(&info->group_sid, &domain->sid, user->base.primary_gid);
483
484 info->acct_name = talloc_strdup(mem_ctx, user->base.account_name.string);
485 info->full_name = talloc_strdup(mem_ctx, user->base.full_name.string);
486
487 nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL,
488 &info->homedir, &info->shell, &info->full_name,
489 &gid );
490 info->primary_gid = gid;
491
492 TALLOC_FREE(user);
493
494 return NT_STATUS_OK;
495 }
496
497 if ( !winbindd_can_contact_domain(domain)) {
498 DEBUG(8,("query_user: No incoming trust from domain %s\n",
499 domain->name));
500
501 /* We still need to generate some basic information
502 about the user even if we cannot contact the
503 domain. Most of this stuff we can deduce. */
504
505 sid_copy( &info->user_sid, sid );
506
507 /* Assume "Domain Users" for the primary group */
508
509 sid_compose(&info->group_sid, &domain->sid, DOMAIN_GROUP_RID_USERS );
510
511 /* Try to fill in what the nss_info backend can do */
512
513 nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL,
514 &info->homedir, &info->shell, &info->full_name,
515 &gid);
516 info->primary_gid = gid;
517
518 status = NT_STATUS_OK;
519 goto done;
520 }
521
522 /* no cache...do the query */
523
524 if ( (ads = ads_cached_connection(domain)) == NULL ) {
525 domain->last_status = NT_STATUS_SERVER_DISABLED;
526 goto done;
527 }
528
529 sidstr = sid_binstring(talloc_tos(), sid);
530 if (asprintf(&ldap_exp, "(objectSid=%s)", sidstr) == -1) {
531 status = NT_STATUS_NO_MEMORY;
532 goto done;
533 }
534 rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
535 free(ldap_exp);
536 TALLOC_FREE(sidstr);
537 if (!ADS_ERR_OK(rc) || !msg) {
538 DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
539 sid_string_dbg(sid), ads_errstr(rc)));
540 goto done;
541 }
542
543 count = ads_count_replies(ads, msg);
544 if (count != 1) {
545 DEBUG(1,("query_user(sid=%s): Not found\n",
546 sid_string_dbg(sid)));
547 goto done;
548 }
549
550 info->acct_name = ads_pull_username(ads, mem_ctx, msg);
551
552 nss_get_info_cached( domain, sid, mem_ctx, ads, msg,
553 &info->homedir, &info->shell, &info->full_name,
554 &gid);
555 info->primary_gid = gid;
556
557 if (info->full_name == NULL) {
558 info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
559 }
560
561 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
562 DEBUG(1,("No primary group for %s !?\n",
563 sid_string_dbg(sid)));
564 goto done;
565 }
566
567 sid_copy(&info->user_sid, sid);
568 sid_compose(&info->group_sid, &domain->sid, group_rid);
569
570 status = NT_STATUS_OK;
571
572 DEBUG(3,("ads query_user gave %s\n", info->acct_name));
573 done:
574 if (msg)
575 ads_msgfree(ads, msg);
576
577 return status;
578 }
579
580 /* Lookup groups a user is a member of - alternate method, for when
581 tokenGroups are not available. */
582 static NTSTATUS lookup_usergroups_member(struct winbindd_domain *domain,
583 TALLOC_CTX *mem_ctx,
584 const char *user_dn,
585 DOM_SID *primary_group,
586 size_t *p_num_groups, DOM_SID **user_sids)
587 {
588 ADS_STATUS rc;
589 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
590 int count;
591 LDAPMessage *res = NULL;
592 LDAPMessage *msg = NULL;
593 char *ldap_exp;
594 ADS_STRUCT *ads;
595 const char *group_attrs[] = {"objectSid", NULL};
596 char *escaped_dn;
597 size_t num_groups = 0;
598
599 DEBUG(3,("ads: lookup_usergroups_member\n"));
600
601 if ( !winbindd_can_contact_domain( domain ) ) {
602 DEBUG(10,("lookup_usergroups_members: No incoming trust for domain %s\n",
603 domain->name));
604 return NT_STATUS_OK;
605 }
606
607 ads = ads_cached_connection(domain);
608
609 if (!ads) {
610 domain->last_status = NT_STATUS_SERVER_DISABLED;
611 goto done;
612 }
613
614 if (!(escaped_dn = escape_ldap_string(talloc_tos(), user_dn))) {
615 status = NT_STATUS_NO_MEMORY;
616 goto done;
617 }
618
619 ldap_exp = talloc_asprintf(mem_ctx,
620 "(&(member=%s)(objectCategory=group)(groupType:dn:%s:=%d))",
621 escaped_dn,
622 ADS_LDAP_MATCHING_RULE_BIT_AND,
623 GROUP_TYPE_SECURITY_ENABLED);
624 if (!ldap_exp) {
625 DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn));
626 TALLOC_FREE(escaped_dn);
627 status = NT_STATUS_NO_MEMORY;
628 goto done;
629 }
630
631 TALLOC_FREE(escaped_dn);
632
633 rc = ads_search_retry(ads, &res, ldap_exp, group_attrs);
634
635 if (!ADS_ERR_OK(rc) || !res) {
636 DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc)));
637 return ads_ntstatus(rc);
638 }
639
640 count = ads_count_replies(ads, res);
641
642 *user_sids = NULL;
643 num_groups = 0;
644
645 /* always add the primary group to the sid array */
646 status = add_sid_to_array(mem_ctx, primary_group, user_sids,
647 &num_groups);
648 if (!NT_STATUS_IS_OK(status)) {
649 goto done;
650 }
651
652 if (count > 0) {
653 for (msg = ads_first_entry(ads, res); msg;
654 msg = ads_next_entry(ads, msg)) {
655 DOM_SID group_sid;
656
657 if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
658 DEBUG(1,("No sid for this group ?!?\n"));
659 continue;
660 }
661
662 /* ignore Builtin groups from ADS - Guenther */
663 if (sid_check_is_in_builtin(&group_sid)) {
664 continue;
665 }
666
667 status = add_sid_to_array(mem_ctx, &group_sid,
668 user_sids, &num_groups);
669 if (!NT_STATUS_IS_OK(status)) {
670 goto done;
671 }
672 }
673
674 }
675
676 *p_num_groups = num_groups;
677 status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
678
679 DEBUG(3,("ads lookup_usergroups (member) succeeded for dn=%s\n", user_dn));
680 done:
681 if (res)
682 ads_msgfree(ads, res);
683
684 return status;
685 }
686
687 /* Lookup groups a user is a member of - alternate method, for when
688 tokenGroups are not available. */
689 static NTSTATUS lookup_usergroups_memberof(struct winbindd_domain *domain,
690 TALLOC_CTX *mem_ctx,
691 const char *user_dn,
692 DOM_SID *primary_group,
693 size_t *p_num_groups,
694 DOM_SID **user_sids)
695 {
696 ADS_STATUS rc;
697 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
698 ADS_STRUCT *ads;
699 const char *attrs[] = {"memberOf", NULL};
700 size_t num_groups = 0;
701 DOM_SID *group_sids = NULL;
702 int i;
703 char **strings = NULL;
704 size_t num_strings = 0, num_sids = 0;
705
706
707 DEBUG(3,("ads: lookup_usergroups_memberof\n"));
708
709 if ( !winbindd_can_contact_domain( domain ) ) {
710 DEBUG(10,("lookup_usergroups_memberof: No incoming trust for "
711 "domain %s\n", domain->name));
712 return NT_STATUS_OK;
713 }
714
715 ads = ads_cached_connection(domain);
716
717 if (!ads) {
718 domain->last_status = NT_STATUS_SERVER_DISABLED;
719 return NT_STATUS_UNSUCCESSFUL;
720 }
721
722 rc = ads_search_retry_extended_dn_ranged(ads, mem_ctx, user_dn, attrs,
723 ADS_EXTENDED_DN_HEX_STRING,
724 &strings, &num_strings);
725
726 if (!ADS_ERR_OK(rc)) {
727 DEBUG(1,("lookup_usergroups_memberof ads_search "
728 "member=%s: %s\n", user_dn, ads_errstr(rc)));
729 return ads_ntstatus(rc);
730 }
731
732 *user_sids = NULL;
733 num_groups = 0;
734
735 /* always add the primary group to the sid array */
736 status = add_sid_to_array(mem_ctx, primary_group, user_sids,
737 &num_groups);
738 if (!NT_STATUS_IS_OK(status)) {
739 goto done;
740 }
741
742 group_sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_strings + 1);
743 if (!group_sids) {
744 status = NT_STATUS_NO_MEMORY;
745 goto done;
746 }
747
748 for (i=0; i<num_strings; i++) {
749 rc = ads_get_sid_from_extended_dn(mem_ctx, strings[i],
750 ADS_EXTENDED_DN_HEX_STRING,
751 &(group_sids)[i]);
752 if (!ADS_ERR_OK(rc)) {
753 /* ignore members without SIDs */
754 if (NT_STATUS_EQUAL(ads_ntstatus(rc),
755 NT_STATUS_NOT_FOUND)) {
756 continue;
757 }
758 else {
759 status = ads_ntstatus(rc);
760 goto done;
761 }
762 }
763 num_sids++;
764 }
765
766 if (i == 0) {
767 DEBUG(1,("No memberOf for this user?!?\n"));
768 status = NT_STATUS_NO_MEMORY;
769 goto done;
770 }
771
772 for (i=0; i<num_sids; i++) {
773
774 /* ignore Builtin groups from ADS - Guenther */
775 if (sid_check_is_in_builtin(&group_sids[i])) {
776 continue;
777 }
778
779 status = add_sid_to_array(mem_ctx, &group_sids[i], user_sids,
780 &num_groups);
781 if (!NT_STATUS_IS_OK(status)) {
782 goto done;
783 }
784
785 }
786
787 *p_num_groups = num_groups;
788 status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
789
790 DEBUG(3,("ads lookup_usergroups (memberof) succeeded for dn=%s\n",
791 user_dn));
792
793 done:
794 TALLOC_FREE(strings);
795 TALLOC_FREE(group_sids);
796
797 return status;
798 }
799
800
801 /* Lookup groups a user is a member of. */
802 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
803 TALLOC_CTX *mem_ctx,
804 const DOM_SID *sid,
805 uint32 *p_num_groups, DOM_SID **user_sids)
806 {
807 ADS_STRUCT *ads = NULL;
808 const char *attrs[] = {"tokenGroups", "primaryGroupID", NULL};
809 ADS_STATUS rc;
810 int count;
811 LDAPMessage *msg = NULL;
812 char *user_dn = NULL;
813 DOM_SID *sids;
814 int i;
815 DOM_SID primary_group;
816 uint32 primary_group_rid;
817 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
818 size_t num_groups = 0;
819
820 DEBUG(3,("ads: lookup_usergroups\n"));
821 *p_num_groups = 0;
822
823 status = lookup_usergroups_cached(domain, mem_ctx, sid,
824 p_num_groups, user_sids);
825 if (NT_STATUS_IS_OK(status)) {
826 return NT_STATUS_OK;
827 }
828
829 if ( !winbindd_can_contact_domain( domain ) ) {
830 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
831 domain->name));
832
833 /* Tell the cache manager not to remember this one */
834
835 return NT_STATUS_SYNCHRONIZATION_REQUIRED;
836 }
837
838 ads = ads_cached_connection(domain);
839
840 if (!ads) {
841 domain->last_status = NT_STATUS_SERVER_DISABLED;
842 status = NT_STATUS_SERVER_DISABLED;
843 goto done;
844 }
845
846 rc = ads_search_retry_sid(ads, &msg, sid, attrs);
847
848 if (!ADS_ERR_OK(rc)) {
849 status = ads_ntstatus(rc);
850 DEBUG(1, ("lookup_usergroups(sid=%s) ads_search tokenGroups: "
851 "%s\n", sid_string_dbg(sid), ads_errstr(rc)));
852 goto done;
853 }
854
855 count = ads_count_replies(ads, msg);
856 if (count != 1) {
857 status = NT_STATUS_UNSUCCESSFUL;
858 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
859 "invalid number of results (count=%d)\n",
860 sid_string_dbg(sid), count));
861 goto done;
862 }
863
864 if (!msg) {
865 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
866 sid_string_dbg(sid)));
867 status = NT_STATUS_UNSUCCESSFUL;
868 goto done;
869 }
870
871 user_dn = ads_get_dn(ads, mem_ctx, msg);
872 if (user_dn == NULL) {
873 status = NT_STATUS_NO_MEMORY;
874 goto done;
875 }
876
877 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
878 DEBUG(1,("%s: No primary group for sid=%s !?\n",
879 domain->name, sid_string_dbg(sid)));
880 goto done;
881 }
882
883 sid_compose(&primary_group, &domain->sid, primary_group_rid);
884
885 count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
886
887 /* there must always be at least one group in the token,
888 unless we are talking to a buggy Win2k server */
889
890 /* actually this only happens when the machine account has no read
891 * permissions on the tokenGroup attribute - gd */
892
893 if (count == 0) {
894
895 /* no tokenGroups */
896
897 /* lookup what groups this user is a member of by DN search on
898 * "memberOf" */
899
900 status = lookup_usergroups_memberof(domain, mem_ctx, user_dn,
901 &primary_group,
902 &num_groups, user_sids);
903 *p_num_groups = (uint32)num_groups;
904 if (NT_STATUS_IS_OK(status)) {
905 goto done;
906 }
907
908 /* lookup what groups this user is a member of by DN search on
909 * "member" */
910
911 status = lookup_usergroups_member(domain, mem_ctx, user_dn,
912 &primary_group,
913 &num_groups, user_sids);
914 *p_num_groups = (uint32)num_groups;
915 goto done;
916 }
917
918 *user_sids = NULL;
919 num_groups = 0;
920
921 status = add_sid_to_array(mem_ctx, &primary_group, user_sids,
922 &num_groups);
923 if (!NT_STATUS_IS_OK(status)) {
924 goto done;
925 }
926
927 for (i=0;i<count;i++) {
928
929 /* ignore Builtin groups from ADS - Guenther */
930 if (sid_check_is_in_builtin(&sids[i])) {
931 continue;
932 }
933
934 status = add_sid_to_array_unique(mem_ctx, &sids[i],
935 user_sids, &num_groups);
936 if (!NT_STATUS_IS_OK(status)) {
937 goto done;
938 }
939 }
940
941 *p_num_groups = (uint32)num_groups;
942 status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
943
944 DEBUG(3,("ads lookup_usergroups (tokenGroups) succeeded for sid=%s\n",
945 sid_string_dbg(sid)));
946 done:
947 TALLOC_FREE(user_dn);
948 ads_msgfree(ads, msg);
949 return status;
950 }
951
952 /* Lookup aliases a user is member of - use rpc methods */
953 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
954 TALLOC_CTX *mem_ctx,
955 uint32 num_sids, const DOM_SID *sids,
956 uint32 *num_aliases, uint32 **alias_rids)
957 {
958 return reconnect_methods.lookup_useraliases(domain, mem_ctx,
959 num_sids, sids,
960 num_aliases,
961 alias_rids);
962 }
963
964 /*
965 find the members of a group, given a group rid and domain
966 */
967 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
968 TALLOC_CTX *mem_ctx,
969 const DOM_SID *group_sid,
970 enum lsa_SidType type,
971 uint32 *num_names,
972 DOM_SID **sid_mem, char ***names,
973 uint32 **name_types)
974 {
975 ADS_STATUS rc;
976 ADS_STRUCT *ads = NULL;
977 char *ldap_exp;
978 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
979 char *sidbinstr;
980 char **members = NULL;
981 int i;
982 size_t num_members = 0;
983 ads_control args;
984 DOM_SID *sid_mem_nocache = NULL;
985 char **names_nocache = NULL;
986 enum lsa_SidType *name_types_nocache = NULL;
987 char **domains_nocache = NULL; /* only needed for rpccli_lsa_lookup_sids */
988 uint32 num_nocache = 0;
989 TALLOC_CTX *tmp_ctx = NULL;
990
991 DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
992 sid_string_dbg(group_sid)));
993
994 *num_names = 0;
995
996 tmp_ctx = talloc_new(mem_ctx);
997 if (!tmp_ctx) {
998 DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
999 status = NT_STATUS_NO_MEMORY;
1000 goto done;
1001 }
1002
1003 if ( !winbindd_can_contact_domain( domain ) ) {
1004 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
1005 domain->name));
1006 return NT_STATUS_OK;
1007 }
1008
1009 ads = ads_cached_connection(domain);
1010
1011 if (!ads) {
1012 domain->last_status = NT_STATUS_SERVER_DISABLED;
1013 goto done;
1014 }
1015
1016 if ((sidbinstr = sid_binstring(talloc_tos(), group_sid)) == NULL) {
1017 status = NT_STATUS_NO_MEMORY;
1018 goto done;
1019 }
1020
1021 /* search for all members of the group */
1022 ldap_exp = talloc_asprintf(tmp_ctx, "(objectSid=%s)", sidbinstr);
1023 TALLOC_FREE(sidbinstr);
1024 if (ldap_exp == NULL) {
1025 DEBUG(1, ("ads: lookup_groupmem: talloc_asprintf for ldap_exp failed!\n"));
1026 status = NT_STATUS_NO_MEMORY;
1027 goto done;
1028 }
1029
1030 args.control = ADS_EXTENDED_DN_OID;
1031 args.val = ADS_EXTENDED_DN_HEX_STRING;
1032 args.critical = True;
1033
1034 rc = ads_ranged_search(ads, tmp_ctx, LDAP_SCOPE_SUBTREE, ads->config.bind_path,
1035 ldap_exp, &args, "member", &members, &num_members);
1036
1037 if (!ADS_ERR_OK(rc)) {
1038 DEBUG(0,("ads_ranged_search failed with: %s\n", ads_errstr(rc)));
1039 status = NT_STATUS_UNSUCCESSFUL;
1040 goto done;
1041 }
1042
1043 DEBUG(10, ("ads lookup_groupmem: got %d sids via extended dn call\n", (int)num_members));
1044
1045 /* Now that we have a list of sids, we need to get the
1046 * lists of names and name_types belonging to these sids.
1047 * even though conceptually not quite clean, we use the
1048 * RPC call lsa_lookup_sids for this since it can handle a
1049 * list of sids. ldap calls can just resolve one sid at a time.
1050 *
1051 * At this stage, the sids are still hidden in the exetended dn
1052 * member output format. We actually do a little better than
1053 * stated above: In extracting the sids from the member strings,
1054 * we try to resolve as many sids as possible from the
1055 * cache. Only the rest is passed to the lsa_lookup_sids call. */
1056
1057 if (num_members) {
1058 (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
1059 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
1060 (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
1061 (sid_mem_nocache) = TALLOC_ZERO_ARRAY(tmp_ctx, DOM_SID, num_members);
1062
1063 if ((members == NULL) || (*sid_mem == NULL) ||
1064 (*names == NULL) || (*name_types == NULL) ||
1065 (sid_mem_nocache == NULL))
1066 {
1067 DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
1068 status = NT_STATUS_NO_MEMORY;
1069 goto done;
1070 }
1071 }
1072 else {
1073 (*sid_mem) = NULL;
1074 (*names) = NULL;
1075 (*name_types) = NULL;
1076 }
1077
1078 for (i=0; i<num_members; i++) {
1079 enum lsa_SidType name_type;
1080 char *name, *domain_name;
1081 DOM_SID sid;
1082
1083 rc = ads_get_sid_from_extended_dn(tmp_ctx, members[i], args.val,
1084 &sid);
1085 if (!ADS_ERR_OK(rc)) {
1086 if (NT_STATUS_EQUAL(ads_ntstatus(rc),
1087 NT_STATUS_NOT_FOUND)) {
1088 /* Group members can be objects, like Exchange
1089 * Public Folders, that don't have a SID. Skip
1090 * them. */
1091 continue;
1092 }
1093 else {
1094 status = ads_ntstatus(rc);
1095 goto done;
1096 }
1097 }
1098 if (lookup_cached_sid(mem_ctx, &sid, &domain_name, &name,
1099 &name_type)) {
1100 DEBUG(10,("ads: lookup_groupmem: got sid %s from "
1101 "cache\n", sid_string_dbg(&sid)));
1102 sid_copy(&(*sid_mem)[*num_names], &sid);
1103 (*names)[*num_names] = fill_domain_username_talloc(
1104 *names,
1105 domain_name,
1106 name,
1107 true);
1108
1109 (*name_types)[*num_names] = name_type;
1110 (*num_names)++;
1111 }
1112 else {
1113 DEBUG(10, ("ads: lookup_groupmem: sid %s not found in "
1114 "cache\n", sid_string_dbg(&sid)));
1115 sid_copy(&(sid_mem_nocache)[num_nocache], &sid);
1116 num_nocache++;
1117 }
1118 }
1119
1120 DEBUG(10, ("ads: lookup_groupmem: %d sids found in cache, "
1121 "%d left for lsa_lookupsids\n", *num_names, num_nocache));
1122
1123 /* handle sids not resolved from cache by lsa_lookup_sids */
1124 if (num_nocache > 0) {
1125
1126 status = winbindd_lookup_sids(tmp_ctx,
1127 domain,
1128 num_nocache,
1129 sid_mem_nocache,
1130 &domains_nocache,
1131 &names_nocache,
1132 &name_types_nocache);
1133
1134 if (!(NT_STATUS_IS_OK(status) ||
1135 NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED) ||
1136 NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)))
1137 {
1138 DEBUG(1, ("lsa_lookupsids call failed with %s "
1139 "- retrying...\n", nt_errstr(status)));
1140
1141 status = winbindd_lookup_sids(tmp_ctx,
1142 domain,
1143 num_nocache,
1144 sid_mem_nocache,
1145 &domains_nocache,
1146 &names_nocache,
1147 &name_types_nocache);
1148 }
1149
1150 if (NT_STATUS_IS_OK(status) ||
1151 NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED))
1152 {
1153 /* Copy the entries over from the "_nocache" arrays
1154 * to the result arrays, skipping the gaps the
1155 * lookup_sids call left. */
1156 for (i=0; i < num_nocache; i++) {
1157 if (((names_nocache)[i] != NULL) &&
1158 ((name_types_nocache)[i] != SID_NAME_UNKNOWN))
1159 {
1160 sid_copy(&(*sid_mem)[*num_names],
1161 &sid_mem_nocache[i]);
1162 (*names)[*num_names] =
1163 fill_domain_username_talloc(
1164 *names,
1165 domains_nocache[i],
1166 names_nocache[i],
1167 true);
1168 (*name_types)[*num_names] = name_types_nocache[i];
1169 (*num_names)++;
1170 }
1171 }
1172 }
1173 else if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1174 DEBUG(10, ("lookup_groupmem: lsa_lookup_sids could "
1175 "not map any SIDs at all.\n"));
1176 /* Don't handle this as an error here.
1177 * There is nothing left to do with respect to the
1178 * overall result... */
1179 }
1180 else if (!NT_STATUS_IS_OK(status)) {
1181 DEBUG(10, ("lookup_groupmem: Error looking up %d "
1182 "sids via rpc_lsa_lookup_sids: %s\n",
1183 (int)num_members, nt_errstr(status)));
1184 goto done;
1185 }
1186 }
1187
1188 status = NT_STATUS_OK;
1189 DEBUG(3,("ads lookup_groupmem for sid=%s succeeded\n",
1190 sid_string_dbg(group_sid)));
1191
1192 done:
1193
1194 TALLOC_FREE(tmp_ctx);
1195
1196 return status;
1197 }
1198
1199 /* find the sequence number for a domain */
1200 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
1201 {
1202 ADS_STRUCT *ads = NULL;
1203 ADS_STATUS rc;
1204
1205 DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
1206
1207 if ( !winbindd_can_contact_domain( domain ) ) {
1208 DEBUG(10,("sequence: No incoming trust for domain %s\n",
1209 domain->name));
1210 *seq = time(NULL);
1211 return NT_STATUS_OK;
1212 }
1213
1214 *seq = DOM_SEQUENCE_NONE;
1215
1216 ads = ads_cached_connection(domain);
1217
1218 if (!ads) {
1219 domain->last_status = NT_STATUS_SERVER_DISABLED;
1220 return NT_STATUS_UNSUCCESSFUL;
1221 }
1222
1223 rc = ads_USN(ads, seq);
1224
1225 if (!ADS_ERR_OK(rc)) {
1226
1227 /* its a dead connection, destroy it */
1228
1229 if (domain->private_data) {
1230 ads = (ADS_STRUCT *)domain->private_data;
1231 ads->is_mine = True;
1232 ads_destroy(&ads);
1233 ads_kdestroy("MEMORY:winbind_ccache");
1234 domain->private_data = NULL;
1235 }
1236 }
1237 return ads_ntstatus(rc);
1238 }
1239
1240 /* find the lockout policy of a domain - use rpc methods */
1241 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
1242 TALLOC_CTX *mem_ctx,
1243 struct samr_DomInfo12 *policy)
1244 {
1245 return reconnect_methods.lockout_policy(domain, mem_ctx, policy);
1246 }
1247
1248 /* find the password policy of a domain - use rpc methods */
1249 static NTSTATUS password_policy(struct winbindd_domain *domain,
1250 TALLOC_CTX *mem_ctx,
1251 struct samr_DomInfo1 *policy)
1252 {
1253 return reconnect_methods.password_policy(domain, mem_ctx, policy);
1254 }
1255
1256 /* get a list of trusted domains */
1257 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
1258 TALLOC_CTX *mem_ctx,
1259 struct netr_DomainTrustList *trusts)
1260 {
1261 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1262 int i;
1263 uint32 flags;
1264 struct rpc_pipe_client *cli;
1265 int ret_count;
1266
1267 DEBUG(3,("ads: trusted_domains\n"));
1268
1269 ZERO_STRUCTP(trusts);
1270
1271 /* If this is our primary domain or a root in our forest,
1272 query for all trusts. If not, then just look for domain
1273 trusts in the target forest */
1274
1275 if (domain->primary || domain_is_forest_root(domain)) {
1276 flags = NETR_TRUST_FLAG_OUTBOUND |
1277 NETR_TRUST_FLAG_INBOUND |
1278 NETR_TRUST_FLAG_IN_FOREST;
1279 } else {
1280 flags = NETR_TRUST_FLAG_IN_FOREST;
1281 }
1282
1283 result = cm_connect_netlogon(domain, &cli);
1284
1285 if (!NT_STATUS_IS_OK(result)) {
1286 DEBUG(5, ("trusted_domains: Could not open a connection to %s "
1287 "for PIPE_NETLOGON (%s)\n",
1288 domain->name, nt_errstr(result)));
1289 return NT_STATUS_UNSUCCESSFUL;
1290 }
1291
1292 result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1293 cli->desthost,
1294 flags,
1295 trusts,
1296 NULL);
1297 if (!NT_STATUS_IS_OK(result)) {
1298 return result;
1299 }
1300 if (trusts->count == 0) {
1301 return NT_STATUS_OK;
1302 }
1303
1304 /* Copy across names and sids */
1305
1306 ret_count = 0;
1307 for (i = 0; i < trusts->count; i++) {
1308 struct netr_DomainTrust *trust = &trusts->array[i];
1309 struct winbindd_domain d;
1310
1311 ZERO_STRUCT(d);
1312
1313 /*
1314 * drop external trusts if this is not our primary
1315 * domain. This means that the returned number of
1316 * domains may be less that the ones actually trusted
1317 * by the DC.
1318 */
1319
1320 if ((trust->trust_attributes
1321 == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) &&
1322 !domain->primary )
1323 {
1324 DEBUG(10,("trusted_domains: Skipping external trusted "
1325 "domain %s because it is outside of our "
1326 "primary domain\n",
1327 trust->netbios_name));
1328 continue;
1329 }
1330
1331 /* add to the trusted domain cache */
1332
1333 fstrcpy(d.name, trust->netbios_name);
1334 fstrcpy(d.alt_name, trust->dns_name);
1335 if (trust->sid) {
1336 sid_copy(&d.sid, trust->sid);
1337 } else {
1338 sid_copy(&d.sid, &global_sid_NULL);
1339 }
1340
1341 if ( domain->primary ) {
1342 DEBUG(10,("trusted_domains(ads): Searching "
1343 "trusted domain list of %s and storing "
1344 "trust flags for domain %s\n",
1345 domain->name, d.alt_name));
1346
1347 d.domain_flags = trust->trust_flags;
1348 d.domain_type = trust->trust_type;
1349 d.domain_trust_attribs = trust->trust_attributes;
1350
1351 wcache_tdc_add_domain( &d );
1352 ret_count++;
1353 } else if (domain_is_forest_root(domain)) {
1354 /* Check if we already have this record. If
1355 * we are following our forest root that is not
1356 * our primary domain, we want to keep trust
1357 * flags from the perspective of our primary
1358 * domain not our forest root. */
1359 struct winbindd_tdc_domain *exist = NULL;
1360
1361 exist = wcache_tdc_fetch_domain(
1362 talloc_tos(), trust->netbios_name);
1363 if (!exist) {
1364 DEBUG(10,("trusted_domains(ads): Searching "
1365 "trusted domain list of %s and "
1366 "storing trust flags for domain "
1367 "%s\n", domain->name, d.alt_name));
1368 d.domain_flags = trust->trust_flags;
1369 d.domain_type = trust->trust_type;
1370 d.domain_trust_attribs =
1371 trust->trust_attributes;
1372
1373 wcache_tdc_add_domain( &d );
1374 ret_count++;
1375 }
1376 TALLOC_FREE(exist);
1377 } else {
1378 /* This gets a little tricky. If we are
1379 following a transitive forest trust, then
1380 innerit the flags, type, and attribs from
1381 the domain we queried to make sure we don't
1382 record the view of the trust from the wrong
1383 side. Always view it from the side of our
1384 primary domain. --jerry */
1385 struct winbindd_tdc_domain *parent = NULL;
1386
1387 DEBUG(10,("trusted_domains(ads): Searching "
1388 "trusted domain list of %s and inheriting "
1389 "trust flags for domain %s\n",
1390 domain->name, d.alt_name));
1391
1392 parent = wcache_tdc_fetch_domain(talloc_tos(),
1393 domain->name);
1394 if (parent) {
1395 d.domain_flags = parent->trust_flags;
1396 d.domain_type = parent->trust_type;
1397 d.domain_trust_attribs = parent->trust_attribs;
1398 } else {
1399 d.domain_flags = domain->domain_flags;
1400 d.domain_type = domain->domain_type;
1401 d.domain_trust_attribs =
1402 domain->domain_trust_attribs;
1403 }
1404 TALLOC_FREE(parent);
1405
1406 wcache_tdc_add_domain( &d );
1407 ret_count++;
1408 }
1409 }
1410 return result;
1411 }
1412
1413 /* the ADS backend methods are exposed via this structure */
1414 struct winbindd_methods ads_methods = {
1415 True,
1416 query_user_list,
1417 enum_dom_groups,
1418 enum_local_groups,
1419 name_to_sid,
1420 sid_to_name,
1421 rids_to_names,
1422 query_user,
1423 lookup_usergroups,
1424 lookup_useraliases,
1425 lookup_groupmem,
1426 sequence_number,
1427 lockout_policy,
1428 password_policy,
1429 trusted_domains,
1430 };
1431
1432 #endif