?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: Explicitly handle inbuf in cli_message_start_done
[Samba/gebeck_regimport.git] / source3 / passdb / lookup_sid.c
blob6149f974ac044cefe5d4e6ade1da0d850841754b
1 /*
2 Unix SMB/CIFS implementation.
3 uid/user handling
4 Copyright (C) Andrew Tridgell 1992-1998
5 Copyright (C) Gerald (Jerry) Carter 2003
6 Copyright (C) Volker Lendecke 2005
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23
24 /*****************************************************************
25 Dissect a user-provided name into domain, name, sid and type.
26
27 If an explicit domain name was given in the form domain\user, it
28 has to try that. If no explicit domain name was given, we have
29 to do guesswork.
30 *****************************************************************/
31
32 bool lookup_name(TALLOC_CTX *mem_ctx,
33 const char *full_name, int flags,
34 const char **ret_domain, const char **ret_name,
35 DOM_SID *ret_sid, enum lsa_SidType *ret_type)
36 {
37 char *p;
38 const char *tmp;
39 const char *domain = NULL;
40 const char *name = NULL;
41 uint32 rid;
42 DOM_SID sid;
43 enum lsa_SidType type;
44 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
45
46 if (tmp_ctx == NULL) {
47 DEBUG(0, ("talloc_new failed\n"));
48 return false;
49 }
50
51 p = strchr_m(full_name, '\\');
52
53 if (p != NULL) {
54 domain = talloc_strndup(tmp_ctx, full_name,
55 PTR_DIFF(p, full_name));
56 name = talloc_strdup(tmp_ctx, p+1);
57 } else {
58 domain = talloc_strdup(tmp_ctx, "");
59 name = talloc_strdup(tmp_ctx, full_name);
60 }
61
62 if ((domain == NULL) || (name == NULL)) {
63 DEBUG(0, ("talloc failed\n"));
64 TALLOC_FREE(tmp_ctx);
65 return false;
66 }
67
68 DEBUG(10,("lookup_name: %s => %s (domain), %s (name)\n",
69 full_name, domain, name));
70 DEBUG(10, ("lookup_name: flags = 0x0%x\n", flags));
71
72 if ((flags & LOOKUP_NAME_DOMAIN) &&
73 strequal(domain, get_global_sam_name()))
74 {
75
76 /* It's our own domain, lookup the name in passdb */
77 if (lookup_global_sam_name(name, flags, &rid, &type)) {
78 sid_compose(&sid, get_global_sam_sid(), rid);
79 goto ok;
80 }
81 TALLOC_FREE(tmp_ctx);
82 return false;
83 }
84
85 if ((flags & LOOKUP_NAME_BUILTIN) &&
86 strequal(domain, builtin_domain_name()))
87 {
88 if (strlen(name) == 0) {
89 /* Swap domain and name */
90 tmp = name; name = domain; domain = tmp;
91 sid_copy(&sid, &global_sid_Builtin);
92 type = SID_NAME_DOMAIN;
93 goto ok;
94 }
95
96 /* Explicit request for a name in BUILTIN */
97 if (lookup_builtin_name(name, &rid)) {
98 sid_compose(&sid, &global_sid_Builtin, rid);
99 type = SID_NAME_ALIAS;
100 goto ok;
101 }
102 TALLOC_FREE(tmp_ctx);
103 return false;
104 }
105
106 /* Try the explicit winbind lookup first, don't let it guess the
107 * domain yet at this point yet. This comes later. */
108
109 if ((domain[0] != '\0') &&
110 (flags & ~(LOOKUP_NAME_DOMAIN|LOOKUP_NAME_ISOLATED)) &&
111 (winbind_lookup_name(domain, name, &sid, &type))) {
112 goto ok;
113 }
114
115 if (((flags & LOOKUP_NAME_NO_NSS) == 0)
116 && strequal(domain, unix_users_domain_name())) {
117 if (lookup_unix_user_name(name, &sid)) {
118 type = SID_NAME_USER;
119 goto ok;
120 }
121 TALLOC_FREE(tmp_ctx);
122 return false;
123 }
124
125 if (((flags & LOOKUP_NAME_NO_NSS) == 0)
126 && strequal(domain, unix_groups_domain_name())) {
127 if (lookup_unix_group_name(name, &sid)) {
128 type = SID_NAME_DOM_GRP;
129 goto ok;
130 }
131 TALLOC_FREE(tmp_ctx);
132 return false;
133 }
134
135 if ((domain[0] == '\0') && (!(flags & LOOKUP_NAME_ISOLATED))) {
136 TALLOC_FREE(tmp_ctx);
137 return false;
138 }
139
140 /* Now the guesswork begins, we haven't been given an explicit
141 * domain. Try the sequence as documented on
142 * http://msdn.microsoft.com/library/en-us/secmgmt/security/lsalookupnames.asp
143 * November 27, 2005 */
144
145 /* 1. well-known names */
146
147 if ((flags & LOOKUP_NAME_WKN) &&
148 lookup_wellknown_name(tmp_ctx, name, &sid, &domain))
149 {
150 type = SID_NAME_WKN_GRP;
151 goto ok;
152 }
153
154 /* 2. Builtin domain as such */
155
156 if ((flags & (LOOKUP_NAME_BUILTIN|LOOKUP_NAME_REMOTE)) &&
157 strequal(name, builtin_domain_name()))
158 {
159 /* Swap domain and name */
160 tmp = name; name = domain; domain = tmp;
161 sid_copy(&sid, &global_sid_Builtin);
162 type = SID_NAME_DOMAIN;
163 goto ok;
164 }
165
166 /* 3. Account domain */
167
168 if ((flags & LOOKUP_NAME_DOMAIN) &&
169 strequal(name, get_global_sam_name()))
170 {
171 if (!secrets_fetch_domain_sid(name, &sid)) {
172 DEBUG(3, ("Could not fetch my SID\n"));
173 TALLOC_FREE(tmp_ctx);
174 return false;
175 }
176 /* Swap domain and name */
177 tmp = name; name = domain; domain = tmp;
178 type = SID_NAME_DOMAIN;
179 goto ok;
180 }
181
182 /* 4. Primary domain */
183
184 if ((flags & LOOKUP_NAME_DOMAIN) && !IS_DC &&
185 strequal(name, lp_workgroup()))
186 {
187 if (!secrets_fetch_domain_sid(name, &sid)) {
188 DEBUG(3, ("Could not fetch the domain SID\n"));
189 TALLOC_FREE(tmp_ctx);
190 return false;
191 }
192 /* Swap domain and name */
193 tmp = name; name = domain; domain = tmp;
194 type = SID_NAME_DOMAIN;
195 goto ok;
196 }
197
198 /* 5. Trusted domains as such, to me it looks as if members don't do
199 this, tested an XP workstation in a NT domain -- vl */
200
201 if ((flags & LOOKUP_NAME_REMOTE) && IS_DC &&
202 (pdb_get_trusteddom_pw(name, NULL, &sid, NULL)))
203 {
204 /* Swap domain and name */
205 tmp = name; name = domain; domain = tmp;
206 type = SID_NAME_DOMAIN;
207 goto ok;
208 }
209
210 /* 6. Builtin aliases */
211
212 if ((flags & LOOKUP_NAME_BUILTIN) &&
213 lookup_builtin_name(name, &rid))
214 {
215 domain = talloc_strdup(tmp_ctx, builtin_domain_name());
216 sid_compose(&sid, &global_sid_Builtin, rid);
217 type = SID_NAME_ALIAS;
218 goto ok;
219 }
220
221 /* 7. Local systems' SAM (DCs don't have a local SAM) */
222 /* 8. Primary SAM (On members, this is the domain) */
223
224 /* Both cases are done by looking at our passdb */
225
226 if ((flags & LOOKUP_NAME_DOMAIN) &&
227 lookup_global_sam_name(name, flags, &rid, &type))
228 {
229 domain = talloc_strdup(tmp_ctx, get_global_sam_name());
230 sid_compose(&sid, get_global_sam_sid(), rid);
231 goto ok;
232 }
233
234 /* Now our local possibilities are exhausted. */
235
236 if (!(flags & LOOKUP_NAME_REMOTE)) {
237 TALLOC_FREE(tmp_ctx);
238 return false;
239 }
240
241 /* If we are not a DC, we have to ask in our primary domain. Let
242 * winbind do that. */
243
244 if (!IS_DC &&
245 (winbind_lookup_name(lp_workgroup(), name, &sid, &type))) {
246 domain = talloc_strdup(tmp_ctx, lp_workgroup());
247 goto ok;
248 }
249
250 /* 9. Trusted domains */
251
252 /* If we're a DC we have to ask all trusted DC's. Winbind does not do
253 * that (yet), but give it a chance. */
254
255 if (IS_DC && winbind_lookup_name("", name, &sid, &type)) {
256 DOM_SID dom_sid;
257 uint32 tmp_rid;
258 enum lsa_SidType domain_type;
259
260 if (type == SID_NAME_DOMAIN) {
261 /* Swap name and type */
262 tmp = name; name = domain; domain = tmp;
263 goto ok;
264 }
265
266 /* Here we have to cope with a little deficiency in the
267 * winbind API: We have to ask it again for the name of the
268 * domain it figured out itself. Maybe fix that later... */
269
270 sid_copy(&dom_sid, &sid);
271 sid_split_rid(&dom_sid, &tmp_rid);
272
273 if (!winbind_lookup_sid(tmp_ctx, &dom_sid, &domain, NULL,
274 &domain_type) ||
275 (domain_type != SID_NAME_DOMAIN)) {
276 DEBUG(2, ("winbind could not find the domain's name "
277 "it just looked up for us\n"));
278 TALLOC_FREE(tmp_ctx);
279 return false;
280 }
281 goto ok;
282 }
283
284 /* 10. Don't translate */
285
286 /* 11. Ok, windows would end here. Samba has two more options:
287 Unmapped users and unmapped groups */
288
289 if (((flags & LOOKUP_NAME_NO_NSS) == 0)
290 && lookup_unix_user_name(name, &sid)) {
291 domain = talloc_strdup(tmp_ctx, unix_users_domain_name());
292 type = SID_NAME_USER;
293 goto ok;
294 }
295
296 if (((flags & LOOKUP_NAME_NO_NSS) == 0)
297 && lookup_unix_group_name(name, &sid)) {
298 domain = talloc_strdup(tmp_ctx, unix_groups_domain_name());
299 type = SID_NAME_DOM_GRP;
300 goto ok;
301 }
302
303 /*
304 * Ok, all possibilities tried. Fail.
305 */
306
307 TALLOC_FREE(tmp_ctx);
308 return false;
309
310 ok:
311 if ((domain == NULL) || (name == NULL)) {
312 DEBUG(0, ("talloc failed\n"));
313 TALLOC_FREE(tmp_ctx);
314 return false;
315 }
316
317 /*
318 * Hand over the results to the talloc context we've been given.
319 */
320
321 if ((ret_name != NULL) &&
322 !(*ret_name = talloc_strdup(mem_ctx, name))) {
323 DEBUG(0, ("talloc failed\n"));
324 TALLOC_FREE(tmp_ctx);
325 return false;
326 }
327
328 if (ret_domain != NULL) {
329 char *tmp_dom;
330 if (!(tmp_dom = talloc_strdup(mem_ctx, domain))) {
331 DEBUG(0, ("talloc failed\n"));
332 TALLOC_FREE(tmp_ctx);
333 return false;
334 }
335 strupper_m(tmp_dom);
336 *ret_domain = tmp_dom;
337 }
338
339 if (ret_sid != NULL) {
340 sid_copy(ret_sid, &sid);
341 }
342
343 if (ret_type != NULL) {
344 *ret_type = type;
345 }
346
347 TALLOC_FREE(tmp_ctx);
348 return true;
349 }
350
351 /************************************************************************
352 Names from smb.conf can be unqualified. eg. valid users = foo
353 These names should never map to a remote name. Try global_sam_name()\foo,
354 and then "Unix Users"\foo (or "Unix Groups"\foo).
355 ************************************************************************/
356
357 bool lookup_name_smbconf(TALLOC_CTX *mem_ctx,
358 const char *full_name, int flags,
359 const char **ret_domain, const char **ret_name,
360 DOM_SID *ret_sid, enum lsa_SidType *ret_type)
361 {
362 char *qualified_name;
363 const char *p;
364
365 /* NB. No winbindd_separator here as lookup_name needs \\' */
366 if ((p = strchr_m(full_name, *lp_winbind_separator())) != NULL) {
367
368 /* The name is already qualified with a domain. */
369
370 if (*lp_winbind_separator() != '\\') {
371 char *tmp;
372
373 /* lookup_name() needs '\\' as a separator */
374
375 tmp = talloc_strdup(mem_ctx, full_name);
376 if (!tmp) {
377 return false;
378 }
379 tmp[p - full_name] = '\\';
380 full_name = tmp;
381 }
382
383 return lookup_name(mem_ctx, full_name, flags,
384 ret_domain, ret_name,
385 ret_sid, ret_type);
386 }
387
388 /* Try with our own SAM name. */
389 qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
390 get_global_sam_name(),
391 full_name );
392 if (!qualified_name) {
393 return false;
394 }
395
396 if (lookup_name(mem_ctx, qualified_name, flags,
397 ret_domain, ret_name,
398 ret_sid, ret_type)) {
399 return true;
400 }
401
402 /* Finally try with "Unix Users" or "Unix Group" */
403 qualified_name = talloc_asprintf(mem_ctx, "%s\\%s",
404 flags & LOOKUP_NAME_GROUP ?
405 unix_groups_domain_name() :
406 unix_users_domain_name(),
407 full_name );
408 if (!qualified_name) {
409 return false;
410 }
411
412 return lookup_name(mem_ctx, qualified_name, flags,
413 ret_domain, ret_name,
414 ret_sid, ret_type);
415 }
416
417 static bool wb_lookup_rids(TALLOC_CTX *mem_ctx,
418 const DOM_SID *domain_sid,
419 int num_rids, uint32 *rids,
420 const char **domain_name,
421 const char **names, enum lsa_SidType *types)
422 {
423 int i;
424 const char **my_names;
425 enum lsa_SidType *my_types;
426 TALLOC_CTX *tmp_ctx;
427
428 if (!(tmp_ctx = talloc_init("wb_lookup_rids"))) {
429 return false;
430 }
431
432 if (!winbind_lookup_rids(tmp_ctx, domain_sid, num_rids, rids,
433 domain_name, &my_names, &my_types)) {
434 *domain_name = "";
435 for (i=0; i<num_rids; i++) {
436 names[i] = "";
437 types[i] = SID_NAME_UNKNOWN;
438 }
439 TALLOC_FREE(tmp_ctx);
440 return true;
441 }
442
443 if (!(*domain_name = talloc_strdup(mem_ctx, *domain_name))) {
444 TALLOC_FREE(tmp_ctx);
445 return false;
446 }
447
448 /*
449 * winbind_lookup_rids allocates its own array. We've been given the
450 * array, so copy it over
451 */
452
453 for (i=0; i<num_rids; i++) {
454 if (my_names[i] == NULL) {
455 TALLOC_FREE(tmp_ctx);
456 return false;
457 }
458 if (!(names[i] = talloc_strdup(names, my_names[i]))) {
459 TALLOC_FREE(tmp_ctx);
460 return false;
461 }
462 types[i] = my_types[i];
463 }
464 TALLOC_FREE(tmp_ctx);
465 return true;
466 }
467
468 static bool lookup_rids(TALLOC_CTX *mem_ctx, const DOM_SID *domain_sid,
469 int num_rids, uint32_t *rids,
470 const char **domain_name,
471 const char ***names, enum lsa_SidType **types)
472 {
473 int i;
474
475 DEBUG(10, ("lookup_rids called for domain sid '%s'\n",
476 sid_string_dbg(domain_sid)));
477
478 if (num_rids) {
479 *names = TALLOC_ZERO_ARRAY(mem_ctx, const char *, num_rids);
480 *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
481
482 if ((*names == NULL) || (*types == NULL)) {
483 return false;
484 }
485
486 for (i = 0; i < num_rids; i++)
487 (*types)[i] = SID_NAME_UNKNOWN;
488 } else {
489 *names = NULL;
490 *types = NULL;
491 }
492
493 if (sid_check_is_domain(domain_sid)) {
494 NTSTATUS result;
495
496 if (*domain_name == NULL) {
497 *domain_name = talloc_strdup(
498 mem_ctx, get_global_sam_name());
499 }
500
501 if (*domain_name == NULL) {
502 return false;
503 }
504
505 become_root();
506 result = pdb_lookup_rids(domain_sid, num_rids, rids,
507 *names, *types);
508 unbecome_root();
509
510 return (NT_STATUS_IS_OK(result) ||
511 NT_STATUS_EQUAL(result, NT_STATUS_NONE_MAPPED) ||
512 NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED));
513 }
514
515 if (sid_check_is_builtin(domain_sid)) {
516
517 if (*domain_name == NULL) {
518 *domain_name = talloc_strdup(
519 mem_ctx, builtin_domain_name());
520 }
521
522 if (*domain_name == NULL) {
523 return false;
524 }
525
526 for (i=0; i<num_rids; i++) {
527 if (lookup_builtin_rid(*names, rids[i],
528 &(*names)[i])) {
529 if ((*names)[i] == NULL) {
530 return false;
531 }
532 (*types)[i] = SID_NAME_ALIAS;
533 } else {
534 (*types)[i] = SID_NAME_UNKNOWN;
535 }
536 }
537 return true;
538 }
539
540 if (sid_check_is_wellknown_domain(domain_sid, NULL)) {
541 for (i=0; i<num_rids; i++) {
542 DOM_SID sid;
543 sid_compose(&sid, domain_sid, rids[i]);
544 if (lookup_wellknown_sid(mem_ctx, &sid,
545 domain_name, &(*names)[i])) {
546 if ((*names)[i] == NULL) {
547 return false;
548 }
549 (*types)[i] = SID_NAME_WKN_GRP;
550 } else {
551 (*types)[i] = SID_NAME_UNKNOWN;
552 }
553 }
554 return true;
555 }
556
557 if (sid_check_is_unix_users(domain_sid)) {
558 if (*domain_name == NULL) {
559 *domain_name = talloc_strdup(
560 mem_ctx, unix_users_domain_name());
561 if (*domain_name == NULL) {
562 return false;
563 }
564 }
565 for (i=0; i<num_rids; i++) {
566 (*names)[i] = talloc_strdup(
567 (*names), uidtoname(rids[i]));
568 if ((*names)[i] == NULL) {
569 return false;
570 }
571 (*types)[i] = SID_NAME_USER;
572 }
573 return true;
574 }
575
576 if (sid_check_is_unix_groups(domain_sid)) {
577 if (*domain_name == NULL) {
578 *domain_name = talloc_strdup(
579 mem_ctx, unix_groups_domain_name());
580 if (*domain_name == NULL) {
581 return false;
582 }
583 }
584 for (i=0; i<num_rids; i++) {
585 (*names)[i] = talloc_strdup(
586 (*names), gidtoname(rids[i]));
587 if ((*names)[i] == NULL) {
588 return false;
589 }
590 (*types)[i] = SID_NAME_DOM_GRP;
591 }
592 return true;
593 }
594
595 return wb_lookup_rids(mem_ctx, domain_sid, num_rids, rids,
596 domain_name, *names, *types);
597 }
598
599 /*
600 * Is the SID a domain as such? If yes, lookup its name.
601 */
602
603 static bool lookup_as_domain(const DOM_SID *sid, TALLOC_CTX *mem_ctx,
604 const char **name)
605 {
606 const char *tmp;
607 enum lsa_SidType type;
608
609 if (sid_check_is_domain(sid)) {
610 *name = talloc_strdup(mem_ctx, get_global_sam_name());
611 return true;
612 }
613
614 if (sid_check_is_builtin(sid)) {
615 *name = talloc_strdup(mem_ctx, builtin_domain_name());
616 return true;
617 }
618
619 if (sid_check_is_wellknown_domain(sid, &tmp)) {
620 *name = talloc_strdup(mem_ctx, tmp);
621 return true;
622 }
623
624 if (sid_check_is_unix_users(sid)) {
625 *name = talloc_strdup(mem_ctx, unix_users_domain_name());
626 return true;
627 }
628
629 if (sid_check_is_unix_groups(sid)) {
630 *name = talloc_strdup(mem_ctx, unix_groups_domain_name());
631 return true;
632 }
633
634 if (sid->num_auths != 4) {
635 /* This can't be a domain */
636 return false;
637 }
638
639 if (IS_DC) {
640 uint32 i, num_domains;
641 struct trustdom_info **domains;
642
643 /* This is relatively expensive, but it happens only on DCs
644 * and for SIDs that have 4 sub-authorities and thus look like
645 * domains */
646
647 if (!NT_STATUS_IS_OK(pdb_enum_trusteddoms(mem_ctx,
648 &num_domains,
649 &domains))) {
650 return false;
651 }
652
653 for (i=0; i<num_domains; i++) {
654 if (sid_equal(sid, &domains[i]->sid)) {
655 *name = talloc_strdup(mem_ctx,
656 domains[i]->name);
657 return true;
658 }
659 }
660 return false;
661 }
662
663 if (winbind_lookup_sid(mem_ctx, sid, &tmp, NULL, &type) &&
664 (type == SID_NAME_DOMAIN)) {
665 *name = tmp;
666 return true;
667 }
668
669 return false;
670 }
671
672 /*
673 * This tries to implement the rather weird rules for the lsa_lookup level
674 * parameter.
675 *
676 * This is as close as we can get to what W2k3 does. With this we survive the
677 * RPC-LSALOOKUP samba4 test as of 2006-01-08. NT4 as a PDC is a bit more
678 * different, but I assume that's just being too liberal. For example, W2k3
679 * replies to everything else but the levels 1-6 with INVALID_PARAMETER
680 * whereas NT4 does the same as level 1 (I think). I did not fully test that
681 * with NT4, this is what w2k3 does.
682 *
683 * Level 1: Ask everywhere
684 * Level 2: Ask domain and trusted domains, no builtin and wkn
685 * Level 3: Only ask domain
686 * Level 4: W2k3ad: Only ask AD trusts
687 * Level 5: Only ask transitive forest trusts
688 * Level 6: Like 4
689 */
690
691 static bool check_dom_sid_to_level(const DOM_SID *sid, int level)
692 {
693 int ret = false;
694
695 switch(level) {
696 case 1:
697 ret = true;
698 break;
699 case 2:
700 ret = (!sid_check_is_builtin(sid) &&
701 !sid_check_is_wellknown_domain(sid, NULL));
702 break;
703 case 3:
704 case 4:
705 case 6:
706 ret = sid_check_is_domain(sid);
707 break;
708 case 5:
709 ret = false;
710 break;
711 }
712
713 DEBUG(10, ("%s SID %s in level %d\n",
714 ret ? "Accepting" : "Rejecting",
715 sid_string_dbg(sid), level));
716 return ret;
717 }
718
719 /*
720 * Lookup a bunch of SIDs. This is modeled after lsa_lookup_sids with
721 * references to domains, it is explicitly made for this.
722 *
723 * This attempts to be as efficient as possible: It collects all SIDs
724 * belonging to a domain and hands them in bulk to the appropriate lookup
725 * function. In particular pdb_lookup_rids with ldapsam_trusted benefits
726 * *hugely* from this. Winbind is going to be extended with a lookup_rids
727 * interface as well, so on a DC we can do a bulk lsa_lookuprids to the
728 * appropriate DC.
729 */
730
731 NTSTATUS lookup_sids(TALLOC_CTX *mem_ctx, int num_sids,
732 const DOM_SID **sids, int level,
733 struct lsa_dom_info **ret_domains,
734 struct lsa_name_info **ret_names)
735 {
736 TALLOC_CTX *tmp_ctx;
737 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
738 struct lsa_name_info *name_infos;
739 struct lsa_dom_info *dom_infos = NULL;
740
741 int i, j;
742
743 if (!(tmp_ctx = talloc_new(mem_ctx))) {
744 DEBUG(0, ("talloc_new failed\n"));
745 return NT_STATUS_NO_MEMORY;
746 }
747
748 if (num_sids) {
749 name_infos = TALLOC_ARRAY(mem_ctx, struct lsa_name_info, num_sids);
750 if (name_infos == NULL) {
751 result = NT_STATUS_NO_MEMORY;
752 goto fail;
753 }
754 } else {
755 name_infos = NULL;
756 }
757
758 dom_infos = TALLOC_ZERO_ARRAY(mem_ctx, struct lsa_dom_info,
759 LSA_REF_DOMAIN_LIST_MULTIPLIER);
760 if (dom_infos == NULL) {
761 result = NT_STATUS_NO_MEMORY;
762 goto fail;
763 }
764
765 /* First build up the data structures:
766 *
767 * dom_infos is a list of domains referenced in the list of
768 * SIDs. Later we will walk the list of domains and look up the RIDs
769 * in bulk.
770 *
771 * name_infos is a shadow-copy of the SIDs array to collect the real
772 * data.
773 *
774 * dom_info->idxs is an index into the name_infos array. The
775 * difficulty we have here is that we need to keep the SIDs the client
776 * asked for in the same order for the reply
777 */
778
779 for (i=0; i<num_sids; i++) {
780 DOM_SID sid;
781 uint32 rid;
782 const char *domain_name = NULL;
783
784 sid_copy(&sid, sids[i]);
785 name_infos[i].type = SID_NAME_USE_NONE;
786
787 if (lookup_as_domain(&sid, name_infos, &domain_name)) {
788 /* We can't push that through the normal lookup
789 * process, as this would reference illegal
790 * domains.
791 *
792 * For example S-1-5-32 would end up referencing
793 * domain S-1-5- with RID 32 which is clearly wrong.
794 */
795 if (domain_name == NULL) {
796 result = NT_STATUS_NO_MEMORY;
797 goto fail;
798 }
799
800 name_infos[i].rid = 0;
801 name_infos[i].type = SID_NAME_DOMAIN;
802 name_infos[i].name = NULL;
803
804 if (sid_check_is_builtin(&sid)) {
805 /* Yes, W2k3 returns "BUILTIN" both as domain
806 * and name here */
807 name_infos[i].name = talloc_strdup(
808 name_infos, builtin_domain_name());
809 if (name_infos[i].name == NULL) {
810 result = NT_STATUS_NO_MEMORY;
811 goto fail;
812 }
813 }
814 } else {
815 /* This is a normal SID with rid component */
816 if (!sid_split_rid(&sid, &rid)) {
817 result = NT_STATUS_INVALID_SID;
818 goto fail;
819 }
820 }
821
822 if (!check_dom_sid_to_level(&sid, level)) {
823 name_infos[i].rid = 0;
824 name_infos[i].type = SID_NAME_UNKNOWN;
825 name_infos[i].name = NULL;
826 continue;
827 }
828
829 for (j=0; j<LSA_REF_DOMAIN_LIST_MULTIPLIER; j++) {
830 if (!dom_infos[j].valid) {
831 break;
832 }
833 if (sid_equal(&sid, &dom_infos[j].sid)) {
834 break;
835 }
836 }
837
838 if (j == LSA_REF_DOMAIN_LIST_MULTIPLIER) {
839 /* TODO: What's the right error message here? */
840 result = NT_STATUS_NONE_MAPPED;
841 goto fail;
842 }
843
844 if (!dom_infos[j].valid) {
845 /* We found a domain not yet referenced, create a new
846 * ref. */
847 dom_infos[j].valid = true;
848 sid_copy(&dom_infos[j].sid, &sid);
849
850 if (domain_name != NULL) {
851 /* This name was being found above in the case
852 * when we found a domain SID */
853 dom_infos[j].name =
854 talloc_strdup(dom_infos, domain_name);
855 if (dom_infos[j].name == NULL) {
856 result = NT_STATUS_NO_MEMORY;
857 goto fail;
858 }
859 } else {
860 /* lookup_rids will take care of this */
861 dom_infos[j].name = NULL;
862 }
863 }
864
865 name_infos[i].dom_idx = j;
866
867 if (name_infos[i].type == SID_NAME_USE_NONE) {
868 name_infos[i].rid = rid;
869
870 ADD_TO_ARRAY(dom_infos, int, i, &dom_infos[j].idxs,
871 &dom_infos[j].num_idxs);
872
873 if (dom_infos[j].idxs == NULL) {
874 result = NT_STATUS_NO_MEMORY;
875 goto fail;
876 }
877 }
878 }
879
880 /* Iterate over the domains found */
881
882 for (i=0; i<LSA_REF_DOMAIN_LIST_MULTIPLIER; i++) {
883 uint32_t *rids;
884 const char *domain_name = NULL;
885 const char **names;
886 enum lsa_SidType *types;
887 struct lsa_dom_info *dom = &dom_infos[i];
888
889 if (!dom->valid) {
890 /* No domains left, we're done */
891 break;
892 }
893
894 if (dom->num_idxs) {
895 if (!(rids = TALLOC_ARRAY(tmp_ctx, uint32, dom->num_idxs))) {
896 result = NT_STATUS_NO_MEMORY;
897 goto fail;
898 }
899 } else {
900 rids = NULL;
901 }
902
903 for (j=0; j<dom->num_idxs; j++) {
904 rids[j] = name_infos[dom->idxs[j]].rid;
905 }
906
907 if (!lookup_rids(tmp_ctx, &dom->sid,
908 dom->num_idxs, rids, &domain_name,
909 &names, &types)) {
910 result = NT_STATUS_NO_MEMORY;
911 goto fail;
912 }
913
914 if (!(dom->name = talloc_strdup(dom_infos, domain_name))) {
915 result = NT_STATUS_NO_MEMORY;
916 goto fail;
917 }
918
919 for (j=0; j<dom->num_idxs; j++) {
920 int idx = dom->idxs[j];
921 name_infos[idx].type = types[j];
922 if (types[j] != SID_NAME_UNKNOWN) {
923 name_infos[idx].name =
924 talloc_strdup(name_infos, names[j]);
925 if (name_infos[idx].name == NULL) {
926 result = NT_STATUS_NO_MEMORY;
927 goto fail;
928 }
929 } else {
930 name_infos[idx].name = NULL;
931 }
932 }
933 }
934
935 *ret_domains = dom_infos;
936 *ret_names = name_infos;
937 TALLOC_FREE(tmp_ctx);
938 return NT_STATUS_OK;
939
940 fail:
941 TALLOC_FREE(dom_infos);
942 TALLOC_FREE(name_infos);
943 TALLOC_FREE(tmp_ctx);
944 return result;
945 }
946
947 /*****************************************************************
948 *THE CANONICAL* convert SID to name function.
949 *****************************************************************/
950
951 bool lookup_sid(TALLOC_CTX *mem_ctx, const DOM_SID *sid,
952 const char **ret_domain, const char **ret_name,
953 enum lsa_SidType *ret_type)
954 {
955 struct lsa_dom_info *domain;
956 struct lsa_name_info *name;
957 TALLOC_CTX *tmp_ctx;
958 bool ret = false;
959
960 DEBUG(10, ("lookup_sid called for SID '%s'\n", sid_string_dbg(sid)));
961
962 if (!(tmp_ctx = talloc_new(mem_ctx))) {
963 DEBUG(0, ("talloc_new failed\n"));
964 return false;
965 }
966
967 if (!NT_STATUS_IS_OK(lookup_sids(tmp_ctx, 1, &sid, 1,
968 &domain, &name))) {
969 goto done;
970 }
971
972 if (name->type == SID_NAME_UNKNOWN) {
973 goto done;
974 }
975
976 if ((ret_domain != NULL) &&
977 !(*ret_domain = talloc_strdup(mem_ctx, domain->name))) {
978 goto done;
979 }
980
981 if ((ret_name != NULL) &&
982 !(*ret_name = talloc_strdup(mem_ctx, name->name))) {
983 goto done;
984 }
985
986 if (ret_type != NULL) {
987 *ret_type = name->type;
988 }
989
990 ret = true;
991
992 done:
993 if (ret) {
994 DEBUG(10, ("Sid %s -> %s\\%s(%d)\n", sid_string_dbg(sid),
995 domain->name, name->name, name->type));
996 } else {
997 DEBUG(10, ("failed to lookup sid %s\n", sid_string_dbg(sid)));
998 }
999 TALLOC_FREE(tmp_ctx);
1000 return ret;
1001 }
1002
1003 /*****************************************************************
1004 Id mapping cache. This is to avoid Winbind mappings already
1005 seen by smbd to be queried too frequently, keeping winbindd
1006 busy, and blocking smbd while winbindd is busy with other
1007 stuff. Written by Michael Steffens <michael.steffens@hp.com>,
1008 modified to use linked lists by jra.
1009 *****************************************************************/
1010
1011 /*****************************************************************
1012 Find a SID given a uid.
1013 *****************************************************************/
1014
1015 static bool fetch_sid_from_uid_cache(DOM_SID *psid, uid_t uid)
1016 {
1017 DATA_BLOB cache_value;
1018
1019 if (!memcache_lookup(NULL, UID_SID_CACHE,
1020 data_blob_const(&uid, sizeof(uid)),
1021 &cache_value)) {
1022 return false;
1023 }
1024
1025 memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
1026 SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
1027 SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, NULL, 0));
1028
1029 return true;
1030 }
1031
1032 /*****************************************************************
1033 Find a uid given a SID.
1034 *****************************************************************/
1035
1036 static bool fetch_uid_from_cache( uid_t *puid, const DOM_SID *psid )
1037 {
1038 DATA_BLOB cache_value;
1039
1040 if (!memcache_lookup(NULL, SID_UID_CACHE,
1041 data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
1042 &cache_value)) {
1043 return false;
1044 }
1045
1046 SMB_ASSERT(cache_value.length == sizeof(*puid));
1047 memcpy(puid, cache_value.data, sizeof(*puid));
1048
1049 return true;
1050 }
1051
1052 /*****************************************************************
1053 Store uid to SID mapping in cache.
1054 *****************************************************************/
1055
1056 void store_uid_sid_cache(const DOM_SID *psid, uid_t uid)
1057 {
1058 memcache_add(NULL, SID_UID_CACHE,
1059 data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
1060 data_blob_const(&uid, sizeof(uid)));
1061 memcache_add(NULL, UID_SID_CACHE,
1062 data_blob_const(&uid, sizeof(uid)),
1063 data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)));
1064 }
1065
1066 /*****************************************************************
1067 Find a SID given a gid.
1068 *****************************************************************/
1069
1070 static bool fetch_sid_from_gid_cache(DOM_SID *psid, gid_t gid)
1071 {
1072 DATA_BLOB cache_value;
1073
1074 if (!memcache_lookup(NULL, GID_SID_CACHE,
1075 data_blob_const(&gid, sizeof(gid)),
1076 &cache_value)) {
1077 return false;
1078 }
1079
1080 memcpy(psid, cache_value.data, MIN(sizeof(*psid), cache_value.length));
1081 SMB_ASSERT(cache_value.length >= offsetof(struct dom_sid, id_auth));
1082 SMB_ASSERT(cache_value.length == ndr_size_dom_sid(psid, NULL, 0));
1083
1084 return true;
1085 }
1086
1087 /*****************************************************************
1088 Find a gid given a SID.
1089 *****************************************************************/
1090
1091 static bool fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
1092 {
1093 DATA_BLOB cache_value;
1094
1095 if (!memcache_lookup(NULL, SID_GID_CACHE,
1096 data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
1097 &cache_value)) {
1098 return false;
1099 }
1100
1101 SMB_ASSERT(cache_value.length == sizeof(*pgid));
1102 memcpy(pgid, cache_value.data, sizeof(*pgid));
1103
1104 return true;
1105 }
1106
1107 /*****************************************************************
1108 Store gid to SID mapping in cache.
1109 *****************************************************************/
1110
1111 void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
1112 {
1113 memcache_add(NULL, SID_GID_CACHE,
1114 data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)),
1115 data_blob_const(&gid, sizeof(gid)));
1116 memcache_add(NULL, GID_SID_CACHE,
1117 data_blob_const(&gid, sizeof(gid)),
1118 data_blob_const(psid, ndr_size_dom_sid(psid, NULL, 0)));
1119 }
1120
1121 /*****************************************************************
1122 *THE LEGACY* convert uid_t to SID function.
1123 *****************************************************************/
1124
1125 static void legacy_uid_to_sid(DOM_SID *psid, uid_t uid)
1126 {
1127 bool ret;
1128
1129 ZERO_STRUCTP(psid);
1130
1131 become_root();
1132 ret = pdb_uid_to_sid(uid, psid);
1133 unbecome_root();
1134
1135 if (ret) {
1136 /* This is a mapped user */
1137 goto done;
1138 }
1139
1140 /* This is an unmapped user */
1141
1142 uid_to_unix_users_sid(uid, psid);
1143
1144 done:
1145 DEBUG(10,("LEGACY: uid %u -> sid %s\n", (unsigned int)uid,
1146 sid_string_dbg(psid)));
1147
1148 store_uid_sid_cache(psid, uid);
1149 return;
1150 }
1151
1152 /*****************************************************************
1153 *THE LEGACY* convert gid_t to SID function.
1154 *****************************************************************/
1155
1156 static void legacy_gid_to_sid(DOM_SID *psid, gid_t gid)
1157 {
1158 bool ret;
1159
1160 ZERO_STRUCTP(psid);
1161
1162 become_root();
1163 ret = pdb_gid_to_sid(gid, psid);
1164 unbecome_root();
1165
1166 if (ret) {
1167 /* This is a mapped group */
1168 goto done;
1169 }
1170
1171 /* This is an unmapped group */
1172
1173 gid_to_unix_groups_sid(gid, psid);
1174
1175 done:
1176 DEBUG(10,("LEGACY: gid %u -> sid %s\n", (unsigned int)gid,
1177 sid_string_dbg(psid)));
1178
1179 store_gid_sid_cache(psid, gid);
1180 return;
1181 }
1182
1183 /*****************************************************************
1184 *THE LEGACY* convert SID to uid function.
1185 *****************************************************************/
1186
1187 static bool legacy_sid_to_uid(const DOM_SID *psid, uid_t *puid)
1188 {
1189 enum lsa_SidType type;
1190
1191 if (sid_check_is_in_our_domain(psid)) {
1192 union unid_t id;
1193 bool ret;
1194
1195 become_root();
1196 ret = pdb_sid_to_id(psid, &id, &type);
1197 unbecome_root();
1198
1199 if (ret) {
1200 if (type != SID_NAME_USER) {
1201 DEBUG(5, ("sid %s is a %s, expected a user\n",
1202 sid_string_dbg(psid),
1203 sid_type_lookup(type)));
1204 return false;
1205 }
1206 *puid = id.uid;
1207 goto done;
1208 }
1209
1210 /* This was ours, but it was not mapped. Fail */
1211 }
1212
1213 DEBUG(10,("LEGACY: mapping failed for sid %s\n",
1214 sid_string_dbg(psid)));
1215 return false;
1216
1217 done:
1218 DEBUG(10,("LEGACY: sid %s -> uid %u\n", sid_string_dbg(psid),
1219 (unsigned int)*puid ));
1220
1221 store_uid_sid_cache(psid, *puid);
1222 return true;
1223 }
1224
1225 /*****************************************************************
1226 *THE LEGACY* convert SID to gid function.
1227 Group mapping is used for gids that maps to Wellknown SIDs
1228 *****************************************************************/
1229
1230 static bool legacy_sid_to_gid(const DOM_SID *psid, gid_t *pgid)
1231 {
1232 GROUP_MAP map;
1233 union unid_t id;
1234 enum lsa_SidType type;
1235
1236 if ((sid_check_is_in_builtin(psid) ||
1237 sid_check_is_in_wellknown_domain(psid))) {
1238 bool ret;
1239
1240 become_root();
1241 ret = pdb_getgrsid(&map, *psid);
1242 unbecome_root();
1243
1244 if (ret) {
1245 *pgid = map.gid;
1246 goto done;
1247 }
1248 DEBUG(10,("LEGACY: mapping failed for sid %s\n",
1249 sid_string_dbg(psid)));
1250 return false;
1251 }
1252
1253 if (sid_check_is_in_our_domain(psid)) {
1254 bool ret;
1255
1256 become_root();
1257 ret = pdb_sid_to_id(psid, &id, &type);
1258 unbecome_root();
1259
1260 if (ret) {
1261 if ((type != SID_NAME_DOM_GRP) &&
1262 (type != SID_NAME_ALIAS)) {
1263 DEBUG(5, ("LEGACY: sid %s is a %s, expected "
1264 "a group\n", sid_string_dbg(psid),
1265 sid_type_lookup(type)));
1266 return false;
1267 }
1268 *pgid = id.gid;
1269 goto done;
1270 }
1271
1272 /* This was ours, but it was not mapped. Fail */
1273 }
1274
1275 DEBUG(10,("LEGACY: mapping failed for sid %s\n",
1276 sid_string_dbg(psid)));
1277 return false;
1278
1279 done:
1280 DEBUG(10,("LEGACY: sid %s -> gid %u\n", sid_string_dbg(psid),
1281 (unsigned int)*pgid ));
1282
1283 store_gid_sid_cache(psid, *pgid);
1284
1285 return true;
1286 }
1287
1288 /*****************************************************************
1289 *THE CANONICAL* convert uid_t to SID function.
1290 *****************************************************************/
1291
1292 void uid_to_sid(DOM_SID *psid, uid_t uid)
1293 {
1294 bool expired = true;
1295 bool ret;
1296 ZERO_STRUCTP(psid);
1297
1298 if (fetch_sid_from_uid_cache(psid, uid))
1299 return;
1300
1301 /* Check the winbindd cache directly. */
1302 ret = idmap_cache_find_uid2sid(uid, psid, &expired);
1303
1304 if (ret && !expired && is_null_sid(psid)) {
1305 /*
1306 * Negative cache entry, we already asked.
1307 * do legacy.
1308 */
1309 legacy_uid_to_sid(psid, uid);
1310 return;
1311 }
1312
1313 if (!ret || expired) {
1314 /* Not in cache. Ask winbindd. */
1315 if (!winbind_uid_to_sid(psid, uid)) {
1316 /*
1317 * We shouldn't return the NULL SID
1318 * here if winbind was running and
1319 * couldn't map, as winbind will have
1320 * added a negative entry that will
1321 * cause us to go though the
1322 * legacy_uid_to_sid()
1323 * function anyway in the case above
1324 * the next time we ask.
1325 */
1326 DEBUG(5, ("uid_to_sid: winbind failed to find a sid "
1327 "for uid %u\n", (unsigned int)uid));
1328
1329 legacy_uid_to_sid(psid, uid);
1330 return;
1331 }
1332 }
1333
1334 DEBUG(10,("uid %u -> sid %s\n", (unsigned int)uid,
1335 sid_string_dbg(psid)));
1336
1337 store_uid_sid_cache(psid, uid);
1338 return;
1339 }
1340
1341 /*****************************************************************
1342 *THE CANONICAL* convert gid_t to SID function.
1343 *****************************************************************/
1344
1345 void gid_to_sid(DOM_SID *psid, gid_t gid)
1346 {
1347 bool expired = true;
1348 bool ret;
1349 ZERO_STRUCTP(psid);
1350
1351 if (fetch_sid_from_gid_cache(psid, gid))
1352 return;
1353
1354 /* Check the winbindd cache directly. */
1355 ret = idmap_cache_find_gid2sid(gid, psid, &expired);
1356
1357 if (ret && !expired && is_null_sid(psid)) {
1358 /*
1359 * Negative cache entry, we already asked.
1360 * do legacy.
1361 */
1362 legacy_gid_to_sid(psid, gid);
1363 return;
1364 }
1365
1366 if (!ret || expired) {
1367 /* Not in cache. Ask winbindd. */
1368 if (!winbind_gid_to_sid(psid, gid)) {
1369 /*
1370 * We shouldn't return the NULL SID
1371 * here if winbind was running and
1372 * couldn't map, as winbind will have
1373 * added a negative entry that will
1374 * cause us to go though the
1375 * legacy_gid_to_sid()
1376 * function anyway in the case above
1377 * the next time we ask.
1378 */
1379 DEBUG(5, ("gid_to_sid: winbind failed to find a sid "
1380 "for gid %u\n", (unsigned int)gid));
1381
1382 legacy_gid_to_sid(psid, gid);
1383 return;
1384 }
1385 }
1386
1387 DEBUG(10,("gid %u -> sid %s\n", (unsigned int)gid,
1388 sid_string_dbg(psid)));
1389
1390 store_gid_sid_cache(psid, gid);
1391 return;
1392 }
1393
1394 /*****************************************************************
1395 *THE CANONICAL* convert SID to uid function.
1396 *****************************************************************/
1397
1398 bool sid_to_uid(const DOM_SID *psid, uid_t *puid)
1399 {
1400 bool expired = true;
1401 bool ret;
1402 uint32 rid;
1403 gid_t gid;
1404
1405 if (fetch_uid_from_cache(puid, psid))
1406 return true;
1407
1408 if (fetch_gid_from_cache(&gid, psid)) {
1409 return false;
1410 }
1411
1412 /* Optimize for the Unix Users Domain
1413 * as the conversion is straightforward */
1414 if (sid_peek_check_rid(&global_sid_Unix_Users, psid, &rid)) {
1415 uid_t uid = rid;
1416 *puid = uid;
1417
1418 /* return here, don't cache */
1419 DEBUG(10,("sid %s -> uid %u\n", sid_string_dbg(psid),
1420 (unsigned int)*puid ));
1421 return true;
1422 }
1423
1424 /* Check the winbindd cache directly. */
1425 ret = idmap_cache_find_sid2uid(psid, puid, &expired);
1426
1427 if (ret && !expired && (*puid == (uid_t)-1)) {
1428 /*
1429 * Negative cache entry, we already asked.
1430 * do legacy.
1431 */
1432 return legacy_sid_to_uid(psid, puid);
1433 }
1434
1435 if (!ret || expired) {
1436 /* Not in cache. Ask winbindd. */
1437 if (!winbind_sid_to_uid(puid, psid)) {
1438 DEBUG(5, ("winbind failed to find a uid for sid %s\n",
1439 sid_string_dbg(psid)));
1440 /* winbind failed. do legacy */
1441 return legacy_sid_to_uid(psid, puid);
1442 }
1443 }
1444
1445 /* TODO: Here would be the place to allocate both a gid and a uid for
1446 * the SID in question */
1447
1448 DEBUG(10,("sid %s -> uid %u\n", sid_string_dbg(psid),
1449 (unsigned int)*puid ));
1450
1451 store_uid_sid_cache(psid, *puid);
1452 return true;
1453 }
1454
1455 /*****************************************************************
1456 *THE CANONICAL* convert SID to gid function.
1457 Group mapping is used for gids that maps to Wellknown SIDs
1458 *****************************************************************/
1459
1460 bool sid_to_gid(const DOM_SID *psid, gid_t *pgid)
1461 {
1462 bool expired = true;
1463 bool ret;
1464 uint32 rid;
1465 uid_t uid;
1466
1467 if (fetch_gid_from_cache(pgid, psid))
1468 return true;
1469
1470 if (fetch_uid_from_cache(&uid, psid))
1471 return false;
1472
1473 /* Optimize for the Unix Groups Domain
1474 * as the conversion is straightforward */
1475 if (sid_peek_check_rid(&global_sid_Unix_Groups, psid, &rid)) {
1476 gid_t gid = rid;
1477 *pgid = gid;
1478
1479 /* return here, don't cache */
1480 DEBUG(10,("sid %s -> gid %u\n", sid_string_dbg(psid),
1481 (unsigned int)*pgid ));
1482 return true;
1483 }
1484
1485 /* Check the winbindd cache directly. */
1486 ret = idmap_cache_find_sid2gid(psid, pgid, &expired);
1487
1488 if (ret && !expired && (*pgid == (gid_t)-1)) {
1489 /*
1490 * Negative cache entry, we already asked.
1491 * do legacy.
1492 */
1493 return legacy_sid_to_gid(psid, pgid);
1494 }
1495
1496 if (!ret || expired) {
1497 /* Not in cache or negative. Ask winbindd. */
1498 /* Ask winbindd if it can map this sid to a gid.
1499 * (Idmap will check it is a valid SID and of the right type) */
1500
1501 if ( !winbind_sid_to_gid(pgid, psid) ) {
1502
1503 DEBUG(10,("winbind failed to find a gid for sid %s\n",
1504 sid_string_dbg(psid)));
1505 /* winbind failed. do legacy */
1506 return legacy_sid_to_gid(psid, pgid);
1507 }
1508 }
1509
1510 DEBUG(10,("sid %s -> gid %u\n", sid_string_dbg(psid),
1511 (unsigned int)*pgid ));
1512
1513 store_gid_sid_cache(psid, *pgid);
1514 return true;
1515 }
reg import