2 Unix SMB/CIFS implementation.
4 Winbind daemon - user related functions
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
8 Copyright (C) Gerald (Jerry) Carter 2003.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 extern userdom_struct current_user_info
;
33 /* Fill a pwent structure with information we have obtained */
35 static BOOL
winbindd_fill_pwent(char *dom_name
, char *user_name
,
36 DOM_SID
*user_sid
, DOM_SID
*group_sid
,
37 char *full_name
, struct winbindd_pw
*pw
)
39 fstring output_username
;
44 if (!pw
|| !dom_name
|| !user_name
)
47 /* Resolve the uid number */
49 if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid
, &pw
->pw_uid
, 0))) {
50 DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string
, user_sid
)));
54 /* Resolve the gid number */
56 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid
, &pw
->pw_gid
, 0))) {
57 DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string
, group_sid
)));
61 strlower_m(user_name
);
65 fill_domain_username(output_username
, dom_name
, user_name
);
67 safe_strcpy(pw
->pw_name
, output_username
, sizeof(pw
->pw_name
) - 1);
69 /* Full name (gecos) */
71 safe_strcpy(pw
->pw_gecos
, full_name
, sizeof(pw
->pw_gecos
) - 1);
73 /* Home directory and shell - use template config parameters. The
74 defaults are /tmp for the home directory and /bin/false for
77 /* The substitution of %U and %D in the 'template homedir' is done
78 by alloc_sub_specified() below. */
80 fstrcpy(current_user_info
.domain
, dom_name
);
82 homedir
= alloc_sub_specified(lp_template_homedir(), user_name
, dom_name
, pw
->pw_uid
, pw
->pw_gid
);
87 safe_strcpy(pw
->pw_dir
, homedir
, sizeof(pw
->pw_dir
) - 1);
91 shell
= alloc_sub_specified(lp_template_shell(), user_name
, dom_name
, pw
->pw_uid
, pw
->pw_gid
);
96 safe_strcpy(pw
->pw_shell
, shell
,
97 sizeof(pw
->pw_shell
) - 1);
101 /* Password - set to "x" as we can't generate anything useful here.
102 Authentication can be done using the pam_winbind module. */
104 safe_strcpy(pw
->pw_passwd
, "x", sizeof(pw
->pw_passwd
) - 1);
109 /* Wrapper for domain->methods->query_user, only on the parent->child pipe */
111 enum winbindd_result
winbindd_dual_userinfo(struct winbindd_domain
*domain
,
112 struct winbindd_cli_state
*state
)
115 WINBIND_USERINFO user_info
;
118 /* Ensure null termination */
119 state
->request
.data
.sid
[sizeof(state
->request
.data
.sid
)-1]='\0';
121 DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state
->pid
,
122 state
->request
.data
.sid
));
124 if (!string_to_sid(&sid
, state
->request
.data
.sid
)) {
125 DEBUG(5, ("%s not a SID\n", state
->request
.data
.sid
));
126 return WINBINDD_ERROR
;
129 status
= domain
->methods
->query_user(domain
, state
->mem_ctx
,
131 if (!NT_STATUS_IS_OK(status
)) {
132 DEBUG(1, ("error getting user info for sid %s\n",
133 sid_string_static(&sid
)));
134 return WINBINDD_ERROR
;
137 fstrcpy(state
->response
.data
.user_info
.acct_name
, user_info
.acct_name
);
138 fstrcpy(state
->response
.data
.user_info
.full_name
, user_info
.full_name
);
139 if (!sid_peek_check_rid(&domain
->sid
, &user_info
.group_sid
,
140 &state
->response
.data
.user_info
.group_rid
)) {
141 DEBUG(1, ("Could not extract group rid out of %s\n",
142 sid_string_static(&sid
)));
143 return WINBINDD_ERROR
;
149 struct getpwsid_state
{
150 struct winbindd_cli_state
*state
;
151 struct winbindd_domain
*domain
;
160 static void getpwsid_queryuser_recv(void *private, BOOL success
,
161 const char *acct_name
,
162 const char *full_name
, uint32 group_rid
);
163 static void getpwsid_sid2uid_recv(void *private, BOOL success
, uid_t uid
);
164 static void getpwsid_sid2gid_recv(void *private, BOOL success
, gid_t gid
);
166 static void winbindd_getpwsid(struct winbindd_cli_state
*state
,
169 struct getpwsid_state
*s
;
171 s
= TALLOC_P(state
->mem_ctx
, struct getpwsid_state
);
173 DEBUG(0, ("talloc failed\n"));
178 s
->domain
= find_domain_from_sid_noinit(sid
);
179 if (s
->domain
== NULL
) {
180 DEBUG(3, ("Could not find domain for sid %s\n",
181 sid_string_static(sid
)));
185 sid_copy(&s
->user_sid
, sid
);
187 query_user_async(s
->state
->mem_ctx
, s
->domain
, sid
,
188 getpwsid_queryuser_recv
, s
);
192 s
->state
->response
.result
= WINBINDD_ERROR
;
193 request_finished(state
);
196 static void getpwsid_queryuser_recv(void *private, BOOL success
,
197 const char *acct_name
,
198 const char *full_name
, uint32 group_rid
)
200 struct getpwsid_state
*s
=
201 talloc_get_type_abort(private, struct getpwsid_state
);
204 DEBUG(5, ("Could not query user %s\\%s\n", s
->domain
->name
,
206 s
->state
->response
.result
= WINBINDD_ERROR
;
207 request_finished(s
->state
);
211 s
->username
= talloc_strdup(s
->state
->mem_ctx
, acct_name
);
212 s
->fullname
= talloc_strdup(s
->state
->mem_ctx
, full_name
);
213 sid_copy(&s
->group_sid
, &s
->domain
->sid
);
214 sid_append_rid(&s
->group_sid
, group_rid
);
216 winbindd_sid2uid_async(s
->state
->mem_ctx
, &s
->user_sid
,
217 getpwsid_sid2uid_recv
, s
);
220 static void getpwsid_sid2uid_recv(void *private, BOOL success
, uid_t uid
)
222 struct getpwsid_state
*s
=
223 talloc_get_type_abort(private, struct getpwsid_state
);
226 DEBUG(5, ("Could not query user's %s\\%s uid\n",
227 s
->domain
->name
, s
->username
));
228 s
->state
->response
.result
= WINBINDD_ERROR
;
229 request_finished(s
->state
);
234 winbindd_sid2gid_async(s
->state
->mem_ctx
, &s
->group_sid
,
235 getpwsid_sid2gid_recv
, s
);
238 static void getpwsid_sid2gid_recv(void *private, BOOL success
, gid_t gid
)
240 struct getpwsid_state
*s
=
241 talloc_get_type_abort(private, struct getpwsid_state
);
242 struct winbindd_pw
*pw
;
243 fstring output_username
;
247 s
->state
->response
.result
= WINBINDD_ERROR
;
250 DEBUG(5, ("Could not query user's %s\\%s\n gid",
251 s
->domain
->name
, s
->username
));
257 pw
= &s
->state
->response
.data
.pw
;
260 fill_domain_username(output_username
, s
->domain
->name
, s
->username
);
261 safe_strcpy(pw
->pw_name
, output_username
, sizeof(pw
->pw_name
) - 1);
262 safe_strcpy(pw
->pw_gecos
, s
->fullname
, sizeof(pw
->pw_gecos
) - 1);
264 /* Home directory and shell - use template config parameters. The
265 defaults are /tmp for the home directory and /bin/false for
268 /* The substitution of %U and %D in the 'template homedir' is done
269 by alloc_sub_specified() below. */
271 fstrcpy(current_user_info
.domain
, s
->domain
->name
);
273 homedir
= alloc_sub_specified(lp_template_homedir(), s
->username
,
274 s
->domain
->name
, pw
->pw_uid
, pw
->pw_gid
);
275 if (homedir
== NULL
) {
276 DEBUG(5, ("Could not compose homedir\n"));
279 safe_strcpy(pw
->pw_dir
, homedir
, sizeof(pw
->pw_dir
) - 1);
282 shell
= alloc_sub_specified(lp_template_shell(), s
->username
,
283 s
->domain
->name
, pw
->pw_uid
, pw
->pw_gid
);
285 DEBUG(5, ("Could not compose shell\n"));
288 safe_strcpy(pw
->pw_shell
, shell
, sizeof(pw
->pw_shell
) - 1);
291 /* Password - set to "x" as we can't generate anything useful here.
292 Authentication can be done using the pam_winbind module. */
294 safe_strcpy(pw
->pw_passwd
, "x", sizeof(pw
->pw_passwd
) - 1);
296 s
->state
->response
.result
= WINBINDD_OK
;
299 request_finished(s
->state
);
302 /* Return a password structure from a username. */
304 static void getpwnam_name2sid_recv(void *private, BOOL success
,
305 const DOM_SID
*sid
, enum SID_NAME_USE type
);
307 enum winbindd_result
winbindd_getpwnam(struct winbindd_cli_state
*state
)
309 struct winbindd_domain
*domain
;
310 fstring domname
, username
;
312 /* Ensure null termination */
313 state
->request
.data
.username
[sizeof(state
->request
.data
.username
)-1]='\0';
315 DEBUG(3, ("[%5lu]: getpwnam %s\n", (unsigned long)state
->pid
,
316 state
->request
.data
.username
));
318 if (!parse_domain_user(state
->request
.data
.username
, domname
,
320 DEBUG(0, ("Could not parse domain user: %s\n",
321 state
->request
.data
.username
));
322 return WINBINDD_ERROR
;
325 /* Get info for the domain */
327 domain
= find_lookup_domain_from_name(domname
);
329 if (domain
== NULL
) {
330 DEBUG(7, ("could not find domain entry for domain %s\n",
332 return WINBINDD_ERROR
;
335 if ( domain
->primary
&& lp_winbind_trusted_domains_only()) {
336 DEBUG(7,("winbindd_getpwnam: My domain -- rejecting "
337 "getgroups() for %s\\%s.\n", domname
, username
));
338 return WINBINDD_ERROR
;
341 /* Get rid and name type from name. The following costs 1 packet */
343 winbindd_lookupname_async(state
->mem_ctx
, domname
, username
,
344 getpwnam_name2sid_recv
, state
);
345 return WINBINDD_PENDING
;
348 static void getpwnam_name2sid_recv(void *private, BOOL success
,
349 const DOM_SID
*sid
, enum SID_NAME_USE type
)
351 struct winbindd_cli_state
*state
= private;
354 DEBUG(5, ("Could not lookup name for user %s\n",
355 state
->request
.data
.username
));
356 state
->response
.result
= WINBINDD_ERROR
;
357 request_finished(state
);
361 if ((type
!= SID_NAME_USER
) && (type
!= SID_NAME_COMPUTER
)) {
362 DEBUG(5, ("%s is not a user\n", state
->request
.data
.username
));
363 state
->response
.result
= WINBINDD_ERROR
;
364 request_finished(state
);
368 winbindd_getpwsid(state
, sid
);
371 /* Return a password structure given a uid number */
373 enum winbindd_result
winbindd_getpwuid(struct winbindd_cli_state
*state
)
378 /* Bug out if the uid isn't in the winbind range */
380 if ((state
->request
.data
.uid
< server_state
.uid_low
) ||
381 (state
->request
.data
.uid
> server_state
.uid_high
))
382 return WINBINDD_ERROR
;
384 DEBUG(3, ("[%5lu]: getpwuid %lu\n", (unsigned long)state
->pid
,
385 (unsigned long)state
->request
.data
.uid
));
387 status
= idmap_uid_to_sid(&user_sid
, state
->request
.data
.uid
,
388 ID_QUERY_ONLY
| ID_CACHE_ONLY
);
390 if (!NT_STATUS_IS_OK(status
)) {
391 DEBUG(5, ("Could not find SID for uid %lu\n",
392 (unsigned long)state
->request
.data
.uid
));
393 return WINBINDD_ERROR
;
396 winbindd_getpwsid(state
, &user_sid
);
397 return WINBINDD_PENDING
;
401 * set/get/endpwent functions
404 /* Rewind file pointer for ntdom passwd database */
406 enum winbindd_result
winbindd_setpwent(struct winbindd_cli_state
*state
)
408 struct winbindd_domain
*domain
;
410 DEBUG(3, ("[%5lu]: setpwent\n", (unsigned long)state
->pid
));
412 /* Check user has enabled this */
414 if (!lp_winbind_enum_users())
415 return WINBINDD_ERROR
;
417 /* Free old static data if it exists */
419 if (state
->getpwent_state
!= NULL
) {
420 free_getent_state(state
->getpwent_state
);
421 state
->getpwent_state
= NULL
;
425 /* add any local users we have */
427 if ( (domain_state
= (struct getent_state
*)malloc(sizeof(struct getent_state
))) == NULL
)
428 return WINBINDD_ERROR
;
430 ZERO_STRUCTP(domain_state
);
432 /* Add to list of open domains */
434 DLIST_ADD(state
->getpwent_state
, domain_state
);
437 /* Create sam pipes for each domain we know about */
439 for(domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
440 struct getent_state
*domain_state
;
443 /* don't add our domaina if we are a PDC or if we
444 are a member of a Samba domain */
446 if ( (IS_DC
|| lp_winbind_trusted_domains_only())
447 && strequal(domain
->name
, lp_workgroup()) )
452 /* Create a state record for this domain */
454 if ((domain_state
= SMB_MALLOC_P(struct getent_state
)) == NULL
)
455 return WINBINDD_ERROR
;
457 ZERO_STRUCTP(domain_state
);
459 fstrcpy(domain_state
->domain_name
, domain
->name
);
461 /* Add to list of open domains */
463 DLIST_ADD(state
->getpwent_state
, domain_state
);
466 state
->getpwent_initialized
= True
;
471 /* Close file pointer to ntdom passwd database */
473 enum winbindd_result
winbindd_endpwent(struct winbindd_cli_state
*state
)
475 DEBUG(3, ("[%5lu]: endpwent\n", (unsigned long)state
->pid
));
477 free_getent_state(state
->getpwent_state
);
478 state
->getpwent_initialized
= False
;
479 state
->getpwent_state
= NULL
;
484 /* Get partial list of domain users for a domain. We fill in the sam_entries,
485 and num_sam_entries fields with domain user information. The dispinfo_ndx
486 field is incremented to the index of the next user to fetch. Return True if
487 some users were returned, False otherwise. */
489 static BOOL
get_sam_user_entries(struct getent_state
*ent
, TALLOC_CTX
*mem_ctx
)
493 WINBIND_USERINFO
*info
;
494 struct getpwent_user
*name_list
= NULL
;
496 struct winbindd_domain
*domain
;
497 struct winbindd_methods
*methods
;
500 if (ent
->num_sam_entries
)
503 if (!(domain
= find_domain_from_name(ent
->domain_name
))) {
504 DEBUG(3, ("no such domain %s in get_sam_user_entries\n",
509 methods
= domain
->methods
;
511 /* Free any existing user info */
513 SAFE_FREE(ent
->sam_entries
);
514 ent
->num_sam_entries
= 0;
516 /* Call query_user_list to get a list of usernames and user rids */
520 status
= methods
->query_user_list(domain
, mem_ctx
, &num_entries
,
524 struct getpwent_user
*tnl
;
526 tnl
= SMB_REALLOC_ARRAY(name_list
, struct getpwent_user
, ent
->num_sam_entries
+ num_entries
);
529 DEBUG(0,("get_sam_user_entries realloc failed.\n"));
530 SAFE_FREE(name_list
);
536 for (i
= 0; i
< num_entries
; i
++) {
537 /* Store account name and gecos */
538 if (!info
[i
].acct_name
) {
539 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].name
, "");
541 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].name
,
544 if (!info
[i
].full_name
) {
545 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].gecos
, "");
547 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].gecos
,
551 /* User and group ids */
552 sid_copy(&name_list
[ent
->num_sam_entries
+i
].user_sid
,
554 sid_copy(&name_list
[ent
->num_sam_entries
+i
].group_sid
,
558 ent
->num_sam_entries
+= num_entries
;
560 /* Fill in remaining fields */
562 ent
->sam_entries
= name_list
;
563 ent
->sam_entry_index
= 0;
564 result
= ent
->num_sam_entries
> 0;
571 /* Fetch next passwd entry from ntdom database */
573 #define MAX_GETPWENT_USERS 500
575 enum winbindd_result
winbindd_getpwent(struct winbindd_cli_state
*state
)
577 struct getent_state
*ent
;
578 struct winbindd_pw
*user_list
;
579 int num_users
, user_list_ndx
= 0, i
;
581 DEBUG(3, ("[%5lu]: getpwent\n", (unsigned long)state
->pid
));
583 /* Check user has enabled this */
585 if (!lp_winbind_enum_users())
586 return WINBINDD_ERROR
;
588 /* Allocate space for returning a chunk of users */
590 num_users
= MIN(MAX_GETPWENT_USERS
, state
->request
.data
.num_entries
);
592 if ((state
->response
.extra_data
= SMB_MALLOC_ARRAY(struct winbindd_pw
, num_users
)) == NULL
)
593 return WINBINDD_ERROR
;
595 memset(state
->response
.extra_data
, 0, num_users
*
596 sizeof(struct winbindd_pw
));
598 user_list
= (struct winbindd_pw
*)state
->response
.extra_data
;
600 if (!state
->getpwent_initialized
)
601 winbindd_setpwent(state
);
603 if (!(ent
= state
->getpwent_state
))
604 return WINBINDD_ERROR
;
606 /* Start sending back users */
608 for (i
= 0; i
< num_users
; i
++) {
609 struct getpwent_user
*name_list
= NULL
;
612 /* Do we need to fetch another chunk of users? */
614 if (ent
->num_sam_entries
== ent
->sam_entry_index
) {
617 !get_sam_user_entries(ent
, state
->mem_ctx
)) {
618 struct getent_state
*next_ent
;
620 /* Free state information for this domain */
622 SAFE_FREE(ent
->sam_entries
);
624 next_ent
= ent
->next
;
625 DLIST_REMOVE(state
->getpwent_state
, ent
);
631 /* No more domains */
637 name_list
= ent
->sam_entries
;
639 /* Lookup user info */
641 result
= winbindd_fill_pwent(
643 name_list
[ent
->sam_entry_index
].name
,
644 &name_list
[ent
->sam_entry_index
].user_sid
,
645 &name_list
[ent
->sam_entry_index
].group_sid
,
646 name_list
[ent
->sam_entry_index
].gecos
,
647 &user_list
[user_list_ndx
]);
649 ent
->sam_entry_index
++;
651 /* Add user to return list */
656 state
->response
.data
.num_entries
++;
657 state
->response
.length
+=
658 sizeof(struct winbindd_pw
);
661 DEBUG(1, ("could not lookup domain user %s\n",
662 name_list
[ent
->sam_entry_index
].name
));
667 return (user_list_ndx
> 0) ? WINBINDD_OK
: WINBINDD_ERROR
;
670 /* List domain users without mapping to unix ids */
672 enum winbindd_result
winbindd_list_users(struct winbindd_cli_state
*state
)
674 struct winbindd_domain
*domain
;
675 WINBIND_USERINFO
*info
;
676 const char *which_domain
;
677 uint32 num_entries
= 0, total_entries
= 0;
678 char *ted
, *extra_data
= NULL
;
679 int extra_data_len
= 0;
680 enum winbindd_result rv
= WINBINDD_ERROR
;
682 DEBUG(3, ("[%5lu]: list users\n", (unsigned long)state
->pid
));
684 /* Ensure null termination */
685 state
->request
.domain_name
[sizeof(state
->request
.domain_name
)-1]='\0';
686 which_domain
= state
->request
.domain_name
;
688 /* Enumerate over trusted domains */
690 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
692 struct winbindd_methods
*methods
;
695 /* if we have a domain name restricting the request and this
696 one in the list doesn't match, then just bypass the remainder
699 if ( *which_domain
&& !strequal(which_domain
, domain
->name
) )
702 methods
= domain
->methods
;
704 /* Query display info */
705 status
= methods
->query_user_list(domain
, state
->mem_ctx
,
706 &num_entries
, &info
);
708 if (num_entries
== 0)
711 /* Allocate some memory for extra data */
712 total_entries
+= num_entries
;
714 ted
= SMB_REALLOC(extra_data
, sizeof(fstring
) * total_entries
);
717 DEBUG(0,("failed to enlarge buffer!\n"));
718 SAFE_FREE(extra_data
);
723 /* Pack user list into extra data fields */
725 for (i
= 0; i
< num_entries
; i
++) {
726 fstring acct_name
, name
;
728 if (!info
[i
].acct_name
) {
729 fstrcpy(acct_name
, "");
731 fstrcpy(acct_name
, info
[i
].acct_name
);
734 fill_domain_username(name
, domain
->name
, acct_name
);
736 /* Append to extra data */
737 memcpy(&extra_data
[extra_data_len
], name
,
739 extra_data_len
+= strlen(name
);
740 extra_data
[extra_data_len
++] = ',';
744 /* Assign extra_data fields in response structure */
747 extra_data
[extra_data_len
- 1] = '\0';
748 state
->response
.extra_data
= extra_data
;
749 state
->response
.length
+= extra_data_len
;
752 /* No domains responded but that's still OK so don't return an