Context Navigation

source: trunk-3.0/source/nsswitch/idmap_ad.c@ 103

Visit:

Last change on this file since 103 was 71, checked in by Paul Smedley, 18 years ago
Update source to 3.0.26a
File size: 22.4 KB

Line
1	/*
2	* idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
3	*
4	* Unix SMB/CIFS implementation.
5	*
6	* Winbind ADS backend functions
7	*
8	* Copyright (C) Andrew Tridgell 2001
9	* Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
10	* Copyright (C) Gerald (Jerry) Carter 2004-2007
11	* Copyright (C) Luke Howard 2001-2004
12	*
13	* This program is free software; you can redistribute it and/or modify
14	* it under the terms of the GNU General Public License as published by
15	* the Free Software Foundation; either version 2 of the License, or
16	* (at your option) any later version.
17	*
18	* This program is distributed in the hope that it will be useful,
19	* but WITHOUT ANY WARRANTY; without even the implied warranty of
20	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21	* GNU General Public License for more details.
22	*
23	* You should have received a copy of the GNU General Public License
24	* along with this program; if not, write to the Free Software
25	* Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26	*/
27
28	#include "includes.h"
29
30	#undef DBGC_CLASS
31	#define DBGC_CLASS DBGC_IDMAP
32
33	#define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
34
35	#define IDMAP_AD_MAX_IDS 30
36	#define CHECK_ALLOC_DONE(mem) do { \
37	if (!mem) { \
38	DEBUG(0, ("Out of memory!\n")); \
39	ret = NT_STATUS_NO_MEMORY; \
40	goto done; \
41	} \
42	} while (0)
43
44	struct idmap_ad_context {
45	uint32_t filter_low_id;
46	uint32_t filter_high_id;
47	};
48
49	NTSTATUS init_module(void);
50
51	static ADS_STRUCT *ad_idmap_ads = NULL;
52	static struct posix_schema *ad_schema = NULL;
53	static enum wb_posix_mapping ad_map_type = WB_POSIX_MAP_UNKNOWN;
54
55	/************************************************************************
56	***********************************************************************/
57
58	static ADS_STRUCT *ad_idmap_cached_connection_internal(void)
59	{
60	ADS_STRUCT *ads;
61	ADS_STATUS status;
62	BOOL local = False;
63	fstring dc_name;
64	struct in_addr dc_ip;
65
66	if (ad_idmap_ads != NULL) {
67
68	time_t expire;
69	time_t now = time(NULL);
70
71	ads = ad_idmap_ads;
72
73	expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
74
75	/* check for a valid structure */
76	DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
77	(uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
78
79	if ( ads->config.realm && (expire > time(NULL))) {
80	return ads;
81	} else {
82	/* we own this ADS_STRUCT so make sure it goes away */
83	DEBUG(7,("Deleting expired krb5 credential cache\n"));
84	ads->is_mine = True;
85	ads_destroy( &ads );
86	ads_kdestroy(WINBIND_CCACHE_NAME);
87	ad_idmap_ads = NULL;
88	TALLOC_FREE( ad_schema );
89	}
90	}
91
92	if (!local) {
93	/* we don't want this to affect the users ccache */
94	setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
95	}
96
97	if ( (ads = ads_init(lp_realm(), lp_workgroup(), NULL)) == NULL ) {
98	DEBUG(1,("ads_init failed\n"));
99	return NULL;
100	}
101
102	/* the machine acct password might have change - fetch it every time */
103	SAFE_FREE(ads->auth.password);
104	ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
105
106	SAFE_FREE(ads->auth.realm);
107	ads->auth.realm = SMB_STRDUP(lp_realm());
108
109	/* setup server affinity */
110
111	get_dc_name( NULL, ads->auth.realm, dc_name, &dc_ip );
112
113	status = ads_connect(ads);
114	if (!ADS_ERR_OK(status)) {
115	DEBUG(1, ("ad_idmap_init: failed to connect to AD\n"));
116	ads_destroy(&ads);
117	return NULL;
118	}
119
120	ads->is_mine = False;
121
122	ad_idmap_ads = ads;
123
124	return ads;
125	}
126
127	/************************************************************************
128	***********************************************************************/
129
130	static ADS_STRUCT *ad_idmap_cached_connection(void)
131	{
132	ADS_STRUCT *ads = ad_idmap_cached_connection_internal();
133
134	if ( !ads )
135	return NULL;
136
137	/* if we have a valid ADS_STRUCT and the schema model is
138	defined, then we can return here. */
139
140	if ( ad_schema )
141	return ads;
142
143	/* Otherwise, set the schema model */
144
145	if ( (ad_map_type == WB_POSIX_MAP_SFU) \|\|
146	(ad_map_type == WB_POSIX_MAP_RFC2307) )
147	{
148	ADS_STATUS schema_status;
149
150	schema_status = ads_check_posix_schema_mapping( NULL, ads, ad_map_type, &ad_schema);
151	if ( !ADS_ERR_OK(schema_status) ) {
152	DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
153	return NULL;
154	}
155	}
156
157	return ads;
158	}
159
160	/************************************************************************
161	***********************************************************************/
162
163	static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
164	{
165	struct idmap_ad_context *ctx;
166	char *config_option;
167	const char *range = NULL;
168	const char *schema_mode = NULL;
169
170	if ( (ctx = TALLOC_ZERO_P(dom, struct idmap_ad_context)) == NULL ) {
171	DEBUG(0, ("Out of memory!\n"));
172	return NT_STATUS_NO_MEMORY;
173	}
174
175	if ( (config_option = talloc_asprintf(ctx, "idmap config %s", dom->name)) == NULL ) {
176	DEBUG(0, ("Out of memory!\n"));
177	talloc_free(ctx);
178	return NT_STATUS_NO_MEMORY;
179	}
180
181	/* load ranges */
182	range = lp_parm_const_string(-1, config_option, "range", NULL);
183	if (range && range[0]) {
184	if ((sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) \|\|
185	(ctx->filter_low_id > ctx->filter_high_id)) {
186	DEBUG(1, ("ERROR: invalid filter range [%s]", range));
187	ctx->filter_low_id = 0;
188	ctx->filter_high_id = 0;
189	}
190	}
191
192	/* schema mode */
193	if ( ad_map_type == WB_POSIX_MAP_UNKNOWN )
194	ad_map_type = WB_POSIX_MAP_RFC2307;
195	schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
196	if ( schema_mode && schema_mode[0] ) {
197	if ( strequal(schema_mode, "sfu") )
198	ad_map_type = WB_POSIX_MAP_SFU;
199	else if ( strequal(schema_mode, "rfc2307" ) )
200	ad_map_type = WB_POSIX_MAP_RFC2307;
201	else
202	DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
203	schema_mode));
204	}
205
206	dom->private_data = ctx;
207	dom->initialized = True;
208
209	talloc_free(config_option);
210
211	return NT_STATUS_OK;
212	}
213
214	/************************************************************************
215	Search up to IDMAP_AD_MAX_IDS entries in maps for a match.
216	***********************************************************************/
217
218	static struct id_map find_map_by_id(struct id_map *maps, enum id_type type, uint32_t id)
219	{
220	int i;
221
222	for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
223	if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
224	return maps[i];
225	}
226	}
227
228	return NULL;
229	}
230
231	/************************************************************************
232	Search up to IDMAP_AD_MAX_IDS entries in maps for a match
233	***********************************************************************/
234
235	static struct id_map find_map_by_sid(struct id_map maps, DOM_SID sid)
236	{
237	int i;
238
239	for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
240	if (sid_equal(maps[i]->sid, sid)) {
241	return maps[i];
242	}
243	}
244
245	return NULL;
246	}
247
248	/************************************************************************
249	***********************************************************************/
250
251	static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain dom, struct id_map *ids)
252	{
253	NTSTATUS ret;
254	TALLOC_CTX *memctx;
255	struct idmap_ad_context *ctx;
256	ADS_STATUS rc;
257	ADS_STRUCT *ads;
258	const char *attrs[] = { "sAMAccountType",
259	"objectSid",
260	NULL, /* uidnumber */
261	NULL, /* gidnumber */
262	NULL };
263	LDAPMessage *res = NULL;
264	LDAPMessage *entry = NULL;
265	char *filter = NULL;
266	int idx = 0;
267	int bidx = 0;
268	int count;
269	int i;
270	char *u_filter = NULL;
271	char *g_filter = NULL;
272
273	/* Only do query if we are online */
274	if (idmap_is_offline()) {
275	return NT_STATUS_FILE_IS_OFFLINE;
276	}
277
278	/* Initilization my have been deferred because we were offline */
279	if ( ! dom->initialized) {
280	ret = idmap_ad_initialize(dom);
281	if ( ! NT_STATUS_IS_OK(ret)) {
282	return ret;
283	}
284	}
285
286	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
287
288	if ( (memctx = talloc_new(ctx)) == NULL ) {
289	DEBUG(0, ("Out of memory!\n"));
290	return NT_STATUS_NO_MEMORY;
291	}
292
293	if ( (ads = ad_idmap_cached_connection()) == NULL ) {
294	DEBUG(1, ("ADS uninitialized\n"));
295	ret = NT_STATUS_UNSUCCESSFUL;
296	goto done;
297	}
298
299	attrs[2] = ad_schema->posix_uidnumber_attr;
300	attrs[3] = ad_schema->posix_gidnumber_attr;
301
302	again:
303	bidx = idx;
304	for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
305	switch (ids[idx]->xid.type) {
306	case ID_TYPE_UID:
307	if ( ! u_filter) {
308	u_filter = talloc_asprintf(memctx, "(&(\|"
309	"(sAMAccountType=%d)"
310	"(sAMAccountType=%d)"
311	"(sAMAccountType=%d))(\|",
312	ATYPE_NORMAL_ACCOUNT,
313	ATYPE_WORKSTATION_TRUST,
314	ATYPE_INTERDOMAIN_TRUST);
315	}
316	u_filter = talloc_asprintf_append(u_filter, "(%s=%lu)",
317	ad_schema->posix_uidnumber_attr,
318	(unsigned long)ids[idx]->xid.id);
319	CHECK_ALLOC_DONE(u_filter);
320	break;
321
322	case ID_TYPE_GID:
323	if ( ! g_filter) {
324	g_filter = talloc_asprintf(memctx, "(&(\|"
325	"(sAMAccountType=%d)"
326	"(sAMAccountType=%d))(\|",
327	ATYPE_SECURITY_GLOBAL_GROUP,
328	ATYPE_SECURITY_LOCAL_GROUP);
329	}
330	g_filter = talloc_asprintf_append(g_filter, "(%s=%lu)",
331	ad_schema->posix_gidnumber_attr,
332	(unsigned long)ids[idx]->xid.id);
333	CHECK_ALLOC_DONE(g_filter);
334	break;
335
336	default:
337	DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
338	ids[idx]->status = ID_UNKNOWN;
339	continue;
340	}
341	}
342	filter = talloc_asprintf(memctx, "(\|");
343	CHECK_ALLOC_DONE(filter);
344	if ( u_filter) {
345	filter = talloc_asprintf_append(filter, "%s))", u_filter);
346	CHECK_ALLOC_DONE(filter);
347	TALLOC_FREE(u_filter);
348	}
349	if ( g_filter) {
350	filter = talloc_asprintf_append(filter, "%s))", g_filter);
351	CHECK_ALLOC_DONE(filter);
352	TALLOC_FREE(g_filter);
353	}
354	filter = talloc_asprintf_append(filter, ")");
355	CHECK_ALLOC_DONE(filter);
356
357	rc = ads_search_retry(ads, &res, filter, attrs);
358	if (!ADS_ERR_OK(rc)) {
359	DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
360	ret = NT_STATUS_UNSUCCESSFUL;
361	goto done;
362	}
363
364	if ( (count = ads_count_replies(ads, res)) == 0 ) {
365	DEBUG(10, ("No IDs found\n"));
366	}
367
368	entry = res;
369	for (i = 0; (i < count) && entry; i++) {
370	DOM_SID sid;
371	enum id_type type;
372	struct id_map *map;
373	uint32_t id;
374	uint32_t atype;
375
376	if (i == 0) { /* first entry */
377	entry = ads_first_entry(ads, entry);
378	} else { /* following ones */
379	entry = ads_next_entry(ads, entry);
380	}
381
382	if ( !entry ) {
383	DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
384	break;
385	}
386
387	/* first check if the SID is present */
388	if (!ads_pull_sid(ads, entry, "objectSid", &sid)) {
389	DEBUG(2, ("Could not retrieve SID from entry\n"));
390	continue;
391	}
392
393	/* get type */
394	if (!ads_pull_uint32(ads, entry, "sAMAccountType", &atype)) {
395	DEBUG(1, ("could not get SAM account type\n"));
396	continue;
397	}
398
399	switch (atype & 0xF0000000) {
400	case ATYPE_SECURITY_GLOBAL_GROUP:
401	case ATYPE_SECURITY_LOCAL_GROUP:
402	type = ID_TYPE_GID;
403	break;
404	case ATYPE_NORMAL_ACCOUNT:
405	case ATYPE_WORKSTATION_TRUST:
406	case ATYPE_INTERDOMAIN_TRUST:
407	type = ID_TYPE_UID;
408	break;
409	default:
410	DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
411	continue;
412	}
413
414	if (!ads_pull_uint32(ads, entry, (type==ID_TYPE_UID) ?
415	ad_schema->posix_uidnumber_attr :
416	ad_schema->posix_gidnumber_attr,
417	&id))
418	{
419	DEBUG(1, ("Could not get unix ID\n"));
420	continue;
421	}
422
423	if ((id == 0) \|\|
424	(ctx->filter_low_id && (id < ctx->filter_low_id)) \|\|
425	(ctx->filter_high_id && (id > ctx->filter_high_id))) {
426	DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
427	id, ctx->filter_low_id, ctx->filter_high_id));
428	continue;
429	}
430
431	map = find_map_by_id(&ids[bidx], type, id);
432	if (!map) {
433	DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
434	continue;
435	}
436
437	sid_copy(map->sid, &sid);
438
439	/* mapped */
440	map->status = ID_MAPPED;
441
442	DEBUG(10, ("Mapped %s -> %lu (%d)\n",
443	sid_string_static(map->sid),
444	(unsigned long)map->xid.id,
445	map->xid.type));
446	}
447
448	if (res) {
449	ads_msgfree(ads, res);
450	}
451
452	if (ids[idx]) { /* still some values to map */
453	goto again;
454	}
455
456	ret = NT_STATUS_OK;
457
458	/* mark all unknown/expired ones as unmapped */
459	for (i = 0; ids[i]; i++) {
460	if (ids[i]->status != ID_MAPPED)
461	ids[i]->status = ID_UNMAPPED;
462	}
463
464	done:
465	talloc_free(memctx);
466	return ret;
467	}
468
469	/************************************************************************
470	***********************************************************************/
471
472	static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain dom, struct id_map *ids)
473	{
474	NTSTATUS ret;
475	TALLOC_CTX *memctx;
476	struct idmap_ad_context *ctx;
477	ADS_STATUS rc;
478	ADS_STRUCT *ads;
479	const char *attrs[] = { "sAMAccountType",
480	"objectSid",
481	NULL, /* attr_uidnumber */
482	NULL, /* attr_gidnumber */
483	NULL };
484	LDAPMessage *res = NULL;
485	LDAPMessage *entry = NULL;
486	char *filter = NULL;
487	int idx = 0;
488	int bidx = 0;
489	int count;
490	int i;
491	char *sidstr;
492
493	/* Only do query if we are online */
494	if (idmap_is_offline()) {
495	return NT_STATUS_FILE_IS_OFFLINE;
496	}
497
498	/* Initilization my have been deferred because we were offline */
499	if ( ! dom->initialized) {
500	ret = idmap_ad_initialize(dom);
501	if ( ! NT_STATUS_IS_OK(ret)) {
502	return ret;
503	}
504	}
505
506	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
507
508	if ( (memctx = talloc_new(ctx)) == NULL ) {
509	DEBUG(0, ("Out of memory!\n"));
510	return NT_STATUS_NO_MEMORY;
511	}
512
513	if ( (ads = ad_idmap_cached_connection()) == NULL ) {
514	DEBUG(1, ("ADS uninitialized\n"));
515	ret = NT_STATUS_UNSUCCESSFUL;
516	goto done;
517	}
518
519	attrs[2] = ad_schema->posix_uidnumber_attr;
520	attrs[3] = ad_schema->posix_gidnumber_attr;
521
522	again:
523	filter = talloc_asprintf(memctx, "(&(\|"
524	"(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
525	"(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
526	")(\|",
527	ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
528	ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
529
530	CHECK_ALLOC_DONE(filter);
531
532	bidx = idx;
533	for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
534
535	sidstr = sid_binstring(ids[idx]->sid);
536	filter = talloc_asprintf_append(filter, "(objectSid=%s)", sidstr);
537
538	free(sidstr);
539	CHECK_ALLOC_DONE(filter);
540	}
541	filter = talloc_asprintf_append(filter, "))");
542	CHECK_ALLOC_DONE(filter);
543	DEBUG(10, ("Filter: [%s]\n", filter));
544
545	rc = ads_search_retry(ads, &res, filter, attrs);
546	if (!ADS_ERR_OK(rc)) {
547	DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
548	ret = NT_STATUS_UNSUCCESSFUL;
549	goto done;
550	}
551
552	if ( (count = ads_count_replies(ads, res)) == 0 ) {
553	DEBUG(10, ("No IDs found\n"));
554	}
555
556	entry = res;
557	for (i = 0; (i < count) && entry; i++) {
558	DOM_SID sid;
559	enum id_type type;
560	struct id_map *map;
561	uint32_t id;
562	uint32_t atype;
563
564	if (i == 0) { /* first entry */
565	entry = ads_first_entry(ads, entry);
566	} else { /* following ones */
567	entry = ads_next_entry(ads, entry);
568	}
569
570	if ( !entry ) {
571	DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
572	break;
573	}
574
575	/* first check if the SID is present */
576	if (!ads_pull_sid(ads, entry, "objectSid", &sid)) {
577	DEBUG(2, ("Could not retrieve SID from entry\n"));
578	continue;
579	}
580
581	map = find_map_by_sid(&ids[bidx], &sid);
582	if (!map) {
583	DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
584	continue;
585	}
586
587	/* get type */
588	if (!ads_pull_uint32(ads, entry, "sAMAccountType", &atype)) {
589	DEBUG(1, ("could not get SAM account type\n"));
590	continue;
591	}
592
593	switch (atype & 0xF0000000) {
594	case ATYPE_SECURITY_GLOBAL_GROUP:
595	case ATYPE_SECURITY_LOCAL_GROUP:
596	type = ID_TYPE_GID;
597	break;
598	case ATYPE_NORMAL_ACCOUNT:
599	case ATYPE_WORKSTATION_TRUST:
600	case ATYPE_INTERDOMAIN_TRUST:
601	type = ID_TYPE_UID;
602	break;
603	default:
604	DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
605	continue;
606	}
607
608	if (!ads_pull_uint32(ads, entry, (type==ID_TYPE_UID) ?
609	ad_schema->posix_uidnumber_attr :
610	ad_schema->posix_gidnumber_attr,
611	&id))
612	{
613	DEBUG(1, ("Could not get unix ID\n"));
614	continue;
615	}
616	if ((id == 0) \|\|
617	(ctx->filter_low_id && (id < ctx->filter_low_id)) \|\|
618	(ctx->filter_high_id && (id > ctx->filter_high_id))) {
619	DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
620	id, ctx->filter_low_id, ctx->filter_high_id));
621	continue;
622	}
623
624	/* mapped */
625	map->xid.type = type;
626	map->xid.id = id;
627	map->status = ID_MAPPED;
628
629	DEBUG(10, ("Mapped %s -> %lu (%d)\n",
630	sid_string_static(map->sid),
631	(unsigned long)map->xid.id,
632	map->xid.type));
633	}
634
635	if (res) {
636	ads_msgfree(ads, res);
637	}
638
639	if (ids[idx]) { /* still some values to map */
640	goto again;
641	}
642
643	ret = NT_STATUS_OK;
644
645	/* mark all unknwoni/expired ones as unmapped */
646	for (i = 0; ids[i]; i++) {
647	if (ids[i]->status != ID_MAPPED)
648	ids[i]->status = ID_UNMAPPED;
649	}
650
651	done:
652	talloc_free(memctx);
653	return ret;
654	}
655
656	/************************************************************************
657	***********************************************************************/
658
659	static NTSTATUS idmap_ad_close(struct idmap_domain *dom)
660	{
661	ADS_STRUCT *ads = ad_idmap_ads;
662
663	if (ads != NULL) {
664	/* we own this ADS_STRUCT so make sure it goes away */
665	ads->is_mine = True;
666	ads_destroy( &ads );
667	ad_idmap_ads = NULL;
668	}
669
670	TALLOC_FREE( ad_schema );
671
672	return NT_STATUS_OK;
673	}
674
675	/*
676	* nss_info_{sfu,rfc2307}
677	*/
678
679	/************************************************************************
680	Initialize the {sfu,rfc2307} state
681	***********************************************************************/
682
683	static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
684	{
685	/* Sanity check if we have previously been called with a
686	different schema model */
687
688	if ( (ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
689	(ad_map_type != WB_POSIX_MAP_SFU) )
690	{
691	DEBUG(0,("nss_sfu_init: Posix Map type has already been set. "
692	"Mixed schema models not supported!\n"));
693	return NT_STATUS_NOT_SUPPORTED;
694	}
695
696	ad_map_type = WB_POSIX_MAP_SFU;
697
698	return NT_STATUS_OK;
699	}
700
701	static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
702	{
703	/* Sanity check if we have previously been called with a
704	different schema model */
705
706	if ( (ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
707	(ad_map_type != WB_POSIX_MAP_RFC2307) )
708	{
709	DEBUG(0,("nss_rfc2307_init: Posix Map type has already been set. "
710	"Mixed schema models not supported!\n"));
711	return NT_STATUS_NOT_SUPPORTED;
712	}
713
714	ad_map_type = WB_POSIX_MAP_RFC2307;
715
716	return NT_STATUS_OK;
717	}
718
719
720	/************************************************************************
721	***********************************************************************/
722	static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
723	const DOM_SID *sid,
724	TALLOC_CTX *ctx,
725	ADS_STRUCT *ads,
726	LDAPMessage *msg,
727	char **homedir,
728	char **shell,
729	char **gecos,
730	uint32 *gid )
731	{
732	ADS_STRUCT *ads_internal = NULL;
733
734	/* Only do query if we are online */
735	if (idmap_is_offline()) {
736	return NT_STATUS_FILE_IS_OFFLINE;
737	}
738
739	/* We are assuming that the internal ADS_STRUCT is for the
740	same forest as the incoming ads pointer /
741
742	ads_internal = ad_idmap_cached_connection();
743
744	if ( !ads_internal \|\| !ad_schema )
745	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
746
747	if ( !homedir \|\| !shell \|\| !gecos )
748	return NT_STATUS_INVALID_PARAMETER;
749
750	*homedir = ads_pull_string( ads, ctx, msg, ad_schema->posix_homedir_attr );
751	*shell = ads_pull_string( ads, ctx, msg, ad_schema->posix_shell_attr );
752	*gecos = ads_pull_string( ads, ctx, msg, ad_schema->posix_gecos_attr );
753
754	if ( gid ) {
755	if ( !ads_pull_uint32(ads, msg, ad_schema->posix_gidnumber_attr, gid ) )
756	*gid = (uint32)-1;
757	}
758
759	return NT_STATUS_OK;
760	}
761
762	/************************************************************************
763	***********************************************************************/
764
765	static NTSTATUS nss_ad_close( void )
766	{
767	/* nothing to do. All memory is free()'d by the idmap close_fn() */
768
769	return NT_STATUS_OK;
770	}
771
772	/************************************************************************
773	Function dispatch tables for the idmap and nss plugins
774	***********************************************************************/
775
776	static struct idmap_methods ad_methods = {
777	.init = idmap_ad_initialize,
778	.unixids_to_sids = idmap_ad_unixids_to_sids,
779	.sids_to_unixids = idmap_ad_sids_to_unixids,
780	.close_fn = idmap_ad_close
781	};
782
783	/* The SFU and RFC2307 NSS plugins share everything but the init
784	function which sets the intended schema model to use */
785
786	static struct nss_info_methods nss_rfc2307_methods = {
787	.init = nss_rfc2307_init,
788	.get_nss_info = nss_ad_get_info,
789	.close_fn = nss_ad_close
790	};
791
792	static struct nss_info_methods nss_sfu_methods = {
793	.init = nss_sfu_init,
794	.get_nss_info = nss_ad_get_info,
795	.close_fn = nss_ad_close
796	};
797
798
799	/************************************************************************
800	Initialize the plugins
801	***********************************************************************/
802
803	NTSTATUS idmap_ad_init(void)
804	{
805	static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
806	static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
807	static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
808
809	/* Always register the AD method first in order to get the
810	idmap_domain interface called */
811
812	if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
813	status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
814	"ad", &ad_methods);
815	if ( !NT_STATUS_IS_OK(status_idmap_ad) )
816	return status_idmap_ad;
817	}
818
819	if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
820	status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
821	"rfc2307", &nss_rfc2307_methods );
822	if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
823	return status_nss_rfc2307;
824	}
825
826	if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
827	status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
828	"sfu", &nss_sfu_methods );
829	if ( !NT_STATUS_IS_OK(status_nss_sfu) )
830	return status_nss_sfu;
831	}
832
833	return NT_STATUS_OK;
834	}
835

Note: See TracBrowser for help on using the repository browser.

Download in other formats: