2 Unix SMB/CIFS implementation.
4 Winbind daemon for ntdom nss module
6 Copyright (C) Tim Potter 2000-2001
7 Copyright (C) 2001 by Martin Pool <mbp@samba.org>
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #define DBGC_CLASS DBGC_WINBIND
29 extern struct winbindd_methods cache_methods
;
30 extern struct winbindd_methods builtin_passdb_methods
;
31 extern struct winbindd_methods sam_passdb_methods
;
35 * @file winbindd_util.c
37 * Winbind daemon for NT domain authentication nss module.
41 /* The list of trusted domains. Note that the list can be deleted and
42 recreated using the init_domain_list() function so pointers to
43 individual winbindd_domain structures cannot be made. Keep a copy of
44 the domain name instead. */
46 static struct winbindd_domain
*_domain_list
= NULL
;
48 struct winbindd_domain
*domain_list(void)
52 if ((!_domain_list
) && (!init_domain_list())) {
53 smb_panic("Init_domain_list failed");
59 /* Free all entries in the trusted domain list */
61 static void free_domain_list(void)
63 struct winbindd_domain
*domain
= _domain_list
;
66 struct winbindd_domain
*next
= domain
->next
;
68 DLIST_REMOVE(_domain_list
, domain
);
74 static bool is_internal_domain(const DOM_SID
*sid
)
79 return (sid_check_is_domain(sid
) || sid_check_is_builtin(sid
));
82 static bool is_in_internal_domain(const DOM_SID
*sid
)
87 return (sid_check_is_in_our_domain(sid
) || sid_check_is_in_builtin(sid
));
91 /* Add a trusted domain to our list of domains */
92 static struct winbindd_domain
*add_trusted_domain(const char *domain_name
, const char *alt_name
,
93 struct winbindd_methods
*methods
,
96 struct winbindd_domain
*domain
;
97 const char *alternative_name
= NULL
;
98 char *idmap_config_option
;
100 const char **ignored_domains
, **dom
;
102 ignored_domains
= lp_parm_string_list(-1, "winbind", "ignore domains", NULL
);
103 for (dom
=ignored_domains
; dom
&& *dom
; dom
++) {
104 if (gen_fnmatch(*dom
, domain_name
) == 0) {
105 DEBUG(2,("Ignoring domain '%s'\n", domain_name
));
110 /* ignore alt_name if we are not in an AD domain */
112 if ( (lp_security() == SEC_ADS
) && alt_name
&& *alt_name
) {
113 alternative_name
= alt_name
;
116 /* We can't call domain_list() as this function is called from
117 init_domain_list() and we'll get stuck in a loop. */
118 for (domain
= _domain_list
; domain
; domain
= domain
->next
) {
119 if (strequal(domain_name
, domain
->name
) ||
120 strequal(domain_name
, domain
->alt_name
))
125 if (alternative_name
&& *alternative_name
)
127 if (strequal(alternative_name
, domain
->name
) ||
128 strequal(alternative_name
, domain
->alt_name
))
136 if (is_null_sid(sid
)) {
140 if (sid_equal(sid
, &domain
->sid
)) {
146 if (domain
!= NULL
) {
148 * We found a match. Possibly update the SID
151 && sid_equal(&domain
->sid
, &global_sid_NULL
)) {
152 sid_copy( &domain
->sid
, sid
);
157 /* Create new domain entry */
159 if ((domain
= SMB_MALLOC_P(struct winbindd_domain
)) == NULL
)
164 ZERO_STRUCTP(domain
);
166 fstrcpy(domain
->name
, domain_name
);
167 if (alternative_name
) {
168 fstrcpy(domain
->alt_name
, alternative_name
);
171 domain
->methods
= methods
;
172 domain
->backend
= NULL
;
173 domain
->internal
= is_internal_domain(sid
);
174 domain
->sequence_number
= DOM_SEQUENCE_NONE
;
175 domain
->last_seq_check
= 0;
176 domain
->initialized
= False
;
177 domain
->online
= is_internal_domain(sid
);
178 domain
->check_online_timeout
= 0;
179 domain
->dc_probe_pid
= (pid_t
)-1;
181 sid_copy(&domain
->sid
, sid
);
184 /* Link to domain list */
185 DLIST_ADD_END(_domain_list
, domain
, struct winbindd_domain
*);
187 wcache_tdc_add_domain( domain
);
189 idmap_config_option
= talloc_asprintf(talloc_tos(), "idmap config %s",
191 if (idmap_config_option
== NULL
) {
192 DEBUG(0, ("talloc failed, not looking for idmap config\n"));
196 param
= lp_parm_const_string(-1, idmap_config_option
, "range", NULL
);
198 DEBUG(10, ("%s : range = %s\n", idmap_config_option
,
199 param
? param
: "not defined"));
202 unsigned low_id
, high_id
;
203 if (sscanf(param
, "%u - %u", &low_id
, &high_id
) != 2) {
204 DEBUG(1, ("invalid range syntax in %s: %s\n",
205 idmap_config_option
, param
));
208 if (low_id
> high_id
) {
209 DEBUG(1, ("invalid range in %s: %s\n",
210 idmap_config_option
, param
));
213 domain
->have_idmap_config
= true;
214 domain
->id_range_low
= low_id
;
215 domain
->id_range_high
= high_id
;
220 DEBUG(2,("Added domain %s %s %s\n",
221 domain
->name
, domain
->alt_name
,
222 &domain
->sid
?sid_string_dbg(&domain
->sid
):""));
227 bool domain_is_forest_root(const struct winbindd_domain
*domain
)
229 const uint32_t fr_flags
=
230 (NETR_TRUST_FLAG_TREEROOT
|NETR_TRUST_FLAG_IN_FOREST
);
232 return ((domain
->domain_flags
& fr_flags
) == fr_flags
);
235 /********************************************************************
236 rescan our domains looking for new trusted domains
237 ********************************************************************/
239 struct trustdom_state
{
240 struct winbindd_domain
*domain
;
241 struct winbindd_response
*response
;
244 static void trustdom_recv(void *private_data
, bool success
);
245 static void rescan_forest_root_trusts( void );
246 static void rescan_forest_trusts( void );
248 static void add_trusted_domains( struct winbindd_domain
*domain
)
250 struct winbindd_request
*request
;
251 struct winbindd_response
*response
;
252 struct trustdom_state
*state
;
254 state
= TALLOC_ZERO_P(NULL
, struct trustdom_state
);
256 DEBUG(0, ("talloc_init failed\n"));
260 request
= TALLOC_ZERO_P(state
, struct winbindd_request
);
261 response
= TALLOC_P(state
, struct winbindd_response
);
263 if ((request
== NULL
) || (response
== NULL
)) {
264 DEBUG(0, ("talloc failed\n"));
268 state
->response
= response
;
269 state
->domain
= domain
;
271 request
->length
= sizeof(*request
);
272 request
->cmd
= WINBINDD_LIST_TRUSTDOM
;
274 async_domain_request(state
, domain
, request
, response
,
275 trustdom_recv
, state
);
278 static void trustdom_recv(void *private_data
, bool success
)
280 struct trustdom_state
*state
=
281 talloc_get_type_abort(private_data
, struct trustdom_state
);
282 struct winbindd_response
*response
= state
->response
;
285 if ((!success
) || (response
->result
!= WINBINDD_OK
)) {
286 DEBUG(1, ("Could not receive trustdoms\n"));
291 p
= (char *)response
->extra_data
.data
;
293 while ((p
!= NULL
) && (*p
!= '\0')) {
294 char *q
, *sidstr
, *alt_name
;
296 struct winbindd_domain
*domain
;
297 char *alternate_name
= NULL
;
299 alt_name
= strchr(p
, '\\');
300 if (alt_name
== NULL
) {
301 DEBUG(0, ("Got invalid trustdom response\n"));
308 sidstr
= strchr(alt_name
, '\\');
309 if (sidstr
== NULL
) {
310 DEBUG(0, ("Got invalid trustdom response\n"));
317 q
= strchr(sidstr
, '\n');
321 if (!string_to_sid(&sid
, sidstr
)) {
322 DEBUG(0, ("Got invalid trustdom response\n"));
326 /* use the real alt_name if we have one, else pass in NULL */
328 if ( !strequal( alt_name
, "(null)" ) )
329 alternate_name
= alt_name
;
331 /* If we have an existing domain structure, calling
332 add_trusted_domain() will update the SID if
333 necessary. This is important because we need the
334 SID for sibling domains */
336 if ( find_domain_from_name_noinit(p
) != NULL
) {
337 domain
= add_trusted_domain(p
, alternate_name
,
341 domain
= add_trusted_domain(p
, alternate_name
,
345 setup_domain_child(domain
);
354 Cases to consider when scanning trusts:
355 (a) we are calling from a child domain (primary && !forest_root)
356 (b) we are calling from the root of the forest (primary && forest_root)
357 (c) we are calling from a trusted forest domain (!primary
361 if (state
->domain
->primary
) {
362 /* If this is our primary domain and we are not in the
363 forest root, we have to scan the root trusts first */
365 if (!domain_is_forest_root(state
->domain
))
366 rescan_forest_root_trusts();
368 rescan_forest_trusts();
370 } else if (domain_is_forest_root(state
->domain
)) {
371 /* Once we have done root forest trust search, we can
372 go on to search the trusted forests */
374 rescan_forest_trusts();
382 /********************************************************************
383 Scan the trusts of our forest root
384 ********************************************************************/
386 static void rescan_forest_root_trusts( void )
388 struct winbindd_tdc_domain
*dom_list
= NULL
;
389 size_t num_trusts
= 0;
392 /* The only transitive trusts supported by Windows 2003 AD are
393 (a) Parent-Child, (b) Tree-Root, and (c) Forest. The
394 first two are handled in forest and listed by
395 DsEnumerateDomainTrusts(). Forest trusts are not so we
396 have to do that ourselves. */
398 if ( !wcache_tdc_fetch_list( &dom_list
, &num_trusts
) )
401 for ( i
=0; i
<num_trusts
; i
++ ) {
402 struct winbindd_domain
*d
= NULL
;
404 /* Find the forest root. Don't necessarily trust
405 the domain_list() as our primary domain may not
406 have been initialized. */
408 if ( !(dom_list
[i
].trust_flags
& NETR_TRUST_FLAG_TREEROOT
) ) {
412 /* Here's the forest root */
414 d
= find_domain_from_name_noinit( dom_list
[i
].domain_name
);
417 d
= add_trusted_domain( dom_list
[i
].domain_name
,
418 dom_list
[i
].dns_name
,
422 setup_domain_child(d
);
430 DEBUG(10,("rescan_forest_root_trusts: Following trust path "
431 "for domain tree root %s (%s)\n",
432 d
->name
, d
->alt_name
));
434 d
->domain_flags
= dom_list
[i
].trust_flags
;
435 d
->domain_type
= dom_list
[i
].trust_type
;
436 d
->domain_trust_attribs
= dom_list
[i
].trust_attribs
;
438 add_trusted_domains( d
);
443 TALLOC_FREE( dom_list
);
448 /********************************************************************
449 scan the transitive forest trusts (not our own)
450 ********************************************************************/
453 static void rescan_forest_trusts( void )
455 struct winbindd_domain
*d
= NULL
;
456 struct winbindd_tdc_domain
*dom_list
= NULL
;
457 size_t num_trusts
= 0;
460 /* The only transitive trusts supported by Windows 2003 AD are
461 (a) Parent-Child, (b) Tree-Root, and (c) Forest. The
462 first two are handled in forest and listed by
463 DsEnumerateDomainTrusts(). Forest trusts are not so we
464 have to do that ourselves. */
466 if ( !wcache_tdc_fetch_list( &dom_list
, &num_trusts
) )
469 for ( i
=0; i
<num_trusts
; i
++ ) {
470 uint32 flags
= dom_list
[i
].trust_flags
;
471 uint32 type
= dom_list
[i
].trust_type
;
472 uint32 attribs
= dom_list
[i
].trust_attribs
;
474 d
= find_domain_from_name_noinit( dom_list
[i
].domain_name
);
476 /* ignore our primary and internal domains */
478 if ( d
&& (d
->internal
|| d
->primary
) )
481 if ( (flags
& NETR_TRUST_FLAG_INBOUND
) &&
482 (type
== NETR_TRUST_TYPE_UPLEVEL
) &&
483 (attribs
== NETR_TRUST_ATTRIBUTE_FOREST_TRANSITIVE
) )
485 /* add the trusted domain if we don't know
489 d
= add_trusted_domain( dom_list
[i
].domain_name
,
490 dom_list
[i
].dns_name
,
494 setup_domain_child(d
);
502 DEBUG(10,("Following trust path for domain %s (%s)\n",
503 d
->name
, d
->alt_name
));
504 add_trusted_domains( d
);
508 TALLOC_FREE( dom_list
);
513 /*********************************************************************
514 The process of updating the trusted domain list is a three step
517 (b) ask the root domain in our forest
518 (c) ask the a DC in any Win2003 trusted forests
519 *********************************************************************/
521 void rescan_trusted_domains(struct tevent_context
*ev
, struct tevent_timer
*te
,
522 struct timeval now
, void *private_data
)
526 /* I use to clear the cache here and start over but that
527 caused problems in child processes that needed the
528 trust dom list early on. Removing it means we
529 could have some trusted domains listed that have been
530 removed from our primary domain's DC until a full
531 restart. This should be ok since I think this is what
532 Windows does as well. */
534 /* this will only add new domains we didn't already know about
535 in the domain_list()*/
537 add_trusted_domains( find_our_domain() );
539 te
= tevent_add_timer(
540 ev
, NULL
, timeval_current_ofs(WINBINDD_RESCAN_FREQ
, 0),
541 rescan_trusted_domains
, NULL
);
543 * If te == NULL, there's not much we can do here. Don't fail, the
544 * only thing we miss is new trusted domains.
550 enum winbindd_result
winbindd_dual_init_connection(struct winbindd_domain
*domain
,
551 struct winbindd_cli_state
*state
)
553 /* Ensure null termination */
554 state
->request
->domain_name
555 [sizeof(state
->request
->domain_name
)-1]='\0';
556 state
->request
->data
.init_conn
.dcname
557 [sizeof(state
->request
->data
.init_conn
.dcname
)-1]='\0';
559 if (strlen(state
->request
->data
.init_conn
.dcname
) > 0) {
560 fstrcpy(domain
->dcname
, state
->request
->data
.init_conn
.dcname
);
563 if (domain
->internal
) {
564 domain
->initialized
= true;
566 init_dc_connection(domain
);
569 if (!domain
->initialized
) {
570 /* If we return error here we can't do any cached authentication,
571 but we may be in disconnected mode and can't initialize correctly.
572 Do what the previous code did and just return without initialization,
573 once we go online we'll re-initialize.
575 DEBUG(5, ("winbindd_dual_init_connection: %s returning without initialization "
576 "online = %d\n", domain
->name
, (int)domain
->online
));
579 fstrcpy(state
->response
->data
.domain_info
.name
, domain
->name
);
580 fstrcpy(state
->response
->data
.domain_info
.alt_name
, domain
->alt_name
);
581 sid_to_fstring(state
->response
->data
.domain_info
.sid
, &domain
->sid
);
583 state
->response
->data
.domain_info
.native_mode
584 = domain
->native_mode
;
585 state
->response
->data
.domain_info
.active_directory
586 = domain
->active_directory
;
587 state
->response
->data
.domain_info
.primary
593 /* Look up global info for the winbind daemon */
594 bool init_domain_list(void)
596 struct winbindd_domain
*domain
;
597 int role
= lp_server_role();
599 /* Free existing list */
604 domain
= add_trusted_domain("BUILTIN", NULL
, &builtin_passdb_methods
,
605 &global_sid_Builtin
);
607 setup_domain_child(domain
);
612 domain
= add_trusted_domain(get_global_sam_name(), NULL
,
613 &sam_passdb_methods
, get_global_sam_sid());
615 if ( role
!= ROLE_DOMAIN_MEMBER
) {
616 domain
->primary
= True
;
618 setup_domain_child(domain
);
621 /* Add ourselves as the first entry. */
623 if ( role
== ROLE_DOMAIN_MEMBER
) {
626 if (!secrets_fetch_domain_sid(lp_workgroup(), &our_sid
)) {
627 DEBUG(0, ("Could not fetch our SID - did we join?\n"));
631 domain
= add_trusted_domain( lp_workgroup(), lp_realm(),
632 &cache_methods
, &our_sid
);
634 domain
->primary
= True
;
635 setup_domain_child(domain
);
637 /* Even in the parent winbindd we'll need to
638 talk to the DC, so try and see if we can
639 contact it. Theoretically this isn't neccessary
640 as the init_dc_connection() in init_child_recv()
641 will do this, but we can start detecting the DC
643 set_domain_online_request(domain
);
650 void check_domain_trusted( const char *name
, const DOM_SID
*user_sid
)
652 struct winbindd_domain
*domain
;
656 /* Check if we even care */
658 if (!lp_allow_trusted_domains())
661 domain
= find_domain_from_name_noinit( name
);
665 sid_copy( &dom_sid
, user_sid
);
666 if ( !sid_split_rid( &dom_sid
, &rid
) )
669 /* add the newly discovered trusted domain */
671 domain
= add_trusted_domain( name
, NULL
, &cache_methods
,
677 /* assume this is a trust from a one-way transitive
680 domain
->active_directory
= True
;
681 domain
->domain_flags
= NETR_TRUST_FLAG_OUTBOUND
;
682 domain
->domain_type
= NETR_TRUST_TYPE_UPLEVEL
;
683 domain
->internal
= False
;
684 domain
->online
= True
;
686 setup_domain_child(domain
);
688 wcache_tdc_add_domain( domain
);
694 * Given a domain name, return the struct winbindd domain info for it
696 * @note Do *not* pass lp_workgroup() to this function. domain_list
697 * may modify it's value, and free that pointer. Instead, our local
698 * domain may be found by calling find_our_domain().
702 * @return The domain structure for the named domain, if it is working.
705 struct winbindd_domain
*find_domain_from_name_noinit(const char *domain_name
)
707 struct winbindd_domain
*domain
;
709 /* Search through list */
711 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
712 if (strequal(domain_name
, domain
->name
) ||
713 (domain
->alt_name
[0] &&
714 strequal(domain_name
, domain
->alt_name
))) {
724 struct winbindd_domain
*find_domain_from_name(const char *domain_name
)
726 struct winbindd_domain
*domain
;
728 domain
= find_domain_from_name_noinit(domain_name
);
733 if (!domain
->initialized
)
734 init_dc_connection(domain
);
739 /* Given a domain sid, return the struct winbindd domain info for it */
741 struct winbindd_domain
*find_domain_from_sid_noinit(const DOM_SID
*sid
)
743 struct winbindd_domain
*domain
;
745 /* Search through list */
747 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
748 if (sid_compare_domain(sid
, &domain
->sid
) == 0)
757 /* Given a domain sid, return the struct winbindd domain info for it */
759 struct winbindd_domain
*find_domain_from_sid(const DOM_SID
*sid
)
761 struct winbindd_domain
*domain
;
763 domain
= find_domain_from_sid_noinit(sid
);
768 if (!domain
->initialized
)
769 init_dc_connection(domain
);
774 struct winbindd_domain
*find_our_domain(void)
776 struct winbindd_domain
*domain
;
778 /* Search through list */
780 for (domain
= domain_list(); domain
!= NULL
; domain
= domain
->next
) {
785 smb_panic("Could not find our domain");
789 struct winbindd_domain
*find_root_domain(void)
791 struct winbindd_domain
*ours
= find_our_domain();
793 if (ours
->forest_name
[0] == '\0') {
797 return find_domain_from_name( ours
->forest_name
);
800 struct winbindd_domain
*find_builtin_domain(void)
802 struct winbindd_domain
*domain
;
804 domain
= find_domain_from_sid(&global_sid_Builtin
);
805 if (domain
== NULL
) {
806 smb_panic("Could not find BUILTIN domain");
812 /* Find the appropriate domain to lookup a name or SID */
814 struct winbindd_domain
*find_lookup_domain_from_sid(const DOM_SID
*sid
)
816 /* SIDs in the S-1-22-{1,2} domain should be handled by our passdb */
818 if ( sid_check_is_in_unix_groups(sid
) ||
819 sid_check_is_unix_groups(sid
) ||
820 sid_check_is_in_unix_users(sid
) ||
821 sid_check_is_unix_users(sid
) )
823 return find_domain_from_sid(get_global_sam_sid());
826 /* A DC can't ask the local smbd for remote SIDs, here winbindd is the
827 * one to contact the external DC's. On member servers the internal
828 * domains are different: These are part of the local SAM. */
830 DEBUG(10, ("find_lookup_domain_from_sid(%s)\n", sid_string_dbg(sid
)));
832 if (IS_DC
|| is_internal_domain(sid
) || is_in_internal_domain(sid
)) {
833 DEBUG(10, ("calling find_domain_from_sid\n"));
834 return find_domain_from_sid(sid
);
837 /* On a member server a query for SID or name can always go to our
840 DEBUG(10, ("calling find_our_domain\n"));
841 return find_our_domain();
844 struct winbindd_domain
*find_lookup_domain_from_name(const char *domain_name
)
846 if ( strequal(domain_name
, unix_users_domain_name() ) ||
847 strequal(domain_name
, unix_groups_domain_name() ) )
850 * The "Unix User" and "Unix Group" domain our handled by
853 return find_domain_from_name_noinit( get_global_sam_name() );
856 if (IS_DC
|| strequal(domain_name
, "BUILTIN") ||
857 strequal(domain_name
, get_global_sam_name()))
858 return find_domain_from_name_noinit(domain_name
);
861 return find_our_domain();
864 /* Is this a domain which we may assume no DOMAIN\ prefix? */
866 static bool assume_domain(const char *domain
)
868 /* never assume the domain on a standalone server */
870 if ( lp_server_role() == ROLE_STANDALONE
)
873 /* domain member servers may possibly assume for the domain name */
875 if ( lp_server_role() == ROLE_DOMAIN_MEMBER
) {
876 if ( !strequal(lp_workgroup(), domain
) )
879 if ( lp_winbind_use_default_domain() || lp_winbind_trusted_domains_only() )
883 /* only left with a domain controller */
885 if ( strequal(get_global_sam_name(), domain
) ) {
892 /* Parse a string of the form DOMAIN\user into a domain and a user */
894 bool parse_domain_user(const char *domuser
, fstring domain
, fstring user
)
896 char *p
= strchr(domuser
,*lp_winbind_separator());
899 fstrcpy(user
, domuser
);
901 if ( assume_domain(lp_workgroup())) {
902 fstrcpy(domain
, lp_workgroup());
903 } else if ((p
= strchr(domuser
, '@')) != NULL
) {
904 fstrcpy(domain
, p
+ 1);
905 user
[PTR_DIFF(p
, domuser
)] = 0;
911 fstrcpy(domain
, domuser
);
912 domain
[PTR_DIFF(p
, domuser
)] = 0;
920 bool parse_domain_user_talloc(TALLOC_CTX
*mem_ctx
, const char *domuser
,
921 char **domain
, char **user
)
923 fstring fstr_domain
, fstr_user
;
924 if (!parse_domain_user(domuser
, fstr_domain
, fstr_user
)) {
927 *domain
= talloc_strdup(mem_ctx
, fstr_domain
);
928 *user
= talloc_strdup(mem_ctx
, fstr_user
);
929 return ((*domain
!= NULL
) && (*user
!= NULL
));
932 /* add a domain user name to a buffer */
933 void parse_add_domuser(void *buf
, char *domuser
, int *len
)
939 p
= strchr(domuser
, *lp_winbind_separator());
943 fstrcpy(domain
, domuser
);
944 domain
[PTR_DIFF(p
, domuser
)] = 0;
947 if (assume_domain(domain
)) {
950 *len
-= (PTR_DIFF(p
, domuser
));
954 safe_strcpy((char *)buf
, user
, *len
);
957 /* Ensure an incoming username from NSS is fully qualified. Replace the
958 incoming fstring with DOMAIN <separator> user. Returns the same
959 values as parse_domain_user() but also replaces the incoming username.
960 Used to ensure all names are fully qualified within winbindd.
961 Used by the NSS protocols of auth, chauthtok, logoff and ccache_ntlm_auth.
962 The protocol definitions of auth_crap, chng_pswd_auth_crap
963 really should be changed to use this instead of doing things
966 bool canonicalize_username(fstring username_inout
, fstring domain
, fstring user
)
968 if (!parse_domain_user(username_inout
, domain
, user
)) {
971 slprintf(username_inout
, sizeof(fstring
) - 1, "%s%c%s",
972 domain
, *lp_winbind_separator(),
978 Fill DOMAIN\\USERNAME entry accounting 'winbind use default domain' and
979 'winbind separator' options.
981 - omit DOMAIN when 'winbind use default domain = true' and DOMAIN is
984 If we are a PDC or BDC, and this is for our domain, do likewise.
986 Also, if omit DOMAIN if 'winbind trusted domains only = true', as the
987 username is then unqualified in unix
989 We always canonicalize as UPPERCASE DOMAIN, lowercase username.
991 void fill_domain_username(fstring name
, const char *domain
, const char *user
, bool can_assume
)
995 fstrcpy(tmp_user
, user
);
996 strlower_m(tmp_user
);
998 if (can_assume
&& assume_domain(domain
)) {
999 strlcpy(name
, tmp_user
, sizeof(fstring
));
1001 slprintf(name
, sizeof(fstring
) - 1, "%s%c%s",
1002 domain
, *lp_winbind_separator(),
1008 * talloc version of fill_domain_username()
1009 * return NULL on talloc failure.
1011 char *fill_domain_username_talloc(TALLOC_CTX
*mem_ctx
,
1016 char *tmp_user
, *name
;
1018 tmp_user
= talloc_strdup(mem_ctx
, user
);
1019 strlower_m(tmp_user
);
1021 if (can_assume
&& assume_domain(domain
)) {
1024 name
= talloc_asprintf(mem_ctx
, "%s%c%s",
1026 *lp_winbind_separator(),
1028 TALLOC_FREE(tmp_user
);
1035 * Winbindd socket accessor functions
1038 const char *get_winbind_pipe_dir(void)
1040 return lp_parm_const_string(-1, "winbindd", "socket dir", WINBINDD_SOCKET_DIR
);
1043 char *get_winbind_priv_pipe_dir(void)
1045 return lock_path(WINBINDD_PRIV_SOCKET_SUBDIR
);
1048 /* Open the winbindd socket */
1050 static int _winbindd_socket
= -1;
1051 static int _winbindd_priv_socket
= -1;
1053 int open_winbindd_socket(void)
1055 if (_winbindd_socket
== -1) {
1056 _winbindd_socket
= create_pipe_sock(
1057 get_winbind_pipe_dir(), WINBINDD_SOCKET_NAME
, 0755);
1058 DEBUG(10, ("open_winbindd_socket: opened socket fd %d\n",
1062 return _winbindd_socket
;
1065 int open_winbindd_priv_socket(void)
1067 if (_winbindd_priv_socket
== -1) {
1068 _winbindd_priv_socket
= create_pipe_sock(
1069 get_winbind_priv_pipe_dir(), WINBINDD_SOCKET_NAME
, 0750);
1070 DEBUG(10, ("open_winbindd_priv_socket: opened socket fd %d\n",
1071 _winbindd_priv_socket
));
1074 return _winbindd_priv_socket
;
1078 * Client list accessor functions
1081 static struct winbindd_cli_state
*_client_list
;
1082 static int _num_clients
;
1084 /* Return list of all connected clients */
1086 struct winbindd_cli_state
*winbindd_client_list(void)
1088 return _client_list
;
1091 /* Add a connection to the list */
1093 void winbindd_add_client(struct winbindd_cli_state
*cli
)
1095 DLIST_ADD(_client_list
, cli
);
1099 /* Remove a client from the list */
1101 void winbindd_remove_client(struct winbindd_cli_state
*cli
)
1103 DLIST_REMOVE(_client_list
, cli
);
1107 /* Close all open clients */
1109 void winbindd_kill_all_clients(void)
1111 struct winbindd_cli_state
*cl
= winbindd_client_list();
1113 DEBUG(10, ("winbindd_kill_all_clients: going postal\n"));
1116 struct winbindd_cli_state
*next
;
1119 winbindd_remove_client(cl
);
1124 /* Return number of open clients */
1126 int winbindd_num_clients(void)
1128 return _num_clients
;
1131 NTSTATUS
lookup_usergroups_cached(struct winbindd_domain
*domain
,
1132 TALLOC_CTX
*mem_ctx
,
1133 const DOM_SID
*user_sid
,
1134 uint32
*p_num_groups
, DOM_SID
**user_sids
)
1136 struct netr_SamInfo3
*info3
= NULL
;
1137 NTSTATUS status
= NT_STATUS_NO_MEMORY
;
1138 size_t num_groups
= 0;
1140 DEBUG(3,(": lookup_usergroups_cached\n"));
1145 info3
= netsamlogon_cache_get(mem_ctx
, user_sid
);
1147 if (info3
== NULL
) {
1148 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
1151 if (info3
->base
.groups
.count
== 0) {
1153 return NT_STATUS_UNSUCCESSFUL
;
1156 /* Skip Domain local groups outside our domain.
1157 We'll get these from the getsidaliases() RPC call. */
1158 status
= sid_array_from_info3(mem_ctx
, info3
,
1163 if (!NT_STATUS_IS_OK(status
)) {
1169 *p_num_groups
= num_groups
;
1170 status
= (user_sids
!= NULL
) ? NT_STATUS_OK
: NT_STATUS_NO_MEMORY
;
1172 DEBUG(3,(": lookup_usergroups_cached succeeded\n"));
1177 /*********************************************************************
1178 We use this to remove spaces from user and group names
1179 ********************************************************************/
1181 NTSTATUS
normalize_name_map(TALLOC_CTX
*mem_ctx
,
1182 struct winbindd_domain
*domain
,
1188 if (!name
|| !normalized
) {
1189 return NT_STATUS_INVALID_PARAMETER
;
1192 if (!lp_winbind_normalize_names()) {
1193 return NT_STATUS_PROCEDURE_NOT_FOUND
;
1196 /* Alias support and whitespace replacement are mutually
1199 nt_status
= resolve_username_to_alias(mem_ctx
, domain
,
1201 if (NT_STATUS_IS_OK(nt_status
)) {
1202 /* special return code to let the caller know we
1203 mapped to an alias */
1204 return NT_STATUS_FILE_RENAMED
;
1207 /* check for an unreachable domain */
1209 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
1210 DEBUG(5,("normalize_name_map: Setting domain %s offline\n",
1212 set_domain_offline(domain
);
1216 /* deal with whitespace */
1218 *normalized
= talloc_strdup(mem_ctx
, name
);
1219 if (!(*normalized
)) {
1220 return NT_STATUS_NO_MEMORY
;
1223 all_string_sub( *normalized
, " ", "_", 0 );
1225 return NT_STATUS_OK
;
1228 /*********************************************************************
1229 We use this to do the inverse of normalize_name_map()
1230 ********************************************************************/
1232 NTSTATUS
normalize_name_unmap(TALLOC_CTX
*mem_ctx
,
1237 struct winbindd_domain
*domain
= find_our_domain();
1239 if (!name
|| !normalized
) {
1240 return NT_STATUS_INVALID_PARAMETER
;
1243 if (!lp_winbind_normalize_names()) {
1244 return NT_STATUS_PROCEDURE_NOT_FOUND
;
1247 /* Alias support and whitespace replacement are mutally
1250 /* When mapping from an alias to a username, we don't know the
1251 domain. But we only need a domain structure to cache
1252 a successful lookup , so just our own domain structure for
1255 nt_status
= resolve_alias_to_username(mem_ctx
, domain
,
1257 if (NT_STATUS_IS_OK(nt_status
)) {
1258 /* Special return code to let the caller know we mapped
1260 return NT_STATUS_FILE_RENAMED
;
1263 /* check for an unreachable domain */
1265 if (NT_STATUS_EQUAL(nt_status
, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND
)) {
1266 DEBUG(5,("normalize_name_unmap: Setting domain %s offline\n",
1268 set_domain_offline(domain
);
1272 /* deal with whitespace */
1274 *normalized
= talloc_strdup(mem_ctx
, name
);
1275 if (!(*normalized
)) {
1276 return NT_STATUS_NO_MEMORY
;
1279 all_string_sub(*normalized
, "_", " ", 0);
1281 return NT_STATUS_OK
;
1284 /*********************************************************************
1285 ********************************************************************/
1287 bool winbindd_can_contact_domain(struct winbindd_domain
*domain
)
1289 struct winbindd_tdc_domain
*tdc
= NULL
;
1290 TALLOC_CTX
*frame
= talloc_stackframe();
1293 /* We can contact the domain if it is our primary domain */
1295 if (domain
->primary
) {
1299 /* Trust the TDC cache and not the winbindd_domain flags */
1301 if ((tdc
= wcache_tdc_fetch_domain(frame
, domain
->name
)) == NULL
) {
1302 DEBUG(10,("winbindd_can_contact_domain: %s not found in cache\n",
1307 /* Can always contact a domain that is in out forest */
1309 if (tdc
->trust_flags
& NETR_TRUST_FLAG_IN_FOREST
) {
1315 * On a _member_ server, we cannot contact the domain if it
1316 * is running AD and we have no inbound trust.
1320 domain
->active_directory
&&
1321 ((tdc
->trust_flags
& NETR_TRUST_FLAG_INBOUND
) != NETR_TRUST_FLAG_INBOUND
))
1323 DEBUG(10, ("winbindd_can_contact_domain: %s is an AD domain "
1324 "and we have no inbound trust.\n", domain
->name
));
1328 /* Assume everything else is ok (probably not true but what
1334 talloc_destroy(frame
);
1339 /*********************************************************************
1340 ********************************************************************/
1342 bool winbindd_internal_child(struct winbindd_child
*child
)
1344 if ((child
== idmap_child()) || (child
== locator_child())) {
1351 #ifdef HAVE_KRB5_LOCATE_PLUGIN_H
1353 /*********************************************************************
1354 ********************************************************************/
1356 static void winbindd_set_locator_kdc_env(const struct winbindd_domain
*domain
)
1359 char addr
[INET6_ADDRSTRLEN
];
1360 const char *kdc
= NULL
;
1363 if (!domain
|| !domain
->alt_name
|| !*domain
->alt_name
) {
1367 if (domain
->initialized
&& !domain
->active_directory
) {
1368 DEBUG(lvl
,("winbindd_set_locator_kdc_env: %s not AD\n",
1373 print_sockaddr(addr
, sizeof(addr
), &domain
->dcaddr
);
1376 DEBUG(lvl
,("winbindd_set_locator_kdc_env: %s no DC IP\n",
1378 kdc
= domain
->dcname
;
1381 if (!kdc
|| !*kdc
) {
1382 DEBUG(lvl
,("winbindd_set_locator_kdc_env: %s no DC at all\n",
1387 if (asprintf_strupper_m(&var
, "%s_%s", WINBINDD_LOCATOR_KDC_ADDRESS
,
1388 domain
->alt_name
) == -1) {
1392 DEBUG(lvl
,("winbindd_set_locator_kdc_env: setting var: %s to: %s\n",
1395 setenv(var
, kdc
, 1);
1399 /*********************************************************************
1400 ********************************************************************/
1402 void winbindd_set_locator_kdc_envs(const struct winbindd_domain
*domain
)
1404 struct winbindd_domain
*our_dom
= find_our_domain();
1406 winbindd_set_locator_kdc_env(domain
);
1408 if (domain
!= our_dom
) {
1409 winbindd_set_locator_kdc_env(our_dom
);
1413 /*********************************************************************
1414 ********************************************************************/
1416 void winbindd_unset_locator_kdc_env(const struct winbindd_domain
*domain
)
1420 if (!domain
|| !domain
->alt_name
|| !*domain
->alt_name
) {
1424 if (asprintf_strupper_m(&var
, "%s_%s", WINBINDD_LOCATOR_KDC_ADDRESS
,
1425 domain
->alt_name
) == -1) {
1434 void winbindd_set_locator_kdc_envs(const struct winbindd_domain
*domain
)
1439 void winbindd_unset_locator_kdc_env(const struct winbindd_domain
*domain
)
1444 #endif /* HAVE_KRB5_LOCATE_PLUGIN_H */
1446 void set_auth_errors(struct winbindd_response
*resp
, NTSTATUS result
)
1448 resp
->data
.auth
.nt_status
= NT_STATUS_V(result
);
1449 fstrcpy(resp
->data
.auth
.nt_status_string
, nt_errstr(result
));
1451 /* we might have given a more useful error above */
1452 if (*resp
->data
.auth
.error_string
== '\0')
1453 fstrcpy(resp
->data
.auth
.error_string
,
1454 get_friendly_nt_error_msg(result
));
1455 resp
->data
.auth
.pam_error
= nt_status_to_pam(result
);
1458 bool is_domain_offline(const struct winbindd_domain
*domain
)
1460 if (!lp_winbind_offline_logon()) {
1463 if (get_global_winbindd_state_offline()) {
1466 return !domain
->online
;