source3/nsswitch/winbindd_ads.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind ADS backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
   8    Copyright (C) Gerald (Jerry) Carter 2004
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "winbindd.h"
  27
  28 #ifdef HAVE_ADS
  29
  30 #undef DBGC_CLASS
  31 #define DBGC_CLASS DBGC_WINBIND
  32
  33 /*
  34   return our ads connections structure for a domain. We keep the connection
  35   open to make things faster
  36 */
  37 static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
  38 {
  39         ADS_STRUCT *ads;
  40         ADS_STATUS status;
  41
  42         if (domain->private_data) {
  43                 ads = (ADS_STRUCT *)domain->private_data;
  44
  45                 /* check for a valid structure */
  46
  47                 DEBUG(7, ("Current tickets expire at %d, time is now %d\n",
  48                           (uint32) ads->auth.expire, (uint32) time(NULL)));
  49                 if ( ads->config.realm && (ads->auth.expire > time(NULL))) {
  50                         return ads;
  51                 }
  52                 else {
  53                         /* we own this ADS_STRUCT so make sure it goes away */
  54                         ads->is_mine = True;
  55                         ads_destroy( &ads );
  56                         ads_kdestroy("MEMORY:winbind_ccache");
  57                         domain->private_data = NULL;
  58                 }
  59         }
  60
  61         /* we don't want this to affect the users ccache */
  62         setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
  63
  64         ads = ads_init(domain->alt_name, domain->name, NULL);
  65         if (!ads) {
  66                 DEBUG(1,("ads_init for domain %s failed\n", domain->name));
  67                 return NULL;
  68         }
  69
  70         /* the machine acct password might have change - fetch it every time */
  71
  72         SAFE_FREE(ads->auth.password);
  73         SAFE_FREE(ads->auth.realm);
  74
  75         if ( IS_DC ) {
  76                 DOM_SID sid;
  77                 time_t last_set_time;
  78
  79                 if ( !secrets_fetch_trusted_domain_password( domain->name, &ads->auth.password, &sid, &last_set_time ) ) {
  80                         ads_destroy( &ads );
  81                         return NULL;
  82                 }
  83                 ads->auth.realm = SMB_STRDUP( ads->server.realm );
  84                 strupper_m( ads->auth.realm );
  85         }
  86         else {
  87                 struct winbindd_domain *our_domain = domain;
  88
  89                 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
  90
  91                 /* always give preference to the alt_name in our
  92                    primary domain if possible */
  93
  94                 if ( !domain->primary )
  95                         our_domain = find_our_domain();
  96
  97                 if ( our_domain->alt_name[0] != '\0' ) {
  98                         ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
  99                         strupper_m( ads->auth.realm );
 100                 }
 101                 else
 102                         ads->auth.realm = SMB_STRDUP( lp_realm() );
 103         }
 104
 105         status = ads_connect(ads);
 106         if (!ADS_ERR_OK(status) || !ads->config.realm) {
 107                 extern struct winbindd_methods msrpc_methods, cache_methods;
 108                 DEBUG(1,("ads_connect for domain %s failed: %s\n",
 109                          domain->name, ads_errstr(status)));
 110                 ads_destroy(&ads);
 111
 112                 /* if we get ECONNREFUSED then it might be a NT4
 113                    server, fall back to MSRPC */
 114                 if (status.error_type == ENUM_ADS_ERROR_SYSTEM &&
 115                     status.err.rc == ECONNREFUSED) {
 116                         DEBUG(1,("Trying MSRPC methods\n"));
 117                         if (domain->methods == &cache_methods) {
 118                                 domain->backend = &msrpc_methods;
 119                         } else {
 120                                 domain->methods = &msrpc_methods;
 121                         }
 122                 }
 123                 return NULL;
 124         }
 125
 126         if (use_nss_info("sfu") && (!ads_check_sfu_mapping(ads))) {
 127                 DEBUG(0,("ads_cached_connection: failed to check sfu attributes\n"));
 128                 return NULL;
 129         }
 130
 131         /* set the flag that says we don't own the memory even
 132            though we do so that ads_destroy() won't destroy the
 133            structure we pass back by reference */
 134
 135         ads->is_mine = False;
 136
 137         domain->private_data = (void *)ads;
 138         return ads;
 139 }
 140
 141
 142 /* Query display info for a realm. This is the basic user list fn */
 143 static NTSTATUS query_user_list(struct winbindd_domain *domain,
 144                                TALLOC_CTX *mem_ctx,
 145                                uint32 *num_entries,
 146                                WINBIND_USERINFO **info)
 147 {
 148         ADS_STRUCT *ads = NULL;
 149         const char *attrs[] = {"userPrincipalName",
 150                                "sAMAccountName",
 151                                "name", "objectSid", "primaryGroupID",
 152                                "sAMAccountType",
 153                                ADS_ATTR_SFU_HOMEDIR_OID,
 154                                ADS_ATTR_SFU_SHELL_OID,
 155                                NULL};
 156         int i, count;
 157         ADS_STATUS rc;
 158         void *res = NULL;
 159         void *msg = NULL;
 160         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 161
 162         *num_entries = 0;
 163
 164         DEBUG(3,("ads: query_user_list\n"));
 165
 166         ads = ads_cached_connection(domain);
 167
 168         if (!ads) {
 169                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 170                 goto done;
 171         }
 172
 173         rc = ads_search_retry(ads, &res, "(objectClass=user)", attrs);
 174         if (!ADS_ERR_OK(rc) || !res) {
 175                 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
 176                 goto done;
 177         }
 178
 179         count = ads_count_replies(ads, res);
 180         if (count == 0) {
 181                 DEBUG(1,("query_user_list: No users found\n"));
 182                 goto done;
 183         }
 184
 185         (*info) = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, count);
 186         if (!*info) {
 187                 status = NT_STATUS_NO_MEMORY;
 188                 goto done;
 189         }
 190
 191         i = 0;
 192
 193         for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
 194                 char *name, *gecos;
 195                 char *homedir = NULL;
 196                 char *shell = NULL;
 197                 uint32 group;
 198                 uint32 atype;
 199
 200                 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
 201                     ads_atype_map(atype) != SID_NAME_USER) {
 202                         DEBUG(1,("Not a user account? atype=0x%x\n", atype));
 203                         continue;
 204                 }
 205
 206                 name = ads_pull_username(ads, mem_ctx, msg);
 207                 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
 208                 if (use_nss_info("sfu")) {
 209                         homedir = ads_pull_string(ads, mem_ctx, msg, ads->schema.sfu_homedir_attr);
 210                         shell = ads_pull_string(ads, mem_ctx, msg, ads->schema.sfu_shell_attr);
 211                 }
 212
 213                 if (!ads_pull_sid(ads, msg, "objectSid",
 214                                   &(*info)[i].user_sid)) {
 215                         DEBUG(1,("No sid for %s !?\n", name));
 216                         continue;
 217                 }
 218                 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
 219                         DEBUG(1,("No primary group for %s !?\n", name));
 220                         continue;
 221                 }
 222
 223                 (*info)[i].acct_name = name;
 224                 (*info)[i].full_name = gecos;
 225                 (*info)[i].homedir = homedir;
 226                 (*info)[i].shell = shell;
 227                 sid_compose(&(*info)[i].group_sid, &domain->sid, group);
 228                 i++;
 229         }
 230
 231         (*num_entries) = i;
 232         status = NT_STATUS_OK;
 233
 234         DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries)));
 235
 236 done:
 237         if (res)
 238                 ads_msgfree(ads, res);
 239
 240         return status;
 241 }
 242
 243 /* list all domain groups */
 244 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
 245                                 TALLOC_CTX *mem_ctx,
 246                                 uint32 *num_entries,
 247                                 struct acct_info **info)
 248 {
 249         ADS_STRUCT *ads = NULL;
 250         const char *attrs[] = {"userPrincipalName", "sAMAccountName",
 251                                "name", "objectSid", NULL};
 252         int i, count;
 253         ADS_STATUS rc;
 254         void *res = NULL;
 255         void *msg = NULL;
 256         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 257         const char *filter;
 258         BOOL enum_dom_local_groups = False;
 259
 260         *num_entries = 0;
 261
 262         DEBUG(3,("ads: enum_dom_groups\n"));
 263
 264         /* only grab domain local groups for our domain */
 265         if ( domain->native_mode && strequal(lp_realm(), domain->alt_name)  ) {
 266                 enum_dom_local_groups = True;
 267         }
 268
 269         /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
 270          * rollup-fixes:
 271          *
 272          * According to Section 5.1(4) of RFC 2251 if a value of a type is it's
 273          * default value, it MUST be absent. In case of extensible matching the
 274          * "dnattr" boolean defaults to FALSE and so it must be only be present
 275          * when set to TRUE.
 276          *
 277          * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
 278          * filter using bitwise matching rule then the buggy AD fails to decode
 279          * the extensible match. As a workaround set it to TRUE and thereby add
 280          * the dnAttributes "dn" field to cope with those older AD versions.
 281          * It should not harm and won't put any additional load on the AD since
 282          * none of the dn components have a bitmask-attribute.
 283          *
 284          * Thanks to Ralf Haferkamp for input and testing - Guenther */
 285
 286         filter = talloc_asprintf(mem_ctx, "(&(objectCategory=group)(&(groupType:dn:%s:=%d)(!(groupType:dn:%s:=%d))))",
 287                                  ADS_LDAP_MATCHING_RULE_BIT_AND, GROUP_TYPE_SECURITY_ENABLED,
 288                                  ADS_LDAP_MATCHING_RULE_BIT_AND,
 289                                  enum_dom_local_groups ? GROUP_TYPE_BUILTIN_LOCAL_GROUP : GROUP_TYPE_RESOURCE_GROUP);
 290
 291         if (filter == NULL) {
 292                 status = NT_STATUS_NO_MEMORY;
 293                 goto done;
 294         }
 295
 296         ads = ads_cached_connection(domain);
 297
 298         if (!ads) {
 299                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 300                 goto done;
 301         }
 302
 303         rc = ads_search_retry(ads, &res, filter, attrs);
 304         if (!ADS_ERR_OK(rc) || !res) {
 305                 DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc)));
 306                 goto done;
 307         }
 308
 309         count = ads_count_replies(ads, res);
 310         if (count == 0) {
 311                 DEBUG(1,("enum_dom_groups: No groups found\n"));
 312                 goto done;
 313         }
 314
 315         (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
 316         if (!*info) {
 317                 status = NT_STATUS_NO_MEMORY;
 318                 goto done;
 319         }
 320
 321         i = 0;
 322
 323         for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
 324                 char *name, *gecos;
 325                 DOM_SID sid;
 326                 uint32 rid;
 327
 328                 name = ads_pull_username(ads, mem_ctx, msg);
 329                 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
 330                 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
 331                         DEBUG(1,("No sid for %s !?\n", name));
 332                         continue;
 333                 }
 334
 335                 if (!sid_peek_check_rid(&domain->sid, &sid, &rid)) {
 336                         DEBUG(1,("No rid for %s !?\n", name));
 337                         continue;
 338                 }
 339
 340                 fstrcpy((*info)[i].acct_name, name);
 341                 fstrcpy((*info)[i].acct_desc, gecos);
 342                 (*info)[i].rid = rid;
 343                 i++;
 344         }
 345
 346         (*num_entries) = i;
 347
 348         status = NT_STATUS_OK;
 349
 350         DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries)));
 351
 352 done:
 353         if (res)
 354                 ads_msgfree(ads, res);
 355
 356         return status;
 357 }
 358
 359 /* list all domain local groups */
 360 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
 361                                 TALLOC_CTX *mem_ctx,
 362                                 uint32 *num_entries,
 363                                 struct acct_info **info)
 364 {
 365         /*
 366          * This is a stub function only as we returned the domain
 367          * local groups in enum_dom_groups() if the domain->native field
 368          * was true.  This is a simple performance optimization when
 369          * using LDAP.
 370          *
 371          * if we ever need to enumerate domain local groups separately,
 372          * then this the optimization in enum_dom_groups() will need
 373          * to be split out
 374          */
 375         *num_entries = 0;
 376
 377         return NT_STATUS_OK;
 378 }
 379
 380 /* convert a DN to a name, SID and name type
 381    this might become a major speed bottleneck if groups have
 382    lots of users, in which case we could cache the results
 383 */
 384 static BOOL dn_lookup(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
 385                       const char *dn,
 386                       char **name, uint32 *name_type, DOM_SID *sid)
 387 {
 388         void *res = NULL;
 389         const char *attrs[] = {"userPrincipalName", "sAMAccountName",
 390                                "objectSid", "sAMAccountType", NULL};
 391         ADS_STATUS rc;
 392         uint32 atype;
 393         DEBUG(3,("ads: dn_lookup\n"));
 394
 395         rc = ads_search_retry_dn(ads, &res, dn, attrs);
 396
 397         if (!ADS_ERR_OK(rc) || !res) {
 398                 goto failed;
 399         }
 400
 401         (*name) = ads_pull_username(ads, mem_ctx, res);
 402
 403         if (!ads_pull_uint32(ads, res, "sAMAccountType", &atype)) {
 404                 goto failed;
 405         }
 406         (*name_type) = ads_atype_map(atype);
 407
 408         if (!ads_pull_sid(ads, res, "objectSid", sid)) {
 409                 goto failed;
 410         }
 411
 412         if (res)
 413                 ads_msgfree(ads, res);
 414
 415         return True;
 416
 417 failed:
 418         if (res)
 419                 ads_msgfree(ads, res);
 420
 421         return False;
 422 }
 423
 424 /* Lookup user information from a rid */
 425 static NTSTATUS query_user(struct winbindd_domain *domain,
 426                            TALLOC_CTX *mem_ctx,
 427                            const DOM_SID *sid,
 428                            WINBIND_USERINFO *info)
 429 {
 430         ADS_STRUCT *ads = NULL;
 431         const char *attrs[] = {"userPrincipalName",
 432                                "sAMAccountName",
 433                                "name",
 434                                "primaryGroupID",
 435                                ADS_ATTR_SFU_HOMEDIR_OID,
 436                                ADS_ATTR_SFU_SHELL_OID,
 437                                NULL};
 438         ADS_STATUS rc;
 439         int count;
 440         void *msg = NULL;
 441         char *ldap_exp;
 442         char *sidstr;
 443         uint32 group_rid;
 444         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 445
 446         DEBUG(3,("ads: query_user\n"));
 447
 448         ads = ads_cached_connection(domain);
 449
 450         if (!ads) {
 451                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 452                 goto done;
 453         }
 454
 455         sidstr = sid_binstring(sid);
 456         asprintf(&ldap_exp, "(objectSid=%s)", sidstr);
 457         rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
 458         free(ldap_exp);
 459         free(sidstr);
 460         if (!ADS_ERR_OK(rc) || !msg) {
 461                 DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
 462                          sid_string_static(sid), ads_errstr(rc)));
 463                 goto done;
 464         }
 465
 466         count = ads_count_replies(ads, msg);
 467         if (count != 1) {
 468                 DEBUG(1,("query_user(sid=%s): Not found\n",
 469                          sid_string_static(sid)));
 470                 goto done;
 471         }
 472
 473         info->acct_name = ads_pull_username(ads, mem_ctx, msg);
 474         info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
 475
 476         if (use_nss_info("sfu")) {
 477                 info->homedir = ads_pull_string(ads, mem_ctx, msg, ads->schema.sfu_homedir_attr);
 478                 info->shell = ads_pull_string(ads, mem_ctx, msg, ads->schema.sfu_shell_attr);
 479         }
 480
 481         if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
 482                 DEBUG(1,("No primary group for %s !?\n",
 483                          sid_string_static(sid)));
 484                 goto done;
 485         }
 486
 487         sid_copy(&info->user_sid, sid);
 488         sid_compose(&info->group_sid, &domain->sid, group_rid);
 489
 490         status = NT_STATUS_OK;
 491
 492         DEBUG(3,("ads query_user gave %s\n", info->acct_name));
 493 done:
 494         if (msg)
 495                 ads_msgfree(ads, msg);
 496
 497         return status;
 498 }
 499
 500 /* Lookup groups a user is a member of - alternate method, for when
 501    tokenGroups are not available. */
 502 static NTSTATUS lookup_usergroups_alt(struct winbindd_domain *domain,
 503                                       TALLOC_CTX *mem_ctx,
 504                                       const char *user_dn,
 505                                       DOM_SID *primary_group,
 506                                       size_t *p_num_groups, DOM_SID **user_sids)
 507 {
 508         ADS_STATUS rc;
 509         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 510         int count;
 511         void *res = NULL;
 512         void *msg = NULL;
 513         char *ldap_exp;
 514         ADS_STRUCT *ads;
 515         const char *group_attrs[] = {"objectSid", NULL};
 516         char *escaped_dn;
 517         size_t num_groups = 0;
 518
 519         DEBUG(3,("ads: lookup_usergroups_alt\n"));
 520
 521         ads = ads_cached_connection(domain);
 522
 523         if (!ads) {
 524                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 525                 goto done;
 526         }
 527
 528         if (!(escaped_dn = escape_ldap_string_alloc(user_dn))) {
 529                 status = NT_STATUS_NO_MEMORY;
 530                 goto done;
 531         }
 532
 533         /* buggy server, no tokenGroups.  Instead lookup what groups this user
 534            is a member of by DN search on member*/
 535
 536         if (!(ldap_exp = talloc_asprintf(mem_ctx, "(&(member=%s)(objectClass=group))", escaped_dn))) {
 537                 DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn));
 538                 SAFE_FREE(escaped_dn);
 539                 status = NT_STATUS_NO_MEMORY;
 540                 goto done;
 541         }
 542
 543         SAFE_FREE(escaped_dn);
 544
 545         rc = ads_search_retry(ads, &res, ldap_exp, group_attrs);
 546
 547         if (!ADS_ERR_OK(rc) || !res) {
 548                 DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc)));
 549                 return ads_ntstatus(rc);
 550         }
 551
 552         count = ads_count_replies(ads, res);
 553
 554         *user_sids = NULL;
 555         num_groups = 0;
 556
 557         /* always add the primary group to the sid array */
 558         add_sid_to_array(mem_ctx, primary_group, user_sids, &num_groups);
 559
 560         if (count > 0) {
 561                 for (msg = ads_first_entry(ads, res); msg;
 562                      msg = ads_next_entry(ads, msg)) {
 563                         DOM_SID group_sid;
 564
 565                         if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
 566                                 DEBUG(1,("No sid for this group ?!?\n"));
 567                                 continue;
 568                         }
 569
 570                         add_sid_to_array(mem_ctx, &group_sid, user_sids,
 571                                          &num_groups);
 572                 }
 573
 574         }
 575
 576         *p_num_groups = num_groups;
 577         status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 578
 579         DEBUG(3,("ads lookup_usergroups (alt) for dn=%s\n", user_dn));
 580 done:
 581         if (res)
 582                 ads_msgfree(ads, res);
 583
 584         return status;
 585 }
 586
 587 /* Lookup groups a user is a member of. */
 588 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 589                                   TALLOC_CTX *mem_ctx,
 590                                   const DOM_SID *sid,
 591                                   uint32 *p_num_groups, DOM_SID **user_sids)
 592 {
 593         ADS_STRUCT *ads = NULL;
 594         const char *attrs[] = {"tokenGroups", "primaryGroupID", NULL};
 595         ADS_STATUS rc;
 596         int count;
 597         LDAPMessage *msg = NULL;
 598         char *user_dn;
 599         DOM_SID *sids;
 600         int i;
 601         DOM_SID primary_group;
 602         uint32 primary_group_rid;
 603         fstring sid_string;
 604         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 605         size_t num_groups = 0;
 606
 607         DEBUG(3,("ads: lookup_usergroups\n"));
 608         *p_num_groups = 0;
 609
 610         ads = ads_cached_connection(domain);
 611
 612         if (!ads) {
 613                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 614                 status = NT_STATUS_SERVER_DISABLED;
 615                 goto done;
 616         }
 617
 618         rc = ads_sid_to_dn(ads, mem_ctx, sid, &user_dn);
 619         if (!ADS_ERR_OK(rc)) {
 620                 status = ads_ntstatus(rc);
 621                 goto done;
 622         }
 623
 624         rc = ads_search_retry_dn(ads, (void**)(void *)&msg, user_dn, attrs);
 625         if (!ADS_ERR_OK(rc)) {
 626                 status = ads_ntstatus(rc);
 627                 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n",
 628                          sid_to_string(sid_string, sid), ads_errstr(rc)));
 629                 goto done;
 630         }
 631
 632         if (!msg) {
 633                 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
 634                          sid_to_string(sid_string, sid)));
 635                 status = NT_STATUS_UNSUCCESSFUL;
 636                 goto done;
 637         }
 638
 639         if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
 640                 DEBUG(1,("%s: No primary group for sid=%s !?\n",
 641                          domain->name, sid_to_string(sid_string, sid)));
 642                 goto done;
 643         }
 644
 645         sid_copy(&primary_group, &domain->sid);
 646         sid_append_rid(&primary_group, primary_group_rid);
 647
 648         count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
 649
 650         if (msg)
 651                 ads_msgfree(ads, msg);
 652
 653         /* there must always be at least one group in the token,
 654            unless we are talking to a buggy Win2k server */
 655         if (count == 0) {
 656                 status = lookup_usergroups_alt(domain, mem_ctx, user_dn,
 657                                              &primary_group,
 658                                              &num_groups, user_sids);
 659                 *p_num_groups = (uint32)num_groups;
 660                 return status;
 661         }
 662
 663         *user_sids = NULL;
 664         num_groups = 0;
 665
 666         add_sid_to_array(mem_ctx, &primary_group, user_sids, &num_groups);
 667
 668         for (i=0;i<count;i++) {
 669
 670                 /* ignore Builtin groups from ADS - Guenther */
 671                 if (sid_check_is_in_builtin(&sids[i])) {
 672                         continue;
 673                 }
 674
 675                 add_sid_to_array_unique(mem_ctx, &sids[i],
 676                                         user_sids, &num_groups);
 677         }
 678
 679         *p_num_groups = (uint32)num_groups;
 680         status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 681
 682         DEBUG(3,("ads lookup_usergroups for sid=%s\n",
 683                  sid_to_string(sid_string, sid)));
 684 done:
 685         return status;
 686 }
 687
 688 /*
 689   find the members of a group, given a group rid and domain
 690  */
 691 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 692                                 TALLOC_CTX *mem_ctx,
 693                                 const DOM_SID *group_sid, uint32 *num_names,
 694                                 DOM_SID **sid_mem, char ***names,
 695                                 uint32 **name_types)
 696 {
 697         ADS_STATUS rc;
 698         int count;
 699         void *res=NULL;
 700         ADS_STRUCT *ads = NULL;
 701         char *ldap_exp;
 702         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 703         char *sidstr;
 704         char **members;
 705         int i;
 706         size_t num_members;
 707         fstring sid_string;
 708         BOOL more_values;
 709         const char **attrs;
 710         uint32 first_usn;
 711         uint32 current_usn;
 712         int num_retries = 0;
 713
 714         DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
 715                   sid_string_static(group_sid)));
 716
 717         *num_names = 0;
 718
 719         ads = ads_cached_connection(domain);
 720
 721         if (!ads) {
 722                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 723                 goto done;
 724         }
 725
 726         sidstr = sid_binstring(group_sid);
 727
 728         /* search for all members of the group */
 729         if (!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)",sidstr))) {
 730                 SAFE_FREE(sidstr);
 731                 DEBUG(1, ("ads: lookup_groupmem: tallloc_asprintf for ldap_exp failed!\n"));
 732                 status = NT_STATUS_NO_MEMORY;
 733                 goto done;
 734         }
 735         SAFE_FREE(sidstr);
 736
 737         members = NULL;
 738         num_members = 0;
 739
 740         attrs = TALLOC_ARRAY(mem_ctx, const char *, 3);
 741         attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
 742         attrs[2] = NULL;
 743
 744         do {
 745                 if (num_members == 0)
 746                         attrs[0] = talloc_strdup(mem_ctx, "member");
 747
 748                 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
 749
 750                 rc = ads_search_retry(ads, &res, ldap_exp, attrs);
 751
 752                 if (!ADS_ERR_OK(rc) || !res) {
 753                         DEBUG(1,("ads: lookup_groupmem ads_search: %s\n",
 754                                  ads_errstr(rc)));
 755                         status = ads_ntstatus(rc);
 756                         goto done;
 757                 }
 758
 759                 count = ads_count_replies(ads, res);
 760                 if (count == 0)
 761                         break;
 762
 763                 if (num_members == 0) {
 764                         if (!ads_pull_uint32(ads, res, "usnChanged", &first_usn)) {
 765                                 DEBUG(1, ("ads: lookup_groupmem could not pull usnChanged!\n"));
 766                                 goto done;
 767                         }
 768                 }
 769
 770                 if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
 771                         DEBUG(1, ("ads: lookup_groupmem could not pull usnChanged!\n"));
 772                         goto done;
 773                 }
 774
 775                 if (first_usn != current_usn) {
 776                         DEBUG(5, ("ads: lookup_groupmem USN on this record changed"
 777                                   " - restarting search\n"));
 778                         if (num_retries < 5) {
 779                                 num_retries++;
 780                                 num_members = 0;
 781                                 continue;
 782                         } else {
 783                                 DEBUG(5, ("ads: lookup_groupmem USN on this record changed"
 784                                           " - restarted search too many times, aborting!\n"));
 785                                 status = NT_STATUS_UNSUCCESSFUL;
 786                                 goto done;
 787                         }
 788                 }
 789
 790                 members = ads_pull_strings_range(ads, mem_ctx, res,
 791                                                  "member",
 792                                                  members,
 793                                                  &attrs[0],
 794                                                  &num_members,
 795                                                  &more_values);
 796
 797                 if ((members == NULL) || (num_members == 0))
 798                         break;
 799
 800         } while (more_values);
 801
 802         /* now we need to turn a list of members into rids, names and name types
 803            the problem is that the members are in the form of distinguised names
 804         */
 805
 806         (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
 807         (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
 808         (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
 809
 810         for (i=0;i<num_members;i++) {
 811                 uint32 name_type;
 812                 char *name;
 813                 DOM_SID sid;
 814
 815                 if (dn_lookup(ads, mem_ctx, members[i], &name, &name_type, &sid)) {
 816                     (*names)[*num_names] = name;
 817                     (*name_types)[*num_names] = name_type;
 818                     sid_copy(&(*sid_mem)[*num_names], &sid);
 819                     (*num_names)++;
 820                 }
 821         }
 822
 823         status = NT_STATUS_OK;
 824         DEBUG(3,("ads lookup_groupmem for sid=%s\n", sid_to_string(sid_string, group_sid)));
 825 done:
 826
 827         if (res)
 828                 ads_msgfree(ads, res);
 829
 830         return status;
 831 }
 832
 833 /* find the sequence number for a domain */
 834 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
 835 {
 836         ADS_STRUCT *ads = NULL;
 837         ADS_STATUS rc;
 838
 839         DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
 840
 841         *seq = DOM_SEQUENCE_NONE;
 842
 843         ads = ads_cached_connection(domain);
 844
 845         if (!ads) {
 846                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 847                 return NT_STATUS_UNSUCCESSFUL;
 848         }
 849
 850         rc = ads_USN(ads, seq);
 851
 852         if (!ADS_ERR_OK(rc)) {
 853
 854                 /* its a dead connection ; don't destroy it
 855                    through since ads_USN() has already done
 856                    that indirectly */
 857
 858                 domain->private_data = NULL;
 859         }
 860         return ads_ntstatus(rc);
 861 }
 862
 863 /* get a list of trusted domains */
 864 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
 865                                 TALLOC_CTX *mem_ctx,
 866                                 uint32 *num_domains,
 867                                 char ***names,
 868                                 char ***alt_names,
 869                                 DOM_SID **dom_sids)
 870 {
 871         NTSTATUS                result = NT_STATUS_UNSUCCESSFUL;
 872         struct ds_domain_trust  *domains = NULL;
 873         int                     count = 0;
 874         int                     i;
 875                                 /* i think we only need our forest and downlevel trusted domains */
 876         uint32                  flags = DS_DOMAIN_IN_FOREST | DS_DOMAIN_DIRECT_OUTBOUND;
 877         struct rpc_pipe_client *cli;
 878
 879         DEBUG(3,("ads: trusted_domains\n"));
 880
 881         *num_domains = 0;
 882         *alt_names   = NULL;
 883         *names       = NULL;
 884         *dom_sids    = NULL;
 885
 886         result = cm_connect_netlogon(domain, &cli);
 887
 888         if (!NT_STATUS_IS_OK(result)) {
 889                 DEBUG(5, ("trusted_domains: Could not open a connection to %s "
 890                           "for PIPE_NETLOGON (%s)\n",
 891                           domain->name, nt_errstr(result)));
 892                 return NT_STATUS_UNSUCCESSFUL;
 893         }
 894
 895         if ( NT_STATUS_IS_OK(result) ) {
 896                 result = rpccli_ds_enum_domain_trusts(cli, mem_ctx,
 897                                                       cli->cli->desthost,
 898                                                       flags, &domains,
 899                                                       (unsigned int *)&count);
 900         }
 901
 902         if ( NT_STATUS_IS_OK(result) && count) {
 903
 904                 /* Allocate memory for trusted domain names and sids */
 905
 906                 if ( !(*names = TALLOC_ARRAY(mem_ctx, char *, count)) ) {
 907                         DEBUG(0, ("trusted_domains: out of memory\n"));
 908                         return NT_STATUS_NO_MEMORY;
 909                 }
 910
 911                 if ( !(*alt_names = TALLOC_ARRAY(mem_ctx, char *, count)) ) {
 912                         DEBUG(0, ("trusted_domains: out of memory\n"));
 913                         return NT_STATUS_NO_MEMORY;
 914                 }
 915
 916                 if ( !(*dom_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, count)) ) {
 917                         DEBUG(0, ("trusted_domains: out of memory\n"));
 918                         return NT_STATUS_NO_MEMORY;
 919                 }
 920
 921                 /* Copy across names and sids */
 922
 923                 for (i = 0; i < count; i++) {
 924                         (*names)[i] = domains[i].netbios_domain;
 925                         (*alt_names)[i] = domains[i].dns_domain;
 926
 927                         sid_copy(&(*dom_sids)[i], &domains[i].sid);
 928                 }
 929
 930                 *num_domains = count;
 931         }
 932
 933         return result;
 934 }
 935
 936 /* the ADS backend methods are exposed via this structure */
 937 struct winbindd_methods ads_methods = {
 938         True,
 939         query_user_list,
 940         enum_dom_groups,
 941         enum_local_groups,
 942         msrpc_name_to_sid,
 943         msrpc_sid_to_name,
 944         query_user,
 945         lookup_usergroups,
 946         msrpc_lookup_useraliases,
 947         lookup_groupmem,
 948         sequence_number,
 949         trusted_domains,
 950 };
 951
 952 #endif