source3/passdb/pdb_interface.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Password and authentication handling
   4    Copyright (C) Andrew Bartlett                        2002
   5    Copyright (C) Jelmer Vernooij                        2002
   6    Copyright (C) Simo Sorce                             2003
   7    Copyright (C) Volker Lendecke                        2006
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24
  25 #undef DBGC_CLASS
  26 #define DBGC_CLASS DBGC_PASSDB
  27
  28 /* Cache of latest SAM lookup query */
  29
  30 static struct samu *csamuser = NULL;
  31
  32 static_decl_pdb;
  33
  34 static struct pdb_init_function_entry *backends = NULL;
  35
  36 static void lazy_initialize_passdb(void)
  37 {
  38         static bool initialized = False;
  39         if(initialized) {
  40                 return;
  41         }
  42         static_init_pdb;
  43         initialized = True;
  44 }
  45
  46 static bool lookup_global_sam_rid(TALLOC_CTX *mem_ctx, uint32 rid,
  47                                   const char **name,
  48                                   enum lsa_SidType *psid_name_use,
  49                                   union unid_t *unix_id);
  50
  51 NTSTATUS smb_register_passdb(int version, const char *name, pdb_init_function init)
  52 {
  53         struct pdb_init_function_entry *entry = backends;
  54
  55         if(version != PASSDB_INTERFACE_VERSION) {
  56                 DEBUG(0,("Can't register passdb backend!\n"
  57                          "You tried to register a passdb module with PASSDB_INTERFACE_VERSION %d, "
  58                          "while this version of samba uses version %d\n",
  59                          version,PASSDB_INTERFACE_VERSION));
  60                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
  61         }
  62
  63         if (!name || !init) {
  64                 return NT_STATUS_INVALID_PARAMETER;
  65         }
  66
  67         DEBUG(5,("Attempting to register passdb backend %s\n", name));
  68
  69         /* Check for duplicates */
  70         if (pdb_find_backend_entry(name)) {
  71                 DEBUG(0,("There already is a passdb backend registered with the name %s!\n", name));
  72                 return NT_STATUS_OBJECT_NAME_COLLISION;
  73         }
  74
  75         entry = SMB_XMALLOC_P(struct pdb_init_function_entry);
  76         entry->name = smb_xstrdup(name);
  77         entry->init = init;
  78
  79         DLIST_ADD(backends, entry);
  80         DEBUG(5,("Successfully added passdb backend '%s'\n", name));
  81         return NT_STATUS_OK;
  82 }
  83
  84 struct pdb_init_function_entry *pdb_find_backend_entry(const char *name)
  85 {
  86         struct pdb_init_function_entry *entry = backends;
  87
  88         while(entry) {
  89                 if (strcmp(entry->name, name)==0) return entry;
  90                 entry = entry->next;
  91         }
  92
  93         return NULL;
  94 }
  95
  96 /*
  97  * The event context for the passdb backend. I know this is a bad hack and yet
  98  * another static variable, but our pdb API is a global thing per
  99  * definition. The first use for this is the LDAP idle function, more might be
 100  * added later.
 101  *
 102  * I don't feel too bad about this static variable, it replaces the
 103  * smb_idle_event_list that used to exist in lib/module.c.  -- VL
 104  */
 105
 106 static struct event_context *pdb_event_ctx;
 107
 108 struct event_context *pdb_get_event_context(void)
 109 {
 110         return pdb_event_ctx;
 111 }
 112
 113 /******************************************************************
 114   Make a pdb_methods from scratch
 115  *******************************************************************/
 116
 117 NTSTATUS make_pdb_method_name(struct pdb_methods **methods, const char *selected)
 118 {
 119         char *module_name = smb_xstrdup(selected);
 120         char *module_location = NULL, *p;
 121         struct pdb_init_function_entry *entry;
 122         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 123
 124         lazy_initialize_passdb();
 125
 126         p = strchr(module_name, ':');
 127
 128         if (p) {
 129                 *p = 0;
 130                 module_location = p+1;
 131                 trim_char(module_location, ' ', ' ');
 132         }
 133
 134         trim_char(module_name, ' ', ' ');
 135
 136
 137         DEBUG(5,("Attempting to find an passdb backend to match %s (%s)\n", selected, module_name));
 138
 139         entry = pdb_find_backend_entry(module_name);
 140
 141         /* Try to find a module that contains this module */
 142         if (!entry) {
 143                 DEBUG(2,("No builtin backend found, trying to load plugin\n"));
 144                 if(NT_STATUS_IS_OK(smb_probe_module("pdb", module_name)) && !(entry = pdb_find_backend_entry(module_name))) {
 145                         DEBUG(0,("Plugin is available, but doesn't register passdb backend %s\n", module_name));
 146                         SAFE_FREE(module_name);
 147                         return NT_STATUS_UNSUCCESSFUL;
 148                 }
 149         }
 150
 151         /* No such backend found */
 152         if(!entry) {
 153                 DEBUG(0,("No builtin nor plugin backend for %s found\n", module_name));
 154                 SAFE_FREE(module_name);
 155                 return NT_STATUS_INVALID_PARAMETER;
 156         }
 157
 158         DEBUG(5,("Found pdb backend %s\n", module_name));
 159
 160         if ( !NT_STATUS_IS_OK( nt_status = entry->init(methods, module_location) ) ) {
 161                 DEBUG(0,("pdb backend %s did not correctly init (error was %s)\n",
 162                         selected, nt_errstr(nt_status)));
 163                 SAFE_FREE(module_name);
 164                 return nt_status;
 165         }
 166
 167         SAFE_FREE(module_name);
 168
 169         DEBUG(5,("pdb backend %s has a valid init\n", selected));
 170
 171         return nt_status;
 172 }
 173
 174 /******************************************************************
 175  Return an already initialised pdn_methods structure
 176 *******************************************************************/
 177
 178 static struct pdb_methods *pdb_get_methods_reload( bool reload )
 179 {
 180         static struct pdb_methods *pdb = NULL;
 181
 182         if ( pdb && reload ) {
 183                 pdb->free_private_data( &(pdb->private_data) );
 184                 if ( !NT_STATUS_IS_OK( make_pdb_method_name( &pdb, lp_passdb_backend() ) ) ) {
 185                         char *msg = NULL;
 186                         asprintf(&msg, "pdb_get_methods_reload: "
 187                                 "failed to get pdb methods for backend %s\n",
 188                                 lp_passdb_backend());
 189                         smb_panic(msg);
 190                 }
 191         }
 192
 193         if ( !pdb ) {
 194                 if ( !NT_STATUS_IS_OK( make_pdb_method_name( &pdb, lp_passdb_backend() ) ) ) {
 195                         char *msg = NULL;
 196                         asprintf(&msg, "pdb_get_methods_reload: "
 197                                 "failed to get pdb methods for backend %s\n",
 198                                 lp_passdb_backend());
 199                         smb_panic(msg);
 200                 }
 201         }
 202
 203         return pdb;
 204 }
 205
 206 static struct pdb_methods *pdb_get_methods(void)
 207 {
 208         return pdb_get_methods_reload(False);
 209 }
 210
 211 /******************************************************************
 212  Backward compatibility functions for the original passdb interface
 213 *******************************************************************/
 214
 215 bool pdb_setsampwent(bool update, uint16 acb_mask)
 216 {
 217         struct pdb_methods *pdb = pdb_get_methods();
 218         return NT_STATUS_IS_OK(pdb->setsampwent(pdb, update, acb_mask));
 219 }
 220
 221 void pdb_endsampwent(void)
 222 {
 223         struct pdb_methods *pdb = pdb_get_methods();
 224         pdb->endsampwent(pdb);
 225 }
 226
 227 bool pdb_getsampwent(struct samu *user)
 228 {
 229         struct pdb_methods *pdb = pdb_get_methods();
 230
 231         if ( !NT_STATUS_IS_OK(pdb->getsampwent(pdb, user) ) ) {
 232                 return False;
 233         }
 234
 235         return True;
 236 }
 237
 238 bool pdb_getsampwnam(struct samu *sam_acct, const char *username)
 239 {
 240         struct pdb_methods *pdb = pdb_get_methods();
 241
 242         if (!NT_STATUS_IS_OK(pdb->getsampwnam(pdb, sam_acct, username))) {
 243                 return False;
 244         }
 245
 246         if ( csamuser ) {
 247                 TALLOC_FREE(csamuser);
 248         }
 249
 250         csamuser = samu_new( NULL );
 251         if (!csamuser) {
 252                 return False;
 253         }
 254
 255         if (!pdb_copy_sam_account(csamuser, sam_acct)) {
 256                 TALLOC_FREE(csamuser);
 257                 return False;
 258         }
 259
 260         return True;
 261 }
 262
 263 /**********************************************************************
 264 **********************************************************************/
 265
 266 bool guest_user_info( struct samu *user )
 267 {
 268         struct passwd *pwd;
 269         NTSTATUS result;
 270         const char *guestname = lp_guestaccount();
 271
 272         if ( !(pwd = getpwnam_alloc( NULL, guestname ) ) ) {
 273                 DEBUG(0,("guest_user_info: Unable to locate guest account [%s]!\n",
 274                         guestname));
 275                 return False;
 276         }
 277
 278         result = samu_set_unix(user, pwd );
 279
 280         TALLOC_FREE( pwd );
 281
 282         return NT_STATUS_IS_OK( result );
 283 }
 284
 285 /**********************************************************************
 286 **********************************************************************/
 287
 288 bool pdb_getsampwsid(struct samu *sam_acct, const DOM_SID *sid)
 289 {
 290         struct pdb_methods *pdb = pdb_get_methods();
 291         uint32 rid;
 292
 293         /* hard code the Guest RID of 501 */
 294
 295         if ( !sid_peek_check_rid( get_global_sam_sid(), sid, &rid ) )
 296                 return False;
 297
 298         if ( rid == DOMAIN_USER_RID_GUEST ) {
 299                 DEBUG(6,("pdb_getsampwsid: Building guest account\n"));
 300                 return guest_user_info( sam_acct );
 301         }
 302
 303         /* check the cache first */
 304
 305         if ( csamuser && sid_equal(sid, pdb_get_user_sid(csamuser) ) )
 306                 return pdb_copy_sam_account(sam_acct, csamuser);
 307
 308         return NT_STATUS_IS_OK(pdb->getsampwsid(pdb, sam_acct, sid));
 309 }
 310
 311 static NTSTATUS pdb_default_create_user(struct pdb_methods *methods,
 312                                         TALLOC_CTX *tmp_ctx, const char *name,
 313                                         uint32 acb_info, uint32 *rid)
 314 {
 315         struct samu *sam_pass;
 316         NTSTATUS status;
 317         struct passwd *pwd;
 318
 319         if ((sam_pass = samu_new(tmp_ctx)) == NULL) {
 320                 return NT_STATUS_NO_MEMORY;
 321         }
 322
 323         if ( !(pwd = Get_Pwnam_alloc(tmp_ctx, name)) ) {
 324                 char *add_script = NULL;
 325                 int add_ret;
 326                 fstring name2;
 327
 328                 if ((acb_info & ACB_NORMAL) && name[strlen(name)-1] != '$') {
 329                         add_script = talloc_strdup(tmp_ctx,
 330                                         lp_adduser_script());
 331                 } else {
 332                         add_script = talloc_strdup(tmp_ctx,
 333                                         lp_addmachine_script());
 334                 }
 335
 336                 if (!add_script || add_script[0] == '\0') {
 337                         DEBUG(3, ("Could not find user %s and no add script "
 338                                   "defined\n", name));
 339                         return NT_STATUS_NO_SUCH_USER;
 340                 }
 341
 342                 /* lowercase the username before creating the Unix account for
 343                    compatibility with previous Samba releases */
 344                 fstrcpy( name2, name );
 345                 strlower_m( name2 );
 346                 add_script = talloc_all_string_sub(tmp_ctx,
 347                                         add_script,
 348                                         "%u",
 349                                         name2);
 350                 if (!add_script) {
 351                         return NT_STATUS_NO_MEMORY;
 352                 }
 353                 add_ret = smbrun(add_script,NULL);
 354                 DEBUG(add_ret ? 0 : 3, ("_samr_create_user: Running the command `%s' gave %d\n",
 355                                         add_script, add_ret));
 356                 if (add_ret == 0) {
 357                         smb_nscd_flush_user_cache();
 358                 }
 359
 360                 flush_pwnam_cache();
 361
 362                 pwd = Get_Pwnam_alloc(tmp_ctx, name);
 363         }
 364
 365         /* we have a valid SID coming out of this call */
 366
 367         status = samu_alloc_rid_unix( sam_pass, pwd );
 368
 369         TALLOC_FREE( pwd );
 370
 371         if (!NT_STATUS_IS_OK(status)) {
 372                 DEBUG(3, ("pdb_default_create_user: failed to create a new user structure: %s\n", nt_errstr(status)));
 373                 return status;
 374         }
 375
 376         if (!sid_peek_check_rid(get_global_sam_sid(),
 377                                 pdb_get_user_sid(sam_pass), rid)) {
 378                 DEBUG(0, ("Could not get RID of fresh user\n"));
 379                 return NT_STATUS_INTERNAL_ERROR;
 380         }
 381
 382         /* Use the username case specified in the original request */
 383
 384         pdb_set_username( sam_pass, name, PDB_SET );
 385
 386         /* Disable the account on creation, it does not have a reasonable password yet. */
 387
 388         acb_info |= ACB_DISABLED;
 389
 390         pdb_set_acct_ctrl(sam_pass, acb_info, PDB_CHANGED);
 391
 392         status = pdb_add_sam_account(sam_pass);
 393
 394         TALLOC_FREE(sam_pass);
 395
 396         return status;
 397 }
 398
 399 NTSTATUS pdb_create_user(TALLOC_CTX *mem_ctx, const char *name, uint32 flags,
 400                          uint32 *rid)
 401 {
 402         struct pdb_methods *pdb = pdb_get_methods();
 403         return pdb->create_user(pdb, mem_ctx, name, flags, rid);
 404 }
 405
 406 /****************************************************************************
 407  Delete a UNIX user on demand.
 408 ****************************************************************************/
 409
 410 static int smb_delete_user(const char *unix_user)
 411 {
 412         char *del_script = NULL;
 413         int ret;
 414
 415         /* safety check */
 416
 417         if ( strequal( unix_user, "root" ) ) {
 418                 DEBUG(0,("smb_delete_user: Refusing to delete local system root account!\n"));
 419                 return -1;
 420         }
 421
 422         del_script = talloc_strdup(talloc_tos(), lp_deluser_script());
 423         if (!del_script || !*del_script) {
 424                 return -1;
 425         }
 426         del_script = talloc_all_string_sub(talloc_tos(),
 427                                 del_script,
 428                                 "%u",
 429                                 unix_user);
 430         if (!del_script) {
 431                 return -1;
 432         }
 433         ret = smbrun(del_script,NULL);
 434         flush_pwnam_cache();
 435         if (ret == 0) {
 436                 smb_nscd_flush_user_cache();
 437         }
 438         DEBUG(ret ? 0 : 3,("smb_delete_user: Running the command `%s' gave %d\n",del_script,ret));
 439
 440         return ret;
 441 }
 442
 443 static NTSTATUS pdb_default_delete_user(struct pdb_methods *methods,
 444                                         TALLOC_CTX *mem_ctx,
 445                                         struct samu *sam_acct)
 446 {
 447         NTSTATUS status;
 448         fstring username;
 449
 450         status = pdb_delete_sam_account(sam_acct);
 451         if (!NT_STATUS_IS_OK(status)) {
 452                 return status;
 453         }
 454
 455         /*
 456          * Now delete the unix side ....
 457          * note: we don't check if the delete really happened as the script is
 458          * not necessary present and maybe the sysadmin doesn't want to delete
 459          * the unix side
 460          */
 461
 462         /* always lower case the username before handing it off to
 463            external scripts */
 464
 465         fstrcpy( username, pdb_get_username(sam_acct) );
 466         strlower_m( username );
 467
 468         smb_delete_user( username );
 469
 470         return status;
 471 }
 472
 473 NTSTATUS pdb_delete_user(TALLOC_CTX *mem_ctx, struct samu *sam_acct)
 474 {
 475         struct pdb_methods *pdb = pdb_get_methods();
 476         uid_t uid = -1;
 477
 478         /* sanity check to make sure we don't delete root */
 479
 480         if ( !sid_to_uid( pdb_get_user_sid(sam_acct), &uid ) ) {
 481                 return NT_STATUS_NO_SUCH_USER;
 482         }
 483
 484         if ( uid == 0 ) {
 485                 return NT_STATUS_ACCESS_DENIED;
 486         }
 487
 488         return pdb->delete_user(pdb, mem_ctx, sam_acct);
 489 }
 490
 491 NTSTATUS pdb_add_sam_account(struct samu *sam_acct)
 492 {
 493         struct pdb_methods *pdb = pdb_get_methods();
 494         return pdb->add_sam_account(pdb, sam_acct);
 495 }
 496
 497 NTSTATUS pdb_update_sam_account(struct samu *sam_acct)
 498 {
 499         struct pdb_methods *pdb = pdb_get_methods();
 500
 501         if (csamuser != NULL) {
 502                 TALLOC_FREE(csamuser);
 503                 csamuser = NULL;
 504         }
 505
 506         return pdb->update_sam_account(pdb, sam_acct);
 507 }
 508
 509 NTSTATUS pdb_delete_sam_account(struct samu *sam_acct)
 510 {
 511         struct pdb_methods *pdb = pdb_get_methods();
 512
 513         if (csamuser != NULL) {
 514                 TALLOC_FREE(csamuser);
 515                 csamuser = NULL;
 516         }
 517
 518         return pdb->delete_sam_account(pdb, sam_acct);
 519 }
 520
 521 NTSTATUS pdb_rename_sam_account(struct samu *oldname, const char *newname)
 522 {
 523         struct pdb_methods *pdb = pdb_get_methods();
 524         uid_t uid;
 525         NTSTATUS status;
 526
 527         if (csamuser != NULL) {
 528                 TALLOC_FREE(csamuser);
 529                 csamuser = NULL;
 530         }
 531
 532         /* sanity check to make sure we don't rename root */
 533
 534         if ( !sid_to_uid( pdb_get_user_sid(oldname), &uid ) ) {
 535                 return NT_STATUS_NO_SUCH_USER;
 536         }
 537
 538         if ( uid == 0 ) {
 539                 return NT_STATUS_ACCESS_DENIED;
 540         }
 541
 542         status = pdb->rename_sam_account(pdb, oldname, newname);
 543
 544         /* always flush the cache here just to be safe */
 545         flush_pwnam_cache();
 546
 547         return status;
 548 }
 549
 550 NTSTATUS pdb_update_login_attempts(struct samu *sam_acct, bool success)
 551 {
 552         struct pdb_methods *pdb = pdb_get_methods();
 553         return pdb->update_login_attempts(pdb, sam_acct, success);
 554 }
 555
 556 bool pdb_getgrsid(GROUP_MAP *map, DOM_SID sid)
 557 {
 558         struct pdb_methods *pdb = pdb_get_methods();
 559         return NT_STATUS_IS_OK(pdb->getgrsid(pdb, map, sid));
 560 }
 561
 562 bool pdb_getgrgid(GROUP_MAP *map, gid_t gid)
 563 {
 564         struct pdb_methods *pdb = pdb_get_methods();
 565         return NT_STATUS_IS_OK(pdb->getgrgid(pdb, map, gid));
 566 }
 567
 568 bool pdb_getgrnam(GROUP_MAP *map, const char *name)
 569 {
 570         struct pdb_methods *pdb = pdb_get_methods();
 571         return NT_STATUS_IS_OK(pdb->getgrnam(pdb, map, name));
 572 }
 573
 574 static NTSTATUS pdb_default_create_dom_group(struct pdb_methods *methods,
 575                                              TALLOC_CTX *mem_ctx,
 576                                              const char *name,
 577                                              uint32 *rid)
 578 {
 579         DOM_SID group_sid;
 580         struct group *grp;
 581         fstring tmp;
 582
 583         grp = getgrnam(name);
 584
 585         if (grp == NULL) {
 586                 gid_t gid;
 587
 588                 if (smb_create_group(name, &gid) != 0) {
 589                         return NT_STATUS_ACCESS_DENIED;
 590                 }
 591
 592                 grp = getgrgid(gid);
 593         }
 594
 595         if (grp == NULL) {
 596                 return NT_STATUS_ACCESS_DENIED;
 597         }
 598
 599         if (pdb_rid_algorithm()) {
 600                 *rid = algorithmic_pdb_gid_to_group_rid( grp->gr_gid );
 601         } else {
 602                 if (!pdb_new_rid(rid)) {
 603                         return NT_STATUS_ACCESS_DENIED;
 604                 }
 605         }
 606
 607         sid_compose(&group_sid, get_global_sam_sid(), *rid);
 608
 609         return add_initial_entry(grp->gr_gid, sid_to_fstring(tmp, &group_sid),
 610                                  SID_NAME_DOM_GRP, name, NULL);
 611 }
 612
 613 NTSTATUS pdb_create_dom_group(TALLOC_CTX *mem_ctx, const char *name,
 614                               uint32 *rid)
 615 {
 616         struct pdb_methods *pdb = pdb_get_methods();
 617         return pdb->create_dom_group(pdb, mem_ctx, name, rid);
 618 }
 619
 620 static NTSTATUS pdb_default_delete_dom_group(struct pdb_methods *methods,
 621                                              TALLOC_CTX *mem_ctx,
 622                                              uint32 rid)
 623 {
 624         DOM_SID group_sid;
 625         GROUP_MAP map;
 626         NTSTATUS status;
 627         struct group *grp;
 628         const char *grp_name;
 629
 630         sid_compose(&group_sid, get_global_sam_sid(), rid);
 631
 632         if (!get_domain_group_from_sid(group_sid, &map)) {
 633                 DEBUG(10, ("Could not find group for rid %d\n", rid));
 634                 return NT_STATUS_NO_SUCH_GROUP;
 635         }
 636
 637         /* We need the group name for the smb_delete_group later on */
 638
 639         if (map.gid == (gid_t)-1) {
 640                 return NT_STATUS_NO_SUCH_GROUP;
 641         }
 642
 643         grp = getgrgid(map.gid);
 644         if (grp == NULL) {
 645                 return NT_STATUS_NO_SUCH_GROUP;
 646         }
 647
 648         /* Copy the name, no idea what pdb_delete_group_mapping_entry does.. */
 649
 650         grp_name = talloc_strdup(mem_ctx, grp->gr_name);
 651         if (grp_name == NULL) {
 652                 return NT_STATUS_NO_MEMORY;
 653         }
 654
 655         status = pdb_delete_group_mapping_entry(group_sid);
 656
 657         if (!NT_STATUS_IS_OK(status)) {
 658                 return status;
 659         }
 660
 661         /* Don't check the result of smb_delete_group */
 662
 663         smb_delete_group(grp_name);
 664
 665         return NT_STATUS_OK;
 666 }
 667
 668 NTSTATUS pdb_delete_dom_group(TALLOC_CTX *mem_ctx, uint32 rid)
 669 {
 670         struct pdb_methods *pdb = pdb_get_methods();
 671         return pdb->delete_dom_group(pdb, mem_ctx, rid);
 672 }
 673
 674 NTSTATUS pdb_add_group_mapping_entry(GROUP_MAP *map)
 675 {
 676         struct pdb_methods *pdb = pdb_get_methods();
 677         return pdb->add_group_mapping_entry(pdb, map);
 678 }
 679
 680 NTSTATUS pdb_update_group_mapping_entry(GROUP_MAP *map)
 681 {
 682         struct pdb_methods *pdb = pdb_get_methods();
 683         return pdb->update_group_mapping_entry(pdb, map);
 684 }
 685
 686 NTSTATUS pdb_delete_group_mapping_entry(DOM_SID sid)
 687 {
 688         struct pdb_methods *pdb = pdb_get_methods();
 689         return pdb->delete_group_mapping_entry(pdb, sid);
 690 }
 691
 692 bool pdb_enum_group_mapping(const DOM_SID *sid, enum lsa_SidType sid_name_use, GROUP_MAP **pp_rmap,
 693                             size_t *p_num_entries, bool unix_only)
 694 {
 695         struct pdb_methods *pdb = pdb_get_methods();
 696         return NT_STATUS_IS_OK(pdb-> enum_group_mapping(pdb, sid, sid_name_use,
 697                 pp_rmap, p_num_entries, unix_only));
 698 }
 699
 700 NTSTATUS pdb_enum_group_members(TALLOC_CTX *mem_ctx,
 701                                 const DOM_SID *sid,
 702                                 uint32 **pp_member_rids,
 703                                 size_t *p_num_members)
 704 {
 705         struct pdb_methods *pdb = pdb_get_methods();
 706         NTSTATUS result;
 707
 708         result = pdb->enum_group_members(pdb, mem_ctx,
 709                         sid, pp_member_rids, p_num_members);
 710
 711         /* special check for rid 513 */
 712
 713         if ( !NT_STATUS_IS_OK( result ) ) {
 714                 uint32 rid;
 715
 716                 sid_peek_rid( sid, &rid );
 717
 718                 if ( rid == DOMAIN_GROUP_RID_USERS ) {
 719                         *p_num_members = 0;
 720                         *pp_member_rids = NULL;
 721
 722                         return NT_STATUS_OK;
 723                 }
 724         }
 725
 726         return result;
 727 }
 728
 729 NTSTATUS pdb_enum_group_memberships(TALLOC_CTX *mem_ctx, struct samu *user,
 730                                     DOM_SID **pp_sids, gid_t **pp_gids,
 731                                     size_t *p_num_groups)
 732 {
 733         struct pdb_methods *pdb = pdb_get_methods();
 734         return pdb->enum_group_memberships(
 735                 pdb, mem_ctx, user,
 736                 pp_sids, pp_gids, p_num_groups);
 737 }
 738
 739 static NTSTATUS pdb_default_set_unix_primary_group(struct pdb_methods *methods,
 740                                                    TALLOC_CTX *mem_ctx,
 741                                                    struct samu *sampass)
 742 {
 743         struct group *grp;
 744         gid_t gid;
 745
 746         if (!sid_to_gid(pdb_get_group_sid(sampass), &gid) ||
 747             (grp = getgrgid(gid)) == NULL) {
 748                 return NT_STATUS_INVALID_PRIMARY_GROUP;
 749         }
 750
 751         if (smb_set_primary_group(grp->gr_name,
 752                                   pdb_get_username(sampass)) != 0) {
 753                 return NT_STATUS_ACCESS_DENIED;
 754         }
 755
 756         return NT_STATUS_OK;
 757 }
 758
 759 NTSTATUS pdb_set_unix_primary_group(TALLOC_CTX *mem_ctx, struct samu *user)
 760 {
 761         struct pdb_methods *pdb = pdb_get_methods();
 762         return pdb->set_unix_primary_group(pdb, mem_ctx, user);
 763 }
 764
 765 /*
 766  * Helper function to see whether a user is in a group. We can't use
 767  * user_in_group_sid here because this creates dependencies only smbd can
 768  * fulfil.
 769  */
 770
 771 static bool pdb_user_in_group(TALLOC_CTX *mem_ctx, struct samu *account,
 772                               const DOM_SID *group_sid)
 773 {
 774         DOM_SID *sids;
 775         gid_t *gids;
 776         size_t i, num_groups;
 777
 778         if (!NT_STATUS_IS_OK(pdb_enum_group_memberships(mem_ctx, account,
 779                                                         &sids, &gids,
 780                                                         &num_groups))) {
 781                 return False;
 782         }
 783
 784         for (i=0; i<num_groups; i++) {
 785                 if (sid_equal(group_sid, &sids[i])) {
 786                         return True;
 787                 }
 788         }
 789         return False;
 790 }
 791
 792 static NTSTATUS pdb_default_add_groupmem(struct pdb_methods *methods,
 793                                          TALLOC_CTX *mem_ctx,
 794                                          uint32 group_rid,
 795                                          uint32 member_rid)
 796 {
 797         DOM_SID group_sid, member_sid;
 798         struct samu *account = NULL;
 799         GROUP_MAP map;
 800         struct group *grp;
 801         struct passwd *pwd;
 802         const char *group_name;
 803         uid_t uid;
 804
 805         sid_compose(&group_sid, get_global_sam_sid(), group_rid);
 806         sid_compose(&member_sid, get_global_sam_sid(), member_rid);
 807
 808         if (!get_domain_group_from_sid(group_sid, &map) ||
 809             (map.gid == (gid_t)-1) ||
 810             ((grp = getgrgid(map.gid)) == NULL)) {
 811                 return NT_STATUS_NO_SUCH_GROUP;
 812         }
 813
 814         group_name = talloc_strdup(mem_ctx, grp->gr_name);
 815         if (group_name == NULL) {
 816                 return NT_STATUS_NO_MEMORY;
 817         }
 818
 819         if ( !(account = samu_new( NULL )) ) {
 820                 return NT_STATUS_NO_MEMORY;
 821         }
 822
 823         if (!pdb_getsampwsid(account, &member_sid) ||
 824             !sid_to_uid(&member_sid, &uid) ||
 825             ((pwd = getpwuid_alloc(mem_ctx, uid)) == NULL)) {
 826                 return NT_STATUS_NO_SUCH_USER;
 827         }
 828
 829         if (pdb_user_in_group(mem_ctx, account, &group_sid)) {
 830                 return NT_STATUS_MEMBER_IN_GROUP;
 831         }
 832
 833         /*
 834          * ok, the group exist, the user exist, the user is not in the group,
 835          * we can (finally) add it to the group !
 836          */
 837
 838         smb_add_user_group(group_name, pwd->pw_name);
 839
 840         if (!pdb_user_in_group(mem_ctx, account, &group_sid)) {
 841                 return NT_STATUS_ACCESS_DENIED;
 842         }
 843
 844         return NT_STATUS_OK;
 845 }
 846
 847 NTSTATUS pdb_add_groupmem(TALLOC_CTX *mem_ctx, uint32 group_rid,
 848                           uint32 member_rid)
 849 {
 850         struct pdb_methods *pdb = pdb_get_methods();
 851         return pdb->add_groupmem(pdb, mem_ctx, group_rid, member_rid);
 852 }
 853
 854 static NTSTATUS pdb_default_del_groupmem(struct pdb_methods *methods,
 855                                          TALLOC_CTX *mem_ctx,
 856                                          uint32 group_rid,
 857                                          uint32 member_rid)
 858 {
 859         DOM_SID group_sid, member_sid;
 860         struct samu *account = NULL;
 861         GROUP_MAP map;
 862         struct group *grp;
 863         struct passwd *pwd;
 864         const char *group_name;
 865         uid_t uid;
 866
 867         sid_compose(&group_sid, get_global_sam_sid(), group_rid);
 868         sid_compose(&member_sid, get_global_sam_sid(), member_rid);
 869
 870         if (!get_domain_group_from_sid(group_sid, &map) ||
 871             (map.gid == (gid_t)-1) ||
 872             ((grp = getgrgid(map.gid)) == NULL)) {
 873                 return NT_STATUS_NO_SUCH_GROUP;
 874         }
 875
 876         group_name = talloc_strdup(mem_ctx, grp->gr_name);
 877         if (group_name == NULL) {
 878                 return NT_STATUS_NO_MEMORY;
 879         }
 880
 881         if ( !(account = samu_new( NULL )) ) {
 882                 return NT_STATUS_NO_MEMORY;
 883         }
 884
 885         if (!pdb_getsampwsid(account, &member_sid) ||
 886             !sid_to_uid(&member_sid, &uid) ||
 887             ((pwd = getpwuid_alloc(mem_ctx, uid)) == NULL)) {
 888                 return NT_STATUS_NO_SUCH_USER;
 889         }
 890
 891         if (!pdb_user_in_group(mem_ctx, account, &group_sid)) {
 892                 return NT_STATUS_MEMBER_NOT_IN_GROUP;
 893         }
 894
 895         /*
 896          * ok, the group exist, the user exist, the user is in the group,
 897          * we can (finally) delete it from the group!
 898          */
 899
 900         smb_delete_user_group(group_name, pwd->pw_name);
 901
 902         if (pdb_user_in_group(mem_ctx, account, &group_sid)) {
 903                 return NT_STATUS_ACCESS_DENIED;
 904         }
 905
 906         return NT_STATUS_OK;
 907 }
 908
 909 NTSTATUS pdb_del_groupmem(TALLOC_CTX *mem_ctx, uint32 group_rid,
 910                           uint32 member_rid)
 911 {
 912         struct pdb_methods *pdb = pdb_get_methods();
 913         return pdb->del_groupmem(pdb, mem_ctx, group_rid, member_rid);
 914 }
 915
 916 NTSTATUS pdb_create_alias(const char *name, uint32 *rid)
 917 {
 918         struct pdb_methods *pdb = pdb_get_methods();
 919         return pdb->create_alias(pdb, name, rid);
 920 }
 921
 922 NTSTATUS pdb_delete_alias(const DOM_SID *sid)
 923 {
 924         struct pdb_methods *pdb = pdb_get_methods();
 925         return pdb->delete_alias(pdb, sid);
 926 }
 927
 928 NTSTATUS pdb_get_aliasinfo(const DOM_SID *sid, struct acct_info *info)
 929 {
 930         struct pdb_methods *pdb = pdb_get_methods();
 931         return pdb->get_aliasinfo(pdb, sid, info);
 932 }
 933
 934 NTSTATUS pdb_set_aliasinfo(const DOM_SID *sid, struct acct_info *info)
 935 {
 936         struct pdb_methods *pdb = pdb_get_methods();
 937         return pdb->set_aliasinfo(pdb, sid, info);
 938 }
 939
 940 NTSTATUS pdb_add_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 941 {
 942         struct pdb_methods *pdb = pdb_get_methods();
 943         return pdb->add_aliasmem(pdb, alias, member);
 944 }
 945
 946 NTSTATUS pdb_del_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 947 {
 948         struct pdb_methods *pdb = pdb_get_methods();
 949         return pdb->del_aliasmem(pdb, alias, member);
 950 }
 951
 952 NTSTATUS pdb_enum_aliasmem(const DOM_SID *alias,
 953                            DOM_SID **pp_members, size_t *p_num_members)
 954 {
 955         struct pdb_methods *pdb = pdb_get_methods();
 956         return pdb->enum_aliasmem(pdb, alias, pp_members, p_num_members);
 957 }
 958
 959 NTSTATUS pdb_enum_alias_memberships(TALLOC_CTX *mem_ctx,
 960                                     const DOM_SID *domain_sid,
 961                                     const DOM_SID *members, size_t num_members,
 962                                     uint32 **pp_alias_rids,
 963                                     size_t *p_num_alias_rids)
 964 {
 965         struct pdb_methods *pdb = pdb_get_methods();
 966         return pdb->enum_alias_memberships(pdb, mem_ctx,
 967                                                        domain_sid,
 968                                                        members, num_members,
 969                                                        pp_alias_rids,
 970                                                        p_num_alias_rids);
 971 }
 972
 973 NTSTATUS pdb_lookup_rids(const DOM_SID *domain_sid,
 974                          int num_rids,
 975                          uint32 *rids,
 976                          const char **names,
 977                          enum lsa_SidType *attrs)
 978 {
 979         struct pdb_methods *pdb = pdb_get_methods();
 980         return pdb->lookup_rids(pdb, domain_sid, num_rids, rids, names, attrs);
 981 }
 982
 983 /*
 984  * NOTE: pdb_lookup_names is currently (2007-01-12) not used anywhere
 985  *       in the samba code.
 986  *       Unlike _lsa_lookup_sids and _samr_lookup_rids, which eventually
 987  *       also ask pdb_lookup_rids, thus looking up a bunch of rids at a time,
 988  *       the pdb_ calls _lsa_lookup_names and _samr_lookup_names come
 989  *       down to are pdb_getsampwnam and pdb_getgrnam instead of
 990  *       pdb_lookup_names.
 991  *       But in principle, it the call belongs to the API and might get
 992  *       used in this context some day.
 993  */
 994 #if 0
 995 NTSTATUS pdb_lookup_names(const DOM_SID *domain_sid,
 996                           int num_names,
 997                           const char **names,
 998                           uint32 *rids,
 999                           enum lsa_SidType *attrs)
1000 {
1001         struct pdb_methods *pdb = pdb_get_methods();
1002         return pdb->lookup_names(pdb, domain_sid, num_names, names, rids, attrs);
1003 }
1004 #endif
1005
1006 bool pdb_get_account_policy(int policy_index, uint32 *value)
1007 {
1008         struct pdb_methods *pdb = pdb_get_methods();
1009         NTSTATUS status;
1010
1011         become_root();
1012         status = pdb->get_account_policy(pdb, policy_index, value);
1013         unbecome_root();
1014
1015         return NT_STATUS_IS_OK(status);
1016 }
1017
1018 bool pdb_set_account_policy(int policy_index, uint32 value)
1019 {
1020         struct pdb_methods *pdb = pdb_get_methods();
1021         NTSTATUS status;
1022
1023         become_root();
1024         status = pdb->set_account_policy(pdb, policy_index, value);
1025         unbecome_root();
1026
1027         return NT_STATUS_IS_OK(status);
1028 }
1029
1030 bool pdb_get_seq_num(time_t *seq_num)
1031 {
1032         struct pdb_methods *pdb = pdb_get_methods();
1033         return NT_STATUS_IS_OK(pdb->get_seq_num(pdb, seq_num));
1034 }
1035
1036 bool pdb_uid_to_rid(uid_t uid, uint32 *rid)
1037 {
1038         struct pdb_methods *pdb = pdb_get_methods();
1039         return pdb->uid_to_rid(pdb, uid, rid);
1040 }
1041
1042 bool pdb_uid_to_sid(uid_t uid, DOM_SID *sid)
1043 {
1044         struct pdb_methods *pdb = pdb_get_methods();
1045         return pdb->uid_to_sid(pdb, uid, sid);
1046 }
1047
1048 bool pdb_gid_to_sid(gid_t gid, DOM_SID *sid)
1049 {
1050         struct pdb_methods *pdb = pdb_get_methods();
1051         return pdb->gid_to_sid(pdb, gid, sid);
1052 }
1053
1054 bool pdb_sid_to_id(const DOM_SID *sid, union unid_t *id,
1055                    enum lsa_SidType *type)
1056 {
1057         struct pdb_methods *pdb = pdb_get_methods();
1058         return pdb->sid_to_id(pdb, sid, id, type);
1059 }
1060
1061 bool pdb_rid_algorithm(void)
1062 {
1063         struct pdb_methods *pdb = pdb_get_methods();
1064         return pdb->rid_algorithm(pdb);
1065 }
1066
1067 /********************************************************************
1068  Allocate a new RID from the passdb backend.  Verify that it is free
1069  by calling lookup_global_sam_rid() to verify that the RID is not
1070  in use.  This handles servers that have existing users or groups
1071  with add RIDs (assigned from previous algorithmic mappings)
1072 ********************************************************************/
1073
1074 bool pdb_new_rid(uint32 *rid)
1075 {
1076         struct pdb_methods *pdb = pdb_get_methods();
1077         const char *name = NULL;
1078         enum lsa_SidType type;
1079         uint32 allocated_rid = 0;
1080         int i;
1081         TALLOC_CTX *ctx;
1082
1083         if (pdb_rid_algorithm()) {
1084                 DEBUG(0, ("Trying to allocate a RID when algorithmic RIDs "
1085                           "are active\n"));
1086                 return False;
1087         }
1088
1089         if (algorithmic_rid_base() != BASE_RID) {
1090                 DEBUG(0, ("'algorithmic rid base' is set but a passdb backend "
1091                           "without algorithmic RIDs is chosen.\n"));
1092                 DEBUGADD(0, ("Please map all used groups using 'net groupmap "
1093                              "add', set the maximum used RID using\n"));
1094                 DEBUGADD(0, ("'net setmaxrid' and remove the parameter\n"));
1095                 return False;
1096         }
1097
1098         if ( (ctx = talloc_init("pdb_new_rid")) == NULL ) {
1099                 DEBUG(0,("pdb_new_rid: Talloc initialization failure\n"));
1100                 return False;
1101         }
1102
1103         /* Attempt to get an unused RID (max tires is 250...yes that it is
1104            and arbitrary number I pulkled out of my head).   -- jerry */
1105
1106         for ( i=0; allocated_rid==0 && i<250; i++ ) {
1107                 /* get a new RID */
1108
1109                 if ( !pdb->new_rid(pdb, &allocated_rid) ) {
1110                         return False;
1111                 }
1112
1113                 /* validate that the RID is not in use */
1114
1115                 if ( lookup_global_sam_rid( ctx, allocated_rid, &name, &type, NULL ) ) {
1116                         allocated_rid = 0;
1117                 }
1118         }
1119
1120         TALLOC_FREE( ctx );
1121
1122         if ( allocated_rid == 0 ) {
1123                 DEBUG(0,("pdb_new_rid: Failed to find unused RID\n"));
1124                 return False;
1125         }
1126
1127         *rid = allocated_rid;
1128
1129         return True;
1130 }
1131
1132 /***************************************************************
1133   Initialize the static context (at smbd startup etc).
1134
1135   If uninitialised, context will auto-init on first use.
1136  ***************************************************************/
1137
1138 bool initialize_password_db(bool reload, struct event_context *event_ctx)
1139 {
1140         pdb_event_ctx = event_ctx;
1141         return (pdb_get_methods_reload(reload) != NULL);
1142 }
1143
1144
1145 /***************************************************************************
1146   Default implementations of some functions.
1147  ****************************************************************************/
1148
1149 static NTSTATUS pdb_default_getsampwnam (struct pdb_methods *methods, struct samu *user, const char *sname)
1150 {
1151         return NT_STATUS_NO_SUCH_USER;
1152 }
1153
1154 static NTSTATUS pdb_default_getsampwsid(struct pdb_methods *my_methods, struct samu * user, const DOM_SID *sid)
1155 {
1156         return NT_STATUS_NO_SUCH_USER;
1157 }
1158
1159 static NTSTATUS pdb_default_add_sam_account (struct pdb_methods *methods, struct samu *newpwd)
1160 {
1161         return NT_STATUS_NOT_IMPLEMENTED;
1162 }
1163
1164 static NTSTATUS pdb_default_update_sam_account (struct pdb_methods *methods, struct samu *newpwd)
1165 {
1166         return NT_STATUS_NOT_IMPLEMENTED;
1167 }
1168
1169 static NTSTATUS pdb_default_delete_sam_account (struct pdb_methods *methods, struct samu *pwd)
1170 {
1171         return NT_STATUS_NOT_IMPLEMENTED;
1172 }
1173
1174 static NTSTATUS pdb_default_rename_sam_account (struct pdb_methods *methods, struct samu *pwd, const char *newname)
1175 {
1176         return NT_STATUS_NOT_IMPLEMENTED;
1177 }
1178
1179 static NTSTATUS pdb_default_update_login_attempts (struct pdb_methods *methods, struct samu *newpwd, bool success)
1180 {
1181         return NT_STATUS_NOT_IMPLEMENTED;
1182 }
1183
1184 static NTSTATUS pdb_default_setsampwent(struct pdb_methods *methods, bool update, uint32 acb_mask)
1185 {
1186         return NT_STATUS_NOT_IMPLEMENTED;
1187 }
1188
1189 static NTSTATUS pdb_default_getsampwent(struct pdb_methods *methods, struct samu *user)
1190 {
1191         return NT_STATUS_NOT_IMPLEMENTED;
1192 }
1193
1194 static void pdb_default_endsampwent(struct pdb_methods *methods)
1195 {
1196         return; /* NT_STATUS_NOT_IMPLEMENTED; */
1197 }
1198
1199 static NTSTATUS pdb_default_get_account_policy(struct pdb_methods *methods, int policy_index, uint32 *value)
1200 {
1201         return account_policy_get(policy_index, value) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1202 }
1203
1204 static NTSTATUS pdb_default_set_account_policy(struct pdb_methods *methods, int policy_index, uint32 value)
1205 {
1206         return account_policy_set(policy_index, value) ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1207 }
1208
1209 static NTSTATUS pdb_default_get_seq_num(struct pdb_methods *methods, time_t *seq_num)
1210 {
1211         *seq_num = time(NULL);
1212         return NT_STATUS_OK;
1213 }
1214
1215 static bool pdb_default_uid_to_sid(struct pdb_methods *methods, uid_t uid,
1216                                    DOM_SID *sid)
1217 {
1218         struct samu *sampw = NULL;
1219         struct passwd *unix_pw;
1220         bool ret;
1221
1222         unix_pw = sys_getpwuid( uid );
1223
1224         if ( !unix_pw ) {
1225                 DEBUG(4,("pdb_default_uid_to_rid: host has no idea of uid "
1226                          "%lu\n", (unsigned long)uid));
1227                 return False;
1228         }
1229
1230         if ( !(sampw = samu_new( NULL )) ) {
1231                 DEBUG(0,("pdb_default_uid_to_rid: samu_new() failed!\n"));
1232                 return False;
1233         }
1234
1235         become_root();
1236         ret = NT_STATUS_IS_OK(
1237                 methods->getsampwnam(methods, sampw, unix_pw->pw_name ));
1238         unbecome_root();
1239
1240         if (!ret) {
1241                 DEBUG(5, ("pdb_default_uid_to_rid: Did not find user "
1242                           "%s (%d)\n", unix_pw->pw_name, uid));
1243                 TALLOC_FREE(sampw);
1244                 return False;
1245         }
1246
1247         sid_copy(sid, pdb_get_user_sid(sampw));
1248
1249         TALLOC_FREE(sampw);
1250
1251         return True;
1252 }
1253
1254 static bool pdb_default_uid_to_rid(struct pdb_methods *methods, uid_t uid,
1255                                    uint32 *rid)
1256 {
1257         DOM_SID sid;
1258         bool ret;
1259
1260         ret = pdb_default_uid_to_sid(methods, uid, &sid);
1261         if (!ret) {
1262                 return ret;
1263         }
1264
1265         ret = sid_peek_check_rid(get_global_sam_sid(), &sid, rid);
1266
1267         if (!ret) {
1268                 DEBUG(1, ("Could not peek rid out of sid %s\n",
1269                           sid_string_dbg(&sid)));
1270         }
1271
1272         return ret;
1273 }
1274
1275 static bool pdb_default_gid_to_sid(struct pdb_methods *methods, gid_t gid,
1276                                    DOM_SID *sid)
1277 {
1278         GROUP_MAP map;
1279
1280         if (!NT_STATUS_IS_OK(methods->getgrgid(methods, &map, gid))) {
1281                 return False;
1282         }
1283
1284         sid_copy(sid, &map.sid);
1285         return True;
1286 }
1287
1288 static bool pdb_default_sid_to_id(struct pdb_methods *methods,
1289                                   const DOM_SID *sid,
1290                                   union unid_t *id, enum lsa_SidType *type)
1291 {
1292         TALLOC_CTX *mem_ctx;
1293         bool ret = False;
1294         const char *name;
1295         uint32 rid;
1296
1297         mem_ctx = talloc_new(NULL);
1298
1299         if (mem_ctx == NULL) {
1300                 DEBUG(0, ("talloc_new failed\n"));
1301                 return False;
1302         }
1303
1304         if (sid_peek_check_rid(get_global_sam_sid(), sid, &rid)) {
1305                 /* Here we might have users as well as groups and aliases */
1306                 ret = lookup_global_sam_rid(mem_ctx, rid, &name, type, id);
1307                 goto done;
1308         }
1309
1310         /* check for "Unix User" */
1311
1312         if ( sid_peek_check_rid(&global_sid_Unix_Users, sid, &rid) ) {
1313                 id->uid = rid;
1314                 *type = SID_NAME_USER;
1315                 ret = True;
1316                 goto done;
1317         }
1318
1319         /* check for "Unix Group" */
1320
1321         if ( sid_peek_check_rid(&global_sid_Unix_Groups, sid, &rid) ) {
1322                 id->gid = rid;
1323                 *type = SID_NAME_ALIAS;
1324                 ret = True;
1325                 goto done;
1326         }
1327
1328         /* BUILTIN */
1329
1330         if (sid_check_is_in_builtin(sid) ||
1331             sid_check_is_in_wellknown_domain(sid)) {
1332                 /* Here we only have aliases */
1333                 GROUP_MAP map;
1334                 if (!NT_STATUS_IS_OK(methods->getgrsid(methods, &map, *sid))) {
1335                         DEBUG(10, ("Could not find map for sid %s\n",
1336                                    sid_string_dbg(sid)));
1337                         goto done;
1338                 }
1339                 if ((map.sid_name_use != SID_NAME_ALIAS) &&
1340                     (map.sid_name_use != SID_NAME_WKN_GRP)) {
1341                         DEBUG(10, ("Map for sid %s is a %s, expected an "
1342                                    "alias\n", sid_string_dbg(sid),
1343                                    sid_type_lookup(map.sid_name_use)));
1344                         goto done;
1345                 }
1346
1347                 id->gid = map.gid;
1348                 *type = SID_NAME_ALIAS;
1349                 ret = True;
1350                 goto done;
1351         }
1352
1353         DEBUG(5, ("Sid %s is neither ours, a Unix SID, nor builtin\n",
1354                   sid_string_dbg(sid)));
1355
1356  done:
1357
1358         TALLOC_FREE(mem_ctx);
1359         return ret;
1360 }
1361
1362 static bool add_uid_to_array_unique(TALLOC_CTX *mem_ctx,
1363                                     uid_t uid, uid_t **pp_uids, size_t *p_num)
1364 {
1365         size_t i;
1366
1367         for (i=0; i<*p_num; i++) {
1368                 if ((*pp_uids)[i] == uid)
1369                         return True;
1370         }
1371
1372         *pp_uids = TALLOC_REALLOC_ARRAY(mem_ctx, *pp_uids, uid_t, *p_num+1);
1373
1374         if (*pp_uids == NULL)
1375                 return False;
1376
1377         (*pp_uids)[*p_num] = uid;
1378         *p_num += 1;
1379         return True;
1380 }
1381
1382 static bool get_memberuids(TALLOC_CTX *mem_ctx, gid_t gid, uid_t **pp_uids, size_t *p_num)
1383 {
1384         struct group *grp;
1385         char **gr;
1386         struct passwd *pwd;
1387         bool winbind_env;
1388         bool ret = False;
1389
1390         *pp_uids = NULL;
1391         *p_num = 0;
1392
1393         /* We only look at our own sam, so don't care about imported stuff */
1394         winbind_env = winbind_env_set();
1395         winbind_off();
1396
1397         if ((grp = getgrgid(gid)) == NULL) {
1398                 /* allow winbindd lookups, but only if they weren't already disabled */
1399                 goto done;
1400         }
1401
1402         /* Primary group members */
1403         setpwent();
1404         while ((pwd = getpwent()) != NULL) {
1405                 if (pwd->pw_gid == gid) {
1406                         if (!add_uid_to_array_unique(mem_ctx, pwd->pw_uid,
1407                                                 pp_uids, p_num)) {
1408                                 goto done;
1409                         }
1410                 }
1411         }
1412         endpwent();
1413
1414         /* Secondary group members */
1415         for (gr = grp->gr_mem; (*gr != NULL) && ((*gr)[0] != '\0'); gr += 1) {
1416                 struct passwd *pw = getpwnam(*gr);
1417
1418                 if (pw == NULL)
1419                         continue;
1420                 if (!add_uid_to_array_unique(mem_ctx, pw->pw_uid, pp_uids, p_num)) {
1421                         goto done;
1422                 }
1423         }
1424
1425         ret = True;
1426
1427   done:
1428
1429         /* allow winbindd lookups, but only if they weren't already disabled */
1430         if (!winbind_env) {
1431                 winbind_on();
1432         }
1433
1434         return ret;
1435 }
1436
1437 static NTSTATUS pdb_default_enum_group_members(struct pdb_methods *methods,
1438                                                TALLOC_CTX *mem_ctx,
1439                                                const DOM_SID *group,
1440                                                uint32 **pp_member_rids,
1441                                                size_t *p_num_members)
1442 {
1443         gid_t gid;
1444         uid_t *uids;
1445         size_t i, num_uids;
1446
1447         *pp_member_rids = NULL;
1448         *p_num_members = 0;
1449
1450         if (!sid_to_gid(group, &gid))
1451                 return NT_STATUS_NO_SUCH_GROUP;
1452
1453         if(!get_memberuids(mem_ctx, gid, &uids, &num_uids))
1454                 return NT_STATUS_NO_SUCH_GROUP;
1455
1456         if (num_uids == 0)
1457                 return NT_STATUS_OK;
1458
1459         *pp_member_rids = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_uids);
1460
1461         for (i=0; i<num_uids; i++) {
1462                 DOM_SID sid;
1463
1464                 uid_to_sid(&sid, uids[i]);
1465
1466                 if (!sid_check_is_in_our_domain(&sid)) {
1467                         DEBUG(5, ("Inconsistent SAM -- group member uid not "
1468                                   "in our domain\n"));
1469                         continue;
1470                 }
1471
1472                 sid_peek_rid(&sid, &(*pp_member_rids)[*p_num_members]);
1473                 *p_num_members += 1;
1474         }
1475
1476         return NT_STATUS_OK;
1477 }
1478
1479 static NTSTATUS pdb_default_enum_group_memberships(struct pdb_methods *methods,
1480                                                    TALLOC_CTX *mem_ctx,
1481                                                    struct samu *user,
1482                                                    DOM_SID **pp_sids,
1483                                                    gid_t **pp_gids,
1484                                                    size_t *p_num_groups)
1485 {
1486         size_t i;
1487         gid_t gid;
1488         struct passwd *pw;
1489         const char *username = pdb_get_username(user);
1490
1491
1492         /* Ignore the primary group SID.  Honor the real Unix primary group.
1493            The primary group SID is only of real use to Windows clients */
1494
1495         if ( !(pw = getpwnam_alloc(mem_ctx, username)) ) {
1496                 return NT_STATUS_NO_SUCH_USER;
1497         }
1498
1499         gid = pw->pw_gid;
1500
1501         TALLOC_FREE( pw );
1502
1503         if (!getgroups_unix_user(mem_ctx, username, gid, pp_gids, p_num_groups)) {
1504                 return NT_STATUS_NO_SUCH_USER;
1505         }
1506
1507         if (*p_num_groups == 0) {
1508                 smb_panic("primary group missing");
1509         }
1510
1511         *pp_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, *p_num_groups);
1512
1513         if (*pp_sids == NULL) {
1514                 TALLOC_FREE(*pp_gids);
1515                 return NT_STATUS_NO_MEMORY;
1516         }
1517
1518         for (i=0; i<*p_num_groups; i++) {
1519                 gid_to_sid(&(*pp_sids)[i], (*pp_gids)[i]);
1520         }
1521
1522         return NT_STATUS_OK;
1523 }
1524
1525 /*******************************************************************
1526  Look up a rid in the SAM we're responsible for (i.e. passdb)
1527  ********************************************************************/
1528
1529 static bool lookup_global_sam_rid(TALLOC_CTX *mem_ctx, uint32 rid,
1530                                   const char **name,
1531                                   enum lsa_SidType *psid_name_use,
1532                                   union unid_t *unix_id)
1533 {
1534         struct samu *sam_account = NULL;
1535         GROUP_MAP map;
1536         bool ret;
1537         DOM_SID sid;
1538
1539         *psid_name_use = SID_NAME_UNKNOWN;
1540
1541         DEBUG(5,("lookup_global_sam_rid: looking up RID %u.\n",
1542                  (unsigned int)rid));
1543
1544         sid_copy(&sid, get_global_sam_sid());
1545         sid_append_rid(&sid, rid);
1546
1547         /* see if the passdb can help us with the name of the user */
1548
1549         if ( !(sam_account = samu_new( NULL )) ) {
1550                 return False;
1551         }
1552
1553         /* BEING ROOT BLLOCK */
1554         become_root();
1555         if (pdb_getsampwsid(sam_account, &sid)) {
1556                 struct passwd *pw;
1557
1558                 unbecome_root();                /* -----> EXIT BECOME_ROOT() */
1559                 *name = talloc_strdup(mem_ctx, pdb_get_username(sam_account));
1560                 if (!*name) {
1561                         TALLOC_FREE(sam_account);
1562                         return False;
1563                 }
1564
1565                 *psid_name_use = SID_NAME_USER;
1566
1567                 TALLOC_FREE(sam_account);
1568
1569                 if (unix_id == NULL) {
1570                         return True;
1571                 }
1572
1573                 pw = Get_Pwnam_alloc(talloc_tos(), *name);
1574                 if (pw == NULL) {
1575                         return False;
1576                 }
1577                 unix_id->uid = pw->pw_uid;
1578                 TALLOC_FREE(pw);
1579                 return True;
1580         }
1581         TALLOC_FREE(sam_account);
1582
1583         ret = pdb_getgrsid(&map, sid);
1584         unbecome_root();
1585         /* END BECOME_ROOT BLOCK */
1586
1587         /* do not resolve SIDs to a name unless there is a valid
1588            gid associated with it */
1589
1590         if ( ret && (map.gid != (gid_t)-1) ) {
1591                 *name = talloc_strdup(mem_ctx, map.nt_name);
1592                 *psid_name_use = map.sid_name_use;
1593
1594                 if ( unix_id ) {
1595                         unix_id->gid = map.gid;
1596                 }
1597
1598                 return True;
1599         }
1600
1601         /* Windows will always map RID 513 to something.  On a non-domain
1602            controller, this gets mapped to SERVER\None. */
1603
1604         if ( unix_id ) {
1605                 DEBUG(5, ("Can't find a unix id for an unmapped group\n"));
1606                 return False;
1607         }
1608
1609         if ( rid == DOMAIN_GROUP_RID_USERS ) {
1610                 *name = talloc_strdup(mem_ctx, "None" );
1611                 *psid_name_use = SID_NAME_DOM_GRP;
1612
1613                 return True;
1614         }
1615
1616         return False;
1617 }
1618
1619 static NTSTATUS pdb_default_lookup_rids(struct pdb_methods *methods,
1620                                         const DOM_SID *domain_sid,
1621                                         int num_rids,
1622                                         uint32 *rids,
1623                                         const char **names,
1624                                         enum lsa_SidType *attrs)
1625 {
1626         int i;
1627         NTSTATUS result;
1628         bool have_mapped = False;
1629         bool have_unmapped = False;
1630
1631         if (sid_check_is_builtin(domain_sid)) {
1632
1633                 for (i=0; i<num_rids; i++) {
1634                         const char *name;
1635
1636                         if (lookup_builtin_rid(names, rids[i], &name)) {
1637                                 attrs[i] = SID_NAME_ALIAS;
1638                                 names[i] = name;
1639                                 DEBUG(5,("lookup_rids: %s:%d\n",
1640                                          names[i], attrs[i]));
1641                                 have_mapped = True;
1642                         } else {
1643                                 have_unmapped = True;
1644                                 attrs[i] = SID_NAME_UNKNOWN;
1645                         }
1646                 }
1647                 goto done;
1648         }
1649
1650         /* Should not happen, but better check once too many */
1651         if (!sid_check_is_domain(domain_sid)) {
1652                 return NT_STATUS_INVALID_HANDLE;
1653         }
1654
1655         for (i = 0; i < num_rids; i++) {
1656                 const char *name;
1657
1658                 if (lookup_global_sam_rid(names, rids[i], &name, &attrs[i],
1659                                           NULL)) {
1660                         if (name == NULL) {
1661                                 return NT_STATUS_NO_MEMORY;
1662                         }
1663                         names[i] = name;
1664                         DEBUG(5,("lookup_rids: %s:%d\n", names[i], attrs[i]));
1665                         have_mapped = True;
1666                 } else {
1667                         have_unmapped = True;
1668                         attrs[i] = SID_NAME_UNKNOWN;
1669                 }
1670         }
1671
1672  done:
1673
1674         result = NT_STATUS_NONE_MAPPED;
1675
1676         if (have_mapped)
1677                 result = have_unmapped ? STATUS_SOME_UNMAPPED : NT_STATUS_OK;
1678
1679         return result;
1680 }
1681
1682 #if 0
1683 static NTSTATUS pdb_default_lookup_names(struct pdb_methods *methods,
1684                                          const DOM_SID *domain_sid,
1685                                          int num_names,
1686                                          const char **names,
1687                                          uint32 *rids,
1688                                          enum lsa_SidType *attrs)
1689 {
1690         int i;
1691         NTSTATUS result;
1692         bool have_mapped = False;
1693         bool have_unmapped = False;
1694
1695         if (sid_check_is_builtin(domain_sid)) {
1696
1697                 for (i=0; i<num_names; i++) {
1698                         uint32 rid;
1699
1700                         if (lookup_builtin_name(names[i], &rid)) {
1701                                 attrs[i] = SID_NAME_ALIAS;
1702                                 rids[i] = rid;
1703                                 DEBUG(5,("lookup_rids: %s:%d\n",
1704                                          names[i], attrs[i]));
1705                                 have_mapped = True;
1706                         } else {
1707                                 have_unmapped = True;
1708                                 attrs[i] = SID_NAME_UNKNOWN;
1709                         }
1710                 }
1711                 goto done;
1712         }
1713
1714         /* Should not happen, but better check once too many */
1715         if (!sid_check_is_domain(domain_sid)) {
1716                 return NT_STATUS_INVALID_HANDLE;
1717         }
1718
1719         for (i = 0; i < num_names; i++) {
1720                 if (lookup_global_sam_name(names[i], 0, &rids[i], &attrs[i])) {
1721                         DEBUG(5,("lookup_names: %s-> %d:%d\n", names[i],
1722                                  rids[i], attrs[i]));
1723                         have_mapped = True;
1724                 } else {
1725                         have_unmapped = True;
1726                         attrs[i] = SID_NAME_UNKNOWN;
1727                 }
1728         }
1729
1730  done:
1731
1732         result = NT_STATUS_NONE_MAPPED;
1733
1734         if (have_mapped)
1735                 result = have_unmapped ? STATUS_SOME_UNMAPPED : NT_STATUS_OK;
1736
1737         return result;
1738 }
1739 #endif
1740
1741 static struct pdb_search *pdb_search_init(enum pdb_search_type type)
1742 {
1743         TALLOC_CTX *mem_ctx;
1744         struct pdb_search *result;
1745
1746         mem_ctx = talloc_init("pdb_search");
1747         if (mem_ctx == NULL) {
1748                 DEBUG(0, ("talloc_init failed\n"));
1749                 return NULL;
1750         }
1751
1752         result = TALLOC_P(mem_ctx, struct pdb_search);
1753         if (result == NULL) {
1754                 DEBUG(0, ("talloc failed\n"));
1755                 return NULL;
1756         }
1757
1758         result->mem_ctx = mem_ctx;
1759         result->type = type;
1760         result->cache = NULL;
1761         result->num_entries = 0;
1762         result->cache_size = 0;
1763         result->search_ended = False;
1764
1765         /* Segfault appropriately if not initialized */
1766         result->next_entry = NULL;
1767         result->search_end = NULL;
1768
1769         return result;
1770 }
1771
1772 static void fill_displayentry(TALLOC_CTX *mem_ctx, uint32 rid,
1773                               uint16 acct_flags,
1774                               const char *account_name,
1775                               const char *fullname,
1776                               const char *description,
1777                               struct samr_displayentry *entry)
1778 {
1779         entry->rid = rid;
1780         entry->acct_flags = acct_flags;
1781
1782         if (account_name != NULL)
1783                 entry->account_name = talloc_strdup(mem_ctx, account_name);
1784         else
1785                 entry->account_name = "";
1786
1787         if (fullname != NULL)
1788                 entry->fullname = talloc_strdup(mem_ctx, fullname);
1789         else
1790                 entry->fullname = "";
1791
1792         if (description != NULL)
1793                 entry->description = talloc_strdup(mem_ctx, description);
1794         else
1795                 entry->description = "";
1796 }
1797
1798 static bool user_search_in_progress = False;
1799 struct user_search {
1800         uint16 acct_flags;
1801 };
1802
1803 static bool next_entry_users(struct pdb_search *s,
1804                              struct samr_displayentry *entry)
1805 {
1806         struct user_search *state = (struct user_search *)s->private_data;
1807         struct samu *user = NULL;
1808
1809  next:
1810         if ( !(user = samu_new( NULL )) ) {
1811                 DEBUG(0, ("next_entry_users: samu_new() failed!\n"));
1812                 return False;
1813         }
1814
1815         if (!pdb_getsampwent(user)) {
1816                 TALLOC_FREE(user);
1817                 return False;
1818         }
1819
1820         if ((state->acct_flags != 0) &&
1821             ((pdb_get_acct_ctrl(user) & state->acct_flags) == 0)) {
1822                 TALLOC_FREE(user);
1823                 goto next;
1824         }
1825
1826         fill_displayentry(s->mem_ctx, pdb_get_user_rid(user),
1827                           pdb_get_acct_ctrl(user), pdb_get_username(user),
1828                           pdb_get_fullname(user), pdb_get_acct_desc(user),
1829                           entry);
1830
1831         TALLOC_FREE(user);
1832         return True;
1833 }
1834
1835 static void search_end_users(struct pdb_search *search)
1836 {
1837         pdb_endsampwent();
1838         user_search_in_progress = False;
1839 }
1840
1841 static bool pdb_default_search_users(struct pdb_methods *methods,
1842                                      struct pdb_search *search,
1843                                      uint32 acct_flags)
1844 {
1845         struct user_search *state;
1846
1847         if (user_search_in_progress) {
1848                 DEBUG(1, ("user search in progress\n"));
1849                 return False;
1850         }
1851
1852         if (!pdb_setsampwent(False, acct_flags)) {
1853                 DEBUG(5, ("Could not start search\n"));
1854                 return False;
1855         }
1856
1857         user_search_in_progress = True;
1858
1859         state = TALLOC_P(search->mem_ctx, struct user_search);
1860         if (state == NULL) {
1861                 DEBUG(0, ("talloc failed\n"));
1862                 return False;
1863         }
1864
1865         state->acct_flags = acct_flags;
1866
1867         search->private_data = state;
1868         search->next_entry = next_entry_users;
1869         search->search_end = search_end_users;
1870         return True;
1871 }
1872
1873 struct group_search {
1874         GROUP_MAP *groups;
1875         size_t num_groups, current_group;
1876 };
1877
1878 static bool next_entry_groups(struct pdb_search *s,
1879                               struct samr_displayentry *entry)
1880 {
1881         struct group_search *state = (struct group_search *)s->private_data;
1882         uint32 rid;
1883         GROUP_MAP *map = &state->groups[state->current_group];
1884
1885         if (state->current_group == state->num_groups)
1886                 return False;
1887
1888         sid_peek_rid(&map->sid, &rid);
1889
1890         fill_displayentry(s->mem_ctx, rid, 0, map->nt_name, NULL, map->comment,
1891                           entry);
1892
1893         state->current_group += 1;
1894         return True;
1895 }
1896
1897 static void search_end_groups(struct pdb_search *search)
1898 {
1899         struct group_search *state =
1900                 (struct group_search *)search->private_data;
1901         SAFE_FREE(state->groups);
1902 }
1903
1904 static bool pdb_search_grouptype(struct pdb_search *search,
1905                                  const DOM_SID *sid, enum lsa_SidType type)
1906 {
1907         struct group_search *state;
1908
1909         state = TALLOC_P(search->mem_ctx, struct group_search);
1910         if (state == NULL) {
1911                 DEBUG(0, ("talloc failed\n"));
1912                 return False;
1913         }
1914
1915         if (!pdb_enum_group_mapping(sid, type, &state->groups, &state->num_groups,
1916                                     True)) {
1917                 DEBUG(0, ("Could not enum groups\n"));
1918                 return False;
1919         }
1920
1921         state->current_group = 0;
1922         search->private_data = state;
1923         search->next_entry = next_entry_groups;
1924         search->search_end = search_end_groups;
1925         return True;
1926 }
1927
1928 static bool pdb_default_search_groups(struct pdb_methods *methods,
1929                                       struct pdb_search *search)
1930 {
1931         return pdb_search_grouptype(search, get_global_sam_sid(), SID_NAME_DOM_GRP);
1932 }
1933
1934 static bool pdb_default_search_aliases(struct pdb_methods *methods,
1935                                        struct pdb_search *search,
1936                                        const DOM_SID *sid)
1937 {
1938
1939         return pdb_search_grouptype(search, sid, SID_NAME_ALIAS);
1940 }
1941
1942 static struct samr_displayentry *pdb_search_getentry(struct pdb_search *search,
1943                                                      uint32 idx)
1944 {
1945         if (idx < search->num_entries)
1946                 return &search->cache[idx];
1947
1948         if (search->search_ended)
1949                 return NULL;
1950
1951         while (idx >= search->num_entries) {
1952                 struct samr_displayentry entry;
1953
1954                 if (!search->next_entry(search, &entry)) {
1955                         search->search_end(search);
1956                         search->search_ended = True;
1957                         break;
1958                 }
1959
1960                 ADD_TO_LARGE_ARRAY(search->mem_ctx, struct samr_displayentry,
1961                                    entry, &search->cache, &search->num_entries,
1962                                    &search->cache_size);
1963         }
1964
1965         return (search->num_entries > idx) ? &search->cache[idx] : NULL;
1966 }
1967
1968 struct pdb_search *pdb_search_users(uint32 acct_flags)
1969 {
1970         struct pdb_methods *pdb = pdb_get_methods();
1971         struct pdb_search *result;
1972
1973         result = pdb_search_init(PDB_USER_SEARCH);
1974         if (result == NULL) {
1975                 return NULL;
1976         }
1977
1978         if (!pdb->search_users(pdb, result, acct_flags)) {
1979                 talloc_destroy(result->mem_ctx);
1980                 return NULL;
1981         }
1982         return result;
1983 }
1984
1985 struct pdb_search *pdb_search_groups(void)
1986 {
1987         struct pdb_methods *pdb = pdb_get_methods();
1988         struct pdb_search *result;
1989
1990         result = pdb_search_init(PDB_GROUP_SEARCH);
1991         if (result == NULL) {
1992                  return NULL;
1993         }
1994
1995         if (!pdb->search_groups(pdb, result)) {
1996                 talloc_destroy(result->mem_ctx);
1997                 return NULL;
1998         }
1999         return result;
2000 }
2001
2002 struct pdb_search *pdb_search_aliases(const DOM_SID *sid)
2003 {
2004         struct pdb_methods *pdb = pdb_get_methods();
2005         struct pdb_search *result;
2006
2007         if (pdb == NULL) return NULL;
2008
2009         result = pdb_search_init(PDB_ALIAS_SEARCH);
2010         if (result == NULL) return NULL;
2011
2012         if (!pdb->search_aliases(pdb, result, sid)) {
2013                 talloc_destroy(result->mem_ctx);
2014                 return NULL;
2015         }
2016         return result;
2017 }
2018
2019 uint32 pdb_search_entries(struct pdb_search *search,
2020                           uint32 start_idx, uint32 max_entries,
2021                           struct samr_displayentry **result)
2022 {
2023         struct samr_displayentry *end_entry;
2024         uint32 end_idx = start_idx+max_entries-1;
2025
2026         /* The first entry needs to be searched after the last. Otherwise the
2027          * first entry might have moved due to a realloc during the search for
2028          * the last entry. */
2029
2030         end_entry = pdb_search_getentry(search, end_idx);
2031         *result = pdb_search_getentry(search, start_idx);
2032
2033         if (end_entry != NULL)
2034                 return max_entries;
2035
2036         if (start_idx >= search->num_entries)
2037                 return 0;
2038
2039         return search->num_entries - start_idx;
2040 }
2041
2042 void pdb_search_destroy(struct pdb_search *search)
2043 {
2044         if (search == NULL)
2045                 return;
2046
2047         if (!search->search_ended)
2048                 search->search_end(search);
2049
2050         talloc_destroy(search->mem_ctx);
2051 }
2052
2053 /*******************************************************************
2054  trustodm methods
2055  *******************************************************************/
2056
2057 bool pdb_get_trusteddom_pw(const char *domain, char** pwd, DOM_SID *sid,
2058                            time_t *pass_last_set_time)
2059 {
2060         struct pdb_methods *pdb = pdb_get_methods();
2061         return pdb->get_trusteddom_pw(pdb, domain, pwd, sid,
2062                         pass_last_set_time);
2063 }
2064
2065 bool pdb_set_trusteddom_pw(const char* domain, const char* pwd,
2066                            const DOM_SID *sid)
2067 {
2068         struct pdb_methods *pdb = pdb_get_methods();
2069         return pdb->set_trusteddom_pw(pdb, domain, pwd, sid);
2070 }
2071
2072 bool pdb_del_trusteddom_pw(const char *domain)
2073 {
2074         struct pdb_methods *pdb = pdb_get_methods();
2075         return pdb->del_trusteddom_pw(pdb, domain);
2076 }
2077
2078 NTSTATUS pdb_enum_trusteddoms(TALLOC_CTX *mem_ctx, uint32 *num_domains,
2079                               struct trustdom_info ***domains)
2080 {
2081         struct pdb_methods *pdb = pdb_get_methods();
2082         return pdb->enum_trusteddoms(pdb, mem_ctx, num_domains, domains);
2083 }
2084
2085 /*******************************************************************
2086  the defaults for trustdom methods:
2087  these simply call the original passdb/secrets.c actions,
2088  to be replaced by pdb_ldap.
2089  *******************************************************************/
2090
2091 static bool pdb_default_get_trusteddom_pw(struct pdb_methods *methods,
2092                                           const char *domain,
2093                                           char** pwd,
2094                                           DOM_SID *sid,
2095                                           time_t *pass_last_set_time)
2096 {
2097         return secrets_fetch_trusted_domain_password(domain, pwd,
2098                                 sid, pass_last_set_time);
2099
2100 }
2101
2102 static bool pdb_default_set_trusteddom_pw(struct pdb_methods *methods,
2103                                           const char* domain,
2104                                           const char* pwd,
2105                                           const DOM_SID *sid)
2106 {
2107         return secrets_store_trusted_domain_password(domain, pwd, sid);
2108 }
2109
2110 static bool pdb_default_del_trusteddom_pw(struct pdb_methods *methods,
2111                                           const char *domain)
2112 {
2113         return trusted_domain_password_delete(domain);
2114 }
2115
2116 static NTSTATUS pdb_default_enum_trusteddoms(struct pdb_methods *methods,
2117                                              TALLOC_CTX *mem_ctx,
2118                                              uint32 *num_domains,
2119                                              struct trustdom_info ***domains)
2120 {
2121         return secrets_trusted_domains(mem_ctx, num_domains, domains);
2122 }
2123
2124 /*******************************************************************
2125  Create a pdb_methods structure and initialize it with the default
2126  operations.  In this way a passdb module can simply implement
2127  the functionality it cares about.  However, normally this is done
2128  in groups of related functions.
2129 *******************************************************************/
2130
2131 NTSTATUS make_pdb_method( struct pdb_methods **methods )
2132 {
2133         /* allocate memory for the structure as its own talloc CTX */
2134
2135         if ( !(*methods = TALLOC_ZERO_P(NULL, struct pdb_methods) ) ) {
2136                 return NT_STATUS_NO_MEMORY;
2137         }
2138
2139         (*methods)->setsampwent = pdb_default_setsampwent;
2140         (*methods)->endsampwent = pdb_default_endsampwent;
2141         (*methods)->getsampwent = pdb_default_getsampwent;
2142         (*methods)->getsampwnam = pdb_default_getsampwnam;
2143         (*methods)->getsampwsid = pdb_default_getsampwsid;
2144         (*methods)->create_user = pdb_default_create_user;
2145         (*methods)->delete_user = pdb_default_delete_user;
2146         (*methods)->add_sam_account = pdb_default_add_sam_account;
2147         (*methods)->update_sam_account = pdb_default_update_sam_account;
2148         (*methods)->delete_sam_account = pdb_default_delete_sam_account;
2149         (*methods)->rename_sam_account = pdb_default_rename_sam_account;
2150         (*methods)->update_login_attempts = pdb_default_update_login_attempts;
2151
2152         (*methods)->getgrsid = pdb_default_getgrsid;
2153         (*methods)->getgrgid = pdb_default_getgrgid;
2154         (*methods)->getgrnam = pdb_default_getgrnam;
2155         (*methods)->create_dom_group = pdb_default_create_dom_group;
2156         (*methods)->delete_dom_group = pdb_default_delete_dom_group;
2157         (*methods)->add_group_mapping_entry = pdb_default_add_group_mapping_entry;
2158         (*methods)->update_group_mapping_entry = pdb_default_update_group_mapping_entry;
2159         (*methods)->delete_group_mapping_entry = pdb_default_delete_group_mapping_entry;
2160         (*methods)->enum_group_mapping = pdb_default_enum_group_mapping;
2161         (*methods)->enum_group_members = pdb_default_enum_group_members;
2162         (*methods)->enum_group_memberships = pdb_default_enum_group_memberships;
2163         (*methods)->set_unix_primary_group = pdb_default_set_unix_primary_group;
2164         (*methods)->add_groupmem = pdb_default_add_groupmem;
2165         (*methods)->del_groupmem = pdb_default_del_groupmem;
2166         (*methods)->create_alias = pdb_default_create_alias;
2167         (*methods)->delete_alias = pdb_default_delete_alias;
2168         (*methods)->get_aliasinfo = pdb_default_get_aliasinfo;
2169         (*methods)->set_aliasinfo = pdb_default_set_aliasinfo;
2170         (*methods)->add_aliasmem = pdb_default_add_aliasmem;
2171         (*methods)->del_aliasmem = pdb_default_del_aliasmem;
2172         (*methods)->enum_aliasmem = pdb_default_enum_aliasmem;
2173         (*methods)->enum_alias_memberships = pdb_default_alias_memberships;
2174         (*methods)->lookup_rids = pdb_default_lookup_rids;
2175         (*methods)->get_account_policy = pdb_default_get_account_policy;
2176         (*methods)->set_account_policy = pdb_default_set_account_policy;
2177         (*methods)->get_seq_num = pdb_default_get_seq_num;
2178         (*methods)->uid_to_rid = pdb_default_uid_to_rid;
2179         (*methods)->uid_to_sid = pdb_default_uid_to_sid;
2180         (*methods)->gid_to_sid = pdb_default_gid_to_sid;
2181         (*methods)->sid_to_id = pdb_default_sid_to_id;
2182
2183         (*methods)->search_users = pdb_default_search_users;
2184         (*methods)->search_groups = pdb_default_search_groups;
2185         (*methods)->search_aliases = pdb_default_search_aliases;
2186
2187         (*methods)->get_trusteddom_pw = pdb_default_get_trusteddom_pw;
2188         (*methods)->set_trusteddom_pw = pdb_default_set_trusteddom_pw;
2189         (*methods)->del_trusteddom_pw = pdb_default_del_trusteddom_pw;
2190         (*methods)->enum_trusteddoms  = pdb_default_enum_trusteddoms;
2191
2192         return NT_STATUS_OK;
2193 }