Context Navigation

← Previous Revision
Next Revision →
Blame
Revision Log

idmap_ad.c

Visit:

Last change on this file was 988, checked in by Silvan Scherrer, 9 years ago
Samba Server: update vendor to version 4.4.3
File size: 26.0 KB

Line
1	/*
2	* idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
3	*
4	* Unix SMB/CIFS implementation.
5	*
6	* Winbind ADS backend functions
7	*
8	* Copyright (C) Andrew Tridgell 2001
9	* Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
10	* Copyright (C) Gerald (Jerry) Carter 2004-2007
11	* Copyright (C) Luke Howard 2001-2004
12	* Copyright (C) Michael Adam 2008,2010
13	*
14	* This program is free software; you can redistribute it and/or modify
15	* it under the terms of the GNU General Public License as published by
16	* the Free Software Foundation; either version 3 of the License, or
17	* (at your option) any later version.
18	*
19	* This program is distributed in the hope that it will be useful,
20	* but WITHOUT ANY WARRANTY; without even the implied warranty of
21	* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22	* GNU General Public License for more details.
23	*
24	* You should have received a copy of the GNU General Public License
25	* along with this program; if not, see <http://www.gnu.org/licenses/>.
26	*/
27
28	#include "includes.h"
29	#include "winbindd.h"
30	#include "../libds/common/flags.h"
31	#include "ads.h"
32	#include "libads/ldap_schema.h"
33	#include "nss_info.h"
34	#include "idmap.h"
35	#include "../libcli/ldap/ldap_ndr.h"
36	#include "../libcli/security/security.h"
37
38	#undef DBGC_CLASS
39	#define DBGC_CLASS DBGC_IDMAP
40
41	#define CHECK_ALLOC_DONE(mem) do { \
42	if (!mem) { \
43	DEBUG(0, ("Out of memory!\n")); \
44	ret = NT_STATUS_NO_MEMORY; \
45	goto done; \
46	} \
47	} while (0)
48
49	struct idmap_ad_context {
50	ADS_STRUCT *ads;
51	struct posix_schema *ad_schema;
52	enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
53	};
54
55	/************************************************************************
56	***********************************************************************/
57
58	static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
59	{
60	ADS_STATUS status;
61	struct idmap_ad_context * ctx;
62
63	DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
64	dom->name));
65
66	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
67
68	status = ads_idmap_cached_connection(&ctx->ads, dom->name);
69	if (!ADS_ERR_OK(status)) {
70	return status;
71	}
72
73	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
74
75	/* if we have a valid ADS_STRUCT and the schema model is
76	defined, then we can return here. */
77
78	if ( ctx->ad_schema ) {
79	return ADS_SUCCESS;
80	}
81
82	/* Otherwise, set the schema model */
83
84	if ( (ctx->ad_map_type == WB_POSIX_MAP_SFU) \|\|
85	(ctx->ad_map_type == WB_POSIX_MAP_SFU20) \|\|
86	(ctx->ad_map_type == WB_POSIX_MAP_RFC2307) )
87	{
88	status = ads_check_posix_schema_mapping(
89	ctx, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
90	if ( !ADS_ERR_OK(status) ) {
91	DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
92	}
93	}
94
95	return status;
96	}
97
98	static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
99	{
100	if (ctx->ads != NULL) {
101	/* we own this ADS_STRUCT so make sure it goes away */
102	ctx->ads->is_mine = True;
103	ads_destroy( &ctx->ads );
104	ctx->ads = NULL;
105	}
106	return 0;
107	}
108
109	/************************************************************************
110	***********************************************************************/
111
112	static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
113	{
114	struct idmap_ad_context *ctx;
115	char *config_option;
116	const char *schema_mode = NULL;
117
118	ctx = talloc_zero(dom, struct idmap_ad_context);
119	if (ctx == NULL) {
120	DEBUG(0, ("Out of memory!\n"));
121	return NT_STATUS_NO_MEMORY;
122	}
123	talloc_set_destructor(ctx, idmap_ad_context_destructor);
124
125	config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
126	if (config_option == NULL) {
127	DEBUG(0, ("Out of memory!\n"));
128	talloc_free(ctx);
129	return NT_STATUS_NO_MEMORY;
130	}
131
132	/* default map type */
133	ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
134
135	/* schema mode */
136	schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
137	if ( schema_mode && schema_mode[0] ) {
138	if ( strequal(schema_mode, "sfu") )
139	ctx->ad_map_type = WB_POSIX_MAP_SFU;
140	else if ( strequal(schema_mode, "sfu20" ) )
141	ctx->ad_map_type = WB_POSIX_MAP_SFU20;
142	else if ( strequal(schema_mode, "rfc2307" ) )
143	ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
144	else
145	DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
146	schema_mode));
147	}
148
149	dom->private_data = ctx;
150
151	talloc_free(config_option);
152
153	return NT_STATUS_OK;
154	}
155
156	/************************************************************************
157	***********************************************************************/
158
159	static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain dom, struct id_map *ids)
160	{
161	NTSTATUS ret;
162	TALLOC_CTX *memctx;
163	struct idmap_ad_context *ctx;
164	ADS_STATUS rc;
165	const char *attrs[] = { "sAMAccountType",
166	"objectSid",
167	NULL, /* uidnumber */
168	NULL, /* gidnumber */
169	NULL };
170	LDAPMessage *res = NULL;
171	LDAPMessage *entry = NULL;
172	char *filter = NULL;
173	int idx = 0;
174	int bidx = 0;
175	int count;
176	int i;
177	char *u_filter = NULL;
178	char *g_filter = NULL;
179
180	/* initialize the status to avoid suprise */
181	for (i = 0; ids[i]; i++) {
182	ids[i]->status = ID_UNKNOWN;
183	}
184
185	/* Only do query if we are online */
186	if (idmap_is_offline()) {
187	return NT_STATUS_FILE_IS_OFFLINE;
188	}
189
190	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
191
192	if ( (memctx = talloc_new(ctx)) == NULL ) {
193	DEBUG(0, ("Out of memory!\n"));
194	return NT_STATUS_NO_MEMORY;
195	}
196
197	rc = ad_idmap_cached_connection(dom);
198	if (!ADS_ERR_OK(rc)) {
199	DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
200	ret = NT_STATUS_UNSUCCESSFUL;
201	/* ret = ads_ntstatus(rc); */
202	goto done;
203	}
204
205	attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
206	attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
207
208	again:
209	bidx = idx;
210	for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
211	switch (ids[idx]->xid.type) {
212	case ID_TYPE_UID:
213	if ( ! u_filter) {
214	u_filter = talloc_asprintf(memctx, "(&(\|"
215	"(sAMAccountType=%d)"
216	"(sAMAccountType=%d)"
217	"(sAMAccountType=%d))(\|",
218	ATYPE_NORMAL_ACCOUNT,
219	ATYPE_WORKSTATION_TRUST,
220	ATYPE_INTERDOMAIN_TRUST);
221	}
222	u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
223	ctx->ad_schema->posix_uidnumber_attr,
224	(unsigned long)ids[idx]->xid.id);
225	CHECK_ALLOC_DONE(u_filter);
226	break;
227
228	case ID_TYPE_GID:
229	if ( ! g_filter) {
230	g_filter = talloc_asprintf(memctx, "(&(\|"
231	"(sAMAccountType=%d)"
232	"(sAMAccountType=%d))(\|",
233	ATYPE_SECURITY_GLOBAL_GROUP,
234	ATYPE_SECURITY_LOCAL_GROUP);
235	}
236	g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
237	ctx->ad_schema->posix_gidnumber_attr,
238	(unsigned long)ids[idx]->xid.id);
239	CHECK_ALLOC_DONE(g_filter);
240	break;
241
242	default:
243	DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
244	ids[idx]->status = ID_UNKNOWN;
245	continue;
246	}
247	}
248	filter = talloc_asprintf(memctx, "(\|");
249	CHECK_ALLOC_DONE(filter);
250	if ( u_filter) {
251	filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
252	CHECK_ALLOC_DONE(filter);
253	TALLOC_FREE(u_filter);
254	}
255	if ( g_filter) {
256	filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
257	CHECK_ALLOC_DONE(filter);
258	TALLOC_FREE(g_filter);
259	}
260	filter = talloc_asprintf_append_buffer(filter, ")");
261	CHECK_ALLOC_DONE(filter);
262
263	rc = ads_search_retry(ctx->ads, &res, filter, attrs);
264	if (!ADS_ERR_OK(rc)) {
265	DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
266	ret = NT_STATUS_UNSUCCESSFUL;
267	goto done;
268	}
269
270	if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
271	DEBUG(10, ("No IDs found\n"));
272	}
273
274	entry = res;
275	for (i = 0; (i < count) && entry; i++) {
276	struct dom_sid sid;
277	enum id_type type;
278	struct id_map *map;
279	uint32_t id;
280	uint32_t atype;
281
282	if (i == 0) { /* first entry */
283	entry = ads_first_entry(ctx->ads, entry);
284	} else { /* following ones */
285	entry = ads_next_entry(ctx->ads, entry);
286	}
287
288	if ( !entry ) {
289	DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
290	break;
291	}
292
293	/* first check if the SID is present */
294	if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
295	DEBUG(2, ("Could not retrieve SID from entry\n"));
296	continue;
297	}
298
299	/* get type */
300	if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
301	DEBUG(1, ("could not get SAM account type\n"));
302	continue;
303	}
304
305	switch (atype & 0xF0000000) {
306	case ATYPE_SECURITY_GLOBAL_GROUP:
307	case ATYPE_SECURITY_LOCAL_GROUP:
308	type = ID_TYPE_GID;
309	break;
310	case ATYPE_NORMAL_ACCOUNT:
311	case ATYPE_WORKSTATION_TRUST:
312	case ATYPE_INTERDOMAIN_TRUST:
313	type = ID_TYPE_UID;
314	break;
315	default:
316	DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
317	continue;
318	}
319
320	if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
321	ctx->ad_schema->posix_uidnumber_attr :
322	ctx->ad_schema->posix_gidnumber_attr,
323	&id))
324	{
325	DEBUG(1, ("Could not get SID for unix ID %u\n", (unsigned) id));
326	continue;
327	}
328
329	if (!idmap_unix_id_is_in_range(id, dom)) {
330	DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
331	id, dom->low_id, dom->high_id));
332	continue;
333	}
334
335	map = idmap_find_map_by_id(&ids[bidx], type, id);
336	if (!map) {
337	DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
338	continue;
339	}
340
341	sid_copy(map->sid, &sid);
342
343	/* mapped */
344	map->status = ID_MAPPED;
345
346	DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
347	(unsigned long)map->xid.id,
348	map->xid.type));
349	}
350
351	if (res) {
352	ads_msgfree(ctx->ads, res);
353	}
354
355	if (ids[idx]) { /* still some values to map */
356	goto again;
357	}
358
359	ret = NT_STATUS_OK;
360
361	/* mark all unknown/expired ones as unmapped */
362	for (i = 0; ids[i]; i++) {
363	if (ids[i]->status != ID_MAPPED)
364	ids[i]->status = ID_UNMAPPED;
365	}
366
367	done:
368	talloc_free(memctx);
369	return ret;
370	}
371
372	/************************************************************************
373	***********************************************************************/
374
375	static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain dom, struct id_map *ids)
376	{
377	NTSTATUS ret;
378	TALLOC_CTX *memctx;
379	struct idmap_ad_context *ctx;
380	ADS_STATUS rc;
381	const char *attrs[] = { "sAMAccountType",
382	"objectSid",
383	NULL, /* attr_uidnumber */
384	NULL, /* attr_gidnumber */
385	NULL };
386	LDAPMessage *res = NULL;
387	LDAPMessage *entry = NULL;
388	char *filter = NULL;
389	int idx = 0;
390	int bidx = 0;
391	int count;
392	int i;
393	char *sidstr;
394
395	/* initialize the status to avoid suprise */
396	for (i = 0; ids[i]; i++) {
397	ids[i]->status = ID_UNKNOWN;
398	}
399
400	/* Only do query if we are online */
401	if (idmap_is_offline()) {
402	return NT_STATUS_FILE_IS_OFFLINE;
403	}
404
405	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
406
407	if ( (memctx = talloc_new(ctx)) == NULL ) {
408	DEBUG(0, ("Out of memory!\n"));
409	return NT_STATUS_NO_MEMORY;
410	}
411
412	rc = ad_idmap_cached_connection(dom);
413	if (!ADS_ERR_OK(rc)) {
414	DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
415	ret = NT_STATUS_UNSUCCESSFUL;
416	/* ret = ads_ntstatus(rc); */
417	goto done;
418	}
419
420	if (ctx->ad_schema == NULL) {
421	DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
422	ret = NT_STATUS_UNSUCCESSFUL;
423	goto done;
424	}
425
426	attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
427	attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
428
429	again:
430	filter = talloc_asprintf(memctx, "(&(\|"
431	"(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
432	"(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
433	")(\|",
434	ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
435	ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
436
437	CHECK_ALLOC_DONE(filter);
438
439	bidx = idx;
440	for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
441
442	ids[idx]->status = ID_UNKNOWN;
443
444	sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[idx]->sid);
445	filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
446
447	TALLOC_FREE(sidstr);
448	CHECK_ALLOC_DONE(filter);
449	}
450	filter = talloc_asprintf_append_buffer(filter, "))");
451	CHECK_ALLOC_DONE(filter);
452	DEBUG(10, ("Filter: [%s]\n", filter));
453
454	rc = ads_search_retry(ctx->ads, &res, filter, attrs);
455	if (!ADS_ERR_OK(rc)) {
456	DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
457	ret = NT_STATUS_UNSUCCESSFUL;
458	goto done;
459	}
460
461	if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
462	DEBUG(10, ("No IDs found\n"));
463	}
464
465	entry = res;
466	for (i = 0; (i < count) && entry; i++) {
467	struct dom_sid sid;
468	enum id_type type;
469	struct id_map *map;
470	uint32_t id;
471	uint32_t atype;
472
473	if (i == 0) { /* first entry */
474	entry = ads_first_entry(ctx->ads, entry);
475	} else { /* following ones */
476	entry = ads_next_entry(ctx->ads, entry);
477	}
478
479	if ( !entry ) {
480	DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
481	break;
482	}
483
484	/* first check if the SID is present */
485	if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
486	DEBUG(2, ("Could not retrieve SID from entry\n"));
487	continue;
488	}
489
490	map = idmap_find_map_by_sid(&ids[bidx], &sid);
491	if (!map) {
492	DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
493	continue;
494	}
495
496	/* get type */
497	if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
498	DEBUG(1, ("could not get SAM account type\n"));
499	continue;
500	}
501
502	switch (atype & 0xF0000000) {
503	case ATYPE_SECURITY_GLOBAL_GROUP:
504	case ATYPE_SECURITY_LOCAL_GROUP:
505	type = ID_TYPE_GID;
506	break;
507	case ATYPE_NORMAL_ACCOUNT:
508	case ATYPE_WORKSTATION_TRUST:
509	case ATYPE_INTERDOMAIN_TRUST:
510	type = ID_TYPE_UID;
511	break;
512	default:
513	DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
514	continue;
515	}
516
517	if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
518	ctx->ad_schema->posix_uidnumber_attr :
519	ctx->ad_schema->posix_gidnumber_attr,
520	&id))
521	{
522	DEBUG(1, ("Could not get unix ID for SID %s\n",
523	sid_string_dbg(map->sid)));
524	continue;
525	}
526	if (!idmap_unix_id_is_in_range(id, dom)) {
527	DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
528	id, dom->low_id, dom->high_id));
529	continue;
530	}
531
532	/* mapped */
533	map->xid.type = type;
534	map->xid.id = id;
535	map->status = ID_MAPPED;
536
537	DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
538	(unsigned long)map->xid.id,
539	map->xid.type));
540	}
541
542	if (res) {
543	ads_msgfree(ctx->ads, res);
544	}
545
546	if (ids[idx]) { /* still some values to map */
547	goto again;
548	}
549
550	ret = NT_STATUS_OK;
551
552	/* mark all unknown/expired ones as unmapped */
553	for (i = 0; ids[i]; i++) {
554	if (ids[i]->status != ID_MAPPED)
555	ids[i]->status = ID_UNMAPPED;
556	}
557
558	done:
559	talloc_free(memctx);
560	return ret;
561	}
562
563	/*
564	* nss_info_{sfu,sfu20,rfc2307}
565	*/
566
567	/************************************************************************
568	Initialize the {sfu,sfu20,rfc2307} state
569	***********************************************************************/
570
571	static const char *wb_posix_map_unknown_string = "WB_POSIX_MAP_UNKNOWN";
572	static const char *wb_posix_map_template_string = "WB_POSIX_MAP_TEMPLATE";
573	static const char *wb_posix_map_sfu_string = "WB_POSIX_MAP_SFU";
574	static const char *wb_posix_map_sfu20_string = "WB_POSIX_MAP_SFU20";
575	static const char *wb_posix_map_rfc2307_string = "WB_POSIX_MAP_RFC2307";
576	static const char *wb_posix_map_unixinfo_string = "WB_POSIX_MAP_UNIXINFO";
577
578	static const char *ad_map_type_string(enum wb_posix_mapping map_type)
579	{
580	switch (map_type) {
581	case WB_POSIX_MAP_TEMPLATE:
582	return wb_posix_map_template_string;
583	case WB_POSIX_MAP_SFU:
584	return wb_posix_map_sfu_string;
585	case WB_POSIX_MAP_SFU20:
586	return wb_posix_map_sfu20_string;
587	case WB_POSIX_MAP_RFC2307:
588	return wb_posix_map_rfc2307_string;
589	case WB_POSIX_MAP_UNIXINFO:
590	return wb_posix_map_unixinfo_string;
591	default:
592	return wb_posix_map_unknown_string;
593	}
594	}
595
596	static NTSTATUS nss_ad_generic_init(struct nss_domain_entry *e,
597	enum wb_posix_mapping new_ad_map_type)
598	{
599	struct idmap_domain *dom;
600	struct idmap_ad_context *ctx;
601
602	if (e->state != NULL) {
603	dom = talloc_get_type(e->state, struct idmap_domain);
604	} else {
605	dom = talloc_zero(e, struct idmap_domain);
606	if (dom == NULL) {
607	DEBUG(0, ("Out of memory!\n"));
608	return NT_STATUS_NO_MEMORY;
609	}
610	e->state = dom;
611	}
612
613	if (e->domain != NULL) {
614	dom->name = talloc_strdup(dom, e->domain);
615	if (dom->name == NULL) {
616	DEBUG(0, ("Out of memory!\n"));
617	return NT_STATUS_NO_MEMORY;
618	}
619	}
620
621	if (dom->private_data != NULL) {
622	ctx = talloc_get_type(dom->private_data,
623	struct idmap_ad_context);
624	} else {
625	ctx = talloc_zero(dom, struct idmap_ad_context);
626	if (ctx == NULL) {
627	DEBUG(0, ("Out of memory!\n"));
628	return NT_STATUS_NO_MEMORY;
629	}
630	ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
631	dom->private_data = ctx;
632	}
633
634	if ((ctx->ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
635	(ctx->ad_map_type != new_ad_map_type))
636	{
637	DEBUG(2, ("nss_ad_generic_init: "
638	"Warning: overriding previously set posix map type "
639	"%s for domain %s with map type %s.\n",
640	ad_map_type_string(ctx->ad_map_type),
641	dom->name,
642	ad_map_type_string(new_ad_map_type)));
643	}
644
645	ctx->ad_map_type = new_ad_map_type;
646
647	return NT_STATUS_OK;
648	}
649
650	static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
651	{
652	return nss_ad_generic_init(e, WB_POSIX_MAP_SFU);
653	}
654
655	static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
656	{
657	return nss_ad_generic_init(e, WB_POSIX_MAP_SFU20);
658	}
659
660	static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
661	{
662	return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
663	}
664
665
666	/************************************************************************
667	***********************************************************************/
668
669	static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
670	const struct dom_sid *sid,
671	TALLOC_CTX *mem_ctx,
672	const char **homedir,
673	const char **shell,
674	const char **gecos,
675	uint32_t *gid )
676	{
677	const char attrs[] = {NULL, / attr_homedir */
678	NULL, /* attr_shell */
679	NULL, /* attr_gecos */
680	NULL, /* attr_gidnumber */
681	NULL };
682	char *filter = NULL;
683	LDAPMessage *msg_internal = NULL;
684	ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
685	NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
686	char *sidstr = NULL;
687	struct idmap_domain *dom;
688	struct idmap_ad_context *ctx;
689
690	DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
691	sid_string_dbg(sid), e->domain?e->domain:"NULL"));
692
693	/* Only do query if we are online */
694	if (idmap_is_offline()) {
695	return NT_STATUS_FILE_IS_OFFLINE;
696	}
697
698	dom = talloc_get_type(e->state, struct idmap_domain);
699	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
700
701	ads_status = ad_idmap_cached_connection(dom);
702	if (!ADS_ERR_OK(ads_status)) {
703	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
704	}
705
706	if (!ctx->ad_schema) {
707	DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
708	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
709	}
710
711	if (!sid \|\| !homedir \|\| !shell \|\| !gecos) {
712	return NT_STATUS_INVALID_PARAMETER;
713	}
714
715	/* Have to do our own query */
716
717	DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
718	"own query\n"));
719
720	attrs[0] = ctx->ad_schema->posix_homedir_attr;
721	attrs[1] = ctx->ad_schema->posix_shell_attr;
722	attrs[2] = ctx->ad_schema->posix_gecos_attr;
723	attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
724
725	sidstr = ldap_encode_ndr_dom_sid(mem_ctx, sid);
726	filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
727	TALLOC_FREE(sidstr);
728
729	if (!filter) {
730	nt_status = NT_STATUS_NO_MEMORY;
731	goto done;
732	}
733
734	ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
735	if (!ADS_ERR_OK(ads_status)) {
736	nt_status = ads_ntstatus(ads_status);
737	goto done;
738	}
739
740	*homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
741	*shell = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
742	*gecos = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
743
744	if (gid) {
745	if (!ads_pull_uint32(ctx->ads, msg_internal, ctx->ad_schema->posix_gidnumber_attr, gid))
746	*gid = (uint32_t)-1;
747	}
748
749	nt_status = NT_STATUS_OK;
750
751	done:
752	if (msg_internal) {
753	ads_msgfree(ctx->ads, msg_internal);
754	}
755
756	return nt_status;
757	}
758
759	/**********************************************************************
760	*********************************************************************/
761
762	static NTSTATUS nss_ad_map_to_alias(TALLOC_CTX *mem_ctx,
763	struct nss_domain_entry *e,
764	const char *name,
765	char **alias)
766	{
767	const char attrs[] = {NULL, / attr_uid */
768	NULL };
769	char *filter = NULL;
770	LDAPMessage *msg = NULL;
771	ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
772	NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
773	struct idmap_domain *dom;
774	struct idmap_ad_context *ctx = NULL;
775
776	/* Check incoming parameters */
777
778	if ( !e \|\| !e->domain \|\| !name \|\| !*alias) {
779	nt_status = NT_STATUS_INVALID_PARAMETER;
780	goto done;
781	}
782
783	/* Only do query if we are online */
784
785	if (idmap_is_offline()) {
786	nt_status = NT_STATUS_FILE_IS_OFFLINE;
787	goto done;
788	}
789
790	dom = talloc_get_type(e->state, struct idmap_domain);
791	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
792
793	ads_status = ad_idmap_cached_connection(dom);
794	if (!ADS_ERR_OK(ads_status)) {
795	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
796	}
797
798	if (!ctx->ad_schema) {
799	nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
800	goto done;
801	}
802
803	attrs[0] = ctx->ad_schema->posix_uid_attr;
804
805	filter = talloc_asprintf(mem_ctx,
806	"(sAMAccountName=%s)",
807	name);
808	if (!filter) {
809	nt_status = NT_STATUS_NO_MEMORY;
810	goto done;
811	}
812
813	ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
814	if (!ADS_ERR_OK(ads_status)) {
815	nt_status = ads_ntstatus(ads_status);
816	goto done;
817	}
818
819	*alias = ads_pull_string(ctx->ads, mem_ctx, msg, ctx->ad_schema->posix_uid_attr);
820
821	if (!*alias) {
822	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
823	}
824
825	nt_status = NT_STATUS_OK;
826
827	done:
828	if (filter) {
829	talloc_destroy(filter);
830	}
831	if (msg) {
832	ads_msgfree(ctx->ads, msg);
833	}
834
835	return nt_status;
836	}
837
838	/**********************************************************************
839	*********************************************************************/
840
841	static NTSTATUS nss_ad_map_from_alias( TALLOC_CTX *mem_ctx,
842	struct nss_domain_entry *e,
843	const char *alias,
844	char **name )
845	{
846	const char *attrs[] = {"sAMAccountName",
847	NULL };
848	char *filter = NULL;
849	LDAPMessage *msg = NULL;
850	ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
851	NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
852	char *username;
853	struct idmap_domain *dom;
854	struct idmap_ad_context *ctx = NULL;
855
856	/* Check incoming parameters */
857
858	if ( !alias \|\| !name) {
859	nt_status = NT_STATUS_INVALID_PARAMETER;
860	goto done;
861	}
862
863	/* Only do query if we are online */
864
865	if (idmap_is_offline()) {
866	nt_status = NT_STATUS_FILE_IS_OFFLINE;
867	goto done;
868	}
869
870	dom = talloc_get_type(e->state, struct idmap_domain);
871	ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
872
873	ads_status = ad_idmap_cached_connection(dom);
874	if (!ADS_ERR_OK(ads_status)) {
875	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
876	}
877
878	if (!ctx->ad_schema) {
879	nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
880	goto done;
881	}
882
883	filter = talloc_asprintf(mem_ctx,
884	"(%s=%s)",
885	ctx->ad_schema->posix_uid_attr,
886	alias);
887	if (!filter) {
888	nt_status = NT_STATUS_NO_MEMORY;
889	goto done;
890	}
891
892	ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
893	if (!ADS_ERR_OK(ads_status)) {
894	nt_status = ads_ntstatus(ads_status);
895	goto done;
896	}
897
898	username = ads_pull_string(ctx->ads, mem_ctx, msg,
899	"sAMAccountName");
900	if (!username) {
901	return NT_STATUS_OBJECT_NAME_NOT_FOUND;
902	}
903
904	*name = talloc_asprintf(mem_ctx, "%s\\%s",
905	lp_workgroup(),
906	username);
907	if (!*name) {
908	nt_status = NT_STATUS_NO_MEMORY;
909	goto done;
910	}
911
912	nt_status = NT_STATUS_OK;
913
914	done:
915	if (filter) {
916	talloc_destroy(filter);
917	}
918	if (msg) {
919	ads_msgfree(ctx->ads, msg);
920	}
921
922	return nt_status;
923	}
924
925	/************************************************************************
926	Function dispatch tables for the idmap and nss plugins
927	***********************************************************************/
928
929	static struct idmap_methods ad_methods = {
930	.init = idmap_ad_initialize,
931	.unixids_to_sids = idmap_ad_unixids_to_sids,
932	.sids_to_unixids = idmap_ad_sids_to_unixids,
933	};
934
935	/* The SFU and RFC2307 NSS plugins share everything but the init
936	function which sets the intended schema model to use */
937
938	static struct nss_info_methods nss_rfc2307_methods = {
939	.init = nss_rfc2307_init,
940	.get_nss_info = nss_ad_get_info,
941	.map_to_alias = nss_ad_map_to_alias,
942	.map_from_alias = nss_ad_map_from_alias,
943	};
944
945	static struct nss_info_methods nss_sfu_methods = {
946	.init = nss_sfu_init,
947	.get_nss_info = nss_ad_get_info,
948	.map_to_alias = nss_ad_map_to_alias,
949	.map_from_alias = nss_ad_map_from_alias,
950	};
951
952	static struct nss_info_methods nss_sfu20_methods = {
953	.init = nss_sfu20_init,
954	.get_nss_info = nss_ad_get_info,
955	.map_to_alias = nss_ad_map_to_alias,
956	.map_from_alias = nss_ad_map_from_alias,
957	};
958
959
960
961	/************************************************************************
962	Initialize the plugins
963	***********************************************************************/
964
965	static_decl_idmap;
966	NTSTATUS idmap_ad_init(void)
967	{
968	static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
969	static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
970	static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
971	static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
972
973	/* Always register the AD method first in order to get the
974	idmap_domain interface called */
975
976	if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
977	status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
978	"ad", &ad_methods);
979	if ( !NT_STATUS_IS_OK(status_idmap_ad) )
980	return status_idmap_ad;
981	}
982
983	if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
984	status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
985	"rfc2307", &nss_rfc2307_methods );
986	if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
987	return status_nss_rfc2307;
988	}
989
990	if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
991	status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
992	"sfu", &nss_sfu_methods );
993	if ( !NT_STATUS_IS_OK(status_nss_sfu) )
994	return status_nss_sfu;
995	}
996
997	if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
998	status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
999	"sfu20", &nss_sfu20_methods );
1000	if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
1001	return status_nss_sfu20;
1002	}
1003
1004	return NT_STATUS_OK;
1005	}
1006

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: vendor/current/source3/winbindd/idmap_ad.c

Download in other formats: