source: trunk/server/source3/winbindd/idmap_ldap.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 28.3 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3
4 idmap LDAP backend
5
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
8 Copyright (C) Gerald Carter 2003
9 Copyright (C) Simo Sorce 2003-2007
10 Copyright (C) Michael Adam 2010
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24*/
25
26#include "includes.h"
27#include "winbindd.h"
28#include "secrets.h"
29#include "idmap.h"
30#include "idmap_rw.h"
31#include "../libcli/security/security.h"
32
33#undef DBGC_CLASS
34#define DBGC_CLASS DBGC_IDMAP
35
36#include <lber.h>
37#include <ldap.h>
38
39#include "smbldap.h"
40
41static char *idmap_fetch_secret(const char *backend,
42 const char *domain, const char *identity)
43{
44 char *tmp, *ret;
45 int r;
46
47 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
48
49 if (r < 0)
50 return NULL;
51
52 strupper_m(tmp); /* make sure the key is case insensitive */
53 ret = secrets_fetch_generic(tmp, identity);
54
55 SAFE_FREE(tmp);
56
57 return ret;
58}
59
60struct idmap_ldap_context {
61 struct smbldap_state *smbldap_state;
62 char *url;
63 char *suffix;
64 char *user_dn;
65 bool anon;
66 struct idmap_rw_ops *rw_ops;
67};
68
69#define CHECK_ALLOC_DONE(mem) do { \
70 if (!mem) { \
71 DEBUG(0, ("Out of memory!\n")); \
72 ret = NT_STATUS_NO_MEMORY; \
73 goto done; \
74 } } while (0)
75
76/**********************************************************************
77 IDMAP ALLOC TDB BACKEND
78**********************************************************************/
79
80/*********************************************************************
81 ********************************************************************/
82
83static NTSTATUS get_credentials( TALLOC_CTX *mem_ctx,
84 struct smbldap_state *ldap_state,
85 const char *config_option,
86 struct idmap_domain *dom,
87 char **dn )
88{
89 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
90 char *secret = NULL;
91 const char *tmp = NULL;
92 char *user_dn = NULL;
93 bool anon = False;
94
95 /* assume anonymous if we don't have a specified user */
96
97 tmp = lp_parm_const_string(-1, config_option, "ldap_user_dn", NULL);
98
99 if ( tmp ) {
100 if (!dom) {
101 DEBUG(0, ("get_credentials: Invalid domain 'NULL' "
102 "encountered for user DN %s\n",
103 tmp));
104 ret = NT_STATUS_UNSUCCESSFUL;
105 goto done;
106 } else {
107 secret = idmap_fetch_secret("ldap", dom->name, tmp);
108 }
109
110 if (!secret) {
111 DEBUG(0, ("get_credentials: Unable to fetch "
112 "auth credentials for %s in %s\n",
113 tmp, (dom==NULL)?"ALLOC":dom->name));
114 ret = NT_STATUS_ACCESS_DENIED;
115 goto done;
116 }
117 *dn = talloc_strdup(mem_ctx, tmp);
118 CHECK_ALLOC_DONE(*dn);
119 } else {
120 if (!fetch_ldap_pw(&user_dn, &secret)) {
121 DEBUG(2, ("get_credentials: Failed to lookup ldap "
122 "bind creds. Using anonymous connection.\n"));
123 anon = True;
124 *dn = NULL;
125 } else {
126 *dn = talloc_strdup(mem_ctx, user_dn);
127 SAFE_FREE( user_dn );
128 CHECK_ALLOC_DONE(*dn);
129 }
130 }
131
132 smbldap_set_creds(ldap_state, anon, *dn, secret);
133 ret = NT_STATUS_OK;
134
135done:
136 SAFE_FREE(secret);
137
138 return ret;
139}
140
141
142/**********************************************************************
143 Verify the sambaUnixIdPool entry in the directory.
144**********************************************************************/
145
146static NTSTATUS verify_idpool(struct idmap_domain *dom)
147{
148 NTSTATUS ret;
149 TALLOC_CTX *mem_ctx;
150 LDAPMessage *result = NULL;
151 LDAPMod **mods = NULL;
152 const char **attr_list;
153 char *filter;
154 int count;
155 int rc;
156 struct idmap_ldap_context *ctx;
157
158 ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
159
160 mem_ctx = talloc_new(ctx);
161 if (mem_ctx == NULL) {
162 DEBUG(0, ("Out of memory!\n"));
163 return NT_STATUS_NO_MEMORY;
164 }
165
166 filter = talloc_asprintf(mem_ctx, "(objectclass=%s)", LDAP_OBJ_IDPOOL);
167 CHECK_ALLOC_DONE(filter);
168
169 attr_list = get_attr_list(mem_ctx, idpool_attr_list);
170 CHECK_ALLOC_DONE(attr_list);
171
172 rc = smbldap_search(ctx->smbldap_state,
173 ctx->suffix,
174 LDAP_SCOPE_SUBTREE,
175 filter,
176 attr_list,
177 0,
178 &result);
179
180 if (rc != LDAP_SUCCESS) {
181 DEBUG(1, ("Unable to verify the idpool, "
182 "cannot continue initialization!\n"));
183 return NT_STATUS_UNSUCCESSFUL;
184 }
185
186 count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
187
188 ldap_msgfree(result);
189
190 if ( count > 1 ) {
191 DEBUG(0,("Multiple entries returned from %s (base == %s)\n",
192 filter, ctx->suffix));
193 ret = NT_STATUS_UNSUCCESSFUL;
194 goto done;
195 }
196 else if (count == 0) {
197 char *uid_str, *gid_str;
198
199 uid_str = talloc_asprintf(mem_ctx, "%lu",
200 (unsigned long)dom->low_id);
201 gid_str = talloc_asprintf(mem_ctx, "%lu",
202 (unsigned long)dom->low_id);
203
204 smbldap_set_mod(&mods, LDAP_MOD_ADD,
205 "objectClass", LDAP_OBJ_IDPOOL);
206 smbldap_set_mod(&mods, LDAP_MOD_ADD,
207 get_attr_key2string(idpool_attr_list,
208 LDAP_ATTR_UIDNUMBER),
209 uid_str);
210 smbldap_set_mod(&mods, LDAP_MOD_ADD,
211 get_attr_key2string(idpool_attr_list,
212 LDAP_ATTR_GIDNUMBER),
213 gid_str);
214 if (mods) {
215 rc = smbldap_modify(ctx->smbldap_state,
216 ctx->suffix,
217 mods);
218 ldap_mods_free(mods, True);
219 } else {
220 ret = NT_STATUS_UNSUCCESSFUL;
221 goto done;
222 }
223 }
224
225 ret = (rc == LDAP_SUCCESS)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
226done:
227 talloc_free(mem_ctx);
228 return ret;
229}
230
231/********************************
232 Allocate a new uid or gid
233********************************/
234
235static NTSTATUS idmap_ldap_allocate_id_internal(struct idmap_domain *dom,
236 struct unixid *xid)
237{
238 TALLOC_CTX *mem_ctx;
239 NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
240 int rc = LDAP_SERVER_DOWN;
241 int count = 0;
242 LDAPMessage *result = NULL;
243 LDAPMessage *entry = NULL;
244 LDAPMod **mods = NULL;
245 char *id_str;
246 char *new_id_str;
247 char *filter = NULL;
248 const char *dn = NULL;
249 const char **attr_list;
250 const char *type;
251 struct idmap_ldap_context *ctx;
252
253 /* Only do query if we are online */
254 if (idmap_is_offline()) {
255 return NT_STATUS_FILE_IS_OFFLINE;
256 }
257
258 ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
259
260 mem_ctx = talloc_new(ctx);
261 if (!mem_ctx) {
262 DEBUG(0, ("Out of memory!\n"));
263 return NT_STATUS_NO_MEMORY;
264 }
265
266 /* get type */
267 switch (xid->type) {
268
269 case ID_TYPE_UID:
270 type = get_attr_key2string(idpool_attr_list,
271 LDAP_ATTR_UIDNUMBER);
272 break;
273
274 case ID_TYPE_GID:
275 type = get_attr_key2string(idpool_attr_list,
276 LDAP_ATTR_GIDNUMBER);
277 break;
278
279 default:
280 DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
281 return NT_STATUS_INVALID_PARAMETER;
282 }
283
284 filter = talloc_asprintf(mem_ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
285 CHECK_ALLOC_DONE(filter);
286
287 attr_list = get_attr_list(mem_ctx, idpool_attr_list);
288 CHECK_ALLOC_DONE(attr_list);
289
290 DEBUG(10, ("Search of the id pool (filter: %s)\n", filter));
291
292 rc = smbldap_search(ctx->smbldap_state,
293 ctx->suffix,
294 LDAP_SCOPE_SUBTREE, filter,
295 attr_list, 0, &result);
296
297 if (rc != LDAP_SUCCESS) {
298 DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
299 goto done;
300 }
301
302 talloc_autofree_ldapmsg(mem_ctx, result);
303
304 count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
305 if (count != 1) {
306 DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
307 goto done;
308 }
309
310 entry = ldap_first_entry(ctx->smbldap_state->ldap_struct, result);
311
312 dn = smbldap_talloc_dn(mem_ctx,
313 ctx->smbldap_state->ldap_struct,
314 entry);
315 if ( ! dn) {
316 goto done;
317 }
318
319 id_str = smbldap_talloc_single_attribute(
320 ctx->smbldap_state->ldap_struct,
321 entry, type, mem_ctx);
322 if (id_str == NULL) {
323 DEBUG(0,("%s attribute not found\n", type));
324 ret = NT_STATUS_UNSUCCESSFUL;
325 goto done;
326 }
327
328 xid->id = strtoul(id_str, NULL, 10);
329
330 /* make sure we still have room to grow */
331
332 switch (xid->type) {
333 case ID_TYPE_UID:
334 if (xid->id > dom->high_id) {
335 DEBUG(0,("Cannot allocate uid above %lu!\n",
336 (unsigned long)dom->high_id));
337 goto done;
338 }
339 break;
340
341 case ID_TYPE_GID:
342 if (xid->id > dom->high_id) {
343 DEBUG(0,("Cannot allocate gid above %lu!\n",
344 (unsigned long)dom->high_id));
345 goto done;
346 }
347 break;
348
349 default:
350 /* impossible */
351 goto done;
352 }
353
354 new_id_str = talloc_asprintf(mem_ctx, "%lu", (unsigned long)xid->id + 1);
355 if ( ! new_id_str) {
356 DEBUG(0,("Out of memory\n"));
357 ret = NT_STATUS_NO_MEMORY;
358 goto done;
359 }
360
361 smbldap_set_mod(&mods, LDAP_MOD_DELETE, type, id_str);
362 smbldap_set_mod(&mods, LDAP_MOD_ADD, type, new_id_str);
363
364 if (mods == NULL) {
365 DEBUG(0,("smbldap_set_mod() failed.\n"));
366 goto done;
367 }
368
369 DEBUG(10, ("Try to atomically increment the id (%s -> %s)\n",
370 id_str, new_id_str));
371
372 rc = smbldap_modify(ctx->smbldap_state, dn, mods);
373
374 ldap_mods_free(mods, True);
375
376 if (rc != LDAP_SUCCESS) {
377 DEBUG(1,("Failed to allocate new %s. "
378 "smbldap_modify() failed.\n", type));
379 goto done;
380 }
381
382 ret = NT_STATUS_OK;
383
384done:
385 talloc_free(mem_ctx);
386 return ret;
387}
388
389/**
390 * Allocate a new unix-ID.
391 * For now this is for the default idmap domain only.
392 * Should be extended later on.
393 */
394static NTSTATUS idmap_ldap_allocate_id(struct idmap_domain *dom,
395 struct unixid *id)
396{
397 NTSTATUS ret;
398
399 if (!strequal(dom->name, "*")) {
400 DEBUG(3, ("idmap_ldap_allocate_id: "
401 "Refusing allocation of a new unixid for domain'%s'. "
402 "This is only supported for the default "
403 "domain \"*\".\n",
404 dom->name));
405 return NT_STATUS_NOT_IMPLEMENTED;
406 }
407
408 ret = idmap_ldap_allocate_id_internal(dom, id);
409
410 return ret;
411}
412
413
414/**********************************************************************
415 IDMAP MAPPING LDAP BACKEND
416**********************************************************************/
417
418static int idmap_ldap_close_destructor(struct idmap_ldap_context *ctx)
419{
420 smbldap_free_struct(&ctx->smbldap_state);
421 DEBUG(5,("The connection to the LDAP server was closed\n"));
422 /* maybe free the results here --metze */
423
424 return 0;
425}
426
427/********************************
428 Initialise idmap database.
429********************************/
430
431static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
432 const struct id_map *map);
433
434static NTSTATUS idmap_ldap_db_init(struct idmap_domain *dom)
435{
436 NTSTATUS ret;
437 struct idmap_ldap_context *ctx = NULL;
438 char *config_option = NULL;
439 const char *tmp = NULL;
440
441 /* Only do init if we are online */
442 if (idmap_is_offline()) {
443 return NT_STATUS_FILE_IS_OFFLINE;
444 }
445
446 ctx = TALLOC_ZERO_P(dom, struct idmap_ldap_context);
447 if ( ! ctx) {
448 DEBUG(0, ("Out of memory!\n"));
449 return NT_STATUS_NO_MEMORY;
450 }
451
452 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
453 if (!config_option) {
454 DEBUG(0, ("Out of memory!\n"));
455 ret = NT_STATUS_NO_MEMORY;
456 goto done;
457 }
458
459 tmp = lp_parm_const_string(-1, config_option, "ldap_url", NULL);
460
461 if ( ! tmp) {
462 DEBUG(1, ("ERROR: missing idmap ldap url\n"));
463 ret = NT_STATUS_UNSUCCESSFUL;
464 goto done;
465 }
466
467 ctx->url = talloc_strdup(ctx, tmp);
468
469 trim_char(ctx->url, '\"', '\"');
470
471 tmp = lp_parm_const_string(-1, config_option, "ldap_base_dn", NULL);
472 if ( ! tmp || ! *tmp) {
473 tmp = lp_ldap_idmap_suffix();
474 if ( ! tmp) {
475 DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
476 ret = NT_STATUS_UNSUCCESSFUL;
477 goto done;
478 }
479 }
480
481 ctx->suffix = talloc_strdup(ctx, tmp);
482 CHECK_ALLOC_DONE(ctx->suffix);
483
484 ctx->rw_ops = talloc_zero(ctx, struct idmap_rw_ops);
485 CHECK_ALLOC_DONE(ctx->rw_ops);
486
487 ctx->rw_ops->get_new_id = idmap_ldap_allocate_id_internal;
488 ctx->rw_ops->set_mapping = idmap_ldap_set_mapping;
489
490 ret = smbldap_init(ctx, winbind_event_context(), ctx->url,
491 &ctx->smbldap_state);
492 if (!NT_STATUS_IS_OK(ret)) {
493 DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n", ctx->url));
494 goto done;
495 }
496
497 ret = get_credentials( ctx, ctx->smbldap_state, config_option,
498 dom, &ctx->user_dn );
499 if ( !NT_STATUS_IS_OK(ret) ) {
500 DEBUG(1,("idmap_ldap_db_init: Failed to get connection "
501 "credentials (%s)\n", nt_errstr(ret)));
502 goto done;
503 }
504
505 /*
506 * Set the destructor on the context, so that resources are
507 * properly freed when the context is released.
508 */
509 talloc_set_destructor(ctx, idmap_ldap_close_destructor);
510
511 dom->private_data = ctx;
512
513 ret = verify_idpool(dom);
514 if (!NT_STATUS_IS_OK(ret)) {
515 DEBUG(1, ("idmap_ldap_db_init: failed to verify ID pool (%s)\n",
516 nt_errstr(ret)));
517 goto done;
518 }
519
520 talloc_free(config_option);
521 return NT_STATUS_OK;
522
523/*failed */
524done:
525 talloc_free(ctx);
526 return ret;
527}
528
529/**
530 * set a mapping.
531 */
532
533/* TODO: change this: This function cannot be called to modify a mapping,
534 * only set a new one */
535
536static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
537 const struct id_map *map)
538{
539 NTSTATUS ret;
540 TALLOC_CTX *memctx;
541 struct idmap_ldap_context *ctx;
542 LDAPMessage *entry = NULL;
543 LDAPMod **mods = NULL;
544 const char *type;
545 char *id_str;
546 char *sid;
547 char *dn;
548 int rc = -1;
549
550 /* Only do query if we are online */
551 if (idmap_is_offline()) {
552 return NT_STATUS_FILE_IS_OFFLINE;
553 }
554
555 ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
556
557 switch(map->xid.type) {
558 case ID_TYPE_UID:
559 type = get_attr_key2string(sidmap_attr_list,
560 LDAP_ATTR_UIDNUMBER);
561 break;
562
563 case ID_TYPE_GID:
564 type = get_attr_key2string(sidmap_attr_list,
565 LDAP_ATTR_GIDNUMBER);
566 break;
567
568 default:
569 return NT_STATUS_INVALID_PARAMETER;
570 }
571
572 memctx = talloc_new(ctx);
573 if ( ! memctx) {
574 DEBUG(0, ("Out of memory!\n"));
575 return NT_STATUS_NO_MEMORY;
576 }
577
578 id_str = talloc_asprintf(memctx, "%lu", (unsigned long)map->xid.id);
579 CHECK_ALLOC_DONE(id_str);
580
581 sid = talloc_strdup(memctx, sid_string_talloc(memctx, map->sid));
582 CHECK_ALLOC_DONE(sid);
583
584 dn = talloc_asprintf(memctx, "%s=%s,%s",
585 get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
586 sid,
587 ctx->suffix);
588 CHECK_ALLOC_DONE(dn);
589
590 smbldap_set_mod(&mods, LDAP_MOD_ADD,
591 "objectClass", LDAP_OBJ_IDMAP_ENTRY);
592
593 smbldap_make_mod(ctx->smbldap_state->ldap_struct,
594 entry, &mods, type, id_str);
595
596 smbldap_make_mod(ctx->smbldap_state->ldap_struct, entry, &mods,
597 get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
598 sid);
599
600 if ( ! mods) {
601 DEBUG(2, ("ERROR: No mods?\n"));
602 ret = NT_STATUS_UNSUCCESSFUL;
603 goto done;
604 }
605
606 /* TODO: remove conflicting mappings! */
607
608 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SID_ENTRY);
609
610 DEBUG(10, ("Set DN %s (%s -> %s)\n", dn, sid, id_str));
611
612 rc = smbldap_add(ctx->smbldap_state, dn, mods);
613 ldap_mods_free(mods, True);
614
615 if (rc != LDAP_SUCCESS) {
616 char *ld_error = NULL;
617 ldap_get_option(ctx->smbldap_state->ldap_struct,
618 LDAP_OPT_ERROR_STRING, &ld_error);
619 DEBUG(0,("ldap_set_mapping_internals: Failed to add %s to %lu "
620 "mapping [%s]\n", sid,
621 (unsigned long)map->xid.id, type));
622 DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n",
623 ld_error ? ld_error : "(NULL)", ldap_err2string (rc)));
624 if (ld_error) {
625 ldap_memfree(ld_error);
626 }
627 ret = NT_STATUS_UNSUCCESSFUL;
628 goto done;
629 }
630
631 DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to "
632 "%lu [%s]\n", sid, (unsigned long)map->xid.id, type));
633
634 ret = NT_STATUS_OK;
635
636done:
637 talloc_free(memctx);
638 return ret;
639}
640
641/**
642 * Create a new mapping for an unmapped SID, also allocating a new ID.
643 * If possible, this should be run inside a transaction to make the
644 * action atomic.
645 */
646static NTSTATUS idmap_ldap_new_mapping(struct idmap_domain *dom, struct id_map *map)
647{
648 NTSTATUS ret;
649 struct idmap_ldap_context *ctx;
650
651 ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
652
653 ret = idmap_rw_new_mapping(dom, ctx->rw_ops, map);
654
655 return ret;
656}
657
658
659/* max number of ids requested per batch query */
660#define IDMAP_LDAP_MAX_IDS 30
661
662/**********************************
663 lookup a set of unix ids.
664**********************************/
665
666/* this function searches up to IDMAP_LDAP_MAX_IDS entries
667 * in maps for a match */
668static struct id_map *find_map_by_id(struct id_map **maps,
669 enum id_type type,
670 uint32_t id)
671{
672 int i;
673
674 for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
675 if (maps[i] == NULL) { /* end of the run */
676 return NULL;
677 }
678 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
679 return maps[i];
680 }
681 }
682
683 return NULL;
684}
685
686static NTSTATUS idmap_ldap_unixids_to_sids(struct idmap_domain *dom,
687 struct id_map **ids)
688{
689 NTSTATUS ret;
690 TALLOC_CTX *memctx;
691 struct idmap_ldap_context *ctx;
692 LDAPMessage *result = NULL;
693 LDAPMessage *entry = NULL;
694 const char *uidNumber;
695 const char *gidNumber;
696 const char **attr_list;
697 char *filter = NULL;
698 bool multi = False;
699 int idx = 0;
700 int bidx = 0;
701 int count;
702 int rc;
703 int i;
704
705 /* Only do query if we are online */
706 if (idmap_is_offline()) {
707 return NT_STATUS_FILE_IS_OFFLINE;
708 }
709
710 ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
711
712 memctx = talloc_new(ctx);
713 if ( ! memctx) {
714 DEBUG(0, ("Out of memory!\n"));
715 return NT_STATUS_NO_MEMORY;
716 }
717
718 uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
719 gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
720
721 attr_list = get_attr_list(memctx, sidmap_attr_list);
722
723 if ( ! ids[1]) {
724 /* if we are requested just one mapping use the simple filter */
725
726 filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%lu))",
727 LDAP_OBJ_IDMAP_ENTRY,
728 (ids[0]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
729 (unsigned long)ids[0]->xid.id);
730 CHECK_ALLOC_DONE(filter);
731 DEBUG(10, ("Filter: [%s]\n", filter));
732 } else {
733 /* multiple mappings */
734 multi = True;
735 }
736
737 for (i = 0; ids[i]; i++) {
738 ids[i]->status = ID_UNKNOWN;
739 }
740
741again:
742 if (multi) {
743
744 talloc_free(filter);
745 filter = talloc_asprintf(memctx,
746 "(&(objectClass=%s)(|",
747 LDAP_OBJ_IDMAP_ENTRY);
748 CHECK_ALLOC_DONE(filter);
749
750 bidx = idx;
751 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
752 filter = talloc_asprintf_append_buffer(filter, "(%s=%lu)",
753 (ids[idx]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
754 (unsigned long)ids[idx]->xid.id);
755 CHECK_ALLOC_DONE(filter);
756 }
757 filter = talloc_asprintf_append_buffer(filter, "))");
758 CHECK_ALLOC_DONE(filter);
759 DEBUG(10, ("Filter: [%s]\n", filter));
760 } else {
761 bidx = 0;
762 idx = 1;
763 }
764
765 rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
766 filter, attr_list, 0, &result);
767
768 if (rc != LDAP_SUCCESS) {
769 DEBUG(3,("Failure looking up ids (%s)\n", ldap_err2string(rc)));
770 ret = NT_STATUS_UNSUCCESSFUL;
771 goto done;
772 }
773
774 count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
775
776 if (count == 0) {
777 DEBUG(10, ("NO SIDs found\n"));
778 }
779
780 for (i = 0; i < count; i++) {
781 char *sidstr = NULL;
782 char *tmp = NULL;
783 enum id_type type;
784 struct id_map *map;
785 uint32_t id;
786
787 if (i == 0) { /* first entry */
788 entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
789 result);
790 } else { /* following ones */
791 entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
792 entry);
793 }
794 if ( ! entry) {
795 DEBUG(2, ("ERROR: Unable to fetch ldap entries "
796 "from results\n"));
797 break;
798 }
799
800 /* first check if the SID is present */
801 sidstr = smbldap_talloc_single_attribute(
802 ctx->smbldap_state->ldap_struct,
803 entry, LDAP_ATTRIBUTE_SID, memctx);
804 if ( ! sidstr) { /* no sid, skip entry */
805 DEBUG(2, ("WARNING SID not found on entry\n"));
806 continue;
807 }
808
809 /* now try to see if it is a uid, if not try with a gid
810 * (gid is more common, but in case both uidNumber and
811 * gidNumber are returned the SID is mapped to the uid
812 *not the gid) */
813 type = ID_TYPE_UID;
814 tmp = smbldap_talloc_single_attribute(
815 ctx->smbldap_state->ldap_struct,
816 entry, uidNumber, memctx);
817 if ( ! tmp) {
818 type = ID_TYPE_GID;
819 tmp = smbldap_talloc_single_attribute(
820 ctx->smbldap_state->ldap_struct,
821 entry, gidNumber, memctx);
822 }
823 if ( ! tmp) { /* wow very strange entry, how did it match ? */
824 DEBUG(5, ("Unprobable match on (%s), no uidNumber, "
825 "nor gidNumber returned\n", sidstr));
826 TALLOC_FREE(sidstr);
827 continue;
828 }
829
830 id = strtoul(tmp, NULL, 10);
831 if (!idmap_unix_id_is_in_range(id, dom)) {
832 DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
833 "Filtered!\n", id,
834 dom->low_id, dom->high_id));
835 TALLOC_FREE(sidstr);
836 TALLOC_FREE(tmp);
837 continue;
838 }
839 TALLOC_FREE(tmp);
840
841 map = find_map_by_id(&ids[bidx], type, id);
842 if (!map) {
843 DEBUG(2, ("WARNING: couldn't match sid (%s) "
844 "with requested ids\n", sidstr));
845 TALLOC_FREE(sidstr);
846 continue;
847 }
848
849 if ( ! string_to_sid(map->sid, sidstr)) {
850 DEBUG(2, ("ERROR: Invalid SID on entry\n"));
851 TALLOC_FREE(sidstr);
852 continue;
853 }
854
855 if (map->status == ID_MAPPED) {
856 DEBUG(1, ("WARNING: duplicate %s mapping in LDAP. "
857 "overwriting mapping %u -> %s with %u -> %s\n",
858 (type == ID_TYPE_UID) ? "UID" : "GID",
859 id, sid_string_dbg(map->sid), id, sidstr));
860 }
861
862 TALLOC_FREE(sidstr);
863
864 /* mapped */
865 map->status = ID_MAPPED;
866
867 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
868 (unsigned long)map->xid.id, map->xid.type));
869 }
870
871 /* free the ldap results */
872 if (result) {
873 ldap_msgfree(result);
874 result = NULL;
875 }
876
877 if (multi && ids[idx]) { /* still some values to map */
878 goto again;
879 }
880
881 ret = NT_STATUS_OK;
882
883 /* mark all unknwon/expired ones as unmapped */
884 for (i = 0; ids[i]; i++) {
885 if (ids[i]->status != ID_MAPPED)
886 ids[i]->status = ID_UNMAPPED;
887 }
888
889done:
890 talloc_free(memctx);
891 return ret;
892}
893
894/**********************************
895 lookup a set of sids.
896**********************************/
897
898/* this function searches up to IDMAP_LDAP_MAX_IDS entries
899 * in maps for a match */
900static struct id_map *find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
901{
902 int i;
903
904 for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
905 if (maps[i] == NULL) { /* end of the run */
906 return NULL;
907 }
908 if (dom_sid_equal(maps[i]->sid, sid)) {
909 return maps[i];
910 }
911 }
912
913 return NULL;
914}
915
916static NTSTATUS idmap_ldap_sids_to_unixids(struct idmap_domain *dom,
917 struct id_map **ids)
918{
919 LDAPMessage *entry = NULL;
920 NTSTATUS ret;
921 TALLOC_CTX *memctx;
922 struct idmap_ldap_context *ctx;
923 LDAPMessage *result = NULL;
924 const char *uidNumber;
925 const char *gidNumber;
926 const char **attr_list;
927 char *filter = NULL;
928 bool multi = False;
929 int idx = 0;
930 int bidx = 0;
931 int count;
932 int rc;
933 int i;
934
935 /* Only do query if we are online */
936 if (idmap_is_offline()) {
937 return NT_STATUS_FILE_IS_OFFLINE;
938 }
939
940 ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
941
942 memctx = talloc_new(ctx);
943 if ( ! memctx) {
944 DEBUG(0, ("Out of memory!\n"));
945 return NT_STATUS_NO_MEMORY;
946 }
947
948 uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
949 gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
950
951 attr_list = get_attr_list(memctx, sidmap_attr_list);
952
953 if ( ! ids[1]) {
954 /* if we are requested just one mapping use the simple filter */
955
956 filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%s))",
957 LDAP_OBJ_IDMAP_ENTRY,
958 LDAP_ATTRIBUTE_SID,
959 sid_string_talloc(memctx, ids[0]->sid));
960 CHECK_ALLOC_DONE(filter);
961 DEBUG(10, ("Filter: [%s]\n", filter));
962 } else {
963 /* multiple mappings */
964 multi = True;
965 }
966
967 for (i = 0; ids[i]; i++) {
968 ids[i]->status = ID_UNKNOWN;
969 }
970
971again:
972 if (multi) {
973
974 TALLOC_FREE(filter);
975 filter = talloc_asprintf(memctx,
976 "(&(objectClass=%s)(|",
977 LDAP_OBJ_IDMAP_ENTRY);
978 CHECK_ALLOC_DONE(filter);
979
980 bidx = idx;
981 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
982 filter = talloc_asprintf_append_buffer(filter, "(%s=%s)",
983 LDAP_ATTRIBUTE_SID,
984 sid_string_talloc(memctx,
985 ids[idx]->sid));
986 CHECK_ALLOC_DONE(filter);
987 }
988 filter = talloc_asprintf_append_buffer(filter, "))");
989 CHECK_ALLOC_DONE(filter);
990 DEBUG(10, ("Filter: [%s]", filter));
991 } else {
992 bidx = 0;
993 idx = 1;
994 }
995
996 rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
997 filter, attr_list, 0, &result);
998
999 if (rc != LDAP_SUCCESS) {
1000 DEBUG(3,("Failure looking up sids (%s)\n",
1001 ldap_err2string(rc)));
1002 ret = NT_STATUS_UNSUCCESSFUL;
1003 goto done;
1004 }
1005
1006 count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
1007
1008 if (count == 0) {
1009 DEBUG(10, ("NO SIDs found\n"));
1010 }
1011
1012 for (i = 0; i < count; i++) {
1013 char *sidstr = NULL;
1014 char *tmp = NULL;
1015 enum id_type type;
1016 struct id_map *map;
1017 struct dom_sid sid;
1018 uint32_t id;
1019
1020 if (i == 0) { /* first entry */
1021 entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
1022 result);
1023 } else { /* following ones */
1024 entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
1025 entry);
1026 }
1027 if ( ! entry) {
1028 DEBUG(2, ("ERROR: Unable to fetch ldap entries "
1029 "from results\n"));
1030 break;
1031 }
1032
1033 /* first check if the SID is present */
1034 sidstr = smbldap_talloc_single_attribute(
1035 ctx->smbldap_state->ldap_struct,
1036 entry, LDAP_ATTRIBUTE_SID, memctx);
1037 if ( ! sidstr) { /* no sid ??, skip entry */
1038 DEBUG(2, ("WARNING SID not found on entry\n"));
1039 continue;
1040 }
1041
1042 if ( ! string_to_sid(&sid, sidstr)) {
1043 DEBUG(2, ("ERROR: Invalid SID on entry\n"));
1044 TALLOC_FREE(sidstr);
1045 continue;
1046 }
1047
1048 map = find_map_by_sid(&ids[bidx], &sid);
1049 if (!map) {
1050 DEBUG(2, ("WARNING: couldn't find entry sid (%s) "
1051 "in ids", sidstr));
1052 TALLOC_FREE(sidstr);
1053 continue;
1054 }
1055
1056 /* now try to see if it is a uid, if not try with a gid
1057 * (gid is more common, but in case both uidNumber and
1058 * gidNumber are returned the SID is mapped to the uid
1059 * not the gid) */
1060 type = ID_TYPE_UID;
1061 tmp = smbldap_talloc_single_attribute(
1062 ctx->smbldap_state->ldap_struct,
1063 entry, uidNumber, memctx);
1064 if ( ! tmp) {
1065 type = ID_TYPE_GID;
1066 tmp = smbldap_talloc_single_attribute(
1067 ctx->smbldap_state->ldap_struct,
1068 entry, gidNumber, memctx);
1069 }
1070 if ( ! tmp) { /* no ids ?? */
1071 DEBUG(5, ("no uidNumber, "
1072 "nor gidNumber attributes found\n"));
1073 TALLOC_FREE(sidstr);
1074 continue;
1075 }
1076
1077 id = strtoul(tmp, NULL, 10);
1078 if (!idmap_unix_id_is_in_range(id, dom)) {
1079 DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1080 "Filtered!\n", id,
1081 dom->low_id, dom->high_id));
1082 TALLOC_FREE(sidstr);
1083 TALLOC_FREE(tmp);
1084 continue;
1085 }
1086 TALLOC_FREE(tmp);
1087
1088 if (map->status == ID_MAPPED) {
1089 DEBUG(1, ("WARNING: duplicate %s mapping in LDAP. "
1090 "overwriting mapping %s -> %u with %s -> %u\n",
1091 (type == ID_TYPE_UID) ? "UID" : "GID",
1092 sidstr, map->xid.id, sidstr, id));
1093 }
1094
1095 TALLOC_FREE(sidstr);
1096
1097 /* mapped */
1098 map->xid.type = type;
1099 map->xid.id = id;
1100 map->status = ID_MAPPED;
1101
1102 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1103 (unsigned long)map->xid.id, map->xid.type));
1104 }
1105
1106 /* free the ldap results */
1107 if (result) {
1108 ldap_msgfree(result);
1109 result = NULL;
1110 }
1111
1112 if (multi && ids[idx]) { /* still some values to map */
1113 goto again;
1114 }
1115
1116 /*
1117 * try to create new mappings for unmapped sids
1118 */
1119 for (i = 0; ids[i]; i++) {
1120 if (ids[i]->status != ID_MAPPED) {
1121 ids[i]->status = ID_UNMAPPED;
1122 if (ids[i]->sid != NULL) {
1123 ret = idmap_ldap_new_mapping(dom, ids[i]);
1124 if (!NT_STATUS_IS_OK(ret)) {
1125 goto done;
1126 }
1127 }
1128 }
1129 }
1130
1131 ret = NT_STATUS_OK;
1132
1133done:
1134 talloc_free(memctx);
1135 return ret;
1136}
1137
1138/**********************************
1139 Close the idmap ldap instance
1140**********************************/
1141
1142static struct idmap_methods idmap_ldap_methods = {
1143
1144 .init = idmap_ldap_db_init,
1145 .unixids_to_sids = idmap_ldap_unixids_to_sids,
1146 .sids_to_unixids = idmap_ldap_sids_to_unixids,
1147 .allocate_id = idmap_ldap_allocate_id,
1148};
1149
1150NTSTATUS idmap_ldap_init(void);
1151NTSTATUS idmap_ldap_init(void)
1152{
1153 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1154 &idmap_ldap_methods);
1155}
1156
Note: See TracBrowser for help on using the repository browser.