source3/winbindd/idmap_adex/cell_util.c

   1 /*
   2  * idmap_adex: Support for AD Forests
   3  *
   4  * Copyright (C) Gerald (Jerry) Carter 2006-2008
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 2 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, write to the Free Software
  18  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 #include "includes.h"
  22 #include "ads.h"
  23 #include "idmap.h"
  24 #include "idmap_adex.h"
  25 #include "../libds/common/flags.h"
  26
  27 #undef DBGC_CLASS
  28 #define DBGC_CLASS DBGC_IDMAP
  29
  30 /**********************************************************************
  31 **********************************************************************/
  32
  33  char *find_attr_string(char **list, size_t num_lines, const char *substr)
  34 {
  35         int i;
  36         int cmplen = strlen(substr);
  37
  38         for (i = 0; i < num_lines; i++) {
  39                 /* make sure to avoid substring matches like uid
  40                    and uidNumber */
  41                 if ((strncasecmp_m(list[i], substr, cmplen) == 0) &&
  42                     (list[i][cmplen] == '=')) {
  43                         /* Don't return an empty string */
  44                         if (list[i][cmplen + 1] != '\0')
  45                                 return &(list[i][cmplen + 1]);
  46
  47                         return NULL;
  48                 }
  49         }
  50
  51         return NULL;
  52 }
  53
  54 /**********************************************************************
  55 **********************************************************************/
  56
  57  bool is_object_class(char **list, size_t num_lines, const char *substr)
  58 {
  59         int i;
  60
  61         for (i = 0; i < num_lines; i++) {
  62                 if (strequal(list[i], substr)) {
  63                         return true;
  64                 }
  65         }
  66
  67         return false;
  68 }
  69
  70 /**********************************************************************
  71  Find out about the cell (e.g. use2307Attrs, etc...)
  72 **********************************************************************/
  73
  74  NTSTATUS cell_lookup_settings(struct likewise_cell * cell)
  75 {
  76         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
  77
  78         /* Parameter check */
  79
  80         if (!cell) {
  81                 nt_status = NT_STATUS_INVALID_PARAMETER;
  82                 BAIL_ON_NTSTATUS_ERROR(nt_status);
  83         }
  84
  85         /* Only supporting Forest-wide, schema based searches */
  86
  87         cell_set_flags(cell, LWCELL_FLAG_USE_RFC2307_ATTRS);
  88         cell_set_flags(cell, LWCELL_FLAG_SEARCH_FOREST);
  89
  90         cell->provider = &ccp_unified;
  91
  92         nt_status = NT_STATUS_OK;
  93
  94 done:
  95         if (!NT_STATUS_IS_OK(nt_status)) {
  96                 DEBUG(1,("LWI: Failed to obtain cell settings (%s)\n",
  97                          nt_errstr(nt_status)));
  98         }
  99
 100         return nt_status;
 101 }
 102
 103
 104 static NTSTATUS cell_lookup_forest(struct likewise_cell *c)
 105 {
 106         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 107         struct gc_info *gc = NULL;
 108
 109         if (!c) {
 110                 return NT_STATUS_INVALID_PARAMETER;
 111         }
 112
 113         if ((gc = talloc_zero(NULL, struct gc_info)) == NULL) {
 114                 nt_status = NT_STATUS_NO_MEMORY;
 115                 BAIL_ON_NTSTATUS_ERROR(nt_status);
 116         }
 117
 118         /* Query the rootDSE for the forest root naming conect first.
 119            Check that the a GC server for the forest has not already
 120            been added */
 121
 122         nt_status = gc_find_forest_root(gc, cell_dns_domain(c));
 123         BAIL_ON_NTSTATUS_ERROR(nt_status);
 124
 125         c->forest_name = talloc_strdup(c, gc->forest_name);
 126         BAIL_ON_PTR_ERROR(c->forest_name, nt_status);
 127
 128 done:
 129         if (gc) {
 130                 talloc_free(gc);
 131         }
 132
 133         return nt_status;
 134 }
 135
 136 /**********************************************************************
 137 **********************************************************************/
 138
 139  NTSTATUS cell_locate_membership(ADS_STRUCT * ads)
 140 {
 141         ADS_STATUS status;
 142         char *domain_dn = ads_build_dn(lp_realm());
 143         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 144         struct dom_sid sid;
 145         struct likewise_cell *cell = NULL;
 146
 147         /* In the Likewise plugin, I had to support the concept of cells
 148            based on the machine's membership in an OU.  However, now I'll
 149            just assume our membership in the forest cell */
 150
 151         DEBUG(2, ("locate_cell_membership: Located membership "
 152                   "in cell \"%s\"\n", domain_dn));
 153
 154         if ((cell = cell_new()) == NULL) {
 155                 nt_status = NT_STATUS_NO_MEMORY;
 156                 BAIL_ON_NTSTATUS_ERROR(nt_status);
 157         }
 158
 159         status = ads_domain_sid(ads, &sid);
 160         if (!ADS_ERR_OK(status)) {
 161                 DEBUG(3,("locate_cell_membership: Failed to find "
 162                          "domain SID for %s\n", domain_dn));
 163         }
 164
 165         /* save the SID and search base for our domain */
 166
 167         cell_set_dns_domain(cell, lp_realm());
 168         cell_set_connection(cell, ads);
 169         cell_set_dn(cell, domain_dn);
 170         cell_set_domain_sid(cell, &sid);
 171
 172         /* Now save our forest root */
 173
 174         cell_lookup_forest(cell);
 175
 176         /* Add the cell to the list */
 177
 178         if (!cell_list_add(cell)) {
 179                 nt_status = NT_STATUS_INSUFFICIENT_RESOURCES;
 180                 BAIL_ON_NTSTATUS_ERROR(nt_status);
 181         }
 182
 183         /* Done! */
 184         nt_status = NT_STATUS_OK;
 185
 186 done:
 187         if (!NT_STATUS_IS_OK(nt_status)) {
 188                 DEBUG(0,("LWI: Failed to locate cell membership (%s)\n",
 189                          nt_errstr(nt_status)));
 190         }
 191
 192         SAFE_FREE(domain_dn);
 193
 194         return nt_status;
 195 }
 196
 197 /*********************************************************************
 198  ********************************************************************/
 199
 200  int min_id_value(void)
 201 {
 202         int id_val;
 203
 204         id_val = lp_parm_int(-1, "lwidentity", "min_id_value", MIN_ID_VALUE);
 205
 206         /* Still don't let it go below 50 */
 207
 208         return MAX(50, id_val);
 209 }
 210
 211 /********************************************************************
 212  *******************************************************************/
 213
 214  char *cell_dn_to_dns(const char *dn)
 215 {
 216         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 217         char *domain = NULL;
 218         char *dns_name = NULL;
 219         const char *tmp_dn;
 220         char *buffer = NULL;
 221         TALLOC_CTX *frame = talloc_stackframe();
 222
 223         if (!dn || !*dn) {
 224                 goto done;
 225         }
 226
 227         tmp_dn = talloc_strdup(frame, dn);
 228         BAIL_ON_PTR_ERROR(tmp_dn, nt_status);
 229
 230         while (next_token_talloc(frame, &tmp_dn, &buffer, ",")) {
 231
 232                 /* skip everything up the where DC=... begins */
 233                 if (strncasecmp_m(buffer, "DC=", 3) != 0)
 234                         continue;
 235
 236                 if (!domain) {
 237                         domain = talloc_strdup(frame, &buffer[3]);
 238                 } else {
 239                         domain = talloc_asprintf_append(domain, ".%s",
 240                                                         &buffer[3]);
 241                 }
 242                 BAIL_ON_PTR_ERROR(domain, nt_status);
 243         }
 244
 245         dns_name = SMB_STRDUP(domain);
 246         BAIL_ON_PTR_ERROR(dns_name, nt_status);
 247
 248         nt_status = NT_STATUS_OK;
 249
 250 done:
 251         PRINT_NTSTATUS_ERROR(nt_status, "cell_dn_to_dns", 1);
 252
 253         talloc_destroy(frame);
 254
 255         return dns_name;
 256 }
 257
 258 /*********************************************************************
 259  ********************************************************************/
 260
 261  NTSTATUS get_sid_type(ADS_STRUCT *ads,
 262                        LDAPMessage *msg,
 263                        enum lsa_SidType *type)
 264 {
 265         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 266         uint32_t atype;
 267
 268         if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype)) {
 269                 nt_status = NT_STATUS_INVALID_USER_BUFFER;
 270                 BAIL_ON_NTSTATUS_ERROR(nt_status);
 271         }
 272
 273         switch (atype &0xF0000000) {
 274         case ATYPE_SECURITY_GLOBAL_GROUP:
 275                 *type = SID_NAME_DOM_GRP;
 276                 break;
 277         case ATYPE_SECURITY_LOCAL_GROUP:
 278                 *type = SID_NAME_ALIAS;
 279                 break;
 280         case ATYPE_NORMAL_ACCOUNT:
 281         case ATYPE_WORKSTATION_TRUST:
 282         case ATYPE_INTERDOMAIN_TRUST:
 283                 *type = SID_NAME_USER;
 284                 break;
 285         default:
 286                 *type = SID_NAME_USE_NONE;
 287                 nt_status = NT_STATUS_INVALID_ACCOUNT_NAME;
 288                 BAIL_ON_NTSTATUS_ERROR(nt_status);
 289         }
 290
 291         nt_status = NT_STATUS_OK;
 292
 293 done:
 294         return nt_status;
 295 }