?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix bug #8254 - "acl check permissions = no" does not work in all cases
[Samba/gebeck_regimport.git] / source3 / passdb / pdb_samba4.c
blob5848c23de8e1dd8eea79cbc2e1beffe0c6eb7d90
1 /*
2 Unix SMB/CIFS implementation.
3 pdb glue module for samba4
4 Copyright (C) Volker Lendecke 2009-2011
5 Copyright (C) Andrew Bartlett 2010
6 Copyright (C) Matthias Dieter Wallnöfer 2009
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /* This module, is a port of Volker's pdb_ads to ldb and DSDB APIs */
23
24 #include "includes.h"
25 #include "source3/include/passdb.h"
26 #include "source4/dsdb/samdb/samdb.h"
27 #include "ldb_errors.h"
28 #include "libcli/security/dom_sid.h"
29 #include "source4/winbind/idmap.h"
30 #include "librpc/gen_ndr/ndr_security.h"
31 #include "libds/common/flag_mapping.h"
32 #include "source4/lib/events/events.h"
33 #include "source4/auth/session.h"
34 #include "source4/auth/system_session_proto.h"
35 #include "source4/param/param.h"
36
37 struct pdb_samba4_state {
38 struct tevent_context *ev;
39 struct ldb_context *ldb;
40 struct idmap_context *idmap_ctx;
41 struct loadparm_context *lp_ctx;
42 };
43
44 static NTSTATUS pdb_samba4_getsampwsid(struct pdb_methods *m,
45 struct samu *sam_acct,
46 const struct dom_sid *sid);
47 static NTSTATUS pdb_samba4_getsamupriv(struct pdb_samba4_state *state,
48 const char *filter,
49 TALLOC_CTX *mem_ctx,
50 struct ldb_message **pmsg);
51 static bool pdb_samba4_sid_to_id(struct pdb_methods *m, const struct dom_sid *sid,
52 union unid_t *id, enum lsa_SidType *type);
53
54 static bool pdb_samba4_pull_time(struct ldb_message *msg, const char *attr,
55 time_t *ptime)
56 {
57 uint64_t tmp;
58 if (! ldb_msg_find_element(msg, attr)) {
59 return false;
60 }
61 tmp = ldb_msg_find_attr_as_uint64(msg, attr, 0);
62 *ptime = uint64s_nt_time_to_unix_abs(&tmp);
63 return true;
64 }
65
66 static struct pdb_domain_info *pdb_samba4_get_domain_info(
67 struct pdb_methods *m, TALLOC_CTX *mem_ctx)
68 {
69 struct pdb_samba4_state *state = talloc_get_type_abort(
70 m->private_data, struct pdb_samba4_state);
71 struct pdb_domain_info *info;
72 struct dom_sid *domain_sid;
73 struct ldb_dn *forest_dn, *domain_dn;
74 struct ldb_result *dom_res = NULL;
75 const char *dom_attrs[] = {
76 "objectSid",
77 "objectGUID",
78 "nTMixedDomain",
79 "fSMORoleOwner",
80 NULL
81 };
82 char *p;
83 int ret;
84
85 info = talloc(mem_ctx, struct pdb_domain_info);
86 if (info == NULL) {
87 return NULL;
88 }
89
90 domain_dn = ldb_get_default_basedn(state->ldb);
91
92 ret = ldb_search(state->ldb, info, &dom_res,
93 domain_dn, LDB_SCOPE_BASE, dom_attrs, NULL);
94 if (ret != LDB_SUCCESS) {
95 goto fail;
96 }
97 if (dom_res->count != 1) {
98 goto fail;
99 }
100
101 info->guid = samdb_result_guid(dom_res->msgs[0], "objectGUID");
102
103 domain_sid = samdb_result_dom_sid(state, dom_res->msgs[0], "objectSid");
104 if (!domain_sid) {
105 goto fail;
106 }
107 info->sid = *domain_sid;
108
109 TALLOC_FREE(dom_res);
110
111 info->name = talloc_strdup(info, lpcfg_sam_name(state->lp_ctx));
112 info->dns_domain = ldb_dn_canonical_string(info, domain_dn);
113
114 if (!info->dns_domain) {
115 goto fail;
116 }
117 p = strchr(info->dns_domain, '/');
118 if (p) {
119 *p = '\0';
120 }
121
122 forest_dn = ldb_get_root_basedn(state->ldb);
123 if (!forest_dn) {
124 goto fail;
125 }
126
127 info->dns_forest = ldb_dn_canonical_string(info, forest_dn);
128 if (!info->dns_forest) {
129 goto fail;
130 }
131 p = strchr(info->dns_forest, '/');
132 if (p) {
133 *p = '\0';
134 }
135
136 return info;
137
138 fail:
139 TALLOC_FREE(dom_res);
140 TALLOC_FREE(info);
141 return NULL;
142 }
143
144 static struct ldb_message *pdb_samba4_get_samu_private(
145 struct pdb_methods *m, struct samu *sam)
146 {
147 struct pdb_samba4_state *state = talloc_get_type_abort(
148 m->private_data, struct pdb_samba4_state);
149 struct ldb_message *msg;
150 char *sidstr, *filter;
151 NTSTATUS status;
152
153 msg = (struct ldb_message *)
154 pdb_get_backend_private_data(sam, m);
155
156 if (msg != NULL) {
157 return talloc_get_type_abort(msg, struct ldb_message);
158 }
159
160 sidstr = dom_sid_string(talloc_tos(), pdb_get_user_sid(sam));
161 if (sidstr == NULL) {
162 return NULL;
163 }
164
165 filter = talloc_asprintf(
166 talloc_tos(), "(&(objectsid=%s)(objectclass=user))", sidstr);
167 TALLOC_FREE(sidstr);
168 if (filter == NULL) {
169 return NULL;
170 }
171
172 status = pdb_samba4_getsamupriv(state, filter, sam, &msg);
173 TALLOC_FREE(filter);
174 if (!NT_STATUS_IS_OK(status)) {
175 return NULL;
176 }
177
178 return msg;
179 }
180
181 static NTSTATUS pdb_samba4_init_sam_from_priv(struct pdb_methods *m,
182 struct samu *sam,
183 struct ldb_message *msg)
184 {
185 struct pdb_samba4_state *state = talloc_get_type_abort(
186 m->private_data, struct pdb_samba4_state);
187 TALLOC_CTX *frame = talloc_stackframe();
188 NTSTATUS status = NT_STATUS_INTERNAL_DB_CORRUPTION;
189 const char *str;
190 time_t tmp_time;
191 struct dom_sid *sid, group_sid;
192 uint64_t n;
193 const DATA_BLOB *blob;
194
195 str = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
196 if (str == NULL) {
197 DEBUG(10, ("no samAccountName\n"));
198 goto fail;
199 }
200 pdb_set_username(sam, str, PDB_SET);
201
202 if (pdb_samba4_pull_time(msg, "lastLogon", &tmp_time)) {
203 pdb_set_logon_time(sam, tmp_time, PDB_SET);
204 }
205 if (pdb_samba4_pull_time(msg, "lastLogoff", &tmp_time)) {
206 pdb_set_logoff_time(sam, tmp_time, PDB_SET);
207 }
208 if (pdb_samba4_pull_time(msg, "pwdLastSet", &tmp_time)) {
209 pdb_set_pass_last_set_time(sam, tmp_time, PDB_SET);
210 }
211 if (pdb_samba4_pull_time(msg, "accountExpires", &tmp_time)) {
212 pdb_set_kickoff_time(sam, tmp_time, PDB_SET);
213 }
214
215 str = ldb_msg_find_attr_as_string(msg, "displayName",
216 NULL);
217 if (str != NULL) {
218 pdb_set_fullname(sam, str, PDB_SET);
219 }
220
221 str = ldb_msg_find_attr_as_string(msg, "homeDirectory",
222 NULL);
223 if (str != NULL) {
224 pdb_set_homedir(sam, str, PDB_SET);
225 }
226
227 str = ldb_msg_find_attr_as_string(msg, "homeDrive", NULL);
228 if (str != NULL) {
229 pdb_set_dir_drive(sam, str, PDB_SET);
230 }
231
232 str = ldb_msg_find_attr_as_string(msg, "scriptPath", NULL);
233 if (str != NULL) {
234 pdb_set_logon_script(sam, str, PDB_SET);
235 }
236
237 str = ldb_msg_find_attr_as_string(msg, "profilePath",
238 NULL);
239 if (str != NULL) {
240 pdb_set_profile_path(sam, str, PDB_SET);
241 }
242
243 str = ldb_msg_find_attr_as_string(msg, "profilePath",
244 NULL);
245 if (str != NULL) {
246 pdb_set_profile_path(sam, str, PDB_SET);
247 }
248
249 str = ldb_msg_find_attr_as_string(msg, "comment",
250 NULL);
251 if (str != NULL) {
252 pdb_set_comment(sam, str, PDB_SET);
253 }
254
255 str = ldb_msg_find_attr_as_string(msg, "description",
256 NULL);
257 if (str != NULL) {
258 pdb_set_acct_desc(sam, str, PDB_SET);
259 }
260
261 str = ldb_msg_find_attr_as_string(msg, "userWorkstations",
262 NULL);
263 if (str != NULL) {
264 pdb_set_workstations(sam, str, PDB_SET);
265 }
266
267 str = ldb_msg_find_attr_as_string(msg, "userParameters",
268 NULL);
269 if (str != NULL) {
270 pdb_set_munged_dial(sam, str, PDB_SET);
271 }
272
273 sid = samdb_result_dom_sid(talloc_tos(), msg, "objectSid");
274 if (!sid) {
275 DEBUG(10, ("Could not pull SID\n"));
276 goto fail;
277 }
278 pdb_set_user_sid(sam, sid, PDB_SET);
279
280 n = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
281 if (n == 0) {
282 DEBUG(10, ("Could not pull userAccountControl\n"));
283 goto fail;
284 }
285 pdb_set_acct_ctrl(sam, ds_uf2acb(n), PDB_SET);
286
287 blob = ldb_msg_find_ldb_val(msg, "unicodePwd");
288 if (blob) {
289 if (blob->length != NT_HASH_LEN) {
290 DEBUG(0, ("Got NT hash of length %d, expected %d\n",
291 (int)blob->length, NT_HASH_LEN));
292 goto fail;
293 }
294 pdb_set_nt_passwd(sam, blob->data, PDB_SET);
295 }
296
297 blob = ldb_msg_find_ldb_val(msg, "dBCSPwd");
298 if (blob) {
299 if (blob->length != LM_HASH_LEN) {
300 DEBUG(0, ("Got LM hash of length %d, expected %d\n",
301 (int)blob->length, LM_HASH_LEN));
302 goto fail;
303 }
304 pdb_set_lanman_passwd(sam, blob->data, PDB_SET);
305 }
306
307 n = ldb_msg_find_attr_as_uint(msg, "primaryGroupID", 0);
308 if (n == 0) {
309 DEBUG(10, ("Could not pull primaryGroupID\n"));
310 goto fail;
311 }
312 sid_compose(&group_sid, samdb_domain_sid(state->ldb), n);
313 pdb_set_group_sid(sam, &group_sid, PDB_SET);
314
315 status = NT_STATUS_OK;
316 fail:
317 TALLOC_FREE(frame);
318 return status;
319 }
320
321 static bool pdb_samba4_add_time(struct ldb_message *msg,
322 const char *attrib, time_t t)
323 {
324 uint64_t nt_time;
325
326 unix_to_nt_time(&nt_time, t);
327
328 return ldb_msg_add_fmt(msg, attrib, "%llu", (unsigned long long) nt_time);
329 }
330
331 /* Like in pdb_ldap(), this will need to be a function pointer when we
332 * start to support 'adds' for migrations from samba3 passdb backends
333 * to samba4 */
334 static bool update_required(struct samu *sam, enum pdb_elements element)
335 {
336 return (IS_SAM_CHANGED(sam, element));
337 }
338
339 static bool pdb_samba4_init_samba4_from_sam(struct pdb_samba4_state *state,
340 struct ldb_message *existing,
341 TALLOC_CTX *mem_ctx,
342 struct ldb_message **pmods,
343 struct samu *sam)
344 {
345 int ret = LDB_SUCCESS;
346 const char *pw;
347 struct ldb_message *msg;
348
349 /* TODO: All fields :-) */
350
351 msg = ldb_msg_new(mem_ctx);
352 if (!msg) {
353 return false;
354 }
355
356 msg->dn = existing->dn;
357
358 pw = pdb_get_plaintext_passwd(sam);
359 if (update_required(sam, PDB_PLAINTEXT_PW)) {
360 if (pw == NULL) {
361 ret = LDB_ERR_OPERATIONS_ERROR;
362 goto fail;
363 }
364
365 ret |= ldb_msg_add_string(msg, "clearTextPassword", pw);
366 }
367
368 if (update_required(sam, PDB_FULLNAME)) {
369 ret |= ldb_msg_add_string(msg, "displayName", pdb_get_fullname(sam));
370 }
371
372 if (update_required(sam, PDB_SMBHOME)) {
373 ret |= ldb_msg_add_string(msg, "homeDirectory",
374 pdb_get_homedir(sam));
375 }
376
377 if (update_required(sam, PDB_PROFILE)) {
378 ret |= ldb_msg_add_string(msg, "profilePath",
379 pdb_get_profile_path(sam));
380 }
381
382 if (update_required(sam, PDB_DRIVE)) {
383 ret |= ldb_msg_add_string(msg, "homeDrive",
384 pdb_get_dir_drive(sam));
385 }
386
387 if (update_required(sam, PDB_LOGONSCRIPT)) {
388 ret |= ldb_msg_add_string(msg, "scriptPath",
389 pdb_get_logon_script(sam));
390 }
391
392 if (update_required(sam, PDB_KICKOFFTIME)) {
393 ret |= pdb_samba4_add_time(msg, "accountExpires",
394 pdb_get_kickoff_time(sam));
395 }
396
397 if (update_required(sam, PDB_USERNAME)) {
398 ret |= ldb_msg_add_string(msg, "samAccountName",
399 pdb_get_username(sam));
400 }
401
402 if (update_required(sam, PDB_HOURSLEN) || update_required(sam, PDB_HOURS)) {
403 struct ldb_val hours = data_blob_const(pdb_get_hours(sam), pdb_get_hours_len(sam));
404 ret |= ldb_msg_add_value(msg, "logonHours",
405 &hours, NULL);
406 }
407
408 if (update_required(sam, PDB_ACCTCTRL)) {
409 ret |= ldb_msg_add_fmt(msg, "userAccountControl",
410 "%d", ds_acb2uf(pdb_get_acct_ctrl(sam)));
411 }
412
413 if (update_required(sam, PDB_COMMENT)) {
414 ret |= ldb_msg_add_string(msg, "comment",
415 pdb_get_comment(sam));
416 }
417
418 if (update_required(sam, PDB_ACCTDESC)) {
419 ret |= ldb_msg_add_string(msg, "description",
420 pdb_get_acct_desc(sam));
421 }
422
423 if (update_required(sam, PDB_WORKSTATIONS)) {
424 ret |= ldb_msg_add_string(msg, "userWorkstations",
425 pdb_get_workstations(sam));
426 }
427
428 /* This will need work, it is actually a UTF8 'string' with internal NULLs, to handle TS parameters */
429 if (update_required(sam, PDB_MUNGEDDIAL)) {
430 ret |= ldb_msg_add_string(msg, "userParameters",
431 pdb_get_munged_dial(sam));
432 }
433
434 if (update_required(sam, PDB_COUNTRY_CODE)) {
435 ret |= ldb_msg_add_fmt(msg, "countryCode",
436 "%i", (int)pdb_get_country_code(sam));
437 }
438
439 if (update_required(sam, PDB_CODE_PAGE)) {
440 ret |= ldb_msg_add_fmt(msg, "codePage",
441 "%i", (int)pdb_get_code_page(sam));
442 }
443
444 /* Not yet handled here or not meaningful for modifies on a Samba4 backend:
445 PDB_LOGONTIME,
446 PDB_LOGOFFTIME,
447 PDB_BAD_PASSWORD_TIME,
448 PDB_CANCHANGETIME,
449 PDB_MUSTCHANGETIME,
450 PDB_DOMAIN,
451 PDB_NTUSERNAME,
452 PDB_LOGONDIVS,
453 PDB_USERSID,
454 PDB_GROUPSID,
455 PDB_PASSLASTSET,
456 PDB_FIELDS_PRESENT,
457 PDB_BAD_PASSWORD_COUNT,
458 PDB_LOGON_COUNT,
459 PDB_UNKNOWN6,
460 PDB_LMPASSWD,
461 PDB_NTPASSWD,
462 PDB_PWHISTORY,
463 PDB_BACKEND_PRIVATE_DATA,
464
465 */
466
467 *pmods = msg;
468 fail:
469 return ret == LDB_SUCCESS;
470 }
471
472 static NTSTATUS pdb_samba4_getsamupriv(struct pdb_samba4_state *state,
473 const char *filter,
474 TALLOC_CTX *mem_ctx,
475 struct ldb_message **msg)
476 {
477 const char * attrs[] = {
478 "lastLogon", "lastLogoff", "pwdLastSet", "accountExpires",
479 "sAMAccountName", "displayName", "homeDirectory",
480 "homeDrive", "scriptPath", "profilePath", "description",
481 "userWorkstations", "comment", "userParameters", "objectSid",
482 "primaryGroupID", "userAccountControl", "logonHours",
483 "badPwdCount", "logonCount", "countryCode", "codePage",
484 "unicodePwd", "dBCSPwd", NULL };
485
486 int rc = dsdb_search_one(state->ldb, mem_ctx, msg, NULL, LDB_SCOPE_SUBTREE, attrs, 0, "%s", filter);
487 if (rc != LDB_SUCCESS) {
488 DEBUG(10, ("ldap_search failed %s\n",
489 ldb_errstring(state->ldb)));
490 return NT_STATUS_LDAP(rc);
491 }
492
493 return NT_STATUS_OK;
494 }
495
496 static NTSTATUS pdb_samba4_getsampwfilter(struct pdb_methods *m,
497 struct pdb_samba4_state *state,
498 struct samu *sam_acct,
499 const char *exp_fmt, ...) _PRINTF_ATTRIBUTE(4, 5)
500 {
501 struct ldb_message *priv;
502 NTSTATUS status;
503 va_list ap;
504 char *expression = NULL;
505 TALLOC_CTX *tmp_ctx = talloc_new(state);
506 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
507
508 va_start(ap, exp_fmt);
509 expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
510 va_end(ap);
511
512 if (!expression) {
513 talloc_free(tmp_ctx);
514 return NT_STATUS_NO_MEMORY;
515 }
516
517 status = pdb_samba4_getsamupriv(state, expression, sam_acct, &priv);
518 talloc_free(tmp_ctx);
519 if (!NT_STATUS_IS_OK(status)) {
520 DEBUG(10, ("pdb_samba4_getsamupriv failed: %s\n",
521 nt_errstr(status)));
522 return status;
523 }
524
525 status = pdb_samba4_init_sam_from_priv(m, sam_acct, priv);
526 if (!NT_STATUS_IS_OK(status)) {
527 DEBUG(10, ("pdb_samba4_init_sam_from_priv failed: %s\n",
528 nt_errstr(status)));
529 TALLOC_FREE(priv);
530 return status;
531 }
532
533 pdb_set_backend_private_data(sam_acct, priv, NULL, m, PDB_SET);
534 return NT_STATUS_OK;
535 }
536
537 static NTSTATUS pdb_samba4_getsampwnam(struct pdb_methods *m,
538 struct samu *sam_acct,
539 const char *username)
540 {
541 struct pdb_samba4_state *state = talloc_get_type_abort(
542 m->private_data, struct pdb_samba4_state);
543
544 return pdb_samba4_getsampwfilter(m, state, sam_acct,
545 "(&(samaccountname=%s)(objectclass=user))",
546 username);
547 }
548
549 static NTSTATUS pdb_samba4_getsampwsid(struct pdb_methods *m,
550 struct samu *sam_acct,
551 const struct dom_sid *sid)
552 {
553 NTSTATUS status;
554 struct pdb_samba4_state *state = talloc_get_type_abort(
555 m->private_data, struct pdb_samba4_state);
556 char *sidstr;
557
558 sidstr = dom_sid_string(talloc_tos(), sid);
559 NT_STATUS_HAVE_NO_MEMORY(sidstr);
560
561 status = pdb_samba4_getsampwfilter(m, state, sam_acct,
562 "(&(objectsid=%s)(objectclass=user))",
563 sidstr);
564 talloc_free(sidstr);
565 return status;
566 }
567
568 static NTSTATUS pdb_samba4_create_user(struct pdb_methods *m,
569 TALLOC_CTX *mem_ctx,
570 const char *name, uint32 acct_flags,
571 uint32 *rid)
572 {
573 struct pdb_samba4_state *state = talloc_get_type_abort(
574 m->private_data, struct pdb_samba4_state);
575 struct dom_sid *sid;
576 struct ldb_dn *dn;
577 NTSTATUS status;
578 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
579 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
580
581 /* Internally this uses transactions to ensure all the steps
582 * happen or fail as one */
583 status = dsdb_add_user(state->ldb, tmp_ctx, name, acct_flags, &sid, &dn);
584 if (!NT_STATUS_IS_OK(status)) {
585 talloc_free(tmp_ctx);
586 return status;
587 }
588 sid_peek_rid(sid, rid);
589 talloc_free(tmp_ctx);
590 return NT_STATUS_OK;
591 }
592
593 static NTSTATUS pdb_samba4_delete_user(struct pdb_methods *m,
594 TALLOC_CTX *mem_ctx,
595 struct samu *sam)
596 {
597 struct pdb_samba4_state *state = talloc_get_type_abort(
598 m->private_data, struct pdb_samba4_state);
599 struct ldb_dn *dn;
600 int rc;
601 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
602 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
603
604 dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, pdb_get_user_sid(sam)));
605 if (!dn || !ldb_dn_validate(dn)) {
606 talloc_free(tmp_ctx);
607 return NT_STATUS_NO_MEMORY;
608 }
609 rc = ldb_delete(state->ldb, dn);
610
611 if (rc != LDB_SUCCESS) {
612 DEBUG(10, ("ldb_delete for %s failed: %s\n", ldb_dn_get_linearized(dn),
613 ldb_errstring(state->ldb)));
614 talloc_free(tmp_ctx);
615 return NT_STATUS_LDAP(rc);
616 }
617 talloc_free(tmp_ctx);
618 return NT_STATUS_OK;
619 }
620
621 /* This interface takes a fully populated struct samu and places it in
622 * the database. This is not implemented at this time as we need to
623 * be careful around the creation of arbitary SIDs (ie, we must ensrue
624 * they are not left in a RID pool */
625 static NTSTATUS pdb_samba4_add_sam_account(struct pdb_methods *m,
626 struct samu *sampass)
627 {
628 return NT_STATUS_NOT_IMPLEMENTED;
629 }
630
631 /*
632 * Update the Samba4 LDB with the changes from a struct samu.
633 *
634 * This takes care not to update elements that have not been changed
635 * by the caller
636 */
637 static NTSTATUS pdb_samba4_update_sam_account(struct pdb_methods *m,
638 struct samu *sam)
639 {
640 struct pdb_samba4_state *state = talloc_get_type_abort(
641 m->private_data, struct pdb_samba4_state);
642 struct ldb_message *msg = pdb_samba4_get_samu_private(
643 m, sam);
644 struct ldb_message *replace_msg;
645 int rc;
646
647 if (!pdb_samba4_init_samba4_from_sam(state, msg, talloc_tos(),
648 &replace_msg, sam)) {
649 return NT_STATUS_NO_MEMORY;
650 }
651
652 if (replace_msg->num_elements == 0) {
653 /* Nothing to do, just return success */
654 return NT_STATUS_OK;
655 }
656
657 rc = dsdb_replace(state->ldb, replace_msg, 0);
658 TALLOC_FREE(replace_msg);
659 if (rc != LDB_SUCCESS) {
660 DEBUG(10, ("dsdb_replace for %s failed: %s\n", ldb_dn_get_linearized(replace_msg->dn),
661 ldb_errstring(state->ldb)));
662 return NT_STATUS_LDAP(rc);
663 }
664
665 return NT_STATUS_OK;
666 }
667
668 static NTSTATUS pdb_samba4_delete_sam_account(struct pdb_methods *m,
669 struct samu *username)
670 {
671 NTSTATUS status;
672 TALLOC_CTX *tmp_ctx = talloc_new(NULL);
673 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
674 status = pdb_samba4_delete_user(m, tmp_ctx, username);
675 talloc_free(tmp_ctx);
676 return status;
677 }
678
679 static NTSTATUS pdb_samba4_rename_sam_account(struct pdb_methods *m,
680 struct samu *oldname,
681 const char *newname)
682 {
683 return NT_STATUS_NOT_IMPLEMENTED;
684 }
685
686 /* This is not implemented, as this module is exptected to be used
687 * with auth_samba4, and this is responible for login counters etc
688 *
689 */
690 static NTSTATUS pdb_samba4_update_login_attempts(struct pdb_methods *m,
691 struct samu *sam_acct,
692 bool success)
693 {
694 return NT_STATUS_NOT_IMPLEMENTED;
695 }
696
697 static NTSTATUS pdb_samba4_getgrfilter(struct pdb_methods *m, GROUP_MAP *map,
698 const char *exp_fmt, ...) _PRINTF_ATTRIBUTE(4, 5)
699 {
700 struct pdb_samba4_state *state = talloc_get_type_abort(
701 m->private_data, struct pdb_samba4_state);
702 const char *attrs[] = { "objectSid", "description", "samAccountName",
703 NULL };
704 struct ldb_message *msg;
705 va_list ap;
706 char *expression = NULL;
707 struct dom_sid *sid;
708 const char *str;
709 int rc;
710 union unid_t id;
711 TALLOC_CTX *tmp_ctx = talloc_stackframe();
712 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
713
714 va_start(ap, exp_fmt);
715 expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
716 va_end(ap);
717
718 if (!expression) {
719 talloc_free(tmp_ctx);
720 return NT_STATUS_NO_MEMORY;
721 }
722
723 rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, NULL, LDB_SCOPE_SUBTREE, attrs, 0, "%s", expression);
724 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
725 talloc_free(tmp_ctx);
726 return NT_STATUS_NO_SUCH_GROUP;
727 } else if (rc != LDB_SUCCESS) {
728 talloc_free(tmp_ctx);
729 DEBUG(10, ("dsdb_search_one failed %s\n",
730 ldb_errstring(state->ldb)));
731 return NT_STATUS_LDAP(rc);
732 }
733
734 sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
735 if (!sid) {
736 talloc_free(tmp_ctx);
737 DEBUG(10, ("Could not pull SID\n"));
738 return NT_STATUS_INTERNAL_DB_CORRUPTION;
739 }
740
741 map->sid = *sid;
742
743 if (!pdb_samba4_sid_to_id(m, sid, &id, &map->sid_name_use)) {
744 talloc_free(tmp_ctx);
745 return NT_STATUS_NO_SUCH_GROUP;
746 }
747 if (map->sid_name_use == SID_NAME_USER) {
748 DEBUG(1, (__location__ "Got SID_NAME_USER when searching for a group with %s", expression));
749 return NT_STATUS_INTERNAL_DB_CORRUPTION;
750 }
751 map->gid = id.gid;
752
753 str = ldb_msg_find_attr_as_string(msg, "samAccountName",
754 NULL);
755 if (str == NULL) {
756 talloc_free(tmp_ctx);
757 return NT_STATUS_INTERNAL_DB_CORRUPTION;
758 }
759 fstrcpy(map->nt_name, str);
760
761 str = ldb_msg_find_attr_as_string(msg, "description",
762 NULL);
763 if (str != NULL) {
764 fstrcpy(map->comment, str);
765 } else {
766 map->comment[0] = '\0';
767 }
768
769 talloc_free(tmp_ctx);
770 return NT_STATUS_OK;
771 }
772
773 static NTSTATUS pdb_samba4_getgrsid(struct pdb_methods *m, GROUP_MAP *map,
774 struct dom_sid sid)
775 {
776 char *filter;
777 NTSTATUS status;
778
779 filter = talloc_asprintf(talloc_tos(),
780 "(&(objectsid=%s)(objectclass=group))",
781 sid_string_talloc(talloc_tos(), &sid));
782 if (filter == NULL) {
783 return NT_STATUS_NO_MEMORY;
784 }
785
786 status = pdb_samba4_getgrfilter(m, map, filter);
787 TALLOC_FREE(filter);
788 return status;
789 }
790
791 static NTSTATUS pdb_samba4_getgrgid(struct pdb_methods *m, GROUP_MAP *map,
792 gid_t gid)
793 {
794 struct pdb_samba4_state *state = talloc_get_type_abort(
795 m->private_data, struct pdb_samba4_state);
796 NTSTATUS status;
797 struct id_map id_map;
798 struct id_map *id_maps[2];
799 TALLOC_CTX *tmp_ctx = talloc_stackframe();
800 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
801
802 id_map.xid.id = gid;
803 id_map.xid.type = ID_TYPE_GID;
804 id_maps[0] = &id_map;
805 id_maps[1] = NULL;
806
807 status = idmap_xids_to_sids(state->idmap_ctx, tmp_ctx, id_maps);
808 if (!NT_STATUS_IS_OK(status)) {
809 return status;
810 }
811 status = pdb_samba4_getgrsid(m, map, *id_map.sid);
812 talloc_free(tmp_ctx);
813 return status;
814 }
815
816 static NTSTATUS pdb_samba4_getgrnam(struct pdb_methods *m, GROUP_MAP *map,
817 const char *name)
818 {
819 char *filter;
820 NTSTATUS status;
821
822 filter = talloc_asprintf(talloc_tos(),
823 "(&(samaccountname=%s)(objectclass=group))",
824 name);
825 if (filter == NULL) {
826 return NT_STATUS_NO_MEMORY;
827 }
828
829 status = pdb_samba4_getgrfilter(m, map, filter);
830 TALLOC_FREE(filter);
831 return status;
832 }
833
834 static NTSTATUS pdb_samba4_create_dom_group(struct pdb_methods *m,
835 TALLOC_CTX *mem_ctx, const char *name,
836 uint32 *rid)
837 {
838 struct pdb_samba4_state *state = talloc_get_type_abort(
839 m->private_data, struct pdb_samba4_state);
840 NTSTATUS status;
841 struct dom_sid *sid;
842 struct ldb_dn *dn;
843 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
844 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
845
846 status = dsdb_add_domain_group(state->ldb, tmp_ctx, name, &sid, &dn);
847 if (!NT_STATUS_IS_OK(status)) {
848 talloc_free(tmp_ctx);
849 return status;
850 }
851
852 sid_peek_rid(sid, rid);
853 talloc_free(tmp_ctx);
854 return NT_STATUS_OK;
855 }
856
857 static NTSTATUS pdb_samba4_delete_dom_group(struct pdb_methods *m,
858 TALLOC_CTX *mem_ctx, uint32 rid)
859 {
860 const char *attrs[] = { NULL };
861 struct pdb_samba4_state *state = talloc_get_type_abort(
862 m->private_data, struct pdb_samba4_state);
863 struct dom_sid sid;
864 struct ldb_message *msg;
865 struct ldb_dn *dn;
866 int rc;
867 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
868 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
869
870 sid_compose(&sid, samdb_domain_sid(state->ldb), rid);
871
872 if (ldb_transaction_start(state->ldb) != LDB_SUCCESS) {
873 DEBUG(0, ("Unable to start transaction in pdb_samba4_delete_dom_group()\n"));
874 return NT_STATUS_INTERNAL_ERROR;
875 }
876
877 dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, &sid));
878 if (!dn || !ldb_dn_validate(dn)) {
879 talloc_free(tmp_ctx);
880 ldb_transaction_cancel(state->ldb);
881 return NT_STATUS_NO_MEMORY;
882 }
883 rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "objectclass=group");
884 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
885 talloc_free(tmp_ctx);
886 ldb_transaction_cancel(state->ldb);
887 return NT_STATUS_NO_SUCH_GROUP;
888 }
889 rc = ldb_delete(state->ldb, dn);
890 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
891 talloc_free(tmp_ctx);
892 ldb_transaction_cancel(state->ldb);
893 return NT_STATUS_NO_SUCH_GROUP;
894 } else if (rc != LDB_SUCCESS) {
895 DEBUG(10, ("ldb_delete failed %s\n",
896 ldb_errstring(state->ldb)));
897 ldb_transaction_cancel(state->ldb);
898 return NT_STATUS_LDAP(rc);
899 }
900
901 if (ldb_transaction_commit(state->ldb) != LDB_SUCCESS) {
902 DEBUG(0, ("Unable to commit transaction in pdb_samba4_delete_dom_group()\n"));
903 return NT_STATUS_INTERNAL_ERROR;
904 }
905 return NT_STATUS_OK;
906 }
907
908 static NTSTATUS pdb_samba4_add_group_mapping_entry(struct pdb_methods *m,
909 GROUP_MAP *map)
910 {
911 return NT_STATUS_NOT_IMPLEMENTED;
912 }
913
914 static NTSTATUS pdb_samba4_update_group_mapping_entry(struct pdb_methods *m,
915 GROUP_MAP *map)
916 {
917 return NT_STATUS_NOT_IMPLEMENTED;
918 }
919
920 static NTSTATUS pdb_samba4_delete_group_mapping_entry(struct pdb_methods *m,
921 struct dom_sid sid)
922 {
923 return NT_STATUS_NOT_IMPLEMENTED;
924 }
925
926 static NTSTATUS pdb_samba4_enum_group_mapping(struct pdb_methods *m,
927 const struct dom_sid *sid,
928 enum lsa_SidType sid_name_use,
929 GROUP_MAP **pp_rmap,
930 size_t *p_num_entries,
931 bool unix_only)
932 {
933 return NT_STATUS_NOT_IMPLEMENTED;
934 }
935
936 static NTSTATUS pdb_samba4_enum_group_members(struct pdb_methods *m,
937 TALLOC_CTX *mem_ctx,
938 const struct dom_sid *group,
939 uint32_t **pmembers,
940 size_t *pnum_members)
941 {
942 unsigned int i, num_sids, num_members;
943 struct pdb_samba4_state *state = talloc_get_type_abort(
944 m->private_data, struct pdb_samba4_state);
945 struct dom_sid *members_as_sids;
946 struct dom_sid *dom_sid;
947 uint32_t *members;
948 struct ldb_dn *dn;
949 NTSTATUS status;
950
951 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
952 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
953
954 dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, group));
955 if (!dn || !ldb_dn_validate(dn)) {
956 return NT_STATUS_NO_MEMORY;
957 }
958
959 status = dsdb_enum_group_mem(state->ldb, tmp_ctx, dn, &members_as_sids, &num_sids);
960 if (!NT_STATUS_IS_OK(status)) {
961 talloc_free(tmp_ctx);
962 return status;
963 }
964 status = dom_sid_split_rid(tmp_ctx, group, &dom_sid, NULL);
965 if (!NT_STATUS_IS_OK(status)) {
966 talloc_free(tmp_ctx);
967 return status;
968 }
969
970 *pmembers = members = talloc_array(mem_ctx, uint32_t, num_sids);
971 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(*pmembers, tmp_ctx);
972 num_members = 0;
973
974 for (i = 0; i < num_sids; i++) {
975 if (!dom_sid_in_domain(dom_sid, &members_as_sids[i])) {
976 continue;
977 }
978 status = dom_sid_split_rid(NULL, &members_as_sids[i],
979 NULL, &members[num_members]);
980 if (!NT_STATUS_IS_OK(status)) {
981 talloc_free(tmp_ctx);
982 return status;
983 }
984 num_members++;
985 }
986 *pnum_members = num_members;
987 return NT_STATUS_OK;
988 }
989
990 /* Just convert the primary group SID into a group */
991 static NTSTATUS fake_enum_group_memberships(struct pdb_samba4_state *state,
992 TALLOC_CTX *mem_ctx,
993 struct samu *user,
994 struct dom_sid **pp_sids,
995 gid_t **pp_gids,
996 uint32_t *p_num_groups)
997 {
998 NTSTATUS status;
999 size_t num_groups = 0;
1000 struct dom_sid *group_sids;
1001 gid_t *gids;
1002 TALLOC_CTX *tmp_ctx;
1003
1004 tmp_ctx = talloc_new(mem_ctx);
1005 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1006
1007 if (user->group_sid) {
1008 struct id_map *id_maps[2];
1009 struct id_map id_map;
1010
1011 num_groups = 1;
1012
1013 group_sids = talloc_array(tmp_ctx, struct dom_sid, num_groups);
1014 if (group_sids == NULL) {
1015 talloc_free(tmp_ctx);
1016 return NT_STATUS_NO_MEMORY;
1017 }
1018 gids = talloc_array(tmp_ctx, gid_t, num_groups);
1019 if (gids == NULL) {
1020 talloc_free(tmp_ctx);
1021 return NT_STATUS_NO_MEMORY;
1022 }
1023
1024 group_sids[0] = *user->group_sid;
1025
1026 ZERO_STRUCT(id_map);
1027 id_map.sid = &group_sids[0];
1028 id_maps[0] = &id_map;
1029 id_maps[1] = NULL;
1030
1031 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
1032 if (!NT_STATUS_IS_OK(status)) {
1033 talloc_free(tmp_ctx);
1034 return status;
1035 }
1036 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
1037 gids[0] = id_map.xid.id;
1038 } else {
1039 DEBUG(1, (__location__
1040 "Group %s, of which %s is a member, could not be converted to a GID\n",
1041 dom_sid_string(tmp_ctx, &group_sids[0]),
1042 dom_sid_string(tmp_ctx, &user->user_sid)));
1043 talloc_free(tmp_ctx);
1044 /* We must error out, otherwise a user might
1045 * avoid a DENY acl based on a group they
1046 * missed out on */
1047 return NT_STATUS_NO_SUCH_GROUP;
1048 }
1049 }
1050
1051 *pp_sids = talloc_steal(mem_ctx, group_sids);
1052 *pp_gids = talloc_steal(mem_ctx, gids);
1053 *p_num_groups = num_groups;
1054 talloc_free(tmp_ctx);
1055 return NT_STATUS_OK;
1056 }
1057
1058 static NTSTATUS pdb_samba4_enum_group_memberships(struct pdb_methods *m,
1059 TALLOC_CTX *mem_ctx,
1060 struct samu *user,
1061 struct dom_sid **pp_sids,
1062 gid_t **pp_gids,
1063 uint32_t *p_num_groups)
1064 {
1065 struct pdb_samba4_state *state = talloc_get_type_abort(
1066 m->private_data, struct pdb_samba4_state);
1067 struct ldb_message *msg = pdb_samba4_get_samu_private(
1068 m, user);
1069 const char *attrs[] = { "tokenGroups", NULL};
1070 struct ldb_message *tokengroups_msg;
1071 struct ldb_message_element *tokengroups;
1072 int i, rc;
1073 NTSTATUS status;
1074 unsigned int count = 0;
1075 size_t num_groups;
1076 struct dom_sid *group_sids;
1077 gid_t *gids;
1078 TALLOC_CTX *tmp_ctx;
1079
1080 if (msg == NULL) {
1081 /* Fake up some things here */
1082 return fake_enum_group_memberships(state,
1083 mem_ctx,
1084 user, pp_sids,
1085 pp_gids, p_num_groups);
1086 }
1087
1088 tmp_ctx = talloc_new(mem_ctx);
1089 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1090
1091 rc = dsdb_search_one(state->ldb, tmp_ctx, &tokengroups_msg, msg->dn, LDB_SCOPE_BASE, attrs, 0, NULL);
1092
1093 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1094 talloc_free(tmp_ctx);
1095 return NT_STATUS_NO_SUCH_USER;
1096 } else if (rc != LDB_SUCCESS) {
1097 DEBUG(10, ("dsdb_search_one failed %s\n",
1098 ldb_errstring(state->ldb)));
1099 talloc_free(tmp_ctx);
1100 return NT_STATUS_LDAP(rc);
1101 }
1102
1103 tokengroups = ldb_msg_find_element(tokengroups_msg, "tokenGroups");
1104
1105 if (tokengroups) {
1106 count = tokengroups->num_values;
1107 }
1108
1109 group_sids = talloc_array(tmp_ctx, struct dom_sid, count);
1110 if (group_sids == NULL) {
1111 talloc_free(tmp_ctx);
1112 return NT_STATUS_NO_MEMORY;
1113 }
1114 gids = talloc_array(tmp_ctx, gid_t, count);
1115 if (gids == NULL) {
1116 talloc_free(tmp_ctx);
1117 return NT_STATUS_NO_MEMORY;
1118 }
1119 num_groups = 0;
1120
1121 for (i=0; i<count; i++) {
1122 struct id_map *id_maps[2];
1123 struct id_map id_map;
1124 struct ldb_val *v = &tokengroups->values[i];
1125 enum ndr_err_code ndr_err
1126 = ndr_pull_struct_blob(v, group_sids, &group_sids[num_groups],
1127 (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
1128 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1129 talloc_free(tmp_ctx);
1130 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1131 }
1132
1133 ZERO_STRUCT(id_map);
1134 id_map.sid = &group_sids[num_groups];
1135 id_maps[0] = &id_map;
1136 id_maps[1] = NULL;
1137
1138 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
1139 if (!NT_STATUS_IS_OK(status)) {
1140 talloc_free(tmp_ctx);
1141 return status;
1142 }
1143 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
1144 gids[num_groups] = id_map.xid.id;
1145 } else {
1146 DEBUG(1, (__location__
1147 "Group %s, of which %s is a member, could not be converted to a GID\n",
1148 dom_sid_string(tmp_ctx, &group_sids[num_groups]),
1149 ldb_dn_get_linearized(msg->dn)));
1150 talloc_free(tmp_ctx);
1151 /* We must error out, otherwise a user might
1152 * avoid a DENY acl based on a group they
1153 * missed out on */
1154 return NT_STATUS_NO_SUCH_GROUP;
1155 }
1156
1157 num_groups += 1;
1158 if (num_groups == count) {
1159 break;
1160 }
1161 }
1162
1163 *pp_sids = talloc_steal(mem_ctx, group_sids);
1164 *pp_gids = talloc_steal(mem_ctx, gids);
1165 *p_num_groups = num_groups;
1166 talloc_free(tmp_ctx);
1167 return NT_STATUS_OK;
1168 }
1169
1170 static NTSTATUS pdb_samba4_set_unix_primary_group(struct pdb_methods *m,
1171 TALLOC_CTX *mem_ctx,
1172 struct samu *user)
1173 {
1174 return NT_STATUS_NOT_IMPLEMENTED;
1175 }
1176
1177 static NTSTATUS pdb_samba4_mod_groupmem_by_sid(struct pdb_methods *m,
1178 TALLOC_CTX *mem_ctx,
1179 const struct dom_sid *groupsid,
1180 const struct dom_sid *membersid,
1181 int mod_op)
1182 {
1183 struct pdb_samba4_state *state = talloc_get_type_abort(
1184 m->private_data, struct pdb_samba4_state);
1185 struct ldb_message *msg;
1186 int ret;
1187 struct ldb_message_element *el;
1188 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1189 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1190 msg = ldb_msg_new(tmp_ctx);
1191 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg, tmp_ctx);
1192
1193 msg->dn = ldb_dn_new_fmt(msg, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, groupsid));
1194 if (!msg->dn || !ldb_dn_validate(msg->dn)) {
1195 talloc_free(tmp_ctx);
1196 return NT_STATUS_NO_MEMORY;
1197 }
1198 ret = ldb_msg_add_fmt(msg, "member", "<SID=%s>", dom_sid_string(tmp_ctx, membersid));
1199 if (ret != LDB_SUCCESS) {
1200 talloc_free(tmp_ctx);
1201 return NT_STATUS_NO_MEMORY;
1202 }
1203 el = ldb_msg_find_element(msg, "member");
1204 el->flags = mod_op;
1205
1206 /* No need for transactions here, the ldb auto-transaction
1207 * code will handle things for the single operation */
1208 ret = ldb_modify(state->ldb, msg);
1209 talloc_free(tmp_ctx);
1210 if (ret != LDB_SUCCESS) {
1211 DEBUG(10, ("ldb_modify failed: %s\n",
1212 ldb_errstring(state->ldb)));
1213 if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1214 return NT_STATUS_MEMBER_IN_GROUP;
1215 }
1216 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
1217 return NT_STATUS_MEMBER_NOT_IN_GROUP;
1218 }
1219 return NT_STATUS_LDAP(ret);
1220 }
1221
1222 return NT_STATUS_OK;
1223 }
1224
1225 static NTSTATUS pdb_samba4_mod_groupmem(struct pdb_methods *m,
1226 TALLOC_CTX *mem_ctx,
1227 uint32 grouprid, uint32 memberrid,
1228 int mod_op)
1229 {
1230 struct pdb_samba4_state *state = talloc_get_type_abort(
1231 m->private_data, struct pdb_samba4_state);
1232 const struct dom_sid *dom_sid, *groupsid, *membersid;
1233 NTSTATUS status;
1234 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1235 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1236
1237 dom_sid = samdb_domain_sid(state->ldb);
1238
1239 groupsid = dom_sid_add_rid(tmp_ctx, dom_sid, grouprid);
1240 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(groupsid, tmp_ctx);
1241 membersid = dom_sid_add_rid(tmp_ctx, dom_sid, memberrid);
1242 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(membersid, tmp_ctx);
1243 status = pdb_samba4_mod_groupmem_by_sid(m, tmp_ctx, groupsid, membersid, mod_op);
1244 talloc_free(tmp_ctx);
1245 return status;
1246 }
1247
1248 static NTSTATUS pdb_samba4_add_groupmem(struct pdb_methods *m,
1249 TALLOC_CTX *mem_ctx,
1250 uint32 group_rid, uint32 member_rid)
1251 {
1252 return pdb_samba4_mod_groupmem(m, mem_ctx, group_rid, member_rid,
1253 LDB_FLAG_MOD_ADD);
1254 }
1255
1256 static NTSTATUS pdb_samba4_del_groupmem(struct pdb_methods *m,
1257 TALLOC_CTX *mem_ctx,
1258 uint32 group_rid, uint32 member_rid)
1259 {
1260 return pdb_samba4_mod_groupmem(m, mem_ctx, group_rid, member_rid,
1261 LDB_FLAG_MOD_DELETE);
1262 }
1263
1264 static NTSTATUS pdb_samba4_create_alias(struct pdb_methods *m,
1265 const char *name, uint32 *rid)
1266 {
1267 TALLOC_CTX *frame = talloc_stackframe();
1268 struct pdb_samba4_state *state = talloc_get_type_abort(
1269 m->private_data, struct pdb_samba4_state);
1270 struct dom_sid *sid;
1271
1272 struct ldb_dn *dn;
1273 NTSTATUS status;
1274
1275 /* Internally this uses transactions to ensure all the steps
1276 * happen or fail as one */
1277 status = dsdb_add_domain_alias(state->ldb, frame, name, &sid, &dn);
1278 if (!NT_STATUS_IS_OK(status)) {
1279 TALLOC_FREE(frame);
1280 }
1281
1282 sid_peek_rid(sid, rid);
1283 TALLOC_FREE(frame);
1284 return NT_STATUS_OK;
1285 }
1286
1287 static NTSTATUS pdb_samba4_delete_alias(struct pdb_methods *m,
1288 const struct dom_sid *sid)
1289 {
1290 const char *attrs[] = { NULL };
1291 struct pdb_samba4_state *state = talloc_get_type_abort(
1292 m->private_data, struct pdb_samba4_state);
1293 struct ldb_message *msg;
1294 struct ldb_dn *dn;
1295 int rc;
1296 TALLOC_CTX *tmp_ctx = talloc_stackframe();
1297 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1298
1299 dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, sid));
1300 if (!dn || !ldb_dn_validate(dn)) {
1301 talloc_free(tmp_ctx);
1302 return NT_STATUS_NO_MEMORY;
1303 }
1304
1305 if (ldb_transaction_start(state->ldb) != LDB_SUCCESS) {
1306 DEBUG(0, ("Failed to start transaction in dsdb_add_domain_alias(): %s\n", ldb_errstring(state->ldb)));
1307 return NT_STATUS_INTERNAL_ERROR;
1308 }
1309
1310 rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "(objectclass=group)"
1311 "(|(grouptype=%d)(grouptype=%d)))",
1312 GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
1313 GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1314 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1315 talloc_free(tmp_ctx);
1316 ldb_transaction_cancel(state->ldb);
1317 return NT_STATUS_NO_SUCH_ALIAS;
1318 }
1319 rc = ldb_delete(state->ldb, dn);
1320 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1321 talloc_free(tmp_ctx);
1322 ldb_transaction_cancel(state->ldb);
1323 return NT_STATUS_NO_SUCH_ALIAS;
1324 } else if (rc != LDB_SUCCESS) {
1325 DEBUG(10, ("ldb_delete failed %s\n",
1326 ldb_errstring(state->ldb)));
1327 ldb_transaction_cancel(state->ldb);
1328 return NT_STATUS_LDAP(rc);
1329 }
1330
1331 if (ldb_transaction_commit(state->ldb) != LDB_SUCCESS) {
1332 DEBUG(0, ("Failed to commit transaction in pdb_samba4_delete_alias(): %s\n",
1333 ldb_errstring(state->ldb)));
1334 return NT_STATUS_INTERNAL_ERROR;
1335 }
1336
1337 return NT_STATUS_OK;
1338 }
1339
1340 #if 0
1341 static NTSTATUS pdb_samba4_set_aliasinfo(struct pdb_methods *m,
1342 const struct dom_sid *sid,
1343 struct acct_info *info)
1344 {
1345 struct pdb_samba4_state *state = talloc_get_type_abort(
1346 m->private_data, struct pdb_samba4_state);
1347 struct tldap_context *ld;
1348 const char *attrs[3] = { "objectSid", "description",
1349 "samAccountName" };
1350 struct ldb_message **msg;
1351 char *sidstr, *dn;
1352 int rc;
1353 struct tldap_mod *mods;
1354 int num_mods;
1355 bool ok;
1356
1357 ld = pdb_samba4_ld(state);
1358 if (ld == NULL) {
1359 return NT_STATUS_LDAP(TLDAP_SERVER_DOWN);
1360 }
1361
1362 sidstr = sid_binstring(talloc_tos(), sid);
1363 NT_STATUS_HAVE_NO_MEMORY(sidstr);
1364
1365 rc = pdb_samba4_search_fmt(state, state->domaindn, TLDAP_SCOPE_SUB,
1366 attrs, ARRAY_SIZE(attrs), 0, talloc_tos(),
1367 &msg, "(&(objectSid=%s)(objectclass=group)"
1368 "(|(grouptype=%d)(grouptype=%d)))",
1369 sidstr, GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
1370 GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1371 TALLOC_FREE(sidstr)
1372 if (rc != LDB_SUCCESS) {
1373 DEBUG(10, ("ldap_search failed %s\n",
1374 ldb_errstring(state->ldb)));
1375 return NT_STATUS_LDAP(rc);
1376 }
1377 switch talloc_array_length(msg) {
1378 case 0:
1379 return NT_STATUS_NO_SUCH_ALIAS;
1380 case 1:
1381 break;
1382 default:
1383 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1384 }
1385
1386 if (!tldap_entry_dn(msg[0], &dn)) {
1387 TALLOC_FREE(msg);
1388 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1389 }
1390
1391 mods = NULL;
1392 num_mods = 0;
1393 ok = true;
1394
1395 ok &= tldap_make_mod_fmt(
1396 msg[0], msg, &num_mods, &mods, "description",
1397 "%s", info->acct_desc);
1398 ok &= tldap_make_mod_fmt(
1399 msg[0], msg, &num_mods, &mods, "samAccountName",
1400 "%s", info->acct_name);
1401 if (!ok) {
1402 TALLOC_FREE(msg);
1403 return NT_STATUS_NO_MEMORY;
1404 }
1405 if (num_mods == 0) {
1406 /* no change */
1407 TALLOC_FREE(msg);
1408 return NT_STATUS_OK;
1409 }
1410
1411 rc = tldap_modify(ld, dn, num_mods, mods, NULL, 0, NULL, 0);
1412 TALLOC_FREE(msg);
1413 if (rc != LDB_SUCCESS) {
1414 DEBUG(10, ("ldap_modify failed: %s\n",
1415 ldb_errstring(state->ldb)));
1416 return NT_STATUS_LDAP(rc);
1417 }
1418 return NT_STATUS_OK;
1419 }
1420 #endif
1421 static NTSTATUS pdb_samba4_add_aliasmem(struct pdb_methods *m,
1422 const struct dom_sid *alias,
1423 const struct dom_sid *member)
1424 {
1425 NTSTATUS status;
1426 TALLOC_CTX *frame = talloc_stackframe();
1427 status = pdb_samba4_mod_groupmem_by_sid(m, frame, alias, member, LDB_FLAG_MOD_ADD);
1428 talloc_free(frame);
1429 return status;
1430 }
1431
1432 static NTSTATUS pdb_samba4_del_aliasmem(struct pdb_methods *m,
1433 const struct dom_sid *alias,
1434 const struct dom_sid *member)
1435 {
1436 NTSTATUS status;
1437 TALLOC_CTX *frame = talloc_stackframe();
1438 status = pdb_samba4_mod_groupmem_by_sid(m, frame, alias, member, LDB_FLAG_MOD_DELETE);
1439 talloc_free(frame);
1440 return status;
1441 }
1442
1443 static NTSTATUS pdb_samba4_enum_aliasmem(struct pdb_methods *m,
1444 const struct dom_sid *alias,
1445 TALLOC_CTX *mem_ctx,
1446 struct dom_sid **pmembers,
1447 size_t *pnum_members)
1448 {
1449 struct pdb_samba4_state *state = talloc_get_type_abort(
1450 m->private_data, struct pdb_samba4_state);
1451 struct ldb_dn *dn;
1452 unsigned int num_members;
1453 NTSTATUS status;
1454 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1455 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1456
1457 dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, alias));
1458 if (!dn || !ldb_dn_validate(dn)) {
1459 return NT_STATUS_NO_MEMORY;
1460 }
1461
1462 status = dsdb_enum_group_mem(state->ldb, mem_ctx, dn, pmembers, &num_members);
1463 *pnum_members = num_members;
1464 if (NT_STATUS_IS_OK(status)) {
1465 talloc_steal(mem_ctx, pmembers);
1466 }
1467 talloc_free(tmp_ctx);
1468 return status;
1469 }
1470
1471 static NTSTATUS pdb_samba4_enum_alias_memberships(struct pdb_methods *m,
1472 TALLOC_CTX *mem_ctx,
1473 const struct dom_sid *domain_sid,
1474 const struct dom_sid *members,
1475 size_t num_members,
1476 uint32_t **palias_rids,
1477 size_t *pnum_alias_rids)
1478 {
1479 struct pdb_samba4_state *state = talloc_get_type_abort(
1480 m->private_data, struct pdb_samba4_state);
1481 uint32_t *alias_rids = NULL;
1482 size_t num_alias_rids = 0;
1483 int i;
1484 struct dom_sid *groupSIDs = NULL;
1485 unsigned int num_groupSIDs = 0;
1486 char *filter;
1487 NTSTATUS status;
1488 const char *sid_string;
1489 const char *sid_dn;
1490 DATA_BLOB sid_blob;
1491
1492 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1493 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1494 /*
1495 * TODO: Get the filter right so that we only get the aliases from
1496 * either the SAM or BUILTIN
1497 */
1498
1499 filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:1.2.840.113556.1.4.803:=%u))",
1500 GROUP_TYPE_BUILTIN_LOCAL_GROUP);
1501 if (filter == NULL) {
1502 return NT_STATUS_NO_MEMORY;
1503 }
1504
1505 for (i = 0; i < num_members; i++) {
1506 sid_string = dom_sid_string(tmp_ctx, &members[i]);
1507 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sid_string, tmp_ctx);
1508
1509 sid_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", sid_string);
1510 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sid_dn, tmp_ctx);
1511
1512 sid_blob = data_blob_string_const(sid_dn);
1513
1514 status = dsdb_expand_nested_groups(state->ldb, &sid_blob, true, filter,
1515 tmp_ctx, &groupSIDs, &num_groupSIDs);
1516 if (!NT_STATUS_IS_OK(status)) {
1517 talloc_free(tmp_ctx);
1518 return status;
1519 }
1520 }
1521
1522 alias_rids = talloc_array(mem_ctx, uint32_t, num_groupSIDs);
1523 if (alias_rids == NULL) {
1524 talloc_free(tmp_ctx);
1525 return NT_STATUS_NO_MEMORY;
1526 }
1527
1528 for (i=0; i<num_groupSIDs; i++) {
1529 if (sid_peek_check_rid(domain_sid, &groupSIDs[i],
1530 &alias_rids[num_alias_rids])) {
1531 num_alias_rids++;;
1532 }
1533 }
1534
1535 *palias_rids = alias_rids;
1536 *pnum_alias_rids = num_alias_rids;
1537 return NT_STATUS_OK;
1538 }
1539
1540 static NTSTATUS pdb_samba4_lookup_rids(struct pdb_methods *m,
1541 const struct dom_sid *domain_sid,
1542 int num_rids,
1543 uint32 *rids,
1544 const char **names,
1545 enum lsa_SidType *lsa_attrs)
1546 {
1547 struct pdb_samba4_state *state = talloc_get_type_abort(
1548 m->private_data, struct pdb_samba4_state);
1549 NTSTATUS status;
1550
1551 TALLOC_CTX *tmp_ctx;
1552
1553 if (num_rids == 0) {
1554 return NT_STATUS_NONE_MAPPED;
1555 }
1556
1557 tmp_ctx = talloc_stackframe();
1558 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1559
1560 status = dsdb_lookup_rids(state->ldb, tmp_ctx, domain_sid, num_rids, rids, names, lsa_attrs);
1561 talloc_free(tmp_ctx);
1562 return status;
1563 }
1564
1565 static NTSTATUS pdb_samba4_lookup_names(struct pdb_methods *m,
1566 const struct dom_sid *domain_sid,
1567 int num_names,
1568 const char **pp_names,
1569 uint32 *rids,
1570 enum lsa_SidType *attrs)
1571 {
1572 return NT_STATUS_NOT_IMPLEMENTED;
1573 }
1574
1575 static NTSTATUS pdb_samba4_get_account_policy(struct pdb_methods *m,
1576 enum pdb_policy_type type,
1577 uint32_t *value)
1578 {
1579 return account_policy_get(type, value)
1580 ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1581 }
1582
1583 static NTSTATUS pdb_samba4_set_account_policy(struct pdb_methods *m,
1584 enum pdb_policy_type type,
1585 uint32_t value)
1586 {
1587 return account_policy_set(type, value)
1588 ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1589 }
1590
1591 static NTSTATUS pdb_samba4_get_seq_num(struct pdb_methods *m,
1592 time_t *seq_num_out)
1593 {
1594 struct pdb_samba4_state *state = talloc_get_type_abort(
1595 m->private_data, struct pdb_samba4_state);
1596 uint64_t seq_num;
1597 int ret = ldb_sequence_number(state->ldb, LDB_SEQ_HIGHEST_SEQ, &seq_num);
1598 if (ret == LDB_SUCCESS) {
1599 *seq_num_out = seq_num;
1600 return NT_STATUS_OK;
1601 } else {
1602 return NT_STATUS_UNSUCCESSFUL;
1603 }
1604 }
1605
1606 struct pdb_samba4_search_state {
1607 uint32_t acct_flags;
1608 struct samr_displayentry *entries;
1609 uint32_t num_entries;
1610 ssize_t array_size;
1611 uint32_t current;
1612 };
1613
1614 static bool pdb_samba4_next_entry(struct pdb_search *search,
1615 struct samr_displayentry *entry)
1616 {
1617 struct pdb_samba4_search_state *state = talloc_get_type_abort(
1618 search->private_data, struct pdb_samba4_search_state);
1619
1620 if (state->current == state->num_entries) {
1621 return false;
1622 }
1623
1624 entry->idx = state->entries[state->current].idx;
1625 entry->rid = state->entries[state->current].rid;
1626 entry->acct_flags = state->entries[state->current].acct_flags;
1627
1628 entry->account_name = talloc_strdup(
1629 search, state->entries[state->current].account_name);
1630 entry->fullname = talloc_strdup(
1631 search, state->entries[state->current].fullname);
1632 entry->description = talloc_strdup(
1633 search, state->entries[state->current].description);
1634
1635 state->current += 1;
1636 return true;
1637 }
1638
1639 static void pdb_samba4_search_end(struct pdb_search *search)
1640 {
1641 struct pdb_samba4_search_state *state = talloc_get_type_abort(
1642 search->private_data, struct pdb_samba4_search_state);
1643 talloc_free(state);
1644 }
1645
1646 static bool pdb_samba4_search_filter(struct pdb_methods *m,
1647 struct pdb_search *search,
1648 struct pdb_samba4_search_state **pstate,
1649 const char *exp_fmt, ...) _PRINTF_ATTRIBUTE(4, 5)
1650 {
1651 struct pdb_samba4_state *state = talloc_get_type_abort(
1652 m->private_data, struct pdb_samba4_state);
1653 struct pdb_samba4_search_state *sstate;
1654 const char * attrs[] = { "objectSid", "sAMAccountName", "displayName",
1655 "userAccountControl", "description", NULL };
1656 struct ldb_result *res;
1657 int i, rc, num_users;
1658
1659 va_list ap;
1660 char *expression = NULL;
1661
1662 TALLOC_CTX *tmp_ctx = talloc_stackframe();
1663 if (!tmp_ctx) {
1664 return false;
1665 }
1666
1667 va_start(ap, exp_fmt);
1668 expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
1669 va_end(ap);
1670
1671 if (!expression) {
1672 talloc_free(tmp_ctx);
1673 return LDB_ERR_OPERATIONS_ERROR;
1674 }
1675
1676 sstate = talloc_zero(tmp_ctx, struct pdb_samba4_search_state);
1677 if (sstate == NULL) {
1678 talloc_free(tmp_ctx);
1679 return false;
1680 }
1681
1682 rc = dsdb_search(state->ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE, attrs, 0, "%s", expression);
1683 if (rc != LDB_SUCCESS) {
1684 talloc_free(tmp_ctx);
1685 DEBUG(10, ("dsdb_search failed: %s\n",
1686 ldb_errstring(state->ldb)));
1687 return false;
1688 }
1689
1690 num_users = res->count;
1691
1692 sstate->entries = talloc_array(sstate, struct samr_displayentry,
1693 num_users);
1694 if (sstate->entries == NULL) {
1695 talloc_free(tmp_ctx);
1696 DEBUG(10, ("talloc failed\n"));
1697 return false;
1698 }
1699
1700 sstate->num_entries = 0;
1701
1702 for (i=0; i<num_users; i++) {
1703 struct samr_displayentry *e;
1704 struct dom_sid *sid;
1705
1706 e = &sstate->entries[sstate->num_entries];
1707
1708 e->idx = sstate->num_entries;
1709 sid = samdb_result_dom_sid(tmp_ctx, res->msgs[i], "objectSid");
1710 if (!sid) {
1711 talloc_free(tmp_ctx);
1712 DEBUG(10, ("Could not pull SID\n"));
1713 return false;
1714 }
1715 sid_peek_rid(sid, &e->rid);
1716
1717 e->acct_flags = samdb_result_acct_flags(state->ldb, tmp_ctx,
1718 res->msgs[i],
1719 ldb_get_default_basedn(state->ldb));
1720 e->account_name = ldb_msg_find_attr_as_string(
1721 res->msgs[i], "samAccountName", NULL);
1722 if (e->account_name == NULL) {
1723 talloc_free(tmp_ctx);
1724 return false;
1725 }
1726 e->fullname = ldb_msg_find_attr_as_string(
1727 res->msgs[i], "displayName", "");
1728 e->description = ldb_msg_find_attr_as_string(
1729 res->msgs[i], "description", "");
1730
1731 sstate->num_entries += 1;
1732 if (sstate->num_entries >= num_users) {
1733 break;
1734 }
1735 }
1736 talloc_steal(sstate->entries, res->msgs);
1737 search->private_data = talloc_steal(search, sstate);
1738 search->next_entry = pdb_samba4_next_entry;
1739 search->search_end = pdb_samba4_search_end;
1740 *pstate = sstate;
1741 talloc_free(tmp_ctx);
1742 return true;
1743 }
1744
1745 static bool pdb_samba4_search_users(struct pdb_methods *m,
1746 struct pdb_search *search,
1747 uint32 acct_flags)
1748 {
1749 struct pdb_samba4_search_state *sstate;
1750 bool ret;
1751
1752 ret = pdb_samba4_search_filter(m, search, &sstate, "(objectclass=user)");
1753 if (!ret) {
1754 return false;
1755 }
1756 sstate->acct_flags = acct_flags;
1757 return true;
1758 }
1759
1760 static bool pdb_samba4_search_groups(struct pdb_methods *m,
1761 struct pdb_search *search)
1762 {
1763 struct pdb_samba4_search_state *sstate;
1764 bool ret;
1765
1766 ret = pdb_samba4_search_filter(m, search, &sstate,
1767 "(&(grouptype=%d)(objectclass=group))",
1768 GTYPE_SECURITY_GLOBAL_GROUP);
1769 if (!ret) {
1770 return false;
1771 }
1772 sstate->acct_flags = 0;
1773 return true;
1774 }
1775
1776 static bool pdb_samba4_search_aliases(struct pdb_methods *m,
1777 struct pdb_search *search,
1778 const struct dom_sid *sid)
1779 {
1780 struct pdb_samba4_search_state *sstate;
1781 bool ret;
1782
1783 ret = pdb_samba4_search_filter(m, search, &sstate,
1784 "(&(grouptype=%d)(objectclass=group))",
1785 sid_check_is_builtin(sid)
1786 ? GTYPE_SECURITY_BUILTIN_LOCAL_GROUP
1787 : GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1788 if (!ret) {
1789 return false;
1790 }
1791 sstate->acct_flags = 0;
1792 return true;
1793 }
1794
1795 static bool pdb_samba4_uid_to_sid(struct pdb_methods *m, uid_t uid,
1796 struct dom_sid *sid)
1797 {
1798 struct pdb_samba4_state *state = talloc_get_type_abort(
1799 m->private_data, struct pdb_samba4_state);
1800 NTSTATUS status;
1801 struct id_map id_map;
1802 struct id_map *id_maps[2];
1803 TALLOC_CTX *tmp_ctx = talloc_stackframe();
1804 if (!tmp_ctx) {
1805 return false;
1806 }
1807
1808 id_map.xid.id = uid;
1809 id_map.xid.type = ID_TYPE_UID;
1810 id_maps[0] = &id_map;
1811 id_maps[1] = NULL;
1812
1813 status = idmap_xids_to_sids(state->idmap_ctx, tmp_ctx, id_maps);
1814 if (!NT_STATUS_IS_OK(status)) {
1815 talloc_free(tmp_ctx);
1816 return false;
1817 }
1818 *sid = *id_map.sid;
1819 talloc_free(tmp_ctx);
1820 return true;
1821 }
1822
1823 static bool pdb_samba4_gid_to_sid(struct pdb_methods *m, gid_t gid,
1824 struct dom_sid *sid)
1825 {
1826 struct pdb_samba4_state *state = talloc_get_type_abort(
1827 m->private_data, struct pdb_samba4_state);
1828 NTSTATUS status;
1829 struct id_map id_map;
1830 struct id_map *id_maps[2];
1831 TALLOC_CTX *tmp_ctx = talloc_stackframe();
1832 if (!tmp_ctx) {
1833 return false;
1834 }
1835
1836 id_map.xid.id = gid;
1837 id_map.xid.type = ID_TYPE_GID;
1838 id_maps[0] = &id_map;
1839 id_maps[1] = NULL;
1840
1841 status = idmap_xids_to_sids(state->idmap_ctx, tmp_ctx, id_maps);
1842 if (!NT_STATUS_IS_OK(status)) {
1843 return false;
1844 }
1845 *sid = *id_map.sid;
1846 talloc_free(tmp_ctx);
1847 return true;
1848 }
1849
1850 static bool pdb_samba4_sid_to_id(struct pdb_methods *m, const struct dom_sid *sid,
1851 union unid_t *id, enum lsa_SidType *type)
1852 {
1853 struct pdb_samba4_state *state = talloc_get_type_abort(
1854 m->private_data, struct pdb_samba4_state);
1855 struct id_map id_map;
1856 struct id_map *id_maps[2];
1857 const char *attrs[] = { "objectClass", "groupType", NULL };
1858 struct ldb_message *msg;
1859 struct ldb_dn *dn;
1860 NTSTATUS status;
1861 int rc;
1862 TALLOC_CTX *tmp_ctx = talloc_stackframe();
1863 if (!tmp_ctx) {
1864 return false;
1865 }
1866
1867 ZERO_STRUCT(id_map);
1868
1869 dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, sid));
1870 if (!dn || !ldb_dn_validate(dn)) {
1871 talloc_free(tmp_ctx);
1872 return false;
1873 }
1874 rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, NULL);
1875 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1876 DEBUG(5, (__location__ "SID to Unix ID lookup failed because SID %s could not be found in the samdb\n", dom_sid_string(tmp_ctx, sid)));
1877 talloc_free(tmp_ctx);
1878 return false;
1879 }
1880 if (samdb_find_attribute(state->ldb, msg, "objectClass", "group")) {
1881 uint32_t grouptype = ldb_msg_find_attr_as_uint(msg, "groupType", 0);
1882 switch (grouptype) {
1883 case GTYPE_SECURITY_BUILTIN_LOCAL_GROUP:
1884 case GTYPE_SECURITY_DOMAIN_LOCAL_GROUP:
1885 *type = SID_NAME_ALIAS;
1886 break;
1887 case GTYPE_SECURITY_GLOBAL_GROUP:
1888 *type = SID_NAME_DOM_GRP;
1889 break;
1890 default:
1891 talloc_free(tmp_ctx);
1892 DEBUG(10, ("Could not pull groupType\n"));
1893 return false;
1894 }
1895
1896 *type = SID_NAME_DOM_GRP;
1897
1898 ZERO_STRUCT(id_map);
1899 id_map.sid = sid;
1900 id_maps[0] = &id_map;
1901 id_maps[1] = NULL;
1902
1903 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
1904 talloc_free(tmp_ctx);
1905 if (!NT_STATUS_IS_OK(status)) {
1906 return false;
1907 }
1908 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
1909 id->gid = id_map.xid.id;
1910 return true;
1911 }
1912 return false;
1913 } else if (samdb_find_attribute(state->ldb, msg, "objectClass", "user")) {
1914 *type = SID_NAME_USER;
1915 ZERO_STRUCT(id_map);
1916 id_map.sid = sid;
1917 id_maps[0] = &id_map;
1918 id_maps[1] = NULL;
1919
1920 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
1921 talloc_free(tmp_ctx);
1922 if (!NT_STATUS_IS_OK(status)) {
1923 return false;
1924 }
1925 if (id_map.xid.type == ID_TYPE_UID || id_map.xid.type == ID_TYPE_BOTH) {
1926 id->uid = id_map.xid.id;
1927 return true;
1928 }
1929 return false;
1930 }
1931 DEBUG(5, (__location__ "SID to Unix ID lookup failed because SID %s was found, but was not a user or group\n", dom_sid_string(tmp_ctx, sid)));
1932 talloc_free(tmp_ctx);
1933 return false;
1934 }
1935
1936 static uint32_t pdb_samba4_capabilities(struct pdb_methods *m)
1937 {
1938 return PDB_CAP_STORE_RIDS | PDB_CAP_ADS;
1939 }
1940
1941 static bool pdb_samba4_new_rid(struct pdb_methods *m, uint32 *rid)
1942 {
1943 return false;
1944 }
1945
1946 static bool pdb_samba4_get_trusteddom_pw(struct pdb_methods *m,
1947 const char *domain, char** pwd,
1948 struct dom_sid *sid,
1949 time_t *pass_last_set_time)
1950 {
1951 return false;
1952 }
1953
1954 static bool pdb_samba4_set_trusteddom_pw(struct pdb_methods *m,
1955 const char* domain, const char* pwd,
1956 const struct dom_sid *sid)
1957 {
1958 return false;
1959 }
1960
1961 static bool pdb_samba4_del_trusteddom_pw(struct pdb_methods *m,
1962 const char *domain)
1963 {
1964 return false;
1965 }
1966
1967 static NTSTATUS pdb_samba4_enum_trusteddoms(struct pdb_methods *m,
1968 TALLOC_CTX *mem_ctx,
1969 uint32 *num_domains,
1970 struct trustdom_info ***domains)
1971 {
1972 *num_domains = 0;
1973 *domains = NULL;
1974 return NT_STATUS_OK;
1975 }
1976
1977 static void pdb_samba4_init_methods(struct pdb_methods *m)
1978 {
1979 m->name = "samba4";
1980 m->get_domain_info = pdb_samba4_get_domain_info;
1981 m->getsampwnam = pdb_samba4_getsampwnam;
1982 m->getsampwsid = pdb_samba4_getsampwsid;
1983 m->create_user = pdb_samba4_create_user;
1984 m->delete_user = pdb_samba4_delete_user;
1985 m->add_sam_account = pdb_samba4_add_sam_account;
1986 m->update_sam_account = pdb_samba4_update_sam_account;
1987 m->delete_sam_account = pdb_samba4_delete_sam_account;
1988 m->rename_sam_account = pdb_samba4_rename_sam_account;
1989 m->update_login_attempts = pdb_samba4_update_login_attempts;
1990 m->getgrsid = pdb_samba4_getgrsid;
1991 m->getgrgid = pdb_samba4_getgrgid;
1992 m->getgrnam = pdb_samba4_getgrnam;
1993 m->create_dom_group = pdb_samba4_create_dom_group;
1994 m->delete_dom_group = pdb_samba4_delete_dom_group;
1995 m->add_group_mapping_entry = pdb_samba4_add_group_mapping_entry;
1996 m->update_group_mapping_entry = pdb_samba4_update_group_mapping_entry;
1997 m->delete_group_mapping_entry = pdb_samba4_delete_group_mapping_entry;
1998 m->enum_group_mapping = pdb_samba4_enum_group_mapping;
1999 m->enum_group_members = pdb_samba4_enum_group_members;
2000 m->enum_group_memberships = pdb_samba4_enum_group_memberships;
2001 m->set_unix_primary_group = pdb_samba4_set_unix_primary_group;
2002 m->add_groupmem = pdb_samba4_add_groupmem;
2003 m->del_groupmem = pdb_samba4_del_groupmem;
2004 m->create_alias = pdb_samba4_create_alias;
2005 m->delete_alias = pdb_samba4_delete_alias;
2006 m->get_aliasinfo = pdb_default_get_aliasinfo;
2007 m->add_aliasmem = pdb_samba4_add_aliasmem;
2008 m->del_aliasmem = pdb_samba4_del_aliasmem;
2009 m->enum_aliasmem = pdb_samba4_enum_aliasmem;
2010 m->enum_alias_memberships = pdb_samba4_enum_alias_memberships;
2011 m->lookup_rids = pdb_samba4_lookup_rids;
2012 m->lookup_names = pdb_samba4_lookup_names;
2013 m->get_account_policy = pdb_samba4_get_account_policy;
2014 m->set_account_policy = pdb_samba4_set_account_policy;
2015 m->get_seq_num = pdb_samba4_get_seq_num;
2016 m->search_users = pdb_samba4_search_users;
2017 m->search_groups = pdb_samba4_search_groups;
2018 m->search_aliases = pdb_samba4_search_aliases;
2019 m->uid_to_sid = pdb_samba4_uid_to_sid;
2020 m->gid_to_sid = pdb_samba4_gid_to_sid;
2021 m->sid_to_id = pdb_samba4_sid_to_id;
2022 m->capabilities = pdb_samba4_capabilities;
2023 m->new_rid = pdb_samba4_new_rid;
2024 m->get_trusteddom_pw = pdb_samba4_get_trusteddom_pw;
2025 m->set_trusteddom_pw = pdb_samba4_set_trusteddom_pw;
2026 m->del_trusteddom_pw = pdb_samba4_del_trusteddom_pw;
2027 m->enum_trusteddoms = pdb_samba4_enum_trusteddoms;
2028 }
2029
2030 static void free_private_data(void **vp)
2031 {
2032 struct pdb_samba4_state *state = talloc_get_type_abort(
2033 *vp, struct pdb_samba4_state);
2034 talloc_unlink(state, state->ldb);
2035 return;
2036 }
2037
2038 static NTSTATUS pdb_init_samba4(struct pdb_methods **pdb_method,
2039 const char *location)
2040 {
2041 struct pdb_methods *m;
2042 struct pdb_samba4_state *state;
2043 NTSTATUS status;
2044
2045 if ( !NT_STATUS_IS_OK(status = make_pdb_method( &m )) ) {
2046 return status;
2047 }
2048
2049 state = talloc_zero(m, struct pdb_samba4_state);
2050 if (state == NULL) {
2051 goto nomem;
2052 }
2053 m->private_data = state;
2054 m->free_private_data = free_private_data;
2055 pdb_samba4_init_methods(m);
2056
2057 state->ev = s4_event_context_init(state);
2058 if (!state->ev) {
2059 DEBUG(10, ("s4_event_context_init failed\n"));
2060 goto fail;
2061 }
2062
2063 state->lp_ctx = loadparm_init_s3(state, loadparm_s3_context());
2064 if (state->lp_ctx == NULL) {
2065 DEBUG(10, ("loadparm_init_s3 failed\n"));
2066 goto fail;
2067 }
2068
2069 state->ldb = samdb_connect(state,
2070 state->ev,
2071 state->lp_ctx,
2072 system_session(state->lp_ctx), 0);
2073
2074 if (!state->ldb) {
2075 DEBUG(10, ("samdb_connect failed\n"));
2076 goto fail;
2077 }
2078
2079 state->idmap_ctx = idmap_init(state, state->ev,
2080 state->lp_ctx);
2081 if (!state->idmap_ctx) {
2082 DEBUG(10, ("samdb_connect failed\n"));
2083 goto fail;
2084 }
2085
2086 *pdb_method = m;
2087 return NT_STATUS_OK;
2088 nomem:
2089 status = NT_STATUS_NO_MEMORY;
2090 fail:
2091 TALLOC_FREE(m);
2092 return status;
2093 }
2094
2095 NTSTATUS pdb_samba4_init(void);
2096 NTSTATUS pdb_samba4_init(void)
2097 {
2098 return smb_register_passdb(PASSDB_INTERFACE_VERSION, "samba4",
2099 pdb_init_samba4);
2100 }
reg import