source/groupdb/mapping.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-2000,
   5  *  Copyright (C) Jean François Micouleau      1998-2001.
   6  *
   7  *  This program is free software; you can redistribute it and/or modify
   8  *  it under the terms of the GNU General Public License as published by
   9  *  the Free Software Foundation; either version 2 of the License, or
  10  *  (at your option) any later version.
  11  *
  12  *  This program is distributed in the hope that it will be useful,
  13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15  *  GNU General Public License for more details.
  16  *
  17  *  You should have received a copy of the GNU General Public License
  18  *  along with this program; if not, write to the Free Software
  19  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  20  */
  21
  22 #include "includes.h"
  23
  24 extern DOM_SID global_sid_Builtin;
  25
  26 static TDB_CONTEXT *tdb; /* used for driver files */
  27
  28 #define DATABASE_VERSION_V1 1 /* native byte format. */
  29 #define DATABASE_VERSION_V2 2 /* le format. */
  30
  31 #define GROUP_PREFIX "UNIXGROUP/"
  32
  33 /* Alias memberships are stored reverse, as memberships. The performance
  34  * critical operation is to determine the aliases a SID is member of, not
  35  * listing alias members. So we store a list of alias SIDs a SID is member of
  36  * hanging of the member as key.
  37  */
  38 #define MEMBEROF_PREFIX "MEMBEROF/"
  39
  40 /****************************************************************************
  41 dump the mapping group mapping to a text file
  42 ****************************************************************************/
  43 char *decode_sid_name_use(fstring group, enum SID_NAME_USE name_use)
  44 {
  45         static fstring group_type;
  46
  47         switch(name_use) {
  48                 case SID_NAME_USER:
  49                         fstrcpy(group_type,"User");
  50                         break;
  51                 case SID_NAME_DOM_GRP:
  52                         fstrcpy(group_type,"Domain group");
  53                         break;
  54                 case SID_NAME_DOMAIN:
  55                         fstrcpy(group_type,"Domain");
  56                         break;
  57                 case SID_NAME_ALIAS:
  58                         fstrcpy(group_type,"Local group");
  59                         break;
  60                 case SID_NAME_WKN_GRP:
  61                         fstrcpy(group_type,"Builtin group");
  62                         break;
  63                 case SID_NAME_DELETED:
  64                         fstrcpy(group_type,"Deleted");
  65                         break;
  66                 case SID_NAME_INVALID:
  67                         fstrcpy(group_type,"Invalid");
  68                         break;
  69                 case SID_NAME_UNKNOWN:
  70                 default:
  71                         fstrcpy(group_type,"Unknown type");
  72                         break;
  73         }
  74
  75         fstrcpy(group, group_type);
  76         return group_type;
  77 }
  78
  79 /****************************************************************************
  80 initialise first time the mapping list - called from init_group_mapping()
  81 ****************************************************************************/
  82 static BOOL default_group_mapping(void)
  83 {
  84         DOM_SID sid_admins;
  85         DOM_SID sid_users;
  86         DOM_SID sid_guests;
  87         fstring str_admins;
  88         fstring str_users;
  89         fstring str_guests;
  90
  91         /* Add the Wellknown groups */
  92
  93         add_initial_entry(-1, "S-1-5-32-544", SID_NAME_WKN_GRP, "Administrators", "");
  94         add_initial_entry(-1, "S-1-5-32-545", SID_NAME_WKN_GRP, "Users", "");
  95         add_initial_entry(-1, "S-1-5-32-546", SID_NAME_WKN_GRP, "Guests", "");
  96         add_initial_entry(-1, "S-1-5-32-547", SID_NAME_WKN_GRP, "Power Users", "");
  97         add_initial_entry(-1, "S-1-5-32-548", SID_NAME_WKN_GRP, "Account Operators", "");
  98         add_initial_entry(-1, "S-1-5-32-549", SID_NAME_WKN_GRP, "System Operators", "");
  99         add_initial_entry(-1, "S-1-5-32-550", SID_NAME_WKN_GRP, "Print Operators", "");
 100         add_initial_entry(-1, "S-1-5-32-551", SID_NAME_WKN_GRP, "Backup Operators", "");
 101         add_initial_entry(-1, "S-1-5-32-552", SID_NAME_WKN_GRP, "Replicators", "");
 102
 103         /* Add the defaults domain groups */
 104
 105         sid_copy(&sid_admins, get_global_sam_sid());
 106         sid_append_rid(&sid_admins, DOMAIN_GROUP_RID_ADMINS);
 107         sid_to_string(str_admins, &sid_admins);
 108         add_initial_entry(-1, str_admins, SID_NAME_DOM_GRP, "Domain Admins", "");
 109
 110         sid_copy(&sid_users,  get_global_sam_sid());
 111         sid_append_rid(&sid_users,  DOMAIN_GROUP_RID_USERS);
 112         sid_to_string(str_users, &sid_users);
 113         add_initial_entry(-1, str_users,  SID_NAME_DOM_GRP, "Domain Users",  "");
 114
 115         sid_copy(&sid_guests, get_global_sam_sid());
 116         sid_append_rid(&sid_guests, DOMAIN_GROUP_RID_GUESTS);
 117         sid_to_string(str_guests, &sid_guests);
 118         add_initial_entry(-1, str_guests, SID_NAME_DOM_GRP, "Domain Guests", "");
 119
 120         return True;
 121 }
 122
 123 /****************************************************************************
 124  Open the group mapping tdb.
 125 ****************************************************************************/
 126
 127 static BOOL init_group_mapping(void)
 128 {
 129         const char *vstring = "INFO/version";
 130         int32 vers_id;
 131
 132         if (tdb)
 133                 return True;
 134         tdb = tdb_open_log(lock_path("group_mapping.tdb"), 0, TDB_DEFAULT, O_RDWR|O_CREAT, 0600);
 135         if (!tdb) {
 136                 DEBUG(0,("Failed to open group mapping database\n"));
 137                 return False;
 138         }
 139
 140         /* handle a Samba upgrade */
 141         tdb_lock_bystring(tdb, vstring, 0);
 142
 143         /* Cope with byte-reversed older versions of the db. */
 144         vers_id = tdb_fetch_int32(tdb, vstring);
 145         if ((vers_id == DATABASE_VERSION_V1) || (IREV(vers_id) == DATABASE_VERSION_V1)) {
 146                 /* Written on a bigendian machine with old fetch_int code. Save as le. */
 147                 tdb_store_int32(tdb, vstring, DATABASE_VERSION_V2);
 148                 vers_id = DATABASE_VERSION_V2;
 149         }
 150
 151         if (vers_id != DATABASE_VERSION_V2) {
 152                 tdb_traverse(tdb, tdb_traverse_delete_fn, NULL);
 153                 tdb_store_int32(tdb, vstring, DATABASE_VERSION_V2);
 154         }
 155
 156         tdb_unlock_bystring(tdb, vstring);
 157
 158         /* write a list of default groups */
 159         if(!default_group_mapping())
 160                 return False;
 161
 162         return True;
 163 }
 164
 165 /****************************************************************************
 166 ****************************************************************************/
 167 static BOOL add_mapping_entry(GROUP_MAP *map, int flag)
 168 {
 169         TDB_DATA kbuf, dbuf;
 170         pstring key, buf;
 171         fstring string_sid="";
 172         int len;
 173
 174         if(!init_group_mapping()) {
 175                 DEBUG(0,("failed to initialize group mapping\n"));
 176                 return(False);
 177         }
 178
 179         sid_to_string(string_sid, &map->sid);
 180
 181         len = tdb_pack(buf, sizeof(buf), "ddff",
 182                         map->gid, map->sid_name_use, map->nt_name, map->comment);
 183
 184         if (len > sizeof(buf))
 185                 return False;
 186
 187         slprintf(key, sizeof(key), "%s%s", GROUP_PREFIX, string_sid);
 188
 189         kbuf.dsize = strlen(key)+1;
 190         kbuf.dptr = key;
 191         dbuf.dsize = len;
 192         dbuf.dptr = buf;
 193         if (tdb_store(tdb, kbuf, dbuf, flag) != 0) return False;
 194
 195         return True;
 196 }
 197
 198 /****************************************************************************
 199 initialise first time the mapping list
 200 ****************************************************************************/
 201 BOOL add_initial_entry(gid_t gid, const char *sid, enum SID_NAME_USE sid_name_use, const char *nt_name, const char *comment)
 202 {
 203         GROUP_MAP map;
 204
 205         if(!init_group_mapping()) {
 206                 DEBUG(0,("failed to initialize group mapping\n"));
 207                 return(False);
 208         }
 209
 210         map.gid=gid;
 211         if (!string_to_sid(&map.sid, sid)) {
 212                 DEBUG(0, ("string_to_sid failed: %s", sid));
 213                 return False;
 214         }
 215
 216         map.sid_name_use=sid_name_use;
 217         fstrcpy(map.nt_name, nt_name);
 218         fstrcpy(map.comment, comment);
 219
 220         return pdb_add_group_mapping_entry(&map);
 221 }
 222
 223 /****************************************************************************
 224  Return the sid and the type of the unix group.
 225 ****************************************************************************/
 226
 227 static BOOL get_group_map_from_sid(DOM_SID sid, GROUP_MAP *map)
 228 {
 229         TDB_DATA kbuf, dbuf;
 230         pstring key;
 231         fstring string_sid;
 232         int ret = 0;
 233
 234         if(!init_group_mapping()) {
 235                 DEBUG(0,("failed to initialize group mapping\n"));
 236                 return(False);
 237         }
 238
 239         /* the key is the SID, retrieving is direct */
 240
 241         sid_to_string(string_sid, &sid);
 242         slprintf(key, sizeof(key), "%s%s", GROUP_PREFIX, string_sid);
 243
 244         kbuf.dptr = key;
 245         kbuf.dsize = strlen(key)+1;
 246
 247         dbuf = tdb_fetch(tdb, kbuf);
 248         if (!dbuf.dptr)
 249                 return False;
 250
 251         ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
 252                                 &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 253
 254         SAFE_FREE(dbuf.dptr);
 255
 256         if ( ret == -1 ) {
 257                 DEBUG(3,("get_group_map_from_sid: tdb_unpack failure\n"));
 258                 return False;
 259         }
 260
 261         sid_copy(&map->sid, &sid);
 262
 263         return True;
 264 }
 265
 266 /****************************************************************************
 267  Return the sid and the type of the unix group.
 268 ****************************************************************************/
 269
 270 static BOOL get_group_map_from_gid(gid_t gid, GROUP_MAP *map)
 271 {
 272         TDB_DATA kbuf, dbuf, newkey;
 273         fstring string_sid;
 274         int ret;
 275
 276         if(!init_group_mapping()) {
 277                 DEBUG(0,("failed to initialize group mapping\n"));
 278                 return(False);
 279         }
 280
 281         /* we need to enumerate the TDB to find the GID */
 282
 283         for (kbuf = tdb_firstkey(tdb);
 284              kbuf.dptr;
 285              newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
 286
 287                 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0) continue;
 288
 289                 dbuf = tdb_fetch(tdb, kbuf);
 290                 if (!dbuf.dptr)
 291                         continue;
 292
 293                 fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX));
 294
 295                 string_to_sid(&map->sid, string_sid);
 296
 297                 ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
 298                                  &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 299
 300                 SAFE_FREE(dbuf.dptr);
 301
 302                 if ( ret == -1 ) {
 303                         DEBUG(3,("get_group_map_from_gid: tdb_unpack failure\n"));
 304                         return False;
 305                 }
 306
 307                 if (gid==map->gid) {
 308                         SAFE_FREE(kbuf.dptr);
 309                         return True;
 310                 }
 311         }
 312
 313         return False;
 314 }
 315
 316 /****************************************************************************
 317  Return the sid and the type of the unix group.
 318 ****************************************************************************/
 319
 320 static BOOL get_group_map_from_ntname(const char *name, GROUP_MAP *map)
 321 {
 322         TDB_DATA kbuf, dbuf, newkey;
 323         fstring string_sid;
 324         int ret;
 325
 326         if(!init_group_mapping()) {
 327                 DEBUG(0,("get_group_map_from_ntname:failed to initialize group mapping\n"));
 328                 return(False);
 329         }
 330
 331         /* we need to enumerate the TDB to find the name */
 332
 333         for (kbuf = tdb_firstkey(tdb);
 334              kbuf.dptr;
 335              newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
 336
 337                 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0) continue;
 338
 339                 dbuf = tdb_fetch(tdb, kbuf);
 340                 if (!dbuf.dptr)
 341                         continue;
 342
 343                 fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX));
 344
 345                 string_to_sid(&map->sid, string_sid);
 346
 347                 ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
 348                                  &map->gid, &map->sid_name_use, &map->nt_name, &map->comment);
 349
 350                 SAFE_FREE(dbuf.dptr);
 351
 352                 if ( ret == -1 ) {
 353                         DEBUG(3,("get_group_map_from_ntname: tdb_unpack failure\n"));
 354                         return False;
 355                 }
 356
 357                 if (StrCaseCmp(name, map->nt_name)==0) {
 358                         SAFE_FREE(kbuf.dptr);
 359                         return True;
 360                 }
 361         }
 362
 363         return False;
 364 }
 365
 366 /****************************************************************************
 367  Remove a group mapping entry.
 368 ****************************************************************************/
 369
 370 static BOOL group_map_remove(DOM_SID sid)
 371 {
 372         TDB_DATA kbuf, dbuf;
 373         pstring key;
 374         fstring string_sid;
 375
 376         if(!init_group_mapping()) {
 377                 DEBUG(0,("failed to initialize group mapping\n"));
 378                 return(False);
 379         }
 380
 381         /* the key is the SID, retrieving is direct */
 382
 383         sid_to_string(string_sid, &sid);
 384         slprintf(key, sizeof(key), "%s%s", GROUP_PREFIX, string_sid);
 385
 386         kbuf.dptr = key;
 387         kbuf.dsize = strlen(key)+1;
 388
 389         dbuf = tdb_fetch(tdb, kbuf);
 390         if (!dbuf.dptr)
 391                 return False;
 392
 393         SAFE_FREE(dbuf.dptr);
 394
 395         if(tdb_delete(tdb, kbuf) != TDB_SUCCESS)
 396                 return False;
 397
 398         return True;
 399 }
 400
 401 /****************************************************************************
 402  Enumerate the group mapping.
 403 ****************************************************************************/
 404
 405 static BOOL enum_group_mapping(enum SID_NAME_USE sid_name_use, GROUP_MAP **rmap,
 406                         int *num_entries, BOOL unix_only)
 407 {
 408         TDB_DATA kbuf, dbuf, newkey;
 409         fstring string_sid;
 410         fstring group_type;
 411         GROUP_MAP map;
 412         GROUP_MAP *mapt;
 413         int ret;
 414         int entries=0;
 415
 416         if(!init_group_mapping()) {
 417                 DEBUG(0,("failed to initialize group mapping\n"));
 418                 return(False);
 419         }
 420
 421         *num_entries=0;
 422         *rmap=NULL;
 423
 424         for (kbuf = tdb_firstkey(tdb);
 425              kbuf.dptr;
 426              newkey = tdb_nextkey(tdb, kbuf), safe_free(kbuf.dptr), kbuf=newkey) {
 427
 428                 if (strncmp(kbuf.dptr, GROUP_PREFIX, strlen(GROUP_PREFIX)) != 0)
 429                         continue;
 430
 431                 dbuf = tdb_fetch(tdb, kbuf);
 432                 if (!dbuf.dptr)
 433                         continue;
 434
 435                 fstrcpy(string_sid, kbuf.dptr+strlen(GROUP_PREFIX));
 436
 437                 ret = tdb_unpack(dbuf.dptr, dbuf.dsize, "ddff",
 438                                  &map.gid, &map.sid_name_use, &map.nt_name, &map.comment);
 439
 440                 SAFE_FREE(dbuf.dptr);
 441
 442                 if ( ret == -1 ) {
 443                         DEBUG(3,("enum_group_mapping: tdb_unpack failure\n"));
 444                         continue;
 445                 }
 446
 447                 /* list only the type or everything if UNKNOWN */
 448                 if (sid_name_use!=SID_NAME_UNKNOWN  && sid_name_use!=map.sid_name_use) {
 449                         DEBUG(11,("enum_group_mapping: group %s is not of the requested type\n", map.nt_name));
 450                         continue;
 451                 }
 452
 453                 if (unix_only==ENUM_ONLY_MAPPED && map.gid==-1) {
 454                         DEBUG(11,("enum_group_mapping: group %s is non mapped\n", map.nt_name));
 455                         continue;
 456                 }
 457
 458                 string_to_sid(&map.sid, string_sid);
 459
 460                 decode_sid_name_use(group_type, map.sid_name_use);
 461                 DEBUG(11,("enum_group_mapping: returning group %s of type %s\n", map.nt_name ,group_type));
 462
 463                 mapt= SMB_REALLOC_ARRAY((*rmap), GROUP_MAP, entries+1);
 464                 if (!mapt) {
 465                         DEBUG(0,("enum_group_mapping: Unable to enlarge group map!\n"));
 466                         SAFE_FREE(*rmap);
 467                         return False;
 468                 }
 469                 else
 470                         (*rmap) = mapt;
 471
 472                 mapt[entries].gid = map.gid;
 473                 sid_copy( &mapt[entries].sid, &map.sid);
 474                 mapt[entries].sid_name_use = map.sid_name_use;
 475                 fstrcpy(mapt[entries].nt_name, map.nt_name);
 476                 fstrcpy(mapt[entries].comment, map.comment);
 477
 478                 entries++;
 479
 480         }
 481
 482         *num_entries=entries;
 483
 484         return True;
 485 }
 486
 487 /* This operation happens on session setup, so it should better be fast. We
 488  * store a list of aliases a SID is member of hanging off MEMBEROF/SID. */
 489
 490 static NTSTATUS one_alias_membership(const DOM_SID *member,
 491                                      DOM_SID **sids, int *num)
 492 {
 493         fstring key, string_sid;
 494         TDB_DATA kbuf, dbuf;
 495         const char *p;
 496
 497         if (!init_group_mapping()) {
 498                 DEBUG(0,("failed to initialize group mapping\n"));
 499                 return NT_STATUS_ACCESS_DENIED;
 500         }
 501
 502         sid_to_string(string_sid, member);
 503         slprintf(key, sizeof(key), "%s%s", MEMBEROF_PREFIX, string_sid);
 504
 505         kbuf.dsize = strlen(key)+1;
 506         kbuf.dptr = key;
 507
 508         dbuf = tdb_fetch(tdb, kbuf);
 509
 510         if (dbuf.dptr == NULL) {
 511                 return NT_STATUS_OK;
 512         }
 513
 514         p = dbuf.dptr;
 515
 516         while (next_token(&p, string_sid, " ", sizeof(string_sid))) {
 517
 518                 DOM_SID alias;
 519
 520                 if (!string_to_sid(&alias, string_sid))
 521                         continue;
 522
 523                 add_sid_to_array_unique(NULL, &alias, sids, num);
 524
 525                 if (sids == NULL)
 526                         return NT_STATUS_NO_MEMORY;
 527         }
 528
 529         SAFE_FREE(dbuf.dptr);
 530         return NT_STATUS_OK;
 531 }
 532
 533 static NTSTATUS alias_memberships(const DOM_SID *members, int num_members,
 534                                   DOM_SID **sids, int *num)
 535 {
 536         int i;
 537
 538         *num = 0;
 539         *sids = NULL;
 540
 541         for (i=0; i<num_members; i++) {
 542                 NTSTATUS status = one_alias_membership(&members[i], sids, num);
 543                 if (!NT_STATUS_IS_OK(status))
 544                         return status;
 545         }
 546         return NT_STATUS_OK;
 547 }
 548
 549 static BOOL is_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 550 {
 551         DOM_SID *sids;
 552         int i, num;
 553
 554         /* This feels the wrong way round, but the on-disk data structure
 555          * dictates it this way. */
 556         if (!NT_STATUS_IS_OK(alias_memberships(member, 1, &sids, &num)))
 557                 return False;
 558
 559         for (i=0; i<num; i++) {
 560                 if (sid_compare(alias, &sids[i]) == 0) {
 561                         SAFE_FREE(sids);
 562                         return True;
 563                 }
 564         }
 565         SAFE_FREE(sids);
 566         return False;
 567 }
 568
 569 static NTSTATUS add_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 570 {
 571         GROUP_MAP map;
 572         TDB_DATA kbuf, dbuf;
 573         pstring key;
 574         fstring string_sid;
 575         char *new_memberstring;
 576         int result;
 577
 578         if(!init_group_mapping()) {
 579                 DEBUG(0,("failed to initialize group mapping\n"));
 580                 return NT_STATUS_ACCESS_DENIED;
 581         }
 582
 583         if (!get_group_map_from_sid(*alias, &map))
 584                 return NT_STATUS_NO_SUCH_ALIAS;
 585
 586         if ( (map.sid_name_use != SID_NAME_ALIAS) &&
 587              (map.sid_name_use != SID_NAME_WKN_GRP) )
 588                 return NT_STATUS_NO_SUCH_ALIAS;
 589
 590         if (is_aliasmem(alias, member))
 591                 return NT_STATUS_MEMBER_IN_ALIAS;
 592
 593         sid_to_string(string_sid, member);
 594         slprintf(key, sizeof(key), "%s%s", MEMBEROF_PREFIX, string_sid);
 595
 596         kbuf.dsize = strlen(key)+1;
 597         kbuf.dptr = key;
 598
 599         dbuf = tdb_fetch(tdb, kbuf);
 600
 601         sid_to_string(string_sid, alias);
 602
 603         if (dbuf.dptr != NULL) {
 604                 asprintf(&new_memberstring, "%s %s", (char *)(dbuf.dptr),
 605                          string_sid);
 606         } else {
 607                 new_memberstring = SMB_STRDUP(string_sid);
 608         }
 609
 610         if (new_memberstring == NULL)
 611                 return NT_STATUS_NO_MEMORY;
 612
 613         SAFE_FREE(dbuf.dptr);
 614         dbuf.dsize = strlen(new_memberstring)+1;
 615         dbuf.dptr = new_memberstring;
 616
 617         result = tdb_store(tdb, kbuf, dbuf, 0);
 618
 619         SAFE_FREE(new_memberstring);
 620
 621         return (result == 0 ? NT_STATUS_OK : NT_STATUS_ACCESS_DENIED);
 622 }
 623
 624 struct aliasmem_closure {
 625         const DOM_SID *alias;
 626         DOM_SID **sids;
 627         int *num;
 628 };
 629
 630 static int collect_aliasmem(TDB_CONTEXT *tdb_ctx, TDB_DATA key, TDB_DATA data,
 631                             void *state)
 632 {
 633         struct aliasmem_closure *closure = (struct aliasmem_closure *)state;
 634         const char *p;
 635         fstring alias_string;
 636
 637         if (strncmp(key.dptr, MEMBEROF_PREFIX,
 638                     strlen(MEMBEROF_PREFIX)) != 0)
 639                 return 0;
 640
 641         p = data.dptr;
 642
 643         while (next_token(&p, alias_string, " ", sizeof(alias_string))) {
 644
 645                 DOM_SID alias, member;
 646                 const char *member_string;
 647
 648
 649                 if (!string_to_sid(&alias, alias_string))
 650                         continue;
 651
 652                 if (sid_compare(closure->alias, &alias) != 0)
 653                         continue;
 654
 655                 /* Ok, we found the alias we're looking for in the membership
 656                  * list currently scanned. The key represents the alias
 657                  * member. Add that. */
 658
 659                 member_string = strchr(key.dptr, '/');
 660
 661                 /* Above we tested for MEMBEROF_PREFIX which includes the
 662                  * slash. */
 663
 664                 SMB_ASSERT(member_string != NULL);
 665                 member_string += 1;
 666
 667                 if (!string_to_sid(&member, member_string))
 668                         continue;
 669
 670                 add_sid_to_array(NULL, &member, closure->sids, closure->num);
 671         }
 672
 673         return 0;
 674 }
 675
 676 static NTSTATUS enum_aliasmem(const DOM_SID *alias, DOM_SID **sids, int *num)
 677 {
 678         GROUP_MAP map;
 679         struct aliasmem_closure closure;
 680
 681         if(!init_group_mapping()) {
 682                 DEBUG(0,("failed to initialize group mapping\n"));
 683                 return NT_STATUS_ACCESS_DENIED;
 684         }
 685
 686         if (!get_group_map_from_sid(*alias, &map))
 687                 return NT_STATUS_NO_SUCH_ALIAS;
 688
 689         if ( (map.sid_name_use != SID_NAME_ALIAS) &&
 690              (map.sid_name_use != SID_NAME_WKN_GRP) )
 691                 return NT_STATUS_NO_SUCH_ALIAS;
 692
 693         *sids = NULL;
 694         *num = 0;
 695
 696         closure.alias = alias;
 697         closure.sids = sids;
 698         closure.num = num;
 699
 700         tdb_traverse(tdb, collect_aliasmem, &closure);
 701         return NT_STATUS_OK;
 702 }
 703
 704 static NTSTATUS del_aliasmem(const DOM_SID *alias, const DOM_SID *member)
 705 {
 706         NTSTATUS result;
 707         DOM_SID *sids;
 708         int i, num;
 709         BOOL found = False;
 710         char *member_string;
 711         TDB_DATA kbuf, dbuf;
 712         pstring key;
 713         fstring sid_string;
 714
 715         result = alias_memberships(member, 1, &sids, &num);
 716
 717         if (!NT_STATUS_IS_OK(result))
 718                 return result;
 719
 720         for (i=0; i<num; i++) {
 721                 if (sid_compare(&sids[i], alias) == 0) {
 722                         found = True;
 723                         break;
 724                 }
 725         }
 726
 727         if (!found) {
 728                 SAFE_FREE(sids);
 729                 return NT_STATUS_MEMBER_NOT_IN_ALIAS;
 730         }
 731
 732         if (i < num)
 733                 sids[i] = sids[num-1];
 734
 735         num -= 1;
 736
 737         sid_to_string(sid_string, member);
 738         slprintf(key, sizeof(key), "%s%s", MEMBEROF_PREFIX, sid_string);
 739
 740         kbuf.dsize = strlen(key)+1;
 741         kbuf.dptr = key;
 742
 743         if (num == 0)
 744                 return tdb_delete(tdb, kbuf) == 0 ?
 745                         NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
 746
 747         member_string = SMB_STRDUP("");
 748
 749         if (member_string == NULL) {
 750                 SAFE_FREE(sids);
 751                 return NT_STATUS_NO_MEMORY;
 752         }
 753
 754         for (i=0; i<num; i++) {
 755                 char *s = member_string;
 756
 757                 sid_to_string(sid_string, &sids[i]);
 758                 asprintf(&member_string, "%s %s", s, sid_string);
 759
 760                 SAFE_FREE(s);
 761                 if (member_string == NULL) {
 762                         SAFE_FREE(sids);
 763                         return NT_STATUS_NO_MEMORY;
 764                 }
 765         }
 766
 767         dbuf.dsize = strlen(member_string)+1;
 768         dbuf.dptr = member_string;
 769
 770         result = tdb_store(tdb, kbuf, dbuf, 0) == 0 ?
 771                 NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
 772
 773         SAFE_FREE(sids);
 774         SAFE_FREE(member_string);
 775
 776         return result;
 777 }
 778
 779 /*
 780  *
 781  * High level functions
 782  * better to use them than the lower ones.
 783  *
 784  * we are checking if the group is in the mapping file
 785  * and if the group is an existing unix group
 786  *
 787  */
 788
 789 /* get a domain group from it's SID */
 790
 791 BOOL get_domain_group_from_sid(DOM_SID sid, GROUP_MAP *map)
 792 {
 793         struct group *grp;
 794         BOOL ret;
 795
 796         if(!init_group_mapping()) {
 797                 DEBUG(0,("failed to initialize group mapping\n"));
 798                 return(False);
 799         }
 800
 801         DEBUG(10, ("get_domain_group_from_sid\n"));
 802
 803         /* if the group is NOT in the database, it CAN NOT be a domain group */
 804
 805         become_root();
 806         ret = pdb_getgrsid(map, sid);
 807         unbecome_root();
 808
 809         if ( !ret )
 810                 return False;
 811
 812         DEBUG(10, ("get_domain_group_from_sid: SID found in the TDB\n"));
 813
 814         /* if it's not a domain group, continue */
 815         if (map->sid_name_use!=SID_NAME_DOM_GRP) {
 816                 return False;
 817         }
 818
 819         DEBUG(10, ("get_domain_group_from_sid: SID is a domain group\n"));
 820
 821         if (map->gid==-1) {
 822                 return False;
 823         }
 824
 825         DEBUG(10, ("get_domain_group_from_sid: SID is mapped to gid:%lu\n",(unsigned long)map->gid));
 826
 827         grp = getgrgid(map->gid);
 828         if ( !grp ) {
 829                 DEBUG(10, ("get_domain_group_from_sid: gid DOESN'T exist in UNIX security\n"));
 830                 return False;
 831         }
 832
 833         DEBUG(10, ("get_domain_group_from_sid: gid exists in UNIX security\n"));
 834
 835         return True;
 836 }
 837
 838
 839 /* get a local (alias) group from it's SID */
 840
 841 BOOL get_local_group_from_sid(DOM_SID *sid, GROUP_MAP *map)
 842 {
 843         BOOL ret;
 844
 845         if(!init_group_mapping()) {
 846                 DEBUG(0,("failed to initialize group mapping\n"));
 847                 return(False);
 848         }
 849
 850         /* The group is in the mapping table */
 851         become_root();
 852         ret = pdb_getgrsid(map, *sid);
 853         unbecome_root();
 854
 855         if ( !ret )
 856                 return False;
 857
 858         if ( ( (map->sid_name_use != SID_NAME_ALIAS) &&
 859                (map->sid_name_use != SID_NAME_WKN_GRP) )
 860                 || (map->gid == -1)
 861                 || (getgrgid(map->gid) == NULL) )
 862         {
 863                 return False;
 864         }
 865
 866 #if 1   /* JERRY */
 867         /* local groups only exist in the group mapping DB so this
 868            is not necessary */
 869
 870         else {
 871                 /* the group isn't in the mapping table.
 872                  * make one based on the unix information */
 873                 uint32 alias_rid;
 874                 struct group *grp;
 875
 876                 sid_peek_rid(sid, &alias_rid);
 877                 map->gid=pdb_group_rid_to_gid(alias_rid);
 878
 879                 grp = getgrgid(map->gid);
 880                 if ( !grp ) {
 881                         DEBUG(3,("get_local_group_from_sid: No unix group for [%ul]\n", map->gid));
 882                         return False;
 883                 }
 884
 885                 map->sid_name_use=SID_NAME_ALIAS;
 886
 887                 fstrcpy(map->nt_name, grp->gr_name);
 888                 fstrcpy(map->comment, "Local Unix Group");
 889
 890                 sid_copy(&map->sid, sid);
 891         }
 892 #endif
 893
 894         return True;
 895 }
 896
 897 /* get a builtin group from it's SID */
 898
 899 BOOL get_builtin_group_from_sid(DOM_SID *sid, GROUP_MAP *map)
 900 {
 901         struct group *grp;
 902         BOOL ret;
 903
 904
 905         if(!init_group_mapping()) {
 906                 DEBUG(0,("failed to initialize group mapping\n"));
 907                 return(False);
 908         }
 909
 910         become_root();
 911         ret = pdb_getgrsid(map, *sid);
 912         unbecome_root();
 913
 914         if ( !ret )
 915                 return False;
 916
 917         if (map->sid_name_use!=SID_NAME_WKN_GRP) {
 918                 return False;
 919         }
 920
 921         if (map->gid==-1) {
 922                 return False;
 923         }
 924
 925         if ( (grp=getgrgid(map->gid)) == NULL) {
 926                 return False;
 927         }
 928
 929         return True;
 930 }
 931
 932
 933
 934 /****************************************************************************
 935 Returns a GROUP_MAP struct based on the gid.
 936 ****************************************************************************/
 937 BOOL get_group_from_gid(gid_t gid, GROUP_MAP *map)
 938 {
 939         struct group *grp;
 940         BOOL ret;
 941
 942         if(!init_group_mapping()) {
 943                 DEBUG(0,("failed to initialize group mapping\n"));
 944                 return(False);
 945         }
 946
 947         if ( (grp=getgrgid(gid)) == NULL)
 948                 return False;
 949
 950         become_root();
 951         ret = pdb_getgrgid(map, gid);
 952         unbecome_root();
 953
 954         if ( !ret ) {
 955                 return False;
 956         }
 957
 958         return True;
 959 }
 960
 961
 962 /****************************************************************************
 963  Create a UNIX group on demand.
 964 ****************************************************************************/
 965
 966 int smb_create_group(char *unix_group, gid_t *new_gid)
 967 {
 968         pstring add_script;
 969         int     ret = -1;
 970         int     fd = 0;
 971
 972         *new_gid = 0;
 973
 974         /* defer to scripts */
 975
 976         if ( *lp_addgroup_script() ) {
 977                 pstrcpy(add_script, lp_addgroup_script());
 978                 pstring_sub(add_script, "%g", unix_group);
 979                 ret = smbrun(add_script, (new_gid!=NULL) ? &fd : NULL);
 980                 DEBUG(ret ? 0 : 3,("smb_create_group: Running the command `%s' gave %d\n",add_script,ret));
 981                 if (ret != 0)
 982                         return ret;
 983
 984                 if (fd != 0) {
 985                         fstring output;
 986
 987                         *new_gid = 0;
 988                         if (read(fd, output, sizeof(output)) > 0) {
 989                                 *new_gid = (gid_t)strtoul(output, NULL, 10);
 990                         }
 991
 992                         close(fd);
 993                 }
 994
 995         } else if ( winbind_create_group( unix_group, NULL ) ) {
 996
 997                 DEBUG(3,("smb_create_group: winbindd created the group (%s)\n",
 998                         unix_group));
 999                 ret = 0;
1000         }
1001
1002         if (*new_gid == 0) {
1003                 struct group *grp = getgrnam(unix_group);
1004
1005                 if (grp != NULL)
1006                         *new_gid = grp->gr_gid;
1007         }
1008
1009         return ret;
1010 }
1011
1012 /****************************************************************************
1013  Delete a UNIX group on demand.
1014 ****************************************************************************/
1015
1016 int smb_delete_group(char *unix_group)
1017 {
1018         pstring del_script;
1019         int ret;
1020
1021         /* defer to scripts */
1022
1023         if ( *lp_delgroup_script() ) {
1024                 pstrcpy(del_script, lp_delgroup_script());
1025                 pstring_sub(del_script, "%g", unix_group);
1026                 ret = smbrun(del_script,NULL);
1027                 DEBUG(ret ? 0 : 3,("smb_delete_group: Running the command `%s' gave %d\n",del_script,ret));
1028                 return ret;
1029         }
1030
1031         if ( winbind_delete_group( unix_group ) ) {
1032                 DEBUG(3,("smb_delete_group: winbindd deleted the group (%s)\n",
1033                         unix_group));
1034                 return 0;
1035         }
1036
1037         return -1;
1038 }
1039
1040 /****************************************************************************
1041  Set a user's primary UNIX group.
1042 ****************************************************************************/
1043 int smb_set_primary_group(const char *unix_group, const char* unix_user)
1044 {
1045         pstring add_script;
1046         int ret;
1047
1048         /* defer to scripts */
1049
1050         if ( *lp_setprimarygroup_script() ) {
1051                 pstrcpy(add_script, lp_setprimarygroup_script());
1052                 all_string_sub(add_script, "%g", unix_group, sizeof(add_script));
1053                 all_string_sub(add_script, "%u", unix_user, sizeof(add_script));
1054                 ret = smbrun(add_script,NULL);
1055                 flush_pwnam_cache();
1056                 DEBUG(ret ? 0 : 3,("smb_set_primary_group: "
1057                          "Running the command `%s' gave %d\n",add_script,ret));
1058                 return ret;
1059         }
1060
1061         /* Try winbindd */
1062
1063         if ( winbind_set_user_primary_group( unix_user, unix_group ) ) {
1064                 DEBUG(3,("smb_delete_group: winbindd set the group (%s) as the primary group for user (%s)\n",
1065                         unix_group, unix_user));
1066                 flush_pwnam_cache();
1067                 return 0;
1068         }
1069
1070         return -1;
1071 }
1072
1073 /****************************************************************************
1074  Add a user to a UNIX group.
1075 ****************************************************************************/
1076
1077 int smb_add_user_group(char *unix_group, char *unix_user)
1078 {
1079         pstring add_script;
1080         int ret;
1081
1082         /* defer to scripts */
1083
1084         if ( *lp_addusertogroup_script() ) {
1085                 pstrcpy(add_script, lp_addusertogroup_script());
1086                 pstring_sub(add_script, "%g", unix_group);
1087                 pstring_sub(add_script, "%u", unix_user);
1088                 ret = smbrun(add_script,NULL);
1089                 DEBUG(ret ? 0 : 3,("smb_add_user_group: Running the command `%s' gave %d\n",add_script,ret));
1090                 return ret;
1091         }
1092
1093         /* Try winbindd */
1094
1095         if ( winbind_add_user_to_group( unix_user, unix_group ) ) {
1096                 DEBUG(3,("smb_delete_group: winbindd added user (%s) to the group (%s)\n",
1097                         unix_user, unix_group));
1098                 return -1;
1099         }
1100
1101         return -1;
1102 }
1103
1104 /****************************************************************************
1105  Delete a user from a UNIX group
1106 ****************************************************************************/
1107
1108 int smb_delete_user_group(const char *unix_group, const char *unix_user)
1109 {
1110         pstring del_script;
1111         int ret;
1112
1113         /* defer to scripts */
1114
1115         if ( *lp_deluserfromgroup_script() ) {
1116                 pstrcpy(del_script, lp_deluserfromgroup_script());
1117                 pstring_sub(del_script, "%g", unix_group);
1118                 pstring_sub(del_script, "%u", unix_user);
1119                 ret = smbrun(del_script,NULL);
1120                 DEBUG(ret ? 0 : 3,("smb_delete_user_group: Running the command `%s' gave %d\n",del_script,ret));
1121                 return ret;
1122         }
1123
1124         /* Try winbindd */
1125
1126         if ( winbind_remove_user_from_group( unix_user, unix_group ) ) {
1127                 DEBUG(3,("smb_delete_group: winbindd removed user (%s) from the group (%s)\n",
1128                         unix_user, unix_group));
1129                 return 0;
1130         }
1131
1132         return -1;
1133 }
1134
1135
1136 NTSTATUS pdb_default_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
1137                                  DOM_SID sid)
1138 {
1139         return get_group_map_from_sid(sid, map) ?
1140                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1141 }
1142
1143 NTSTATUS pdb_default_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
1144                                  gid_t gid)
1145 {
1146         return get_group_map_from_gid(gid, map) ?
1147                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1148 }
1149
1150 NTSTATUS pdb_default_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
1151                                  const char *name)
1152 {
1153         return get_group_map_from_ntname(name, map) ?
1154                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1155 }
1156
1157 NTSTATUS pdb_default_add_group_mapping_entry(struct pdb_methods *methods,
1158                                                 GROUP_MAP *map)
1159 {
1160         return add_mapping_entry(map, TDB_INSERT) ?
1161                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1162 }
1163
1164 NTSTATUS pdb_default_update_group_mapping_entry(struct pdb_methods *methods,
1165                                                    GROUP_MAP *map)
1166 {
1167         return add_mapping_entry(map, TDB_REPLACE) ?
1168                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1169 }
1170
1171 NTSTATUS pdb_default_delete_group_mapping_entry(struct pdb_methods *methods,
1172                                                    DOM_SID sid)
1173 {
1174         return group_map_remove(sid) ?
1175                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1176 }
1177
1178 NTSTATUS pdb_default_enum_group_mapping(struct pdb_methods *methods,
1179                                            enum SID_NAME_USE sid_name_use,
1180                                            GROUP_MAP **rmap, int *num_entries,
1181                                            BOOL unix_only)
1182 {
1183         return enum_group_mapping(sid_name_use, rmap, num_entries, unix_only) ?
1184                 NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1185 }
1186
1187 NTSTATUS pdb_default_find_alias(struct pdb_methods *methods,
1188                                 const char *name, DOM_SID *sid)
1189 {
1190         GROUP_MAP map;
1191
1192         if (!pdb_getgrnam(&map, name))
1193                 return NT_STATUS_NO_SUCH_ALIAS;
1194
1195         if ((map.sid_name_use != SID_NAME_WKN_GRP) &&
1196             (map.sid_name_use != SID_NAME_ALIAS))
1197                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1198
1199         sid_copy(sid, &map.sid);
1200         return NT_STATUS_OK;
1201 }
1202
1203 NTSTATUS pdb_default_create_alias(struct pdb_methods *methods,
1204                                   const char *name, uint32 *rid)
1205 {
1206         DOM_SID sid;
1207         enum SID_NAME_USE type;
1208         uint32 new_rid;
1209         gid_t gid;
1210
1211         GROUP_MAP map;
1212
1213         if (lookup_name(get_global_sam_name(), name, &sid, &type))
1214                 return NT_STATUS_ALIAS_EXISTS;
1215
1216         if (!winbind_allocate_rid(&new_rid))
1217                 return NT_STATUS_ACCESS_DENIED;
1218
1219         sid_copy(&sid, get_global_sam_sid());
1220         sid_append_rid(&sid, new_rid);
1221
1222         /* Here we allocate the gid */
1223         if (!winbind_sid_to_gid(&gid, &sid)) {
1224                 DEBUG(0, ("Could not get gid for new RID\n"));
1225                 return NT_STATUS_ACCESS_DENIED;
1226         }
1227
1228         map.gid = gid;
1229         sid_copy(&map.sid, &sid);
1230         map.sid_name_use = SID_NAME_ALIAS;
1231         fstrcpy(map.nt_name, name);
1232         fstrcpy(map.comment, "");
1233
1234         if (!pdb_add_group_mapping_entry(&map)) {
1235                 DEBUG(0, ("Could not add group mapping entry for alias %s\n",
1236                           name));
1237                 return NT_STATUS_ACCESS_DENIED;
1238         }
1239
1240         *rid = new_rid;
1241
1242         return NT_STATUS_OK;
1243 }
1244
1245 NTSTATUS pdb_default_delete_alias(struct pdb_methods *methods,
1246                                   const DOM_SID *sid)
1247 {
1248         return pdb_delete_group_mapping_entry(*sid) ?
1249                 NT_STATUS_OK : NT_STATUS_ACCESS_DENIED;
1250 }
1251
1252 NTSTATUS pdb_default_enum_aliases(struct pdb_methods *methods,
1253                                   const DOM_SID *sid,
1254                                   uint32 start_idx, uint32 max_entries,
1255                                   uint32 *num_aliases,
1256                                   struct acct_info **info)
1257 {
1258         GROUP_MAP *map;
1259         int i, num_maps;
1260         enum SID_NAME_USE type = SID_NAME_UNKNOWN;
1261
1262         if (sid_compare(sid, get_global_sam_sid()) == 0)
1263                 type = SID_NAME_ALIAS;
1264
1265         if (sid_compare(sid, &global_sid_Builtin) == 0)
1266                 type = SID_NAME_WKN_GRP;
1267
1268         if (!pdb_enum_group_mapping(type, &map, &num_maps, False) ||
1269             (num_maps == 0)) {
1270                 *num_aliases = 0;
1271                 *info = NULL;
1272                 goto done;
1273         }
1274
1275         if (start_idx > num_maps) {
1276                 *num_aliases = 0;
1277                 *info = NULL;
1278                 goto done;
1279         }
1280
1281         *num_aliases = num_maps - start_idx;
1282
1283         if (*num_aliases > max_entries)
1284                 *num_aliases = max_entries;
1285
1286         *info = SMB_MALLOC_ARRAY(struct acct_info, *num_aliases);
1287
1288         for (i=0; i<*num_aliases; i++) {
1289                 fstrcpy((*info)[i].acct_name, map[i+start_idx].nt_name);
1290                 fstrcpy((*info)[i].acct_desc, map[i+start_idx].comment);
1291                 sid_peek_rid(&map[i].sid, &(*info)[i+start_idx].rid);
1292         }
1293
1294  done:
1295         SAFE_FREE(map);
1296         return NT_STATUS_OK;
1297 }
1298
1299 NTSTATUS pdb_default_get_aliasinfo(struct pdb_methods *methods,
1300                                    const DOM_SID *sid,
1301                                    struct acct_info *info)
1302 {
1303         GROUP_MAP map;
1304
1305         if (!pdb_getgrsid(&map, *sid))
1306                 return NT_STATUS_NO_SUCH_ALIAS;
1307
1308         fstrcpy(info->acct_name, map.nt_name);
1309         fstrcpy(info->acct_desc, map.comment);
1310         sid_peek_rid(&map.sid, &info->rid);
1311         return NT_STATUS_OK;
1312 }
1313
1314 NTSTATUS pdb_default_set_aliasinfo(struct pdb_methods *methods,
1315                                    const DOM_SID *sid,
1316                                    struct acct_info *info)
1317 {
1318         GROUP_MAP map;
1319
1320         if (!pdb_getgrsid(&map, *sid))
1321                 return NT_STATUS_NO_SUCH_ALIAS;
1322
1323         fstrcpy(map.comment, info->acct_desc);
1324
1325         if (!pdb_update_group_mapping_entry(&map))
1326                 return NT_STATUS_ACCESS_DENIED;
1327
1328         return NT_STATUS_OK;
1329 }
1330
1331 NTSTATUS pdb_default_add_aliasmem(struct pdb_methods *methods,
1332                                   const DOM_SID *alias, const DOM_SID *member)
1333 {
1334         return add_aliasmem(alias, member);
1335 }
1336
1337 NTSTATUS pdb_default_del_aliasmem(struct pdb_methods *methods,
1338                                   const DOM_SID *alias, const DOM_SID *member)
1339 {
1340         return del_aliasmem(alias, member);
1341 }
1342
1343 NTSTATUS pdb_default_enum_aliasmem(struct pdb_methods *methods,
1344                                    const DOM_SID *alias, DOM_SID **members,
1345                                    int *num_members)
1346 {
1347         return enum_aliasmem(alias, members, num_members);
1348 }
1349
1350 NTSTATUS pdb_default_alias_memberships(struct pdb_methods *methods,
1351                                        TALLOC_CTX *mem_ctx,
1352                                        const DOM_SID *domain_sid,
1353                                        const DOM_SID *members,
1354                                        int num_members,
1355                                        uint32 **alias_rids,
1356                                        int *num_alias_rids)
1357 {
1358         DOM_SID *alias_sids;
1359         int i, num_alias_sids;
1360         NTSTATUS result;
1361
1362         alias_sids = NULL;
1363         num_alias_sids = 0;
1364
1365         result = alias_memberships(members, num_members,
1366                                    &alias_sids, &num_alias_sids);
1367
1368         if (!NT_STATUS_IS_OK(result))
1369                 return result;
1370
1371         *alias_rids = TALLOC_ARRAY(mem_ctx, uint32, num_alias_sids);
1372         if ((alias_sids != 0) && (*alias_rids == NULL))
1373                 return NT_STATUS_NO_MEMORY;
1374
1375         *num_alias_rids = 0;
1376
1377         for (i=0; i<num_alias_sids; i++) {
1378                 if (!sid_peek_check_rid(domain_sid, &alias_sids[i],
1379                                         &(*alias_rids)[*num_alias_rids]))
1380                         continue;
1381                 *num_alias_rids += 1;
1382         }
1383
1384         SAFE_FREE(alias_sids);
1385
1386         return NT_STATUS_OK;
1387 }
1388
1389 /**********************************************************************
1390  no ops for passdb backends that don't implement group mapping
1391  *********************************************************************/
1392
1393 NTSTATUS pdb_nop_getgrsid(struct pdb_methods *methods, GROUP_MAP *map,
1394                                  DOM_SID sid)
1395 {
1396         return NT_STATUS_UNSUCCESSFUL;
1397 }
1398
1399 NTSTATUS pdb_nop_getgrgid(struct pdb_methods *methods, GROUP_MAP *map,
1400                                  gid_t gid)
1401 {
1402         return NT_STATUS_UNSUCCESSFUL;
1403 }
1404
1405 NTSTATUS pdb_nop_getgrnam(struct pdb_methods *methods, GROUP_MAP *map,
1406                                  const char *name)
1407 {
1408         return NT_STATUS_UNSUCCESSFUL;
1409 }
1410
1411 NTSTATUS pdb_nop_add_group_mapping_entry(struct pdb_methods *methods,
1412                                                 GROUP_MAP *map)
1413 {
1414         return NT_STATUS_UNSUCCESSFUL;
1415 }
1416
1417 NTSTATUS pdb_nop_update_group_mapping_entry(struct pdb_methods *methods,
1418                                                    GROUP_MAP *map)
1419 {
1420         return NT_STATUS_UNSUCCESSFUL;
1421 }
1422
1423 NTSTATUS pdb_nop_delete_group_mapping_entry(struct pdb_methods *methods,
1424                                                    DOM_SID sid)
1425 {
1426         return NT_STATUS_UNSUCCESSFUL;
1427 }
1428
1429 NTSTATUS pdb_nop_enum_group_mapping(struct pdb_methods *methods,
1430                                            enum SID_NAME_USE sid_name_use,
1431                                            GROUP_MAP **rmap, int *num_entries,
1432                                            BOOL unix_only)
1433 {
1434         return NT_STATUS_UNSUCCESSFUL;
1435 }
1436