2 Unix SMB/CIFS implementation.
4 Copyright (C) Tim Potter 2000
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003
6 Copyright (C) Simo Sorce 2003
7 Copyright (C) Jeremy Allison 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 2 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program; if not, write to the Free Software
21 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.*/
26 #define DBGC_CLASS DBGC_IDMAP
30 struct idmap_function_entry {
32 struct idmap_methods *methods;
33 struct idmap_function_entry *prev,*next;
36 static struct idmap_function_entry *backends = NULL;
38 static struct idmap_methods *cache_map;
39 static struct idmap_methods *remote_map;
41 static BOOL proxyonly = False;
43 /**********************************************************************
44 Get idmap methods. Don't allow tdb to be a remote method.
45 **********************************************************************/
47 static struct idmap_methods *get_methods(const char *name, BOOL cache_method)
49 struct idmap_function_entry *entry = backends;
51 for(entry = backends; entry; entry = entry->next) {
52 if (!cache_method && strequal(entry->name, "tdb"))
53 continue; /* tdb is only cache method. */
54 if (strequal(entry->name, name))
55 return entry->methods;
61 /**********************************************************************
62 Allow a module to register itself as a method.
63 **********************************************************************/
65 NTSTATUS smb_register_idmap(int version, const char *name, struct idmap_methods *methods)
67 struct idmap_function_entry *entry;
69 if ((version != SMB_IDMAP_INTERFACE_VERSION)) {
70 DEBUG(0, ("smb_register_idmap: Failed to register idmap module.\n"
71 "The module was compiled against SMB_IDMAP_INTERFACE_VERSION %d,\n"
72 "current SMB_IDMAP_INTERFACE_VERSION is %d.\n"
73 "Please recompile against the current version of samba!\n",
74 version, SMB_IDMAP_INTERFACE_VERSION));
75 return NT_STATUS_OBJECT_TYPE_MISMATCH;
78 if (!name || !name[0] || !methods) {
79 DEBUG(0,("smb_register_idmap: called with NULL pointer or empty name!\n"));
80 return NT_STATUS_INVALID_PARAMETER;
83 if (get_methods(name, False)) {
84 DEBUG(0,("smb_register_idmap: idmap module %s already registered!\n", name));
85 return NT_STATUS_OBJECT_NAME_COLLISION;
88 entry = SMB_XMALLOC_P(struct idmap_function_entry);
89 entry->name = smb_xstrdup(name);
90 entry->methods = methods;
92 DLIST_ADD(backends, entry);
93 DEBUG(5, ("smb_register_idmap: Successfully added idmap backend '%s'\n", name));
97 /**********************************************************************
98 Initialise idmap cache and a remote backend (if configured).
99 **********************************************************************/
101 BOOL idmap_init(const char **remote_backend)
107 cache_map = get_methods("tdb", True);
110 DEBUG(0, ("idmap_init: could not find tdb cache backend!\n"));
114 if (!NT_STATUS_IS_OK(cache_map->init( NULL ))) {
115 DEBUG(0, ("idmap_init: could not initialise tdb cache backend!\n"));
120 if ((remote_map == NULL) && (remote_backend != NULL) &&
121 (*remote_backend != NULL) && (**remote_backend != '\0')) {
122 char *rem_backend = smb_xstrdup(*remote_backend);
125 BOOL idmap_prefix_workaround = False;
127 /* get any mode parameters passed in */
129 if ( (pparams = strchr( rem_backend, ':' )) != NULL ) {
132 fstrcpy( params, pparams );
135 /* strip any leading idmap_ prefix of */
136 if ( strncmp( rem_backend, "idmap_", 6) == 0 ) {
138 idmap_prefix_workaround = True;
139 DEBUG(0, ("idmap_init: idmap backend uses deprecated 'idmap_' prefix. Please replace 'idmap_%s' by '%s' in %s\n", rem_backend, rem_backend, dyn_CONFIGFILE));
142 DEBUG(3, ("idmap_init: using '%s' as remote backend\n", rem_backend));
144 if((remote_map = get_methods(rem_backend, False)) ||
145 (NT_STATUS_IS_OK(smb_probe_module("idmap", rem_backend)) &&
146 (remote_map = get_methods(rem_backend, False)))) {
147 if (!NT_STATUS_IS_OK(remote_map->init(params))) {
148 DEBUG(0, ("idmap_init: failed to initialize remote backend!\n"));
152 DEBUG(0, ("idmap_init: could not load remote backend '%s'\n", rem_backend));
153 if (idmap_prefix_workaround)
155 SAFE_FREE(rem_backend);
158 if (idmap_prefix_workaround)
160 SAFE_FREE(rem_backend);
166 /**************************************************************************
167 Don't do id mapping. This is used to make winbind a netlogon proxy only.
168 **************************************************************************/
170 void idmap_set_proxyonly(void)
175 BOOL idmap_proxyonly(void)
180 /**************************************************************************
181 This is a rare operation, designed to allow an explicit mapping to be
182 set up for a sid to a POSIX id.
183 **************************************************************************/
185 NTSTATUS idmap_set_mapping(const DOM_SID *sid, unid_t id, enum idmap_type id_type)
187 struct idmap_methods *map = remote_map;
191 return NT_STATUS_UNSUCCESSFUL;
194 if (sid_check_is_in_our_domain(sid)) {
195 DEBUG(3, ("Refusing to add SID %s to idmap, it's our own "
196 "domain\n", sid_string_static(sid)));
197 return NT_STATUS_ACCESS_DENIED;
200 if (sid_check_is_in_builtin(sid)) {
201 DEBUG(3, ("Refusing to add SID %s to idmap, it's our builtin "
202 "domain\n", sid_string_static(sid)));
203 return NT_STATUS_ACCESS_DENIED;
206 DEBUG(10, ("idmap_set_mapping: Set %s to %s %lu\n",
207 sid_string_static(sid),
208 (id_type == ID_USERID) ? "UID" : "GID",
209 (id_type == ID_USERID) ? (unsigned long)id.uid :
210 (unsigned long)id.gid));
212 if ( (NT_STATUS_IS_OK(cache_map->get_sid_from_id(&tmp_sid, id, id_type, IDMAP_FLAG_QUERY_ONLY))) &&
213 sid_equal(sid, &tmp_sid) ) {
214 /* Nothing to do, we already have that mapping */
215 DEBUG(10, ("idmap_set_mapping: Mapping already there\n"));
220 /* Ok, we don't have a authoritative remote
221 mapping. So update our local cache only. */
225 return map->set_mapping(sid, id, id_type);
228 /**************************************************************************
229 Get ID from SID. This can create a mapping for a SID to a POSIX id.
230 **************************************************************************/
232 NTSTATUS idmap_get_id_from_sid(unid_t *id, enum idmap_type *id_type, const DOM_SID *sid, int flags)
235 int cache_flags = flags;
238 return NT_STATUS_UNSUCCESSFUL;
241 if (sid_check_is_in_our_domain(sid)) {
242 DEBUG(9, ("sid %s is in our domain -- go look in passdb\n",
243 sid_string_static(sid)));
244 return NT_STATUS_NONE_MAPPED;
247 if (sid_check_is_in_builtin(sid)) {
248 DEBUG(9, ("sid %s is in builtin domain -- go look in passdb\n",
249 sid_string_static(sid)));
250 return NT_STATUS_NONE_MAPPED;
254 /* We have a central remote idmap so only look in
255 cache, ensure we don't allocate */
256 cache_flags |= IDMAP_FLAG_QUERY_ONLY;
259 ret = cache_map->get_id_from_sid(id, id_type, sid, cache_flags);
260 if (NT_STATUS_IS_OK(ret)) {
264 if ((remote_map == NULL) || (flags & IDMAP_FLAG_CACHE_ONLY)) {
268 /* Ok, the mapping was not in the cache, give the remote map a try. */
270 ret = remote_map->get_id_from_sid(id, id_type, sid, flags);
272 if (NT_STATUS_IS_OK(ret)) {
273 /* The remote backend gave us a valid mapping, cache it. */
274 ret = cache_map->set_mapping(sid, *id, *id_type);
280 /**************************************************************************
281 Get SID from ID. This must have been created before.
282 **************************************************************************/
284 NTSTATUS idmap_get_sid_from_id(DOM_SID *sid, unid_t id, enum idmap_type id_type, int flags)
287 int cache_flags = flags;
290 return NT_STATUS_UNSUCCESSFUL;
294 /* We have a central remote idmap so only look in
295 cache, ensure we don't allocate */
296 cache_flags |= IDMAP_FLAG_QUERY_ONLY;
299 ret = cache_map->get_sid_from_id(sid, id, id_type, cache_flags);
301 if (NT_STATUS_IS_OK(ret)) {
305 if ((remote_map == NULL) || (flags & IDMAP_FLAG_CACHE_ONLY)) {
309 /* Not in cache, ask our authoritative backend */
311 ret = remote_map->get_sid_from_id(sid, id, id_type, flags);
313 if (NT_STATUS_IS_OK(ret)) {
314 /* The remote backend gave us a valid mapping, cache it. */
315 ret = cache_map->set_mapping(sid, id, id_type);
321 /**************************************************************************
322 Alloocate a new UNIX uid/gid
323 **************************************************************************/
325 NTSTATUS idmap_allocate_id(unid_t *id, enum idmap_type id_type)
327 /* we have to allocate from the authoritative backend */
330 return NT_STATUS_UNSUCCESSFUL;
334 return remote_map->allocate_id( id, id_type );
337 return cache_map->allocate_id( id, id_type );
340 /**************************************************************************
342 **************************************************************************/
344 NTSTATUS idmap_close(void)
352 ret = cache_map->close_fn();
353 if (!NT_STATUS_IS_OK(ret)) {
354 DEBUG(3, ("idmap_close: failed to close local tdb cache!\n"));
359 ret = remote_map->close_fn();
360 if (!NT_STATUS_IS_OK(ret)) {
361 DEBUG(3, ("idmap_close: failed to close remote idmap repository!\n"));
369 /**************************************************************************
371 **************************************************************************/
373 void idmap_status(void)
377 remote_map->status();