2 Unix SMB/CIFS implementation.
4 Winbind rpc backend functions
6 Copyright (C) Tim Potter 2000-2001,2003
7 Copyright (C) Simo Sorce 2003
8 Copyright (C) Volker Lendecke 2004
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 static void add_member(const char *domain, const char *user,
32 char **pp_members, size_t *p_num_members)
36 fill_domain_username(name, domain, user);
37 safe_strcat(name, ",", sizeof(name)-1);
38 string_append(pp_members, name);
42 /**********************************************************************
43 Add member users resulting from sid. Expand if it is a domain group.
44 **********************************************************************/
46 static void add_expanded_sid(const DOM_SID *sid, char **pp_members, size_t *p_num_members)
50 struct winbindd_domain *domain;
53 char *domain_name = NULL;
55 enum SID_NAME_USE type;
64 TALLOC_CTX *mem_ctx = talloc_init("add_expanded_sid");
66 if (mem_ctx == NULL) {
67 DEBUG(1, ("talloc_init failed\n"));
71 sid_copy(&dom_sid, sid);
72 sid_split_rid(&dom_sid, &rid);
74 domain = find_lookup_domain_from_sid(sid);
77 DEBUG(3, ("Could not find domain for sid %s\n",
78 sid_string_static(sid)));
82 result = domain->methods->sid_to_name(domain, mem_ctx, sid,
83 &domain_name, &name, &type);
85 if (!NT_STATUS_IS_OK(result)) {
86 DEBUG(3, ("sid_to_name failed for sid %s\n",
87 sid_string_static(sid)));
91 DEBUG(10, ("Found name %s, type %d\n", name, type));
93 if (type == SID_NAME_USER) {
94 add_member(domain_name, name, pp_members, p_num_members);
98 if (type != SID_NAME_DOM_GRP) {
99 DEBUG(10, ("Alias member %s neither user nor group, ignore\n",
104 /* Expand the domain group, this must be done via the target domain */
106 domain = find_domain_from_sid(sid);
108 if (domain == NULL) {
109 DEBUG(3, ("Could not find domain from SID %s\n",
110 sid_string_static(sid)));
114 result = domain->methods->lookup_groupmem(domain, mem_ctx,
119 if (!NT_STATUS_IS_OK(result)) {
120 DEBUG(10, ("Could not lookup group members for %s: %s\n",
121 name, nt_errstr(result)));
125 for (i=0; i<num_names; i++) {
126 DEBUG(10, ("Adding group member SID %s\n",
127 sid_string_static(&sid_mem[i])));
129 if (types[i] != SID_NAME_USER) {
130 DEBUG(1, ("Hmmm. Member %s of group %s is no user. "
131 "Ignoring.\n", names[i], name));
135 add_member(domain->name, names[i], pp_members, p_num_members);
139 talloc_destroy(mem_ctx);
143 BOOL fill_passdb_alias_grmem(struct winbindd_domain *domain,
145 size_t *num_gr_mem, char **gr_mem, size_t *gr_mem_len)
148 size_t i, num_members;
154 if (!NT_STATUS_IS_OK(pdb_enum_aliasmem(group_sid, &members,
158 for (i=0; i<num_members; i++) {
159 add_expanded_sid(&members[i], gr_mem, num_gr_mem);
164 if (*gr_mem != NULL) {
167 /* We have at least one member, strip off the last "," */
168 len = strlen(*gr_mem);
169 (*gr_mem)[len-1] = '\0';
176 /* Query display info for a domain. This returns enough information plus a
177 bit extra to give an overview of domain users for the User Manager
179 static NTSTATUS query_user_list(struct winbindd_domain *domain,
182 WINBIND_USERINFO **info)
184 /* We don't have users */
190 /* list all domain groups */
191 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
194 struct acct_info **info)
196 /* We don't have domain groups */
202 /* List all domain groups */
204 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
207 struct acct_info **info)
209 struct pdb_search *search;
210 struct samr_displayentry *aliases;
212 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
214 search = pdb_search_aliases(&domain->sid);
215 if (search == NULL) goto done;
217 *num_entries = pdb_search_entries(search, 0, 0xffffffff, &aliases);
218 if (*num_entries == 0) goto done;
220 *info = TALLOC_ARRAY(mem_ctx, struct acct_info, *num_entries);
222 result = NT_STATUS_NO_MEMORY;
226 for (i=0; i<*num_entries; i++) {
227 fstrcpy((*info)[i].acct_name, aliases[i].account_name);
228 fstrcpy((*info)[i].acct_desc, aliases[i].description);
229 (*info)[i].rid = aliases[i].rid;
232 result = NT_STATUS_OK;
234 pdb_search_destroy(search);
238 /* convert a single name to a sid in a domain */
239 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
241 const char *domain_name,
244 enum SID_NAME_USE *type)
246 DEBUG(10, ("Finding name %s\n", name));
248 if (!pdb_find_alias(name, sid))
249 return NT_STATUS_NONE_MAPPED;
251 if (sid_check_is_in_builtin(sid))
252 *type = SID_NAME_WKN_GRP;
254 *type = SID_NAME_ALIAS;
260 convert a domain SID to a user or group name
262 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
267 enum SID_NAME_USE *type)
269 const char *dom, *nam;
271 DEBUG(10, ("Converting SID %s\n", sid_string_static(sid)));
274 if (!sid_check_is_in_builtin(sid) &&
275 !sid_check_is_in_our_domain(sid)) {
276 DEBUG(0, ("Possible deadlock: Trying to lookup SID %s with "
277 "passdb backend\n", sid_string_static(sid)));
278 return NT_STATUS_NONE_MAPPED;
281 if (!lookup_sid(mem_ctx, sid, &dom, &nam, type)) {
282 return NT_STATUS_NONE_MAPPED;
285 *domain_name = talloc_strdup(mem_ctx, dom);
286 *name = talloc_strdup(mem_ctx, nam);
291 /* Lookup user information from a rid or username. */
292 static NTSTATUS query_user(struct winbindd_domain *domain,
294 const DOM_SID *user_sid,
295 WINBIND_USERINFO *user_info)
297 return NT_STATUS_NO_SUCH_USER;
300 /* Lookup groups a user is a member of. I wish Unix had a call like this! */
301 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
303 const DOM_SID *user_sid,
304 uint32 *num_groups, DOM_SID **user_gids)
306 return NT_STATUS_NO_SUCH_USER;
309 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
311 uint32 num_sids, const DOM_SID *sids,
312 uint32 *p_num_aliases, uint32 **rids)
315 size_t num_aliases = 0;
317 result = pdb_enum_alias_memberships(mem_ctx, &domain->sid,
318 sids, num_sids, rids, &num_aliases);
320 *p_num_aliases = num_aliases;
324 /* Lookup group membership given a rid. */
325 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
327 const DOM_SID *group_sid, uint32 *num_names,
328 DOM_SID **sid_mem, char ***names,
331 size_t i, num_members, num_mapped;
334 const DOM_SID **sids;
335 struct lsa_dom_info *lsa_domains;
336 struct lsa_name_info *lsa_names;
338 if (!sid_check_is_in_our_domain(group_sid)) {
339 /* There's no groups, only aliases in BUILTIN */
340 return NT_STATUS_NO_SUCH_GROUP;
343 result = pdb_enum_group_members(mem_ctx, group_sid, &rids,
345 if (!NT_STATUS_IS_OK(result)) {
349 if (num_members == 0) {
357 *sid_mem = TALLOC_ARRAY(mem_ctx, DOM_SID, num_members);
358 *names = TALLOC_ARRAY(mem_ctx, char *, num_members);
359 *name_types = TALLOC_ARRAY(mem_ctx, uint32, num_members);
360 sids = TALLOC_ARRAY(mem_ctx, const DOM_SID *, num_members);
362 if (((*sid_mem) == NULL) || ((*names) == NULL) ||
363 ((*name_types) == NULL) || (sids == NULL)) {
364 return NT_STATUS_NO_MEMORY;
367 for (i=0; i<num_members; i++) {
368 DOM_SID *sid = &((*sid_mem)[i]);
369 sid_copy(sid, &domain->sid);
370 sid_append_rid(sid, rids[i]);
374 result = lookup_sids(mem_ctx, num_members, sids, 1,
375 &lsa_domains, &lsa_names);
376 if (!NT_STATUS_IS_OK(result)) {
381 for (i=0; i<num_members; i++) {
382 if (lsa_names[i].type != SID_NAME_USER) {
383 DEBUG(2, ("Got %s as group member -- ignoring\n",
384 sid_type_lookup(lsa_names[i].type)));
387 (*names)[i] = talloc_steal((*names),
389 (*name_types)[i] = lsa_names[i].type;
394 *num_names = num_mapped;
399 /* find the sequence number for a domain */
400 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
405 result = pdb_get_seq_num(&seq_num);
410 *seq = (int) seq_num;
415 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
417 SAM_UNK_INFO_12 *lockout_policy)
419 /* actually we have that */
420 return NT_STATUS_NOT_IMPLEMENTED;
423 static NTSTATUS password_policy(struct winbindd_domain *domain,
425 SAM_UNK_INFO_1 *password_policy)
427 /* actually we have that */
428 return NT_STATUS_NOT_IMPLEMENTED;
431 /* get a list of trusted domains */
432 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
440 struct trustdom_info **domains;
448 nt_status = secrets_trusted_domains(mem_ctx, num_domains,
450 if (!NT_STATUS_IS_OK(nt_status)) {
454 *names = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
455 *alt_names = TALLOC_ARRAY(mem_ctx, char *, *num_domains);
456 *dom_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, *num_domains);
458 if ((*alt_names == NULL) || (*names == NULL) || (*dom_sids == NULL)) {
459 return NT_STATUS_NO_MEMORY;
462 for (i=0; i<*num_domains; i++) {
463 (*alt_names)[i] = NULL;
464 (*names)[i] = talloc_steal((*names), domains[i]->name);
465 sid_copy(&(*dom_sids)[i], &domains[i]->sid);
471 /* the rpc backend methods are exposed via this structure */
472 struct winbindd_methods passdb_methods = {