source3/winbindd/idmap_ad.c

   1 /*
   2  *  idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
   3  *
   4  * Unix SMB/CIFS implementation.
   5  *
   6  * Winbind ADS backend functions
   7  *
   8  * Copyright (C) Andrew Tridgell 2001
   9  * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
  10  * Copyright (C) Gerald (Jerry) Carter 2004-2007
  11  * Copyright (C) Luke Howard 2001-2004
  12  * Copyright (C) Michael Adam 2008
  13  *
  14  * This program is free software; you can redistribute it and/or modify
  15  * it under the terms of the GNU General Public License as published by
  16  * the Free Software Foundation; either version 3 of the License, or
  17  * (at your option) any later version.
  18  *
  19  * This program is distributed in the hope that it will be useful,
  20  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  21  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  22  * GNU General Public License for more details.
  23  *
  24  * You should have received a copy of the GNU General Public License
  25  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  26  */
  27
  28 #include "includes.h"
  29 #include "winbindd.h"
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_IDMAP
  33
  34 #define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
  35
  36 #define IDMAP_AD_MAX_IDS 30
  37 #define CHECK_ALLOC_DONE(mem) do { \
  38      if (!mem) { \
  39            DEBUG(0, ("Out of memory!\n")); \
  40            ret = NT_STATUS_NO_MEMORY; \
  41            goto done; \
  42       } \
  43 } while (0)
  44
  45 struct idmap_ad_context {
  46         uint32_t filter_low_id;
  47         uint32_t filter_high_id;
  48         ADS_STRUCT *ads;
  49         struct posix_schema *ad_schema;
  50         enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
  51 };
  52
  53 NTSTATUS init_module(void);
  54
  55 /************************************************************************
  56  ***********************************************************************/
  57
  58 static ADS_STATUS ad_idmap_cached_connection_internal(struct idmap_domain *dom)
  59 {
  60         ADS_STRUCT *ads;
  61         ADS_STATUS status;
  62         bool local = False;
  63         fstring dc_name;
  64         struct sockaddr_storage dc_ip;
  65         struct idmap_ad_context *ctx;
  66         char *ldap_server = NULL;
  67         char *realm = NULL;
  68         struct winbindd_domain *wb_dom;
  69
  70         DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
  71                    dom->name));
  72
  73         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
  74
  75         if (ctx->ads != NULL) {
  76
  77                 time_t expire;
  78                 time_t now = time(NULL);
  79
  80                 ads = ctx->ads;
  81
  82                 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
  83
  84                 /* check for a valid structure */
  85                 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
  86                           (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
  87
  88                 if ( ads->config.realm && (expire > time(NULL))) {
  89                         return ADS_SUCCESS;
  90                 } else {
  91                         /* we own this ADS_STRUCT so make sure it goes away */
  92                         DEBUG(7,("Deleting expired krb5 credential cache\n"));
  93                         ads->is_mine = True;
  94                         ads_destroy( &ads );
  95                         ads_kdestroy(WINBIND_CCACHE_NAME);
  96                         ctx->ads = NULL;
  97                         TALLOC_FREE( ctx->ad_schema );
  98                 }
  99         }
 100
 101         if (!local) {
 102                 /* we don't want this to affect the users ccache */
 103                 setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
 104         }
 105
 106         /*
 107          * At this point we only have the NetBIOS domain name.
 108          * Check if we can get server nam and realm from SAF cache
 109          * and the domain list.
 110          */
 111         ldap_server = saf_fetch(dom->name);
 112         DEBUG(10, ("ldap_server from saf cache: '%s'\n", ldap_server?ldap_server:""));
 113
 114         wb_dom = find_domain_from_name_noinit(dom->name);
 115         if (wb_dom == NULL) {
 116                 DEBUG(10, ("find_domain_from_name_noinit did not find domain '%s'\n",
 117                            dom->name));
 118                 realm = NULL;
 119         } else {
 120                 DEBUG(10, ("find_domain_from_name_noinit found realm '%s' for "
 121                           " domain '%s'\n", wb_dom->alt_name, dom->name));
 122                 realm = wb_dom->alt_name;
 123         }
 124
 125         if ( (ads = ads_init(realm, dom->name, ldap_server)) == NULL ) {
 126                 DEBUG(1,("ads_init failed\n"));
 127                 return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
 128         }
 129
 130         /* the machine acct password might have change - fetch it every time */
 131         SAFE_FREE(ads->auth.password);
 132         ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 133
 134         SAFE_FREE(ads->auth.realm);
 135         ads->auth.realm = SMB_STRDUP(lp_realm());
 136
 137         /* setup server affinity */
 138
 139         get_dc_name(dom->name, realm, dc_name, &dc_ip );
 140
 141         status = ads_connect(ads);
 142         if (!ADS_ERR_OK(status)) {
 143                 DEBUG(1, ("ad_idmap_init: failed to connect to AD\n"));
 144                 ads_destroy(&ads);
 145                 return status;
 146         }
 147
 148         ads->is_mine = False;
 149
 150         ctx->ads = ads;
 151
 152         return ADS_SUCCESS;
 153 }
 154
 155 /************************************************************************
 156  ***********************************************************************/
 157
 158 static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
 159 {
 160         ADS_STATUS status;
 161         struct idmap_ad_context * ctx;
 162
 163         status = ad_idmap_cached_connection_internal(dom);
 164         if (!ADS_ERR_OK(status)) {
 165                 return status;
 166         }
 167
 168         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 169
 170         /* if we have a valid ADS_STRUCT and the schema model is
 171            defined, then we can return here. */
 172
 173         if ( ctx->ad_schema ) {
 174                 return ADS_SUCCESS;
 175         }
 176
 177         /* Otherwise, set the schema model */
 178
 179         if ( (ctx->ad_map_type ==  WB_POSIX_MAP_SFU) ||
 180              (ctx->ad_map_type ==  WB_POSIX_MAP_SFU20) ||
 181              (ctx->ad_map_type ==  WB_POSIX_MAP_RFC2307) )
 182         {
 183                 status = ads_check_posix_schema_mapping(NULL, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
 184                 if ( !ADS_ERR_OK(status) ) {
 185                         DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
 186                 }
 187         }
 188
 189         return status;
 190 }
 191
 192 /************************************************************************
 193  ***********************************************************************/
 194
 195 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom,
 196                                     const char *params)
 197 {
 198         struct idmap_ad_context *ctx;
 199         char *config_option;
 200         const char *range = NULL;
 201         const char *schema_mode = NULL;
 202
 203         if ( (ctx = TALLOC_ZERO_P(dom, struct idmap_ad_context)) == NULL ) {
 204                 DEBUG(0, ("Out of memory!\n"));
 205                 return NT_STATUS_NO_MEMORY;
 206         }
 207
 208         if ( (config_option = talloc_asprintf(ctx, "idmap config %s", dom->name)) == NULL ) {
 209                 DEBUG(0, ("Out of memory!\n"));
 210                 talloc_free(ctx);
 211                 return NT_STATUS_NO_MEMORY;
 212         }
 213
 214         /* load ranges */
 215         range = lp_parm_const_string(-1, config_option, "range", NULL);
 216         if (range && range[0]) {
 217                 if ((sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
 218                     (ctx->filter_low_id > ctx->filter_high_id)) {
 219                         DEBUG(1, ("ERROR: invalid filter range [%s]", range));
 220                         ctx->filter_low_id = 0;
 221                         ctx->filter_high_id = 0;
 222                 }
 223         }
 224
 225         /* default map type */
 226         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 227
 228         /* schema mode */
 229         schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
 230         if ( schema_mode && schema_mode[0] ) {
 231                 if ( strequal(schema_mode, "sfu") )
 232                         ctx->ad_map_type = WB_POSIX_MAP_SFU;
 233                 else if ( strequal(schema_mode, "sfu20" ) )
 234                         ctx->ad_map_type = WB_POSIX_MAP_SFU20;
 235                 else if ( strequal(schema_mode, "rfc2307" ) )
 236                         ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 237                 else
 238                         DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
 239                                  schema_mode));
 240         }
 241
 242         dom->private_data = ctx;
 243
 244         talloc_free(config_option);
 245
 246         return NT_STATUS_OK;
 247 }
 248
 249 /************************************************************************
 250  Search up to IDMAP_AD_MAX_IDS entries in maps for a match.
 251  ***********************************************************************/
 252
 253 static struct id_map *find_map_by_id(struct id_map **maps, enum id_type type, uint32_t id)
 254 {
 255         int i;
 256
 257         for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
 258                 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
 259                         return maps[i];
 260                 }
 261         }
 262
 263         return NULL;
 264 }
 265
 266 /************************************************************************
 267  Search up to IDMAP_AD_MAX_IDS entries in maps for a match
 268  ***********************************************************************/
 269
 270 static struct id_map *find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
 271 {
 272         int i;
 273
 274         for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
 275                 if (sid_equal(maps[i]->sid, sid)) {
 276                         return maps[i];
 277                 }
 278         }
 279
 280         return NULL;
 281 }
 282
 283 /************************************************************************
 284  ***********************************************************************/
 285
 286 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
 287 {
 288         NTSTATUS ret;
 289         TALLOC_CTX *memctx;
 290         struct idmap_ad_context *ctx;
 291         ADS_STATUS rc;
 292         const char *attrs[] = { "sAMAccountType",
 293                                 "objectSid",
 294                                 NULL, /* uidnumber */
 295                                 NULL, /* gidnumber */
 296                                 NULL };
 297         LDAPMessage *res = NULL;
 298         LDAPMessage *entry = NULL;
 299         char *filter = NULL;
 300         int idx = 0;
 301         int bidx = 0;
 302         int count;
 303         int i;
 304         char *u_filter = NULL;
 305         char *g_filter = NULL;
 306
 307         /* initialize the status to avoid suprise */
 308         for (i = 0; ids[i]; i++) {
 309                 ids[i]->status = ID_UNKNOWN;
 310         }
 311
 312         /* Only do query if we are online */
 313         if (idmap_is_offline()) {
 314                 return NT_STATUS_FILE_IS_OFFLINE;
 315         }
 316
 317         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 318
 319         if ( (memctx = talloc_new(ctx)) == NULL ) {
 320                 DEBUG(0, ("Out of memory!\n"));
 321                 return NT_STATUS_NO_MEMORY;
 322         }
 323
 324         rc = ad_idmap_cached_connection(dom);
 325         if (!ADS_ERR_OK(rc)) {
 326                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 327                 ret = NT_STATUS_UNSUCCESSFUL;
 328                 /* ret = ads_ntstatus(rc); */
 329                 goto done;
 330         }
 331
 332         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 333         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 334
 335 again:
 336         bidx = idx;
 337         for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
 338                 switch (ids[idx]->xid.type) {
 339                 case ID_TYPE_UID:
 340                         if ( ! u_filter) {
 341                                 u_filter = talloc_asprintf(memctx, "(&(|"
 342                                                            "(sAMAccountType=%d)"
 343                                                            "(sAMAccountType=%d)"
 344                                                            "(sAMAccountType=%d))(|",
 345                                                            ATYPE_NORMAL_ACCOUNT,
 346                                                            ATYPE_WORKSTATION_TRUST,
 347                                                            ATYPE_INTERDOMAIN_TRUST);
 348                         }
 349                         u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
 350                                                           ctx->ad_schema->posix_uidnumber_attr,
 351                                                           (unsigned long)ids[idx]->xid.id);
 352                         CHECK_ALLOC_DONE(u_filter);
 353                         break;
 354
 355                 case ID_TYPE_GID:
 356                         if ( ! g_filter) {
 357                                 g_filter = talloc_asprintf(memctx, "(&(|"
 358                                                            "(sAMAccountType=%d)"
 359                                                            "(sAMAccountType=%d))(|",
 360                                                            ATYPE_SECURITY_GLOBAL_GROUP,
 361                                                            ATYPE_SECURITY_LOCAL_GROUP);
 362                         }
 363                         g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
 364                                                           ctx->ad_schema->posix_gidnumber_attr,
 365                                                           (unsigned long)ids[idx]->xid.id);
 366                         CHECK_ALLOC_DONE(g_filter);
 367                         break;
 368
 369                 default:
 370                         DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
 371                         ids[idx]->status = ID_UNKNOWN;
 372                         continue;
 373                 }
 374         }
 375         filter = talloc_asprintf(memctx, "(|");
 376         CHECK_ALLOC_DONE(filter);
 377         if ( u_filter) {
 378                 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
 379                 CHECK_ALLOC_DONE(filter);
 380                         TALLOC_FREE(u_filter);
 381         }
 382         if ( g_filter) {
 383                 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
 384                 CHECK_ALLOC_DONE(filter);
 385                 TALLOC_FREE(g_filter);
 386         }
 387         filter = talloc_asprintf_append_buffer(filter, ")");
 388         CHECK_ALLOC_DONE(filter);
 389
 390         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 391         if (!ADS_ERR_OK(rc)) {
 392                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 393                 ret = NT_STATUS_UNSUCCESSFUL;
 394                 goto done;
 395         }
 396
 397         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 398                 DEBUG(10, ("No IDs found\n"));
 399         }
 400
 401         entry = res;
 402         for (i = 0; (i < count) && entry; i++) {
 403                 struct dom_sid sid;
 404                 enum id_type type;
 405                 struct id_map *map;
 406                 uint32_t id;
 407                 uint32_t atype;
 408
 409                 if (i == 0) { /* first entry */
 410                         entry = ads_first_entry(ctx->ads, entry);
 411                 } else { /* following ones */
 412                         entry = ads_next_entry(ctx->ads, entry);
 413                 }
 414
 415                 if ( !entry ) {
 416                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 417                         break;
 418                 }
 419
 420                 /* first check if the SID is present */
 421                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 422                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 423                         continue;
 424                 }
 425
 426                 /* get type */
 427                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 428                         DEBUG(1, ("could not get SAM account type\n"));
 429                         continue;
 430                 }
 431
 432                 switch (atype & 0xF0000000) {
 433                 case ATYPE_SECURITY_GLOBAL_GROUP:
 434                 case ATYPE_SECURITY_LOCAL_GROUP:
 435                         type = ID_TYPE_GID;
 436                         break;
 437                 case ATYPE_NORMAL_ACCOUNT:
 438                 case ATYPE_WORKSTATION_TRUST:
 439                 case ATYPE_INTERDOMAIN_TRUST:
 440                         type = ID_TYPE_UID;
 441                         break;
 442                 default:
 443                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 444                         continue;
 445                 }
 446
 447                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 448                                                  ctx->ad_schema->posix_uidnumber_attr :
 449                                                  ctx->ad_schema->posix_gidnumber_attr,
 450                                      &id))
 451                 {
 452                         DEBUG(1, ("Could not get unix ID\n"));
 453                         continue;
 454                 }
 455
 456                 if ((id == 0) ||
 457                     (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
 458                     (ctx->filter_high_id && (id > ctx->filter_high_id))) {
 459                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 460                                 id, ctx->filter_low_id, ctx->filter_high_id));
 461                         continue;
 462                 }
 463
 464                 map = find_map_by_id(&ids[bidx], type, id);
 465                 if (!map) {
 466                         DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
 467                         continue;
 468                 }
 469
 470                 sid_copy(map->sid, &sid);
 471
 472                 /* mapped */
 473                 map->status = ID_MAPPED;
 474
 475                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 476                            (unsigned long)map->xid.id,
 477                            map->xid.type));
 478         }
 479
 480         if (res) {
 481                 ads_msgfree(ctx->ads, res);
 482         }
 483
 484         if (ids[idx]) { /* still some values to map */
 485                 goto again;
 486         }
 487
 488         ret = NT_STATUS_OK;
 489
 490         /* mark all unknown/expired ones as unmapped */
 491         for (i = 0; ids[i]; i++) {
 492                 if (ids[i]->status != ID_MAPPED)
 493                         ids[i]->status = ID_UNMAPPED;
 494         }
 495
 496 done:
 497         talloc_free(memctx);
 498         return ret;
 499 }
 500
 501 /************************************************************************
 502  ***********************************************************************/
 503
 504 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
 505 {
 506         NTSTATUS ret;
 507         TALLOC_CTX *memctx;
 508         struct idmap_ad_context *ctx;
 509         ADS_STATUS rc;
 510         const char *attrs[] = { "sAMAccountType",
 511                                 "objectSid",
 512                                 NULL, /* attr_uidnumber */
 513                                 NULL, /* attr_gidnumber */
 514                                 NULL };
 515         LDAPMessage *res = NULL;
 516         LDAPMessage *entry = NULL;
 517         char *filter = NULL;
 518         int idx = 0;
 519         int bidx = 0;
 520         int count;
 521         int i;
 522         char *sidstr;
 523
 524         /* initialize the status to avoid suprise */
 525         for (i = 0; ids[i]; i++) {
 526                 ids[i]->status = ID_UNKNOWN;
 527         }
 528
 529         /* Only do query if we are online */
 530         if (idmap_is_offline()) {
 531                 return NT_STATUS_FILE_IS_OFFLINE;
 532         }
 533
 534         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 535
 536         if ( (memctx = talloc_new(ctx)) == NULL ) {
 537                 DEBUG(0, ("Out of memory!\n"));
 538                 return NT_STATUS_NO_MEMORY;
 539         }
 540
 541         rc = ad_idmap_cached_connection(dom);
 542         if (!ADS_ERR_OK(rc)) {
 543                 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
 544                 ret = NT_STATUS_UNSUCCESSFUL;
 545                 /* ret = ads_ntstatus(rc); */
 546                 goto done;
 547         }
 548
 549         if (ctx->ad_schema == NULL) {
 550                 DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
 551                 ret = NT_STATUS_UNSUCCESSFUL;
 552                 goto done;
 553         }
 554
 555         attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
 556         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 557
 558 again:
 559         filter = talloc_asprintf(memctx, "(&(|"
 560                                  "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
 561                                  "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
 562                                  ")(|",
 563                                  ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
 564                                  ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
 565
 566         CHECK_ALLOC_DONE(filter);
 567
 568         bidx = idx;
 569         for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
 570
 571                 ids[idx]->status = ID_UNKNOWN;
 572
 573                 sidstr = sid_binstring(talloc_tos(), ids[idx]->sid);
 574                 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
 575
 576                 TALLOC_FREE(sidstr);
 577                 CHECK_ALLOC_DONE(filter);
 578         }
 579         filter = talloc_asprintf_append_buffer(filter, "))");
 580         CHECK_ALLOC_DONE(filter);
 581         DEBUG(10, ("Filter: [%s]\n", filter));
 582
 583         rc = ads_search_retry(ctx->ads, &res, filter, attrs);
 584         if (!ADS_ERR_OK(rc)) {
 585                 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
 586                 ret = NT_STATUS_UNSUCCESSFUL;
 587                 goto done;
 588         }
 589
 590         if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
 591                 DEBUG(10, ("No IDs found\n"));
 592         }
 593
 594         entry = res;
 595         for (i = 0; (i < count) && entry; i++) {
 596                 struct dom_sid sid;
 597                 enum id_type type;
 598                 struct id_map *map;
 599                 uint32_t id;
 600                 uint32_t atype;
 601
 602                 if (i == 0) { /* first entry */
 603                         entry = ads_first_entry(ctx->ads, entry);
 604                 } else { /* following ones */
 605                         entry = ads_next_entry(ctx->ads, entry);
 606                 }
 607
 608                 if ( !entry ) {
 609                         DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
 610                         break;
 611                 }
 612
 613                 /* first check if the SID is present */
 614                 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
 615                         DEBUG(2, ("Could not retrieve SID from entry\n"));
 616                         continue;
 617                 }
 618
 619                 map = find_map_by_sid(&ids[bidx], &sid);
 620                 if (!map) {
 621                         DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
 622                         continue;
 623                 }
 624
 625                 /* get type */
 626                 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
 627                         DEBUG(1, ("could not get SAM account type\n"));
 628                         continue;
 629                 }
 630
 631                 switch (atype & 0xF0000000) {
 632                 case ATYPE_SECURITY_GLOBAL_GROUP:
 633                 case ATYPE_SECURITY_LOCAL_GROUP:
 634                         type = ID_TYPE_GID;
 635                         break;
 636                 case ATYPE_NORMAL_ACCOUNT:
 637                 case ATYPE_WORKSTATION_TRUST:
 638                 case ATYPE_INTERDOMAIN_TRUST:
 639                         type = ID_TYPE_UID;
 640                         break;
 641                 default:
 642                         DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
 643                         continue;
 644                 }
 645
 646                 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
 647                                                  ctx->ad_schema->posix_uidnumber_attr :
 648                                                  ctx->ad_schema->posix_gidnumber_attr,
 649                                      &id))
 650                 {
 651                         DEBUG(1, ("Could not get unix ID\n"));
 652                         continue;
 653                 }
 654                 if ((id == 0) ||
 655                     (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
 656                     (ctx->filter_high_id && (id > ctx->filter_high_id))) {
 657                         DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
 658                                 id, ctx->filter_low_id, ctx->filter_high_id));
 659                         continue;
 660                 }
 661
 662                 /* mapped */
 663                 map->xid.type = type;
 664                 map->xid.id = id;
 665                 map->status = ID_MAPPED;
 666
 667                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 668                            (unsigned long)map->xid.id,
 669                            map->xid.type));
 670         }
 671
 672         if (res) {
 673                 ads_msgfree(ctx->ads, res);
 674         }
 675
 676         if (ids[idx]) { /* still some values to map */
 677                 goto again;
 678         }
 679
 680         ret = NT_STATUS_OK;
 681
 682         /* mark all unknwoni/expired ones as unmapped */
 683         for (i = 0; ids[i]; i++) {
 684                 if (ids[i]->status != ID_MAPPED)
 685                         ids[i]->status = ID_UNMAPPED;
 686         }
 687
 688 done:
 689         talloc_free(memctx);
 690         return ret;
 691 }
 692
 693 /************************************************************************
 694  ***********************************************************************/
 695
 696 static NTSTATUS idmap_ad_close(struct idmap_domain *dom)
 697 {
 698         struct idmap_ad_context * ctx;
 699
 700         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 701
 702         if (ctx->ads != NULL) {
 703                 /* we own this ADS_STRUCT so make sure it goes away */
 704                 ctx->ads->is_mine = True;
 705                 ads_destroy( &ctx->ads );
 706                 ctx->ads = NULL;
 707         }
 708
 709         TALLOC_FREE( ctx->ad_schema );
 710
 711         return NT_STATUS_OK;
 712 }
 713
 714 /*
 715  * nss_info_{sfu,sfu20,rfc2307}
 716  */
 717
 718 /************************************************************************
 719  Initialize the {sfu,sfu20,rfc2307} state
 720  ***********************************************************************/
 721
 722 static const char *wb_posix_map_unknown_string = "WB_POSIX_MAP_UNKNOWN";
 723 static const char *wb_posix_map_template_string = "WB_POSIX_MAP_TEMPLATE";
 724 static const char *wb_posix_map_sfu_string = "WB_POSIX_MAP_SFU";
 725 static const char *wb_posix_map_sfu20_string = "WB_POSIX_MAP_SFU20";
 726 static const char *wb_posix_map_rfc2307_string = "WB_POSIX_MAP_RFC2307";
 727 static const char *wb_posix_map_unixinfo_string = "WB_POSIX_MAP_UNIXINFO";
 728
 729 static const char *ad_map_type_string(enum wb_posix_mapping map_type)
 730 {
 731         switch (map_type) {
 732                 case WB_POSIX_MAP_TEMPLATE:
 733                         return wb_posix_map_template_string;
 734                 case WB_POSIX_MAP_SFU:
 735                         return wb_posix_map_sfu_string;
 736                 case WB_POSIX_MAP_SFU20:
 737                         return wb_posix_map_sfu20_string;
 738                 case WB_POSIX_MAP_RFC2307:
 739                         return wb_posix_map_rfc2307_string;
 740                 case WB_POSIX_MAP_UNIXINFO:
 741                         return wb_posix_map_unixinfo_string;
 742                 default:
 743                         return wb_posix_map_unknown_string;
 744         }
 745 }
 746
 747 static NTSTATUS nss_ad_generic_init(struct nss_domain_entry *e,
 748                                     enum wb_posix_mapping new_ad_map_type)
 749 {
 750         struct idmap_domain *dom;
 751         struct idmap_ad_context *ctx;
 752
 753         if (e->state != NULL) {
 754                 dom = talloc_get_type(e->state, struct idmap_domain);
 755         } else {
 756                 dom = TALLOC_ZERO_P(e, struct idmap_domain);
 757                 if (dom == NULL) {
 758                         DEBUG(0, ("Out of memory!\n"));
 759                         return NT_STATUS_NO_MEMORY;
 760                 }
 761                 e->state = dom;
 762         }
 763
 764         if (e->domain != NULL) {
 765                 dom->name = talloc_strdup(dom, e->domain);
 766                 if (dom->name == NULL) {
 767                         DEBUG(0, ("Out of memory!\n"));
 768                         return NT_STATUS_NO_MEMORY;
 769                 }
 770         }
 771
 772         if (dom->private_data != NULL) {
 773                 ctx = talloc_get_type(dom->private_data,
 774                                       struct idmap_ad_context);
 775         } else {
 776                 ctx = TALLOC_ZERO_P(dom, struct idmap_ad_context);
 777                 if (ctx == NULL) {
 778                         DEBUG(0, ("Out of memory!\n"));
 779                         return NT_STATUS_NO_MEMORY;
 780                 }
 781                 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
 782                 dom->private_data = ctx;
 783         }
 784
 785         if ((ctx->ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
 786             (ctx->ad_map_type != new_ad_map_type))
 787         {
 788                 DEBUG(2, ("nss_ad_generic_init: "
 789                           "Warning: overriding previously set posix map type "
 790                           "%s for domain %s with map type %s.\n",
 791                           ad_map_type_string(ctx->ad_map_type),
 792                           dom->name,
 793                           ad_map_type_string(new_ad_map_type)));
 794         }
 795
 796         ctx->ad_map_type = new_ad_map_type;
 797
 798         return NT_STATUS_OK;
 799 }
 800
 801 static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
 802 {
 803         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU);
 804 }
 805
 806 static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
 807 {
 808         return nss_ad_generic_init(e, WB_POSIX_MAP_SFU20);
 809 }
 810
 811 static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
 812 {
 813         return nss_ad_generic_init(e, WB_POSIX_MAP_RFC2307);
 814 }
 815
 816
 817 /************************************************************************
 818  ***********************************************************************/
 819
 820 static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
 821                                   const struct dom_sid *sid,
 822                                   TALLOC_CTX *mem_ctx,
 823                                   ADS_STRUCT *ads,
 824                                   LDAPMessage *msg,
 825                                   const char **homedir,
 826                                   const char **shell,
 827                                   const char **gecos,
 828                                   uint32 *gid )
 829 {
 830         const char *attrs[] = {NULL, /* attr_homedir */
 831                                NULL, /* attr_shell */
 832                                NULL, /* attr_gecos */
 833                                NULL, /* attr_gidnumber */
 834                                NULL };
 835         char *filter = NULL;
 836         LDAPMessage *msg_internal = NULL;
 837         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 838         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 839         char *sidstr = NULL;
 840         struct idmap_domain *dom;
 841         struct idmap_ad_context *ctx;
 842
 843         DEBUG(10, ("nss_ad_get_info called for sid [%s] in domain '%s'\n",
 844                    sid_string_dbg(sid), e->domain?e->domain:"NULL"));
 845
 846         /* Only do query if we are online */
 847         if (idmap_is_offline()) {
 848                 return NT_STATUS_FILE_IS_OFFLINE;
 849         }
 850
 851         dom = talloc_get_type(e->state, struct idmap_domain);
 852         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 853
 854         ads_status = ad_idmap_cached_connection(dom);
 855         if (!ADS_ERR_OK(ads_status)) {
 856                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 857         }
 858
 859         if (!ctx->ad_schema) {
 860                 DEBUG(10, ("nss_ad_get_info: no ad_schema configured!\n"));
 861                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 862         }
 863
 864         if (!sid || !homedir || !shell || !gecos) {
 865                 return NT_STATUS_INVALID_PARAMETER;
 866         }
 867
 868         /* See if we can use the ADS connection struct swe were given */
 869
 870         if (ads) {
 871                 DEBUG(10, ("nss_ad_get_info: using given ads connection and "
 872                            "LDAP message (%p)\n", msg));
 873
 874                 *homedir = ads_pull_string( ads, mem_ctx, msg, ctx->ad_schema->posix_homedir_attr );
 875                 *shell   = ads_pull_string( ads, mem_ctx, msg, ctx->ad_schema->posix_shell_attr );
 876                 *gecos   = ads_pull_string( ads, mem_ctx, msg, ctx->ad_schema->posix_gecos_attr );
 877
 878                 if (gid) {
 879                         if ( !ads_pull_uint32(ads, msg, ctx->ad_schema->posix_gidnumber_attr, gid ) )
 880                                 *gid = (uint32)-1;
 881                 }
 882
 883                 nt_status = NT_STATUS_OK;
 884                 goto done;
 885         }
 886
 887         /* Have to do our own query */
 888
 889         DEBUG(10, ("nss_ad_get_info: no ads connection given, doing our "
 890                    "own query\n"));
 891
 892         attrs[0] = ctx->ad_schema->posix_homedir_attr;
 893         attrs[1] = ctx->ad_schema->posix_shell_attr;
 894         attrs[2] = ctx->ad_schema->posix_gecos_attr;
 895         attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
 896
 897         sidstr = sid_binstring(mem_ctx, sid);
 898         filter = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr);
 899         TALLOC_FREE(sidstr);
 900
 901         if (!filter) {
 902                 nt_status = NT_STATUS_NO_MEMORY;
 903                 goto done;
 904         }
 905
 906         ads_status = ads_search_retry(ctx->ads, &msg_internal, filter, attrs);
 907         if (!ADS_ERR_OK(ads_status)) {
 908                 nt_status = ads_ntstatus(ads_status);
 909                 goto done;
 910         }
 911
 912         *homedir = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_homedir_attr);
 913         *shell   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_shell_attr);
 914         *gecos   = ads_pull_string(ctx->ads, mem_ctx, msg_internal, ctx->ad_schema->posix_gecos_attr);
 915
 916         if (gid) {
 917                 if (!ads_pull_uint32(ctx->ads, msg_internal, ctx->ad_schema->posix_gidnumber_attr, gid))
 918                         *gid = (uint32)-1;
 919         }
 920
 921         nt_status = NT_STATUS_OK;
 922
 923 done:
 924         if (msg_internal) {
 925                 ads_msgfree(ctx->ads, msg_internal);
 926         }
 927
 928         return nt_status;
 929 }
 930
 931 /**********************************************************************
 932  *********************************************************************/
 933
 934 static NTSTATUS nss_ad_map_to_alias(TALLOC_CTX *mem_ctx,
 935                                     struct nss_domain_entry *e,
 936                                     const char *name,
 937                                     char **alias)
 938 {
 939         const char *attrs[] = {NULL, /* attr_uid */
 940                                NULL };
 941         char *filter = NULL;
 942         LDAPMessage *msg = NULL;
 943         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
 944         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
 945         struct idmap_domain *dom;
 946         struct idmap_ad_context *ctx = NULL;
 947
 948         /* Check incoming parameters */
 949
 950         if ( !e || !e->domain || !name || !*alias) {
 951                 nt_status = NT_STATUS_INVALID_PARAMETER;
 952                 goto done;
 953         }
 954
 955         /* Only do query if we are online */
 956
 957         if (idmap_is_offline()) {
 958                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
 959                 goto done;
 960         }
 961
 962         dom = talloc_get_type(e->state, struct idmap_domain);
 963         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
 964
 965         ads_status = ad_idmap_cached_connection(dom);
 966         if (!ADS_ERR_OK(ads_status)) {
 967                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 968         }
 969
 970         if (!ctx->ad_schema) {
 971                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
 972                 goto done;
 973         }
 974
 975         attrs[0] = ctx->ad_schema->posix_uid_attr;
 976
 977         filter = talloc_asprintf(mem_ctx,
 978                                  "(sAMAccountName=%s)",
 979                                  name);
 980         if (!filter) {
 981                 nt_status = NT_STATUS_NO_MEMORY;
 982                 goto done;
 983         }
 984
 985         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
 986         if (!ADS_ERR_OK(ads_status)) {
 987                 nt_status = ads_ntstatus(ads_status);
 988                 goto done;
 989         }
 990
 991         *alias = ads_pull_string(ctx->ads, mem_ctx, msg, ctx->ad_schema->posix_uid_attr);
 992
 993         if (!*alias) {
 994                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 995         }
 996
 997         nt_status = NT_STATUS_OK;
 998
 999 done:
1000         if (filter) {
1001                 talloc_destroy(filter);
1002         }
1003         if (msg) {
1004                 ads_msgfree(ctx->ads, msg);
1005         }
1006
1007         return nt_status;
1008 }
1009
1010 /**********************************************************************
1011  *********************************************************************/
1012
1013 static NTSTATUS nss_ad_map_from_alias( TALLOC_CTX *mem_ctx,
1014                                              struct nss_domain_entry *e,
1015                                              const char *alias,
1016                                              char **name )
1017 {
1018         const char *attrs[] = {"sAMAccountName",
1019                                NULL };
1020         char *filter = NULL;
1021         LDAPMessage *msg = NULL;
1022         ADS_STATUS ads_status = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
1023         NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
1024         char *username;
1025         struct idmap_domain *dom;
1026         struct idmap_ad_context *ctx = NULL;
1027
1028         /* Check incoming parameters */
1029
1030         if ( !alias || !name) {
1031                 nt_status = NT_STATUS_INVALID_PARAMETER;
1032                 goto done;
1033         }
1034
1035         /* Only do query if we are online */
1036
1037         if (idmap_is_offline()) {
1038                 nt_status = NT_STATUS_FILE_IS_OFFLINE;
1039                 goto done;
1040         }
1041
1042         dom = talloc_get_type(e->state, struct idmap_domain);
1043         ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
1044
1045         ads_status = ad_idmap_cached_connection(dom);
1046         if (!ADS_ERR_OK(ads_status)) {
1047                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1048         }
1049
1050         if (!ctx->ad_schema) {
1051                 nt_status = NT_STATUS_OBJECT_PATH_NOT_FOUND;
1052                 goto done;
1053         }
1054
1055         filter = talloc_asprintf(mem_ctx,
1056                                  "(%s=%s)",
1057                                  ctx->ad_schema->posix_uid_attr,
1058                                  alias);
1059         if (!filter) {
1060                 nt_status = NT_STATUS_NO_MEMORY;
1061                 goto done;
1062         }
1063
1064         ads_status = ads_search_retry(ctx->ads, &msg, filter, attrs);
1065         if (!ADS_ERR_OK(ads_status)) {
1066                 nt_status = ads_ntstatus(ads_status);
1067                 goto done;
1068         }
1069
1070         username = ads_pull_string(ctx->ads, mem_ctx, msg,
1071                                    "sAMAccountName");
1072         if (!username) {
1073                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
1074         }
1075
1076         *name = talloc_asprintf(mem_ctx, "%s\\%s",
1077                                 lp_workgroup(),
1078                                 username);
1079         if (!*name) {
1080                 nt_status = NT_STATUS_NO_MEMORY;
1081                 goto done;
1082         }
1083
1084         nt_status = NT_STATUS_OK;
1085
1086 done:
1087         if (filter) {
1088                 talloc_destroy(filter);
1089         }
1090         if (msg) {
1091                 ads_msgfree(ctx->ads, msg);
1092         }
1093
1094         return nt_status;
1095 }
1096
1097
1098 /************************************************************************
1099  ***********************************************************************/
1100
1101 static NTSTATUS nss_ad_close( void )
1102 {
1103         /* nothing to do.  All memory is free()'d by the idmap close_fn() */
1104
1105         return NT_STATUS_OK;
1106 }
1107
1108 /************************************************************************
1109  Function dispatch tables for the idmap and nss plugins
1110  ***********************************************************************/
1111
1112 static struct idmap_methods ad_methods = {
1113         .init            = idmap_ad_initialize,
1114         .unixids_to_sids = idmap_ad_unixids_to_sids,
1115         .sids_to_unixids = idmap_ad_sids_to_unixids,
1116         .close_fn        = idmap_ad_close
1117 };
1118
1119 /* The SFU and RFC2307 NSS plugins share everything but the init
1120    function which sets the intended schema model to use */
1121
1122 static struct nss_info_methods nss_rfc2307_methods = {
1123         .init           = nss_rfc2307_init,
1124         .get_nss_info   = nss_ad_get_info,
1125         .map_to_alias   = nss_ad_map_to_alias,
1126         .map_from_alias = nss_ad_map_from_alias,
1127         .close_fn       = nss_ad_close
1128 };
1129
1130 static struct nss_info_methods nss_sfu_methods = {
1131         .init           = nss_sfu_init,
1132         .get_nss_info   = nss_ad_get_info,
1133         .map_to_alias   = nss_ad_map_to_alias,
1134         .map_from_alias = nss_ad_map_from_alias,
1135         .close_fn       = nss_ad_close
1136 };
1137
1138 static struct nss_info_methods nss_sfu20_methods = {
1139         .init           = nss_sfu20_init,
1140         .get_nss_info   = nss_ad_get_info,
1141         .map_to_alias   = nss_ad_map_to_alias,
1142         .map_from_alias = nss_ad_map_from_alias,
1143         .close_fn       = nss_ad_close
1144 };
1145
1146
1147
1148 /************************************************************************
1149  Initialize the plugins
1150  ***********************************************************************/
1151
1152 NTSTATUS idmap_ad_init(void)
1153 {
1154         static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
1155         static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
1156         static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
1157         static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
1158
1159         /* Always register the AD method first in order to get the
1160            idmap_domain interface called */
1161
1162         if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
1163                 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
1164                                                      "ad", &ad_methods);
1165                 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
1166                         return status_idmap_ad;
1167         }
1168
1169         if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
1170                 status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1171                                                             "rfc2307",  &nss_rfc2307_methods );
1172                 if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
1173                         return status_nss_rfc2307;
1174         }
1175
1176         if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
1177                 status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1178                                                         "sfu",  &nss_sfu_methods );
1179                 if ( !NT_STATUS_IS_OK(status_nss_sfu) )
1180                         return status_nss_sfu;
1181         }
1182
1183         if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
1184                 status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
1185                                                         "sfu20",  &nss_sfu20_methods );
1186                 if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
1187                         return status_nss_sfu20;
1188         }
1189
1190         return NT_STATUS_OK;
1191 }
1192