source: branches/samba-3.2.x/source/winbindd/idmap.c

Last change on this file was 272, checked in by Herwig Bauernfeind, 16 years ago

Update 3.2 to 3.2.12
File size: 40.6 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 ID Mapping
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003-2007
7 Copyright (C) Jeremy Allison 2006
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "winbindd.h"
25
26#undef DBGC_CLASS
27#define DBGC_CLASS DBGC_IDMAP
28
29static_decl_idmap;
30
31struct idmap_backend {
32 const char *name;
33 struct idmap_methods *methods;
34 struct idmap_backend *prev, *next;
35};
36
37struct idmap_alloc_backend {
38 const char *name;
39 struct idmap_alloc_methods *methods;
40 struct idmap_alloc_backend *prev, *next;
41};
42
43struct idmap_cache_ctx;
44
45struct idmap_alloc_context {
46 const char *params;
47 struct idmap_alloc_methods *methods;
48 bool initialized;
49};
50
51static TALLOC_CTX *idmap_ctx = NULL;
52static struct idmap_cache_ctx *idmap_cache;
53
54static struct idmap_backend *backends = NULL;
55static struct idmap_domain **idmap_domains = NULL;
56static int num_domains = 0;
57static int pdb_dom_num = -1;
58static int def_dom_num = -1;
59
60static struct idmap_alloc_backend *alloc_backends = NULL;
61static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
62
63#define IDMAP_CHECK_RET(ret) do { \
64 if ( ! NT_STATUS_IS_OK(ret)) { \
65 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
66 goto done; \
67 } } while(0)
68#define IDMAP_REPORT_RET(ret) do { \
69 if ( ! NT_STATUS_IS_OK(ret)) { \
70 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
71 } } while(0)
72#define IDMAP_CHECK_ALLOC(mem) do { \
73 if (!mem) { \
74 DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; \
75 goto done; \
76 } } while(0)
77
78static struct idmap_methods *get_methods(const char *name)
79{
80 struct idmap_backend *b;
81
82 for (b = backends; b; b = b->next) {
83 if (strequal(b->name, name)) {
84 return b->methods;
85 }
86 }
87
88 return NULL;
89}
90
91static struct idmap_alloc_methods *get_alloc_methods(const char *name)
92{
93 struct idmap_alloc_backend *b;
94
95 for (b = alloc_backends; b; b = b->next) {
96 if (strequal(b->name, name)) {
97 return b->methods;
98 }
99 }
100
101 return NULL;
102}
103
104bool idmap_is_offline(void)
105{
106 return ( lp_winbind_offline_logon() &&
107 get_global_winbindd_state_offline() );
108}
109
110/**********************************************************************
111 Allow a module to register itself as a method.
112**********************************************************************/
113
114NTSTATUS smb_register_idmap(int version, const char *name,
115 struct idmap_methods *methods)
116{
117 struct idmap_methods *test;
118 struct idmap_backend *entry;
119
120 if (!idmap_ctx) {
121 return NT_STATUS_INTERNAL_DB_ERROR;
122 }
123
124 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
125 DEBUG(0, ("Failed to register idmap module.\n"
126 "The module was compiled against "
127 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
128 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
129 "Please recompile against the current version "
130 "of samba!\n",
131 version, SMB_IDMAP_INTERFACE_VERSION));
132 return NT_STATUS_OBJECT_TYPE_MISMATCH;
133 }
134
135 if (!name || !name[0] || !methods) {
136 DEBUG(0,("Called with NULL pointer or empty name!\n"));
137 return NT_STATUS_INVALID_PARAMETER;
138 }
139
140 test = get_methods(name);
141 if (test) {
142 DEBUG(0,("Idmap module %s already registered!\n", name));
143 return NT_STATUS_OBJECT_NAME_COLLISION;
144 }
145
146 entry = talloc(idmap_ctx, struct idmap_backend);
147 if ( ! entry) {
148 DEBUG(0,("Out of memory!\n"));
149 return NT_STATUS_NO_MEMORY;
150 }
151 entry->name = talloc_strdup(idmap_ctx, name);
152 if ( ! entry->name) {
153 DEBUG(0,("Out of memory!\n"));
154 return NT_STATUS_NO_MEMORY;
155 }
156 entry->methods = methods;
157
158 DLIST_ADD(backends, entry);
159 DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
160 return NT_STATUS_OK;
161}
162
163/**********************************************************************
164 Allow a module to register itself as a method.
165**********************************************************************/
166
167NTSTATUS smb_register_idmap_alloc(int version, const char *name,
168 struct idmap_alloc_methods *methods)
169{
170 struct idmap_alloc_methods *test;
171 struct idmap_alloc_backend *entry;
172
173 if (!idmap_ctx) {
174 return NT_STATUS_INTERNAL_DB_ERROR;
175 }
176
177 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
178 DEBUG(0, ("Failed to register idmap alloc module.\n"
179 "The module was compiled against "
180 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
181 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
182 "Please recompile against the current version "
183 "of samba!\n",
184 version, SMB_IDMAP_INTERFACE_VERSION));
185 return NT_STATUS_OBJECT_TYPE_MISMATCH;
186 }
187
188 if (!name || !name[0] || !methods) {
189 DEBUG(0,("Called with NULL pointer or empty name!\n"));
190 return NT_STATUS_INVALID_PARAMETER;
191 }
192
193 test = get_alloc_methods(name);
194 if (test) {
195 DEBUG(0,("idmap_alloc module %s already registered!\n", name));
196 return NT_STATUS_OBJECT_NAME_COLLISION;
197 }
198
199 entry = talloc(idmap_ctx, struct idmap_alloc_backend);
200 if ( ! entry) {
201 DEBUG(0,("Out of memory!\n"));
202 return NT_STATUS_NO_MEMORY;
203 }
204 entry->name = talloc_strdup(idmap_ctx, name);
205 if ( ! entry->name) {
206 DEBUG(0,("Out of memory!\n"));
207 return NT_STATUS_NO_MEMORY;
208 }
209 entry->methods = methods;
210
211 DLIST_ADD(alloc_backends, entry);
212 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
213 return NT_STATUS_OK;
214}
215
216static int close_domain_destructor(struct idmap_domain *dom)
217{
218 NTSTATUS ret;
219
220 ret = dom->methods->close_fn(dom);
221 if (!NT_STATUS_IS_OK(ret)) {
222 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
223 }
224
225 return 0;
226}
227
228/**************************************************************************
229 Shutdown.
230**************************************************************************/
231
232NTSTATUS idmap_close(void)
233{
234 /* close the alloc backend first before freeing idmap_ctx */
235 if (idmap_alloc_ctx) {
236 idmap_alloc_ctx->methods->close_fn();
237 idmap_alloc_ctx->methods = NULL;
238 }
239 alloc_backends = NULL;
240
241 /* this talloc_free call will fire the talloc destructors
242 * that will free all active backends resources */
243 TALLOC_FREE(idmap_ctx);
244 idmap_cache = NULL;
245 idmap_domains = NULL;
246 backends = NULL;
247
248 return NT_STATUS_OK;
249}
250
251/****************************************************************************
252 ****************************************************************************/
253
254NTSTATUS idmap_init_cache(void)
255{
256 /* Always initialize the cache. We'll have to delay initialization
257 of backends if we are offline */
258
259 if ( idmap_ctx ) {
260 return NT_STATUS_OK;
261 }
262
263 if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
264 return NT_STATUS_NO_MEMORY;
265 }
266
267 if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
268 return NT_STATUS_UNSUCCESSFUL;
269 }
270
271 return NT_STATUS_OK;
272}
273
274/****************************************************************************
275 ****************************************************************************/
276
277NTSTATUS idmap_init(void)
278{
279 NTSTATUS ret;
280 static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
281 struct idmap_domain *dom;
282 char *compat_backend = NULL;
283 char *compat_params = NULL;
284 const char **dom_list = NULL;
285 const char *default_domain = NULL;
286 char *alloc_backend = NULL;
287 bool default_already_defined = False;
288 bool pri_dom_is_in_list = False;
289 int compat = 0;
290 int i;
291
292 ret = idmap_init_cache();
293 if (!NT_STATUS_IS_OK(ret))
294 return ret;
295
296 if (NT_STATUS_IS_OK(idmap_init_status)) {
297 return NT_STATUS_OK;
298 }
299
300 /* We can't reliably call intialization code here unless
301 we are online. But return NT_STATUS_OK so the upper
302 level code doesn't abort idmap lookups. */
303
304 if ( get_global_winbindd_state_offline() ) {
305 idmap_init_status = NT_STATUS_FILE_IS_OFFLINE;
306 return NT_STATUS_OK;
307 }
308
309 static_init_idmap;
310
311 dom_list = lp_idmap_domains();
312
313 if ( lp_idmap_backend() ) {
314 const char **compat_list = lp_idmap_backend();
315 char *p = NULL;
316 const char *q = NULL;
317
318 if ( dom_list ) {
319 DEBUG(0, ("WARNING: idmap backend and idmap domains are"
320 " mutually exclusive!\n"));
321 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
322 } else {
323 compat = 1;
324
325 compat_backend = talloc_strdup(idmap_ctx, *compat_list);
326
327 /* strip any leading idmap_ prefix of */
328 if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
329 q = *compat_list += 6;
330 DEBUG(0, ("WARNING: idmap backend uses obsolete"
331 " and deprecated 'idmap_' prefix.\n"
332 "Please replace 'idmap_%s' by '%s' in"
333 " %s\n", q, q, get_dyn_CONFIGFILE()));
334 compat_backend = talloc_strdup(idmap_ctx, q);
335 } else {
336 compat_backend = talloc_strdup(idmap_ctx,
337 *compat_list);
338 }
339
340 if (compat_backend == NULL ) {
341 ret = NT_STATUS_NO_MEMORY;
342 goto done;
343 }
344
345 /* separate the backend and module arguements */
346 if ((p = strchr(compat_backend, ':')) != NULL) {
347 *p = '\0';
348 compat_params = p + 1;
349 }
350 }
351 } else if ( !dom_list ) {
352 /* Back compatible: without idmap domains and explicit
353 idmap backend. Taking default idmap backend: tdb */
354
355 compat = 1;
356 compat_backend = talloc_strdup( idmap_ctx, "tdb");
357 compat_params = compat_backend;
358 }
359
360 if ( ! dom_list) {
361 /* generate a list with our main domain */
362 const char ** dl;
363
364 dl = talloc_array(idmap_ctx, const char *, 2);
365 if (dl == NULL) {
366 ret = NT_STATUS_NO_MEMORY;
367 goto done;
368 }
369 dl[0] = talloc_strdup(dl, lp_workgroup());
370 if (dl[0] == NULL) {
371 ret = NT_STATUS_NO_MEMORY;
372 goto done;
373 }
374
375 /* terminate */
376 dl[1] = NULL;
377
378 dom_list = dl;
379 default_domain = dl[0];
380 }
381
382 /***************************
383 * initialize idmap domains
384 */
385 DEBUG(1, ("Initializing idmap domains\n"));
386
387 for (i=0, num_domains=0; dom_list[i]; i++) {
388 const char *parm_backend;
389 char *config_option;
390
391 /* ignore BUILTIN and local MACHINE domains */
392 if (strequal(dom_list[i], "BUILTIN")
393 || strequal(dom_list[i], get_global_sam_name()))
394 {
395 DEBUG(0,("idmap_init: Ignoring domain %s\n",
396 dom_list[i]));
397 continue;
398 }
399
400 if ((dom_list[i] != default_domain) &&
401 strequal(dom_list[i], lp_workgroup())) {
402 pri_dom_is_in_list = True;
403 }
404 /* init domain */
405
406 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
407 IDMAP_CHECK_ALLOC(dom);
408
409 dom->name = talloc_strdup(dom, dom_list[i]);
410 IDMAP_CHECK_ALLOC(dom->name);
411
412 config_option = talloc_asprintf(dom, "idmap config %s",
413 dom->name);
414 IDMAP_CHECK_ALLOC(config_option);
415
416 /* default or specific ? */
417
418 dom->default_domain = lp_parm_bool(-1, config_option,
419 "default", False);
420
421 if (dom->default_domain ||
422 (default_domain && strequal(dom_list[i], default_domain))) {
423
424 /* make sure this is set even when we match
425 * default_domain */
426 dom->default_domain = True;
427
428 if (default_already_defined) {
429 DEBUG(1, ("ERROR: Multiple domains defined as"
430 " default!\n"));
431 ret = NT_STATUS_INVALID_PARAMETER;
432 goto done;
433 }
434
435 default_already_defined = True;
436
437 }
438
439 dom->readonly = lp_parm_bool(-1, config_option,
440 "readonly", False);
441
442 /* find associated backend (default: tdb) */
443 if (compat) {
444 parm_backend = talloc_strdup(idmap_ctx, compat_backend);
445 } else {
446 parm_backend = talloc_strdup(idmap_ctx,
447 lp_parm_const_string(
448 -1, config_option,
449 "backend", "tdb"));
450 }
451 IDMAP_CHECK_ALLOC(parm_backend);
452
453 /* get the backend methods for this domain */
454 dom->methods = get_methods(parm_backend);
455
456 if ( ! dom->methods) {
457 ret = smb_probe_module("idmap", parm_backend);
458 if (NT_STATUS_IS_OK(ret)) {
459 dom->methods = get_methods(parm_backend);
460 }
461 }
462 if ( ! dom->methods) {
463 DEBUG(0, ("ERROR: Could not get methods for "
464 "backend %s\n", parm_backend));
465 ret = NT_STATUS_UNSUCCESSFUL;
466 goto done;
467 }
468
469 /* check the set_mapping function exists otherwise mark the
470 * module as readonly */
471 if ( ! dom->methods->set_mapping) {
472 DEBUG(5, ("Forcing to readonly, as this module can't"
473 " store arbitrary mappings.\n"));
474 dom->readonly = True;
475 }
476
477 /* now that we have methods,
478 * set the destructor for this domain */
479 talloc_set_destructor(dom, close_domain_destructor);
480
481 if (compat_params) {
482 dom->params = talloc_strdup(dom, compat_params);
483 IDMAP_CHECK_ALLOC(dom->params);
484 } else {
485 dom->params = NULL;
486 }
487
488 /* Finally instance a backend copy for this domain */
489 ret = dom->methods->init(dom);
490 if ( ! NT_STATUS_IS_OK(ret)) {
491 DEBUG(0, ("ERROR: Initialization failed for backend "
492 "%s (domain %s), deferred!\n",
493 parm_backend, dom->name));
494 }
495 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
496 struct idmap_domain *, i+1);
497 if ( ! idmap_domains) {
498 DEBUG(0, ("Out of memory!\n"));
499 ret = NT_STATUS_NO_MEMORY;
500 goto done;
501 }
502 idmap_domains[num_domains] = dom;
503
504 /* save default domain position for future uses */
505 if (dom->default_domain) {
506 def_dom_num = num_domains;
507 }
508
509 /* Bump counter to next available slot */
510
511 num_domains++;
512
513 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
514 dom->name, parm_backend,
515 dom->default_domain?"":"not ",
516 dom->readonly?"":"not "));
517
518 talloc_free(config_option);
519 }
520
521 /* on DCs we need to add idmap_tdb as the default backend if compat is
522 * defined (when the old implicit configuration is used)
523 * This is not done in the previous loop a on member server we exclude
524 * the local domain. But on a DC the local domain is the only domain
525 * available therefore we are left with no default domain */
526 if (((lp_server_role() == ROLE_DOMAIN_PDC) ||
527 (lp_server_role() == ROLE_DOMAIN_BDC)) &&
528 ((num_domains == 0) && (compat == 1))) {
529
530 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
531 IDMAP_CHECK_ALLOC(dom);
532
533 dom->name = talloc_strdup(dom, "__default__");
534 IDMAP_CHECK_ALLOC(dom->name);
535
536 dom->default_domain = True;
537 dom->readonly = False;
538
539 /* get the backend methods for this domain */
540 dom->methods = get_methods(compat_backend);
541 if ( ! dom->methods) {
542 ret = smb_probe_module("idmap", compat_backend);
543 if (NT_STATUS_IS_OK(ret)) {
544 dom->methods = get_methods(compat_backend);
545 }
546 }
547 if ( ! dom->methods) {
548 DEBUG(0, ("ERROR: Could not get methods for "
549 "backend %s\n", compat_backend));
550 ret = NT_STATUS_UNSUCCESSFUL;
551 goto done;
552 }
553
554 /* now that we have methods,
555 * set the destructor for this domain */
556 talloc_set_destructor(dom, close_domain_destructor);
557
558 if (compat_params) {
559 dom->params = talloc_strdup(dom, compat_params);
560 IDMAP_CHECK_ALLOC(dom->params);
561 } else {
562 dom->params = NULL;
563 }
564
565 /* Finally instance a backend copy for this domain */
566 ret = dom->methods->init(dom);
567 if ( ! NT_STATUS_IS_OK(ret)) {
568 DEBUG(0, ("ERROR: Initialization failed for backend "
569 "%s (domain %s), deferred!\n",
570 compat_backend, dom->name));
571 }
572 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
573 struct idmap_domain *, 2);
574 if ( ! idmap_domains) {
575 DEBUG(0, ("Out of memory!\n"));
576 ret = NT_STATUS_NO_MEMORY;
577 goto done;
578 }
579 idmap_domains[num_domains] = dom;
580
581 def_dom_num = num_domains;
582
583 /* Bump counter to next available slot */
584
585 num_domains++;
586
587 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
588 dom->name, compat_backend,
589 dom->default_domain?"":"not ",
590 dom->readonly?"":"not "));
591 }
592
593 /* automatically add idmap_nss backend if needed */
594 if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
595 ( ! pri_dom_is_in_list) &&
596 lp_winbind_trusted_domains_only()) {
597
598 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
599 IDMAP_CHECK_ALLOC(dom);
600
601 dom->name = talloc_strdup(dom, lp_workgroup());
602 IDMAP_CHECK_ALLOC(dom->name);
603
604 dom->default_domain = False;
605 dom->readonly = True;
606
607 /* get the backend methods for nss */
608 dom->methods = get_methods("nss");
609
610 /* (the nss module is always statically linked) */
611 if ( ! dom->methods) {
612 DEBUG(0, ("ERROR: No methods for idmap_nss ?!\n"));
613 ret = NT_STATUS_UNSUCCESSFUL;
614 goto done;
615 }
616
617 /* now that we have methods,
618 * set the destructor for this domain */
619 talloc_set_destructor(dom, close_domain_destructor);
620
621 if (compat_params) {
622 dom->params = talloc_strdup(dom, compat_params);
623 IDMAP_CHECK_ALLOC(dom->params);
624 } else {
625 dom->params = NULL;
626 }
627
628 /* Finally instance a backend copy for this domain */
629 ret = dom->methods->init(dom);
630 if ( ! NT_STATUS_IS_OK(ret)) {
631 DEBUG(0, ("ERROR: Init. failed for idmap_nss ?!\n"));
632 ret = NT_STATUS_UNSUCCESSFUL;
633 goto done;
634 }
635
636 idmap_domains = talloc_realloc(idmap_ctx,
637 idmap_domains,
638 struct idmap_domain *,
639 num_domains+1);
640 if ( ! idmap_domains) {
641 DEBUG(0, ("Out of memory!\n"));
642 ret = NT_STATUS_NO_MEMORY;
643 goto done;
644 }
645 idmap_domains[num_domains] = dom;
646
647 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n",
648 dom->name ));
649
650 num_domains++;
651 }
652
653 /**** automatically add idmap_passdb backend ****/
654 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
655 IDMAP_CHECK_ALLOC(dom);
656
657 dom->name = talloc_strdup(dom, get_global_sam_name());
658 IDMAP_CHECK_ALLOC(dom->name);
659
660 dom->default_domain = False;
661 dom->readonly = True;
662
663 /* get the backend methods for passdb */
664 dom->methods = get_methods("passdb");
665
666 /* (the passdb module is always statically linked) */
667 if ( ! dom->methods) {
668 DEBUG(0, ("ERROR: No methods for idmap_passdb ?!\n"));
669 ret = NT_STATUS_UNSUCCESSFUL;
670 goto done;
671 }
672
673 /* now that we have methods, set the destructor for this domain */
674 talloc_set_destructor(dom, close_domain_destructor);
675
676 if (compat_params) {
677 dom->params = talloc_strdup(dom, compat_params);
678 IDMAP_CHECK_ALLOC(dom->params);
679 } else {
680 dom->params = NULL;
681 }
682
683 /* Finally instance a backend copy for this domain */
684 ret = dom->methods->init(dom);
685 if ( ! NT_STATUS_IS_OK(ret)) {
686 DEBUG(0, ("ERROR: Init. failed for idmap_passdb ?!\n"));
687 ret = NT_STATUS_UNSUCCESSFUL;
688 goto done;
689 }
690
691 idmap_domains = talloc_realloc(idmap_ctx,
692 idmap_domains,
693 struct idmap_domain *,
694 num_domains+1);
695 if ( ! idmap_domains) {
696 DEBUG(0, ("Out of memory!\n"));
697 ret = NT_STATUS_NO_MEMORY;
698 goto done;
699 }
700 idmap_domains[num_domains] = dom;
701
702 /* needed to handle special BUILTIN and wellknown SIDs cases */
703 pdb_dom_num = num_domains;
704
705 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n",
706 dom->name));
707
708 num_domains++;
709 /**** finished adding idmap_passdb backend ****/
710
711 /* sort domains so that the default is the last one */
712 /* don't sort if no default domain defined */
713 if (def_dom_num != -1 && def_dom_num != num_domains-1) {
714 /* default is not last, move it */
715 struct idmap_domain *tmp;
716
717 if (pdb_dom_num > def_dom_num) {
718 pdb_dom_num --;
719
720 } else if (pdb_dom_num == def_dom_num) { /* ?? */
721 pdb_dom_num = num_domains - 1;
722 }
723
724 tmp = idmap_domains[def_dom_num];
725
726 for (i = def_dom_num; i < num_domains-1; i++) {
727 idmap_domains[i] = idmap_domains[i+1];
728 }
729 idmap_domains[i] = tmp;
730 def_dom_num = i;
731 }
732
733
734 /* Initialize alloc module */
735
736 DEBUG(3, ("Initializing idmap alloc module\n"));
737
738 alloc_backend = NULL;
739 if (compat) {
740 alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
741 } else {
742 char *ab = lp_idmap_alloc_backend();
743
744 if (ab && (ab[0] != '\0')) {
745 alloc_backend = talloc_strdup(idmap_ctx,
746 lp_idmap_alloc_backend());
747 }
748 }
749
750 if ( alloc_backend ) {
751
752 idmap_alloc_ctx = TALLOC_ZERO_P(idmap_ctx,
753 struct idmap_alloc_context);
754 IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
755
756 idmap_alloc_ctx->methods = get_alloc_methods(alloc_backend);
757 if ( ! idmap_alloc_ctx->methods) {
758 ret = smb_probe_module("idmap", alloc_backend);
759 if (NT_STATUS_IS_OK(ret)) {
760 idmap_alloc_ctx->methods =
761 get_alloc_methods(alloc_backend);
762 }
763 }
764 if (idmap_alloc_ctx->methods) {
765
766 if (compat_params) {
767 idmap_alloc_ctx->params =
768 talloc_strdup(idmap_alloc_ctx,
769 compat_params);
770 IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
771 } else {
772 idmap_alloc_ctx->params = NULL;
773 }
774
775 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
776 if ( ! NT_STATUS_IS_OK(ret)) {
777 DEBUG(0, ("ERROR: Initialization failed for "
778 "alloc backend %s, deferred!\n",
779 alloc_backend));
780 } else {
781 idmap_alloc_ctx->initialized = True;
782 }
783 } else {
784 DEBUG(2, ("idmap_init: Unable to get methods for "
785 "alloc backend %s\n",
786 alloc_backend));
787 /* certain compat backends are just readonly */
788 if ( compat ) {
789 TALLOC_FREE(idmap_alloc_ctx);
790 ret = NT_STATUS_OK;
791 } else {
792 ret = NT_STATUS_UNSUCCESSFUL;
793 }
794 }
795 }
796
797 /* cleanup temporary strings */
798 TALLOC_FREE( compat_backend );
799
800 idmap_init_status = NT_STATUS_OK;
801
802 return ret;
803
804done:
805 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
806 idmap_close();
807
808 return ret;
809}
810
811static NTSTATUS idmap_alloc_init(void)
812{
813 NTSTATUS ret;
814
815 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
816 return ret;
817 }
818
819 if ( ! idmap_alloc_ctx) {
820 return NT_STATUS_NOT_SUPPORTED;
821 }
822
823 if ( ! idmap_alloc_ctx->initialized) {
824 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
825 if ( ! NT_STATUS_IS_OK(ret)) {
826 DEBUG(0, ("ERROR: Initialization failed for alloc "
827 "backend, deferred!\n"));
828 return ret;
829 } else {
830 idmap_alloc_ctx->initialized = True;
831 }
832 }
833
834 return NT_STATUS_OK;
835}
836
837/**************************************************************************
838 idmap allocator interface functions
839**************************************************************************/
840
841NTSTATUS idmap_allocate_uid(struct unixid *id)
842{
843 NTSTATUS ret;
844
845 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
846 return ret;
847 }
848
849 id->type = ID_TYPE_UID;
850 return idmap_alloc_ctx->methods->allocate_id(id);
851}
852
853NTSTATUS idmap_allocate_gid(struct unixid *id)
854{
855 NTSTATUS ret;
856
857 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
858 return ret;
859 }
860
861 id->type = ID_TYPE_GID;
862 return idmap_alloc_ctx->methods->allocate_id(id);
863}
864
865NTSTATUS idmap_set_uid_hwm(struct unixid *id)
866{
867 NTSTATUS ret;
868
869 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
870 return ret;
871 }
872
873 id->type = ID_TYPE_UID;
874 return idmap_alloc_ctx->methods->set_id_hwm(id);
875}
876
877NTSTATUS idmap_set_gid_hwm(struct unixid *id)
878{
879 NTSTATUS ret;
880
881 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
882 return ret;
883 }
884
885 id->type = ID_TYPE_GID;
886 return idmap_alloc_ctx->methods->set_id_hwm(id);
887}
888
889/******************************************************************************
890 Lookup an idmap_domain give a full user or group SID
891 ******************************************************************************/
892
893static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
894{
895 DOM_SID domain_sid;
896 uint32_t rid;
897 struct winbindd_domain *domain = NULL;
898 int i;
899
900 /* 1. Handle BUILTIN or Special SIDs and prevent them from
901 falling into the default domain space (if we have a
902 configured passdb backend. */
903
904 if ( (pdb_dom_num != -1) &&
905 (sid_check_is_in_builtin(account_sid) ||
906 sid_check_is_in_wellknown_domain(account_sid) ||
907 sid_check_is_in_unix_groups(account_sid) ||
908 sid_check_is_in_unix_users(account_sid)) )
909 {
910 return idmap_domains[pdb_dom_num];
911 }
912
913 /* 2. Lookup the winbindd_domain from the account_sid */
914
915 sid_copy( &domain_sid, account_sid );
916 sid_split_rid( &domain_sid, &rid );
917 domain = find_domain_from_sid_noinit( &domain_sid );
918
919 for (i = 0; domain && i < num_domains; i++) {
920 if ( strequal( idmap_domains[i]->name, domain->name ) ) {
921 return idmap_domains[i];
922 }
923 }
924
925 /* 3. Fall back to the default domain */
926
927 if ( def_dom_num != -1 ) {
928 return idmap_domains[def_dom_num];
929 }
930
931 return NULL;
932}
933
934/******************************************************************************
935 Lookup an index given an idmap_domain pointer
936 ******************************************************************************/
937
938static uint32_t find_idmap_domain_index( struct idmap_domain *id_domain)
939{
940 int i;
941
942 for (i = 0; i < num_domains; i++) {
943 if ( idmap_domains[i] == id_domain )
944 return i;
945 }
946
947 return -1;
948}
949
950
951/*********************************************************
952 Check if creating a mapping is permitted for the domain
953*********************************************************/
954
955static NTSTATUS idmap_can_map(const struct id_map *map,
956 struct idmap_domain **ret_dom)
957{
958 struct idmap_domain *dom;
959
960 /* Check we do not create mappings for our own local domain,
961 * or BUILTIN or special SIDs */
962 if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
963 sid_check_is_in_builtin(map->sid) ||
964 sid_check_is_in_wellknown_domain(map->sid) ||
965 sid_check_is_in_unix_users(map->sid) ||
966 sid_check_is_in_unix_groups(map->sid) )
967 {
968 DEBUG(10, ("We are not supposed to create mappings for our own "
969 "domains (local, builtin, specials)\n"));
970 return NT_STATUS_UNSUCCESSFUL;
971 }
972
973 /* Special check for trusted domain only = Yes */
974 if (lp_winbind_trusted_domains_only()) {
975 struct winbindd_domain *wdom = find_our_domain();
976 if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
977 DEBUG(10, ("We are not supposed to create mappings for "
978 "our primary domain when <trusted domain "
979 "only> is True\n"));
980 DEBUGADD(10, ("Leave [%s] unmapped\n",
981 sid_string_dbg(map->sid)));
982 return NT_STATUS_UNSUCCESSFUL;
983 }
984 }
985
986 if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
987 /* huh, couldn't find a suitable domain,
988 * let's just leave it unmapped */
989 DEBUG(10, ("Could not find idmap backend for SID %s\n",
990 sid_string_dbg(map->sid)));
991 return NT_STATUS_NO_SUCH_DOMAIN;
992 }
993
994 if (dom->readonly) {
995 /* ouch the domain is read only,
996 * let's just leave it unmapped */
997 DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
998 sid_string_dbg(map->sid)));
999 return NT_STATUS_UNSUCCESSFUL;
1000 }
1001
1002 *ret_dom = dom;
1003 return NT_STATUS_OK;
1004}
1005
1006static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
1007{
1008 NTSTATUS ret;
1009 struct idmap_domain *dom;
1010
1011 /* If we are offline we cannot lookup SIDs, deny mapping */
1012 if (idmap_is_offline()) {
1013 return NT_STATUS_FILE_IS_OFFLINE;
1014 }
1015
1016 ret = idmap_can_map(map, &dom);
1017 if ( ! NT_STATUS_IS_OK(ret)) {
1018 return NT_STATUS_NONE_MAPPED;
1019 }
1020
1021 /* check if this is a valid SID and then map it */
1022 switch (map->xid.type) {
1023 case ID_TYPE_UID:
1024 ret = idmap_allocate_uid(&map->xid);
1025 if ( ! NT_STATUS_IS_OK(ret)) {
1026 /* can't allocate id, let's just leave it unmapped */
1027 DEBUG(2, ("uid allocation failed! "
1028 "Can't create mapping\n"));
1029 return NT_STATUS_NONE_MAPPED;
1030 }
1031 break;
1032 case ID_TYPE_GID:
1033 ret = idmap_allocate_gid(&map->xid);
1034 if ( ! NT_STATUS_IS_OK(ret)) {
1035 /* can't allocate id, let's just leave it unmapped */
1036 DEBUG(2, ("gid allocation failed! "
1037 "Can't create mapping\n"));
1038 return NT_STATUS_NONE_MAPPED;
1039 }
1040 break;
1041 default:
1042 /* invalid sid, let's just leave it unmapped */
1043 DEBUG(3,("idmap_new_mapping: Refusing to create a "
1044 "mapping for an unspecified ID type.\n"));
1045 return NT_STATUS_NONE_MAPPED;
1046 }
1047
1048 /* ok, got a new id, let's set a mapping */
1049 map->status = ID_MAPPED;
1050
1051 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
1052 sid_string_dbg(map->sid),
1053 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
1054 (unsigned long)map->xid.id));
1055 ret = dom->methods->set_mapping(dom, map);
1056
1057 if ( ! NT_STATUS_IS_OK(ret)) {
1058 /* something wrong here :-( */
1059 DEBUG(2, ("Failed to commit mapping\n!"));
1060
1061 /* TODO: would it make sense to have an "unalloc_id function?" */
1062
1063 return NT_STATUS_NONE_MAPPED;
1064 }
1065
1066 return NT_STATUS_OK;
1067}
1068
1069static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
1070{
1071 struct idmap_domain *dom;
1072 NTSTATUS ret;
1073
1074 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
1075 sid_string_dbg(map->sid),
1076 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
1077 (unsigned long)map->xid.id));
1078
1079 ret = idmap_can_map(map, &dom);
1080 if ( ! NT_STATUS_IS_OK(ret)) {
1081 return ret;
1082 }
1083
1084 DEBUG(10,("set_mapping for domain %s\n", dom->name ));
1085
1086 return dom->methods->set_mapping(dom, map);
1087}
1088
1089static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
1090{
1091 struct idmap_domain *dom;
1092 struct id_map **unmapped;
1093 struct id_map **_ids;
1094 TALLOC_CTX *ctx;
1095 NTSTATUS ret;
1096 int i, u, n;
1097
1098 if (!ids || !*ids) {
1099 DEBUG(1, ("Invalid list of maps\n"));
1100 return NT_STATUS_INVALID_PARAMETER;
1101 }
1102
1103 ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
1104 if ( ! ctx) {
1105 DEBUG(0, ("Out of memory!\n"));
1106 return NT_STATUS_NO_MEMORY;
1107 }
1108
1109 DEBUG(10, ("Query backends to map ids->sids\n"));
1110
1111 /* start from the default (the last one) and then if there are still
1112 * unmapped entries cycle through the others */
1113
1114 _ids = ids;
1115
1116 unmapped = NULL;
1117 for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
1118
1119 dom = idmap_domains[n];
1120
1121 DEBUG(10, ("Query sids from domain %s\n", dom->name));
1122
1123 ret = dom->methods->unixids_to_sids(dom, _ids);
1124 IDMAP_REPORT_RET(ret);
1125
1126 unmapped = NULL;
1127
1128 for (i = 0, u = 0; _ids[i]; i++) {
1129 if (_ids[i]->status != ID_MAPPED) {
1130 unmapped = talloc_realloc(ctx, unmapped,
1131 struct id_map *, u + 2);
1132 IDMAP_CHECK_ALLOC(unmapped);
1133 unmapped[u] = _ids[i];
1134 u++;
1135 }
1136 }
1137 if (unmapped) {
1138 /* terminate the unmapped list */
1139 unmapped[u] = NULL;
1140 } else { /* no more entries, get out */
1141 break;
1142 }
1143
1144 _ids = unmapped;
1145
1146 }
1147
1148 if (unmapped) {
1149 /* there are still unmapped ids,
1150 * map them to the unix users/groups domains */
1151 /* except for expired entries,
1152 * these will be returned as valid (offline mode) */
1153 for (i = 0; unmapped[i]; i++) {
1154 if (unmapped[i]->status == ID_EXPIRED) continue;
1155 switch (unmapped[i]->xid.type) {
1156 case ID_TYPE_UID:
1157 uid_to_unix_users_sid(
1158 (uid_t)unmapped[i]->xid.id,
1159 unmapped[i]->sid);
1160 unmapped[i]->status = ID_MAPPED;
1161 break;
1162 case ID_TYPE_GID:
1163 gid_to_unix_groups_sid(
1164 (gid_t)unmapped[i]->xid.id,
1165 unmapped[i]->sid);
1166 unmapped[i]->status = ID_MAPPED;
1167 break;
1168 default: /* what?! */
1169 unmapped[i]->status = ID_UNKNOWN;
1170 break;
1171 }
1172 }
1173 }
1174
1175 ret = NT_STATUS_OK;
1176
1177done:
1178 talloc_free(ctx);
1179 return ret;
1180}
1181
1182static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
1183{
1184 struct id_map ***dom_ids;
1185 struct idmap_domain *dom;
1186 TALLOC_CTX *ctx;
1187 NTSTATUS ret;
1188 int i, *counters;
1189
1190 if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
1191 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1192 return NT_STATUS_NO_MEMORY;
1193 }
1194
1195 DEBUG(10, ("Query backends to map sids->ids\n"));
1196
1197 /* split list per domain */
1198 if (num_domains == 0) {
1199 DEBUG(1, ("No domains available?\n"));
1200 return NT_STATUS_UNSUCCESSFUL;
1201 }
1202
1203 dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
1204 IDMAP_CHECK_ALLOC(dom_ids);
1205 counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
1206 IDMAP_CHECK_ALLOC(counters);
1207
1208 /* partition the requests by domain */
1209
1210 for (i = 0; ids[i]; i++) {
1211 uint32_t idx;
1212
1213 if ((dom = find_idmap_domain_from_sid(ids[i]->sid)) == NULL) {
1214 /* no available idmap_domain. Move on */
1215 continue;
1216 }
1217
1218 DEBUG(10,("SID %s is being handled by %s\n",
1219 sid_string_dbg(ids[i]->sid),
1220 dom ? dom->name : "none" ));
1221
1222 idx = find_idmap_domain_index( dom );
1223 SMB_ASSERT( idx != -1 );
1224
1225 dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
1226 struct id_map *,
1227 counters[idx] + 2);
1228 IDMAP_CHECK_ALLOC(dom_ids[idx]);
1229
1230 dom_ids[idx][counters[idx]] = ids[i];
1231 counters[idx]++;
1232 dom_ids[idx][counters[idx]] = NULL;
1233 }
1234
1235 /* All the ids have been dispatched in the right queues.
1236 Let's cycle through the filled ones */
1237
1238 for (i = 0; i < num_domains; i++) {
1239 if (dom_ids[i]) {
1240 dom = idmap_domains[i];
1241 DEBUG(10, ("Query ids from domain %s\n", dom->name));
1242 ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
1243 IDMAP_REPORT_RET(ret);
1244 }
1245 }
1246
1247 /* ok all the backends have been contacted at this point */
1248 /* let's see if we have any unmapped SID left and act accordingly */
1249
1250 for (i = 0; ids[i]; i++) {
1251 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1252 * was not able to confirm/deny (offline mode) */
1253 if (ids[i]->status == ID_UNKNOWN ||
1254 ids[i]->status == ID_UNMAPPED) {
1255 /* ok this is an unmapped one, see if we can map it */
1256 ret = idmap_new_mapping(ctx, ids[i]);
1257 if (NT_STATUS_IS_OK(ret)) {
1258 /* successfully mapped */
1259 ids[i]->status = ID_MAPPED;
1260 } else
1261 if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
1262 /* could not map it */
1263 ids[i]->status = ID_UNMAPPED;
1264 } else {
1265 /* Something very bad happened down there
1266 * OR we are offline */
1267 ids[i]->status = ID_UNKNOWN;
1268 }
1269 }
1270 }
1271
1272 ret = NT_STATUS_OK;
1273
1274done:
1275 talloc_free(ctx);
1276 return ret;
1277}
1278
1279/**************************************************************************
1280 idmap interface functions
1281**************************************************************************/
1282
1283NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
1284{
1285 TALLOC_CTX *ctx;
1286 NTSTATUS ret;
1287 struct id_map **bids;
1288 int i, bi;
1289 int bn = 0;
1290 struct winbindd_domain *our_domain = find_our_domain();
1291
1292 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1293 return ret;
1294 }
1295
1296 if (!ids || !*ids) {
1297 DEBUG(1, ("Invalid list of maps\n"));
1298 return NT_STATUS_INVALID_PARAMETER;
1299 }
1300
1301 ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
1302 if ( ! ctx) {
1303 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1304 return NT_STATUS_NO_MEMORY;
1305 }
1306
1307 /* no ids to be asked to the backends by default */
1308 bids = NULL;
1309 bi = 0;
1310
1311 for (i = 0; ids[i]; i++) {
1312
1313 if ( ! ids[i]->sid) {
1314 DEBUG(1, ("invalid null SID in id_map array"));
1315 talloc_free(ctx);
1316 return NT_STATUS_INVALID_PARAMETER;
1317 }
1318
1319 ret = idmap_cache_map_id(idmap_cache, ids[i]);
1320
1321 if ( ! NT_STATUS_IS_OK(ret)) {
1322
1323 if ( ! bids) {
1324 /* alloc space for ids to be resolved by
1325 * backends (realloc ten by ten) */
1326 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1327 if ( ! bids) {
1328 DEBUG(1, ("Out of memory!\n"));
1329 talloc_free(ctx);
1330 return NT_STATUS_NO_MEMORY;
1331 }
1332 bn = 10;
1333 }
1334
1335 /* add this id to the ones to be retrieved
1336 * from the backends */
1337 bids[bi] = ids[i];
1338 bi++;
1339
1340 /* check if we need to allocate new space
1341 * on the rids array */
1342 if (bi == bn) {
1343 bn += 10;
1344 bids = talloc_realloc(ctx, bids,
1345 struct id_map *, bn);
1346 if ( ! bids) {
1347 DEBUG(1, ("Out of memory!\n"));
1348 talloc_free(ctx);
1349 return NT_STATUS_NO_MEMORY;
1350 }
1351 }
1352
1353 /* make sure the last element is NULL */
1354 bids[bi] = NULL;
1355 }
1356 }
1357
1358 /* let's see if there is any id mapping to be retieved
1359 * from the backends */
1360 if (bids) {
1361 bool online;
1362
1363 /* Only do query if we are online */
1364 online = !IS_DOMAIN_OFFLINE(our_domain);
1365 if (online) {
1366 ret = idmap_backends_unixids_to_sids(bids);
1367 IDMAP_CHECK_RET(ret);
1368 }
1369
1370 /* update the cache */
1371 for (i = 0; i < bi; i++) {
1372 if (bids[i]->status == ID_MAPPED) {
1373 ret = idmap_cache_set(idmap_cache, bids[i]);
1374 } else if (bids[i]->status == ID_EXPIRED) {
1375 /* the cache returned an expired entry and the
1376 * backend was not able to clear the situation
1377 * (offline). This handles a previous
1378 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1379 * for disconnected mode, */
1380 bids[i]->status = ID_MAPPED;
1381 } else if (bids[i]->status == ID_UNKNOWN) {
1382 /* something bad here. We were not able to
1383 * handle this for some reason, mark it as
1384 * unmapped and hope next time things will
1385 * settle down. */
1386 bids[i]->status = ID_UNMAPPED;
1387 } else if (online) { /* unmapped */
1388 ret = idmap_cache_set_negative_id(idmap_cache,
1389 bids[i]);
1390 }
1391 IDMAP_CHECK_RET(ret);
1392 }
1393 }
1394
1395 ret = NT_STATUS_OK;
1396done:
1397 talloc_free(ctx);
1398 return ret;
1399}
1400
1401NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
1402{
1403 TALLOC_CTX *ctx;
1404 NTSTATUS ret;
1405 struct id_map **bids;
1406 int i, bi;
1407 int bn = 0;
1408 struct winbindd_domain *our_domain = find_our_domain();
1409
1410 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1411 return ret;
1412 }
1413
1414 if (!ids || !*ids) {
1415 DEBUG(1, ("Invalid list of maps\n"));
1416 return NT_STATUS_INVALID_PARAMETER;
1417 }
1418
1419 ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
1420 if ( ! ctx) {
1421 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1422 return NT_STATUS_NO_MEMORY;
1423 }
1424
1425 /* no ids to be asked to the backends by default */
1426 bids = NULL;
1427 bi = 0;
1428
1429 for (i = 0; ids[i]; i++) {
1430
1431 if ( ! ids[i]->sid) {
1432 DEBUG(1, ("invalid null SID in id_map array\n"));
1433 talloc_free(ctx);
1434 return NT_STATUS_INVALID_PARAMETER;
1435 }
1436
1437 ret = idmap_cache_map_sid(idmap_cache, ids[i]);
1438
1439 if ( ! NT_STATUS_IS_OK(ret)) {
1440
1441 if ( ! bids) {
1442 /* alloc space for ids to be resolved
1443 by backends (realloc ten by ten) */
1444 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1445 if ( ! bids) {
1446 DEBUG(1, ("Out of memory!\n"));
1447 talloc_free(ctx);
1448 return NT_STATUS_NO_MEMORY;
1449 }
1450 bn = 10;
1451 }
1452
1453 /* add this id to the ones to be retrieved
1454 * from the backends */
1455 bids[bi] = ids[i];
1456 bi++;
1457
1458 /* check if we need to allocate new space
1459 * on the ids array */
1460 if (bi == bn) {
1461 bn += 10;
1462 bids = talloc_realloc(ctx, bids,
1463 struct id_map *, bn);
1464 if ( ! bids) {
1465 DEBUG(1, ("Out of memory!\n"));
1466 talloc_free(ctx);
1467 return NT_STATUS_NO_MEMORY;
1468 }
1469 }
1470
1471 /* make sure the last element is NULL */
1472 bids[bi] = NULL;
1473 }
1474 }
1475
1476 /* let's see if there is any id mapping to be retieved
1477 * from the backends */
1478 if (bids) {
1479 bool online;
1480
1481 /* Only do query if we are online */
1482 online = !IS_DOMAIN_OFFLINE(our_domain);
1483 if (online) {
1484 ret = idmap_backends_sids_to_unixids(bids);
1485 IDMAP_CHECK_RET(ret);
1486 }
1487
1488 /* update the cache */
1489 for (i = 0; bids[i]; i++) {
1490 if (bids[i]->status == ID_MAPPED) {
1491 ret = idmap_cache_set(idmap_cache, bids[i]);
1492 } else if (bids[i]->status == ID_EXPIRED) {
1493 /* the cache returned an expired entry and the
1494 * backend was not able to clear the situation
1495 * (offline). This handles a previous
1496 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1497 * for disconnected mode, */
1498 bids[i]->status = ID_MAPPED;
1499 } else if (bids[i]->status == ID_UNKNOWN) {
1500 /* something bad here. We were not able to
1501 * handle this for some reason, mark it as
1502 * unmapped and hope next time things will
1503 * settle down. */
1504 bids[i]->status = ID_UNMAPPED;
1505 } else if (online) { /* unmapped */
1506 ret = idmap_cache_set_negative_sid(idmap_cache,
1507 bids[i]);
1508 }
1509 IDMAP_CHECK_RET(ret);
1510 }
1511 }
1512
1513 ret = NT_STATUS_OK;
1514done:
1515 talloc_free(ctx);
1516 return ret;
1517}
1518
1519NTSTATUS idmap_set_mapping(const struct id_map *id)
1520{
1521 TALLOC_CTX *ctx;
1522 NTSTATUS ret;
1523
1524 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1525 return ret;
1526 }
1527
1528 /* sanity checks */
1529 if ((id->sid == NULL) || (id->status != ID_MAPPED)) {
1530 DEBUG(1, ("NULL SID or unmapped entry\n"));
1531 return NT_STATUS_INVALID_PARAMETER;
1532 }
1533
1534 /* TODO: check uid/gid range ? */
1535
1536 ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
1537 if ( ! ctx) {
1538 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1539 return NT_STATUS_NO_MEMORY;
1540 }
1541
1542 /* set the new mapping */
1543 ret = idmap_backends_set_mapping(id);
1544 IDMAP_CHECK_RET(ret);
1545
1546 /* set the mapping in the cache */
1547 ret = idmap_cache_set(idmap_cache, id);
1548 IDMAP_CHECK_RET(ret);
1549
1550done:
1551 talloc_free(ctx);
1552 return ret;
1553}
1554
1555char *idmap_fetch_secret(const char *backend, bool alloc,
1556 const char *domain, const char *identity)
1557{
1558 char *tmp, *ret;
1559 int r;
1560
1561 if (alloc) {
1562 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
1563 } else {
1564 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
1565 }
1566
1567 if (r < 0)
1568 return NULL;
1569
1570 strupper_m(tmp); /* make sure the key is case insensitive */
1571 ret = secrets_fetch_generic(tmp, identity);
1572
1573 SAFE_FREE(tmp);
1574
1575 return ret;
1576}
1577
Note: See TracBrowser for help on using the repository browser.