Changeset 140 for branches/samba-3.0/source/nsswitch

Timestamp:

Jul 11, 2008, 1:13:42 AM (17 years ago)

Author:

Paul Smedley

Message:

Update branch to 3.0.31 release

Location:

branches/samba-3.0/source/nsswitch

Files:

• idmap_util.c (modified) (1 diff)
• pam_winbind.c (modified) (6 diffs)
• winbindd.c (modified) (3 diffs)
• winbindd_cache.c (modified) (2 diffs)
• winbindd_cm.c (modified) (5 diffs)
• winbindd_dual.c (modified) (6 diffs)
• winbindd_group.c (modified) (1 diff)
• winbindd_pam.c (modified) (4 diffs)
• winbindd_passdb.c (modified) (10 diffs)
• winbindd_proto.h (modified) (1 diff)
• winbindd_util.c (modified) (6 diffs)

branches/samba-3.0/source/nsswitch/idmap_util.c

@@ -159 +159 @@
 
         if ((map.status != ID_MAPPED) || (map.xid.type != ID_TYPE_GID)) {
-                DEBUG(10, ("sid [%s] not mapped to an gid [%u,%u,%u]\n", 
+                DEBUG(10, ("sid [%s] not mapped to an gid [%u,%u]\n", 
                            sid_string_static(sid), 
                            map.status, 
-                           map.xid.type, 
-                           map.xid.id));
+                           map.xid.type));
                 return NT_STATUS_NONE_MAPPED;
         }

branches/samba-3.0/source/nsswitch/pam_winbind.c

@@ -1182 +1182 @@
         }
 
+        if (ctrl & WINBIND_CACHED_LOGIN) {
+                request.flags |= WBFLAG_PAM_CACHED_LOGIN;
+        }
+
         ret = pam_winbind_request_log(pamh, ctrl, WINBINDD_PAM_CHAUTHTOK, &request, &response, user);
 
@@ -1908 +1912 @@
 {
 
-        /* Make sure that we only do this if 
+        /* Make sure that we only do this if
          * a) the chauthtok got initiated during a logon attempt (authenticate->acct_mgmt->chauthtok)
          * b) any later password change via the "passwd" command if done by the user itself 
-         */
-                
+         *
+         * NB. If we login from gdm or xdm and the password expires,
+         * we change the password, but there is no memory cache.
+         * Thus, even for passthrough login, we should do the
+         * authentication again to update memory cache.
+         * --- BoYang
+         * */
+
         char *new_authtok_reqd_during_auth = NULL;
         struct passwd *pwd = NULL;
-
-        if (!(ctrl & WINBIND_KRB5_AUTH)) {
-                return False;
-        }
 
         _pam_get_data(pamh, PAM_WINBIND_NEW_AUTHTOK_REQD_DURING_AUTH, &new_authtok_reqd_during_auth);
@@ -1947 +1953 @@
         int ret;
         unsigned int ctrl;
+        bool cached_login = False;
 
         /* <DO NOT free() THESE> */
@@ -1970 +1977 @@
         _PAM_LOG_FUNCTION_ENTER("pam_sm_chauthtok", pamh, ctrl, flags);
 
-        /* clearing offline bit for the auth in the password change */
+        cached_login = (ctrl & WINBIND_CACHED_LOGIN);
+
+        /* clearing offline bit for auth */
         ctrl &= ~WINBIND_CACHED_LOGIN;
 
@@ -2118 +2127 @@
                                &pwdlastset_update);
 
+                /*
+                 * if cached creds were enabled, make sure to set the
+                 * WINBIND_CACHED_LOGIN bit here in order to have winbindd
+                 * update the cached creds storage - gd
+                 */
+                if (cached_login) {
+                        ctrl |= WINBIND_CACHED_LOGIN;
+                }
+
                 ret = winbind_chauthtok_request(pamh, ctrl, user, pass_old, pass_new, pwdlastset_update);
                 if (ret) {
@@ -2130 +2148 @@
                         const char *member = get_member_from_config(pamh, argc, argv, ctrl, d);
                         const char *cctype = get_krb5_cc_type_from_config(pamh, argc, argv, ctrl, d);
+
+                        /* Keep the WINBIND_CACHED_LOGIN bit for
+                         * authentication after changing the password.
+                         * This will update the cached credentials in case
+                         * that winbindd_dual_pam_chauthtok() fails
+                         * to update them.
+                         * --- BoYang
+                         * */
 
                         ret = winbind_auth_request(pamh, ctrl, user, pass_new,

branches/samba-3.0/source/nsswitch/winbindd.c

@@ -118 +118 @@
 /* Handle the signal by unlinking socket and exiting */
 
-static void terminate(void)
-{
-        pstring path;
-
-        /* Remove socket file */
-        pstr_sprintf(path, "%s/%s", 
-                 WINBINDD_SOCKET_DIR, WINBINDD_SOCKET_NAME);
-        unlink(path);
+static void terminate(bool in_parent)
+{
+        if (in_parent) {
+                /* When parent goes away we should
+                 * remove the socket file. Not so
+                 * when children terminate.
+                 */ 
+
+                pstring path;
+
+                /* Remove socket file */
+                pstr_sprintf(path, "%s/%s", 
+                        WINBINDD_SOCKET_DIR, WINBINDD_SOCKET_NAME);
+                unlink(path);
+        }
 
         idmap_close();
@@ -732 +739 @@
 
 /* check if TERM has been received */
-void winbind_check_sigterm(void)
+void winbind_check_sigterm(bool in_parent)
 {
         if (do_sigterm)
-                terminate();
+                terminate(in_parent);
 }
 
@@ -902 +909 @@
         /* Check signal handling things */
 
-        winbind_check_sigterm();
+        winbind_check_sigterm(true);
         winbind_check_sighup();
 

branches/samba-3.0/source/nsswitch/winbindd_cache.c

@@ -38 +38 @@
 extern struct winbindd_methods ads_methods;
 #endif
-extern struct winbindd_methods passdb_methods;
+extern struct winbindd_methods builtin_passdb_methods;
 
 /*
@@ -139 +139 @@
 
         if (domain->internal) {
-                domain->backend = &passdb_methods;
+                domain->backend = &builtin_passdb_methods;
                 domain->initialized = True;
         }

branches/samba-3.0/source/nsswitch/winbindd_cm.c

@@ -608 +608 @@
         }
 
-        /* this is at least correct when domain is our domain,
-         * which is the only case, when this is currently used: */
+        /* For now assume our machine account only exists in our domain */
+
         if (machine_krb5_principal != NULL)
         {
                 if (asprintf(machine_krb5_principal, "%s$@%s",
-                             account_name, domain->alt_name) == -1)
+                             account_name, lp_realm()) == -1)
                 {
                         return NT_STATUS_NO_MEMORY;
@@ -730 +730 @@
                         (*cli)->use_kerberos = True;
                         DEBUG(5, ("connecting to %s from %s with kerberos principal "
-                                  "[%s]\n", controller, global_myname(),
-                                  machine_krb5_principal));
+                                  "[%s] and realm [%s]\n", controller, global_myname(),
+                                  machine_krb5_principal, domain->alt_name));
 
                         ads_status = cli_session_setup_spnego(*cli,
                                                               machine_krb5_principal, 
                                                               machine_password, 
-                                                              domain->name);
+                                                              lp_workgroup(),
+                                                              domain->alt_name);
 
                         if (!ADS_ERR_OK(ads_status)) {
@@ -756 +757 @@
                 DEBUG(5, ("connecting to %s from %s with username "
                           "[%s]\\[%s]\n",  controller, global_myname(),
-                          domain->name, machine_account));
+                          lp_workgroup(), machine_account));
 
                 ads_status = cli_session_setup_spnego(*cli,
                                                       machine_account, 
                                                       machine_password, 
-                                                      domain->name);
+                                                      lp_workgroup(),
+                                                      NULL);
                 if (!ADS_ERR_OK(ads_status)) {
                         DEBUG(4, ("authenticated session setup failed with %s\n",
@@ -1249 +1251 @@
         int i, fd_index;
 
+        *fd = -1;
+
  again:
         if (!get_dcs(mem_ctx, domain, &dcs, &num_dcs) || (num_dcs == 0))
@@ -1309 +1313 @@
         winbind_add_failed_connection_entry(domain, dcs[fd_index].name,
                                     NT_STATUS_UNSUCCESSFUL);
+
+        /* Throw away all arrays as we're doing this again. */
+        TALLOC_FREE(dcs);
+        num_dcs = 0;
+
+        TALLOC_FREE(dcnames);
+        num_dcnames = 0;
+
+        TALLOC_FREE(addrs);
+        num_addrs = 0;
+
+        *fd = -1;
+
         goto again;
 }

branches/samba-3.0/source/nsswitch/winbindd_dual.c

@@ -36 +36 @@
 
 extern BOOL override_logfile;
-extern struct winbindd_methods cache_methods;
 
 /* Read some data from a client connection */
@@ -888 +887 @@
         struct winbindd_cli_state state;
         struct winbindd_domain *domain;
+        struct winbindd_domain *primary_domain = NULL;
 
         if (socketpair(AF_UNIX, SOCK_STREAM, 0, fdpair) != 0) {
@@ -967 +967 @@
 
         /* Ensure we have no pending check_online events other
-           than one for this domain. */
+           than one for this domain or the primary domain. */
 
         for (domain = domain_list(); domain; domain = domain->next) {
-                if (domain != child->domain) {
+                if (domain->primary) {
+                        primary_domain = domain;
+                }
+                if ((domain != child->domain) && !domain->primary) {
                         TALLOC_FREE(domain->check_online_event);
                 }
@@ -986 +989 @@
 
                 set_domain_online_request(child->domain);
+
+                if (primary_domain != child->domain) {
+                        /* We need to talk to the primary
+                         * domain as well as the trusted
+                         * domain inside a trusted domain
+                         * child.
+                         * See the code in :
+                         * winbindd_dual_pam_auth_samlogon()
+                         * especially the calling of 
+                         * contact_domain = find_our_domain()
+                         * in the non-DC case for details.
+                         */
+                        set_domain_online_request(primary_domain);
+                }
 
                 child->lockout_policy_event = event_add_timed(
@@ -994 +1011 @@
         }
 
-        /* Special case for Winbindd on a Samba DC,
-         * We want to make sure the child can connect to smbd
-         * but not the main daemon */
-
-        if (child->domain && child->domain->internal && IS_DC) {
-                child->domain->methods = &cache_methods;
-                child->domain->online = False;
-        }
-
         while (1) {
 
@@ -1016 +1024 @@
 
                 /* check for signals */
-                winbind_check_sigterm();
+                winbind_check_sigterm(false);
                 winbind_check_sighup();
 

branches/samba-3.0/source/nsswitch/winbindd_group.c

@@ -1399 +1399 @@
         s->state->response.data.num_entries = s->num_token_gids;
         /* s->token_gids are talloced */
-        s->state->response.extra_data.data = smb_xmemdup(s->token_gids, s->num_token_gids * sizeof(gid_t));
-        s->state->response.length += s->num_token_gids * sizeof(gid_t);
+        if (s->num_token_gids != 0) {
+                s->state->response.extra_data.data = smb_xmemdup(
+                        s->token_gids, s->num_token_gids * sizeof(gid_t));
+                s->state->response.length += s->num_token_gids * sizeof(gid_t);
+        }
         request_ok(s->state);
 }

branches/samba-3.0/source/nsswitch/winbindd_pam.c

@@ -1380 +1380 @@
                     NT_STATUS_EQUAL(result, NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND)) {
                         DEBUG(10,("winbindd_dual_pam_auth_kerberos setting domain to offline\n"));
-                        domain->online = False;
+                        /* Use set_domain_offline() instead of
+                         * just set status offline, otherwise,
+                         * domain will never goes online again
+                         * --- BoYang */
+                        set_domain_offline(domain);
                 }
 
@@ -2045 +2049 @@
 
         if (NT_STATUS_IS_OK(result) && (state->request.flags & WBFLAG_PAM_CACHED_LOGIN)) {
-                
+
                 /* Update the single sign-on memory creds. */
                 result = winbindd_replace_memory_creds(state->request.data.chauthtok.user,
                                                         newpass);
+
+                /* When we login from gdm or xdm and password expires,
+                 * we change the password, but there are no memory crendentials.
+                 * So, winbindd_replace_memory_creds() returns
+                 * NT_STATUS_OBJECT_NAME_NOT_FOUND. This is not a failure.
+                 * --- BoYang
+                 * */
+                if (NT_STATUS_EQUAL(result, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
+                        result = NT_STATUS_OK;
+                }
 
                 if (!NT_STATUS_IS_OK(result)) {
@@ -2059 +2073 @@
                                                          state->mem_ctx, user,
                                                          newpass);
+                        /* Again, this happens when we login from gdm or xdm
+                         * and the password expires, *BUT* cached crendentials
+                         * don't exist. winbindd_update_creds_by_name()
+                         * returns NT_STATUS_NO_SUCH_USER.
+                         * This is not a failure.
+                         * --- BoYang
+                         * */
+                        if (NT_STATUS_EQUAL(result, NT_STATUS_NO_SUCH_USER)) {
+                                result = NT_STATUS_OK;
+                        }
                         if (!NT_STATUS_IS_OK(result)) {
                                 DEBUG(10,("Failed to store creds: %s\n", nt_errstr(result)));
@@ -2064 +2088 @@
                         }
                 }
-        }               
+        }
 
         if (!NT_STATUS_IS_OK(result) && !got_info && contact_domain) {

branches/samba-3.0/source/nsswitch/winbindd_passdb.c

@@ -7 +7 @@
    Copyright (C) Simo Sorce 2003
    Copyright (C) Volker Lendecke 2004
+   Copyright (C) Jeremy Allison 2008
    
    This program is free software; you can redistribute it and/or modify
@@ -29 +30 @@
 #define DBGC_CLASS DBGC_WINBIND
 
-/* Query display info for a domain.  This returns enough information plus a
-   bit extra to give an overview of domain users for the User Manager
-   application. */
-static NTSTATUS query_user_list(struct winbindd_domain *domain,
-                               TALLOC_CTX *mem_ctx,
-                               uint32 *num_entries, 
-                               WINBIND_USERINFO **info)
-{
-        /* We don't have users */
-        *num_entries = 0;
-        *info = NULL;
-        return NT_STATUS_OK;
-}
-
-/* list all domain groups */
-static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
+static NTSTATUS enum_groups_internal(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
                                 uint32 *num_entries, 
-                                struct acct_info **info)
-{
-        /* We don't have domain groups */
-        *num_entries = 0;
-        *info = NULL;
-        return NT_STATUS_OK;
-}
-
-/* List all domain groups */
-
-static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
-                                TALLOC_CTX *mem_ctx,
-                                uint32 *num_entries, 
-                                struct acct_info **info)
+                                struct acct_info **info,
+                                enum lsa_SidType sidtype)
 {
         struct pdb_search *search;
-        struct samr_displayentry *aliases;
+        struct samr_displayentry *entries;
         int i;
         NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
 
-        search = pdb_search_aliases(&domain->sid);
+        if (sidtype == SID_NAME_ALIAS) {
+                search = pdb_search_aliases(&domain->sid);
+        } else {
+                search = pdb_search_groups();
+        }
+
         if (search == NULL) goto done;
 
-        *num_entries = pdb_search_entries(search, 0, 0xffffffff, &aliases);
-        if (*num_entries == 0) goto done;
+        *num_entries = pdb_search_entries(search, 0, 0xffffffff, &entries);
+        if (*num_entries == 0) {
+                /* Zero entries isn't an error */
+                result = NT_STATUS_OK;
+                goto done;
+        }
 
         *info = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
@@ -80 +63 @@
 
         for (i=0; i<*num_entries; i++) {
-                fstrcpy((*info)[i].acct_name, aliases[i].account_name);
-                fstrcpy((*info)[i].acct_desc, aliases[i].description);
-                (*info)[i].rid = aliases[i].rid;
+                fstrcpy((*info)[i].acct_name, entries[i].account_name);
+                fstrcpy((*info)[i].acct_desc, entries[i].description);
+                (*info)[i].rid = entries[i].rid;
         }
 
@@ -89 +72 @@
         pdb_search_destroy(search);
         return result;
+}
+
+/* List all local groups (aliases) */
+static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
+                                TALLOC_CTX *mem_ctx,
+                                uint32 *num_entries, 
+                                struct acct_info **info)
+{
+        return enum_groups_internal(domain,
+                                mem_ctx,
+                                num_entries,
+                                info,
+                                SID_NAME_ALIAS);
 }
 
@@ -144 +140 @@
 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
                               TALLOC_CTX *mem_ctx,
-                              const DOM_SID *sid,
+                              const DOM_SID *domain_sid,
                               uint32 *rids,
                               size_t num_rids,
@@ -151 +147 @@
                               enum lsa_SidType **types)
 {
-        return NT_STATUS_UNSUCCESSFUL;
-}
-
-/* Lookup user information from a rid or username. */
-static NTSTATUS query_user(struct winbindd_domain *domain, 
-                           TALLOC_CTX *mem_ctx, 
-                           const DOM_SID *user_sid,
-                           WINBIND_USERINFO *user_info)
-{
-        return NT_STATUS_NO_SUCH_USER;
+        size_t i;
+        bool have_mapped;
+        bool have_unmapped;
+
+        *domain_name = NULL;
+        *names = NULL;
+        *types = NULL;
+
+        if (!num_rids) {
+                return NT_STATUS_OK;
+        }
+
+        *names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
+        *types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
+
+        if ((*names == NULL) || (*types == NULL)) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        have_mapped = have_unmapped = false;
+
+        for (i=0; i<num_rids; i++) {
+                DOM_SID sid;
+                const char *dom = NULL, *nam = NULL;
+                enum lsa_SidType type = SID_NAME_UNKNOWN;
+
+                if (!sid_compose(&sid, domain_sid, rids[i])) {
+                        return NT_STATUS_INTERNAL_ERROR;
+                }
+
+                if (!lookup_sid(mem_ctx, &sid, &dom, &nam, &type)) {
+                        have_unmapped = true;
+                        (*types)[i] = SID_NAME_UNKNOWN;
+                        (*names)[i] = talloc_strdup(mem_ctx, "");
+                } else {
+                        have_mapped = true;
+                        (*types)[i] = type;
+                        (*names)[i] = CONST_DISCARD(char *, nam);
+                }
+
+                if (domain_name == NULL) {
+                        *domain_name = CONST_DISCARD(char *, dom);
+                } else {
+                        char *dname = CONST_DISCARD(char *, dom);
+                        TALLOC_FREE(dname);
+                }
+        }
+
+        if (!have_mapped) {
+                return NT_STATUS_NONE_MAPPED;
+        }
+        if (!have_unmapped) {
+                return NT_STATUS_OK;
+        }
+        return STATUS_SOME_UNMAPPED;
 }
 
@@ -179 +220 @@
         }
 
-        if ( !pdb_getsampwsid( user, user_sid ) ) {
+        if (!pdb_getsampwsid(user, user_sid ) ) {
                 return NT_STATUS_NO_SUCH_USER;
         }
@@ -208 +249 @@
 }
 
-/* Lookup group membership given a rid.   */
-static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
+/* find the sequence number for a domain */
+static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
+{
+        BOOL result;
+        time_t seq_num;
+
+        result = pdb_get_seq_num(&seq_num);
+        if (!result) {
+                *seq = 1;
+        }
+
+        *seq = (int) seq_num;
+        /* *seq = 1; */
+        return NT_STATUS_OK;
+}
+
+static NTSTATUS lockout_policy(struct winbindd_domain *domain,
+                               TALLOC_CTX *mem_ctx,
+                               SAM_UNK_INFO_12 *policy)
+{
+        /* actually we have that */
+        return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS password_policy(struct winbindd_domain *domain,
+                                TALLOC_CTX *mem_ctx,
+                                SAM_UNK_INFO_1 *policy)
+{
+        uint32 min_pass_len,pass_hist,password_properties;
+        time_t u_expire, u_min_age;
+        NTTIME nt_expire, nt_min_age;
+        uint32 account_policy_temp;
+
+        if ((policy = TALLOC_ZERO_P(mem_ctx, SAM_UNK_INFO_1)) == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+        min_pass_len = account_policy_temp;
+
+        if (!pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+        pass_hist = account_policy_temp;
+
+        if (!pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+        password_properties = account_policy_temp;
+
+        if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+        u_expire = account_policy_temp;
+
+        if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp)) {
+                return NT_STATUS_ACCESS_DENIED;
+        }
+        u_min_age = account_policy_temp;
+
+        unix_to_nt_time_abs(&nt_expire, u_expire);
+        unix_to_nt_time_abs(&nt_min_age, u_min_age);
+
+        init_unk_info1(policy, (uint16)min_pass_len, (uint16)pass_hist, 
+                       password_properties, nt_expire, nt_min_age);
+
+        return NT_STATUS_OK;
+}
+
+/*********************************************************************
+ BUILTIN specific functions.
+*********************************************************************/
+
+/* list all domain groups */
+static NTSTATUS builtin_enum_dom_groups(struct winbindd_domain *domain,
+                                TALLOC_CTX *mem_ctx,
+                                uint32 *num_entries, 
+                                struct acct_info **info)
+{
+        /* BUILTIN doesn't have domain groups */
+        *num_entries = 0;
+        *info = NULL;
+        return NT_STATUS_OK;
+}
+
+/* Query display info for a domain.  This returns enough information plus a
+   bit extra to give an overview of domain users for the User Manager
+   application. */
+static NTSTATUS builtin_query_user_list(struct winbindd_domain *domain,
+                               TALLOC_CTX *mem_ctx,
+                               uint32 *num_entries, 
+                               WINBIND_USERINFO **info)
+{
+        /* We don't have users */
+        *num_entries = 0;
+        *info = NULL;
+        return NT_STATUS_OK;
+}
+
+/* Lookup user information from a rid or username. */
+static NTSTATUS builtin_query_user(struct winbindd_domain *domain, 
+                           TALLOC_CTX *mem_ctx, 
+                           const DOM_SID *user_sid,
+                           WINBIND_USERINFO *user_info)
+{
+        return NT_STATUS_NO_SUCH_USER;
+}
+
+static NTSTATUS builtin_lookup_groupmem(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
                                 const DOM_SID *group_sid, uint32 *num_names, 
                                 DOM_SID **sid_mem, char ***names, 
+                                uint32 **name_types)
+{
+        *num_names = 0;
+        *sid_mem = NULL;
+        *names = NULL;
+        *name_types = 0;
+        return NT_STATUS_NO_SUCH_GROUP;
+}
+
+/* get a list of trusted domains - builtin domain */
+static NTSTATUS builtin_trusted_domains(struct winbindd_domain *domain,
+                                TALLOC_CTX *mem_ctx,
+                                uint32 *num_domains,
+                                char ***names,
+                                char ***alt_names,
+                                DOM_SID **dom_sids)
+{
+        *num_domains = 0;
+        *names = NULL;
+        *alt_names = NULL;
+        *dom_sids = NULL;
+        return NT_STATUS_OK;
+}
+
+/*********************************************************************
+ SAM specific functions.
+*********************************************************************/
+
+/* list all domain groups */
+static NTSTATUS sam_enum_dom_groups(struct winbindd_domain *domain,
+                                TALLOC_CTX *mem_ctx,
+                                uint32 *num_entries, 
+                                struct acct_info **info)
+{
+        return enum_groups_internal(domain,
+                                mem_ctx,
+                                num_entries,
+                                info,
+                                SID_NAME_DOM_GRP);
+}
+
+static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
+                               TALLOC_CTX *mem_ctx,
+                               uint32 *num_entries, 
+                               WINBIND_USERINFO **info)
+{
+        struct pdb_search *ps = pdb_search_users(ACB_NORMAL);
+        struct samr_displayentry *entries = NULL;
+        uint32 i;
+
+        *num_entries = 0;
+        *info = NULL;
+
+        if (!ps) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        *num_entries = pdb_search_entries(ps,
+                                        1, 0xffffffff,
+                                        &entries);
+
+        *info = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
+        if (!(*info)) {
+                pdb_search_destroy(ps);
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        for (i = 0; i < *num_entries; i++) {
+                struct samr_displayentry *e = &entries[i];
+
+                (*info)[i].acct_name = talloc_strdup(mem_ctx, e->account_name );
+                (*info)[i].full_name = talloc_strdup(mem_ctx, e->fullname );
+                (*info)[i].homedir = NULL;
+                (*info)[i].shell = NULL;
+                sid_compose(&(*info)[i].user_sid, &domain->sid, e->rid);
+
+                /* For the moment we set the primary group for
+                every user to be the Domain Users group.
+                There are serious problems with determining
+                the actual primary group for large domains.
+                This should really be made into a 'winbind
+                force group' smb.conf parameter or
+                something like that. */
+
+                sid_compose(&(*info)[i].group_sid, &domain->sid,
+                                DOMAIN_GROUP_RID_USERS);
+        }
+
+        pdb_search_destroy(ps);
+        return NT_STATUS_OK;
+}
+
+/* Lookup user information from a rid or username. */
+static NTSTATUS sam_query_user(struct winbindd_domain *domain,
+                           TALLOC_CTX *mem_ctx,
+                           const DOM_SID *user_sid,
+                           WINBIND_USERINFO *user_info)
+{
+        struct samu *sampass = NULL;
+        fstring sidstr;
+
+        ZERO_STRUCTP(user_info);
+
+        if (!sid_check_is_in_our_domain(user_sid)) {
+                return NT_STATUS_NO_SUCH_USER;
+        }
+
+        sid_to_string(sidstr, user_sid);
+        DEBUG(10,("sam_query_user: getting samu info for sid %s\n",
+                sidstr ));
+
+        if (!(sampass = samu_new(mem_ctx))) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (!pdb_getsampwsid(sampass, user_sid)) {
+                TALLOC_FREE(sampass);
+                return NT_STATUS_NO_SUCH_USER;
+        }
+
+        if (pdb_get_group_sid(sampass) == NULL) {
+                TALLOC_FREE(sampass);
+                return NT_STATUS_NO_SUCH_GROUP;
+        }
+
+        sid_to_string(sidstr, sampass->group_sid);
+        DEBUG(10,("sam_query_user: group sid %s\n", sidstr ));
+
+        sid_copy(&user_info->user_sid, user_sid);
+        sid_copy(&user_info->group_sid, sampass->group_sid);
+
+        user_info->acct_name = talloc_strdup(mem_ctx, sampass->username ?
+                                        sampass->username : "");
+        user_info->full_name = talloc_strdup(mem_ctx, sampass->full_name ?
+                                        sampass->full_name : "");
+        user_info->homedir = talloc_strdup(mem_ctx, sampass->home_dir ?
+                                        sampass->home_dir : "");
+        if (sampass->unix_pw && sampass->unix_pw->pw_shell) {
+                user_info->shell = talloc_strdup(mem_ctx, sampass->unix_pw->pw_shell);
+        } else {
+                user_info->shell = talloc_strdup(mem_ctx, "");
+        }
+        user_info->primary_gid = sampass->unix_pw ? sampass->unix_pw->pw_gid : (gid_t)-1;
+
+        TALLOC_FREE(sampass);
+        return NT_STATUS_OK;
+}
+
+/* Lookup group membership given a rid.   */
+static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
+                                TALLOC_CTX *mem_ctx,
+                                const DOM_SID *group_sid, uint32 *num_names,
+                                DOM_SID **sid_mem, char ***names,
                                 uint32 **name_types)
 {
@@ -304 +607 @@
 }
 
-/* find the sequence number for a domain */
-static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
-{
-        BOOL result;
-        time_t seq_num;
-
-        result = pdb_get_seq_num(&seq_num);
-        if (!result) {
-                *seq = 1;
-        }
-
-        *seq = (int) seq_num;
-        /* *seq = 1; */
-        return NT_STATUS_OK;
-}
-
-static NTSTATUS lockout_policy(struct winbindd_domain *domain,
-                               TALLOC_CTX *mem_ctx,
-                               SAM_UNK_INFO_12 *policy)
-{
-        /* actually we have that */
-        return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static NTSTATUS password_policy(struct winbindd_domain *domain,
-                                TALLOC_CTX *mem_ctx,
-                                SAM_UNK_INFO_1 *policy)
-{
-        uint32 min_pass_len,pass_hist,password_properties;
-        time_t u_expire, u_min_age;
-        NTTIME nt_expire, nt_min_age;
-        uint32 account_policy_temp;
-
-        if ((policy = TALLOC_ZERO_P(mem_ctx, SAM_UNK_INFO_1)) == NULL) {
-                return NT_STATUS_NO_MEMORY;
-        }
-
-        if (!pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        min_pass_len = account_policy_temp;
-
-        if (!pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        pass_hist = account_policy_temp;
-
-        if (!pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        password_properties = account_policy_temp;
-        
-        if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        u_expire = account_policy_temp;
-
-        if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp)) {
-                return NT_STATUS_ACCESS_DENIED;
-        }
-        u_min_age = account_policy_temp;
-
-        unix_to_nt_time_abs(&nt_expire, u_expire);
-        unix_to_nt_time_abs(&nt_min_age, u_min_age);
-
-        init_unk_info1(policy, (uint16)min_pass_len, (uint16)pass_hist, 
-                       password_properties, nt_expire, nt_min_age);
-
-        return NT_STATUS_OK;
-}
-
-/* get a list of trusted domains */
-static NTSTATUS trusted_domains(struct winbindd_domain *domain,
+/* get a list of trusted domains - sam */
+static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
                                 TALLOC_CTX *mem_ctx,
                                 uint32 *num_domains,
@@ -434 +666 @@
 
 /* the rpc backend methods are exposed via this structure */
-struct winbindd_methods passdb_methods = {
-        False,
-        query_user_list,
-        enum_dom_groups,
+struct winbindd_methods builtin_passdb_methods = {
+        false,
+        builtin_query_user_list,
+        builtin_enum_dom_groups,
         enum_local_groups,
         name_to_sid,
         sid_to_name,
         rids_to_names,
-        query_user,
+        builtin_query_user,
         lookup_usergroups,
         lookup_useraliases,
-        lookup_groupmem,
+        builtin_lookup_groupmem,
         sequence_number,
         lockout_policy,
         password_policy,
-        trusted_domains,
+        builtin_trusted_domains,
 };
+
+/* the rpc backend methods are exposed via this structure */
+struct winbindd_methods sam_passdb_methods = {
+        false,
+        sam_query_user_list,
+        sam_enum_dom_groups,
+        enum_local_groups,
+        name_to_sid,
+        sid_to_name,
+        rids_to_names,
+        sam_query_user,
+        lookup_usergroups,
+        lookup_useraliases,
+        sam_lookup_groupmem,
+        sequence_number,
+        lockout_policy,
+        password_policy,
+        sam_trusted_domains,
+};

branches/samba-3.0/source/nsswitch/winbindd_proto.h

@@ -20 +20 @@
 void request_finished_cont(void *private_data, BOOL success);
 void winbind_check_sighup(void);
-void winbind_check_sigterm(void);
+void winbind_check_sigterm(bool in_parent);
 int main(int argc, char **argv, char **envp);
 

branches/samba-3.0/source/nsswitch/winbindd_util.c

@@ -29 +29 @@
 
 extern struct winbindd_methods cache_methods;
-extern struct winbindd_methods passdb_methods;
+extern struct winbindd_methods builtin_passdb_methods;
+extern struct winbindd_methods sam_passdb_methods;
 
 /**
@@ -84 +85 @@
                 return False;
 
+        if ( IS_DC )
+                return sid_check_is_builtin(sid);
+
         return (sid_check_is_domain(sid) || sid_check_is_builtin(sid));
 }
@@ -91 +95 @@
         if (sid == NULL)
                 return False;
+
+        if ( IS_DC )
+                return sid_check_is_in_builtin(sid);
 
         return (sid_check_is_in_our_domain(sid) || sid_check_is_in_builtin(sid));
@@ -141 +148 @@
         ZERO_STRUCTP(domain);
 
-        /* prioritise the short name */
-        if (strchr_m(domain_name, '.') && alternative_name && *alternative_name) {
-                fstrcpy(domain->name, alternative_name);
-                fstrcpy(domain->alt_name, domain_name);
-        } else {
-                fstrcpy(domain->name, domain_name);
-                if (alternative_name) {
-                        fstrcpy(domain->alt_name, alternative_name);
-                }
+        fstrcpy(domain->name, domain_name);
+        if (alternative_name) {
+                fstrcpy(domain->alt_name, alternative_name);
         }
 
@@ -524 +525 @@
 
         domain = add_trusted_domain(get_global_sam_name(), NULL,
-                                    &passdb_methods, get_global_sam_sid());
+                                    &sam_passdb_methods, get_global_sam_sid());
         if ( role != ROLE_DOMAIN_MEMBER ) {
                 domain->primary = True;
@@ -532 +533 @@
         /* BUILTIN domain */
 
-        domain = add_trusted_domain("BUILTIN", NULL, &passdb_methods,
+        domain = add_trusted_domain("BUILTIN", NULL, &builtin_passdb_methods,
                                     &global_sid_Builtin);
         setup_domain_child(domain, &domain->child, NULL);