Context Navigation

source: branches/samba-3.3.x/source/winbindd/idmap_ldap.c

Visit:

Last change on this file was 370, checked in by Herwig Bauernfeind, 16 years ago
Update Samba 3.3 to 3.3.10 (source)
File size: 37.7 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3
4	idmap LDAP backend
5
6	Copyright (C) Tim Potter 2000
7	Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
8	Copyright (C) Gerald Carter 2003
9	Copyright (C) Simo Sorce 2003-2007
10
11	This program is free software; you can redistribute it and/or modify
12	it under the terms of the GNU General Public License as published by
13	the Free Software Foundation; either version 3 of the License, or
14	(at your option) any later version.
15
16	This program is distributed in the hope that it will be useful,
17	but WITHOUT ANY WARRANTY; without even the implied warranty of
18	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19	GNU General Public License for more details.
20
21	You should have received a copy of the GNU General Public License
22	along with this program. If not, see <http://www.gnu.org/licenses/>.
23	*/
24
25	#include "includes.h"
26	#include "winbindd.h"
27
28	#undef DBGC_CLASS
29	#define DBGC_CLASS DBGC_IDMAP
30
31	#include <lber.h>
32	#include <ldap.h>
33
34	#include "smbldap.h"
35
36	static char idmap_fetch_secret(const char backend, bool alloc,
37	const char domain, const char identity)
38	{
39	char tmp, ret;
40	int r;
41
42	if (alloc) {
43	r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
44	} else {
45	r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
46	}
47
48	if (r < 0)
49	return NULL;
50
51	strupper_m(tmp); /* make sure the key is case insensitive */
52	ret = secrets_fetch_generic(tmp, identity);
53
54	SAFE_FREE(tmp);
55
56	return ret;
57	}
58
59	struct idmap_ldap_context {
60	struct smbldap_state *smbldap_state;
61	char *url;
62	char *suffix;
63	char *user_dn;
64	uint32_t filter_low_id, filter_high_id; /* Filter range */
65	bool anon;
66	};
67
68	struct idmap_ldap_alloc_context {
69	struct smbldap_state *smbldap_state;
70	char *url;
71	char *suffix;
72	char *user_dn;
73	uid_t low_uid, high_uid; /* Range of uids */
74	gid_t low_gid, high_gid; /* Range of gids */
75
76	};
77
78	#define CHECK_ALLOC_DONE(mem) do { \
79	if (!mem) { \
80	DEBUG(0, ("Out of memory!\n")); \
81	ret = NT_STATUS_NO_MEMORY; \
82	goto done; \
83	} } while (0)
84
85	/**********************************************************************
86	IDMAP ALLOC TDB BACKEND
87	**********************************************************************/
88
89	static struct idmap_ldap_alloc_context *idmap_alloc_ldap;
90
91	/*********************************************************************
92	********************************************************************/
93
94	static NTSTATUS get_credentials( TALLOC_CTX *mem_ctx,
95	struct smbldap_state *ldap_state,
96	const char *config_option,
97	struct idmap_domain *dom,
98	char **dn )
99	{
100	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
101	char *secret = NULL;
102	const char *tmp = NULL;
103	char *user_dn = NULL;
104	bool anon = False;
105
106	/* assume anonymous if we don't have a specified user */
107
108	tmp = lp_parm_const_string(-1, config_option, "ldap_user_dn", NULL);
109
110	if ( tmp ) {
111	if (!dom) {
112	/* only the alloc backend can pass in a NULL dom */
113	secret = idmap_fetch_secret("ldap", True,
114	NULL, tmp);
115	} else {
116	secret = idmap_fetch_secret("ldap", False,
117	dom->name, tmp);
118	}
119
120	if (!secret) {
121	DEBUG(0, ("get_credentials: Unable to fetch "
122	"auth credentials for %s in %s\n",
123	tmp, (dom==NULL)?"ALLOC":dom->name));
124	ret = NT_STATUS_ACCESS_DENIED;
125	goto done;
126	}
127	*dn = talloc_strdup(mem_ctx, tmp);
128	CHECK_ALLOC_DONE(*dn);
129	} else {
130	if (!fetch_ldap_pw(&user_dn, &secret)) {
131	DEBUG(2, ("get_credentials: Failed to lookup ldap "
132	"bind creds. Using anonymous connection.\n"));
133	anon = True;
134	} else {
135	*dn = talloc_strdup(mem_ctx, user_dn);
136	SAFE_FREE( user_dn );
137	CHECK_ALLOC_DONE(*dn);
138	}
139	}
140
141	smbldap_set_creds(ldap_state, anon, *dn, secret);
142	ret = NT_STATUS_OK;
143
144	done:
145	SAFE_FREE(secret);
146
147	return ret;
148	}
149
150
151	/**********************************************************************
152	Verify the sambaUnixIdPool entry in the directory.
153	**********************************************************************/
154
155	static NTSTATUS verify_idpool(void)
156	{
157	NTSTATUS ret;
158	TALLOC_CTX *ctx;
159	LDAPMessage *result = NULL;
160	LDAPMod **mods = NULL;
161	const char **attr_list;
162	char *filter;
163	int count;
164	int rc;
165
166	if ( ! idmap_alloc_ldap) {
167	return NT_STATUS_UNSUCCESSFUL;
168	}
169
170	ctx = talloc_new(idmap_alloc_ldap);
171	if ( ! ctx) {
172	DEBUG(0, ("Out of memory!\n"));
173	return NT_STATUS_NO_MEMORY;
174	}
175
176	filter = talloc_asprintf(ctx, "(objectclass=%s)", LDAP_OBJ_IDPOOL);
177	CHECK_ALLOC_DONE(filter);
178
179	attr_list = get_attr_list(ctx, idpool_attr_list);
180	CHECK_ALLOC_DONE(attr_list);
181
182	rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
183	idmap_alloc_ldap->suffix,
184	LDAP_SCOPE_SUBTREE,
185	filter,
186	attr_list,
187	0,
188	&result);
189
190	if (rc != LDAP_SUCCESS) {
191	DEBUG(1, ("Unable to verify the idpool, "
192	"cannot continue initialization!\n"));
193	return NT_STATUS_UNSUCCESSFUL;
194	}
195
196	count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
197	result);
198
199	ldap_msgfree(result);
200
201	if ( count > 1 ) {
202	DEBUG(0,("Multiple entries returned from %s (base == %s)\n",
203	filter, idmap_alloc_ldap->suffix));
204	ret = NT_STATUS_UNSUCCESSFUL;
205	goto done;
206	}
207	else if (count == 0) {
208	char uid_str, gid_str;
209
210	uid_str = talloc_asprintf(ctx, "%lu",
211	(unsigned long)idmap_alloc_ldap->low_uid);
212	gid_str = talloc_asprintf(ctx, "%lu",
213	(unsigned long)idmap_alloc_ldap->low_gid);
214
215	smbldap_set_mod(&mods, LDAP_MOD_ADD,
216	"objectClass", LDAP_OBJ_IDPOOL);
217	smbldap_set_mod(&mods, LDAP_MOD_ADD,
218	get_attr_key2string(idpool_attr_list,
219	LDAP_ATTR_UIDNUMBER),
220	uid_str);
221	smbldap_set_mod(&mods, LDAP_MOD_ADD,
222	get_attr_key2string(idpool_attr_list,
223	LDAP_ATTR_GIDNUMBER),
224	gid_str);
225	if (mods) {
226	rc = smbldap_modify(idmap_alloc_ldap->smbldap_state,
227	idmap_alloc_ldap->suffix,
228	mods);
229	ldap_mods_free(mods, True);
230	} else {
231	ret = NT_STATUS_UNSUCCESSFUL;
232	goto done;
233	}
234	}
235
236	ret = (rc == LDAP_SUCCESS)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
237	done:
238	talloc_free(ctx);
239	return ret;
240	}
241
242	/*****************************************************************************
243	Initialise idmap database.
244	*****************************************************************************/
245
246	static NTSTATUS idmap_ldap_alloc_init(const char *params)
247	{
248	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
249	const char *tmp;
250	uid_t low_uid = 0;
251	uid_t high_uid = 0;
252	gid_t low_gid = 0;
253	gid_t high_gid = 0;
254
255	/* Only do init if we are online */
256	if (idmap_is_offline()) {
257	return NT_STATUS_FILE_IS_OFFLINE;
258	}
259
260	idmap_alloc_ldap = TALLOC_ZERO_P(NULL, struct idmap_ldap_alloc_context);
261	CHECK_ALLOC_DONE( idmap_alloc_ldap );
262
263	/* load ranges */
264
265	if (!lp_idmap_uid(&low_uid, &high_uid)
266	\|\| !lp_idmap_gid(&low_gid, &high_gid)) {
267	DEBUG(1, ("idmap uid or idmap gid missing\n"));
268	ret = NT_STATUS_UNSUCCESSFUL;
269	goto done;
270	}
271
272	idmap_alloc_ldap->low_uid = low_uid;
273	idmap_alloc_ldap->high_uid = high_uid;
274	idmap_alloc_ldap->low_gid = low_gid;
275	idmap_alloc_ldap->high_gid= high_gid;
276
277	if (idmap_alloc_ldap->high_uid <= idmap_alloc_ldap->low_uid) {
278	DEBUG(1, ("idmap uid range invalid\n"));
279	DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
280	ret = NT_STATUS_UNSUCCESSFUL;
281	goto done;
282	}
283
284	if (idmap_alloc_ldap->high_gid <= idmap_alloc_ldap->low_gid) {
285	DEBUG(1, ("idmap gid range invalid\n"));
286	DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
287	ret = NT_STATUS_UNSUCCESSFUL;
288	goto done;
289	}
290
291	if (params && *params) {
292	/* assume location is the only parameter */
293	idmap_alloc_ldap->url = talloc_strdup(idmap_alloc_ldap, params);
294	} else {
295	tmp = lp_parm_const_string(-1, "idmap alloc config",
296	"ldap_url", NULL);
297
298	if ( ! tmp) {
299	DEBUG(1, ("ERROR: missing idmap ldap url\n"));
300	ret = NT_STATUS_UNSUCCESSFUL;
301	goto done;
302	}
303
304	idmap_alloc_ldap->url = talloc_strdup(idmap_alloc_ldap, tmp);
305	}
306	CHECK_ALLOC_DONE( idmap_alloc_ldap->url );
307
308	tmp = lp_parm_const_string(-1, "idmap alloc config",
309	"ldap_base_dn", NULL);
310	if ( ! tmp \|\| ! *tmp) {
311	tmp = lp_ldap_idmap_suffix();
312	if ( ! tmp) {
313	DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
314	ret = NT_STATUS_UNSUCCESSFUL;
315	goto done;
316	}
317	}
318
319	idmap_alloc_ldap->suffix = talloc_strdup(idmap_alloc_ldap, tmp);
320	CHECK_ALLOC_DONE( idmap_alloc_ldap->suffix );
321
322	ret = smbldap_init(idmap_alloc_ldap, winbind_event_context(),
323	idmap_alloc_ldap->url,
324	&idmap_alloc_ldap->smbldap_state);
325	if (!NT_STATUS_IS_OK(ret)) {
326	DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n",
327	idmap_alloc_ldap->url));
328	goto done;
329	}
330
331	ret = get_credentials( idmap_alloc_ldap,
332	idmap_alloc_ldap->smbldap_state,
333	"idmap alloc config", NULL,
334	&idmap_alloc_ldap->user_dn );
335	if ( !NT_STATUS_IS_OK(ret) ) {
336	DEBUG(1,("idmap_ldap_alloc_init: Failed to get connection "
337	"credentials (%s)\n", nt_errstr(ret)));
338	goto done;
339	}
340
341	/* see if the idmap suffix and sub entries exists */
342
343	ret = verify_idpool();
344
345	done:
346	if ( !NT_STATUS_IS_OK( ret ) )
347	TALLOC_FREE( idmap_alloc_ldap );
348
349	return ret;
350	}
351
352	/********************************
353	Allocate a new uid or gid
354	********************************/
355
356	static NTSTATUS idmap_ldap_allocate_id(struct unixid *xid)
357	{
358	TALLOC_CTX *ctx;
359	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
360	int rc = LDAP_SERVER_DOWN;
361	int count = 0;
362	LDAPMessage *result = NULL;
363	LDAPMessage *entry = NULL;
364	LDAPMod **mods = NULL;
365	char *id_str;
366	char *new_id_str;
367	char *filter = NULL;
368	const char *dn = NULL;
369	const char **attr_list;
370	const char *type;
371
372	/* Only do query if we are online */
373	if (idmap_is_offline()) {
374	return NT_STATUS_FILE_IS_OFFLINE;
375	}
376
377	if ( ! idmap_alloc_ldap) {
378	return NT_STATUS_UNSUCCESSFUL;
379	}
380
381	ctx = talloc_new(idmap_alloc_ldap);
382	if ( ! ctx) {
383	DEBUG(0, ("Out of memory!\n"));
384	return NT_STATUS_NO_MEMORY;
385	}
386
387	/* get type */
388	switch (xid->type) {
389
390	case ID_TYPE_UID:
391	type = get_attr_key2string(idpool_attr_list,
392	LDAP_ATTR_UIDNUMBER);
393	break;
394
395	case ID_TYPE_GID:
396	type = get_attr_key2string(idpool_attr_list,
397	LDAP_ATTR_GIDNUMBER);
398	break;
399
400	default:
401	DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
402	return NT_STATUS_INVALID_PARAMETER;
403	}
404
405	filter = talloc_asprintf(ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
406	CHECK_ALLOC_DONE(filter);
407
408	attr_list = get_attr_list(ctx, idpool_attr_list);
409	CHECK_ALLOC_DONE(attr_list);
410
411	DEBUG(10, ("Search of the id pool (filter: %s)\n", filter));
412
413	rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
414	idmap_alloc_ldap->suffix,
415	LDAP_SCOPE_SUBTREE, filter,
416	attr_list, 0, &result);
417
418	if (rc != LDAP_SUCCESS) {
419	DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
420	goto done;
421	}
422
423	talloc_autofree_ldapmsg(ctx, result);
424
425	count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
426	result);
427	if (count != 1) {
428	DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
429	goto done;
430	}
431
432	entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
433	result);
434
435	dn = smbldap_talloc_dn(ctx,
436	idmap_alloc_ldap->smbldap_state->ldap_struct,
437	entry);
438	if ( ! dn) {
439	goto done;
440	}
441
442	if ( ! (id_str = smbldap_talloc_single_attribute(idmap_alloc_ldap->smbldap_state->ldap_struct,
443	entry, type, ctx))) {
444	DEBUG(0,("%s attribute not found\n", type));
445	goto done;
446	}
447	if ( ! id_str) {
448	DEBUG(0,("Out of memory\n"));
449	ret = NT_STATUS_NO_MEMORY;
450	goto done;
451	}
452
453	xid->id = strtoul(id_str, NULL, 10);
454
455	/* make sure we still have room to grow */
456
457	switch (xid->type) {
458	case ID_TYPE_UID:
459	if (xid->id > idmap_alloc_ldap->high_uid) {
460	DEBUG(0,("Cannot allocate uid above %lu!\n",
461	(unsigned long)idmap_alloc_ldap->high_uid));
462	goto done;
463	}
464	break;
465
466	case ID_TYPE_GID:
467	if (xid->id > idmap_alloc_ldap->high_gid) {
468	DEBUG(0,("Cannot allocate gid above %lu!\n",
469	(unsigned long)idmap_alloc_ldap->high_uid));
470	goto done;
471	}
472	break;
473
474	default:
475	/* impossible */
476	goto done;
477	}
478
479	new_id_str = talloc_asprintf(ctx, "%lu", (unsigned long)xid->id + 1);
480	if ( ! new_id_str) {
481	DEBUG(0,("Out of memory\n"));
482	ret = NT_STATUS_NO_MEMORY;
483	goto done;
484	}
485
486	smbldap_set_mod(&mods, LDAP_MOD_DELETE, type, id_str);
487	smbldap_set_mod(&mods, LDAP_MOD_ADD, type, new_id_str);
488
489	if (mods == NULL) {
490	DEBUG(0,("smbldap_set_mod() failed.\n"));
491	goto done;
492	}
493
494	DEBUG(10, ("Try to atomically increment the id (%s -> %s)\n",
495	id_str, new_id_str));
496
497	rc = smbldap_modify(idmap_alloc_ldap->smbldap_state, dn, mods);
498
499	ldap_mods_free(mods, True);
500
501	if (rc != LDAP_SUCCESS) {
502	DEBUG(1,("Failed to allocate new %s. "
503	"smbldap_modify() failed.\n", type));
504	goto done;
505	}
506
507	ret = NT_STATUS_OK;
508
509	done:
510	talloc_free(ctx);
511	return ret;
512	}
513
514	/**********************************
515	Get current highest id.
516	**********************************/
517
518	static NTSTATUS idmap_ldap_get_hwm(struct unixid *xid)
519	{
520	TALLOC_CTX *memctx;
521	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
522	int rc = LDAP_SERVER_DOWN;
523	int count = 0;
524	LDAPMessage *result = NULL;
525	LDAPMessage *entry = NULL;
526	char *id_str;
527	char *filter = NULL;
528	const char **attr_list;
529	const char *type;
530
531	/* Only do query if we are online */
532	if (idmap_is_offline()) {
533	return NT_STATUS_FILE_IS_OFFLINE;
534	}
535
536	if ( ! idmap_alloc_ldap) {
537	return NT_STATUS_UNSUCCESSFUL;
538	}
539
540	memctx = talloc_new(idmap_alloc_ldap);
541	if ( ! memctx) {
542	DEBUG(0, ("Out of memory!\n"));
543	return NT_STATUS_NO_MEMORY;
544	}
545
546	/* get type */
547	switch (xid->type) {
548
549	case ID_TYPE_UID:
550	type = get_attr_key2string(idpool_attr_list,
551	LDAP_ATTR_UIDNUMBER);
552	break;
553
554	case ID_TYPE_GID:
555	type = get_attr_key2string(idpool_attr_list,
556	LDAP_ATTR_GIDNUMBER);
557	break;
558
559	default:
560	DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
561	return NT_STATUS_INVALID_PARAMETER;
562	}
563
564	filter = talloc_asprintf(memctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
565	CHECK_ALLOC_DONE(filter);
566
567	attr_list = get_attr_list(memctx, idpool_attr_list);
568	CHECK_ALLOC_DONE(attr_list);
569
570	rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
571	idmap_alloc_ldap->suffix,
572	LDAP_SCOPE_SUBTREE, filter,
573	attr_list, 0, &result);
574
575	if (rc != LDAP_SUCCESS) {
576	DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
577	goto done;
578	}
579
580	talloc_autofree_ldapmsg(memctx, result);
581
582	count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
583	result);
584	if (count != 1) {
585	DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
586	goto done;
587	}
588
589	entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
590	result);
591
592	id_str = smbldap_talloc_single_attribute(idmap_alloc_ldap->smbldap_state->ldap_struct,
593	entry, type, memctx);
594	if ( ! id_str) {
595	DEBUG(0,("%s attribute not found\n", type));
596	goto done;
597	}
598	if ( ! id_str) {
599	DEBUG(0,("Out of memory\n"));
600	ret = NT_STATUS_NO_MEMORY;
601	goto done;
602	}
603
604	xid->id = strtoul(id_str, NULL, 10);
605
606	ret = NT_STATUS_OK;
607	done:
608	talloc_free(memctx);
609	return ret;
610	}
611	/**********************************
612	Set highest id.
613	**********************************/
614
615	static NTSTATUS idmap_ldap_set_hwm(struct unixid *xid)
616	{
617	TALLOC_CTX *ctx;
618	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
619	int rc = LDAP_SERVER_DOWN;
620	int count = 0;
621	LDAPMessage *result = NULL;
622	LDAPMessage *entry = NULL;
623	LDAPMod **mods = NULL;
624	char *new_id_str;
625	char *filter = NULL;
626	const char *dn = NULL;
627	const char **attr_list;
628	const char *type;
629
630	/* Only do query if we are online */
631	if (idmap_is_offline()) {
632	return NT_STATUS_FILE_IS_OFFLINE;
633	}
634
635	if ( ! idmap_alloc_ldap) {
636	return NT_STATUS_UNSUCCESSFUL;
637	}
638
639	ctx = talloc_new(idmap_alloc_ldap);
640	if ( ! ctx) {
641	DEBUG(0, ("Out of memory!\n"));
642	return NT_STATUS_NO_MEMORY;
643	}
644
645	/* get type */
646	switch (xid->type) {
647
648	case ID_TYPE_UID:
649	type = get_attr_key2string(idpool_attr_list,
650	LDAP_ATTR_UIDNUMBER);
651	break;
652
653	case ID_TYPE_GID:
654	type = get_attr_key2string(idpool_attr_list,
655	LDAP_ATTR_GIDNUMBER);
656	break;
657
658	default:
659	DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
660	return NT_STATUS_INVALID_PARAMETER;
661	}
662
663	filter = talloc_asprintf(ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
664	CHECK_ALLOC_DONE(filter);
665
666	attr_list = get_attr_list(ctx, idpool_attr_list);
667	CHECK_ALLOC_DONE(attr_list);
668
669	rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
670	idmap_alloc_ldap->suffix,
671	LDAP_SCOPE_SUBTREE, filter,
672	attr_list, 0, &result);
673
674	if (rc != LDAP_SUCCESS) {
675	DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
676	goto done;
677	}
678
679	talloc_autofree_ldapmsg(ctx, result);
680
681	count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
682	result);
683	if (count != 1) {
684	DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
685	goto done;
686	}
687
688	entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
689	result);
690
691	dn = smbldap_talloc_dn(ctx,
692	idmap_alloc_ldap->smbldap_state->ldap_struct,
693	entry);
694	if ( ! dn) {
695	goto done;
696	}
697
698	new_id_str = talloc_asprintf(ctx, "%lu", (unsigned long)xid->id);
699	if ( ! new_id_str) {
700	DEBUG(0,("Out of memory\n"));
701	ret = NT_STATUS_NO_MEMORY;
702	goto done;
703	}
704
705	smbldap_set_mod(&mods, LDAP_MOD_REPLACE, type, new_id_str);
706
707	if (mods == NULL) {
708	DEBUG(0,("smbldap_set_mod() failed.\n"));
709	goto done;
710	}
711
712	rc = smbldap_modify(idmap_alloc_ldap->smbldap_state, dn, mods);
713
714	ldap_mods_free(mods, True);
715
716	if (rc != LDAP_SUCCESS) {
717	DEBUG(1,("Failed to allocate new %s. "
718	"smbldap_modify() failed.\n", type));
719	goto done;
720	}
721
722	ret = NT_STATUS_OK;
723
724	done:
725	talloc_free(ctx);
726	return ret;
727	}
728
729	/**********************************
730	Close idmap ldap alloc
731	**********************************/
732
733	static NTSTATUS idmap_ldap_alloc_close(void)
734	{
735	if (idmap_alloc_ldap) {
736	smbldap_free_struct(&idmap_alloc_ldap->smbldap_state);
737	DEBUG(5,("The connection to the LDAP server was closed\n"));
738	/* maybe free the results here --metze */
739	TALLOC_FREE(idmap_alloc_ldap);
740	}
741	return NT_STATUS_OK;
742	}
743
744
745	/**********************************************************************
746	IDMAP MAPPING LDAP BACKEND
747	**********************************************************************/
748
749	static int idmap_ldap_close_destructor(struct idmap_ldap_context *ctx)
750	{
751	smbldap_free_struct(&ctx->smbldap_state);
752	DEBUG(5,("The connection to the LDAP server was closed\n"));
753	/* maybe free the results here --metze */
754
755	return 0;
756	}
757
758	/********************************
759	Initialise idmap database.
760	********************************/
761
762	static NTSTATUS idmap_ldap_db_init(struct idmap_domain *dom,
763	const char *params)
764	{
765	NTSTATUS ret;
766	struct idmap_ldap_context *ctx = NULL;
767	char *config_option = NULL;
768	const char *tmp = NULL;
769
770	/* Only do init if we are online */
771	if (idmap_is_offline()) {
772	return NT_STATUS_FILE_IS_OFFLINE;
773	}
774
775	ctx = TALLOC_ZERO_P(dom, struct idmap_ldap_context);
776	if ( ! ctx) {
777	DEBUG(0, ("Out of memory!\n"));
778	return NT_STATUS_NO_MEMORY;
779	}
780
781	if (strequal(dom->name, "*")) {
782	uid_t low_uid = 0;
783	uid_t high_uid = 0;
784	gid_t low_gid = 0;
785	gid_t high_gid = 0;
786
787	ctx->filter_low_id = 0;
788	ctx->filter_high_id = 0;
789
790	if (lp_idmap_uid(&low_uid, &high_uid)) {
791	ctx->filter_low_id = low_uid;
792	ctx->filter_high_id = high_uid;
793	} else {
794	DEBUG(3, ("Warning: 'idmap uid' not set!\n"));
795	}
796
797	if (lp_idmap_gid(&low_gid, &high_gid)) {
798	if ((low_gid != low_uid) \|\| (high_gid != high_uid)) {
799	DEBUG(1, ("Warning: 'idmap uid' and 'idmap gid'"
800	" ranges do not agree -- building "
801	"intersection\n"));
802	ctx->filter_low_id = MAX(ctx->filter_low_id,
803	low_gid);
804	ctx->filter_high_id = MIN(ctx->filter_high_id,
805	high_gid);
806	}
807	} else {
808	DEBUG(3, ("Warning: 'idmap gid' not set!\n"));
809	}
810	} else {
811	const char *range = NULL;
812
813	config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
814	if ( ! config_option) {
815	DEBUG(0, ("Out of memory!\n"));
816	ret = NT_STATUS_NO_MEMORY;
817	goto done;
818	}
819
820	/* load ranges */
821	range = lp_parm_const_string(-1, config_option, "range", NULL);
822	if (range && range[0]) {
823	if ((sscanf(range, "%u - %u", &ctx->filter_low_id,
824	&ctx->filter_high_id) != 2))
825	{
826	DEBUG(1, ("ERROR: invalid filter range [%s]", range));
827	ctx->filter_low_id = 0;
828	ctx->filter_high_id = 0;
829	}
830	}
831	}
832
833	if (ctx->filter_low_id > ctx->filter_high_id) {
834	DEBUG(1, ("ERROR: invalid filter range [%u-%u]",
835	ctx->filter_low_id, ctx->filter_high_id));
836	ctx->filter_low_id = 0;
837	ctx->filter_high_id = 0;
838	}
839
840	if (params != NULL) {
841	/* assume location is the only parameter */
842	ctx->url = talloc_strdup(ctx, params);
843	} else {
844	tmp = lp_parm_const_string(-1, config_option, "ldap_url", NULL);
845
846	if ( ! tmp) {
847	DEBUG(1, ("ERROR: missing idmap ldap url\n"));
848	ret = NT_STATUS_UNSUCCESSFUL;
849	goto done;
850	}
851
852	ctx->url = talloc_strdup(ctx, tmp);
853	}
854	CHECK_ALLOC_DONE(ctx->url);
855
856	trim_char(ctx->url, '\"', '\"');
857
858	tmp = lp_parm_const_string(-1, config_option, "ldap_base_dn", NULL);
859	if ( ! tmp \|\| ! *tmp) {
860	tmp = lp_ldap_idmap_suffix();
861	if ( ! tmp) {
862	DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
863	ret = NT_STATUS_UNSUCCESSFUL;
864	goto done;
865	}
866	}
867
868	ctx->suffix = talloc_strdup(ctx, tmp);
869	CHECK_ALLOC_DONE(ctx->suffix);
870
871	ret = smbldap_init(ctx, winbind_event_context(), ctx->url,
872	&ctx->smbldap_state);
873	if (!NT_STATUS_IS_OK(ret)) {
874	DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n", ctx->url));
875	goto done;
876	}
877
878	ret = get_credentials( ctx, ctx->smbldap_state, config_option,
879	dom, &ctx->user_dn );
880	if ( !NT_STATUS_IS_OK(ret) ) {
881	DEBUG(1,("idmap_ldap_db_init: Failed to get connection "
882	"credentials (%s)\n", nt_errstr(ret)));
883	goto done;
884	}
885
886	/* set the destructor on the context, so that resource are properly
887	freed if the contexts is released */
888
889	talloc_set_destructor(ctx, idmap_ldap_close_destructor);
890
891	dom->private_data = ctx;
892
893	talloc_free(config_option);
894	return NT_STATUS_OK;
895
896	/failed /
897	done:
898	talloc_free(ctx);
899	return ret;
900	}
901
902	/* max number of ids requested per batch query */
903	#define IDMAP_LDAP_MAX_IDS 30
904
905	/**********************************
906	lookup a set of unix ids.
907	**********************************/
908
909	/* this function searches up to IDMAP_LDAP_MAX_IDS entries
910	* in maps for a match */
911	static struct id_map find_map_by_id(struct id_map *maps,
912	enum id_type type,
913	uint32_t id)
914	{
915	int i;
916
917	for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
918	if (maps[i] == NULL) { /* end of the run */
919	return NULL;
920	}
921	if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
922	return maps[i];
923	}
924	}
925
926	return NULL;
927	}
928
929	static NTSTATUS idmap_ldap_unixids_to_sids(struct idmap_domain *dom,
930	struct id_map **ids)
931	{
932	NTSTATUS ret;
933	TALLOC_CTX *memctx;
934	struct idmap_ldap_context *ctx;
935	LDAPMessage *result = NULL;
936	const char *uidNumber;
937	const char *gidNumber;
938	const char **attr_list;
939	char *filter = NULL;
940	bool multi = False;
941	int idx = 0;
942	int bidx = 0;
943	int count;
944	int rc;
945	int i;
946
947	/* Only do query if we are online */
948	if (idmap_is_offline()) {
949	return NT_STATUS_FILE_IS_OFFLINE;
950	}
951
952	ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
953
954	memctx = talloc_new(ctx);
955	if ( ! memctx) {
956	DEBUG(0, ("Out of memory!\n"));
957	return NT_STATUS_NO_MEMORY;
958	}
959
960	uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
961	gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
962
963	attr_list = get_attr_list(memctx, sidmap_attr_list);
964
965	if ( ! ids[1]) {
966	/* if we are requested just one mapping use the simple filter */
967
968	filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%lu))",
969	LDAP_OBJ_IDMAP_ENTRY,
970	(ids[0]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
971	(unsigned long)ids[0]->xid.id);
972	CHECK_ALLOC_DONE(filter);
973	DEBUG(10, ("Filter: [%s]\n", filter));
974	} else {
975	/* multiple mappings */
976	multi = True;
977	}
978
979	for (i = 0; ids[i]; i++) {
980	ids[i]->status = ID_UNKNOWN;
981	}
982
983	again:
984	if (multi) {
985
986	talloc_free(filter);
987	filter = talloc_asprintf(memctx,
988	"(&(objectClass=%s)(\|",
989	LDAP_OBJ_IDMAP_ENTRY);
990	CHECK_ALLOC_DONE(filter);
991
992	bidx = idx;
993	for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
994	filter = talloc_asprintf_append_buffer(filter, "(%s=%lu)",
995	(ids[idx]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
996	(unsigned long)ids[idx]->xid.id);
997	CHECK_ALLOC_DONE(filter);
998	}
999	filter = talloc_asprintf_append_buffer(filter, "))");
1000	CHECK_ALLOC_DONE(filter);
1001	DEBUG(10, ("Filter: [%s]\n", filter));
1002	} else {
1003	bidx = 0;
1004	idx = 1;
1005	}
1006
1007	rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
1008	filter, attr_list, 0, &result);
1009
1010	if (rc != LDAP_SUCCESS) {
1011	DEBUG(3,("Failure looking up ids (%s)\n", ldap_err2string(rc)));
1012	ret = NT_STATUS_UNSUCCESSFUL;
1013	goto done;
1014	}
1015
1016	count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
1017
1018	if (count == 0) {
1019	DEBUG(10, ("NO SIDs found\n"));
1020	}
1021
1022	for (i = 0; i < count; i++) {
1023	LDAPMessage *entry = NULL;
1024	char *sidstr = NULL;
1025	char *tmp = NULL;
1026	enum id_type type;
1027	struct id_map *map;
1028	uint32_t id;
1029
1030	if (i == 0) { /* first entry */
1031	entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
1032	result);
1033	} else { /* following ones */
1034	entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
1035	entry);
1036	}
1037	if ( ! entry) {
1038	DEBUG(2, ("ERROR: Unable to fetch ldap entries "
1039	"from results\n"));
1040	break;
1041	}
1042
1043	/* first check if the SID is present */
1044	sidstr = smbldap_talloc_single_attribute(
1045	ctx->smbldap_state->ldap_struct,
1046	entry, LDAP_ATTRIBUTE_SID, memctx);
1047	if ( ! sidstr) { /* no sid, skip entry */
1048	DEBUG(2, ("WARNING SID not found on entry\n"));
1049	continue;
1050	}
1051
1052	/* now try to see if it is a uid, if not try with a gid
1053	* (gid is more common, but in case both uidNumber and
1054	* gidNumber are returned the SID is mapped to the uid
1055	not the gid) /
1056	type = ID_TYPE_UID;
1057	tmp = smbldap_talloc_single_attribute(
1058	ctx->smbldap_state->ldap_struct,
1059	entry, uidNumber, memctx);
1060	if ( ! tmp) {
1061	type = ID_TYPE_GID;
1062	tmp = smbldap_talloc_single_attribute(
1063	ctx->smbldap_state->ldap_struct,
1064	entry, gidNumber, memctx);
1065	}
1066	if ( ! tmp) { /* wow very strange entry, how did it match ? */
1067	DEBUG(5, ("Unprobable match on (%s), no uidNumber, "
1068	"nor gidNumber returned\n", sidstr));
1069	TALLOC_FREE(sidstr);
1070	continue;
1071	}
1072
1073	id = strtoul(tmp, NULL, 10);
1074	if ((id == 0) \|\|
1075	(ctx->filter_low_id && (id < ctx->filter_low_id)) \|\|
1076	(ctx->filter_high_id && (id > ctx->filter_high_id))) {
1077	DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1078	"Filtered!\n", id,
1079	ctx->filter_low_id, ctx->filter_high_id));
1080	TALLOC_FREE(sidstr);
1081	TALLOC_FREE(tmp);
1082	continue;
1083	}
1084	TALLOC_FREE(tmp);
1085
1086	map = find_map_by_id(&ids[bidx], type, id);
1087	if (!map) {
1088	DEBUG(2, ("WARNING: couldn't match sid (%s) "
1089	"with requested ids\n", sidstr));
1090	TALLOC_FREE(sidstr);
1091	continue;
1092	}
1093
1094	if ( ! string_to_sid(map->sid, sidstr)) {
1095	DEBUG(2, ("ERROR: Invalid SID on entry\n"));
1096	TALLOC_FREE(sidstr);
1097	continue;
1098	}
1099	TALLOC_FREE(sidstr);
1100
1101	/* mapped */
1102	map->status = ID_MAPPED;
1103
1104	DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1105	(unsigned long)map->xid.id, map->xid.type));
1106	}
1107
1108	/* free the ldap results */
1109	if (result) {
1110	ldap_msgfree(result);
1111	result = NULL;
1112	}
1113
1114	if (multi && ids[idx]) { /* still some values to map */
1115	goto again;
1116	}
1117
1118	ret = NT_STATUS_OK;
1119
1120	/* mark all unknwon/expired ones as unmapped */
1121	for (i = 0; ids[i]; i++) {
1122	if (ids[i]->status != ID_MAPPED)
1123	ids[i]->status = ID_UNMAPPED;
1124	}
1125
1126	done:
1127	talloc_free(memctx);
1128	return ret;
1129	}
1130
1131	/**********************************
1132	lookup a set of sids.
1133	**********************************/
1134
1135	/* this function searches up to IDMAP_LDAP_MAX_IDS entries
1136	* in maps for a match */
1137	static struct id_map find_map_by_sid(struct id_map maps, DOM_SID sid)
1138	{
1139	int i;
1140
1141	for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
1142	if (maps[i] == NULL) { /* end of the run */
1143	return NULL;
1144	}
1145	if (sid_equal(maps[i]->sid, sid)) {
1146	return maps[i];
1147	}
1148	}
1149
1150	return NULL;
1151	}
1152
1153	static NTSTATUS idmap_ldap_sids_to_unixids(struct idmap_domain *dom,
1154	struct id_map **ids)
1155	{
1156	LDAPMessage *entry = NULL;
1157	NTSTATUS ret;
1158	TALLOC_CTX *memctx;
1159	struct idmap_ldap_context *ctx;
1160	LDAPMessage *result = NULL;
1161	const char *uidNumber;
1162	const char *gidNumber;
1163	const char **attr_list;
1164	char *filter = NULL;
1165	bool multi = False;
1166	int idx = 0;
1167	int bidx = 0;
1168	int count;
1169	int rc;
1170	int i;
1171
1172	/* Only do query if we are online */
1173	if (idmap_is_offline()) {
1174	return NT_STATUS_FILE_IS_OFFLINE;
1175	}
1176
1177	ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
1178
1179	memctx = talloc_new(ctx);
1180	if ( ! memctx) {
1181	DEBUG(0, ("Out of memory!\n"));
1182	return NT_STATUS_NO_MEMORY;
1183	}
1184
1185	uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
1186	gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
1187
1188	attr_list = get_attr_list(memctx, sidmap_attr_list);
1189
1190	if ( ! ids[1]) {
1191	/* if we are requested just one mapping use the simple filter */
1192
1193	filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%s))",
1194	LDAP_OBJ_IDMAP_ENTRY,
1195	LDAP_ATTRIBUTE_SID,
1196	sid_string_talloc(memctx, ids[0]->sid));
1197	CHECK_ALLOC_DONE(filter);
1198	DEBUG(10, ("Filter: [%s]\n", filter));
1199	} else {
1200	/* multiple mappings */
1201	multi = True;
1202	}
1203
1204	for (i = 0; ids[i]; i++) {
1205	ids[i]->status = ID_UNKNOWN;
1206	}
1207
1208	again:
1209	if (multi) {
1210
1211	TALLOC_FREE(filter);
1212	filter = talloc_asprintf(memctx,
1213	"(&(objectClass=%s)(\|",
1214	LDAP_OBJ_IDMAP_ENTRY);
1215	CHECK_ALLOC_DONE(filter);
1216
1217	bidx = idx;
1218	for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
1219	filter = talloc_asprintf_append_buffer(filter, "(%s=%s)",
1220	LDAP_ATTRIBUTE_SID,
1221	sid_string_talloc(memctx,
1222	ids[idx]->sid));
1223	CHECK_ALLOC_DONE(filter);
1224	}
1225	filter = talloc_asprintf_append_buffer(filter, "))");
1226	CHECK_ALLOC_DONE(filter);
1227	DEBUG(10, ("Filter: [%s]", filter));
1228	} else {
1229	bidx = 0;
1230	idx = 1;
1231	}
1232
1233	rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
1234	filter, attr_list, 0, &result);
1235
1236	if (rc != LDAP_SUCCESS) {
1237	DEBUG(3,("Failure looking up sids (%s)\n",
1238	ldap_err2string(rc)));
1239	ret = NT_STATUS_UNSUCCESSFUL;
1240	goto done;
1241	}
1242
1243	count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
1244
1245	if (count == 0) {
1246	DEBUG(10, ("NO SIDs found\n"));
1247	}
1248
1249	for (i = 0; i < count; i++) {
1250	char *sidstr = NULL;
1251	char *tmp = NULL;
1252	enum id_type type;
1253	struct id_map *map;
1254	DOM_SID sid;
1255	uint32_t id;
1256
1257	if (i == 0) { /* first entry */
1258	entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
1259	result);
1260	} else { /* following ones */
1261	entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
1262	entry);
1263	}
1264	if ( ! entry) {
1265	DEBUG(2, ("ERROR: Unable to fetch ldap entries "
1266	"from results\n"));
1267	break;
1268	}
1269
1270	/* first check if the SID is present */
1271	sidstr = smbldap_talloc_single_attribute(
1272	ctx->smbldap_state->ldap_struct,
1273	entry, LDAP_ATTRIBUTE_SID, memctx);
1274	if ( ! sidstr) { /* no sid ??, skip entry */
1275	DEBUG(2, ("WARNING SID not found on entry\n"));
1276	continue;
1277	}
1278
1279	if ( ! string_to_sid(&sid, sidstr)) {
1280	DEBUG(2, ("ERROR: Invalid SID on entry\n"));
1281	TALLOC_FREE(sidstr);
1282	continue;
1283	}
1284
1285	map = find_map_by_sid(&ids[bidx], &sid);
1286	if (!map) {
1287	DEBUG(2, ("WARNING: couldn't find entry sid (%s) "
1288	"in ids", sidstr));
1289	TALLOC_FREE(sidstr);
1290	continue;
1291	}
1292
1293	TALLOC_FREE(sidstr);
1294
1295	/* now try to see if it is a uid, if not try with a gid
1296	* (gid is more common, but in case both uidNumber and
1297	* gidNumber are returned the SID is mapped to the uid
1298	* not the gid) */
1299	type = ID_TYPE_UID;
1300	tmp = smbldap_talloc_single_attribute(
1301	ctx->smbldap_state->ldap_struct,
1302	entry, uidNumber, memctx);
1303	if ( ! tmp) {
1304	type = ID_TYPE_GID;
1305	tmp = smbldap_talloc_single_attribute(
1306	ctx->smbldap_state->ldap_struct,
1307	entry, gidNumber, memctx);
1308	}
1309	if ( ! tmp) { /* no ids ?? */
1310	DEBUG(5, ("no uidNumber, "
1311	"nor gidNumber attributes found\n"));
1312	continue;
1313	}
1314
1315	id = strtoul(tmp, NULL, 10);
1316	if ((id == 0) \|\|
1317	(ctx->filter_low_id && (id < ctx->filter_low_id)) \|\|
1318	(ctx->filter_high_id && (id > ctx->filter_high_id))) {
1319	DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1320	"Filtered!\n", id,
1321	ctx->filter_low_id, ctx->filter_high_id));
1322	TALLOC_FREE(tmp);
1323	continue;
1324	}
1325	TALLOC_FREE(tmp);
1326
1327	/* mapped */
1328	map->xid.type = type;
1329	map->xid.id = id;
1330	map->status = ID_MAPPED;
1331
1332	DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1333	(unsigned long)map->xid.id, map->xid.type));
1334	}
1335
1336	/* free the ldap results */
1337	if (result) {
1338	ldap_msgfree(result);
1339	result = NULL;
1340	}
1341
1342	if (multi && ids[idx]) { /* still some values to map */
1343	goto again;
1344	}
1345
1346	ret = NT_STATUS_OK;
1347
1348	/* mark all unknwon/expired ones as unmapped */
1349	for (i = 0; ids[i]; i++) {
1350	if (ids[i]->status != ID_MAPPED)
1351	ids[i]->status = ID_UNMAPPED;
1352	}
1353
1354	done:
1355	talloc_free(memctx);
1356	return ret;
1357	}
1358
1359	/**********************************
1360	set a mapping.
1361	**********************************/
1362
1363	/* TODO: change this: This function cannot be called to modify a mapping,
1364	* only set a new one */
1365
1366	static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
1367	const struct id_map *map)
1368	{
1369	NTSTATUS ret;
1370	TALLOC_CTX *memctx;
1371	struct idmap_ldap_context *ctx;
1372	LDAPMessage *entry = NULL;
1373	LDAPMod **mods = NULL;
1374	const char *type;
1375	char *id_str;
1376	char *sid;
1377	char *dn;
1378	int rc = -1;
1379
1380	/* Only do query if we are online */
1381	if (idmap_is_offline()) {
1382	return NT_STATUS_FILE_IS_OFFLINE;
1383	}
1384
1385	ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
1386
1387	switch(map->xid.type) {
1388	case ID_TYPE_UID:
1389	type = get_attr_key2string(sidmap_attr_list,
1390	LDAP_ATTR_UIDNUMBER);
1391	break;
1392
1393	case ID_TYPE_GID:
1394	type = get_attr_key2string(sidmap_attr_list,
1395	LDAP_ATTR_GIDNUMBER);
1396	break;
1397
1398	default:
1399	return NT_STATUS_INVALID_PARAMETER;
1400	}
1401
1402	memctx = talloc_new(ctx);
1403	if ( ! memctx) {
1404	DEBUG(0, ("Out of memory!\n"));
1405	return NT_STATUS_NO_MEMORY;
1406	}
1407
1408	id_str = talloc_asprintf(memctx, "%lu", (unsigned long)map->xid.id);
1409	CHECK_ALLOC_DONE(id_str);
1410
1411	sid = talloc_strdup(memctx, sid_string_talloc(memctx, map->sid));
1412	CHECK_ALLOC_DONE(sid);
1413
1414	dn = talloc_asprintf(memctx, "%s=%s,%s",
1415	get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
1416	sid,
1417	ctx->suffix);
1418	CHECK_ALLOC_DONE(dn);
1419
1420	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1421	"objectClass", LDAP_OBJ_IDMAP_ENTRY);
1422
1423	smbldap_make_mod(ctx->smbldap_state->ldap_struct,
1424	entry, &mods, type, id_str);
1425
1426	smbldap_make_mod(ctx->smbldap_state->ldap_struct, entry, &mods,
1427	get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
1428	sid);
1429
1430	if ( ! mods) {
1431	DEBUG(2, ("ERROR: No mods?\n"));
1432	ret = NT_STATUS_UNSUCCESSFUL;
1433	goto done;
1434	}
1435
1436	/* TODO: remove conflicting mappings! */
1437
1438	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SID_ENTRY);
1439
1440	DEBUG(10, ("Set DN %s (%s -> %s)\n", dn, sid, id_str));
1441
1442	rc = smbldap_add(ctx->smbldap_state, dn, mods);
1443	ldap_mods_free(mods, True);
1444
1445	if (rc != LDAP_SUCCESS) {
1446	char *ld_error = NULL;
1447	ldap_get_option(ctx->smbldap_state->ldap_struct,
1448	LDAP_OPT_ERROR_STRING, &ld_error);
1449	DEBUG(0,("ldap_set_mapping_internals: Failed to add %s to %lu "
1450	"mapping [%s]\n", sid,
1451	(unsigned long)map->xid.id, type));
1452	DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n",
1453	ld_error ? ld_error : "(NULL)", ldap_err2string (rc)));
1454	if (ld_error) {
1455	ldap_memfree(ld_error);
1456	}
1457	ret = NT_STATUS_UNSUCCESSFUL;
1458	goto done;
1459	}
1460
1461	DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to "
1462	"%lu [%s]\n", sid, (unsigned long)map->xid.id, type));
1463
1464	ret = NT_STATUS_OK;
1465
1466	done:
1467	talloc_free(memctx);
1468	return ret;
1469	}
1470
1471	/**********************************
1472	Close the idmap ldap instance
1473	**********************************/
1474
1475	static NTSTATUS idmap_ldap_close(struct idmap_domain *dom)
1476	{
1477	struct idmap_ldap_context *ctx;
1478
1479	if (dom->private_data) {
1480	ctx = talloc_get_type(dom->private_data,
1481	struct idmap_ldap_context);
1482
1483	talloc_free(ctx);
1484	dom->private_data = NULL;
1485	}
1486
1487	return NT_STATUS_OK;
1488	}
1489
1490	static struct idmap_methods idmap_ldap_methods = {
1491
1492	.init = idmap_ldap_db_init,
1493	.unixids_to_sids = idmap_ldap_unixids_to_sids,
1494	.sids_to_unixids = idmap_ldap_sids_to_unixids,
1495	.set_mapping = idmap_ldap_set_mapping,
1496	.close_fn = idmap_ldap_close
1497	};
1498
1499	static struct idmap_alloc_methods idmap_ldap_alloc_methods = {
1500
1501	.init = idmap_ldap_alloc_init,
1502	.allocate_id = idmap_ldap_allocate_id,
1503	.get_id_hwm = idmap_ldap_get_hwm,
1504	.set_id_hwm = idmap_ldap_set_hwm,
1505	.close_fn = idmap_ldap_alloc_close,
1506	/* .dump_data = TODO */
1507	};
1508
1509	static NTSTATUS idmap_alloc_ldap_init(void)
1510	{
1511	return smb_register_idmap_alloc(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1512	&idmap_ldap_alloc_methods);
1513	}
1514
1515	NTSTATUS idmap_ldap_init(void);
1516	NTSTATUS idmap_ldap_init(void)
1517	{
1518	NTSTATUS ret;
1519
1520	/* FIXME: bad hack to actually register also the alloc_ldap module
1521	* without changining configure.in */
1522	ret = idmap_alloc_ldap_init();
1523	if (! NT_STATUS_IS_OK(ret)) {
1524	return ret;
1525	}
1526	return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1527	&idmap_ldap_methods);
1528	}
1529

Note: See TracBrowser for help on using the repository browser.

Download in other formats: