2 * idmap_autorid: static map between Active Directory/NT RIDs
3 * and RFC 2307 accounts
5 * based on the idmap_rid module, but this module defines the ranges
6 * for the domains by automatically allocating a range for each domain
8 * Copyright (C) Christian Ambach, 2010-2011
10 * This program is free software; you can redistribute it and/or modify
11 * it under the terms of the GNU General Public License as published by
12 * the Free Software Foundation; either version 3 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful,
16 * but WITHOUT ANY WARRANTY; without even the implied warranty of
17 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 * GNU General Public License for more details.
20 * You should have received a copy of the GNU General Public License
21 * along with this program; if not, see <http://www.gnu.org/licenses/>.
26 #include "system/filesys.h"
28 #include "dbwrap/dbwrap.h"
29 #include "dbwrap/dbwrap_open.h"
31 #include "../libcli/security/dom_sid.h"
35 #define DBGC_CLASS DBGC_IDMAP
37 #define HWM "NEXT RANGE"
38 #define ALLOC_HWM_UID "NEXT ALLOC UID"
39 #define ALLOC_HWM_GID "NEXT ALLOC GID"
40 #define ALLOC_RANGE "ALLOC"
41 #define CONFIGKEY "CONFIG"
43 struct autorid_global_config
{
49 struct autorid_domain_config
{
52 struct autorid_global_config
*globalcfg
;
55 /* handle to the tdb storing domain <-> range assignments */
56 static struct db_context
*autorid_db
;
58 static NTSTATUS
idmap_autorid_get_domainrange(struct db_context
*db
,
62 uint32_t domainnum
, hwm
;
64 struct autorid_domain_config
*cfg
;
66 cfg
= (struct autorid_domain_config
*)private_data
;
68 ret
= dbwrap_fetch_uint32(db
, cfg
->sid
, &domainnum
);
69 if (!NT_STATUS_IS_OK(ret
)) {
70 DEBUG(10, ("Acquiring new range for domain %s\n", cfg
->sid
));
72 /* fetch the current HWM */
73 ret
= dbwrap_fetch_uint32(db
, HWM
, &hwm
);
74 if (!NT_STATUS_IS_OK(ret
)) {
75 DEBUG(1, ("Fatal error while fetching current "
76 "HWM value: %s\n", nt_errstr(ret
)));
77 ret
= NT_STATUS_INTERNAL_ERROR
;
81 /* do we have a range left? */
82 if (hwm
>= cfg
->globalcfg
->maxranges
) {
83 DEBUG(1, ("No more domain ranges available!\n"));
84 ret
= NT_STATUS_NO_MEMORY
;
88 /* increase the HWM */
89 ret
= dbwrap_change_uint32_atomic(db
, HWM
, &domainnum
, 1);
90 if (!NT_STATUS_IS_OK(ret
)) {
91 DEBUG(1, ("Fatal error while fetching a new "
92 "domain range value!\n"));
96 /* store away the new mapping in both directions */
97 ret
= dbwrap_trans_store_uint32(db
, cfg
->sid
, domainnum
);
98 if (!NT_STATUS_IS_OK(ret
)) {
99 DEBUG(1, ("Fatal error while storing new "
100 "domain->range assignment!\n"));
104 numstr
= talloc_asprintf(db
, "%u", domainnum
);
106 ret
= NT_STATUS_NO_MEMORY
;
110 ret
= dbwrap_trans_store_bystring(db
, numstr
,
111 string_term_tdb_data(cfg
->sid
), TDB_INSERT
);
114 if (!NT_STATUS_IS_OK(ret
)) {
115 DEBUG(1, ("Fatal error while storing "
116 "new domain->range assignment!\n"));
119 DEBUG(5, ("Acquired new range #%d for domain %s\n",
120 domainnum
, cfg
->sid
));
123 DEBUG(10, ("Using range #%d for domain %s\n", domainnum
, cfg
->sid
));
124 cfg
->domainnum
= domainnum
;
133 static NTSTATUS
idmap_autorid_id_to_sid(struct autorid_global_config
*cfg
,
142 /* can this be one of our ids? */
143 if (map
->xid
.id
< cfg
->minvalue
) {
144 DEBUG(10, ("id %d is lower than minimum value, "
145 "ignoring mapping request\n", map
->xid
.id
));
146 map
->status
= ID_UNKNOWN
;
150 if (map
->xid
.id
> (cfg
->minvalue
+ cfg
->rangesize
* cfg
->maxranges
)) {
151 DEBUG(10, ("id %d is outside of maximum id value, "
152 "ignoring mapping request\n", map
->xid
.id
));
153 map
->status
= ID_UNKNOWN
;
157 /* determine the range of this uid */
158 range
= ((map
->xid
.id
- cfg
->minvalue
) / cfg
->rangesize
);
160 keystr
= talloc_asprintf(talloc_tos(), "%u", range
);
162 return NT_STATUS_NO_MEMORY
;
165 status
= dbwrap_fetch_bystring(autorid_db
, talloc_tos(), keystr
, &data
);
168 if (!NT_STATUS_IS_OK(status
)) {
169 DEBUG(4, ("id %d belongs to range %d which does not have "
170 "domain mapping, ignoring mapping request\n",
171 map
->xid
.id
, range
));
172 TALLOC_FREE(data
.dptr
);
173 map
->status
= ID_UNKNOWN
;
177 if (strncmp((const char *)data
.dptr
,
179 strlen(ALLOC_RANGE
)) == 0) {
180 /* this is from the alloc range, there is no mapping back */
181 DEBUG(5, ("id %d belongs to alloc range, cannot map back\n",
183 TALLOC_FREE(data
.dptr
);
184 map
->status
= ID_UNKNOWN
;
188 string_to_sid(&sid
, (const char *)data
.dptr
);
189 TALLOC_FREE(data
.dptr
);
191 sid_compose(map
->sid
, &sid
,
192 (map
->xid
.id
- cfg
->minvalue
-
193 range
* cfg
->rangesize
));
195 /* We **really** should have some way of validating
196 the SID exists and is the correct type here. But
197 that is a deficiency in the idmap_rid design. */
199 map
->status
= ID_MAPPED
;
203 /**********************************
204 Single sid to id lookup function.
205 **********************************/
207 static NTSTATUS
idmap_autorid_sid_to_id(struct autorid_global_config
*global
,
208 struct autorid_domain_config
*domain
,
213 sid_peek_rid(map
->sid
, &rid
);
215 /* if the rid is higher than the size of the range, we cannot map it */
216 if (rid
>= global
->rangesize
) {
217 map
->status
= ID_UNKNOWN
;
218 DEBUG(2, ("RID %d is larger then size of range (%d), "
219 "user cannot be mapped\n", rid
, global
->rangesize
));
220 return NT_STATUS_UNSUCCESSFUL
;
222 map
->xid
.id
= global
->minvalue
+
223 (global
->rangesize
* domain
->domainnum
)+rid
;
225 /* We **really** should have some way of validating
226 the SID exists and is the correct type here. But
227 that is a deficiency in the idmap_rid design. */
229 map
->status
= ID_MAPPED
;
234 /**********************************
235 lookup a set of unix ids.
236 **********************************/
238 static NTSTATUS
idmap_autorid_unixids_to_sids(struct idmap_domain
*dom
,
241 struct autorid_global_config
*globalcfg
;
245 /* initialize the status to avoid surprise */
246 for (i
= 0; ids
[i
]; i
++) {
247 ids
[i
]->status
= ID_UNKNOWN
;
250 globalcfg
= talloc_get_type(dom
->private_data
,
251 struct autorid_global_config
);
253 for (i
= 0; ids
[i
]; i
++) {
255 ret
= idmap_autorid_id_to_sid(globalcfg
, ids
[i
]);
257 if ((!NT_STATUS_IS_OK(ret
)) &&
258 (!NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
))) {
259 /* some fatal error occurred, log it */
260 DEBUG(3, ("Unexpected error resolving an ID "
261 " (%d)\n", ids
[i
]->xid
.id
));
271 /**********************************
272 lookup a set of sids.
273 **********************************/
275 static NTSTATUS
idmap_autorid_sids_to_unixids(struct idmap_domain
*dom
,
278 struct autorid_global_config
*global
;
282 /* initialize the status to avoid surprise */
283 for (i
= 0; ids
[i
]; i
++) {
284 ids
[i
]->status
= ID_UNKNOWN
;
287 global
= talloc_get_type(dom
->private_data
,
288 struct autorid_global_config
);
290 for (i
= 0; ids
[i
]; i
++) {
291 struct winbindd_tdc_domain
*domain
;
292 struct autorid_domain_config domaincfg
;
294 struct dom_sid domainsid
;
296 ZERO_STRUCT(domaincfg
);
298 sid_copy(&domainsid
, ids
[i
]->sid
);
299 if (!sid_split_rid(&domainsid
, &rid
)) {
300 DEBUG(4, ("Could not determine domain SID from %s, "
301 "ignoring mapping request\n",
302 sid_string_dbg(ids
[i
]->sid
)));
307 * Check if the domain is around
309 domain
= wcache_tdc_fetch_domainbysid(talloc_tos(),
311 if (domain
== NULL
) {
312 DEBUG(10, ("Ignoring unknown domain sid %s\n",
313 sid_string_dbg(&domainsid
)));
318 domaincfg
.globalcfg
= global
;
319 sid_to_fstring(domaincfg
.sid
, &domainsid
);
321 ret
= dbwrap_trans_do(autorid_db
,
322 idmap_autorid_get_domainrange
,
325 if (!NT_STATUS_IS_OK(ret
)) {
326 DEBUG(3, ("Could not determine range for domain, "
327 "check previous messages for reason\n"));
331 ret
= idmap_autorid_sid_to_id(global
, &domaincfg
, ids
[i
]);
333 if ((!NT_STATUS_IS_OK(ret
)) &&
334 (!NT_STATUS_EQUAL(ret
, NT_STATUS_NONE_MAPPED
))) {
335 /* some fatal error occurred, log it */
336 DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
337 sid_string_dbg(ids
[i
]->sid
)));
348 /* initialize the given HWM to 0 if it does not exist yet */
349 static NTSTATUS
idmap_autorid_init_hwm(const char *hwm
) {
354 status
= dbwrap_fetch_uint32(autorid_db
, hwm
, &hwmval
);
355 if (NT_STATUS_EQUAL(status
, NT_STATUS_NOT_FOUND
)) {
356 status
= dbwrap_trans_store_int32(autorid_db
, hwm
, 0);
357 if (!NT_STATUS_IS_OK(status
)) {
359 ("Unable to initialise HWM (%s) in autorid "
360 "database: %s\n", hwm
, nt_errstr(status
)));
361 return NT_STATUS_INTERNAL_DB_ERROR
;
363 } else if (!NT_STATUS_IS_OK(status
)) {
364 DEBUG(0, ("unable to fetch HWM (%s) from autorid "
365 "database: %s\n", hwm
, nt_errstr(status
)));
373 * open and initialize the database which stores the ranges for the domains
375 static NTSTATUS
idmap_autorid_db_init(void)
380 /* its already open */
384 /* Open idmap repository */
385 autorid_db
= db_open(NULL
, state_path("autorid.tdb"), 0,
386 TDB_DEFAULT
, O_RDWR
| O_CREAT
, 0644);
389 DEBUG(0, ("Unable to open idmap_autorid database '%s'\n",
390 state_path("autorid.tdb")));
391 return NT_STATUS_UNSUCCESSFUL
;
394 /* Initialize high water mark for the currently used range to 0 */
396 status
= idmap_autorid_init_hwm(HWM
);
397 NT_STATUS_NOT_OK_RETURN(status
);
399 status
= idmap_autorid_init_hwm(ALLOC_HWM_UID
);
400 NT_STATUS_NOT_OK_RETURN(status
);
402 status
= idmap_autorid_init_hwm(ALLOC_HWM_GID
);
407 static struct autorid_global_config
*idmap_autorid_loadconfig(TALLOC_CTX
* ctx
)
411 struct autorid_global_config
*cfg
;
412 unsigned long minvalue
, rangesize
, maxranges
;
415 status
= dbwrap_fetch_bystring(autorid_db
, ctx
, CONFIGKEY
, &data
);
417 if (!NT_STATUS_IS_OK(status
)) {
418 DEBUG(10, ("No saved config found\n"));
422 cfg
= talloc_zero(ctx
, struct autorid_global_config
);
427 if (sscanf((char *)data
.dptr
,
428 "minvalue:%lu rangesize:%lu maxranges:%lu",
429 &minvalue
, &rangesize
, &maxranges
) != 3) {
431 ("Found invalid configuration data"
432 "creating new config\n"));
436 cfg
->minvalue
= minvalue
;
437 cfg
->rangesize
= rangesize
;
438 cfg
->maxranges
= maxranges
;
440 DEBUG(10, ("Loaded previously stored configuration "
441 "minvalue:%d rangesize:%d\n",
442 cfg
->minvalue
, cfg
->rangesize
));
448 static NTSTATUS
idmap_autorid_saveconfig(struct autorid_global_config
*cfg
)
456 talloc_asprintf(talloc_tos(),
457 "minvalue:%u rangesize:%u maxranges:%u",
458 cfg
->minvalue
, cfg
->rangesize
, cfg
->maxranges
);
461 return NT_STATUS_NO_MEMORY
;
464 data
= string_tdb_data(cfgstr
);
466 status
= dbwrap_trans_store_bystring(autorid_db
, CONFIGKEY
,
474 static NTSTATUS
idmap_autorid_initialize(struct idmap_domain
*dom
)
476 struct autorid_global_config
*config
;
477 struct autorid_global_config
*storedconfig
= NULL
;
481 if (!strequal(dom
->name
, "*")) {
482 DEBUG(0, ("idmap_autorid_initialize: Error: autorid configured "
483 "for domain '%s'. But autorid can only be used for "
484 "the default idmap configuration.\n", dom
->name
));
485 return NT_STATUS_INVALID_PARAMETER
;
488 config
= talloc_zero(dom
, struct autorid_global_config
);
490 DEBUG(0, ("Out of memory!\n"));
491 return NT_STATUS_NO_MEMORY
;
494 status
= idmap_autorid_db_init();
495 if (!NT_STATUS_IS_OK(status
)) {
499 config
->minvalue
= dom
->low_id
;
500 config
->rangesize
= lp_parm_int(-1, "idmap config *", "rangesize", 100000);
502 if (config
->rangesize
< 2000) {
503 DEBUG(1, ("autorid rangesize must be at least 2000\n"));
504 status
= NT_STATUS_INVALID_PARAMETER
;
508 config
->maxranges
= (dom
->high_id
- dom
->low_id
+ 1) /
511 if (config
->maxranges
== 0) {
512 DEBUG(1, ("allowed uid range is smaller then rangesize, "
513 "increase uid range or decrease rangesize\n"));
514 status
= NT_STATUS_INVALID_PARAMETER
;
518 /* check if the high-low limit is a multiple of the rangesize */
519 if ((dom
->high_id
- dom
->low_id
+ 1) % config
->rangesize
!= 0) {
520 DEBUG(5, ("High uid-low uid difference of %d "
521 "is not a multiple of the rangesize %d, "
522 "limiting ranges to lower boundary number of %d\n",
523 (dom
->high_id
- dom
->low_id
+ 1), config
->rangesize
,
527 DEBUG(10, ("Current configuration in config is "
528 "minvalue:%d rangesize:%d maxranges:%d\n",
529 config
->minvalue
, config
->rangesize
, config
->maxranges
));
531 /* read previously stored config and current HWM */
532 storedconfig
= idmap_autorid_loadconfig(talloc_tos());
534 status
= dbwrap_fetch_uint32(autorid_db
, HWM
, &hwm
);
535 if (!NT_STATUS_IS_OK(status
)) {
536 DEBUG(1, ("Fatal error while fetching current "
537 "HWM value: %s\n", nt_errstr(status
)));
538 status
= NT_STATUS_INTERNAL_ERROR
;
542 /* did the minimum value or rangesize change? */
544 ((storedconfig
->minvalue
!= config
->minvalue
) ||
545 (storedconfig
->rangesize
!= config
->rangesize
))) {
546 DEBUG(1, ("New configuration values for rangesize or "
547 "minimum uid value conflict with previously "
548 "used values! Aborting initialization\n"));
549 status
= NT_STATUS_INVALID_PARAMETER
;
554 * has the highest uid value been reduced to setting that is not
555 * sufficient any more for already existing ranges?
557 if (hwm
> config
->maxranges
) {
558 DEBUG(1, ("New upper uid limit is too low to cover "
559 "existing mappings! Aborting initialization\n"));
560 status
= NT_STATUS_INVALID_PARAMETER
;
564 status
= idmap_autorid_saveconfig(config
);
566 if (!NT_STATUS_IS_OK(status
)) {
567 DEBUG(1, ("Failed to store configuration data!\n"));
571 DEBUG(5, ("%d domain ranges with a size of %d are available\n",
572 config
->maxranges
, config
->rangesize
));
574 dom
->private_data
= config
;
582 talloc_free(storedconfig
);
587 static NTSTATUS
idmap_autorid_allocate_id(struct idmap_domain
*dom
,
588 struct unixid
*xid
) {
591 struct autorid_global_config
*globalcfg
;
592 struct autorid_domain_config domaincfg
;
596 if (!strequal(dom
->name
, "*")) {
597 DEBUG(3, ("idmap_autorid_allocate_id: "
598 "Refusing creation of mapping for domain'%s'. "
599 "Currently only supported for the default "
602 return NT_STATUS_NOT_IMPLEMENTED
;
605 if ((xid
->type
!= ID_TYPE_UID
) && (xid
->type
!= ID_TYPE_GID
)) {
606 return NT_STATUS_INVALID_PARAMETER
;
610 globalcfg
= talloc_get_type(dom
->private_data
,
611 struct autorid_global_config
);
613 /* fetch the range for the allocation pool */
615 ZERO_STRUCT(domaincfg
);
617 domaincfg
.globalcfg
= globalcfg
;
618 fstrcpy(domaincfg
.sid
, ALLOC_RANGE
);
620 ret
= dbwrap_trans_do(autorid_db
,
621 idmap_autorid_get_domainrange
,
623 if (!NT_STATUS_IS_OK(ret
)) {
624 DEBUG(3, ("Could not determine range for allocation pool, "
625 "check previous messages for reason\n"));
629 /* fetch the current HWM */
630 hwmkey
= (xid
->type
==ID_TYPE_UID
)?ALLOC_HWM_UID
:ALLOC_HWM_GID
;
632 ret
= dbwrap_fetch_uint32(autorid_db
, hwmkey
, &hwm
);
634 if (!NT_STATUS_IS_OK(ret
)) {
635 DEBUG(1, ("Failed to fetch current allocation HWM value: %s\n",
637 return NT_STATUS_INTERNAL_ERROR
;
640 if (hwm
>= globalcfg
->rangesize
) {
641 DEBUG(1, ("allocation range is depleted!\n"));
642 return NT_STATUS_NO_MEMORY
;
645 ret
= dbwrap_change_uint32_atomic(autorid_db
, hwmkey
, &(xid
->id
), 1);
646 if (!NT_STATUS_IS_OK(ret
)) {
647 DEBUG(1, ("Fatal error while allocating new ID!\n"));
651 xid
->id
= globalcfg
->minvalue
+
652 globalcfg
->rangesize
* domaincfg
.domainnum
+
655 DEBUG(10, ("Returned new %s %d from allocation range\n",
656 (xid
->type
==ID_TYPE_UID
)?"uid":"gid", xid
->id
));
662 Close the idmap tdb instance
664 static struct idmap_methods autorid_methods
= {
665 .init
= idmap_autorid_initialize
,
666 .unixids_to_sids
= idmap_autorid_unixids_to_sids
,
667 .sids_to_unixids
= idmap_autorid_sids_to_unixids
,
668 .allocate_id
= idmap_autorid_allocate_id
671 NTSTATUS
samba_module_init(void)
673 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION
,
674 "autorid", &autorid_methods
);