source3/winbindd/idmap_ad.c

   1 /*
   2  *  idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
   3  *
   4  * Unix SMB/CIFS implementation.
   5  *
   6  * Winbind ADS backend functions
   7  *
   8  * Copyright (C) Andrew Tridgell 2001
   9  * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
  10  * Copyright (C) Gerald (Jerry) Carter 2004-2007
  11  * Copyright (C) Luke Howard 2001-2004
  12  * Copyright (C) Michael Adam 2008
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 3 of the License, or
  17  * (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  26  */
  27
  28 #include "includes.h"
  29 #include "winbindd.h"
  30 #include "../libds/common/flags.h"
  31
  32 #undef DBGC_CLASS
  33 #define DBGC_CLASS DBGC_IDMAP
  34
  35 #define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
  36
  37 #define IDMAP_AD_MAX_IDS 30
  38 #define CHECK_ALLOC_DONE(mem) do { \
  39      if (!mem) { \
  40            DEBUG(0, ("Out of memory!\n")); \
  41            ret = NT_STATUS_NO_MEMORY; \
  42            goto done; \
  43       } \
  44 } while (0)
  45
  46 struct idmap_ad_context {
  47         uint32_t filter_low_id;
  48         uint32_t filter_high_id;
  49         ADS_STRUCT *ads;
  50         struct posix_schema *ad_schema;
  51         enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
  52 };
  53
  54 NTSTATUS init_module(void);
  55
  56 /************************************************************************
  57  ***********************************************************************/
  58
  59 static ADS_STATUS ad_idmap_cached_connection_internal(struct idmap_domain *dom)
  60 {
  61         ADS_STRUCT *ads;
  62         ADS_STATUS status;
  63         bool local = False;
  64         fstring dc_name;
  65         struct sockaddr_storage dc_ip;
  66         struct idmap_ad_context *ctx;
  67         char *ldap_server = NULL;
  68         char *realm = NULL;
  69         struct winbindd_domain *wb_dom;
  70
  71         DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
  72                    dom->name));
  73
  74         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
  75
  76         if (ctx->ads != NULL) {
  77
  78                 time_t expire;
  79                 time_t now = time(NULL);
  80
  81                 ads = ctx->ads;
  82
  83                 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
  84
  85                 /* check for a valid structure */
  86                 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
  87                           (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
  88
  89                 if ( ads->config.realm && (expire > time(NULL))) {
  90                         return ADS_SUCCESS;
  91                 } else {
  92                         /* we own this ADS_STRUCT so make sure it goes away */
  93                         DEBUG(7,("Deleting expired krb5 credential cache\n"));
  94                         ads->is_mine = True;
  95                         ads_destroy( &ads );
  96                         ads_kdestroy(WINBIND_CCACHE_NAME);
  97                         ctx->ads = NULL;
  98                         TALLOC_FREE( ctx->ad_schema );
  99                 }
 100         }
 101
 102         if (!local) {
 103                 /* we don't want this to affect the users ccache */
 104                 setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
 105         }
 106
 107         /*
 108          * At this point we only have the NetBIOS domain name.
 109          * Check if we can get server nam and realm from SAF cache
 110          * and the domain list.
 111          */
 112         ldap_server = saf_fetch(dom->name);
 113         DEBUG(10, ("ldap_server from saf cache: '%s'\n", ldap_server?ldap_server:""));
 114
 115         wb_dom = find_domain_from_name_noinit(dom->name);
 116         if (wb_dom == NULL) {
 117                 DEBUG(10, ("find_domain_from_name_noinit did not find domain '%s'\n",
 118                            dom->name));
 119                 realm = NULL;
 120         } else {
 121                 DEBUG(10, ("find_domain_from_name_noinit found realm '%s' for "
 122                           " domain '%s'\n", wb_dom->alt_name, dom->name));
 123                 realm = wb_dom->alt_name;
 124         }
 125
 126         if ( (ads = ads_init(realm, dom->name, ldap_server)) == NULL ) {
 127                 DEBUG(1,("ads_init failed\n"));
 128                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
 129         }
 130
 131         /* the machine acct password might have change - fetch it every time */
 132         SAFE_FREE(ads->auth.password);
 133         ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 134
 135         SAFE_FREE(ads->auth.realm);
 136         ads->auth.realm = SMB_STRDUP(lp_realm());
 137
 138         /* setup server affinity */
 139
 140         get_dc_name(dom->name, realm, dc_name, &dc_ip );
 141
 142         status = ads_connect(ads);
 143         if (!ADS_ERR_OK(status)) {
 144                 DEBUG(1, ("ad_idmap_init: failed to connect to AD\n"));
 145                 ads_destroy(&ads);
 146                 return status;
 147         }
 148
 149         ads->is_mine = False;
 150
 151         ctx->ads = ads;
 152
 153         return ADS_SUCCESS;
 154 }
 155
 156 /************************************************************************
 157  ***********************************************************************/
 158
 159 static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
 160 {
 161         ADS_STATUS status;
 162         struct idmap_ad_context * ctx;
 163
 164         status = ad_idmap_cached_connection_internal(dom);
 165         if (!ADS_ERR_OK(status)) {
 166                 return status;
 167         }
 168
 169         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 170
 171         /* if we have a valid ADS_STRUCT and the schema model is
 172            defined, then we can return here. */
 173
 174         if ( ctx->ad_schema ) {
 175                 return ADS_SUCCESS;
 176         }
 177
 178         /* Otherwise, set the schema model */
 179
 180         if ( (ctx->ad_map_type ==  WB_POSIX_MAP_SFU) ||
 181              (ctx->ad_map_type ==  WB_POSIX_MAP_SFU20) ||
 182              (ctx->ad_map_type ==  WB_POSIX_MAP_RFC2307) )
 183         {
 184                 status = ads_check_posix_schema_mapping(NULL, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
 185                 if ( !ADS_ERR_OK(status) ) {
 186                         DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
 187                 }
 188         }
 189
 190         return status;
 191 }
 192
 193 /************************************************************************
 194  ***********************************************************************/
 195
 196 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom,
 197                                     const char *params)
 198 {
 199         struct idmap_ad_context *ctx;
 200         char *config_option;
 201         const char *range = NULL;
 202         const char *schema_mode = NULL;
 203
 204         if ( (ctx = TALLOC_ZERO_P(dom, struct idmap_ad_context)) == NULL ) {
 205                 DEBUG(0, ("Out of memory!\n"));
 206                 return NT_STATUS_NO_MEMORY;
 207         }
 208
 209         if ( (config_option = talloc_asprintf(ctx, "idmap config %s", dom->name)) == NULL ) {
 210                 DEBUG(0, ("Out of memory!\n"));
 211                 talloc_free(ctx);
 212                 return NT_STATUS_NO_MEMORY;
 213         }
 214
 215         /* load ranges */
 216         range = lp_parm_const_string(-1, config_option, "range", NULL);
 217         if (range && range[0]) {
 218                 if ((sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
 219                     (ctx->filter_low_id > ctx->filter_high_id)) {
 220                         DEBUG(1, ("ERROR: invalid filter range [%s]", range));
 221                         ctx->filter_low_id = 0;
 222                         ctx->filter_high_id = 0;
 223                 }
 224         }
 225
 226         /* default map type */
 227         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 228
 229         /* schema mode */
 230         schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
 231         if ( schema_mode && schema_mode[0] ) {
 232                 if ( strequal(schema_mode, "sfu") )
 233                         ctx->ad_map_type = WB_POSIX_MAP_SFU;
 234                 else if ( strequal(schema_mode, "sfu20" ) )
 235                         ctx->ad_map_type = WB_POSIX_MAP_SFU20;
 236                 else if ( strequal(schema_mode, "rfc2307" ) )
 237                         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 238                 else
 239                         DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
 240                                  schema_mode));
 241         }
 242
 243         dom->private_data = ctx;
 244
 245         talloc_free(config_option);
 246
 247         return NT_STATUS_OK;
 248 }
 249
 250 /************************************************************************
 251  Search up to IDMAP_AD_MAX_IDS entries in maps for a match.
 252  ***********************************************************************/
 253
 254 static struct id_map *find_map_by_id(struct id_map **maps, enum id_type type, uint32_t id)
 255 {
 256         int i;
 257
 258         for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
 259                 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
 260                         return maps[i];
 261                 }
 262         }
 263
 264         return NULL;
 265 }
 266
 267 /************************************************************************
 268  Search up to IDMAP_AD_MAX_IDS entries in maps for a match
 269  ***********************************************************************/
 270
 271 static struct id_map *find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
 272 {
 273         int i;
 274
 275         for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
 276                 if (sid_equal(maps[i]->sid, sid)) {
 277                         return maps[i];
 278                 }
 279         }
 280
 281         return NULL;
 282 }
 283
 284 /************************************************************************
 285  ***********************************************************************/
 286
 287 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 288 {
 289         NTSTATUS ret;
 290         TALLOC_CTX *memctx;
 291         struct idmap_ad_context *ctx;
 292         ADS_STATUS rc;
 293         const char *attrs[] = { "sAMAccountType",
 294                                 "objectSid",
 295                                 NULL, /* uidnumber */
 296                                 NULL, /* gidnumber */
 297                                 NULL };
 298         LDAPMessage *res = NULL;
 299         LDAPMessage *entry = NULL;
 300         char *filter = NULL;
 301         int idx = 0;
 302         int bidx = 0;
 303         int count;
 304         int i;
 305         char *u_filter = NULL;
 306         char *g_filter = NULL;
 307
 308         /* initialize the status to avoid suprise */
 309         for (i = 0; ids[i]; i++) {
 310                 ids[i]->status = ID_UNKNOWN;
 311         }
 312
 313         /* Only do query if we are online */
 314         if (idmap_is_offline()) {
 315                 return NT_STATUS_FILE_IS_OFFLINE;
 316         }
 317
 318         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 319
 320         if ( (memctx = talloc_new(ctx)) == NULL ) {
 321                 DEBUG(0, ("Out of memory!\n"));
 322                 return NT_STATUS_NO_MEMORY;
 323         }
 324
 325         rc = ad_idmap_cached_connection(dom);
 326         if (!ADS_ERR_OK(rc)) {
 327                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 328                 ret = NT_STATUS_UNSUCCESSFUL;
 329                 /* ret = ads_ntstatus(rc); */
 330                 goto done;
 331         }
 332
 333         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 334         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 335
 336 again:
 337         bidx = idx;
 338         for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
 339                 switch (ids[idx]->xid.type) {
 340                 case ID_TYPE_UID:
 341                         if ( ! u_filter) {
 342                                 u_filter = talloc_asprintf(memctx, "(&(|"
 343                                                            "(sAMAccountType=%d)"
 344                                                            "(sAMAccountType=%d)"
 345                                                            "(sAMAccountType=%d))(|",
 346                                                            ATYPE_NORMAL_ACCOUNT,
 347                                                            ATYPE_WORKSTATION_TRUST,
 348                                                            ATYPE_INTERDOMAIN_TRUST);
 349                         }
 350                         u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
 351                                                           ctx->ad_schema->posix_uidnumber_attr,
 352                                                           (unsigned long)ids[idx]->xid.id);
 353                         CHECK_ALLOC_DONE(u_filter);
 354                         break;
 355
 356                 case ID_TYPE_GID:
 357                         if ( ! g_filter) {
 358                                 g_filter = talloc_asprintf(memctx, "(&(|"
 359                                                            "(sAMAccountType=%d)"
 360                                                            "(sAMAccountType=%d))(|",
 361                                                            ATYPE_SECURITY_GLOBAL_GROUP,
 362                                                            ATYPE_SECURITY_LOCAL_GROUP);
 363                         }
 364                         g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
 365                                                           ctx->ad_schema->posix_gidnumber_attr,
 366                                                           (unsigned long)ids[idx]->xid.id);
 367                         CHECK_ALLOC_DONE(g_filter);
 368                         break;
 369
 370                 default:
 371                         DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
 372                         ids[idx]->status = ID_UNKNOWN;
 373                         continue;
 374                 }
 375         }
 376         filter = talloc_asprintf(memctx, "(|");
 377         CHECK_ALLOC_DONE(filter);
 378         if ( u_filter) {
 379                 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
 380                 CHECK_ALLOC_DONE(filter);
 381                         TALLOC_FREE(u_filter);
 382         }
 383         if ( g_filter) {
 384                 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
 385                 CHECK_ALLOC_DONE(filter);
 386                 TALLOC_FREE(g_filter);
 387         }
 388         filter = talloc_asprintf_append_buffer(filter, ")");
 389         CHECK_ALLOC_DONE(filter);
 390
 391         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 392         if (!ADS_ERR_OK(rc)) {
 393                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 394                 ret = NT_STATUS_UNSUCCESSFUL;
 395                 goto done;
 396         }
 397
 398         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 399                 DEBUG(10, ("No IDs found\n"));
 400         }
 401
 402         entry = res;
 403         for (i = 0; (i < count) && entry; i++) {
 404                 struct dom_sid sid;
 405                 enum id_type type;
 406                 struct id_map *map;
 407                 uint32_t id;
 408                 uint32_t atype;
 409
 410                 if (i == 0) { /* first entry */
 411                         entry = ads_first_entry(ctx->ads, entry);
 412                 } else { /* following ones */
 413                         entry = ads_next_entry(ctx->ads, entry);
 414                 }
 415
 416                 if ( !entry ) {
 417                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 418                         break;
 419                 }
 420
 421                 /* first check if the SID is present */
 422                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 423                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 424                         continue;
 425                 }
 426
 427                 /* get type */
 428                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 429                         DEBUG(1, ("could not get SAM account type\n"));
 430                         continue;
 431                 }
 432
 433                 switch (atype & 0xF0000000) {
 434                 case ATYPE_SECURITY_GLOBAL_GROUP:
 435                 case ATYPE_SECURITY_LOCAL_GROUP:
 436                         type = ID_TYPE_GID;
 437                         break;
 438                 case ATYPE_NORMAL_ACCOUNT:
 439                 case ATYPE_WORKSTATION_TRUST:
 440                 case ATYPE_INTERDOMAIN_TRUST:
 441                         type = ID_TYPE_UID;
 442                         break;
 443                 default:
 444                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 445                         continue;
 446                 }
 447
 448                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 449                                                  ctx->ad_schema->posix_uidnumber_attr :
 450                                                  ctx->ad_schema->posix_gidnumber_attr,
 451                                      &id))
 452                 {
 453                         DEBUG(1, ("Could not get unix ID\n"));
 454                         continue;
 455                 }
 456
 457                 if ((id == 0) ||
 458                     (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
 459                     (ctx->filter_high_id && (id > ctx->filter_high_id))) {
 460                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 461                                 id, ctx->filter_low_id, ctx->filter_high_id));
 462                         continue;
 463                 }
 464
 465                 map = find_map_by_id(&ids[bidx], type, id);
 466                 if (!map) {
 467                         DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
 468                         continue;
 469                 }
 470
 471                 sid_copy(map->sid, &sid);
 472
 473                 /* mapped */
 474                 map->status = ID_MAPPED;
 475
 476                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 477                            (unsigned long)map->xid.id,
 478                            map->xid.type));
 479         }
 480
 481         if (res) {
 482                 ads_msgfree(ctx->ads, res);
 483         }
 484
 485         if (ids[idx]) { /* still some values to map */
 486                 goto again;
 487         }
 488
 489         ret = NT_STATUS_OK;
 490
 491         /* mark all unknown/expired ones as unmapped */
 492         for (i = 0; ids[i]; i++) {
 493                 if (ids[i]->status != ID_MAPPED)
 494                         ids[i]->status = ID_UNMAPPED;
 495         }
 496
 497 done:
 498         talloc_free(memctx);
 499         return ret;
 500 }
 501
 502 /************************************************************************
 503  ***********************************************************************/
 504
 505 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 506 {
 507         NTSTATUS ret;
 508         TALLOC_CTX *memctx;
 509         struct idmap_ad_context *ctx;
 510         ADS_STATUS rc;
 511         const char *attrs[] = { "sAMAccountType",
 512                                 "objectSid",
 513                                 NULL, /* attr_uidnumber */
 514                                 NULL, /* attr_gidnumber */
 515                                 NULL };
 516         LDAPMessage *res = NULL;
 517         LDAPMessage *entry = NULL;
 518         char *filter = NULL;
 519         int idx = 0;
 520         int bidx = 0;
 521         int count;
 522         int i;
 523         char *sidstr;
 524
 525         /* initialize the status to avoid suprise */
 526         for (i = 0; ids[i]; i++) {
 527                 ids[i]->status = ID_UNKNOWN;
 528         }
 529
 530         /* Only do query if we are online */
 531         if (idmap_is_offline()) {
 532                 return NT_STATUS_FILE_IS_OFFLINE;
 533         }
 534
 535         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 536
 537         if ( (memctx = talloc_new(ctx)) == NULL ) {
 538                 DEBUG(0, ("Out of memory!\n"));
 539                 return NT_STATUS_NO_MEMORY;
 540         }
 541
 542         rc = ad_idmap_cached_connection(dom);
 543         if (!ADS_ERR_OK(rc)) {
 544                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 545                 ret = NT_STATUS_UNSUCCESSFUL;
 546                 /* ret = ads_ntstatus(rc); */
 547                 goto done;
 548         }
 549
 550         if (ctx->ad_schema == NULL) {
 551                 DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
 552                 ret = NT_STATUS_UNSUCCESSFUL;
 553                 goto done;
 554         }
 555
 556         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 557         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 558
 559 again:
 560         filter = talloc_asprintf(memctx, "(&(|"
 561                                  "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
 562                                  "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
 563                                  ")(|",
 564                                  ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
 565                                  ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
 566
 567         CHECK_ALLOC_DONE(filter);
 568
 569         bidx = idx;
 570         for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
 571
 572                 ids[idx]->status = ID_UNKNOWN;
 573
 574                 sidstr = sid_binstring(talloc_tos(), ids[idx]->sid);
 575                 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
 576
 577                 TALLOC_FREE(sidstr);
 578                 CHECK_ALLOC_DONE(filter);
 579         }
 580         filter = talloc_asprintf_append_buffer(filter, "))");
 581         CHECK_ALLOC_DONE(filter);
 582         DEBUG(10, ("Filter: [%s]\n", filter));
 583
 584         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 585         if (!ADS_ERR_OK(rc)) {
 586                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 587                 ret = NT_STATUS_UNSUCCESSFUL;
 588                 goto done;
 589         }
 590
 591         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 592                 DEBUG(10, ("No IDs found\n"));
 593         }
 594
 595         entry = res;
 596         for (i = 0; (i < count) && entry; i++) {
 597                 struct dom_sid sid;
 598                 enum id_type type;
 599                 struct id_map *map;
 600                 uint32_t id;
 601                 uint32_t atype;
 602
 603                 if (i == 0) { /* first entry */
 604                         entry = ads_first_entry(ctx->ads, entry);
 605                 } else { /* following ones */
 606                         entry = ads_next_entry(ctx->ads, entry);
 607                 }
 608
 609                 if ( !entry ) {
 610                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 611                         break;
 612                 }
 613
 614                 /* first check if the SID is present */
 615                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 616                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 617                         continue;
 618                 }
 619
 620                 map = find_map_by_sid(&ids[bidx], &sid);
 621                 if (!map) {
 622                         DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
 623                         continue;
 624                 }
 625
 626                 /* get type */
 627                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 628                         DEBUG(1, ("could not get SAM account type\n"));
 629                         continue;
 630                 }
 631
 632                 switch (atype & 0xF0000000) {
 633                 case ATYPE_SECURITY_GLOBAL_GROUP:
 634                 case ATYPE_SECURITY_LOCAL_GROUP:
 635                         type = ID_TYPE_GID;
 636                         break;
 637                 case ATYPE_NORMAL_ACCOUNT:
 638                 case ATYPE_WORKSTATION_TRUST:
 639                 case ATYPE_INTERDOMAIN_TRUST:
 640                         type = ID_TYPE_UID;
 641                         break;
 642                 default:
 643                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 644                         continue;
 645                 }
 646
 647                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 648                                                  ctx->ad_schema->posix_uidnumber_attr :
 649                                                  ctx->ad_schema->posix_gidnumber_attr,
 650                                      &id))
 651                 {
 652                         DEBUG(1, ("Could not get unix ID\n"));
 653                         continue;
 654                 }
 655                 if ((id == 0) ||
 656                     (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
 657                     (ctx->filter_high_id && (id > ctx->filter_high_id))) {
 658                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 659                                 id, ctx->filter_low_id, ctx->filter_high_id));
 660                         continue;
 661                 }
 662
 663                 /* mapped */
 664                 map->xid.type = type;
 665                 map->xid.id = id;
 666                 map->status = ID_MAPPED;
 667
 668                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 669                            (unsigned long)map->xid.id,
 670                            map->xid.type));
 671         }
 672
 673         if (res) {
 674                 ads_msgfree(ctx->ads, res);
 675         }
 676
 677         if (ids[idx]) { /* still some values to map */
 678                 goto again;
 679         }
 680
 681         ret = NT_STATUS_OK;
 682
 683         /* mark all unknwoni/expired ones as unmapped */
 684         for (i = 0; ids[i]; i++) {
 685                 if (ids[i]->status != ID_MAPPED)
 686                         ids[i]->status = ID_UNMAPPED;
 687         }
 688
 689 done:
 690         talloc_free(memctx);
 691         return ret;
 692 }
 693
 694 /************************************************************************
 695  ***********************************************************************/
 696
 697 static NTSTATUS idmap_ad_close(struct idmap_domain *dom)
 698 {
 699         struct idmap_ad_context * ctx;
 700
 701         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 702
 703         if (ctx->ads != NULL) {
 704                 /* we own this ADS_STRUCT so make sure it goes away */
 705                 ctx->ads->is_mine = True;
 706                 ads_destroy( &ctx->ads );
 707                 ctx->ads = NULL;
 708         }
 709
 710         TALLOC_FREE( ctx->ad_schema );
 711
 712         return NT_STATUS_OK;
 713 }
 714
 715 /*
 716  * nss_info_{sfu,sfu20,rfc2307}
 717  */
 718
 719 /************************************************************************
 720  Initialize the {sfu,sfu20,rfc2307} state
 721  ***********************************************************************/
 722
 723 static const char *wb_posix_map_unknown_string = "WB_POSIX_MAP_UNKNOWN";
 724 static const char *wb_posix_map_template_string = "WB_POSIX_MAP_TEMPLATE";
 725 static const char *wb_posix_map_sfu_string = "WB_POSIX_MAP_SFU";
 726 static const char *wb_posix_map_sfu20_string = "WB_POSIX_MAP_SFU20";
 727 static const char *wb_posix_map_rfc2307_string = "WB_POSIX_MAP_RFC2307";
 728 static const char *wb_posix_map_unixinfo_string = "WB_POSIX_MAP_UNIXINFO";
 729
 730 static const char *ad_map_type_string(enum wb_posix_mapping map_type)
 731 {
 732         switch (map_type) {
 733                 case WB_POSIX_MAP_TEMPLATE:
 734                         return wb_posix_map_template_string;
 735                 case WB_POSIX_MAP_SFU:
 736                         return wb_posix_map_sfu_string;
 737                 case WB_POSIX_MAP_SFU20:
 738                         return wb_posix_map_sfu20_string;
 739                 case WB_POSIX_MAP_RFC2307:
 740                         return wb_posix_map_rfc2307_string;
 741                 case WB_POSIX_MAP_UNIXINFO:
 742                         return wb_posix_map_unixinfo_string;
 743                 default:
 744                         return wb_posix_map_unknown_string;
 745         }
 746 }
 747
 748 static NTSTATUS nss_ad_generic_init(struct nss_domain_entry *e,
 749                                     enum wb_posix_mapping new_ad_map_type)
 750 {
 751         struct idmap_domain *dom;
 752         struct idmap_ad_context *ctx;
 753
 754         if (e->state != NULL) {
 755                 dom = talloc_get_type(e->state, struct idmap_domain);
 756         } else {
 757                 dom = TALLOC_ZERO_P(e, struct idmap_domain);
 758                 if (dom == NULL) {
 759                         DEBUG(0, ("Out of memory!\n"));
 760                         return NT_STATUS_NO_MEMORY;
 761                 }
 762                 e->state = dom;
 763         }
 764
 765         if (e->domain != NULL) {
 766                 dom->name = talloc_strdup(dom, e->domain);
 767                 if (dom->name == NULL) {
 768                         DEBUG(0, ("Out of memory!\n"));
 769                         return NT_STATUS_NO_MEMORY;
 770                 }
 771         }
 772
 773         if (dom->private_data != NULL) {
 774                 ctx = talloc_get_type(dom->private_data,
 775                                       struct idmap_ad_context);
 776         } else {
 777                 ctx = TALLOC_ZERO_P(dom, struct idmap_ad_context);
 778                 if (ctx == NULL) {
 779                         DEBUG(0, ("Out of memory!\n"));
 780                         return NT_STATUS_NO_MEMORY;
 781                 }
 782                 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 783                 dom->private_data = ctx;
 784         }
 785
 786         if ((ctx->ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
 787             (ctx->ad_map_type != new_ad_map_type))
 788         {
 789                 DEBUG(2, ("nss_ad_generic_init: "
 790                           "Warning: overriding previously set posix map type "
 791                           "%s for domain %s with map type %s.\n",
 792                           ad_map_type_string(ctx->ad_map_type),
 793                           dom->name,
 794                           ad_map_type_string(new_ad_map_type)));
 795         }
 796
 797         ctx->ad_map_type = new_ad_map_type;
 798
 799         return NT_STATUS_OK;
 800 }
 801
 802 static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
 803 {
 804         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU);
 805 }
 806
 807 static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
 808 {
 809         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU20);
 810 }
 811
 812 static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
 813 {
 814         return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
 815 }
 816
 817
 818 /************************************************************************
 819  ***********************************************************************/
 820
 821 static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
 822                                   const struct dom_sid *sid,
 823                                   TALLOC_CTX *mem_ctx,
 824                                   ADS_STRUCT *ads,
 825                                   LDAPMessage *msg,
 826                                   const char **homedir,
 827                                   const char **shell,
 828                                   const char **gecos,
 829                                   uint32 *gid )
 830 {
 831         const char *attrs[] = {NULL, /* attr_homedir */
 832                                NULL, /* attr_shell */
 833                                NULL, /* attr_gecos */
 834                                NULL, /* attr_gidnumber */
 835                                NULL };
 836         char *filter = NULL;
 837         LDAPMessage *msg_internal = NULL;
 838         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 839         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 840         char *sidstr = NULL;
 841         struct idmap_domain *dom;
 842         struct idmap_ad_context *ctx;
 843
 844         DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
 845                    sid_string_dbg(sid), e->domain?e->domain:"NULL"));
 846
 847         /* Only do query if we are online */
 848         if (idmap_is_offline()) {
 849                 return NT_STATUS_FILE_IS_OFFLINE;
 850         }
 851
 852         dom = talloc_get_type(e->state, struct idmap_domain);
 853         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 854
 855         ads_status = ad_idmap_cached_connection(dom);
 856         if (!ADS_ERR_OK(ads_status)) {
 857                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 858         }
 859
 860         if (!ctx->ad_schema) {
 861                 DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
 862                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 863         }
 864
 865         if (!sid || !homedir || !shell || !gecos) {
 866                 return NT_STATUS_INVALID_PARAMETER;
 867         }
 868
 869         /* See if we can use the ADS connection struct swe were given */
 870
 871         if (ads) {
 872                 DEBUG(10, ("nss_ad_get_info: using given ads connection and "
 873                            "LDAP message (%p)\n", msg));
 874
 875                 *homedir = ads_pull_string( ads, mem_ctx, msg, ctx->ad_schema->posix_homedir_attr );
 876                 *shell   = ads_pull_string( ads, mem_ctx, msg, ctx->ad_schema->posix_shell_attr );
 877                 *gecos   = ads_pull_string( ads, mem_ctx, msg, ctx->ad_schema->posix_gecos_attr );
 878
 879                 if (gid) {
 880                         if ( !ads_pull_uint32(ads, msg, ctx->ad_schema->posix_gidnumber_attr, gid ) )
 881                                 *gid = (uint32)-1;
 882                 }
 883
 884                 nt_status = NT_STATUS_OK;
 885                 goto done;
 886         }
 887
 888         /* Have to do our own query */
 889
 890         DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
 891                    "own query\n"));
 892
 893         attrs[0] = ctx->ad_schema->posix_homedir_attr;
 894         attrs[1] = ctx->ad_schema->posix_shell_attr;
 895         attrs[2] = ctx->ad_schema->posix_gecos_attr;
 896         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 897
 898         sidstr = sid_binstring(mem_ctx, sid);
 899         filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
 900         TALLOC_FREE(sidstr);
 901
 902         if (!filter) {
 903                 nt_status = NT_STATUS_NO_MEMORY;
 904                 goto done;
 905         }
 906
 907         ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
 908         if (!ADS_ERR_OK(ads_status)) {
 909                 nt_status = ads_ntstatus(ads_status);
 910                 goto done;
 911         }
 912
 913         *homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
 914         *shell   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
 915         *gecos   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
 916
 917         if (gid) {
 918                 if (!ads_pull_uint32(ctx->ads, msg_internal, ctx->ad_schema->posix_gidnumber_attr, gid))
 919                         *gid = (uint32)-1;
 920         }
 921
 922         nt_status = NT_STATUS_OK;
 923
 924 done:
 925         if (msg_internal) {
 926                 ads_msgfree(ctx->ads, msg_internal);
 927         }
 928
 929         return nt_status;
 930 }
 931
 932 /**********************************************************************
 933  *********************************************************************/
 934
 935 static NTSTATUS nss_ad_map_to_alias(TALLOC_CTX *mem_ctx,
 936                                     struct nss_domain_entry *e,
 937                                     const char *name,
 938                                     char **alias)
 939 {
 940         const char *attrs[] = {NULL, /* attr_uid */
 941                                NULL };
 942         char *filter = NULL;
 943         LDAPMessage *msg = NULL;
 944         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 945         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 946         struct idmap_domain *dom;
 947         struct idmap_ad_context *ctx = NULL;
 948
 949         /* Check incoming parameters */
 950
 951         if ( !e || !e->domain || !name || !*alias) {
 952                 nt_status = NT_STATUS_INVALID_PARAMETER;
 953                 goto done;
 954         }
 955
 956         /* Only do query if we are online */
 957
 958         if (idmap_is_offline()) {
 959                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
 960                 goto done;
 961         }
 962
 963         dom = talloc_get_type(e->state, struct idmap_domain);
 964         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 965
 966         ads_status = ad_idmap_cached_connection(dom);
 967         if (!ADS_ERR_OK(ads_status)) {
 968                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 969         }
 970
 971         if (!ctx->ad_schema) {
 972                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
 973                 goto done;
 974         }
 975
 976         attrs[0] = ctx->ad_schema->posix_uid_attr;
 977
 978         filter = talloc_asprintf(mem_ctx,
 979                                  "(sAMAccountName=%s)",
 980                                  name);
 981         if (!filter) {
 982                 nt_status = NT_STATUS_NO_MEMORY;
 983                 goto done;
 984         }
 985
 986         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
 987         if (!ADS_ERR_OK(ads_status)) {
 988                 nt_status = ads_ntstatus(ads_status);
 989                 goto done;
 990         }
 991
 992         *alias = ads_pull_string(ctx->ads, mem_ctx, msg, ctx->ad_schema->posix_uid_attr);
 993
 994         if (!*alias) {
 995                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 996         }
 997
 998         nt_status = NT_STATUS_OK;
 999
1000 done:
1001         if (filter) {
1002                 talloc_destroy(filter);
1003         }
1004         if (msg) {
1005                 ads_msgfree(ctx->ads, msg);
1006         }
1007
1008         return nt_status;
1009 }
1010
1011 /**********************************************************************
1012  *********************************************************************/
1013
1014 static NTSTATUS nss_ad_map_from_alias( TALLOC_CTX *mem_ctx,
1015                                              struct nss_domain_entry *e,
1016                                              const char *alias,
1017                                              char **name )
1018 {
1019         const char *attrs[] = {"sAMAccountName",
1020                                NULL };
1021         char *filter = NULL;
1022         LDAPMessage *msg = NULL;
1023         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
1024         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
1025         char *username;
1026         struct idmap_domain *dom;
1027         struct idmap_ad_context *ctx = NULL;
1028
1029         /* Check incoming parameters */
1030
1031         if ( !alias || !name) {
1032                 nt_status = NT_STATUS_INVALID_PARAMETER;
1033                 goto done;
1034         }
1035
1036         /* Only do query if we are online */
1037
1038         if (idmap_is_offline()) {
1039                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
1040                 goto done;
1041         }
1042
1043         dom = talloc_get_type(e->state, struct idmap_domain);
1044         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
1045
1046         ads_status = ad_idmap_cached_connection(dom);
1047         if (!ADS_ERR_OK(ads_status)) {
1048                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1049         }
1050
1051         if (!ctx->ad_schema) {
1052                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
1053                 goto done;
1054         }
1055
1056         filter = talloc_asprintf(mem_ctx,
1057                                  "(%s=%s)",
1058                                  ctx->ad_schema->posix_uid_attr,
1059                                  alias);
1060         if (!filter) {
1061                 nt_status = NT_STATUS_NO_MEMORY;
1062                 goto done;
1063         }
1064
1065         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
1066         if (!ADS_ERR_OK(ads_status)) {
1067                 nt_status = ads_ntstatus(ads_status);
1068                 goto done;
1069         }
1070
1071         username = ads_pull_string(ctx->ads, mem_ctx, msg,
1072                                    "sAMAccountName");
1073         if (!username) {
1074                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1075         }
1076
1077         *name = talloc_asprintf(mem_ctx, "%s\\%s",
1078                                 lp_workgroup(),
1079                                 username);
1080         if (!*name) {
1081                 nt_status = NT_STATUS_NO_MEMORY;
1082                 goto done;
1083         }
1084
1085         nt_status = NT_STATUS_OK;
1086
1087 done:
1088         if (filter) {
1089                 talloc_destroy(filter);
1090         }
1091         if (msg) {
1092                 ads_msgfree(ctx->ads, msg);
1093         }
1094
1095         return nt_status;
1096 }
1097
1098
1099 /************************************************************************
1100  ***********************************************************************/
1101
1102 static NTSTATUS nss_ad_close( void )
1103 {
1104         /* nothing to do.  All memory is free()'d by the idmap close_fn() */
1105
1106         return NT_STATUS_OK;
1107 }
1108
1109 /************************************************************************
1110  Function dispatch tables for the idmap and nss plugins
1111  ***********************************************************************/
1112
1113 static struct idmap_methods ad_methods = {
1114         .init            = idmap_ad_initialize,
1115         .unixids_to_sids = idmap_ad_unixids_to_sids,
1116         .sids_to_unixids = idmap_ad_sids_to_unixids,
1117         .close_fn        = idmap_ad_close
1118 };
1119
1120 /* The SFU and RFC2307 NSS plugins share everything but the init
1121    function which sets the intended schema model to use */
1122
1123 static struct nss_info_methods nss_rfc2307_methods = {
1124         .init           = nss_rfc2307_init,
1125         .get_nss_info   = nss_ad_get_info,
1126         .map_to_alias   = nss_ad_map_to_alias,
1127         .map_from_alias = nss_ad_map_from_alias,
1128         .close_fn       = nss_ad_close
1129 };
1130
1131 static struct nss_info_methods nss_sfu_methods = {
1132         .init           = nss_sfu_init,
1133         .get_nss_info   = nss_ad_get_info,
1134         .map_to_alias   = nss_ad_map_to_alias,
1135         .map_from_alias = nss_ad_map_from_alias,
1136         .close_fn       = nss_ad_close
1137 };
1138
1139 static struct nss_info_methods nss_sfu20_methods = {
1140         .init           = nss_sfu20_init,
1141         .get_nss_info   = nss_ad_get_info,
1142         .map_to_alias   = nss_ad_map_to_alias,
1143         .map_from_alias = nss_ad_map_from_alias,
1144         .close_fn       = nss_ad_close
1145 };
1146
1147
1148
1149 /************************************************************************
1150  Initialize the plugins
1151  ***********************************************************************/
1152
1153 NTSTATUS idmap_ad_init(void)
1154 {
1155         static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
1156         static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
1157         static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
1158         static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
1159
1160         /* Always register the AD method first in order to get the
1161            idmap_domain interface called */
1162
1163         if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
1164                 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
1165                                                      "ad", &ad_methods);
1166                 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
1167                         return status_idmap_ad;
1168         }
1169
1170         if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
1171                 status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1172                                                             "rfc2307",  &nss_rfc2307_methods );
1173                 if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
1174                         return status_nss_rfc2307;
1175         }
1176
1177         if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
1178                 status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1179                                                         "sfu",  &nss_sfu_methods );
1180                 if ( !NT_STATUS_IS_OK(status_nss_sfu) )
1181                         return status_nss_sfu;
1182         }
1183
1184         if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
1185                 status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1186                                                         "sfu20",  &nss_sfu20_methods );
1187                 if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
1188                         return status_nss_sfu20;
1189         }
1190
1191         return NT_STATUS_OK;
1192 }
1193