2 * idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
4 * Unix SMB/CIFS implementation.
6 * Winbind ADS backend functions
8 * Copyright (C) Andrew Tridgell 2001
9 * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
10 * Copyright (C) Gerald (Jerry) Carter 2004-2007
11 * Copyright (C) Luke Howard 2001-2004
12 * Copyright (C) Michael Adam 2008,2010
14 * This program is free software; you can redistribute it and/or modify
15 * it under the terms of the GNU General Public License as published by
16 * the Free Software Foundation; either version 3 of the License, or
17 * (at your option) any later version.
19 * This program is distributed in the hope that it will be useful,
20 * but WITHOUT ANY WARRANTY; without even the implied warranty of
21 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
22 * GNU General Public License for more details.
24 * You should have received a copy of the GNU General Public License
25 * along with this program; if not, see <http://www.gnu.org/licenses/>.
30 #include "../libds/common/flags.h"
32 #include "libads/ldap_schema.h"
35 #include "../libcli/ldap/ldap_ndr.h"
36 #include "../libcli/security/security.h"
39 #define DBGC_CLASS DBGC_IDMAP
41 #define CHECK_ALLOC_DONE(mem) do { \
43 DEBUG(0, ("Out of memory!\n")); \
44 ret = NT_STATUS_NO_MEMORY; \
49 struct idmap_ad_context {
51 struct posix_schema *ad_schema;
52 enum wb_posix_mapping ad_map_type; /* WB_POSIX_MAP_UNKNOWN */
55 /************************************************************************
56 ***********************************************************************/
58 static ADS_STATUS ad_idmap_cached_connection(struct idmap_domain *dom)
61 struct idmap_ad_context * ctx;
63 DEBUG(10, ("ad_idmap_cached_connection: called for domain '%s'\n",
66 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
68 status = ads_idmap_cached_connection(&ctx->ads, dom->name);
69 if (!ADS_ERR_OK(status)) {
73 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
75 /* if we have a valid ADS_STRUCT and the schema model is
76 defined, then we can return here. */
78 if ( ctx->ad_schema ) {
82 /* Otherwise, set the schema model */
84 if ( (ctx->ad_map_type == WB_POSIX_MAP_SFU) ||
85 (ctx->ad_map_type == WB_POSIX_MAP_SFU20) ||
86 (ctx->ad_map_type == WB_POSIX_MAP_RFC2307) )
88 status = ads_check_posix_schema_mapping(
89 ctx, ctx->ads, ctx->ad_map_type, &ctx->ad_schema);
90 if ( !ADS_ERR_OK(status) ) {
91 DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
98 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
100 if (ctx->ads != NULL) {
101 /* we own this ADS_STRUCT so make sure it goes away */
102 ctx->ads->is_mine = True;
103 ads_destroy( &ctx->ads );
109 /************************************************************************
110 ***********************************************************************/
112 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
114 struct idmap_ad_context *ctx;
116 const char *schema_mode = NULL;
118 ctx = talloc_zero(dom, struct idmap_ad_context);
120 DEBUG(0, ("Out of memory!\n"));
121 return NT_STATUS_NO_MEMORY;
123 talloc_set_destructor(ctx, idmap_ad_context_destructor);
125 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
126 if (config_option == NULL) {
127 DEBUG(0, ("Out of memory!\n"));
129 return NT_STATUS_NO_MEMORY;
132 /* default map type */
133 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
136 schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
137 if ( schema_mode && schema_mode[0] ) {
138 if ( strequal(schema_mode, "sfu") )
139 ctx->ad_map_type = WB_POSIX_MAP_SFU;
140 else if ( strequal(schema_mode, "sfu20" ) )
141 ctx->ad_map_type = WB_POSIX_MAP_SFU20;
142 else if ( strequal(schema_mode, "rfc2307" ) )
143 ctx->ad_map_type = WB_POSIX_MAP_RFC2307;
145 DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
149 dom->private_data = ctx;
151 talloc_free(config_option);
156 /************************************************************************
157 ***********************************************************************/
159 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
163 struct idmap_ad_context *ctx;
165 const char *attrs[] = { "sAMAccountType",
167 NULL, /* uidnumber */
168 NULL, /* gidnumber */
170 LDAPMessage *res = NULL;
171 LDAPMessage *entry = NULL;
177 char *u_filter = NULL;
178 char *g_filter = NULL;
180 /* initialize the status to avoid suprise */
181 for (i = 0; ids[i]; i++) {
182 ids[i]->status = ID_UNKNOWN;
185 /* Only do query if we are online */
186 if (idmap_is_offline()) {
187 return NT_STATUS_FILE_IS_OFFLINE;
190 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
192 if ( (memctx = talloc_new(ctx)) == NULL ) {
193 DEBUG(0, ("Out of memory!\n"));
194 return NT_STATUS_NO_MEMORY;
197 rc = ad_idmap_cached_connection(dom);
198 if (!ADS_ERR_OK(rc)) {
199 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
200 ret = NT_STATUS_UNSUCCESSFUL;
201 /* ret = ads_ntstatus(rc); */
205 attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
206 attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
210 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
211 switch (ids[idx]->xid.type) {
214 u_filter = talloc_asprintf(memctx, "(&(|"
215 "(sAMAccountType=%d)"
216 "(sAMAccountType=%d)"
217 "(sAMAccountType=%d))(|",
218 ATYPE_NORMAL_ACCOUNT,
219 ATYPE_WORKSTATION_TRUST,
220 ATYPE_INTERDOMAIN_TRUST);
222 u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
223 ctx->ad_schema->posix_uidnumber_attr,
224 (unsigned long)ids[idx]->xid.id);
225 CHECK_ALLOC_DONE(u_filter);
230 g_filter = talloc_asprintf(memctx, "(&(|"
231 "(sAMAccountType=%d)"
232 "(sAMAccountType=%d))(|",
233 ATYPE_SECURITY_GLOBAL_GROUP,
234 ATYPE_SECURITY_LOCAL_GROUP);
236 g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
237 ctx->ad_schema->posix_gidnumber_attr,
238 (unsigned long)ids[idx]->xid.id);
239 CHECK_ALLOC_DONE(g_filter);
243 DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
244 ids[idx]->status = ID_UNKNOWN;
248 filter = talloc_asprintf(memctx, "(|");
249 CHECK_ALLOC_DONE(filter);
251 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
252 CHECK_ALLOC_DONE(filter);
253 TALLOC_FREE(u_filter);
256 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
257 CHECK_ALLOC_DONE(filter);
258 TALLOC_FREE(g_filter);
260 filter = talloc_asprintf_append_buffer(filter, ")");
261 CHECK_ALLOC_DONE(filter);
263 rc = ads_search_retry(ctx->ads, &res, filter, attrs);
264 if (!ADS_ERR_OK(rc)) {
265 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
266 ret = NT_STATUS_UNSUCCESSFUL;
270 if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
271 DEBUG(10, ("No IDs found\n"));
275 for (i = 0; (i < count) && entry; i++) {
282 if (i == 0) { /* first entry */
283 entry = ads_first_entry(ctx->ads, entry);
284 } else { /* following ones */
285 entry = ads_next_entry(ctx->ads, entry);
289 DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
293 /* first check if the SID is present */
294 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
295 DEBUG(2, ("Could not retrieve SID from entry\n"));
300 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
301 DEBUG(1, ("could not get SAM account type\n"));
305 switch (atype & 0xF0000000) {
306 case ATYPE_SECURITY_GLOBAL_GROUP:
307 case ATYPE_SECURITY_LOCAL_GROUP:
310 case ATYPE_NORMAL_ACCOUNT:
311 case ATYPE_WORKSTATION_TRUST:
312 case ATYPE_INTERDOMAIN_TRUST:
316 DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
320 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
321 ctx->ad_schema->posix_uidnumber_attr :
322 ctx->ad_schema->posix_gidnumber_attr,
325 DEBUG(1, ("Could not get unix ID for SID %s\n",
326 dom_sid_string(talloc_tos(), &sid)));
330 if (!idmap_unix_id_is_in_range(id, dom)) {
331 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
332 id, dom->low_id, dom->high_id));
336 map = idmap_find_map_by_id(&ids[bidx], type, id);
338 DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
342 sid_copy(map->sid, &sid);
345 map->status = ID_MAPPED;
347 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
348 (unsigned long)map->xid.id,
353 ads_msgfree(ctx->ads, res);
356 if (ids[idx]) { /* still some values to map */
362 /* mark all unknown/expired ones as unmapped */
363 for (i = 0; ids[i]; i++) {
364 if (ids[i]->status != ID_MAPPED)
365 ids[i]->status = ID_UNMAPPED;
373 /************************************************************************
374 ***********************************************************************/
376 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
380 struct idmap_ad_context *ctx;
382 const char *attrs[] = { "sAMAccountType",
384 NULL, /* attr_uidnumber */
385 NULL, /* attr_gidnumber */
387 LDAPMessage *res = NULL;
388 LDAPMessage *entry = NULL;
396 /* initialize the status to avoid suprise */
397 for (i = 0; ids[i]; i++) {
398 ids[i]->status = ID_UNKNOWN;
401 /* Only do query if we are online */
402 if (idmap_is_offline()) {
403 return NT_STATUS_FILE_IS_OFFLINE;
406 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
408 if ( (memctx = talloc_new(ctx)) == NULL ) {
409 DEBUG(0, ("Out of memory!\n"));
410 return NT_STATUS_NO_MEMORY;
413 rc = ad_idmap_cached_connection(dom);
414 if (!ADS_ERR_OK(rc)) {
415 DEBUG(1, ("ADS uninitialized: %s\n", ads_errstr(rc)));
416 ret = NT_STATUS_UNSUCCESSFUL;
417 /* ret = ads_ntstatus(rc); */
421 if (ctx->ad_schema == NULL) {
422 DEBUG(0, ("haven't got ctx->ad_schema ! \n"));
423 ret = NT_STATUS_UNSUCCESSFUL;
427 attrs[2] = ctx->ad_schema->posix_uidnumber_attr;
428 attrs[3] = ctx->ad_schema->posix_gidnumber_attr;
431 filter = talloc_asprintf(memctx, "(&(|"
432 "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
433 "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
435 ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
436 ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
438 CHECK_ALLOC_DONE(filter);
441 for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
443 ids[idx]->status = ID_UNKNOWN;
445 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[idx]->sid);
446 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
449 CHECK_ALLOC_DONE(filter);
451 filter = talloc_asprintf_append_buffer(filter, "))");
452 CHECK_ALLOC_DONE(filter);
453 DEBUG(10, ("Filter: [%s]\n", filter));
455 rc = ads_search_retry(ctx->ads, &res, filter, attrs);
456 if (!ADS_ERR_OK(rc)) {
457 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
458 ret = NT_STATUS_UNSUCCESSFUL;
462 if ( (count = ads_count_replies(ctx->ads, res)) == 0 ) {
463 DEBUG(10, ("No IDs found\n"));
467 for (i = 0; (i < count) && entry; i++) {
474 if (i == 0) { /* first entry */
475 entry = ads_first_entry(ctx->ads, entry);
476 } else { /* following ones */
477 entry = ads_next_entry(ctx->ads, entry);
481 DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
485 /* first check if the SID is present */
486 if (!ads_pull_sid(ctx->ads, entry, "objectSid", &sid)) {
487 DEBUG(2, ("Could not retrieve SID from entry\n"));
491 map = idmap_find_map_by_sid(&ids[bidx], &sid);
493 DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
498 if (!ads_pull_uint32(ctx->ads, entry, "sAMAccountType", &atype)) {
499 DEBUG(1, ("could not get SAM account type\n"));
503 switch (atype & 0xF0000000) {
504 case ATYPE_SECURITY_GLOBAL_GROUP:
505 case ATYPE_SECURITY_LOCAL_GROUP:
508 case ATYPE_NORMAL_ACCOUNT:
509 case ATYPE_WORKSTATION_TRUST:
510 case ATYPE_INTERDOMAIN_TRUST:
514 DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
518 if (!ads_pull_uint32(ctx->ads, entry, (type==ID_TYPE_UID) ?
519 ctx->ad_schema->posix_uidnumber_attr :
520 ctx->ad_schema->posix_gidnumber_attr,
523 DEBUG(1, ("Could not get unix ID for SID %s\n",
524 sid_string_dbg(map->sid)));
527 if (!idmap_unix_id_is_in_range(id, dom)) {
528 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
529 id, dom->low_id, dom->high_id));
534 map->xid.type = type;
536 map->status = ID_MAPPED;
538 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
539 (unsigned long)map->xid.id,
544 ads_msgfree(ctx->ads, res);
547 if (ids[idx]) { /* still some values to map */
553 /* mark all unknown/expired ones as unmapped */
554 for (i = 0; ids[i]; i++) {
555 if (ids[i]->status != ID_MAPPED)
556 ids[i]->status = ID_UNMAPPED;
564 /************************************************************************
565 Function dispatch tables for the idmap and nss plugins
566 ***********************************************************************/
568 static struct idmap_methods ad_methods = {
569 .init = idmap_ad_initialize,
570 .unixids_to_sids = idmap_ad_unixids_to_sids,
571 .sids_to_unixids = idmap_ad_sids_to_unixids,
574 /************************************************************************
575 Initialize the plugins
576 ***********************************************************************/
579 NTSTATUS idmap_ad_init(void)
581 static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
582 static NTSTATUS status_ad_nss = NT_STATUS_UNSUCCESSFUL;
584 /* Always register the AD method first in order to get the
585 idmap_domain interface called */
587 if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
588 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
590 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
591 return status_idmap_ad;
594 if ( !NT_STATUS_IS_OK( status_ad_nss ) ) {
595 status_ad_nss = idmap_ad_nss_init();
596 if ( !NT_STATUS_IS_OK(status_ad_nss) )
597 return status_ad_nss;