source: trunk-3.0/source/nsswitch/idmap.c@ 101

Last change on this file since 101 was 71, checked in by Paul Smedley, 18 years ago

Update source to 3.0.26a
File size: 39.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 ID Mapping
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003-2007
7 Copyright (C) Jeremy Allison 2006
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
22*/
23
24#include "includes.h"
25#include "winbindd.h"
26
27#undef DBGC_CLASS
28#define DBGC_CLASS DBGC_IDMAP
29
30static_decl_idmap;
31
32struct idmap_backend {
33 const char *name;
34 struct idmap_methods *methods;
35 struct idmap_backend *prev, *next;
36};
37
38struct idmap_alloc_backend {
39 const char *name;
40 struct idmap_alloc_methods *methods;
41 struct idmap_alloc_backend *prev, *next;
42};
43
44struct idmap_cache_ctx;
45
46struct idmap_alloc_context {
47 const char *params;
48 struct idmap_alloc_methods *methods;
49 BOOL initialized;
50};
51
52static TALLOC_CTX *idmap_ctx = NULL;
53static struct idmap_cache_ctx *idmap_cache;
54
55static struct idmap_backend *backends = NULL;
56static struct idmap_domain **idmap_domains = NULL;
57static int num_domains = 0;
58static int pdb_dom_num = -1;
59static int def_dom_num = -1;
60
61static struct idmap_alloc_backend *alloc_backends = NULL;
62static struct idmap_alloc_context *idmap_alloc_ctx = NULL;
63
64#define IDMAP_CHECK_RET(ret) do { \
65 if ( ! NT_STATUS_IS_OK(ret)) { \
66 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
67 goto done; \
68 } } while(0)
69#define IDMAP_REPORT_RET(ret) do { \
70 if ( ! NT_STATUS_IS_OK(ret)) { \
71 DEBUG(2, ("ERROR: NTSTATUS = 0x%08x\n", NT_STATUS_V(ret))); \
72 } } while(0)
73#define IDMAP_CHECK_ALLOC(mem) do { \
74 if (!mem) { \
75 DEBUG(0, ("Out of memory!\n")); ret = NT_STATUS_NO_MEMORY; \
76 goto done; \
77 } } while(0)
78
79static struct idmap_methods *get_methods(struct idmap_backend *be,
80 const char *name)
81{
82 struct idmap_backend *b;
83
84 for (b = be; b; b = b->next) {
85 if (strequal(b->name, name)) {
86 return b->methods;
87 }
88 }
89
90 return NULL;
91}
92
93static struct idmap_alloc_methods *get_alloc_methods(
94 struct idmap_alloc_backend *be,
95 const char *name)
96{
97 struct idmap_alloc_backend *b;
98
99 for (b = be; b; b = b->next) {
100 if (strequal(b->name, name)) {
101 return b->methods;
102 }
103 }
104
105 return NULL;
106}
107
108BOOL idmap_is_offline(void)
109{
110 return ( lp_winbind_offline_logon() &&
111 get_global_winbindd_state_offline() );
112}
113
114/**********************************************************************
115 Allow a module to register itself as a method.
116**********************************************************************/
117
118NTSTATUS smb_register_idmap(int version, const char *name,
119 struct idmap_methods *methods)
120{
121 struct idmap_methods *test;
122 struct idmap_backend *entry;
123
124 if (!idmap_ctx) {
125 return NT_STATUS_INTERNAL_DB_ERROR;
126 }
127
128 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
129 DEBUG(0, ("Failed to register idmap module.\n"
130 "The module was compiled against "
131 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
132 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
133 "Please recompile against the current version "
134 "of samba!\n",
135 version, SMB_IDMAP_INTERFACE_VERSION));
136 return NT_STATUS_OBJECT_TYPE_MISMATCH;
137 }
138
139 if (!name || !name[0] || !methods) {
140 DEBUG(0,("Called with NULL pointer or empty name!\n"));
141 return NT_STATUS_INVALID_PARAMETER;
142 }
143
144 test = get_methods(backends, name);
145 if (test) {
146 DEBUG(0,("Idmap module %s already registered!\n", name));
147 return NT_STATUS_OBJECT_NAME_COLLISION;
148 }
149
150 entry = talloc(idmap_ctx, struct idmap_backend);
151 if ( ! entry) {
152 DEBUG(0,("Out of memory!\n"));
153 return NT_STATUS_NO_MEMORY;
154 }
155 entry->name = talloc_strdup(idmap_ctx, name);
156 if ( ! entry->name) {
157 DEBUG(0,("Out of memory!\n"));
158 return NT_STATUS_NO_MEMORY;
159 }
160 entry->methods = methods;
161
162 DLIST_ADD(backends, entry);
163 DEBUG(5, ("Successfully added idmap backend '%s'\n", name));
164 return NT_STATUS_OK;
165}
166
167/**********************************************************************
168 Allow a module to register itself as a method.
169**********************************************************************/
170
171NTSTATUS smb_register_idmap_alloc(int version, const char *name,
172 struct idmap_alloc_methods *methods)
173{
174 struct idmap_alloc_methods *test;
175 struct idmap_alloc_backend *entry;
176
177 if (!idmap_ctx) {
178 return NT_STATUS_INTERNAL_DB_ERROR;
179 }
180
181 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
182 DEBUG(0, ("Failed to register idmap alloc module.\n"
183 "The module was compiled against "
184 "SMB_IDMAP_INTERFACE_VERSION %d,\n"
185 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
186 "Please recompile against the current version "
187 "of samba!\n",
188 version, SMB_IDMAP_INTERFACE_VERSION));
189 return NT_STATUS_OBJECT_TYPE_MISMATCH;
190 }
191
192 if (!name || !name[0] || !methods) {
193 DEBUG(0,("Called with NULL pointer or empty name!\n"));
194 return NT_STATUS_INVALID_PARAMETER;
195 }
196
197 test = get_alloc_methods(alloc_backends, name);
198 if (test) {
199 DEBUG(0,("idmap_alloc module %s already registered!\n", name));
200 return NT_STATUS_OBJECT_NAME_COLLISION;
201 }
202
203 entry = talloc(idmap_ctx, struct idmap_alloc_backend);
204 if ( ! entry) {
205 DEBUG(0,("Out of memory!\n"));
206 return NT_STATUS_NO_MEMORY;
207 }
208 entry->name = talloc_strdup(idmap_ctx, name);
209 if ( ! entry->name) {
210 DEBUG(0,("Out of memory!\n"));
211 return NT_STATUS_NO_MEMORY;
212 }
213 entry->methods = methods;
214
215 DLIST_ADD(alloc_backends, entry);
216 DEBUG(5, ("Successfully added idmap alloc backend '%s'\n", name));
217 return NT_STATUS_OK;
218}
219
220static int close_domain_destructor(struct idmap_domain *dom)
221{
222 NTSTATUS ret;
223
224 ret = dom->methods->close_fn(dom);
225 if (!NT_STATUS_IS_OK(ret)) {
226 DEBUG(3, ("Failed to close idmap domain [%s]!\n", dom->name));
227 }
228
229 return 0;
230}
231
232/**************************************************************************
233 Shutdown.
234**************************************************************************/
235
236NTSTATUS idmap_close(void)
237{
238 /* close the alloc backend first before freeing idmap_ctx */
239 if (idmap_alloc_ctx) {
240 idmap_alloc_ctx->methods->close_fn();
241 idmap_alloc_ctx->methods = NULL;
242 }
243 alloc_backends = NULL;
244
245 /* this talloc_free call will fire the talloc destructors
246 * that will free all active backends resources */
247 TALLOC_FREE(idmap_ctx);
248 idmap_cache = NULL;
249 idmap_domains = NULL;
250 backends = NULL;
251
252 return NT_STATUS_OK;
253}
254
255/**********************************************************************
256 Initialise idmap cache and a remote backend (if configured).
257**********************************************************************/
258
259static const char *idmap_default_domain[] = { "default domain", NULL };
260
261/****************************************************************************
262 ****************************************************************************/
263
264NTSTATUS idmap_init_cache(void)
265{
266 /* Always initialize the cache. We'll have to delay initialization
267 of backends if we are offline */
268
269 if ( idmap_ctx ) {
270 return NT_STATUS_OK;
271 }
272
273 if ( (idmap_ctx = talloc_named_const(NULL, 0, "idmap_ctx")) == NULL ) {
274 return NT_STATUS_NO_MEMORY;
275 }
276
277 if ( (idmap_cache = idmap_cache_init(idmap_ctx)) == NULL ) {
278 return NT_STATUS_UNSUCCESSFUL;
279 }
280
281 return NT_STATUS_OK;
282}
283
284/****************************************************************************
285 ****************************************************************************/
286
287NTSTATUS idmap_init(void)
288{
289 NTSTATUS ret;
290 static NTSTATUS idmap_init_status = NT_STATUS_UNSUCCESSFUL;
291 struct idmap_domain *dom;
292 char *compat_backend = NULL;
293 char *compat_params = NULL;
294 const char **dom_list = NULL;
295 char *alloc_backend = NULL;
296 BOOL default_already_defined = False;
297 BOOL pri_dom_is_in_list = False;
298 int compat = 0;
299 int i;
300
301 ret = idmap_init_cache();
302 if (!NT_STATUS_IS_OK(ret))
303 return ret;
304
305 if (NT_STATUS_IS_OK(idmap_init_status))
306 return NT_STATUS_OK;
307
308 static_init_idmap;
309
310 dom_list = lp_idmap_domains();
311
312 if ( lp_idmap_backend() ) {
313 const char **compat_list = lp_idmap_backend();
314 char *p = NULL;
315 const char *q = NULL;
316
317 if (dom_list) {
318 DEBUG(0, ("WARNING: idmap backend and idmap domains "
319 "are mutually excusive!\n"));
320 DEBUGADD(0,("idmap backend option will be IGNORED!\n"));
321 } else {
322 compat = 1;
323
324 compat_backend = talloc_strdup(idmap_ctx, *compat_list);
325 if (compat_backend == NULL) {
326 ret = NT_STATUS_NO_MEMORY;
327 goto done;
328 }
329
330 /* strip any leading idmap_ prefix of */
331 if (strncmp(*compat_list, "idmap_", 6) == 0 ) {
332 q = *compat_list += 6;
333 DEBUG(0, ("WARNING: idmap backend uses obsolete"
334 " and deprecated 'idmap_' prefix.\n"
335 "Please replace 'idmap_%s' by '%s' in"
336 " %s\n", q, q, dyn_CONFIGFILE));
337 compat_backend = talloc_strdup(idmap_ctx, q);
338 } else {
339 compat_backend = talloc_strdup(idmap_ctx,
340 *compat_list);
341 }
342
343 /* separate the backend and module arguements */
344 if ((p = strchr(compat_backend, ':')) != NULL) {
345 *p = '\0';
346 compat_params = p + 1;
347 }
348 }
349 } else if ( !dom_list ) {
350 /* Back compatible: without idmap domains and explicit
351 idmap backend. Taking default idmap backend: tdb */
352
353 compat = 1;
354 compat_backend = talloc_strdup( idmap_ctx, "tdb");
355 compat_params = compat_backend;
356 }
357
358 if ( ! dom_list) {
359 dom_list = idmap_default_domain;
360 }
361
362 /***************************
363 * initialize idmap domains
364 */
365 DEBUG(1, ("Initializing idmap domains\n"));
366
367 for (i = 0; dom_list[i]; i++) {
368 const char *parm_backend;
369 char *config_option;
370
371 /* ignore BUILTIN and local MACHINE domains */
372 if (strequal(dom_list[i], "BUILTIN")
373 || strequal(dom_list[i], get_global_sam_name()))
374 {
375 DEBUG(0,("idmap_init: Ignoring invalid domain %s\n",
376 dom_list[i]));
377 continue;
378 }
379
380 if (strequal(dom_list[i], lp_workgroup())) {
381 pri_dom_is_in_list = True;
382 }
383 /* init domain */
384
385 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
386 IDMAP_CHECK_ALLOC(dom);
387
388 dom->name = talloc_strdup(dom, dom_list[i]);
389 IDMAP_CHECK_ALLOC(dom->name);
390
391 config_option = talloc_asprintf(dom, "idmap config %s",
392 dom->name);
393 IDMAP_CHECK_ALLOC(config_option);
394
395 /* default or specific ? */
396
397 dom->default_domain = lp_parm_bool(-1, config_option,
398 "default", False);
399
400 if (dom->default_domain ||
401 strequal(dom_list[i], idmap_default_domain[0])) {
402
403 /* make sure this is set even when we match
404 * idmap_default_domain[0] */
405 dom->default_domain = True;
406
407 if (default_already_defined) {
408 DEBUG(1, ("ERROR: Multiple domains defined as"
409 " default!\n"));
410 ret = NT_STATUS_INVALID_PARAMETER;
411 goto done;
412 }
413
414 default_already_defined = True;
415
416 }
417
418 dom->readonly = lp_parm_bool(-1, config_option,
419 "readonly", False);
420
421 /* find associated backend (default: tdb) */
422 if (compat) {
423 parm_backend = talloc_strdup(idmap_ctx, compat_backend);
424 } else {
425 char *backend = lp_parm_const_string(-1, config_option,
426 "backend", "tdb");
427 parm_backend = talloc_strdup(idmap_ctx, backend);
428 }
429 IDMAP_CHECK_ALLOC(parm_backend);
430
431 /* get the backend methods for this domain */
432 dom->methods = get_methods(backends, parm_backend);
433
434 if ( ! dom->methods) {
435 ret = smb_probe_module("idmap", parm_backend);
436 if (NT_STATUS_IS_OK(ret)) {
437 dom->methods = get_methods(backends,
438 parm_backend);
439 }
440 }
441 if ( ! dom->methods) {
442 DEBUG(0, ("ERROR: Could not get methods for "
443 "backend %s\n", parm_backend));
444 ret = NT_STATUS_UNSUCCESSFUL;
445 goto done;
446 }
447
448 /* check the set_mapping function exists otherwise mark the
449 * module as readonly */
450 if ( ! dom->methods->set_mapping) {
451 DEBUG(5, ("Forcing to readonly, as this module can't"
452 " store arbitrary mappings.\n"));
453 dom->readonly = True;
454 }
455
456 /* now that we have methods,
457 * set the destructor for this domain */
458 talloc_set_destructor(dom, close_domain_destructor);
459
460 if (compat_params) {
461 dom->params = talloc_strdup(dom, compat_params);
462 IDMAP_CHECK_ALLOC(dom->params);
463 } else {
464 dom->params = NULL;
465 }
466
467 /* Finally instance a backend copy for this domain */
468 ret = dom->methods->init(dom);
469 if ( ! NT_STATUS_IS_OK(ret)) {
470 DEBUG(0, ("ERROR: Initialization failed for backend "
471 "%s (domain %s), deferred!\n",
472 parm_backend, dom->name));
473 }
474 idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
475 struct idmap_domain *, i+1);
476 if ( ! idmap_domains) {
477 DEBUG(0, ("Out of memory!\n"));
478 ret = NT_STATUS_NO_MEMORY;
479 goto done;
480 }
481 idmap_domains[i] = dom;
482
483 /* save default domain position for future uses */
484 if (dom->default_domain) {
485 def_dom_num = i;
486 }
487
488 DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
489 dom->name, parm_backend,
490 dom->default_domain?"":"not ",
491 dom->readonly?"":"not "));
492
493 talloc_free(config_option);
494 }
495
496 /* save the number of domains we have */
497 num_domains = i;
498
499 /* automatically add idmap_nss backend if needed */
500 if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
501 ( ! pri_dom_is_in_list) &&
502 lp_winbind_trusted_domains_only()) {
503
504 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
505 IDMAP_CHECK_ALLOC(dom);
506
507 dom->name = talloc_strdup(dom, lp_workgroup());
508 IDMAP_CHECK_ALLOC(dom->name);
509
510 dom->default_domain = False;
511 dom->readonly = True;
512
513 /* get the backend methods for passdb */
514 dom->methods = get_methods(backends, "nss");
515
516 /* (the nss module is always statically linked) */
517 if ( ! dom->methods) {
518 DEBUG(0, ("ERROR: No methods for idmap_nss ?!\n"));
519 ret = NT_STATUS_UNSUCCESSFUL;
520 goto done;
521 }
522
523 /* now that we have methods,
524 * set the destructor for this domain */
525 talloc_set_destructor(dom, close_domain_destructor);
526
527 if (compat_params) {
528 dom->params = talloc_strdup(dom, compat_params);
529 IDMAP_CHECK_ALLOC(dom->params);
530 } else {
531 dom->params = NULL;
532 }
533
534 /* Finally instance a backend copy for this domain */
535 ret = dom->methods->init(dom);
536 if ( ! NT_STATUS_IS_OK(ret)) {
537 DEBUG(0, ("ERROR: Init. failed for idmap_nss ?!\n"));
538 ret = NT_STATUS_UNSUCCESSFUL;
539 goto done;
540 }
541
542 idmap_domains = talloc_realloc(idmap_ctx,
543 idmap_domains,
544 struct idmap_domain *,
545 num_domains+1);
546 if ( ! idmap_domains) {
547 DEBUG(0, ("Out of memory!\n"));
548 ret = NT_STATUS_NO_MEMORY;
549 goto done;
550 }
551 idmap_domains[num_domains] = dom;
552
553 DEBUG(10, ("Domain %s - Backend nss - not default - readonly\n",
554 dom->name ));
555
556 num_domains++;
557 }
558
559 /**** automatically add idmap_passdb backend ****/
560 dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
561 IDMAP_CHECK_ALLOC(dom);
562
563 dom->name = talloc_strdup(dom, get_global_sam_name());
564 IDMAP_CHECK_ALLOC(dom->name);
565
566 dom->default_domain = False;
567 dom->readonly = True;
568
569 /* get the backend methods for passdb */
570 dom->methods = get_methods(backends, "passdb");
571
572 /* (the passdb module is always statically linked) */
573 if ( ! dom->methods) {
574 DEBUG(0, ("ERROR: No methods for idmap_passdb ?!\n"));
575 ret = NT_STATUS_UNSUCCESSFUL;
576 goto done;
577 }
578
579 /* now that we have methods, set the destructor for this domain */
580 talloc_set_destructor(dom, close_domain_destructor);
581
582 if (compat_params) {
583 dom->params = talloc_strdup(dom, compat_params);
584 IDMAP_CHECK_ALLOC(dom->params);
585 } else {
586 dom->params = NULL;
587 }
588
589 /* Finally instance a backend copy for this domain */
590 ret = dom->methods->init(dom);
591 if ( ! NT_STATUS_IS_OK(ret)) {
592 DEBUG(0, ("ERROR: Init. failed for idmap_passdb ?!\n"));
593 ret = NT_STATUS_UNSUCCESSFUL;
594 goto done;
595 }
596
597 idmap_domains = talloc_realloc(idmap_ctx,
598 idmap_domains,
599 struct idmap_domain *,
600 num_domains+1);
601 if ( ! idmap_domains) {
602 DEBUG(0, ("Out of memory!\n"));
603 ret = NT_STATUS_NO_MEMORY;
604 goto done;
605 }
606 idmap_domains[num_domains] = dom;
607
608 /* needed to handle special BUILTIN and wellknown SIDs cases */
609 pdb_dom_num = num_domains;
610
611 DEBUG(10, ("Domain %s - Backend passdb - not default - readonly\n",
612 dom->name));
613
614 num_domains++;
615 /**** finished adding idmap_passdb backend ****/
616
617 /* sort domains so that the default is the last one */
618 /* don't sort if no default domain defined */
619 if (def_dom_num != -1 && def_dom_num != num_domains-1) {
620 /* default is not last, move it */
621 struct idmap_domain *tmp;
622
623 if (pdb_dom_num > def_dom_num) {
624 pdb_dom_num --;
625
626 } else if (pdb_dom_num == def_dom_num) { /* ?? */
627 pdb_dom_num = num_domains - 1;
628 }
629
630 tmp = idmap_domains[def_dom_num];
631
632 for (i = def_dom_num; i < num_domains-1; i++) {
633 idmap_domains[i] = idmap_domains[i+1];
634 }
635 idmap_domains[i] = tmp;
636 def_dom_num = i;
637 }
638
639
640 /* Initialize alloc module */
641
642 DEBUG(3, ("Initializing idmap alloc module\n"));
643
644 alloc_backend = NULL;
645 if (compat) {
646 alloc_backend = talloc_strdup(idmap_ctx, compat_backend);
647 } else {
648 char *ab = lp_idmap_alloc_backend();
649
650 if (ab && (ab[0] != '\0')) {
651 alloc_backend = talloc_strdup(idmap_ctx,
652 lp_idmap_alloc_backend());
653 }
654 }
655
656 if ( alloc_backend ) {
657
658 idmap_alloc_ctx = TALLOC_ZERO_P(idmap_ctx,
659 struct idmap_alloc_context);
660 IDMAP_CHECK_ALLOC(idmap_alloc_ctx);
661
662 idmap_alloc_ctx->methods = get_alloc_methods(alloc_backends,
663 alloc_backend);
664 if ( ! idmap_alloc_ctx->methods) {
665 ret = smb_probe_module("idmap", alloc_backend);
666 if (NT_STATUS_IS_OK(ret)) {
667 idmap_alloc_ctx->methods =
668 get_alloc_methods(alloc_backends,
669 alloc_backend);
670 }
671 }
672 if (idmap_alloc_ctx->methods) {
673
674 if (compat_params) {
675 idmap_alloc_ctx->params =
676 talloc_strdup(idmap_alloc_ctx,
677 compat_params);
678 IDMAP_CHECK_ALLOC(idmap_alloc_ctx->params);
679 } else {
680 idmap_alloc_ctx->params = NULL;
681 }
682
683 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
684 if ( ! NT_STATUS_IS_OK(ret)) {
685 DEBUG(0, ("ERROR: Initialization failed for "
686 "alloc backend %s, deferred!\n",
687 alloc_backend));
688 } else {
689 idmap_alloc_ctx->initialized = True;
690 }
691 } else {
692 DEBUG(2, ("idmap_init: Unable to get methods for "
693 "alloc backend %s\n",
694 alloc_backend));
695 /* certain compat backends are just readonly */
696 if ( compat ) {
697 TALLOC_FREE(idmap_alloc_ctx);
698 ret = NT_STATUS_OK;
699 } else {
700 ret = NT_STATUS_UNSUCCESSFUL;
701 }
702 }
703 }
704
705 /* cleanpu temporary strings */
706 TALLOC_FREE( compat_backend );
707
708 idmap_init_status = NT_STATUS_OK;
709
710 return ret;
711
712done:
713 DEBUG(0, ("Aborting IDMAP Initialization ...\n"));
714 idmap_close();
715
716 return ret;
717}
718
719static NTSTATUS idmap_alloc_init(void)
720{
721 NTSTATUS ret;
722
723 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
724 return ret;
725 }
726
727 if ( ! idmap_alloc_ctx) {
728 return NT_STATUS_NOT_SUPPORTED;
729 }
730
731 if ( ! idmap_alloc_ctx->initialized) {
732 ret = idmap_alloc_ctx->methods->init(idmap_alloc_ctx->params);
733 if ( ! NT_STATUS_IS_OK(ret)) {
734 DEBUG(0, ("ERROR: Initialization failed for alloc "
735 "backend, deferred!\n"));
736 return ret;
737 } else {
738 idmap_alloc_ctx->initialized = True;
739 }
740 }
741
742 return NT_STATUS_OK;
743}
744
745/**************************************************************************
746 idmap allocator interface functions
747**************************************************************************/
748
749NTSTATUS idmap_allocate_uid(struct unixid *id)
750{
751 NTSTATUS ret;
752
753 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
754 return ret;
755 }
756
757 id->type = ID_TYPE_UID;
758 return idmap_alloc_ctx->methods->allocate_id(id);
759}
760
761NTSTATUS idmap_allocate_gid(struct unixid *id)
762{
763 NTSTATUS ret;
764
765 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
766 return ret;
767 }
768
769 id->type = ID_TYPE_GID;
770 return idmap_alloc_ctx->methods->allocate_id(id);
771}
772
773NTSTATUS idmap_set_uid_hwm(struct unixid *id)
774{
775 NTSTATUS ret;
776
777 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
778 return ret;
779 }
780
781 id->type = ID_TYPE_UID;
782 return idmap_alloc_ctx->methods->set_id_hwm(id);
783}
784
785NTSTATUS idmap_set_gid_hwm(struct unixid *id)
786{
787 NTSTATUS ret;
788
789 if (! NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
790 return ret;
791 }
792
793 id->type = ID_TYPE_GID;
794 return idmap_alloc_ctx->methods->set_id_hwm(id);
795}
796
797/******************************************************************************
798 Lookup an idmap_domain give a full user or group SID
799 ******************************************************************************/
800
801static struct idmap_domain* find_idmap_domain_from_sid( DOM_SID *account_sid )
802{
803 DOM_SID domain_sid;
804 uint32 rid;
805 struct winbindd_domain *domain = NULL;
806 int i;
807
808 /* 1. Handle BUILTIN or Special SIDs and prevent them from
809 falling into the default domain space (if we have a
810 configured passdb backend. */
811
812 if ( (pdb_dom_num != -1) &&
813 (sid_check_is_in_builtin(account_sid) ||
814 sid_check_is_in_wellknown_domain(account_sid) ||
815 sid_check_is_in_unix_groups(account_sid) ||
816 sid_check_is_in_unix_users(account_sid)) )
817 {
818 return idmap_domains[pdb_dom_num];
819 }
820
821 /* 2. Lookup the winbindd_domain from the account_sid */
822
823 sid_copy( &domain_sid, account_sid );
824 sid_split_rid( &domain_sid, &rid );
825 domain = find_domain_from_sid_noinit( &domain_sid );
826
827 for (i = 0; domain && i < num_domains; i++) {
828 if ( strequal( idmap_domains[i]->name, domain->name ) ) {
829 return idmap_domains[i];
830 }
831 }
832
833 /* 3. Fall back to the default domain */
834
835 if ( def_dom_num != -1 ) {
836 return idmap_domains[def_dom_num];
837 }
838
839 return NULL;
840}
841
842/******************************************************************************
843 Lookup an index given an idmap_domain pointer
844 ******************************************************************************/
845
846static uint32 find_idmap_domain_index( struct idmap_domain *id_domain)
847{
848 int i;
849
850 for (i = 0; i < num_domains; i++) {
851 if ( idmap_domains[i] == id_domain )
852 return i;
853 }
854
855 return -1;
856}
857
858
859/*********************************************************
860 Check if creating a mapping is permitted for the domain
861*********************************************************/
862
863static NTSTATUS idmap_can_map(const struct id_map *map,
864 struct idmap_domain **ret_dom)
865{
866 struct idmap_domain *dom;
867
868 /* Check we do not create mappings for our own local domain,
869 * or BUILTIN or special SIDs */
870 if ((sid_compare_domain(map->sid, get_global_sam_sid()) == 0) ||
871 sid_check_is_in_builtin(map->sid) ||
872 sid_check_is_in_wellknown_domain(map->sid)) {
873 DEBUG(10, ("We are not supposed to create mappings for "
874 "our own domains (local, builtin, specials)\n"));
875 return NT_STATUS_UNSUCCESSFUL;
876 }
877
878 /* Special check for trusted domain only = Yes */
879 if (lp_winbind_trusted_domains_only()) {
880 struct winbindd_domain *wdom = find_our_domain();
881 if (wdom && (sid_compare_domain(map->sid, &wdom->sid) == 0)) {
882 DEBUG(10, ("We are not supposed to create mappings for "
883 "our primary domain when <trusted domain "
884 "only> is True\n"));
885 DEBUGADD(10, ("Leave [%s] unmapped\n",
886 sid_string_static(map->sid)));
887 return NT_STATUS_UNSUCCESSFUL;
888 }
889 }
890
891 if ( (dom = find_idmap_domain_from_sid( map->sid )) == NULL ) {
892 /* huh, couldn't find a suitable domain,
893 * let's just leave it unmapped */
894 DEBUG(10, ("Could not find idmap backend for SID %s",
895 sid_string_static(map->sid)));
896 return NT_STATUS_NO_SUCH_DOMAIN;
897 }
898
899 if (dom->readonly) {
900 /* ouch the domain is read only,
901 * let's just leave it unmapped */
902 DEBUG(10, ("idmap backend for SID %s is READONLY!\n",
903 sid_string_static(map->sid)));
904 return NT_STATUS_UNSUCCESSFUL;
905 }
906
907 *ret_dom = dom;
908 return NT_STATUS_OK;
909}
910
911static NTSTATUS idmap_new_mapping(TALLOC_CTX *ctx, struct id_map *map)
912{
913 NTSTATUS ret;
914 struct idmap_domain *dom;
915
916 /* If we are offline we cannot lookup SIDs, deny mapping */
917 if (idmap_is_offline()) {
918 return NT_STATUS_FILE_IS_OFFLINE;
919 }
920
921 ret = idmap_can_map(map, &dom);
922 if ( ! NT_STATUS_IS_OK(ret)) {
923 return NT_STATUS_NONE_MAPPED;
924 }
925
926 /* check if this is a valid SID and then map it */
927 switch (map->xid.type) {
928 case ID_TYPE_UID:
929 ret = idmap_allocate_uid(&map->xid);
930 if ( ! NT_STATUS_IS_OK(ret)) {
931 /* can't allocate id, let's just leave it unmapped */
932 DEBUG(2, ("uid allocation failed! "
933 "Can't create mapping\n"));
934 return NT_STATUS_NONE_MAPPED;
935 }
936 break;
937 case ID_TYPE_GID:
938 ret = idmap_allocate_gid(&map->xid);
939 if ( ! NT_STATUS_IS_OK(ret)) {
940 /* can't allocate id, let's just leave it unmapped */
941 DEBUG(2, ("gid allocation failed! "
942 "Can't create mapping\n"));
943 return NT_STATUS_NONE_MAPPED;
944 }
945 break;
946 default:
947 /* invalid sid, let's just leave it unmapped */
948 DEBUG(3,("idmap_new_mapping: Refusing to create a "
949 "mapping for an unspecified ID type.\n"));
950 return NT_STATUS_NONE_MAPPED;
951 }
952
953 /* ok, got a new id, let's set a mapping */
954 map->status = ID_MAPPED;
955
956 DEBUG(10, ("Setting mapping: %s <-> %s %lu\n",
957 sid_string_static(map->sid),
958 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
959 (unsigned long)map->xid.id));
960 ret = dom->methods->set_mapping(dom, map);
961
962 if ( ! NT_STATUS_IS_OK(ret)) {
963 /* something wrong here :-( */
964 DEBUG(2, ("Failed to commit mapping\n!"));
965
966 /* TODO: would it make sense to have an "unalloc_id function?" */
967
968 return NT_STATUS_NONE_MAPPED;
969 }
970
971 return NT_STATUS_OK;
972}
973
974static NTSTATUS idmap_backends_set_mapping(const struct id_map *map)
975{
976 struct idmap_domain *dom;
977 NTSTATUS ret;
978
979 DEBUG(10, ("Setting mapping %s <-> %s %lu\n",
980 sid_string_static(map->sid),
981 (map->xid.type == ID_TYPE_UID) ? "UID" : "GID",
982 (unsigned long)map->xid.id));
983
984 ret = idmap_can_map(map, &dom);
985 if ( ! NT_STATUS_IS_OK(ret)) {
986 return ret;
987 }
988
989 DEBUG(10,("set_mapping for domain %s\n", dom->name ));
990
991 return dom->methods->set_mapping(dom, map);
992}
993
994static NTSTATUS idmap_backends_unixids_to_sids(struct id_map **ids)
995{
996 struct idmap_domain *dom;
997 struct id_map **unmapped;
998 struct id_map **_ids;
999 TALLOC_CTX *ctx;
1000 NTSTATUS ret;
1001 int i, u, n;
1002
1003 if (!ids || !*ids) {
1004 DEBUG(1, ("Invalid list of maps\n"));
1005 return NT_STATUS_INVALID_PARAMETER;
1006 }
1007
1008 ctx = talloc_named_const(NULL, 0, "idmap_backends_unixids_to_sids ctx");
1009 if ( ! ctx) {
1010 DEBUG(0, ("Out of memory!\n"));
1011 return NT_STATUS_NO_MEMORY;
1012 }
1013
1014 DEBUG(10, ("Query backends to map ids->sids\n"));
1015
1016 /* start from the default (the last one) and then if there are still
1017 * unmapped entries cycle through the others */
1018
1019 _ids = ids;
1020
1021 unmapped = NULL;
1022 for (n = num_domains-1; n >= 0; n--) { /* cycle backwards */
1023
1024 dom = idmap_domains[n];
1025
1026 DEBUG(10, ("Query sids from domain %s\n", dom->name));
1027
1028 ret = dom->methods->unixids_to_sids(dom, _ids);
1029 IDMAP_REPORT_RET(ret);
1030
1031 unmapped = NULL;
1032
1033 for (i = 0, u = 0; _ids[i]; i++) {
1034 if (_ids[i]->status != ID_MAPPED) {
1035 unmapped = talloc_realloc(ctx, unmapped,
1036 struct id_map *, u + 2);
1037 IDMAP_CHECK_ALLOC(unmapped);
1038 unmapped[u] = _ids[i];
1039 u++;
1040 }
1041 }
1042 if (unmapped) {
1043 /* terminate the unmapped list */
1044 unmapped[u] = NULL;
1045 } else { /* no more entries, get out */
1046 break;
1047 }
1048
1049 _ids = unmapped;
1050
1051 }
1052
1053 if (unmapped) {
1054 /* there are still unmapped ids,
1055 * map them to the unix users/groups domains */
1056 /* except for expired entries,
1057 * these will be returned as valid (offline mode) */
1058 for (i = 0; unmapped[i]; i++) {
1059 if (unmapped[i]->status == ID_EXPIRED) continue;
1060 switch (unmapped[i]->xid.type) {
1061 case ID_TYPE_UID:
1062 uid_to_unix_users_sid(
1063 (uid_t)unmapped[i]->xid.id,
1064 unmapped[i]->sid);
1065 unmapped[i]->status = ID_MAPPED;
1066 break;
1067 case ID_TYPE_GID:
1068 gid_to_unix_groups_sid(
1069 (gid_t)unmapped[i]->xid.id,
1070 unmapped[i]->sid);
1071 unmapped[i]->status = ID_MAPPED;
1072 break;
1073 default: /* what?! */
1074 unmapped[i]->status = ID_UNKNOWN;
1075 break;
1076 }
1077 }
1078 }
1079
1080 ret = NT_STATUS_OK;
1081
1082done:
1083 talloc_free(ctx);
1084 return ret;
1085}
1086
1087static NTSTATUS idmap_backends_sids_to_unixids(struct id_map **ids)
1088{
1089 struct id_map ***dom_ids;
1090 struct idmap_domain *dom;
1091 TALLOC_CTX *ctx;
1092 NTSTATUS ret;
1093 int i, *counters;
1094
1095 if ( (ctx = talloc_named_const(NULL, 0, "be_sids_to_ids")) == NULL ) {
1096 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1097 return NT_STATUS_NO_MEMORY;
1098 }
1099
1100 DEBUG(10, ("Query backends to map sids->ids\n"));
1101
1102 /* split list per domain */
1103 if (num_domains == 0) {
1104 DEBUG(1, ("No domains available?\n"));
1105 return NT_STATUS_UNSUCCESSFUL;
1106 }
1107
1108 dom_ids = TALLOC_ZERO_ARRAY(ctx, struct id_map **, num_domains);
1109 IDMAP_CHECK_ALLOC(dom_ids);
1110 counters = TALLOC_ZERO_ARRAY(ctx, int, num_domains);
1111 IDMAP_CHECK_ALLOC(counters);
1112
1113 /* partition the requests by domain */
1114
1115 for (i = 0; ids[i]; i++) {
1116 uint32 idx;
1117
1118 if ((dom = find_idmap_domain_from_sid(ids[i]->sid)) == NULL) {
1119 /* no available idmap_domain. Move on */
1120 continue;
1121 }
1122
1123 DEBUG(10,("SID %s is being handled by %s\n",
1124 sid_string_static(ids[i]->sid),
1125 dom ? dom->name : "none" ));
1126
1127 idx = find_idmap_domain_index( dom );
1128 SMB_ASSERT( idx != -1 );
1129
1130 dom_ids[idx] = talloc_realloc(ctx, dom_ids[idx],
1131 struct id_map *,
1132 counters[idx] + 2);
1133 IDMAP_CHECK_ALLOC(dom_ids[idx]);
1134
1135 dom_ids[idx][counters[idx]] = ids[i];
1136 counters[idx]++;
1137 dom_ids[idx][counters[idx]] = NULL;
1138 }
1139
1140 /* All the ids have been dispatched in the right queues.
1141 Let's cycle through the filled ones */
1142
1143 for (i = 0; i < num_domains; i++) {
1144 if (dom_ids[i]) {
1145 dom = idmap_domains[i];
1146 DEBUG(10, ("Query ids from domain %s\n", dom->name));
1147 ret = dom->methods->sids_to_unixids(dom, dom_ids[i]);
1148 IDMAP_REPORT_RET(ret);
1149 }
1150 }
1151
1152 /* ok all the backends have been contacted at this point */
1153 /* let's see if we have any unmapped SID left and act accordingly */
1154
1155 for (i = 0; ids[i]; i++) {
1156 /* NOTE: this will NOT touch ID_EXPIRED entries that the backend
1157 * was not able to confirm/deny (offline mode) */
1158 if (ids[i]->status == ID_UNKNOWN ||
1159 ids[i]->status == ID_UNMAPPED) {
1160 /* ok this is an unmapped one, see if we can map it */
1161 ret = idmap_new_mapping(ctx, ids[i]);
1162 if (NT_STATUS_IS_OK(ret)) {
1163 /* successfully mapped */
1164 ids[i]->status = ID_MAPPED;
1165 } else
1166 if (NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED)) {
1167 /* could not map it */
1168 ids[i]->status = ID_UNMAPPED;
1169 } else {
1170 /* Something very bad happened down there
1171 * OR we are offline */
1172 ids[i]->status = ID_UNKNOWN;
1173 }
1174 }
1175 }
1176
1177 ret = NT_STATUS_OK;
1178
1179done:
1180 talloc_free(ctx);
1181 return ret;
1182}
1183
1184/**************************************************************************
1185 idmap interface functions
1186**************************************************************************/
1187
1188NTSTATUS idmap_unixids_to_sids(struct id_map **ids)
1189{
1190 TALLOC_CTX *ctx;
1191 NTSTATUS ret;
1192 struct id_map **bids;
1193 int i, bi;
1194 int bn = 0;
1195
1196 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1197 return ret;
1198 }
1199
1200 if (!ids || !*ids) {
1201 DEBUG(1, ("Invalid list of maps\n"));
1202 return NT_STATUS_INVALID_PARAMETER;
1203 }
1204
1205 ctx = talloc_named_const(NULL, 0, "idmap_unixids_to_sids ctx");
1206 if ( ! ctx) {
1207 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1208 return NT_STATUS_NO_MEMORY;
1209 }
1210
1211 /* no ids to be asked to the backends by default */
1212 bids = NULL;
1213 bi = 0;
1214
1215 for (i = 0; ids[i]; i++) {
1216
1217 if ( ! ids[i]->sid) {
1218 DEBUG(1, ("invalid null SID in id_map array"));
1219 talloc_free(ctx);
1220 return NT_STATUS_INVALID_PARAMETER;
1221 }
1222
1223 ret = idmap_cache_map_id(idmap_cache, ids[i]);
1224
1225 if ( ! NT_STATUS_IS_OK(ret)) {
1226
1227 if ( ! bids) {
1228 /* alloc space for ids to be resolved by
1229 * backends (realloc ten by ten) */
1230 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1231 if ( ! bids) {
1232 DEBUG(1, ("Out of memory!\n"));
1233 talloc_free(ctx);
1234 return NT_STATUS_NO_MEMORY;
1235 }
1236 bn = 10;
1237 }
1238
1239 /* add this id to the ones to be retrieved
1240 * from the backends */
1241 bids[bi] = ids[i];
1242 bi++;
1243
1244 /* check if we need to allocate new space
1245 * on the rids array */
1246 if (bi == bn) {
1247 bn += 10;
1248 bids = talloc_realloc(ctx, bids,
1249 struct id_map *, bn);
1250 if ( ! bids) {
1251 DEBUG(1, ("Out of memory!\n"));
1252 talloc_free(ctx);
1253 return NT_STATUS_NO_MEMORY;
1254 }
1255 }
1256
1257 /* make sure the last element is NULL */
1258 bids[bi] = NULL;
1259 }
1260 }
1261
1262 /* let's see if there is any id mapping to be retieved
1263 * from the backends */
1264 if (bi) {
1265
1266 ret = idmap_backends_unixids_to_sids(bids);
1267 IDMAP_CHECK_RET(ret);
1268
1269 /* update the cache */
1270 for (i = 0; i < bi; i++) {
1271 if (bids[i]->status == ID_MAPPED) {
1272 ret = idmap_cache_set(idmap_cache, bids[i]);
1273 } else if (bids[i]->status == ID_EXPIRED) {
1274 /* the cache returned an expired entry and the
1275 * backend was not able to clear the situation
1276 * (offline). This handles a previous
1277 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1278 * for disconnected mode, */
1279 bids[i]->status = ID_MAPPED;
1280 } else if (bids[i]->status == ID_UNKNOWN) {
1281 /* something bad here. We were not able to
1282 * handle this for some reason, mark it as
1283 * unmapped and hope next time things will
1284 * settle down. */
1285 bids[i]->status = ID_UNMAPPED;
1286 } else { /* unmapped */
1287 ret = idmap_cache_set_negative_id(idmap_cache,
1288 bids[i]);
1289 }
1290 IDMAP_CHECK_RET(ret);
1291 }
1292 }
1293
1294 ret = NT_STATUS_OK;
1295done:
1296 talloc_free(ctx);
1297 return ret;
1298}
1299
1300NTSTATUS idmap_sids_to_unixids(struct id_map **ids)
1301{
1302 TALLOC_CTX *ctx;
1303 NTSTATUS ret;
1304 struct id_map **bids;
1305 int i, bi;
1306 int bn = 0;
1307
1308 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1309 return ret;
1310 }
1311
1312 if (!ids || !*ids) {
1313 DEBUG(1, ("Invalid list of maps\n"));
1314 return NT_STATUS_INVALID_PARAMETER;
1315 }
1316
1317 ctx = talloc_named_const(NULL, 0, "idmap_sids_to_unixids ctx");
1318 if ( ! ctx) {
1319 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1320 return NT_STATUS_NO_MEMORY;
1321 }
1322
1323 /* no ids to be asked to the backends by default */
1324 bids = NULL;
1325 bi = 0;
1326
1327 for (i = 0; ids[i]; i++) {
1328
1329 if ( ! ids[i]->sid) {
1330 DEBUG(1, ("invalid null SID in id_map array\n"));
1331 talloc_free(ctx);
1332 return NT_STATUS_INVALID_PARAMETER;
1333 }
1334
1335 ret = idmap_cache_map_sid(idmap_cache, ids[i]);
1336
1337 if ( ! NT_STATUS_IS_OK(ret)) {
1338
1339 if ( ! bids) {
1340 /* alloc space for ids to be resolved
1341 by backends (realloc ten by ten) */
1342 bids = TALLOC_ARRAY(ctx, struct id_map *, 10);
1343 if ( ! bids) {
1344 DEBUG(1, ("Out of memory!\n"));
1345 talloc_free(ctx);
1346 return NT_STATUS_NO_MEMORY;
1347 }
1348 bn = 10;
1349 }
1350
1351 /* add this id to the ones to be retrieved
1352 * from the backends */
1353 bids[bi] = ids[i];
1354 bi++;
1355
1356 /* check if we need to allocate new space
1357 * on the ids array */
1358 if (bi == bn) {
1359 bn += 10;
1360 bids = talloc_realloc(ctx, bids,
1361 struct id_map *, bn);
1362 if ( ! bids) {
1363 DEBUG(1, ("Out of memory!\n"));
1364 talloc_free(ctx);
1365 return NT_STATUS_NO_MEMORY;
1366 }
1367 }
1368
1369 /* make sure the last element is NULL */
1370 bids[bi] = NULL;
1371 }
1372 }
1373
1374 /* let's see if there is any id mapping to be retieved
1375 * from the backends */
1376 if (bids) {
1377
1378 ret = idmap_backends_sids_to_unixids(bids);
1379 IDMAP_CHECK_RET(ret);
1380
1381 /* update the cache */
1382 for (i = 0; bids[i]; i++) {
1383 if (bids[i]->status == ID_MAPPED) {
1384 ret = idmap_cache_set(idmap_cache, bids[i]);
1385 } else if (bids[i]->status == ID_EXPIRED) {
1386 /* the cache returned an expired entry and the
1387 * backend was not able to clear the situation
1388 * (offline). This handles a previous
1389 * NT_STATUS_SYNCHRONIZATION_REQUIRED
1390 * for disconnected mode, */
1391 bids[i]->status = ID_MAPPED;
1392 } else if (bids[i]->status == ID_UNKNOWN) {
1393 /* something bad here. We were not able to
1394 * handle this for some reason, mark it as
1395 * unmapped and hope next time things will
1396 * settle down. */
1397 bids[i]->status = ID_UNMAPPED;
1398 } else { /* unmapped */
1399 ret = idmap_cache_set_negative_sid(idmap_cache,
1400 bids[i]);
1401 }
1402 IDMAP_CHECK_RET(ret);
1403 }
1404 }
1405
1406 ret = NT_STATUS_OK;
1407done:
1408 talloc_free(ctx);
1409 return ret;
1410}
1411
1412NTSTATUS idmap_set_mapping(const struct id_map *id)
1413{
1414 TALLOC_CTX *ctx;
1415 NTSTATUS ret;
1416
1417 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1418 return ret;
1419 }
1420
1421 /* sanity checks */
1422 if ((id->sid == NULL) || (id->status != ID_MAPPED)) {
1423 DEBUG(1, ("NULL SID or unmapped entry\n"));
1424 return NT_STATUS_INVALID_PARAMETER;
1425 }
1426
1427 /* TODO: check uid/gid range ? */
1428
1429 ctx = talloc_named_const(NULL, 0, "idmap_set_mapping ctx");
1430 if ( ! ctx) {
1431 DEBUG(1, ("failed to allocate talloc context, OOM?\n"));
1432 return NT_STATUS_NO_MEMORY;
1433 }
1434
1435 /* set the new mapping */
1436 ret = idmap_backends_set_mapping(id);
1437 IDMAP_CHECK_RET(ret);
1438
1439 /* set the mapping in the cache */
1440 ret = idmap_cache_set(idmap_cache, id);
1441 IDMAP_CHECK_RET(ret);
1442
1443done:
1444 talloc_free(ctx);
1445 return ret;
1446}
1447
1448/**************************************************************************
1449 Dump backend status.
1450**************************************************************************/
1451
1452void idmap_dump_maps(char *logfile)
1453{
1454 NTSTATUS ret;
1455 struct unixid allid;
1456 struct id_map *maps;
1457 int num_maps;
1458 FILE *dump;
1459 int i;
1460
1461 if (! NT_STATUS_IS_OK(ret = idmap_init())) {
1462 return;
1463 }
1464
1465 dump = fopen(logfile, "w");
1466 if ( ! dump) {
1467 DEBUG(0, ("Unable to open open stream for file [%s], "
1468 "errno: %d\n", logfile, errno));
1469 return;
1470 }
1471
1472 if (NT_STATUS_IS_OK(ret = idmap_alloc_init())) {
1473 allid.type = ID_TYPE_UID;
1474 allid.id = 0;
1475 idmap_alloc_ctx->methods->get_id_hwm(&allid);
1476 fprintf(dump, "USER HWM %lu\n", (unsigned long)allid.id);
1477
1478 allid.type = ID_TYPE_GID;
1479 allid.id = 0;
1480 idmap_alloc_ctx->methods->get_id_hwm(&allid);
1481 fprintf(dump, "GROUP HWM %lu\n", (unsigned long)allid.id);
1482 }
1483
1484 maps = talloc(idmap_ctx, struct id_map);
1485 num_maps = 0;
1486
1487 for (i = 0; i < num_domains; i++) {
1488 if (idmap_domains[i]->methods->dump_data) {
1489 idmap_domains[i]->methods->dump_data(idmap_domains[i],
1490 &maps, &num_maps);
1491 }
1492 }
1493
1494 for (i = 0; i < num_maps; i++) {
1495 switch (maps[i].xid.type) {
1496 case ID_TYPE_UID:
1497 fprintf(dump, "UID %lu %s\n",
1498 (unsigned long)maps[i].xid.id,
1499 sid_string_static(maps[i].sid));
1500 break;
1501 case ID_TYPE_GID:
1502 fprintf(dump, "GID %lu %s\n",
1503 (unsigned long)maps[i].xid.id,
1504 sid_string_static(maps[i].sid));
1505 break;
1506 case ID_TYPE_NOT_SPECIFIED:
1507 break;
1508 }
1509 }
1510
1511 fflush(dump);
1512 fclose(dump);
1513}
1514
1515char *idmap_fetch_secret(const char *backend, bool alloc,
1516 const char *domain, const char *identity)
1517{
1518 char *tmp, *ret;
1519 int r;
1520
1521 if (alloc) {
1522 r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
1523 } else {
1524 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
1525 }
1526
1527 if (r < 0)
1528 return NULL;
1529
1530 strupper_m(tmp); /* make sure the key is case insensitive */
1531 ret = secrets_fetch_generic(tmp, identity);
1532
1533 SAFE_FREE(tmp);
1534
1535 return ret;
1536}
1537
Note: See TracBrowser for help on using the repository browser.