2 Unix SMB/CIFS implementation.
4 Winbind daemon - user related functions
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
27 #define DBGC_CLASS DBGC_WINBIND
29 /* Fill a pwent structure with information we have obtained */
31 static BOOL
winbindd_fill_pwent(char *dom_name
, char *user_name
,
32 DOM_SID
*user_sid
, DOM_SID
*group_sid
,
33 char *full_name
, struct winbindd_pw
*pw
)
35 extern userdom_struct current_user_info
;
36 fstring output_username
;
40 if (!pw
|| !dom_name
|| !user_name
)
43 /* Resolve the uid number */
45 if (!winbindd_idmap_get_uid_from_sid(user_sid
,
47 DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string
, user_sid
)));
51 /* Resolve the gid number */
53 if (!winbindd_idmap_get_gid_from_sid(group_sid
,
55 DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string
, group_sid
)));
61 fill_domain_username(output_username
, dom_name
, user_name
);
63 safe_strcpy(pw
->pw_name
, output_username
, sizeof(pw
->pw_name
) - 1);
65 /* Full name (gecos) */
67 safe_strcpy(pw
->pw_gecos
, full_name
, sizeof(pw
->pw_gecos
) - 1);
69 /* Home directory and shell - use template config parameters. The
70 defaults are /tmp for the home directory and /bin/false for
73 /* The substitution of %U and %D in the 'template homedir' is done
74 by lp_string() calling standard_sub_basic(). */
76 fstrcpy(current_user_info
.smb_name
, user_name
);
77 sub_set_smb_name(user_name
);
78 fstrcpy(current_user_info
.domain
, dom_name
);
80 pstrcpy(homedir
, lp_template_homedir());
82 safe_strcpy(pw
->pw_dir
, homedir
, sizeof(pw
->pw_dir
) - 1);
84 safe_strcpy(pw
->pw_shell
, lp_template_shell(),
85 sizeof(pw
->pw_shell
) - 1);
87 /* Password - set to "x" as we can't generate anything useful here.
88 Authentication can be done using the pam_winbind module. */
90 safe_strcpy(pw
->pw_passwd
, "x", sizeof(pw
->pw_passwd
) - 1);
95 /* Return a password structure from a username. */
97 enum winbindd_result
winbindd_getpwnam(struct winbindd_cli_state
*state
)
99 WINBIND_USERINFO user_info
;
102 fstring name_domain
, name_user
;
103 enum SID_NAME_USE name_type
;
104 struct winbindd_domain
*domain
;
107 /* Ensure null termination */
108 state
->request
.data
.username
[sizeof(state
->request
.data
.username
)-1]='\0';
110 DEBUG(3, ("[%5d]: getpwnam %s\n", state
->pid
,
111 state
->request
.data
.username
));
113 /* Parse domain and username */
115 if (!parse_domain_user(state
->request
.data
.username
, name_domain
,
117 return WINBINDD_ERROR
;
119 if ((domain
= find_domain_from_name(name_domain
)) == NULL
) {
120 DEBUG(5, ("no such domain: %s\n", name_domain
));
121 return WINBINDD_ERROR
;
124 /* Get rid and name type from name */
126 if (!winbindd_lookup_sid_by_name(domain
, name_user
, &user_sid
, &name_type
)) {
127 DEBUG(1, ("user '%s' does not exist\n", name_user
));
128 return WINBINDD_ERROR
;
131 if (name_type
!= SID_NAME_USER
) {
132 DEBUG(1, ("name '%s' is not a user name: %d\n", name_user
,
134 return WINBINDD_ERROR
;
137 /* Get some user info. Split the user rid from the sid obtained
138 from the winbind_lookup_by_name() call and use it in a
139 winbind_lookup_userinfo() */
141 if (!(mem_ctx
= talloc_init("winbindd_getpwnam([%s]\\[%s])",
142 name_domain
, name_user
))) {
143 DEBUG(1, ("out of memory\n"));
144 return WINBINDD_ERROR
;
147 status
= domain
->methods
->query_user(domain
, mem_ctx
, &user_sid
,
150 if (!NT_STATUS_IS_OK(status
)) {
151 DEBUG(1, ("error getting user info for user '[%s]\\[%s]'\n",
152 name_domain
, name_user
));
153 talloc_destroy(mem_ctx
);
154 return WINBINDD_ERROR
;
157 /* Now take all this information and fill in a passwd structure */
158 if (!winbindd_fill_pwent(name_domain
, name_user
,
159 user_info
.user_sid
, user_info
.group_sid
,
161 &state
->response
.data
.pw
)) {
162 talloc_destroy(mem_ctx
);
163 return WINBINDD_ERROR
;
166 talloc_destroy(mem_ctx
);
171 /* Return a password structure given a uid number */
173 enum winbindd_result
winbindd_getpwuid(struct winbindd_cli_state
*state
)
176 struct winbindd_domain
*domain
;
179 enum SID_NAME_USE name_type
;
180 WINBIND_USERINFO user_info
;
185 /* Bug out if the uid isn't in the winbind range */
187 if ((state
->request
.data
.uid
< server_state
.uid_low
) ||
188 (state
->request
.data
.uid
> server_state
.uid_high
))
189 return WINBINDD_ERROR
;
191 DEBUG(3, ("[%5d]: getpwuid %d\n", state
->pid
,
192 state
->request
.data
.uid
));
194 /* Get rid from uid */
196 if (!winbindd_idmap_get_sid_from_uid(state
->request
.data
.uid
,
198 DEBUG(1, ("could not convert uid %d to SID\n",
199 state
->request
.data
.uid
));
200 return WINBINDD_ERROR
;
203 /* Get name and name type from rid */
205 if (!winbindd_lookup_name_by_sid(&user_sid
, dom_name
, user_name
, &name_type
)) {
208 sid_to_string(temp
, &user_sid
);
209 DEBUG(1, ("could not lookup sid %s\n", temp
));
210 return WINBINDD_ERROR
;
213 domain
= find_domain_from_sid(&user_sid
);
216 DEBUG(1,("Can't find domain from sid\n"));
217 return WINBINDD_ERROR
;
220 /* Get some user info */
222 if (!(mem_ctx
= talloc_init("winbind_getpwuid(%d)",
223 state
->request
.data
.uid
))) {
225 DEBUG(1, ("out of memory\n"));
226 return WINBINDD_ERROR
;
229 status
= domain
->methods
->query_user(domain
, mem_ctx
, &user_sid
,
232 if (!NT_STATUS_IS_OK(status
)) {
233 DEBUG(1, ("error getting user info for user '%s'\n",
235 talloc_destroy(mem_ctx
);
236 return WINBINDD_ERROR
;
239 /* Resolve gid number */
241 if (!winbindd_idmap_get_gid_from_sid(user_info
.group_sid
, &gid
)) {
242 DEBUG(1, ("error getting group id for user %s\n", user_name
));
243 talloc_destroy(mem_ctx
);
244 return WINBINDD_ERROR
;
247 /* Fill in password structure */
249 if (!winbindd_fill_pwent(domain
->name
, user_name
, user_info
.user_sid
,
251 user_info
.full_name
, &state
->response
.data
.pw
)) {
252 talloc_destroy(mem_ctx
);
253 return WINBINDD_ERROR
;
256 talloc_destroy(mem_ctx
);
262 * set/get/endpwent functions
265 /* Rewind file pointer for ntdom passwd database */
267 enum winbindd_result
winbindd_setpwent(struct winbindd_cli_state
*state
)
269 struct winbindd_domain
*domain
;
271 DEBUG(3, ("[%5d]: setpwent\n", state
->pid
));
273 /* Check user has enabled this */
275 if (!lp_winbind_enum_users())
276 return WINBINDD_ERROR
;
278 /* Free old static data if it exists */
280 if (state
->getpwent_state
!= NULL
) {
281 free_getent_state(state
->getpwent_state
);
282 state
->getpwent_state
= NULL
;
285 /* Create sam pipes for each domain we know about */
287 for(domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
288 struct getent_state
*domain_state
;
290 /* Create a state record for this domain */
292 if ((domain_state
= (struct getent_state
*)
293 malloc(sizeof(struct getent_state
))) == NULL
)
294 return WINBINDD_ERROR
;
296 ZERO_STRUCTP(domain_state
);
298 fstrcpy(domain_state
->domain_name
, domain
->name
);
300 /* Add to list of open domains */
302 DLIST_ADD(state
->getpwent_state
, domain_state
);
308 /* Close file pointer to ntdom passwd database */
310 enum winbindd_result
winbindd_endpwent(struct winbindd_cli_state
*state
)
312 DEBUG(3, ("[%5d]: endpwent\n", state
->pid
));
314 free_getent_state(state
->getpwent_state
);
315 state
->getpwent_state
= NULL
;
320 /* Get partial list of domain users for a domain. We fill in the sam_entries,
321 and num_sam_entries fields with domain user information. The dispinfo_ndx
322 field is incremented to the index of the next user to fetch. Return True if
323 some users were returned, False otherwise. */
325 #define MAX_FETCH_SAM_ENTRIES 100
327 static BOOL
get_sam_user_entries(struct getent_state
*ent
)
331 WINBIND_USERINFO
*info
;
332 struct getpwent_user
*name_list
= NULL
;
335 struct winbindd_domain
*domain
;
336 struct winbindd_methods
*methods
;
339 if (ent
->num_sam_entries
)
342 if (!(mem_ctx
= talloc_init("get_sam_user_entries(%s)",
346 if (!(domain
= find_domain_from_name(ent
->domain_name
))) {
347 DEBUG(3, ("no such domain %s in get_sam_user_entries\n",
352 methods
= domain
->methods
;
354 /* Free any existing user info */
356 SAFE_FREE(ent
->sam_entries
);
357 ent
->num_sam_entries
= 0;
359 /* Call query_user_list to get a list of usernames and user rids */
363 status
= methods
->query_user_list(domain
, mem_ctx
, &num_entries
,
367 struct getpwent_user
*tnl
;
369 tnl
= (struct getpwent_user
*)Realloc(name_list
,
370 sizeof(struct getpwent_user
) *
371 (ent
->num_sam_entries
+
375 DEBUG(0,("get_sam_user_entries realloc failed.\n"));
376 SAFE_FREE(name_list
);
382 for (i
= 0; i
< num_entries
; i
++) {
383 /* Store account name and gecos */
384 if (!info
[i
].acct_name
) {
385 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].name
, "");
387 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].name
,
390 if (!info
[i
].full_name
) {
391 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].gecos
, "");
393 fstrcpy(name_list
[ent
->num_sam_entries
+ i
].gecos
,
397 /* User and group ids */
398 sid_copy(&name_list
[ent
->num_sam_entries
+i
].user_sid
, info
[i
].user_sid
);
399 sid_copy(&name_list
[ent
->num_sam_entries
+i
].group_sid
, info
[i
].group_sid
);
402 ent
->num_sam_entries
+= num_entries
;
404 /* Fill in remaining fields */
406 ent
->sam_entries
= name_list
;
407 ent
->sam_entry_index
= 0;
408 result
= ent
->num_sam_entries
> 0;
412 talloc_destroy(mem_ctx
);
417 /* Fetch next passwd entry from ntdom database */
419 #define MAX_GETPWENT_USERS 500
421 enum winbindd_result
winbindd_getpwent(struct winbindd_cli_state
*state
)
423 struct getent_state
*ent
;
424 struct winbindd_pw
*user_list
;
425 int num_users
, user_list_ndx
= 0, i
;
427 DEBUG(3, ("[%5d]: getpwent\n", state
->pid
));
429 /* Check user has enabled this */
431 if (!lp_winbind_enum_users())
432 return WINBINDD_ERROR
;
434 /* Allocate space for returning a chunk of users */
436 num_users
= MIN(MAX_GETPWENT_USERS
, state
->request
.data
.num_entries
);
438 if ((state
->response
.extra_data
=
439 malloc(num_users
* sizeof(struct winbindd_pw
))) == NULL
)
440 return WINBINDD_ERROR
;
442 memset(state
->response
.extra_data
, 0, num_users
*
443 sizeof(struct winbindd_pw
));
445 user_list
= (struct winbindd_pw
*)state
->response
.extra_data
;
447 if (!(ent
= state
->getpwent_state
))
448 return WINBINDD_ERROR
;
450 /* Start sending back users */
452 for (i
= 0; i
< num_users
; i
++) {
453 struct getpwent_user
*name_list
= NULL
;
454 fstring domain_user_name
;
457 /* Do we need to fetch another chunk of users? */
459 if (ent
->num_sam_entries
== ent
->sam_entry_index
) {
461 while(ent
&& !get_sam_user_entries(ent
)) {
462 struct getent_state
*next_ent
;
464 /* Free state information for this domain */
466 SAFE_FREE(ent
->sam_entries
);
468 next_ent
= ent
->next
;
469 DLIST_REMOVE(state
->getpwent_state
, ent
);
475 /* No more domains */
481 name_list
= ent
->sam_entries
;
483 /* Skip machine accounts */
485 if (name_list
[ent
->sam_entry_index
].
486 name
[strlen(name_list
[ent
->sam_entry_index
].name
) - 1]
488 ent
->sam_entry_index
++;
492 /* Lookup user info */
494 result
= winbindd_fill_pwent(
496 name_list
[ent
->sam_entry_index
].name
,
497 &name_list
[ent
->sam_entry_index
].user_sid
,
498 &name_list
[ent
->sam_entry_index
].group_sid
,
499 name_list
[ent
->sam_entry_index
].gecos
,
500 &user_list
[user_list_ndx
]);
502 ent
->sam_entry_index
++;
504 /* Add user to return list */
509 state
->response
.data
.num_entries
++;
510 state
->response
.length
+=
511 sizeof(struct winbindd_pw
);
514 DEBUG(1, ("could not lookup domain user %s\n",
520 return (user_list_ndx
> 0) ? WINBINDD_OK
: WINBINDD_ERROR
;
523 /* List domain users without mapping to unix ids */
525 enum winbindd_result
winbindd_list_users(struct winbindd_cli_state
*state
)
527 struct winbindd_domain
*domain
;
528 WINBIND_USERINFO
*info
;
529 uint32 num_entries
= 0, total_entries
= 0;
530 char *ted
, *extra_data
= NULL
;
531 int extra_data_len
= 0;
533 enum winbindd_result rv
= WINBINDD_ERROR
;
535 DEBUG(3, ("[%5d]: list users\n", state
->pid
));
537 if (!(mem_ctx
= talloc_init("winbindd_list_users")))
538 return WINBINDD_ERROR
;
540 /* Enumerate over trusted domains */
542 for (domain
= domain_list(); domain
; domain
= domain
->next
) {
544 struct winbindd_methods
*methods
;
547 methods
= domain
->methods
;
549 /* Query display info */
550 status
= methods
->query_user_list(domain
, mem_ctx
,
551 &num_entries
, &info
);
553 if (num_entries
== 0)
556 /* Allocate some memory for extra data */
557 total_entries
+= num_entries
;
559 ted
= Realloc(extra_data
, sizeof(fstring
) * total_entries
);
562 DEBUG(0,("failed to enlarge buffer!\n"));
563 SAFE_FREE(extra_data
);
568 /* Pack user list into extra data fields */
570 for (i
= 0; i
< num_entries
; i
++) {
571 fstring acct_name
, name
;
573 if (!info
[i
].acct_name
) {
574 fstrcpy(acct_name
, "");
576 fstrcpy(acct_name
, info
[i
].acct_name
);
579 fill_domain_username(name
, domain
->name
, acct_name
);
581 /* Append to extra data */
582 memcpy(&extra_data
[extra_data_len
], name
,
584 extra_data_len
+= strlen(name
);
585 extra_data
[extra_data_len
++] = ',';
589 /* Assign extra_data fields in response structure */
592 extra_data
[extra_data_len
- 1] = '\0';
593 state
->response
.extra_data
= extra_data
;
594 state
->response
.length
+= extra_data_len
;
597 /* No domains responded but that's still OK so don't return an
604 talloc_destroy(mem_ctx
);