source/sam/idmap_rid.c

   1 /*
   2  *  idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
   3  *  Copyright (C) Guenther Deschner, 2004
   4  *  Copyright (C) Sumit Bose, 2004
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  *
  20  */
  21
  22 #include "includes.h"
  23
  24 #undef DBGC_CLASS
  25 #define DBGC_CLASS DBGC_IDMAP
  26
  27 #define IDMAP_RID_SUPPORT_TRUSTED_DOMAINS 0
  28
  29 NTSTATUS init_module(void);
  30
  31 struct dom_entry {
  32         fstring name;
  33         fstring sid;
  34         uint32 min_id;
  35         uint32 max_id;
  36 };
  37
  38 typedef struct trust_dom_array {
  39         int number;
  40         struct dom_entry *dom;
  41 } trust_dom_array;
  42
  43 static trust_dom_array trust;
  44
  45 static NTSTATUS rid_idmap_parse(const char *init_param,
  46                                 uint32 num_domains,
  47                                 fstring *domain_names,
  48                                 DOM_SID *domain_sids,
  49                                 uid_t u_low,
  50                                 uid_t u_high)
  51 {
  52         const char *p;
  53         int i;
  54         trust.number = 0;
  55         fstring sid_str;
  56         BOOL known_domain = False;
  57         p = init_param;
  58         fstring tok;
  59
  60         /* falling back to automatic mapping when there were no options given */
  61         if (!*init_param) {
  62
  63                 DEBUG(3,("rid_idmap_parse: no domain list given or trusted domain-support deactivated, falling back to automatic mapping for own domain:\n"));
  64
  65                 sid_to_string(sid_str, &domain_sids[0]);
  66
  67                 fstrcpy(trust.dom[0].name, domain_names[0]);
  68                 fstrcpy(trust.dom[0].sid, sid_str);
  69                 trust.dom[0].min_id = u_low;
  70                 trust.dom[0].max_id = u_high;
  71                 trust.number = 1;
  72
  73                 DEBUGADD(3,("rid_idmap_parse:\tdomain: [%s], sid: [%s], range=[%d-%d]\n",
  74                                 trust.dom[0].name, trust.dom[0].sid, trust.dom[0].min_id, trust.dom[0].max_id));
  75                 return NT_STATUS_OK;
  76         }
  77
  78         /* scan through the init_param-list */
  79         while (next_token(&init_param, tok, LIST_SEP, sizeof(tok))) {
  80
  81                 p = tok;
  82                 DEBUG(3,("rid_idmap_parse: parsing entry: %d\n", trust.number));
  83
  84                 /* reinit sizes */
  85                 trust.dom = (struct dom_entry *) realloc(trust.dom, sizeof(struct dom_entry)*(trust.number+1));
  86
  87                 if ( trust.dom == NULL ) {
  88                         return NT_STATUS_NO_MEMORY;
  89                 }
  90
  91                 if (!next_token(&p, tok, "=", sizeof(tok))) {
  92                         DEBUG(0, ("rid_idmap_parse: no '=' sign found in domain list [%s]\n", init_param));
  93                         return NT_STATUS_UNSUCCESSFUL;
  94                 }
  95
  96                 /* add the name */
  97                 fstrcpy(trust.dom[trust.number].name, tok);
  98                 DEBUGADD(3,("rid_idmap_parse:\tentry %d has name: [%s]\n", trust.number, trust.dom[trust.number].name));
  99
 100                 /* add the domain-sid */
 101                 for (i=0; i<num_domains; i++) {
 102
 103                         known_domain = False;
 104
 105                         if (strequal(domain_names[i], trust.dom[trust.number].name)) {
 106
 107                                 sid_to_string(sid_str, &domain_sids[i]);
 108                                 fstrcpy(trust.dom[trust.number].sid, sid_str);
 109
 110                                 DEBUGADD(3,("rid_idmap_parse:\tentry %d has sid: [%s]\n", trust.number, trust.dom[trust.number].sid));
 111                                 known_domain = True;
 112                                 break;
 113                         }
 114                 }
 115
 116                 if (!known_domain) {
 117                         DEBUG(0,("rid_idmap_parse: your DC does not know anything about domain: [%s]\n", trust.dom[trust.number].name));
 118                         return NT_STATUS_INVALID_PARAMETER;
 119                 }
 120
 121                 if (!next_token(&p, tok, "-", sizeof(tok))) {
 122                         DEBUG(0,("rid_idmap_parse: no mapping-range defined\n"));
 123                         return NT_STATUS_INVALID_PARAMETER;
 124                 }
 125
 126                 /* add min_id */
 127                 trust.dom[trust.number].min_id = atoi(tok);
 128                 DEBUGADD(3,("rid_idmap_parse:\tentry %d has min_id: [%d]\n", trust.number, trust.dom[trust.number].min_id));
 129
 130                 /* add max_id */
 131                 trust.dom[trust.number].max_id = atoi(p);
 132                 DEBUGADD(3,("rid_idmap_parse:\tentry %d has max_id: [%d]\n", trust.number, trust.dom[trust.number].max_id));
 133
 134                 trust.number++;
 135         }
 136
 137         return NT_STATUS_OK;
 138
 139 }
 140
 141 static NTSTATUS rid_idmap_get_domains(uint32 *num_domains, fstring **domain_names, DOM_SID **domain_sids)
 142 {
 143         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 144         struct cli_state *cli;
 145         TALLOC_CTX *mem_ctx;
 146         POLICY_HND pol;
 147         uint32 des_access = SEC_RIGHTS_MAXIMUM_ALLOWED;
 148         fstring dc_name;
 149         struct in_addr dc_ip;
 150         char *password = NULL;
 151         char *username = NULL;
 152         char *domain = NULL;
 153         uint32 info_class = 5;
 154         char *domain_name = NULL;
 155         DOM_SID *domain_sid;
 156         fstring sid_str;
 157         int i;
 158         uint32 trusted_num_domains = 0;
 159         char **trusted_domain_names;
 160         DOM_SID *trusted_domain_sids;
 161
 162         /* create mem_ctx */
 163         if (!(mem_ctx = talloc_init("rid_idmap_get_trusted_domains"))) {
 164                 DEBUG(0, ("rid_idmap_get_domains: talloc_init() failed\n"));
 165                 return NT_STATUS_NO_MEMORY;
 166         }
 167
 168         if (!get_dc_name(lp_workgroup(), 0, dc_name, &dc_ip)) {
 169                 DEBUG(1, ("rid_idmap_get_domains: could not get dc-name\n"));
 170                 return NT_STATUS_UNSUCCESSFUL;
 171         }
 172
 173         /* open a connection to the dc */
 174         username = secrets_fetch(SECRETS_AUTH_USER, NULL);
 175         password = secrets_fetch(SECRETS_AUTH_PASSWORD, NULL);
 176         domain =   secrets_fetch(SECRETS_AUTH_DOMAIN, NULL);
 177
 178         if (username) {
 179
 180                 if (!domain)
 181                         domain = smb_xstrdup(lp_workgroup());
 182
 183                 if (!password)
 184                         password = smb_xstrdup("");
 185
 186                 DEBUG(3, ("rid_idmap_get_domains: IPC$ connections done by user %s\\%s\n", domain, username));
 187
 188         } else {
 189
 190                 DEBUG(3, ("rid_idmap_get_domains: IPC$ connections done anonymously\n"));
 191                 username = "";
 192                 domain = "";
 193                 password = "";
 194         }
 195
 196         DEBUG(10, ("rid_idmap_get_domains: opening connection to [%s]\n", dc_name));
 197
 198         status = cli_full_connection(&cli, global_myname(), dc_name,
 199                         NULL, 0,
 200                         "IPC$", "IPC",
 201                         username,
 202                         lp_workgroup(),
 203                         password,
 204                         CLI_FULL_CONNECTION_ANNONYMOUS_FALLBACK, True, NULL);
 205
 206         if (!NT_STATUS_IS_OK(status)) {
 207                 DEBUG(1, ("rid_idmap_get_domains: could not setup connection to dc\n"));
 208                 return status;
 209         }
 210
 211         /* query the lsa-pipe */
 212         if (!cli_nt_session_open (cli, PI_LSARPC)) {
 213                 DEBUG(1, ("rid_idmap_get_domains: could not setup connection to dc\n"));
 214                 goto out;
 215         }
 216
 217         /* query policies */
 218         status = cli_lsa_open_policy(cli, mem_ctx, False, des_access, &pol);
 219         if (!NT_STATUS_IS_OK(status)) {
 220                 goto out;
 221         }
 222
 223         status = cli_lsa_query_info_policy(cli, mem_ctx, &pol, info_class, &domain_name, &domain_sid);
 224         if (!NT_STATUS_IS_OK(status)) {
 225                 DEBUG(1, ("rid_idmap_get_domains: cannot retrieve domain-info\n"));
 226                 goto out;
 227         }
 228
 229         sid_to_string(sid_str, domain_sid);
 230         DEBUG(10,("rid_idmap_get_domains: my domain: [%s], sid: [%s]\n", domain_name, sid_str));
 231
 232         if (lp_allow_trusted_domains()) {
 233
 234                 uint32 enum_ctx = 0;
 235
 236                 /* scan trusted domains */
 237                 DEBUG(10, ("rid_idmap_get_domains: enumerating trusted domains\n"));
 238                 status = cli_lsa_enum_trust_dom(cli, mem_ctx, &pol, &enum_ctx,
 239                                 &trusted_num_domains,
 240                                 &trusted_domain_names,
 241                                 &trusted_domain_sids);
 242
 243                 if (!NT_STATUS_IS_OK(status) &&
 244                     !NT_STATUS_EQUAL(status, NT_STATUS_NO_MORE_ENTRIES) &&
 245                     !NT_STATUS_EQUAL(status, STATUS_MORE_ENTRIES)) {
 246                         DEBUG(1, ("rid_idmap_get_domains: could not enumerate trusted domains\n"));
 247                         goto out;
 248                 }
 249
 250                 /* show trusted domains */
 251                 DEBUG(10,("rid_idmap_get_domains: scan for trusted domains gave %d results:\n", trusted_num_domains));
 252                 for (i=0; i<trusted_num_domains; i++) {
 253                         sid_to_string(sid_str, &trusted_domain_sids[i]);
 254                         DEBUGADD(10,("rid_idmap_get_domains:\t#%d\tDOMAIN: [%s], SID: [%s]\n",
 255                                                 i, trusted_domain_names[i], sid_str));
 256                 }
 257         }
 258
 259         /* put the results together */
 260         *num_domains = trusted_num_domains + 1;
 261         *domain_names = (fstring *) malloc(sizeof(fstring) * *num_domains);
 262         *domain_sids = (DOM_SID *) malloc(sizeof(DOM_SID) * *num_domains);
 263
 264         /* first add myself at the end*/
 265         fstrcpy((*domain_names)[0], domain_name);
 266         sid_copy(&(*domain_sids)[0], domain_sid);
 267
 268         /* add trusted domains */
 269         for (i=0; i<trusted_num_domains; i++) {
 270                 fstrcpy((*domain_names)[i+1], trusted_domain_names[i]);
 271                 sid_copy(&((*domain_sids)[i+1]), &(trusted_domain_sids[i]));
 272         }
 273
 274         /* show complete domain list */
 275         DEBUG(5,("rid_idmap_get_domains: complete domain-list has %d entries:\n", *num_domains));
 276         for (i=0; i<*num_domains; i++) {
 277                 sid_to_string(sid_str, &((*domain_sids)[i]));
 278                 DEBUGADD(5,("rid_idmap_get_domains:\t#%d\tdomain: [%s], sid: [%s]\n",
 279                                         i, (*domain_names)[i], sid_str ));
 280         }
 281
 282         status = NT_STATUS_OK;
 283
 284 out:
 285         cli_lsa_close(cli, mem_ctx, &pol);
 286         cli_nt_session_close(cli);
 287         talloc_destroy(mem_ctx);
 288         cli_shutdown(cli);
 289
 290         return status;
 291 }
 292
 293 static NTSTATUS rid_idmap_init(char *init_param)
 294 {
 295         int i, j;
 296         uid_t u_low, u_high;
 297         gid_t g_low, g_high;
 298         uint32 num_domains = 0;
 299         fstring *domain_names;
 300         DOM_SID *domain_sids;
 301         NTSTATUS nt_status = NT_STATUS_INVALID_PARAMETER;
 302         trust.dom = NULL;
 303
 304         /* basic sanity checks */
 305         if (!lp_idmap_uid(&u_low, &u_high) || !lp_idmap_gid(&g_low, &g_high)) {
 306                 DEBUG(0, ("rid_idmap_init: cannot get required global idmap-ranges.\n"));
 307                 return nt_status;
 308         }
 309
 310         if (u_low != g_low || u_high != g_high) {
 311                 DEBUG(0, ("rid_idmap_init: range defined in \"idmap uid\" must match range of \"idmap gid\".\n"));
 312                 return nt_status;
 313         }
 314
 315         if (lp_allow_trusted_domains()) {
 316 #if IDMAP_RID_SUPPORT_TRUSTED_DOMAINS
 317                 DEBUG(3,("rid_idmap_init: enabling trusted-domain-mapping\n"));
 318 #else
 319                 DEBUG(0,("rid_idmap_init: idmap_rid does not work with trusted domains\n"));
 320                 DEBUGADD(0,("rid_idmap_init: please set \"allow trusted domains\" to \"no\" when using idmap_rid\n"));
 321                 return nt_status;
 322 #endif
 323         }
 324
 325         /* init sizes */
 326         trust.dom = (struct dom_entry *) malloc(sizeof(struct dom_entry));
 327         if (trust.dom == NULL) {
 328                 return NT_STATUS_NO_MEMORY;
 329         }
 330
 331         /* retrieve full domain list */
 332         nt_status = rid_idmap_get_domains(&num_domains, &domain_names, &domain_sids);
 333         if (!NT_STATUS_IS_OK(nt_status) &&
 334             !NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_MORE_ENTRIES) &&
 335             !NT_STATUS_EQUAL(nt_status, STATUS_MORE_ENTRIES)) {
 336                 DEBUG(0, ("rid_idmap_init: cannot fetch sids for domain and/or trusted-domains from domain-controller.\n"));
 337                 return nt_status;
 338         }
 339
 340         /* parse the init string */
 341         nt_status = rid_idmap_parse(init_param, num_domains, domain_names, domain_sids, u_low, u_high);
 342         if (!NT_STATUS_IS_OK(nt_status)) {
 343                 DEBUG(0, ("rid_idmap_init: cannot parse module-configuration\n"));
 344                 goto out;
 345         }
 346
 347         nt_status = NT_STATUS_INVALID_PARAMETER;
 348
 349         /* some basic sanity checks */
 350         for (i=0; i<trust.number; i++) {
 351
 352                 if (trust.dom[i].min_id > trust.dom[i].max_id) {
 353                         DEBUG(0, ("rid_idmap_init: min_id (%d) has to be smaller than max_id (%d) for domain [%s]\n",
 354                                                 trust.dom[i].min_id, trust.dom[i].max_id, trust.dom[i].name));
 355                         goto out;
 356                 }
 357
 358                 if (trust.dom[i].min_id < u_low || trust.dom[i].max_id > u_high) {
 359                         DEBUG(0, ("rid_idmap_init: mapping of domain [%s] (%d-%d) has to fit into global idmap range (%d-%d).\n",
 360                                                 trust.dom[i].name, trust.dom[i].min_id, trust.dom[i].max_id, u_low, u_high));
 361                         goto out;
 362                 }
 363         }
 364
 365         /* check for overlaps */
 366         for (i=0; i<trust.number-1; i++) {
 367                 for (j=i+1; j<trust.number; j++) {
 368                         if (trust.dom[i].min_id <= trust.dom[j].max_id && trust.dom[j].min_id <= trust.dom[i].max_id) {
 369                                 DEBUG(0, ("rid_idmap_init: the ranges of domain [%s] and [%s] overlap\n",
 370                                                         trust.dom[i+1].name, trust.dom[i].name));
 371                                 goto out;
 372                         }
 373                 }
 374         }
 375
 376         DEBUG(3, ("rid_idmap_init: using %d mappings:\n", trust.number));
 377         for (i=0; i<trust.number; i++) {
 378                 DEBUGADD(3, ("rid_idmap_init:\tdomain: [%s], sid: [%s], min_id: [%d], max_id: [%d]\n",
 379                                 trust.dom[i].name, trust.dom[i].sid, trust.dom[i].min_id, trust.dom[i].max_id));
 380         }
 381
 382         nt_status = NT_STATUS_OK;
 383
 384 out:
 385         SAFE_FREE(domain_names);
 386         SAFE_FREE(domain_sids);
 387
 388         return nt_status;
 389 }
 390
 391 static NTSTATUS rid_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, int id_type)
 392 {
 393         fstring sid_string;
 394         int i;
 395         DOM_SID sidstr;
 396
 397         /* find range */
 398         for (i=0; i<trust.number; i++) {
 399                 if (trust.dom[i].min_id <= unid.uid && trust.dom[i].max_id >= unid.uid )
 400                         break;
 401         }
 402
 403         if (i == trust.number) {
 404                 DEBUG(0,("rid_idmap_get_sid_from_id: no suitable range available for id: %d\n", unid.uid));
 405                 return NT_STATUS_INVALID_PARAMETER;
 406         }
 407
 408         /* use lower-end of idmap-range as offset for users and groups*/
 409         unid.uid -= trust.dom[i].min_id;
 410
 411         if (!trust.dom[i].sid)
 412                 return NT_STATUS_INVALID_PARAMETER;
 413
 414         string_to_sid(&sidstr, trust.dom[i].sid);
 415         sid_copy(sid, &sidstr);
 416         if (!sid_append_rid( sid, (unsigned long)unid.uid )) {
 417                 DEBUG(0,("rid_idmap_get_sid_from_id: could not append rid to domain sid\n"));
 418                 return NT_STATUS_NO_MEMORY;
 419         }
 420
 421         DEBUG(3, ("rid_idmap_get_sid_from_id: mapped POSIX %s %d to SID [%s]\n",
 422                 (id_type == ID_GROUPID) ? "GID" : "UID", unid.uid,
 423                 sid_to_string(sid_string, sid)));
 424
 425         return NT_STATUS_OK;
 426 }
 427
 428 static NTSTATUS rid_idmap_get_id_from_sid(unid_t *unid, int *id_type, const DOM_SID *sid)
 429 {
 430         fstring sid_string;
 431         int i;
 432         uint32 rid;
 433         DOM_SID sidstr;
 434
 435         /* check if we have a mapping for the sid */
 436         for (i=0; i<trust.number; i++) {
 437                 if (!trust.dom[i].sid) {
 438                         return NT_STATUS_INVALID_PARAMETER;
 439                 }
 440                 string_to_sid(&sidstr, trust.dom[i].sid);
 441                 if ( sid_compare_domain(sid, &sidstr) == 0 )
 442                         break;
 443         }
 444
 445         if (i == trust.number) {
 446                 DEBUG(0,("rid_idmap_get_id_from_sid: no suitable range available for sid: %s\n",
 447                         sid_string_static(sid)));
 448                 return NT_STATUS_INVALID_PARAMETER;
 449         }
 450
 451         if (!sid_peek_rid(sid, &rid)) {
 452                 DEBUG(0,("rid_idmap_get_id_from_sid: could not peek rid\n"));
 453                 return NT_STATUS_INVALID_PARAMETER;
 454         }
 455
 456         /* use lower-end of idmap-range as offset for users and groups */
 457         unid->uid = rid + trust.dom[i].min_id;
 458
 459         if (unid->uid > trust.dom[i].max_id) {
 460                 DEBUG(0,("rid_idmap_get_id_from_sid: rid: %d too high for mapping of domain: %s\n", rid, trust.dom[i].name));
 461                 return NT_STATUS_INVALID_PARAMETER;
 462         }
 463         if (unid->uid < trust.dom[i].min_id) {
 464                 DEBUG(0,("rid_idmap_get_id_from_sid: rid: %d too low for mapping of domain: %s\n", rid, trust.dom[i].name));
 465                 return NT_STATUS_INVALID_PARAMETER;
 466         }
 467
 468         DEBUG(3,("rid_idmap_get_id_from_sid: mapped SID [%s] to POSIX %s %d\n",
 469                 sid_to_string(sid_string, sid),
 470                 (*id_type == ID_GROUPID) ? "GID" : "UID", unid->uid));
 471
 472         return NT_STATUS_OK;
 473
 474 }
 475
 476 static NTSTATUS rid_idmap_set_mapping(const DOM_SID *sid, unid_t id, int id_type)
 477 {
 478         return NT_STATUS_NOT_IMPLEMENTED;
 479 }
 480
 481 static NTSTATUS rid_idmap_close(void)
 482 {
 483         SAFE_FREE(trust.dom);
 484
 485         return NT_STATUS_OK;
 486 }
 487
 488 static NTSTATUS rid_idmap_allocate_rid(uint32 *rid, int rid_type)
 489 {
 490         return NT_STATUS_NOT_IMPLEMENTED;
 491 }
 492
 493 static NTSTATUS rid_idmap_allocate_id(unid_t *id, int id_type)
 494 {
 495         return NT_STATUS_NOT_IMPLEMENTED;
 496 }
 497
 498 static void rid_idmap_status(void)
 499 {
 500         DEBUG(0, ("RID IDMAP Status not available\n"));
 501 }
 502
 503 static struct idmap_methods rid_methods = {
 504         rid_idmap_init,
 505         rid_idmap_allocate_rid,
 506         rid_idmap_allocate_id,
 507         rid_idmap_get_sid_from_id,
 508         rid_idmap_get_id_from_sid,
 509         rid_idmap_set_mapping,
 510         rid_idmap_close,
 511         rid_idmap_status
 512 };
 513
 514 NTSTATUS init_module(void)
 515 {
 516         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "idmap_rid", &rid_methods);
 517 }
 518