source3/winbindd/idmap_ad.c

   1 /*
   2  *  idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
   3  *
   4  * Unix SMB/CIFS implementation.
   5  *
   6  * Winbind ADS backend functions
   7  *
   8  * Copyright (C) Andrew Tridgell 2001
   9  * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
  10  * Copyright (C) Gerald (Jerry) Carter 2004-2007
  11  * Copyright (C) Luke Howard 2001-2004
  12  * Copyright (C) Michael Adam 2008,2010
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 3 of the License, or
  17  * (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  26  */
  27
  28 #include "includes.h"
  29 #include "winbindd.h"
  30 #include "../libds/common/flags.h"
  31 #include "ads.h"
  32 #include "libads/ldap_schema.h"
  33 #include "nss_info.h"
  34 #include "secrets.h"
  35 #include "idmap.h"
  36 #include "../libcli/ldap/ldap_ndr.h"
  37 #include "../libcli/security/security.h"
  38
  39 #undef DBGC_CLASS
  40 #define DBGC_CLASS DBGC_IDMAP
  41
  42 #define CHECK_ALLOC_DONE(mem) do { \
  43      if (!mem) { \
  44            DEBUG(0, ("Out of memory!\n")); \
  45            ret = NT_STATUS_NO_MEMORY; \
  46            goto done; \
  47       } \
  48 } while (0)
  49
  50 struct idmap_ad_context {
  51         ADS_STRUCT *ads;
  52         struct posix_schema *ad_schema;
  53         enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
  54 };
  55
  56 /************************************************************************
  57  ***********************************************************************/
  58
  59 static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
  60 {
  61         ADS_STATUS status;
  62         struct idmap_ad_context * ctx;
  63
  64         DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
  65                    dom->name));
  66
  67         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
  68
  69         status = ads_idmap_cached_connection(&ctx->ads, dom->name);
  70         if (!ADS_ERR_OK(status)) {
  71                 return status;
  72         }
  73
  74         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
  75
  76         /* if we have a valid ADS_STRUCT and the schema model is
  77            defined, then we can return here. */
  78
  79         if ( ctx->ad_schema ) {
  80                 return ADS_SUCCESS;
  81         }
  82
  83         /* Otherwise, set the schema model */
  84
  85         if ( (ctx->ad_map_type ==  WB_POSIX_MAP_SFU) ||
  86              (ctx->ad_map_type ==  WB_POSIX_MAP_SFU20) ||
  87              (ctx->ad_map_type ==  WB_POSIX_MAP_RFC2307) )
  88         {
  89                 status = ads_check_posix_schema_mapping(
  90                         ctx, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
  91                 if ( !ADS_ERR_OK(status) ) {
  92                         DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
  93                 }
  94         }
  95
  96         return status;
  97 }
  98
  99 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
 100 {
 101         if (ctx->ads != NULL) {
 102                 /* we own this ADS_STRUCT so make sure it goes away */
 103                 ctx->ads->is_mine = True;
 104                 ads_destroy( &ctx->ads );
 105                 ctx->ads = NULL;
 106         }
 107         return 0;
 108 }
 109
 110 /************************************************************************
 111  ***********************************************************************/
 112
 113 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
 114 {
 115         struct idmap_ad_context *ctx;
 116         char *config_option;
 117         const char *schema_mode = NULL;
 118
 119         ctx = talloc_zero(dom, struct idmap_ad_context);
 120         if (ctx == NULL) {
 121                 DEBUG(0, ("Out of memory!\n"));
 122                 return NT_STATUS_NO_MEMORY;
 123         }
 124         talloc_set_destructor(ctx, idmap_ad_context_destructor);
 125
 126         config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
 127         if (config_option == NULL) {
 128                 DEBUG(0, ("Out of memory!\n"));
 129                 talloc_free(ctx);
 130                 return NT_STATUS_NO_MEMORY;
 131         }
 132
 133         /* default map type */
 134         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 135
 136         /* schema mode */
 137         schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
 138         if ( schema_mode && schema_mode[0] ) {
 139                 if ( strequal(schema_mode, "sfu") )
 140                         ctx->ad_map_type = WB_POSIX_MAP_SFU;
 141                 else if ( strequal(schema_mode, "sfu20" ) )
 142                         ctx->ad_map_type = WB_POSIX_MAP_SFU20;
 143                 else if ( strequal(schema_mode, "rfc2307" ) )
 144                         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 145                 else
 146                         DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
 147                                  schema_mode));
 148         }
 149
 150         dom->private_data = ctx;
 151
 152         talloc_free(config_option);
 153
 154         return NT_STATUS_OK;
 155 }
 156
 157 /************************************************************************
 158  ***********************************************************************/
 159
 160 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 161 {
 162         NTSTATUS ret;
 163         TALLOC_CTX *memctx;
 164         struct idmap_ad_context *ctx;
 165         ADS_STATUS rc;
 166         const char *attrs[] = { "sAMAccountType",
 167                                 "objectSid",
 168                                 NULL, /* uidnumber */
 169                                 NULL, /* gidnumber */
 170                                 NULL };
 171         LDAPMessage *res = NULL;
 172         LDAPMessage *entry = NULL;
 173         char *filter = NULL;
 174         int idx = 0;
 175         int bidx = 0;
 176         int count;
 177         int i;
 178         char *u_filter = NULL;
 179         char *g_filter = NULL;
 180
 181         /* initialize the status to avoid suprise */
 182         for (i = 0; ids[i]; i++) {
 183                 ids[i]->status = ID_UNKNOWN;
 184         }
 185
 186         /* Only do query if we are online */
 187         if (idmap_is_offline()) {
 188                 return NT_STATUS_FILE_IS_OFFLINE;
 189         }
 190
 191         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 192
 193         if ( (memctx = talloc_new(ctx)) == NULL ) {
 194                 DEBUG(0, ("Out of memory!\n"));
 195                 return NT_STATUS_NO_MEMORY;
 196         }
 197
 198         rc = ad_idmap_cached_connection(dom);
 199         if (!ADS_ERR_OK(rc)) {
 200                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 201                 ret = NT_STATUS_UNSUCCESSFUL;
 202                 /* ret = ads_ntstatus(rc); */
 203                 goto done;
 204         }
 205
 206         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 207         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 208
 209 again:
 210         bidx = idx;
 211         for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 212                 switch (ids[idx]->xid.type) {
 213                 case ID_TYPE_UID:
 214                         if ( ! u_filter) {
 215                                 u_filter = talloc_asprintf(memctx, "(&(|"
 216                                                            "(sAMAccountType=%d)"
 217                                                            "(sAMAccountType=%d)"
 218                                                            "(sAMAccountType=%d))(|",
 219                                                            ATYPE_NORMAL_ACCOUNT,
 220                                                            ATYPE_WORKSTATION_TRUST,
 221                                                            ATYPE_INTERDOMAIN_TRUST);
 222                         }
 223                         u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
 224                                                           ctx->ad_schema->posix_uidnumber_attr,
 225                                                           (unsigned long)ids[idx]->xid.id);
 226                         CHECK_ALLOC_DONE(u_filter);
 227                         break;
 228
 229                 case ID_TYPE_GID:
 230                         if ( ! g_filter) {
 231                                 g_filter = talloc_asprintf(memctx, "(&(|"
 232                                                            "(sAMAccountType=%d)"
 233                                                            "(sAMAccountType=%d))(|",
 234                                                            ATYPE_SECURITY_GLOBAL_GROUP,
 235                                                            ATYPE_SECURITY_LOCAL_GROUP);
 236                         }
 237                         g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
 238                                                           ctx->ad_schema->posix_gidnumber_attr,
 239                                                           (unsigned long)ids[idx]->xid.id);
 240                         CHECK_ALLOC_DONE(g_filter);
 241                         break;
 242
 243                 default:
 244                         DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
 245                         ids[idx]->status = ID_UNKNOWN;
 246                         continue;
 247                 }
 248         }
 249         filter = talloc_asprintf(memctx, "(|");
 250         CHECK_ALLOC_DONE(filter);
 251         if ( u_filter) {
 252                 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
 253                 CHECK_ALLOC_DONE(filter);
 254                         TALLOC_FREE(u_filter);
 255         }
 256         if ( g_filter) {
 257                 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
 258                 CHECK_ALLOC_DONE(filter);
 259                 TALLOC_FREE(g_filter);
 260         }
 261         filter = talloc_asprintf_append_buffer(filter, ")");
 262         CHECK_ALLOC_DONE(filter);
 263
 264         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 265         if (!ADS_ERR_OK(rc)) {
 266                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 267                 ret = NT_STATUS_UNSUCCESSFUL;
 268                 goto done;
 269         }
 270
 271         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 272                 DEBUG(10, ("No IDs found\n"));
 273         }
 274
 275         entry = res;
 276         for (i = 0; (i < count) && entry; i++) {
 277                 struct dom_sid sid;
 278                 enum id_type type;
 279                 struct id_map *map;
 280                 uint32_t id;
 281                 uint32_t atype;
 282
 283                 if (i == 0) { /* first entry */
 284                         entry = ads_first_entry(ctx->ads, entry);
 285                 } else { /* following ones */
 286                         entry = ads_next_entry(ctx->ads, entry);
 287                 }
 288
 289                 if ( !entry ) {
 290                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 291                         break;
 292                 }
 293
 294                 /* first check if the SID is present */
 295                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 296                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 297                         continue;
 298                 }
 299
 300                 /* get type */
 301                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 302                         DEBUG(1, ("could not get SAM account type\n"));
 303                         continue;
 304                 }
 305
 306                 switch (atype & 0xF0000000) {
 307                 case ATYPE_SECURITY_GLOBAL_GROUP:
 308                 case ATYPE_SECURITY_LOCAL_GROUP:
 309                         type = ID_TYPE_GID;
 310                         break;
 311                 case ATYPE_NORMAL_ACCOUNT:
 312                 case ATYPE_WORKSTATION_TRUST:
 313                 case ATYPE_INTERDOMAIN_TRUST:
 314                         type = ID_TYPE_UID;
 315                         break;
 316                 default:
 317                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 318                         continue;
 319                 }
 320
 321                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 322                                                  ctx->ad_schema->posix_uidnumber_attr :
 323                                                  ctx->ad_schema->posix_gidnumber_attr,
 324                                      &id))
 325                 {
 326                         DEBUG(1, ("Could not get SID for unix ID %u\n", (unsigned) id));
 327                         continue;
 328                 }
 329
 330                 if (!idmap_unix_id_is_in_range(id, dom)) {
 331                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 332                                 id, dom->low_id, dom->high_id));
 333                         continue;
 334                 }
 335
 336                 map = idmap_find_map_by_id(&ids[bidx], type, id);
 337                 if (!map) {
 338                         DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
 339                         continue;
 340                 }
 341
 342                 sid_copy(map->sid, &sid);
 343
 344                 /* mapped */
 345                 map->status = ID_MAPPED;
 346
 347                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 348                            (unsigned long)map->xid.id,
 349                            map->xid.type));
 350         }
 351
 352         if (res) {
 353                 ads_msgfree(ctx->ads, res);
 354         }
 355
 356         if (ids[idx]) { /* still some values to map */
 357                 goto again;
 358         }
 359
 360         ret = NT_STATUS_OK;
 361
 362         /* mark all unknown/expired ones as unmapped */
 363         for (i = 0; ids[i]; i++) {
 364                 if (ids[i]->status != ID_MAPPED)
 365                         ids[i]->status = ID_UNMAPPED;
 366         }
 367
 368 done:
 369         talloc_free(memctx);
 370         return ret;
 371 }
 372
 373 /************************************************************************
 374  ***********************************************************************/
 375
 376 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 377 {
 378         NTSTATUS ret;
 379         TALLOC_CTX *memctx;
 380         struct idmap_ad_context *ctx;
 381         ADS_STATUS rc;
 382         const char *attrs[] = { "sAMAccountType",
 383                                 "objectSid",
 384                                 NULL, /* attr_uidnumber */
 385                                 NULL, /* attr_gidnumber */
 386                                 NULL };
 387         LDAPMessage *res = NULL;
 388         LDAPMessage *entry = NULL;
 389         char *filter = NULL;
 390         int idx = 0;
 391         int bidx = 0;
 392         int count;
 393         int i;
 394         char *sidstr;
 395
 396         /* initialize the status to avoid suprise */
 397         for (i = 0; ids[i]; i++) {
 398                 ids[i]->status = ID_UNKNOWN;
 399         }
 400
 401         /* Only do query if we are online */
 402         if (idmap_is_offline()) {
 403                 return NT_STATUS_FILE_IS_OFFLINE;
 404         }
 405
 406         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 407
 408         if ( (memctx = talloc_new(ctx)) == NULL ) {
 409                 DEBUG(0, ("Out of memory!\n"));
 410                 return NT_STATUS_NO_MEMORY;
 411         }
 412
 413         rc = ad_idmap_cached_connection(dom);
 414         if (!ADS_ERR_OK(rc)) {
 415                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 416                 ret = NT_STATUS_UNSUCCESSFUL;
 417                 /* ret = ads_ntstatus(rc); */
 418                 goto done;
 419         }
 420
 421         if (ctx->ad_schema == NULL) {
 422                 DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
 423                 ret = NT_STATUS_UNSUCCESSFUL;
 424                 goto done;
 425         }
 426
 427         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 428         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 429
 430 again:
 431         filter = talloc_asprintf(memctx, "(&(|"
 432                                  "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
 433                                  "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
 434                                  ")(|",
 435                                  ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
 436                                  ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
 437
 438         CHECK_ALLOC_DONE(filter);
 439
 440         bidx = idx;
 441         for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 442
 443                 ids[idx]->status = ID_UNKNOWN;
 444
 445                 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[idx]->sid);
 446                 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
 447
 448                 TALLOC_FREE(sidstr);
 449                 CHECK_ALLOC_DONE(filter);
 450         }
 451         filter = talloc_asprintf_append_buffer(filter, "))");
 452         CHECK_ALLOC_DONE(filter);
 453         DEBUG(10, ("Filter: [%s]\n", filter));
 454
 455         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 456         if (!ADS_ERR_OK(rc)) {
 457                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 458                 ret = NT_STATUS_UNSUCCESSFUL;
 459                 goto done;
 460         }
 461
 462         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 463                 DEBUG(10, ("No IDs found\n"));
 464         }
 465
 466         entry = res;
 467         for (i = 0; (i < count) && entry; i++) {
 468                 struct dom_sid sid;
 469                 enum id_type type;
 470                 struct id_map *map;
 471                 uint32_t id;
 472                 uint32_t atype;
 473
 474                 if (i == 0) { /* first entry */
 475                         entry = ads_first_entry(ctx->ads, entry);
 476                 } else { /* following ones */
 477                         entry = ads_next_entry(ctx->ads, entry);
 478                 }
 479
 480                 if ( !entry ) {
 481                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 482                         break;
 483                 }
 484
 485                 /* first check if the SID is present */
 486                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 487                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 488                         continue;
 489                 }
 490
 491                 map = idmap_find_map_by_sid(&ids[bidx], &sid);
 492                 if (!map) {
 493                         DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
 494                         continue;
 495                 }
 496
 497                 /* get type */
 498                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 499                         DEBUG(1, ("could not get SAM account type\n"));
 500                         continue;
 501                 }
 502
 503                 switch (atype & 0xF0000000) {
 504                 case ATYPE_SECURITY_GLOBAL_GROUP:
 505                 case ATYPE_SECURITY_LOCAL_GROUP:
 506                         type = ID_TYPE_GID;
 507                         break;
 508                 case ATYPE_NORMAL_ACCOUNT:
 509                 case ATYPE_WORKSTATION_TRUST:
 510                 case ATYPE_INTERDOMAIN_TRUST:
 511                         type = ID_TYPE_UID;
 512                         break;
 513                 default:
 514                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 515                         continue;
 516                 }
 517
 518                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 519                                                  ctx->ad_schema->posix_uidnumber_attr :
 520                                                  ctx->ad_schema->posix_gidnumber_attr,
 521                                      &id))
 522                 {
 523                         DEBUG(1, ("Could not get unix ID for SID %s\n",
 524                                 sid_string_dbg(map->sid)));
 525                         continue;
 526                 }
 527                 if (!idmap_unix_id_is_in_range(id, dom)) {
 528                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 529                                 id, dom->low_id, dom->high_id));
 530                         continue;
 531                 }
 532
 533                 /* mapped */
 534                 map->xid.type = type;
 535                 map->xid.id = id;
 536                 map->status = ID_MAPPED;
 537
 538                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 539                            (unsigned long)map->xid.id,
 540                            map->xid.type));
 541         }
 542
 543         if (res) {
 544                 ads_msgfree(ctx->ads, res);
 545         }
 546
 547         if (ids[idx]) { /* still some values to map */
 548                 goto again;
 549         }
 550
 551         ret = NT_STATUS_OK;
 552
 553         /* mark all unknown/expired ones as unmapped */
 554         for (i = 0; ids[i]; i++) {
 555                 if (ids[i]->status != ID_MAPPED)
 556                         ids[i]->status = ID_UNMAPPED;
 557         }
 558
 559 done:
 560         talloc_free(memctx);
 561         return ret;
 562 }
 563
 564 /*
 565  * nss_info_{sfu,sfu20,rfc2307}
 566  */
 567
 568 /************************************************************************
 569  Initialize the {sfu,sfu20,rfc2307} state
 570  ***********************************************************************/
 571
 572 static const char *wb_posix_map_unknown_string = "WB_POSIX_MAP_UNKNOWN";
 573 static const char *wb_posix_map_template_string = "WB_POSIX_MAP_TEMPLATE";
 574 static const char *wb_posix_map_sfu_string = "WB_POSIX_MAP_SFU";
 575 static const char *wb_posix_map_sfu20_string = "WB_POSIX_MAP_SFU20";
 576 static const char *wb_posix_map_rfc2307_string = "WB_POSIX_MAP_RFC2307";
 577 static const char *wb_posix_map_unixinfo_string = "WB_POSIX_MAP_UNIXINFO";
 578
 579 static const char *ad_map_type_string(enum wb_posix_mapping map_type)
 580 {
 581         switch (map_type) {
 582                 case WB_POSIX_MAP_TEMPLATE:
 583                         return wb_posix_map_template_string;
 584                 case WB_POSIX_MAP_SFU:
 585                         return wb_posix_map_sfu_string;
 586                 case WB_POSIX_MAP_SFU20:
 587                         return wb_posix_map_sfu20_string;
 588                 case WB_POSIX_MAP_RFC2307:
 589                         return wb_posix_map_rfc2307_string;
 590                 case WB_POSIX_MAP_UNIXINFO:
 591                         return wb_posix_map_unixinfo_string;
 592                 default:
 593                         return wb_posix_map_unknown_string;
 594         }
 595 }
 596
 597 static NTSTATUS nss_ad_generic_init(struct nss_domain_entry *e,
 598                                     enum wb_posix_mapping new_ad_map_type)
 599 {
 600         struct idmap_domain *dom;
 601         struct idmap_ad_context *ctx;
 602
 603         if (e->state != NULL) {
 604                 dom = talloc_get_type(e->state, struct idmap_domain);
 605         } else {
 606                 dom = talloc_zero(e, struct idmap_domain);
 607                 if (dom == NULL) {
 608                         DEBUG(0, ("Out of memory!\n"));
 609                         return NT_STATUS_NO_MEMORY;
 610                 }
 611                 e->state = dom;
 612         }
 613
 614         if (e->domain != NULL) {
 615                 dom->name = talloc_strdup(dom, e->domain);
 616                 if (dom->name == NULL) {
 617                         DEBUG(0, ("Out of memory!\n"));
 618                         return NT_STATUS_NO_MEMORY;
 619                 }
 620         }
 621
 622         if (dom->private_data != NULL) {
 623                 ctx = talloc_get_type(dom->private_data,
 624                                       struct idmap_ad_context);
 625         } else {
 626                 ctx = talloc_zero(dom, struct idmap_ad_context);
 627                 if (ctx == NULL) {
 628                         DEBUG(0, ("Out of memory!\n"));
 629                         return NT_STATUS_NO_MEMORY;
 630                 }
 631                 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 632                 dom->private_data = ctx;
 633         }
 634
 635         if ((ctx->ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
 636             (ctx->ad_map_type != new_ad_map_type))
 637         {
 638                 DEBUG(2, ("nss_ad_generic_init: "
 639                           "Warning: overriding previously set posix map type "
 640                           "%s for domain %s with map type %s.\n",
 641                           ad_map_type_string(ctx->ad_map_type),
 642                           dom->name,
 643                           ad_map_type_string(new_ad_map_type)));
 644         }
 645
 646         ctx->ad_map_type = new_ad_map_type;
 647
 648         return NT_STATUS_OK;
 649 }
 650
 651 static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
 652 {
 653         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU);
 654 }
 655
 656 static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
 657 {
 658         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU20);
 659 }
 660
 661 static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
 662 {
 663         return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
 664 }
 665
 666
 667 /************************************************************************
 668  ***********************************************************************/
 669
 670 static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
 671                                   const struct dom_sid *sid,
 672                                   TALLOC_CTX *mem_ctx,
 673                                   const char **homedir,
 674                                   const char **shell,
 675                                   const char **gecos,
 676                                   uint32 *gid )
 677 {
 678         const char *attrs[] = {NULL, /* attr_homedir */
 679                                NULL, /* attr_shell */
 680                                NULL, /* attr_gecos */
 681                                NULL, /* attr_gidnumber */
 682                                NULL };
 683         char *filter = NULL;
 684         LDAPMessage *msg_internal = NULL;
 685         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 686         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 687         char *sidstr = NULL;
 688         struct idmap_domain *dom;
 689         struct idmap_ad_context *ctx;
 690
 691         DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
 692                    sid_string_dbg(sid), e->domain?e->domain:"NULL"));
 693
 694         /* Only do query if we are online */
 695         if (idmap_is_offline()) {
 696                 return NT_STATUS_FILE_IS_OFFLINE;
 697         }
 698
 699         dom = talloc_get_type(e->state, struct idmap_domain);
 700         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 701
 702         ads_status = ad_idmap_cached_connection(dom);
 703         if (!ADS_ERR_OK(ads_status)) {
 704                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 705         }
 706
 707         if (!ctx->ad_schema) {
 708                 DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
 709                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 710         }
 711
 712         if (!sid || !homedir || !shell || !gecos) {
 713                 return NT_STATUS_INVALID_PARAMETER;
 714         }
 715
 716         /* Have to do our own query */
 717
 718         DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
 719                    "own query\n"));
 720
 721         attrs[0] = ctx->ad_schema->posix_homedir_attr;
 722         attrs[1] = ctx->ad_schema->posix_shell_attr;
 723         attrs[2] = ctx->ad_schema->posix_gecos_attr;
 724         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 725
 726         sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
 727         filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
 728         TALLOC_FREE(sidstr);
 729
 730         if (!filter) {
 731                 nt_status = NT_STATUS_NO_MEMORY;
 732                 goto done;
 733         }
 734
 735         ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
 736         if (!ADS_ERR_OK(ads_status)) {
 737                 nt_status = ads_ntstatus(ads_status);
 738                 goto done;
 739         }
 740
 741         *homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
 742         *shell   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
 743         *gecos   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
 744
 745         if (gid) {
 746                 if (!ads_pull_uint32(ctx->ads, msg_internal, ctx->ad_schema->posix_gidnumber_attr, gid))
 747                         *gid = (uint32)-1;
 748         }
 749
 750         nt_status = NT_STATUS_OK;
 751
 752 done:
 753         if (msg_internal) {
 754                 ads_msgfree(ctx->ads, msg_internal);
 755         }
 756
 757         return nt_status;
 758 }
 759
 760 /**********************************************************************
 761  *********************************************************************/
 762
 763 static NTSTATUS nss_ad_map_to_alias(TALLOC_CTX *mem_ctx,
 764                                     struct nss_domain_entry *e,
 765                                     const char *name,
 766                                     char **alias)
 767 {
 768         const char *attrs[] = {NULL, /* attr_uid */
 769                                NULL };
 770         char *filter = NULL;
 771         LDAPMessage *msg = NULL;
 772         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 773         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 774         struct idmap_domain *dom;
 775         struct idmap_ad_context *ctx = NULL;
 776
 777         /* Check incoming parameters */
 778
 779         if ( !e || !e->domain || !name || !*alias) {
 780                 nt_status = NT_STATUS_INVALID_PARAMETER;
 781                 goto done;
 782         }
 783
 784         /* Only do query if we are online */
 785
 786         if (idmap_is_offline()) {
 787                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
 788                 goto done;
 789         }
 790
 791         dom = talloc_get_type(e->state, struct idmap_domain);
 792         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 793
 794         ads_status = ad_idmap_cached_connection(dom);
 795         if (!ADS_ERR_OK(ads_status)) {
 796                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 797         }
 798
 799         if (!ctx->ad_schema) {
 800                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
 801                 goto done;
 802         }
 803
 804         attrs[0] = ctx->ad_schema->posix_uid_attr;
 805
 806         filter = talloc_asprintf(mem_ctx,
 807                                  "(sAMAccountName=%s)",
 808                                  name);
 809         if (!filter) {
 810                 nt_status = NT_STATUS_NO_MEMORY;
 811                 goto done;
 812         }
 813
 814         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
 815         if (!ADS_ERR_OK(ads_status)) {
 816                 nt_status = ads_ntstatus(ads_status);
 817                 goto done;
 818         }
 819
 820         *alias = ads_pull_string(ctx->ads, mem_ctx, msg, ctx->ad_schema->posix_uid_attr);
 821
 822         if (!*alias) {
 823                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 824         }
 825
 826         nt_status = NT_STATUS_OK;
 827
 828 done:
 829         if (filter) {
 830                 talloc_destroy(filter);
 831         }
 832         if (msg) {
 833                 ads_msgfree(ctx->ads, msg);
 834         }
 835
 836         return nt_status;
 837 }
 838
 839 /**********************************************************************
 840  *********************************************************************/
 841
 842 static NTSTATUS nss_ad_map_from_alias( TALLOC_CTX *mem_ctx,
 843                                              struct nss_domain_entry *e,
 844                                              const char *alias,
 845                                              char **name )
 846 {
 847         const char *attrs[] = {"sAMAccountName",
 848                                NULL };
 849         char *filter = NULL;
 850         LDAPMessage *msg = NULL;
 851         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 852         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 853         char *username;
 854         struct idmap_domain *dom;
 855         struct idmap_ad_context *ctx = NULL;
 856
 857         /* Check incoming parameters */
 858
 859         if ( !alias || !name) {
 860                 nt_status = NT_STATUS_INVALID_PARAMETER;
 861                 goto done;
 862         }
 863
 864         /* Only do query if we are online */
 865
 866         if (idmap_is_offline()) {
 867                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
 868                 goto done;
 869         }
 870
 871         dom = talloc_get_type(e->state, struct idmap_domain);
 872         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 873
 874         ads_status = ad_idmap_cached_connection(dom);
 875         if (!ADS_ERR_OK(ads_status)) {
 876                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 877         }
 878
 879         if (!ctx->ad_schema) {
 880                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
 881                 goto done;
 882         }
 883
 884         filter = talloc_asprintf(mem_ctx,
 885                                  "(%s=%s)",
 886                                  ctx->ad_schema->posix_uid_attr,
 887                                  alias);
 888         if (!filter) {
 889                 nt_status = NT_STATUS_NO_MEMORY;
 890                 goto done;
 891         }
 892
 893         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
 894         if (!ADS_ERR_OK(ads_status)) {
 895                 nt_status = ads_ntstatus(ads_status);
 896                 goto done;
 897         }
 898
 899         username = ads_pull_string(ctx->ads, mem_ctx, msg,
 900                                    "sAMAccountName");
 901         if (!username) {
 902                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 903         }
 904
 905         *name = talloc_asprintf(mem_ctx, "%s\\%s",
 906                                 lp_workgroup(),
 907                                 username);
 908         if (!*name) {
 909                 nt_status = NT_STATUS_NO_MEMORY;
 910                 goto done;
 911         }
 912
 913         nt_status = NT_STATUS_OK;
 914
 915 done:
 916         if (filter) {
 917                 talloc_destroy(filter);
 918         }
 919         if (msg) {
 920                 ads_msgfree(ctx->ads, msg);
 921         }
 922
 923         return nt_status;
 924 }
 925
 926 /************************************************************************
 927  Function dispatch tables for the idmap and nss plugins
 928  ***********************************************************************/
 929
 930 static struct idmap_methods ad_methods = {
 931         .init            = idmap_ad_initialize,
 932         .unixids_to_sids = idmap_ad_unixids_to_sids,
 933         .sids_to_unixids = idmap_ad_sids_to_unixids,
 934 };
 935
 936 /* The SFU and RFC2307 NSS plugins share everything but the init
 937    function which sets the intended schema model to use */
 938
 939 static struct nss_info_methods nss_rfc2307_methods = {
 940         .init           = nss_rfc2307_init,
 941         .get_nss_info   = nss_ad_get_info,
 942         .map_to_alias   = nss_ad_map_to_alias,
 943         .map_from_alias = nss_ad_map_from_alias,
 944 };
 945
 946 static struct nss_info_methods nss_sfu_methods = {
 947         .init           = nss_sfu_init,
 948         .get_nss_info   = nss_ad_get_info,
 949         .map_to_alias   = nss_ad_map_to_alias,
 950         .map_from_alias = nss_ad_map_from_alias,
 951 };
 952
 953 static struct nss_info_methods nss_sfu20_methods = {
 954         .init           = nss_sfu20_init,
 955         .get_nss_info   = nss_ad_get_info,
 956         .map_to_alias   = nss_ad_map_to_alias,
 957         .map_from_alias = nss_ad_map_from_alias,
 958 };
 959
 960
 961
 962 /************************************************************************
 963  Initialize the plugins
 964  ***********************************************************************/
 965
 966 NTSTATUS samba_init_module(void)
 967 {
 968         static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
 969         static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
 970         static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
 971         static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
 972
 973         /* Always register the AD method first in order to get the
 974            idmap_domain interface called */
 975
 976         if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
 977                 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
 978                                                      "ad", &ad_methods);
 979                 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
 980                         return status_idmap_ad;
 981         }
 982
 983         if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
 984                 status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
 985                                                             "rfc2307",  &nss_rfc2307_methods );
 986                 if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
 987                         return status_nss_rfc2307;
 988         }
 989
 990         if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
 991                 status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
 992                                                         "sfu",  &nss_sfu_methods );
 993                 if ( !NT_STATUS_IS_OK(status_nss_sfu) )
 994                         return status_nss_sfu;
 995         }
 996
 997         if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
 998                 status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
 999                                                         "sfu20",  &nss_sfu20_methods );
1000                 if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
1001                         return status_nss_sfu20;
1002         }
1003
1004         return NT_STATUS_OK;
1005 }
1006