2 Unix SMB/CIFS implementation.
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Andrew Tridgell 2000
9 This library is free software; you can redistribute it and/or
10 modify it under the terms of the GNU Library General Public
11 License as published by the Free Software Foundation; either
12 version 2 of the License, or (at your option) any later version.
14 This library is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 Library General Public License for more details.
19 You should have received a copy of the GNU Library General Public
20 License along with this library; if not, write to the
21 Free Software Foundation, Inc., 59 Temple Place - Suite 330,
22 Boston, MA 02111-1307, USA.
26 #include "nsswitch/winbind_nss.h"
29 #define DBGC_CLASS DBGC_WINBIND
31 extern DOM_SID global_sid_NULL
; /* NULL sid */
33 NSS_STATUS
winbindd_request(int req_type
,
34 struct winbindd_request
*request
,
35 struct winbindd_response
*response
);
37 /* Call winbindd to convert a name to a sid */
39 BOOL
winbind_lookup_name(const char *dom_name
, const char *name
, DOM_SID
*sid
,
40 enum SID_NAME_USE
*name_type
)
42 struct winbindd_request request
;
43 struct winbindd_response response
;
46 if (!sid
|| !name_type
)
49 /* Send off request */
52 ZERO_STRUCT(response
);
54 fstrcpy(request
.data
.name
.dom_name
, dom_name
);
55 fstrcpy(request
.data
.name
.name
, name
);
57 if ((result
= winbindd_request(WINBINDD_LOOKUPNAME
, &request
,
58 &response
)) == NSS_STATUS_SUCCESS
) {
59 if (!string_to_sid(sid
, response
.data
.sid
.sid
))
61 *name_type
= (enum SID_NAME_USE
)response
.data
.sid
.type
;
64 return result
== NSS_STATUS_SUCCESS
;
67 /* Call winbindd to convert sid to name */
69 BOOL
winbind_lookup_sid(const DOM_SID
*sid
,
70 fstring dom_name
, fstring name
,
71 enum SID_NAME_USE
*name_type
)
73 struct winbindd_request request
;
74 struct winbindd_response response
;
78 /* Initialise request */
81 ZERO_STRUCT(response
);
83 sid_to_string(sid_str
, sid
);
84 fstrcpy(request
.data
.sid
, sid_str
);
88 result
= winbindd_request(WINBINDD_LOOKUPSID
, &request
, &response
);
92 if (result
== NSS_STATUS_SUCCESS
) {
93 fstrcpy(dom_name
, response
.data
.name
.dom_name
);
94 fstrcpy(name
, response
.data
.name
.name
);
95 *name_type
= (enum SID_NAME_USE
)response
.data
.name
.type
;
97 DEBUG(10, ("winbind_lookup_sid: SUCCESS: SID %s -> %s %s\n",
98 sid_str
, dom_name
, name
));
101 return (result
== NSS_STATUS_SUCCESS
);
104 /* Call winbindd to convert SID to uid */
106 BOOL
winbind_sid_to_uid(uid_t
*puid
, const DOM_SID
*sid
)
108 struct winbindd_request request
;
109 struct winbindd_response response
;
116 /* Initialise request */
118 ZERO_STRUCT(request
);
119 ZERO_STRUCT(response
);
121 sid_to_string(sid_str
, sid
);
122 fstrcpy(request
.data
.sid
, sid_str
);
126 result
= winbindd_request(WINBINDD_SID_TO_UID
, &request
, &response
);
128 /* Copy out result */
130 if (result
== NSS_STATUS_SUCCESS
) {
131 *puid
= response
.data
.uid
;
134 return (result
== NSS_STATUS_SUCCESS
);
137 /* Call winbindd to convert uid to sid */
139 BOOL
winbind_uid_to_sid(DOM_SID
*sid
, uid_t uid
)
141 struct winbindd_request request
;
142 struct winbindd_response response
;
148 /* Initialise request */
150 ZERO_STRUCT(request
);
151 ZERO_STRUCT(response
);
153 request
.data
.uid
= uid
;
157 result
= winbindd_request(WINBINDD_UID_TO_SID
, &request
, &response
);
159 /* Copy out result */
161 if (result
== NSS_STATUS_SUCCESS
) {
162 if (!string_to_sid(sid
, response
.data
.sid
.sid
))
165 sid_copy(sid
, &global_sid_NULL
);
168 return (result
== NSS_STATUS_SUCCESS
);
171 /* Call winbindd to convert SID to gid */
173 BOOL
winbind_sid_to_gid(gid_t
*pgid
, const DOM_SID
*sid
)
175 struct winbindd_request request
;
176 struct winbindd_response response
;
183 /* Initialise request */
185 ZERO_STRUCT(request
);
186 ZERO_STRUCT(response
);
188 sid_to_string(sid_str
, sid
);
189 fstrcpy(request
.data
.sid
, sid_str
);
193 result
= winbindd_request(WINBINDD_SID_TO_GID
, &request
, &response
);
195 /* Copy out result */
197 if (result
== NSS_STATUS_SUCCESS
) {
198 *pgid
= response
.data
.gid
;
201 return (result
== NSS_STATUS_SUCCESS
);
204 /* Call winbindd to convert gid to sid */
206 BOOL
winbind_gid_to_sid(DOM_SID
*sid
, gid_t gid
)
208 struct winbindd_request request
;
209 struct winbindd_response response
;
215 /* Initialise request */
217 ZERO_STRUCT(request
);
218 ZERO_STRUCT(response
);
220 request
.data
.gid
= gid
;
224 result
= winbindd_request(WINBINDD_GID_TO_SID
, &request
, &response
);
226 /* Copy out result */
228 if (result
== NSS_STATUS_SUCCESS
) {
229 if (!string_to_sid(sid
, response
.data
.sid
.sid
))
232 sid_copy(sid
, &global_sid_NULL
);
235 return (result
== NSS_STATUS_SUCCESS
);
238 /* Fetch the list of groups a user is a member of from winbindd. This is
239 used by winbind_getgroups. */
241 static int wb_getgroups(const char *user
, gid_t
**groups
)
243 struct winbindd_request request
;
244 struct winbindd_response response
;
249 fstrcpy(request
.data
.username
, user
);
251 ZERO_STRUCT(response
);
253 result
= winbindd_request(WINBINDD_GETGROUPS
, &request
, &response
);
255 if (result
== NSS_STATUS_SUCCESS
) {
257 /* Return group list. Don't forget to free the group list
260 *groups
= (gid_t
*)response
.extra_data
;
261 return response
.data
.num_entries
;
267 /* Call winbindd to initialise group membership. This is necessary for
268 some systems (i.e RH5.2) that do not have an initgroups function as part
269 of the nss extension. In RH5.2 this is implemented using getgrent()
270 which can be amazingly inefficient as well as having problems with
273 int winbind_initgroups(char *user
, gid_t gid
)
275 gid_t
*tgr
, *groups
= NULL
;
278 /* Call normal initgroups if we are a local user */
280 if (!strchr(user
, *lp_winbind_separator())) {
281 return initgroups(user
, gid
);
284 result
= wb_getgroups(user
, &groups
);
286 DEBUG(10,("winbind_getgroups: %s: result = %s\n", user
,
287 result
== -1 ? "FAIL" : "SUCCESS"));
290 int ngroups
= result
, i
;
291 BOOL is_member
= False
;
293 /* Check to see if the passed gid is already in the list */
295 for (i
= 0; i
< ngroups
; i
++) {
296 if (groups
[i
] == gid
) {
301 /* Add group to list if necessary */
304 tgr
= (gid_t
*)Realloc(groups
, sizeof(gid_t
) * ngroups
+ 1);
313 groups
[ngroups
] = gid
;
319 if (sys_setgroups(ngroups
, groups
) == -1) {
327 /* The call failed. Set errno to something so we don't get
328 a bogus value from the last failed system call. */
333 /* Free response data if necessary */
341 /* Return a list of groups the user is a member of. This function is
342 useful for large systems where inverting the group database would be too
343 time consuming. If size is zero, list is not modified and the total
344 number of groups for the user is returned. */
346 int winbind_getgroups(const char *user
, gid_t
**list
)
349 * Don't do the lookup if the name has no separator _and_ we are not in
350 * 'winbind use default domain' mode.
353 if (!(strchr(user
, *lp_winbind_separator()) || lp_winbind_use_default_domain()))
356 /* Fetch list of groups */
358 return wb_getgroups(user
, list
);
361 /**********************************************************************
362 simple wrapper function to see if winbindd is alive
363 **********************************************************************/
365 BOOL
winbind_ping( void )
369 result
= winbindd_request(WINBINDD_PING
, NULL
, NULL
);
371 return result
== NSS_STATUS_SUCCESS
;
374 /**********************************************************************
375 Ask winbindd to create a local user
376 **********************************************************************/
378 BOOL
winbind_create_user( const char *name
, uint32
*rid
)
380 struct winbindd_request request
;
381 struct winbindd_response response
;
384 if ( !lp_winbind_enable_local_accounts() )
390 DEBUG(10,("winbind_create_user: %s\n", name
));
392 ZERO_STRUCT(request
);
393 ZERO_STRUCT(response
);
395 /* see if the caller wants a new RID returned */
398 request
.flags
= WBFLAG_ALLOCATE_RID
;
400 fstrcpy( request
.data
.acct_mgt
.username
, name
);
401 fstrcpy( request
.data
.acct_mgt
.groupname
, "" );
403 result
= winbindd_request( WINBINDD_CREATE_USER
, &request
, &response
);
406 *rid
= response
.data
.rid
;
408 return result
== NSS_STATUS_SUCCESS
;
411 /**********************************************************************
412 Ask winbindd to create a local group
413 **********************************************************************/
415 BOOL
winbind_create_group( const char *name
, uint32
*rid
)
417 struct winbindd_request request
;
418 struct winbindd_response response
;
421 if ( !lp_winbind_enable_local_accounts() )
427 DEBUG(10,("winbind_create_group: %s\n", name
));
429 ZERO_STRUCT(request
);
430 ZERO_STRUCT(response
);
432 /* see if the caller wants a new RID returned */
435 request
.flags
= WBFLAG_ALLOCATE_RID
;
437 fstrcpy( request
.data
.acct_mgt
.groupname
, name
);
440 result
= winbindd_request( WINBINDD_CREATE_GROUP
, &request
, &response
);
443 *rid
= response
.data
.rid
;
445 return result
== NSS_STATUS_SUCCESS
;
448 /**********************************************************************
449 Ask winbindd to add a user to a local group
450 **********************************************************************/
452 BOOL
winbind_add_user_to_group( const char *user
, const char *group
)
454 struct winbindd_request request
;
455 struct winbindd_response response
;
458 if ( !lp_winbind_enable_local_accounts() )
461 if ( !user
|| !group
)
464 ZERO_STRUCT(request
);
465 ZERO_STRUCT(response
);
467 DEBUG(10,("winbind_add_user_to_group: user(%s), group(%s) \n",
470 fstrcpy( request
.data
.acct_mgt
.username
, user
);
471 fstrcpy( request
.data
.acct_mgt
.groupname
, group
);
473 result
= winbindd_request( WINBINDD_ADD_USER_TO_GROUP
, &request
, &response
);
475 return result
== NSS_STATUS_SUCCESS
;
478 /**********************************************************************
479 Ask winbindd to remove a user to a local group
480 **********************************************************************/
482 BOOL
winbind_remove_user_from_group( const char *user
, const char *group
)
484 struct winbindd_request request
;
485 struct winbindd_response response
;
488 if ( !lp_winbind_enable_local_accounts() )
491 if ( !user
|| !group
)
494 ZERO_STRUCT(request
);
495 ZERO_STRUCT(response
);
497 DEBUG(10,("winbind_remove_user_from_group: user(%s), group(%s) \n",
500 ZERO_STRUCT(response
);
502 fstrcpy( request
.data
.acct_mgt
.username
, user
);
503 fstrcpy( request
.data
.acct_mgt
.groupname
, group
);
505 result
= winbindd_request( WINBINDD_REMOVE_USER_FROM_GROUP
, &request
, &response
);
507 return result
== NSS_STATUS_SUCCESS
;
510 /**********************************************************************
511 Ask winbindd to set the primary group for a user local user
512 **********************************************************************/
514 BOOL
winbind_set_user_primary_group( const char *user
, const char *group
)
516 struct winbindd_request request
;
517 struct winbindd_response response
;
520 if ( !lp_winbind_enable_local_accounts() )
523 if ( !user
|| !group
)
526 ZERO_STRUCT(request
);
527 ZERO_STRUCT(response
);
529 DEBUG(10,("winbind_set_user_primary_group: user(%s), group(%s) \n",
532 fstrcpy( request
.data
.acct_mgt
.username
, user
);
533 fstrcpy( request
.data
.acct_mgt
.groupname
, group
);
535 result
= winbindd_request( WINBINDD_SET_USER_PRIMARY_GROUP
, &request
, &response
);
537 return result
== NSS_STATUS_SUCCESS
;
541 /**********************************************************************
542 Ask winbindd to remove a user from its lists of accounts
543 **********************************************************************/
545 BOOL
winbind_delete_user( const char *user
)
547 struct winbindd_request request
;
548 struct winbindd_response response
;
551 if ( !lp_winbind_enable_local_accounts() )
557 ZERO_STRUCT(request
);
558 ZERO_STRUCT(response
);
560 DEBUG(10,("winbind_delete_user: user (%s)\n", user
));
562 fstrcpy( request
.data
.acct_mgt
.username
, user
);
564 result
= winbindd_request( WINBINDD_DELETE_USER
, &request
, &response
);
566 return result
== NSS_STATUS_SUCCESS
;
569 /**********************************************************************
570 Ask winbindd to remove a group from its lists of accounts
571 **********************************************************************/
573 BOOL
winbind_delete_group( const char *group
)
575 struct winbindd_request request
;
576 struct winbindd_response response
;
579 if ( !lp_winbind_enable_local_accounts() )
585 ZERO_STRUCT(request
);
586 ZERO_STRUCT(response
);
588 DEBUG(10,("winbind_delete_group: group (%s)\n", group
));
590 fstrcpy( request
.data
.acct_mgt
.groupname
, group
);
592 result
= winbindd_request( WINBINDD_DELETE_GROUP
, &request
, &response
);
594 return result
== NSS_STATUS_SUCCESS
;
597 /***********************************************************************/
598 #if 0 /* not needed currently since winbindd_acct was added -- jerry */
600 /* Call winbindd to convert SID to uid. Do not allocate */
602 BOOL
winbind_sid_to_uid_query(uid_t
*puid
, const DOM_SID
*sid
)
604 struct winbindd_request request
;
605 struct winbindd_response response
;
612 /* Initialise request */
614 ZERO_STRUCT(request
);
615 ZERO_STRUCT(response
);
617 sid_to_string(sid_str
, sid
);
618 fstrcpy(request
.data
.sid
, sid_str
);
620 request
.flags
= WBFLAG_QUERY_ONLY
;
624 result
= winbindd_request(WINBINDD_SID_TO_UID
, &request
, &response
);
626 /* Copy out result */
628 if (result
== NSS_STATUS_SUCCESS
) {
629 *puid
= response
.data
.uid
;
632 return (result
== NSS_STATUS_SUCCESS
);
635 /* Call winbindd to convert SID to gid. Do not allocate */
637 BOOL
winbind_sid_to_gid_query(gid_t
*pgid
, const DOM_SID
*sid
)
639 struct winbindd_request request
;
640 struct winbindd_response response
;
647 /* Initialise request */
649 ZERO_STRUCT(request
);
650 ZERO_STRUCT(response
);
652 sid_to_string(sid_str
, sid
);
653 fstrcpy(request
.data
.sid
, sid_str
);
655 request
.flags
= WBFLAG_QUERY_ONLY
;
659 result
= winbindd_request(WINBINDD_SID_TO_GID
, &request
, &response
);
661 /* Copy out result */
663 if (result
== NSS_STATUS_SUCCESS
) {
664 *pgid
= response
.data
.gid
;
667 return (result
== NSS_STATUS_SUCCESS
);
672 /***********************************************************************/