source3/winbindd/idmap_ldap.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    idmap LDAP backend
   5
   6    Copyright (C) Tim Potter             2000
   7    Copyright (C) Jim McDonough <jmcd@us.ibm.com>        2003
   8    Copyright (C) Gerald Carter          2003
   9    Copyright (C) Simo Sorce             2003-2007
  10    Copyright (C) Michael Adam           2010
  11
  12    This program is free software; you can redistribute it and/or modify
  13    it under the terms of the GNU General Public License as published by
  14    the Free Software Foundation; either version 3 of the License, or
  15    (at your option) any later version.
  16
  17    This program is distributed in the hope that it will be useful,
  18    but WITHOUT ANY WARRANTY; without even the implied warranty of
  19    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  20    GNU General Public License for more details.
  21
  22    You should have received a copy of the GNU General Public License
  23    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  24 */
  25
  26 #include "includes.h"
  27 #include "winbindd.h"
  28 #include "secrets.h"
  29 #include "idmap.h"
  30 #include "idmap_rw.h"
  31 #include "../libcli/security/security.h"
  32
  33 #undef DBGC_CLASS
  34 #define DBGC_CLASS DBGC_IDMAP
  35
  36 #include <lber.h>
  37 #include <ldap.h>
  38
  39 #include "smbldap.h"
  40
  41 static char *idmap_fetch_secret(const char *backend, bool alloc,
  42                                 const char *domain, const char *identity)
  43 {
  44         char *tmp, *ret;
  45         int r;
  46
  47         if (alloc) {
  48                 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
  49         } else {
  50                 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
  51         }
  52
  53         if (r < 0)
  54                 return NULL;
  55
  56         strupper_m(tmp); /* make sure the key is case insensitive */
  57         ret = secrets_fetch_generic(tmp, identity);
  58
  59         SAFE_FREE(tmp);
  60
  61         return ret;
  62 }
  63
  64 struct idmap_ldap_alloc_context {
  65         struct smbldap_state *smbldap_state;
  66         char *url;
  67         char *suffix;
  68         char *user_dn;
  69 };
  70
  71 struct idmap_ldap_context {
  72         struct smbldap_state *smbldap_state;
  73         char *url;
  74         char *suffix;
  75         char *user_dn;
  76         bool anon;
  77         struct idmap_ldap_alloc_context *alloc;
  78         struct idmap_rw_ops *rw_ops;
  79 };
  80
  81 #define CHECK_ALLOC_DONE(mem) do { \
  82         if (!mem) { \
  83                 DEBUG(0, ("Out of memory!\n")); \
  84                 ret = NT_STATUS_NO_MEMORY; \
  85                 goto done; \
  86         } } while (0)
  87
  88 /**********************************************************************
  89  IDMAP ALLOC TDB BACKEND
  90 **********************************************************************/
  91
  92 /*********************************************************************
  93  ********************************************************************/
  94
  95 static NTSTATUS get_credentials( TALLOC_CTX *mem_ctx,
  96                                  struct smbldap_state *ldap_state,
  97                                  const char *config_option,
  98                                  struct idmap_domain *dom,
  99                                  char **dn )
 100 {
 101         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 102         char *secret = NULL;
 103         const char *tmp = NULL;
 104         char *user_dn = NULL;
 105         bool anon = False;
 106
 107         /* assume anonymous if we don't have a specified user */
 108
 109         tmp = lp_parm_const_string(-1, config_option, "ldap_user_dn", NULL);
 110
 111         if ( tmp ) {
 112                 if (!dom) {
 113                         /* only the alloc backend can pass in a NULL dom */
 114                         secret = idmap_fetch_secret("ldap", True,
 115                                                     NULL, tmp);
 116                 } else {
 117                         secret = idmap_fetch_secret("ldap", False,
 118                                                     dom->name, tmp);
 119                 }
 120
 121                 if (!secret) {
 122                         DEBUG(0, ("get_credentials: Unable to fetch "
 123                                   "auth credentials for %s in %s\n",
 124                                   tmp, (dom==NULL)?"ALLOC":dom->name));
 125                         ret = NT_STATUS_ACCESS_DENIED;
 126                         goto done;
 127                 }
 128                 *dn = talloc_strdup(mem_ctx, tmp);
 129                 CHECK_ALLOC_DONE(*dn);
 130         } else {
 131                 if (!fetch_ldap_pw(&user_dn, &secret)) {
 132                         DEBUG(2, ("get_credentials: Failed to lookup ldap "
 133                                   "bind creds. Using anonymous connection.\n"));
 134                         anon = True;
 135                         *dn = NULL;
 136                 } else {
 137                         *dn = talloc_strdup(mem_ctx, user_dn);
 138                         SAFE_FREE( user_dn );
 139                         CHECK_ALLOC_DONE(*dn);
 140                 }
 141         }
 142
 143         smbldap_set_creds(ldap_state, anon, *dn, secret);
 144         ret = NT_STATUS_OK;
 145
 146 done:
 147         SAFE_FREE(secret);
 148
 149         return ret;
 150 }
 151
 152
 153 /**********************************************************************
 154  Verify the sambaUnixIdPool entry in the directory.
 155 **********************************************************************/
 156
 157 static NTSTATUS verify_idpool(struct idmap_domain *dom)
 158 {
 159         NTSTATUS ret;
 160         TALLOC_CTX *mem_ctx;
 161         LDAPMessage *result = NULL;
 162         LDAPMod **mods = NULL;
 163         const char **attr_list;
 164         char *filter;
 165         int count;
 166         int rc;
 167         struct idmap_ldap_context *ctx;
 168
 169         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 170
 171         mem_ctx = talloc_new(ctx);
 172         if (mem_ctx == NULL) {
 173                 DEBUG(0, ("Out of memory!\n"));
 174                 return NT_STATUS_NO_MEMORY;
 175         }
 176
 177         filter = talloc_asprintf(mem_ctx, "(objectclass=%s)", LDAP_OBJ_IDPOOL);
 178         CHECK_ALLOC_DONE(filter);
 179
 180         attr_list = get_attr_list(mem_ctx, idpool_attr_list);
 181         CHECK_ALLOC_DONE(attr_list);
 182
 183         rc = smbldap_search(ctx->smbldap_state,
 184                                 ctx->suffix,
 185                                 LDAP_SCOPE_SUBTREE,
 186                                 filter,
 187                                 attr_list,
 188                                 0,
 189                                 &result);
 190
 191         if (rc != LDAP_SUCCESS) {
 192                 DEBUG(1, ("Unable to verify the idpool, "
 193                           "cannot continue initialization!\n"));
 194                 return NT_STATUS_UNSUCCESSFUL;
 195         }
 196
 197         count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
 198
 199         ldap_msgfree(result);
 200
 201         if ( count > 1 ) {
 202                 DEBUG(0,("Multiple entries returned from %s (base == %s)\n",
 203                         filter, ctx->suffix));
 204                 ret = NT_STATUS_UNSUCCESSFUL;
 205                 goto done;
 206         }
 207         else if (count == 0) {
 208                 char *uid_str, *gid_str;
 209
 210                 uid_str = talloc_asprintf(mem_ctx, "%lu",
 211                                 (unsigned long)dom->low_id);
 212                 gid_str = talloc_asprintf(mem_ctx, "%lu",
 213                                 (unsigned long)dom->low_id);
 214
 215                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 216                                 "objectClass", LDAP_OBJ_IDPOOL);
 217                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 218                                 get_attr_key2string(idpool_attr_list,
 219                                                     LDAP_ATTR_UIDNUMBER),
 220                                 uid_str);
 221                 smbldap_set_mod(&mods, LDAP_MOD_ADD,
 222                                 get_attr_key2string(idpool_attr_list,
 223                                                     LDAP_ATTR_GIDNUMBER),
 224                                 gid_str);
 225                 if (mods) {
 226                         rc = smbldap_modify(ctx->smbldap_state,
 227                                                 ctx->suffix,
 228                                                 mods);
 229                         ldap_mods_free(mods, True);
 230                 } else {
 231                         ret = NT_STATUS_UNSUCCESSFUL;
 232                         goto done;
 233                 }
 234         }
 235
 236         ret = (rc == LDAP_SUCCESS)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
 237 done:
 238         talloc_free(mem_ctx);
 239         return ret;
 240 }
 241
 242 /*****************************************************************************
 243  Initialise idmap database.
 244 *****************************************************************************/
 245
 246 static int idmap_ldap_alloc_close_destructor(struct idmap_ldap_alloc_context *ctx)
 247 {
 248         smbldap_free_struct(&ctx->smbldap_state);
 249         DEBUG(5,("The connection to the LDAP server was closed\n"));
 250         /* maybe free the results here --metze */
 251         return 0;
 252 }
 253
 254 /********************************
 255  Allocate a new uid or gid
 256 ********************************/
 257
 258 static NTSTATUS idmap_ldap_allocate_id(struct idmap_domain *dom,
 259                                        struct unixid *xid)
 260 {
 261         TALLOC_CTX *mem_ctx;
 262         NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
 263         int rc = LDAP_SERVER_DOWN;
 264         int count = 0;
 265         LDAPMessage *result = NULL;
 266         LDAPMessage *entry = NULL;
 267         LDAPMod **mods = NULL;
 268         char *id_str;
 269         char *new_id_str;
 270         char *filter = NULL;
 271         const char *dn = NULL;
 272         const char **attr_list;
 273         const char *type;
 274         struct idmap_ldap_context *ctx;
 275
 276         /* Only do query if we are online */
 277         if (idmap_is_offline()) {
 278                 return NT_STATUS_FILE_IS_OFFLINE;
 279         }
 280
 281         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 282
 283         if (!ctx->alloc) {
 284                 return NT_STATUS_UNSUCCESSFUL;
 285         }
 286
 287         mem_ctx = talloc_new(ctx->alloc);
 288         if (!mem_ctx) {
 289                 DEBUG(0, ("Out of memory!\n"));
 290                 return NT_STATUS_NO_MEMORY;
 291         }
 292
 293         /* get type */
 294         switch (xid->type) {
 295
 296         case ID_TYPE_UID:
 297                 type = get_attr_key2string(idpool_attr_list,
 298                                            LDAP_ATTR_UIDNUMBER);
 299                 break;
 300
 301         case ID_TYPE_GID:
 302                 type = get_attr_key2string(idpool_attr_list,
 303                                            LDAP_ATTR_GIDNUMBER);
 304                 break;
 305
 306         default:
 307                 DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
 308                 return NT_STATUS_INVALID_PARAMETER;
 309         }
 310
 311         filter = talloc_asprintf(mem_ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
 312         CHECK_ALLOC_DONE(filter);
 313
 314         attr_list = get_attr_list(mem_ctx, idpool_attr_list);
 315         CHECK_ALLOC_DONE(attr_list);
 316
 317         DEBUG(10, ("Search of the id pool (filter: %s)\n", filter));
 318
 319         rc = smbldap_search(ctx->alloc->smbldap_state,
 320                                 ctx->alloc->suffix,
 321                                LDAP_SCOPE_SUBTREE, filter,
 322                                attr_list, 0, &result);
 323
 324         if (rc != LDAP_SUCCESS) {
 325                 DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
 326                 goto done;
 327         }
 328
 329         talloc_autofree_ldapmsg(mem_ctx, result);
 330
 331         count = ldap_count_entries(ctx->alloc->smbldap_state->ldap_struct,
 332                                    result);
 333         if (count != 1) {
 334                 DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
 335                 goto done;
 336         }
 337
 338         entry = ldap_first_entry(ctx->alloc->smbldap_state->ldap_struct,
 339                                  result);
 340
 341         dn = smbldap_talloc_dn(mem_ctx,
 342                                ctx->alloc->smbldap_state->ldap_struct,
 343                                entry);
 344         if ( ! dn) {
 345                 goto done;
 346         }
 347
 348         id_str = smbldap_talloc_single_attribute(
 349                                 ctx->alloc->smbldap_state->ldap_struct,
 350                                 entry, type, mem_ctx);
 351         if (id_str == NULL) {
 352                 DEBUG(0,("%s attribute not found\n", type));
 353                 ret = NT_STATUS_UNSUCCESSFUL;
 354                 goto done;
 355         }
 356
 357         xid->id = strtoul(id_str, NULL, 10);
 358
 359         /* make sure we still have room to grow */
 360
 361         switch (xid->type) {
 362         case ID_TYPE_UID:
 363                 if (xid->id > dom->high_id) {
 364                         DEBUG(0,("Cannot allocate uid above %lu!\n",
 365                                  (unsigned long)dom->high_id));
 366                         goto done;
 367                 }
 368                 break;
 369
 370         case ID_TYPE_GID:
 371                 if (xid->id > dom->high_id) {
 372                         DEBUG(0,("Cannot allocate gid above %lu!\n",
 373                                  (unsigned long)dom->high_id));
 374                         goto done;
 375                 }
 376                 break;
 377
 378         default:
 379                 /* impossible */
 380                 goto done;
 381         }
 382
 383         new_id_str = talloc_asprintf(mem_ctx, "%lu", (unsigned long)xid->id + 1);
 384         if ( ! new_id_str) {
 385                 DEBUG(0,("Out of memory\n"));
 386                 ret = NT_STATUS_NO_MEMORY;
 387                 goto done;
 388         }
 389
 390         smbldap_set_mod(&mods, LDAP_MOD_DELETE, type, id_str);
 391         smbldap_set_mod(&mods, LDAP_MOD_ADD, type, new_id_str);
 392
 393         if (mods == NULL) {
 394                 DEBUG(0,("smbldap_set_mod() failed.\n"));
 395                 goto done;
 396         }
 397
 398         DEBUG(10, ("Try to atomically increment the id (%s -> %s)\n",
 399                    id_str, new_id_str));
 400
 401         rc = smbldap_modify(ctx->alloc->smbldap_state, dn, mods);
 402
 403         ldap_mods_free(mods, True);
 404
 405         if (rc != LDAP_SUCCESS) {
 406                 DEBUG(1,("Failed to allocate new %s. "
 407                          "smbldap_modify() failed.\n", type));
 408                 goto done;
 409         }
 410
 411         ret = NT_STATUS_OK;
 412
 413 done:
 414         talloc_free(mem_ctx);
 415         return ret;
 416 }
 417
 418 /**
 419  * Allocate a new unix-ID.
 420  * For now this is for the default idmap domain only.
 421  * Should be extended later on.
 422  */
 423 static NTSTATUS idmap_ldap_get_new_id(struct idmap_domain *dom,
 424                                       struct unixid *id)
 425 {
 426         NTSTATUS ret;
 427
 428         if (!strequal(dom->name, "*")) {
 429                 DEBUG(3, ("idmap_ldap_get_new_id: "
 430                           "Refusing allocation of a new unixid for domain'%s'. "
 431                           "Currently only supported for the default "
 432                           "domain \"*\".\n",
 433                            dom->name));
 434                 return NT_STATUS_NOT_IMPLEMENTED;
 435         }
 436
 437         ret = idmap_ldap_allocate_id(dom, id);
 438
 439         return ret;
 440 }
 441
 442
 443 /**********************************************************************
 444  IDMAP MAPPING LDAP BACKEND
 445 **********************************************************************/
 446
 447 static int idmap_ldap_close_destructor(struct idmap_ldap_context *ctx)
 448 {
 449         smbldap_free_struct(&ctx->smbldap_state);
 450         DEBUG(5,("The connection to the LDAP server was closed\n"));
 451         /* maybe free the results here --metze */
 452
 453         return 0;
 454 }
 455
 456 /********************************
 457  Initialise idmap database.
 458 ********************************/
 459
 460 static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
 461                                        const struct id_map *map);
 462
 463 static NTSTATUS idmap_ldap_db_init(struct idmap_domain *dom,
 464                                    const char *params)
 465 {
 466         NTSTATUS ret;
 467         struct idmap_ldap_context *ctx = NULL;
 468         char *config_option = NULL;
 469         const char *tmp = NULL;
 470
 471         /* Only do init if we are online */
 472         if (idmap_is_offline()) {
 473                 return NT_STATUS_FILE_IS_OFFLINE;
 474         }
 475
 476         ctx = TALLOC_ZERO_P(dom, struct idmap_ldap_context);
 477         if ( ! ctx) {
 478                 DEBUG(0, ("Out of memory!\n"));
 479                 return NT_STATUS_NO_MEMORY;
 480         }
 481
 482         if (strequal(dom->name, "*")) {
 483                 /* more specific configuration can go here */
 484         } else {
 485                 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
 486                 if ( ! config_option) {
 487                         DEBUG(0, ("Out of memory!\n"));
 488                         ret = NT_STATUS_NO_MEMORY;
 489                         goto done;
 490                 }
 491         }
 492
 493         if (params != NULL) {
 494                 /* assume location is the only parameter */
 495                 ctx->url = talloc_strdup(ctx, params);
 496         } else {
 497                 tmp = lp_parm_const_string(-1, config_option, "ldap_url", NULL);
 498
 499                 if ( ! tmp) {
 500                         DEBUG(1, ("ERROR: missing idmap ldap url\n"));
 501                         ret = NT_STATUS_UNSUCCESSFUL;
 502                         goto done;
 503                 }
 504
 505                 ctx->url = talloc_strdup(ctx, tmp);
 506         }
 507         CHECK_ALLOC_DONE(ctx->url);
 508
 509         trim_char(ctx->url, '\"', '\"');
 510
 511         tmp = lp_parm_const_string(-1, config_option, "ldap_base_dn", NULL);
 512         if ( ! tmp || ! *tmp) {
 513                 tmp = lp_ldap_idmap_suffix();
 514                 if ( ! tmp) {
 515                         DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
 516                         ret = NT_STATUS_UNSUCCESSFUL;
 517                         goto done;
 518                 }
 519         }
 520
 521         ctx->suffix = talloc_strdup(ctx, tmp);
 522         CHECK_ALLOC_DONE(ctx->suffix);
 523
 524         ctx->rw_ops = talloc_zero(ctx, struct idmap_rw_ops);
 525         CHECK_ALLOC_DONE(ctx->rw_ops);
 526
 527         ctx->rw_ops->get_new_id = idmap_ldap_get_new_id;
 528         ctx->rw_ops->set_mapping = idmap_ldap_set_mapping;
 529
 530         ret = smbldap_init(ctx, winbind_event_context(), ctx->url,
 531                            &ctx->smbldap_state);
 532         if (!NT_STATUS_IS_OK(ret)) {
 533                 DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n", ctx->url));
 534                 goto done;
 535         }
 536
 537         ret = get_credentials( ctx, ctx->smbldap_state, config_option,
 538                                dom, &ctx->user_dn );
 539         if ( !NT_STATUS_IS_OK(ret) ) {
 540                 DEBUG(1,("idmap_ldap_db_init: Failed to get connection "
 541                          "credentials (%s)\n", nt_errstr(ret)));
 542                 goto done;
 543         }
 544
 545         /* set the destructor on the context, so that resource are properly
 546            freed if the contexts is released */
 547
 548         talloc_set_destructor(ctx, idmap_ldap_close_destructor);
 549
 550         dom->private_data = ctx;
 551
 552         ret = verify_idpool(dom);
 553         if (!NT_STATUS_IS_OK(ret)) {
 554                 DEBUG(1, ("idmap_ldap_db_init: failed to verify ID pool (%s)\n",
 555                          nt_errstr(ret)));
 556                 goto done;
 557         }
 558
 559         talloc_free(config_option);
 560         return NT_STATUS_OK;
 561
 562 /*failed */
 563 done:
 564         talloc_free(ctx);
 565         return ret;
 566 }
 567
 568 /**
 569  * set a mapping.
 570  */
 571
 572 /* TODO: change this:  This function cannot be called to modify a mapping,
 573  * only set a new one */
 574
 575 static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
 576                                        const struct id_map *map)
 577 {
 578         NTSTATUS ret;
 579         TALLOC_CTX *memctx;
 580         struct idmap_ldap_context *ctx;
 581         LDAPMessage *entry = NULL;
 582         LDAPMod **mods = NULL;
 583         const char *type;
 584         char *id_str;
 585         char *sid;
 586         char *dn;
 587         int rc = -1;
 588
 589         /* Only do query if we are online */
 590         if (idmap_is_offline()) {
 591                 return NT_STATUS_FILE_IS_OFFLINE;
 592         }
 593
 594         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 595
 596         switch(map->xid.type) {
 597         case ID_TYPE_UID:
 598                 type = get_attr_key2string(sidmap_attr_list,
 599                                            LDAP_ATTR_UIDNUMBER);
 600                 break;
 601
 602         case ID_TYPE_GID:
 603                 type = get_attr_key2string(sidmap_attr_list,
 604                                            LDAP_ATTR_GIDNUMBER);
 605                 break;
 606
 607         default:
 608                 return NT_STATUS_INVALID_PARAMETER;
 609         }
 610
 611         memctx = talloc_new(ctx);
 612         if ( ! memctx) {
 613                 DEBUG(0, ("Out of memory!\n"));
 614                 return NT_STATUS_NO_MEMORY;
 615         }
 616
 617         id_str = talloc_asprintf(memctx, "%lu", (unsigned long)map->xid.id);
 618         CHECK_ALLOC_DONE(id_str);
 619
 620         sid = talloc_strdup(memctx, sid_string_talloc(memctx, map->sid));
 621         CHECK_ALLOC_DONE(sid);
 622
 623         dn = talloc_asprintf(memctx, "%s=%s,%s",
 624                         get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
 625                         sid,
 626                         ctx->suffix);
 627         CHECK_ALLOC_DONE(dn);
 628
 629         smbldap_set_mod(&mods, LDAP_MOD_ADD,
 630                         "objectClass", LDAP_OBJ_IDMAP_ENTRY);
 631
 632         smbldap_make_mod(ctx->smbldap_state->ldap_struct,
 633                          entry, &mods, type, id_str);
 634
 635         smbldap_make_mod(ctx->smbldap_state->ldap_struct, entry, &mods,
 636                          get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
 637                          sid);
 638
 639         if ( ! mods) {
 640                 DEBUG(2, ("ERROR: No mods?\n"));
 641                 ret = NT_STATUS_UNSUCCESSFUL;
 642                 goto done;
 643         }
 644
 645         /* TODO: remove conflicting mappings! */
 646
 647         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SID_ENTRY);
 648
 649         DEBUG(10, ("Set DN %s (%s -> %s)\n", dn, sid, id_str));
 650
 651         rc = smbldap_add(ctx->smbldap_state, dn, mods);
 652         ldap_mods_free(mods, True);
 653
 654         if (rc != LDAP_SUCCESS) {
 655                 char *ld_error = NULL;
 656                 ldap_get_option(ctx->smbldap_state->ldap_struct,
 657                                 LDAP_OPT_ERROR_STRING, &ld_error);
 658                 DEBUG(0,("ldap_set_mapping_internals: Failed to add %s to %lu "
 659                          "mapping [%s]\n", sid,
 660                          (unsigned long)map->xid.id, type));
 661                 DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n",
 662                         ld_error ? ld_error : "(NULL)", ldap_err2string (rc)));
 663                 if (ld_error) {
 664                         ldap_memfree(ld_error);
 665                 }
 666                 ret = NT_STATUS_UNSUCCESSFUL;
 667                 goto done;
 668         }
 669
 670         DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to "
 671                   "%lu [%s]\n", sid, (unsigned long)map->xid.id, type));
 672
 673         ret = NT_STATUS_OK;
 674
 675 done:
 676         talloc_free(memctx);
 677         return ret;
 678 }
 679
 680 /**
 681  * Create a new mapping for an unmapped SID, also allocating a new ID.
 682  * If possible, this should be run inside a transaction to make the
 683  * action atomic.
 684  */
 685 static NTSTATUS idmap_ldap_new_mapping(struct idmap_domain *dom, struct id_map *map)
 686 {
 687         NTSTATUS ret;
 688         struct idmap_ldap_context *ctx;
 689
 690         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 691
 692         ret = idmap_rw_new_mapping(dom, ctx->rw_ops, map);
 693
 694         return ret;
 695 }
 696
 697
 698 /* max number of ids requested per batch query */
 699 #define IDMAP_LDAP_MAX_IDS 30
 700
 701 /**********************************
 702  lookup a set of unix ids.
 703 **********************************/
 704
 705 /* this function searches up to IDMAP_LDAP_MAX_IDS entries
 706  * in maps for a match */
 707 static struct id_map *find_map_by_id(struct id_map **maps,
 708                                      enum id_type type,
 709                                      uint32_t id)
 710 {
 711         int i;
 712
 713         for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
 714                 if (maps[i] == NULL) { /* end of the run */
 715                         return NULL;
 716                 }
 717                 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
 718                         return maps[i];
 719                 }
 720         }
 721
 722         return NULL;
 723 }
 724
 725 static NTSTATUS idmap_ldap_unixids_to_sids(struct idmap_domain *dom,
 726                                            struct id_map **ids)
 727 {
 728         NTSTATUS ret;
 729         TALLOC_CTX *memctx;
 730         struct idmap_ldap_context *ctx;
 731         LDAPMessage *result = NULL;
 732         LDAPMessage *entry = NULL;
 733         const char *uidNumber;
 734         const char *gidNumber;
 735         const char **attr_list;
 736         char *filter = NULL;
 737         bool multi = False;
 738         int idx = 0;
 739         int bidx = 0;
 740         int count;
 741         int rc;
 742         int i;
 743
 744         /* Only do query if we are online */
 745         if (idmap_is_offline()) {
 746                 return NT_STATUS_FILE_IS_OFFLINE;
 747         }
 748
 749         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 750
 751         memctx = talloc_new(ctx);
 752         if ( ! memctx) {
 753                 DEBUG(0, ("Out of memory!\n"));
 754                 return NT_STATUS_NO_MEMORY;
 755         }
 756
 757         uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
 758         gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
 759
 760         attr_list = get_attr_list(memctx, sidmap_attr_list);
 761
 762         if ( ! ids[1]) {
 763                 /* if we are requested just one mapping use the simple filter */
 764
 765                 filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%lu))",
 766                                 LDAP_OBJ_IDMAP_ENTRY,
 767                                 (ids[0]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
 768                                 (unsigned long)ids[0]->xid.id);
 769                 CHECK_ALLOC_DONE(filter);
 770                 DEBUG(10, ("Filter: [%s]\n", filter));
 771         } else {
 772                 /* multiple mappings */
 773                 multi = True;
 774         }
 775
 776         for (i = 0; ids[i]; i++) {
 777                 ids[i]->status = ID_UNKNOWN;
 778         }
 779
 780 again:
 781         if (multi) {
 782
 783                 talloc_free(filter);
 784                 filter = talloc_asprintf(memctx,
 785                                          "(&(objectClass=%s)(|",
 786                                          LDAP_OBJ_IDMAP_ENTRY);
 787                 CHECK_ALLOC_DONE(filter);
 788
 789                 bidx = idx;
 790                 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
 791                         filter = talloc_asprintf_append_buffer(filter, "(%s=%lu)",
 792                                         (ids[idx]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
 793                                         (unsigned long)ids[idx]->xid.id);
 794                         CHECK_ALLOC_DONE(filter);
 795                 }
 796                 filter = talloc_asprintf_append_buffer(filter, "))");
 797                 CHECK_ALLOC_DONE(filter);
 798                 DEBUG(10, ("Filter: [%s]\n", filter));
 799         } else {
 800                 bidx = 0;
 801                 idx = 1;
 802         }
 803
 804         rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
 805                 filter, attr_list, 0, &result);
 806
 807         if (rc != LDAP_SUCCESS) {
 808                 DEBUG(3,("Failure looking up ids (%s)\n", ldap_err2string(rc)));
 809                 ret = NT_STATUS_UNSUCCESSFUL;
 810                 goto done;
 811         }
 812
 813         count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
 814
 815         if (count == 0) {
 816                 DEBUG(10, ("NO SIDs found\n"));
 817         }
 818
 819         for (i = 0; i < count; i++) {
 820                 char *sidstr = NULL;
 821                 char *tmp = NULL;
 822                 enum id_type type;
 823                 struct id_map *map;
 824                 uint32_t id;
 825
 826                 if (i == 0) { /* first entry */
 827                         entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
 828                                                  result);
 829                 } else { /* following ones */
 830                         entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
 831                                                 entry);
 832                 }
 833                 if ( ! entry) {
 834                         DEBUG(2, ("ERROR: Unable to fetch ldap entries "
 835                                   "from results\n"));
 836                         break;
 837                 }
 838
 839                 /* first check if the SID is present */
 840                 sidstr = smbldap_talloc_single_attribute(
 841                                 ctx->smbldap_state->ldap_struct,
 842                                 entry, LDAP_ATTRIBUTE_SID, memctx);
 843                 if ( ! sidstr) { /* no sid, skip entry */
 844                         DEBUG(2, ("WARNING SID not found on entry\n"));
 845                         continue;
 846                 }
 847
 848                 /* now try to see if it is a uid, if not try with a gid
 849                  * (gid is more common, but in case both uidNumber and
 850                  * gidNumber are returned the SID is mapped to the uid
 851                  *not the gid) */
 852                 type = ID_TYPE_UID;
 853                 tmp = smbldap_talloc_single_attribute(
 854                                 ctx->smbldap_state->ldap_struct,
 855                                 entry, uidNumber, memctx);
 856                 if ( ! tmp) {
 857                         type = ID_TYPE_GID;
 858                         tmp = smbldap_talloc_single_attribute(
 859                                         ctx->smbldap_state->ldap_struct,
 860                                         entry, gidNumber, memctx);
 861                 }
 862                 if ( ! tmp) { /* wow very strange entry, how did it match ? */
 863                         DEBUG(5, ("Unprobable match on (%s), no uidNumber, "
 864                                   "nor gidNumber returned\n", sidstr));
 865                         TALLOC_FREE(sidstr);
 866                         continue;
 867                 }
 868
 869                 id = strtoul(tmp, NULL, 10);
 870                 if (!idmap_unix_id_is_in_range(id, dom)) {
 871                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
 872                                   "Filtered!\n", id,
 873                                   dom->low_id, dom->high_id));
 874                         TALLOC_FREE(sidstr);
 875                         TALLOC_FREE(tmp);
 876                         continue;
 877                 }
 878                 TALLOC_FREE(tmp);
 879
 880                 map = find_map_by_id(&ids[bidx], type, id);
 881                 if (!map) {
 882                         DEBUG(2, ("WARNING: couldn't match sid (%s) "
 883                                   "with requested ids\n", sidstr));
 884                         TALLOC_FREE(sidstr);
 885                         continue;
 886                 }
 887
 888                 if ( ! string_to_sid(map->sid, sidstr)) {
 889                         DEBUG(2, ("ERROR: Invalid SID on entry\n"));
 890                         TALLOC_FREE(sidstr);
 891                         continue;
 892                 }
 893
 894                 if (map->status == ID_MAPPED) {
 895                         DEBUG(1, ("WARNING: duplicate %s mapping in LDAP. "
 896                               "overwriting mapping %u -> %s with %u -> %s\n",
 897                               (type == ID_TYPE_UID) ? "UID" : "GID",
 898                               id, sid_string_dbg(map->sid), id, sidstr));
 899                 }
 900
 901                 TALLOC_FREE(sidstr);
 902
 903                 /* mapped */
 904                 map->status = ID_MAPPED;
 905
 906                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 907                            (unsigned long)map->xid.id, map->xid.type));
 908         }
 909
 910         /* free the ldap results */
 911         if (result) {
 912                 ldap_msgfree(result);
 913                 result = NULL;
 914         }
 915
 916         if (multi && ids[idx]) { /* still some values to map */
 917                 goto again;
 918         }
 919
 920         ret = NT_STATUS_OK;
 921
 922         /* mark all unknwon/expired ones as unmapped */
 923         for (i = 0; ids[i]; i++) {
 924                 if (ids[i]->status != ID_MAPPED)
 925                         ids[i]->status = ID_UNMAPPED;
 926         }
 927
 928 done:
 929         talloc_free(memctx);
 930         return ret;
 931 }
 932
 933 /**********************************
 934  lookup a set of sids.
 935 **********************************/
 936
 937 /* this function searches up to IDMAP_LDAP_MAX_IDS entries
 938  * in maps for a match */
 939 static struct id_map *find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
 940 {
 941         int i;
 942
 943         for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
 944                 if (maps[i] == NULL) { /* end of the run */
 945                         return NULL;
 946                 }
 947                 if (dom_sid_equal(maps[i]->sid, sid)) {
 948                         return maps[i];
 949                 }
 950         }
 951
 952         return NULL;
 953 }
 954
 955 static NTSTATUS idmap_ldap_sids_to_unixids(struct idmap_domain *dom,
 956                                            struct id_map **ids)
 957 {
 958         LDAPMessage *entry = NULL;
 959         NTSTATUS ret;
 960         TALLOC_CTX *memctx;
 961         struct idmap_ldap_context *ctx;
 962         LDAPMessage *result = NULL;
 963         const char *uidNumber;
 964         const char *gidNumber;
 965         const char **attr_list;
 966         char *filter = NULL;
 967         bool multi = False;
 968         int idx = 0;
 969         int bidx = 0;
 970         int count;
 971         int rc;
 972         int i;
 973
 974         /* Only do query if we are online */
 975         if (idmap_is_offline()) {
 976                 return NT_STATUS_FILE_IS_OFFLINE;
 977         }
 978
 979         ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
 980
 981         memctx = talloc_new(ctx);
 982         if ( ! memctx) {
 983                 DEBUG(0, ("Out of memory!\n"));
 984                 return NT_STATUS_NO_MEMORY;
 985         }
 986
 987         uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
 988         gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
 989
 990         attr_list = get_attr_list(memctx, sidmap_attr_list);
 991
 992         if ( ! ids[1]) {
 993                 /* if we are requested just one mapping use the simple filter */
 994
 995                 filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%s))",
 996                                 LDAP_OBJ_IDMAP_ENTRY,
 997                                 LDAP_ATTRIBUTE_SID,
 998                                 sid_string_talloc(memctx, ids[0]->sid));
 999                 CHECK_ALLOC_DONE(filter);
1000                 DEBUG(10, ("Filter: [%s]\n", filter));
1001         } else {
1002                 /* multiple mappings */
1003                 multi = True;
1004         }
1005
1006         for (i = 0; ids[i]; i++) {
1007                 ids[i]->status = ID_UNKNOWN;
1008         }
1009
1010 again:
1011         if (multi) {
1012
1013                 TALLOC_FREE(filter);
1014                 filter = talloc_asprintf(memctx,
1015                                          "(&(objectClass=%s)(|",
1016                                          LDAP_OBJ_IDMAP_ENTRY);
1017                 CHECK_ALLOC_DONE(filter);
1018
1019                 bidx = idx;
1020                 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
1021                         filter = talloc_asprintf_append_buffer(filter, "(%s=%s)",
1022                                         LDAP_ATTRIBUTE_SID,
1023                                         sid_string_talloc(memctx,
1024                                                           ids[idx]->sid));
1025                         CHECK_ALLOC_DONE(filter);
1026                 }
1027                 filter = talloc_asprintf_append_buffer(filter, "))");
1028                 CHECK_ALLOC_DONE(filter);
1029                 DEBUG(10, ("Filter: [%s]", filter));
1030         } else {
1031                 bidx = 0;
1032                 idx = 1;
1033         }
1034
1035         rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
1036                 filter, attr_list, 0, &result);
1037
1038         if (rc != LDAP_SUCCESS) {
1039                 DEBUG(3,("Failure looking up sids (%s)\n",
1040                          ldap_err2string(rc)));
1041                 ret = NT_STATUS_UNSUCCESSFUL;
1042                 goto done;
1043         }
1044
1045         count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
1046
1047         if (count == 0) {
1048                 DEBUG(10, ("NO SIDs found\n"));
1049         }
1050
1051         for (i = 0; i < count; i++) {
1052                 char *sidstr = NULL;
1053                 char *tmp = NULL;
1054                 enum id_type type;
1055                 struct id_map *map;
1056                 struct dom_sid sid;
1057                 uint32_t id;
1058
1059                 if (i == 0) { /* first entry */
1060                         entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
1061                                                  result);
1062                 } else { /* following ones */
1063                         entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
1064                                                 entry);
1065                 }
1066                 if ( ! entry) {
1067                         DEBUG(2, ("ERROR: Unable to fetch ldap entries "
1068                                   "from results\n"));
1069                         break;
1070                 }
1071
1072                 /* first check if the SID is present */
1073                 sidstr = smbldap_talloc_single_attribute(
1074                                 ctx->smbldap_state->ldap_struct,
1075                                 entry, LDAP_ATTRIBUTE_SID, memctx);
1076                 if ( ! sidstr) { /* no sid ??, skip entry */
1077                         DEBUG(2, ("WARNING SID not found on entry\n"));
1078                         continue;
1079                 }
1080
1081                 if ( ! string_to_sid(&sid, sidstr)) {
1082                         DEBUG(2, ("ERROR: Invalid SID on entry\n"));
1083                         TALLOC_FREE(sidstr);
1084                         continue;
1085                 }
1086
1087                 map = find_map_by_sid(&ids[bidx], &sid);
1088                 if (!map) {
1089                         DEBUG(2, ("WARNING: couldn't find entry sid (%s) "
1090                                   "in ids", sidstr));
1091                         TALLOC_FREE(sidstr);
1092                         continue;
1093                 }
1094
1095                 /* now try to see if it is a uid, if not try with a gid
1096                  * (gid is more common, but in case both uidNumber and
1097                  * gidNumber are returned the SID is mapped to the uid
1098                  * not the gid) */
1099                 type = ID_TYPE_UID;
1100                 tmp = smbldap_talloc_single_attribute(
1101                                 ctx->smbldap_state->ldap_struct,
1102                                 entry, uidNumber, memctx);
1103                 if ( ! tmp) {
1104                         type = ID_TYPE_GID;
1105                         tmp = smbldap_talloc_single_attribute(
1106                                         ctx->smbldap_state->ldap_struct,
1107                                         entry, gidNumber, memctx);
1108                 }
1109                 if ( ! tmp) { /* no ids ?? */
1110                         DEBUG(5, ("no uidNumber, "
1111                                   "nor gidNumber attributes found\n"));
1112                         TALLOC_FREE(sidstr);
1113                         continue;
1114                 }
1115
1116                 id = strtoul(tmp, NULL, 10);
1117                 if (!idmap_unix_id_is_in_range(id, dom)) {
1118                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1119                                   "Filtered!\n", id,
1120                                   dom->low_id, dom->high_id));
1121                         TALLOC_FREE(sidstr);
1122                         TALLOC_FREE(tmp);
1123                         continue;
1124                 }
1125                 TALLOC_FREE(tmp);
1126
1127                 if (map->status == ID_MAPPED) {
1128                         DEBUG(1, ("WARNING: duplicate %s mapping in LDAP. "
1129                               "overwriting mapping %s -> %u with %s -> %u\n",
1130                               (type == ID_TYPE_UID) ? "UID" : "GID",
1131                               sidstr, map->xid.id, sidstr, id));
1132                 }
1133
1134                 TALLOC_FREE(sidstr);
1135
1136                 /* mapped */
1137                 map->xid.type = type;
1138                 map->xid.id = id;
1139                 map->status = ID_MAPPED;
1140
1141                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1142                            (unsigned long)map->xid.id, map->xid.type));
1143         }
1144
1145         /* free the ldap results */
1146         if (result) {
1147                 ldap_msgfree(result);
1148                 result = NULL;
1149         }
1150
1151         if (multi && ids[idx]) { /* still some values to map */
1152                 goto again;
1153         }
1154
1155         /*
1156          *  try to create new mappings for unmapped sids
1157          */
1158         for (i = 0; ids[i]; i++) {
1159                 if (ids[i]->status != ID_MAPPED) {
1160                         ids[i]->status = ID_UNMAPPED;
1161                         if (ids[i]->sid != NULL) {
1162                                 ret = idmap_ldap_new_mapping(dom, ids[i]);
1163                                 if (!NT_STATUS_IS_OK(ret)) {
1164                                         goto done;
1165                                 }
1166                         }
1167                 }
1168         }
1169
1170         ret = NT_STATUS_OK;
1171
1172 done:
1173         talloc_free(memctx);
1174         return ret;
1175 }
1176
1177 /**********************************
1178  Close the idmap ldap instance
1179 **********************************/
1180
1181 static NTSTATUS idmap_ldap_close(struct idmap_domain *dom)
1182 {
1183         struct idmap_ldap_context *ctx;
1184
1185         if (dom->private_data) {
1186                 ctx = talloc_get_type(dom->private_data,
1187                                       struct idmap_ldap_context);
1188
1189                 talloc_free(ctx);
1190                 dom->private_data = NULL;
1191         }
1192
1193         return NT_STATUS_OK;
1194 }
1195
1196 static struct idmap_methods idmap_ldap_methods = {
1197
1198         .init = idmap_ldap_db_init,
1199         .unixids_to_sids = idmap_ldap_unixids_to_sids,
1200         .sids_to_unixids = idmap_ldap_sids_to_unixids,
1201         .allocate_id = idmap_ldap_get_new_id,
1202         .close_fn = idmap_ldap_close
1203 };
1204
1205 NTSTATUS idmap_ldap_init(void);
1206 NTSTATUS idmap_ldap_init(void)
1207 {
1208         return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1209                                   &idmap_ldap_methods);
1210 }
1211