2 * Unix SMB/CIFS implementation.
3 * Authentication utility functions
4 * Copyright (C) Andrew Tridgell 1992-1998
5 * Copyright (C) Andrew Bartlett 2001
6 * Copyright (C) Jeremy Allison 2000-2001
7 * Copyright (C) Rafal Szczesniak 2002
8 * Copyright (C) Volker Lendecke 2006
9 * Copyright (C) Michael Adam 2007
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 /* functions moved from auth/auth_util.c to minimize linker deps */
30 #include "../librpc/gen_ndr/netlogon.h"
32 /****************************************************************************
33 Check for a SID in an NT_USER_TOKEN
34 ****************************************************************************/
36 bool nt_token_check_sid ( const struct dom_sid
*sid
, const NT_USER_TOKEN
*token
)
43 for ( i
=0; i
<token
->num_sids
; i
++ ) {
44 if ( sid_equal( sid
, &token
->user_sids
[i
] ) )
51 bool nt_token_check_domain_rid( NT_USER_TOKEN
*token
, uint32 rid
)
53 struct dom_sid domain_sid
;
55 /* if we are a domain member, the get the domain SID, else for
56 a DC or standalone server, use our own SID */
58 if ( lp_server_role() == ROLE_DOMAIN_MEMBER
) {
59 if ( !secrets_fetch_domain_sid( lp_workgroup(),
61 DEBUG(1,("nt_token_check_domain_rid: Cannot lookup "
62 "SID for domain [%s]\n", lp_workgroup()));
67 sid_copy( &domain_sid
, get_global_sam_sid() );
69 sid_append_rid( &domain_sid
, rid
);
71 return nt_token_check_sid( &domain_sid
, token
);\
74 /******************************************************************************
75 Create a token for the root user to be used internally by smbd.
76 This is similar to running under the context of the LOCAL_SYSTEM account
77 in Windows. This is a read-only token. Do not modify it or free() it.
78 Create a copy if your need to change it.
79 ******************************************************************************/
81 NT_USER_TOKEN
*get_root_nt_token( void )
83 struct nt_user_token
*token
, *for_cache
;
84 struct dom_sid u_sid
, g_sid
;
88 cache_data
= memcache_lookup_talloc(
89 NULL
, SINGLETON_CACHE_TALLOC
,
90 data_blob_string_const_null("root_nt_token"));
92 if (cache_data
!= NULL
) {
93 return talloc_get_type_abort(
94 cache_data
, struct nt_user_token
);
97 if ( !(pw
= sys_getpwuid(0)) ) {
98 if ( !(pw
= sys_getpwnam("root")) ) {
99 DEBUG(0,("get_root_nt_token: both sys_getpwuid(0) "
100 "and sys_getpwnam(\"root\") failed!\n"));
105 /* get the user and primary group SIDs; although the
106 BUILTIN\Administrators SId is really the one that matters here */
108 uid_to_sid(&u_sid
, pw
->pw_uid
);
109 gid_to_sid(&g_sid
, pw
->pw_gid
);
111 token
= create_local_nt_token(talloc_autofree_context(), &u_sid
, False
,
112 1, &global_sid_Builtin_Administrators
);
114 token
->privileges
= se_disk_operators
;
119 NULL
, SINGLETON_CACHE_TALLOC
,
120 data_blob_string_const_null("root_nt_token"), &for_cache
);
127 * Add alias SIDs from memberships within the partially created token SID list
130 NTSTATUS
add_aliases(const struct dom_sid
*domain_sid
,
131 struct nt_user_token
*token
)
134 size_t i
, num_aliases
;
138 if (!(tmp_ctx
= talloc_init("add_aliases"))) {
139 return NT_STATUS_NO_MEMORY
;
145 status
= pdb_enum_alias_memberships(tmp_ctx
, domain_sid
,
148 &aliases
, &num_aliases
);
150 if (!NT_STATUS_IS_OK(status
)) {
151 DEBUG(10, ("pdb_enum_alias_memberships failed: %s\n",
156 for (i
=0; i
<num_aliases
; i
++) {
157 struct dom_sid alias_sid
;
158 sid_compose(&alias_sid
, domain_sid
, aliases
[i
]);
159 status
= add_sid_to_array_unique(token
, &alias_sid
,
162 if (!NT_STATUS_IS_OK(status
)) {
163 DEBUG(0, ("add_sid_to_array failed\n"));
169 TALLOC_FREE(tmp_ctx
);
173 /*******************************************************************
174 *******************************************************************/
176 static NTSTATUS
add_builtin_administrators(struct nt_user_token
*token
,
177 const struct dom_sid
*dom_sid
)
179 struct dom_sid domadm
;
182 /* nothing to do if we aren't in a domain */
184 if ( !(IS_DC
|| lp_server_role()==ROLE_DOMAIN_MEMBER
) ) {
188 /* Find the Domain Admins SID */
191 sid_copy( &domadm
, get_global_sam_sid() );
193 sid_copy(&domadm
, dom_sid
);
195 sid_append_rid( &domadm
, DOMAIN_RID_ADMINS
);
197 /* Add Administrators if the user beloongs to Domain Admins */
199 if ( nt_token_check_sid( &domadm
, token
) ) {
200 status
= add_sid_to_array(token
,
201 &global_sid_Builtin_Administrators
,
202 &token
->user_sids
, &token
->num_sids
);
203 if (!NT_STATUS_IS_OK(status
)) {
212 * Create the requested BUILTIN if it doesn't already exist. This requires
213 * winbindd to be running.
215 * @param[in] rid BUILTIN rid to create
216 * @return Normal NTSTATUS return.
218 static NTSTATUS
create_builtin(uint32 rid
)
220 NTSTATUS status
= NT_STATUS_OK
;
224 if (!sid_compose(&sid
, &global_sid_Builtin
, rid
)) {
225 return NT_STATUS_NO_SUCH_ALIAS
;
228 if (!sid_to_gid(&sid
, &gid
)) {
229 if (!lp_winbind_nested_groups() || !winbind_ping()) {
230 return NT_STATUS_PROTOCOL_UNREACHABLE
;
232 status
= pdb_create_builtin_alias(rid
);
238 * Add sid as a member of builtin_sid.
240 * @param[in] builtin_sid An existing builtin group.
241 * @param[in] dom_sid sid to add as a member of builtin_sid.
242 * @return Normal NTSTATUS return
244 static NTSTATUS
add_sid_to_builtin(const struct dom_sid
*builtin_sid
,
245 const struct dom_sid
*dom_sid
)
247 NTSTATUS status
= NT_STATUS_OK
;
249 if (!dom_sid
|| !builtin_sid
) {
250 return NT_STATUS_INVALID_PARAMETER
;
253 status
= pdb_add_aliasmem(builtin_sid
, dom_sid
);
255 if (NT_STATUS_EQUAL(status
, NT_STATUS_MEMBER_IN_ALIAS
)) {
256 DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
257 sid_string_dbg(dom_sid
),
258 sid_string_dbg(builtin_sid
)));
262 if (!NT_STATUS_IS_OK(status
)) {
263 DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
264 "%s\n", sid_string_dbg(dom_sid
),
265 sid_string_dbg(builtin_sid
), nt_errstr(status
)));
270 /*******************************************************************
271 *******************************************************************/
273 NTSTATUS
create_builtin_users(const struct dom_sid
*dom_sid
)
276 struct dom_sid dom_users
;
278 status
= create_builtin(BUILTIN_RID_USERS
);
279 if ( !NT_STATUS_IS_OK(status
) ) {
280 DEBUG(5,("create_builtin_users: Failed to create Users\n"));
284 /* add domain users */
285 if ((IS_DC
|| (lp_server_role() == ROLE_DOMAIN_MEMBER
))
286 && sid_compose(&dom_users
, dom_sid
, DOMAIN_RID_USERS
))
288 status
= add_sid_to_builtin(&global_sid_Builtin_Users
,
295 /*******************************************************************
296 *******************************************************************/
298 NTSTATUS
create_builtin_administrators(const struct dom_sid
*dom_sid
)
301 struct dom_sid dom_admins
, root_sid
;
303 enum lsa_SidType type
;
307 status
= create_builtin(BUILTIN_RID_ADMINISTRATORS
);
308 if ( !NT_STATUS_IS_OK(status
) ) {
309 DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
313 /* add domain admins */
314 if ((IS_DC
|| (lp_server_role() == ROLE_DOMAIN_MEMBER
))
315 && sid_compose(&dom_admins
, dom_sid
, DOMAIN_RID_ADMINS
))
317 status
= add_sid_to_builtin(&global_sid_Builtin_Administrators
,
319 if (!NT_STATUS_IS_OK(status
)) {
325 if ( (ctx
= talloc_init("create_builtin_administrators")) == NULL
) {
326 return NT_STATUS_NO_MEMORY
;
328 fstr_sprintf( root_name
, "%s\\root", get_global_sam_name() );
329 ret
= lookup_name(ctx
, root_name
, LOOKUP_NAME_DOMAIN
, NULL
, NULL
,
334 status
= add_sid_to_builtin(&global_sid_Builtin_Administrators
,
341 static NTSTATUS
finalize_local_nt_token(struct nt_user_token
*result
,
344 NTSTATUS
create_local_nt_token_from_info3(TALLOC_CTX
*mem_ctx
,
346 struct netr_SamInfo3
*info3
,
347 struct extra_auth_info
*extra
,
348 struct nt_user_token
**ntok
)
350 struct nt_user_token
*usrtok
= NULL
;
354 DEBUG(10, ("Create local NT token for %s\n",
355 info3
->base
.account_name
.string
));
357 usrtok
= talloc_zero(mem_ctx
, struct nt_user_token
);
359 DEBUG(0, ("talloc failed\n"));
360 return NT_STATUS_NO_MEMORY
;
363 /* Add the user and primary group sid FIRST */
364 /* check if the user rid is the special "Domain Guests" rid.
365 * If so pick the first sid for the extra sids instead as it
366 * is a local fake account */
367 usrtok
->user_sids
= talloc_array(usrtok
, struct dom_sid
, 2);
368 if (!usrtok
->user_sids
) {
370 return NT_STATUS_NO_MEMORY
;
372 usrtok
->num_sids
= 2;
375 if (info3
->base
.rid
== (uint32_t)(-1)) {
376 /* this is a signal the user was fake and generated,
377 * the actual SID we want to use is stored in the extra
379 if (is_null_sid(&extra
->user_sid
)) {
380 /* we couldn't find the user sid, bail out */
381 DEBUG(3, ("Invalid user SID\n"));
383 return NT_STATUS_UNSUCCESSFUL
;
385 sid_copy(&usrtok
->user_sids
[0], &extra
->user_sid
);
387 sid_copy(&usrtok
->user_sids
[0], info3
->base
.domain_sid
);
388 sid_append_rid(&usrtok
->user_sids
[0], info3
->base
.rid
);
392 if (info3
->base
.primary_gid
== (uint32_t)(-1)) {
393 /* this is a signal the user was fake and generated,
394 * the actual SID we want to use is stored in the extra
396 if (is_null_sid(&extra
->pgid_sid
)) {
397 /* we couldn't find the user sid, bail out */
398 DEBUG(3, ("Invalid group SID\n"));
400 return NT_STATUS_UNSUCCESSFUL
;
402 sid_copy(&usrtok
->user_sids
[1], &extra
->pgid_sid
);
404 sid_copy(&usrtok
->user_sids
[1], info3
->base
.domain_sid
);
405 sid_append_rid(&usrtok
->user_sids
[1],
406 info3
->base
.primary_gid
);
409 /* Now the SIDs we got from authentication. These are the ones from
410 * the info3 struct or from the pdb_enum_group_memberships, depending
411 * on who authenticated the user.
412 * Note that we start the for loop at "1" here, we already added the
413 * first group sid as primary above. */
415 for (i
= 0; i
< info3
->base
.groups
.count
; i
++) {
416 struct dom_sid tmp_sid
;
418 sid_copy(&tmp_sid
, info3
->base
.domain_sid
);
419 sid_append_rid(&tmp_sid
, info3
->base
.groups
.rids
[i
].rid
);
421 status
= add_sid_to_array_unique(usrtok
, &tmp_sid
,
424 if (!NT_STATUS_IS_OK(status
)) {
425 DEBUG(3, ("Failed to add SID to nt token\n"));
431 /* now also add extra sids if they are not the special user/group
433 for (i
= 0; i
< info3
->sidcount
; i
++) {
434 status
= add_sid_to_array_unique(usrtok
,
438 if (!NT_STATUS_IS_OK(status
)) {
439 DEBUG(3, ("Failed to add SID to nt token\n"));
445 status
= finalize_local_nt_token(usrtok
, is_guest
);
446 if (!NT_STATUS_IS_OK(status
)) {
447 DEBUG(3, ("Failed to finalize nt token\n"));
456 /*******************************************************************
457 Create a NT token for the user, expanding local aliases
458 *******************************************************************/
460 struct nt_user_token
*create_local_nt_token(TALLOC_CTX
*mem_ctx
,
461 const struct dom_sid
*user_sid
,
464 const struct dom_sid
*groupsids
)
466 struct nt_user_token
*result
= NULL
;
470 DEBUG(10, ("Create local NT token for %s\n",
471 sid_string_dbg(user_sid
)));
473 if (!(result
= TALLOC_ZERO_P(mem_ctx
, struct nt_user_token
))) {
474 DEBUG(0, ("talloc failed\n"));
478 /* Add the user and primary group sid */
480 status
= add_sid_to_array(result
, user_sid
,
481 &result
->user_sids
, &result
->num_sids
);
482 if (!NT_STATUS_IS_OK(status
)) {
487 /* For guest, num_groupsids may be zero. */
489 status
= add_sid_to_array(result
, &groupsids
[0],
492 if (!NT_STATUS_IS_OK(status
)) {
498 /* Now the SIDs we got from authentication. These are the ones from
499 * the info3 struct or from the pdb_enum_group_memberships, depending
500 * on who authenticated the user.
501 * Note that we start the for loop at "1" here, we already added the
502 * first group sid as primary above. */
504 for (i
=1; i
<num_groupsids
; i
++) {
505 status
= add_sid_to_array_unique(result
, &groupsids
[i
],
508 if (!NT_STATUS_IS_OK(status
)) {
514 status
= finalize_local_nt_token(result
, is_guest
);
515 if (!NT_STATUS_IS_OK(status
)) {
523 static NTSTATUS
finalize_local_nt_token(struct nt_user_token
*result
,
526 struct dom_sid dom_sid
;
530 /* Add in BUILTIN sids */
532 status
= add_sid_to_array(result
, &global_sid_World
,
533 &result
->user_sids
, &result
->num_sids
);
534 if (!NT_STATUS_IS_OK(status
)) {
537 status
= add_sid_to_array(result
, &global_sid_Network
,
538 &result
->user_sids
, &result
->num_sids
);
539 if (!NT_STATUS_IS_OK(status
)) {
544 status
= add_sid_to_array(result
, &global_sid_Builtin_Guests
,
547 if (!NT_STATUS_IS_OK(status
)) {
551 status
= add_sid_to_array(result
,
552 &global_sid_Authenticated_Users
,
555 if (!NT_STATUS_IS_OK(status
)) {
560 /* Deal with the BUILTIN\Administrators group. If the SID can
561 be resolved then assume that the add_aliasmem( S-1-5-32 )
564 if (!sid_to_gid(&global_sid_Builtin_Administrators
, &gid
)) {
567 if (!secrets_fetch_domain_sid(lp_workgroup(), &dom_sid
)) {
568 status
= NT_STATUS_OK
;
569 DEBUG(3, ("Failed to fetch domain sid for %s\n",
572 status
= create_builtin_administrators(&dom_sid
);
576 if (NT_STATUS_EQUAL(status
, NT_STATUS_PROTOCOL_UNREACHABLE
)) {
577 /* Add BUILTIN\Administrators directly to token. */
578 status
= add_builtin_administrators(result
, &dom_sid
);
579 if ( !NT_STATUS_IS_OK(status
) ) {
580 DEBUG(3, ("Failed to check for local "
581 "Administrators membership (%s)\n",
584 } else if (!NT_STATUS_IS_OK(status
)) {
585 DEBUG(2, ("WARNING: Failed to create "
586 "BUILTIN\\Administrators group! Can "
587 "Winbind allocate gids?\n"));
591 /* Deal with the BUILTIN\Users group. If the SID can
592 be resolved then assume that the add_aliasmem( S-1-5-32 )
595 if (!sid_to_gid(&global_sid_Builtin_Users
, &gid
)) {
598 if (!secrets_fetch_domain_sid(lp_workgroup(), &dom_sid
)) {
599 status
= NT_STATUS_OK
;
600 DEBUG(3, ("Failed to fetch domain sid for %s\n",
603 status
= create_builtin_users(&dom_sid
);
607 if (!NT_STATUS_EQUAL(status
, NT_STATUS_PROTOCOL_UNREACHABLE
) &&
608 !NT_STATUS_IS_OK(status
))
610 DEBUG(2, ("WARNING: Failed to create BUILTIN\\Users group! "
611 "Can Winbind allocate gids?\n"));
615 /* Deal with local groups */
617 if (lp_winbind_nested_groups()) {
621 /* Now add the aliases. First the one from our local SAM */
623 status
= add_aliases(get_global_sam_sid(), result
);
625 if (!NT_STATUS_IS_OK(status
)) {
630 /* Finally the builtin ones */
632 status
= add_aliases(&global_sid_Builtin
, result
);
634 if (!NT_STATUS_IS_OK(status
)) {
642 /* Add privileges based on current user sids */
644 get_privileges_for_sids(&result
->privileges
, result
->user_sids
,
650 /****************************************************************************
651 prints a NT_USER_TOKEN to debug output.
652 ****************************************************************************/
654 void debug_nt_user_token(int dbg_class
, int dbg_lev
, NT_USER_TOKEN
*token
)
659 DEBUGC(dbg_class
, dbg_lev
, ("NT user token: (NULL)\n"));
663 DEBUGC(dbg_class
, dbg_lev
,
664 ("NT user token of user %s\n",
665 sid_string_dbg(&token
->user_sids
[0]) ));
666 DEBUGADDC(dbg_class
, dbg_lev
,
667 ("contains %lu SIDs\n", (unsigned long)token
->num_sids
));
668 for (i
= 0; i
< token
->num_sids
; i
++)
669 DEBUGADDC(dbg_class
, dbg_lev
,
670 ("SID[%3lu]: %s\n", (unsigned long)i
,
671 sid_string_dbg(&token
->user_sids
[i
])));
673 dump_se_priv( dbg_class
, dbg_lev
, &token
->privileges
);
676 /****************************************************************************
677 prints a UNIX 'token' to debug output.
678 ****************************************************************************/
680 void debug_unix_user_token(int dbg_class
, int dbg_lev
, uid_t uid
, gid_t gid
,
681 int n_groups
, gid_t
*groups
)
684 DEBUGC(dbg_class
, dbg_lev
,
685 ("UNIX token of user %ld\n", (long int)uid
));
687 DEBUGADDC(dbg_class
, dbg_lev
,
688 ("Primary group is %ld and contains %i supplementary "
689 "groups\n", (long int)gid
, n_groups
));
690 for (i
= 0; i
< n_groups
; i
++)
691 DEBUGADDC(dbg_class
, dbg_lev
, ("Group[%3i]: %ld\n", i
,
692 (long int)groups
[i
]));
696 * Create an artificial NT token given just a username. (Initially intended
699 * We go through lookup_name() to avoid problems we had with 'winbind use
704 * unmapped unix users: Go directly to nss to find the user's group.
706 * A passdb user: The list of groups is provided by pdb_enum_group_memberships.
708 * If the user is provided by winbind, the primary gid is set to "domain
709 * users" of the user's domain. For an explanation why this is necessary, see
710 * the thread starting at
711 * http://lists.samba.org/archive/samba-technical/2006-January/044803.html.
714 NTSTATUS
create_token_from_username(TALLOC_CTX
*mem_ctx
, const char *username
,
716 uid_t
*uid
, gid_t
*gid
,
717 char **found_username
,
718 struct nt_user_token
**token
)
720 NTSTATUS result
= NT_STATUS_NO_SUCH_USER
;
721 TALLOC_CTX
*tmp_ctx
= talloc_stackframe();
722 struct dom_sid user_sid
;
723 enum lsa_SidType type
;
725 struct dom_sid
*group_sids
;
726 struct dom_sid unix_group_sid
;
727 size_t num_group_sids
;
731 if (!lookup_name_smbconf(tmp_ctx
, username
, LOOKUP_NAME_ALL
,
732 NULL
, NULL
, &user_sid
, &type
)) {
733 DEBUG(1, ("lookup_name_smbconf for %s failed\n", username
));
737 if (type
!= SID_NAME_USER
) {
738 DEBUG(1, ("%s is a %s, not a user\n", username
,
739 sid_type_lookup(type
)));
743 if (sid_check_is_in_our_domain(&user_sid
)) {
746 /* This is a passdb user, so ask passdb */
748 struct samu
*sam_acct
= NULL
;
750 if ( !(sam_acct
= samu_new( tmp_ctx
)) ) {
751 result
= NT_STATUS_NO_MEMORY
;
756 ret
= pdb_getsampwsid(sam_acct
, &user_sid
);
760 DEBUG(1, ("pdb_getsampwsid(%s) for user %s failed\n",
761 sid_string_dbg(&user_sid
), username
));
762 DEBUGADD(1, ("Fall back to unix user %s\n", username
));
766 result
= pdb_enum_group_memberships(tmp_ctx
, sam_acct
,
769 if (!NT_STATUS_IS_OK(result
)) {
770 DEBUG(1, ("enum_group_memberships failed for %s (%s): "
771 "%s\n", username
, sid_string_dbg(&user_sid
),
773 DEBUGADD(1, ("Fall back to unix user %s\n", username
));
777 /* see the smb_panic() in pdb_default_enum_group_memberships */
778 SMB_ASSERT(num_group_sids
> 0);
782 /* Ensure we're returning the found_username on the right context. */
783 *found_username
= talloc_strdup(mem_ctx
,
784 pdb_get_username(sam_acct
));
787 * If the SID from lookup_name() was the guest sid, passdb knows
788 * about the mapping of guest sid to lp_guestaccount()
789 * username and will return the unix_pw info for a guest
790 * user. Use it if it's there, else lookup the *uid details
791 * using getpwnam_alloc(). See bug #6291 for details. JRA.
794 /* We must always assign the *uid. */
795 if (sam_acct
->unix_pw
== NULL
) {
796 struct passwd
*pwd
= getpwnam_alloc(sam_acct
, *found_username
);
798 DEBUG(10, ("getpwnam_alloc failed for %s\n",
800 result
= NT_STATUS_NO_SUCH_USER
;
803 result
= samu_set_unix(sam_acct
, pwd
);
804 if (!NT_STATUS_IS_OK(result
)) {
805 DEBUG(10, ("samu_set_unix failed for %s\n",
807 result
= NT_STATUS_NO_SUCH_USER
;
811 *uid
= sam_acct
->unix_pw
->pw_uid
;
813 } else if (sid_check_is_in_unix_users(&user_sid
)) {
815 /* This is a unix user not in passdb. We need to ask nss
816 * directly, without consulting passdb */
821 * This goto target is used as a fallback for the passdb
822 * case. The concrete bug report is when passdb gave us an
828 if (!sid_to_uid(&user_sid
, uid
)) {
829 DEBUG(1, ("unix_user case, sid_to_uid for %s (%s) failed\n",
830 username
, sid_string_dbg(&user_sid
)));
831 result
= NT_STATUS_NO_SUCH_USER
;
835 uid_to_unix_users_sid(*uid
, &user_sid
);
837 pass
= getpwuid_alloc(tmp_ctx
, *uid
);
839 DEBUG(1, ("getpwuid(%u) for user %s failed\n",
840 (unsigned int)*uid
, username
));
844 if (!getgroups_unix_user(tmp_ctx
, username
, pass
->pw_gid
,
845 &gids
, &num_group_sids
)) {
846 DEBUG(1, ("getgroups_unix_user for user %s failed\n",
851 if (num_group_sids
) {
852 group_sids
= TALLOC_ARRAY(tmp_ctx
, struct dom_sid
, num_group_sids
);
853 if (group_sids
== NULL
) {
854 DEBUG(1, ("TALLOC_ARRAY failed\n"));
855 result
= NT_STATUS_NO_MEMORY
;
862 for (i
=0; i
<num_group_sids
; i
++) {
863 gid_to_sid(&group_sids
[i
], gids
[i
]);
866 /* In getgroups_unix_user we always set the primary gid */
867 SMB_ASSERT(num_group_sids
> 0);
871 /* Ensure we're returning the found_username on the right context. */
872 *found_username
= talloc_strdup(mem_ctx
, pass
->pw_name
);
875 /* This user is from winbind, force the primary gid to the
876 * user's "domain users" group. Under certain circumstances
877 * (user comes from NT4), this might be a loss of
878 * information. But we can not rely on winbind getting the
879 * correct info. AD might prohibit winbind looking up that
884 /* We must always assign the *uid. */
885 if (!sid_to_uid(&user_sid
, uid
)) {
886 DEBUG(1, ("winbindd case, sid_to_uid for %s (%s) failed\n",
887 username
, sid_string_dbg(&user_sid
)));
888 result
= NT_STATUS_NO_SUCH_USER
;
893 group_sids
= TALLOC_ARRAY(tmp_ctx
, struct dom_sid
, num_group_sids
);
894 if (group_sids
== NULL
) {
895 DEBUG(1, ("TALLOC_ARRAY failed\n"));
896 result
= NT_STATUS_NO_MEMORY
;
900 sid_copy(&group_sids
[0], &user_sid
);
901 sid_split_rid(&group_sids
[0], &dummy
);
902 sid_append_rid(&group_sids
[0], DOMAIN_RID_USERS
);
904 if (!sid_to_gid(&group_sids
[0], gid
)) {
905 DEBUG(1, ("sid_to_gid(%s) failed\n",
906 sid_string_dbg(&group_sids
[0])));
912 /* Ensure we're returning the found_username on the right context. */
913 *found_username
= talloc_strdup(mem_ctx
, username
);
916 /* Add the "Unix Group" SID for each gid to catch mapped groups
917 and their Unix equivalent. This is to solve the backwards
918 compatibility problem of 'valid users = +ntadmin' where
919 ntadmin has been paired with "Domain Admins" in the group
920 mapping table. Otherwise smb.conf would need to be changed
921 to 'valid user = "Domain Admins"'. --jerry */
923 num_gids
= num_group_sids
;
924 for ( i
=0; i
<num_gids
; i
++ ) {
927 /* don't pickup anything managed by Winbind */
929 if ( lp_idmap_gid(&low
, &high
) && (gids
[i
] >= low
) && (gids
[i
] <= high
) )
932 gid_to_unix_groups_sid(gids
[i
], &unix_group_sid
);
934 result
= add_sid_to_array_unique(tmp_ctx
, &unix_group_sid
,
935 &group_sids
, &num_group_sids
);
936 if (!NT_STATUS_IS_OK(result
)) {
941 /* Ensure we're creating the nt_token on the right context. */
942 *token
= create_local_nt_token(mem_ctx
, &user_sid
,
943 is_guest
, num_group_sids
, group_sids
);
945 if ((*token
== NULL
) || (*found_username
== NULL
)) {
946 result
= NT_STATUS_NO_MEMORY
;
950 result
= NT_STATUS_OK
;
952 TALLOC_FREE(tmp_ctx
);
956 /***************************************************************************
957 Build upon create_token_from_username:
959 Expensive helper function to figure out whether a user given its name is
960 member of a particular group.
961 ***************************************************************************/
963 bool user_in_group_sid(const char *username
, const struct dom_sid
*group_sid
)
968 char *found_username
;
969 struct nt_user_token
*token
;
971 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
973 status
= create_token_from_username(mem_ctx
, username
, False
,
974 &uid
, &gid
, &found_username
,
977 if (!NT_STATUS_IS_OK(status
)) {
978 DEBUG(10, ("could not create token for %s\n", username
));
979 TALLOC_FREE(mem_ctx
);
983 result
= nt_token_check_sid(group_sid
, token
);
985 TALLOC_FREE(mem_ctx
);
989 bool user_in_group(const char *username
, const char *groupname
)
991 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
992 struct dom_sid group_sid
;
995 ret
= lookup_name(mem_ctx
, groupname
, LOOKUP_NAME_ALL
,
996 NULL
, NULL
, &group_sid
, NULL
);
997 TALLOC_FREE(mem_ctx
);
1000 DEBUG(10, ("lookup_name for (%s) failed.\n", groupname
));
1004 return user_in_group_sid(username
, &group_sid
);