2 * idmap_rid: static map between Active Directory/NT RIDs and RFC 2307 accounts
3 * Copyright (C) Guenther Deschner, 2004
4 * Copyright (C) Sumit Bose, 2004
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 #define DBGC_CLASS DBGC_IDMAP
27 struct idmap_rid_context {
28 const char *domain_name;
34 /******************************************************************************
35 compat params can't be used because of the completely different way
36 we support multiple domains in the new idmap
37 *****************************************************************************/
39 static NTSTATUS idmap_rid_initialize(struct idmap_domain *dom,
43 struct idmap_rid_context *ctx;
44 char *config_option = NULL;
51 ctx = TALLOC_ZERO_P(dom, struct idmap_rid_context);
53 DEBUG(0, ("Out of memory!\n"));
54 return NT_STATUS_NO_MEMORY;
57 config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
58 if ( ! config_option) {
59 DEBUG(0, ("Out of memory!\n"));
60 ret = NT_STATUS_NO_MEMORY;
64 range = lp_parm_const_string(-1, config_option, "range", NULL);
66 (sscanf(range, "%u - %u", &ctx->low_id, &ctx->high_id) != 2) ||
67 (ctx->low_id > ctx->high_id))
73 /* lets see if the range is defined by the old idmap uid/idmap gid */
74 if (!ctx->low_id && !ctx->high_id) {
75 if (lp_idmap_uid(&low_uid, &high_uid)) {
76 ctx->low_id = low_uid;
77 ctx->high_id = high_uid;
80 if (lp_idmap_gid(&low_gid, &high_gid)) {
81 if ((ctx->low_id != low_gid) ||
82 (ctx->high_id != high_uid)) {
83 DEBUG(1, ("ERROR: idmap uid range must match idmap gid range\n"));
84 ret = NT_STATUS_UNSUCCESSFUL;
90 if (!ctx->low_id || !ctx->high_id) {
91 DEBUG(1, ("ERROR: Invalid configuration, ID range missing or invalid\n"));
92 ret = NT_STATUS_UNSUCCESSFUL;
96 ctx->base_rid = lp_parm_int(-1, config_option, "base_rid", 0);
97 ctx->domain_name = talloc_strdup( ctx, dom->name );
99 dom->private_data = ctx;
101 talloc_free(config_option);
109 static NTSTATUS idmap_rid_id_to_sid(TALLOC_CTX *memctx, struct idmap_rid_context *ctx, struct id_map *map)
111 struct winbindd_domain *domain;
113 /* apply filters before checking */
114 if ((map->xid.id < ctx->low_id) || (map->xid.id > ctx->high_id)) {
115 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
116 map->xid.id, ctx->low_id, ctx->high_id));
117 return NT_STATUS_NONE_MAPPED;
120 if ( (domain = find_domain_from_name_noinit(ctx->domain_name)) == NULL ) {
121 return NT_STATUS_NO_SUCH_DOMAIN;
124 sid_compose(map->sid, &domain->sid, map->xid.id - ctx->low_id + ctx->base_rid);
126 /* We **really** should have some way of validating
127 the SID exists and is the correct type here. But
128 that is a deficiency in the idmap_rid design. */
130 map->status = ID_MAPPED;
135 /**********************************
136 Single sid to id lookup function.
137 **********************************/
139 static NTSTATUS idmap_rid_sid_to_id(TALLOC_CTX *memctx, struct idmap_rid_context *ctx, struct id_map *map)
143 sid_peek_rid(map->sid, &rid);
144 map->xid.id = rid - ctx->base_rid + ctx->low_id;
146 /* apply filters before returning result */
148 if ((map->xid.id < ctx->low_id) || (map->xid.id > ctx->high_id)) {
149 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
150 map->xid.id, ctx->low_id, ctx->high_id));
151 map->status = ID_UNMAPPED;
152 return NT_STATUS_NONE_MAPPED;
155 /* We **really** should have some way of validating
156 the SID exists and is the correct type here. But
157 that is a deficiency in the idmap_rid design. */
159 map->status = ID_MAPPED;
164 /**********************************
165 lookup a set of unix ids.
166 **********************************/
168 static NTSTATUS idmap_rid_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
170 struct idmap_rid_context *ridctx;
175 /* initialize the status to avoid suprise */
176 for (i = 0; ids[i]; i++) {
177 ids[i]->status = ID_UNKNOWN;
180 ridctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
182 ctx = talloc_new(dom);
184 DEBUG(0, ("Out of memory!\n"));
185 return NT_STATUS_NO_MEMORY;
188 for (i = 0; ids[i]; i++) {
190 ret = idmap_rid_id_to_sid(ctx, ridctx, ids[i]);
192 if (( ! NT_STATUS_IS_OK(ret)) &&
193 ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
194 /* some fatal error occurred, log it */
195 DEBUG(3, ("Unexpected error resolving an ID (%d)\n", ids[i]->xid.id));
203 /**********************************
204 lookup a set of sids.
205 **********************************/
207 static NTSTATUS idmap_rid_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
209 struct idmap_rid_context *ridctx;
214 /* initialize the status to avoid suprise */
215 for (i = 0; ids[i]; i++) {
216 ids[i]->status = ID_UNKNOWN;
219 ridctx = talloc_get_type(dom->private_data, struct idmap_rid_context);
221 ctx = talloc_new(dom);
223 DEBUG(0, ("Out of memory!\n"));
224 return NT_STATUS_NO_MEMORY;
227 for (i = 0; ids[i]; i++) {
229 ret = idmap_rid_sid_to_id(ctx, ridctx, ids[i]);
231 if (( ! NT_STATUS_IS_OK(ret)) &&
232 ( ! NT_STATUS_EQUAL(ret, NT_STATUS_NONE_MAPPED))) {
233 /* some fatal error occurred, log it */
234 DEBUG(3, ("Unexpected error resolving a SID (%s)\n",
235 sid_string_dbg(ids[i]->sid)));
243 static NTSTATUS idmap_rid_close(struct idmap_domain *dom)
245 if (dom->private_data) {
246 TALLOC_FREE(dom->private_data);
251 static struct idmap_methods rid_methods = {
252 .init = idmap_rid_initialize,
253 .unixids_to_sids = idmap_rid_unixids_to_sids,
254 .sids_to_unixids = idmap_rid_sids_to_unixids,
255 .close_fn = idmap_rid_close
258 NTSTATUS idmap_rid_init(void)
260 return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "rid", &rid_methods);