s3:passdb: add optional get_trusteddom_creds() hooks

[obnox/samba/samba-obnox.git] / source3 / passdb / pdb_interface.c

diff --git a/source3/passdb/pdb_interface.c b/source3/passdb/pdb_interface.c
index e48e6d40da3f013df77d1e43978b8273748e78ef..b8247f25952035e2b090ce5e37c628116a475bed 100644 (file)
--- a/source3/passdb/pdb_interface.c
+++ b/source3/passdb/pdb_interface.c
@@ -29,12 +29,13 @@
 #include "../librpc/gen_ndr/drsblobs.h"
 #include "../librpc/gen_ndr/ndr_drsblobs.h"
 #include "../librpc/gen_ndr/idmap.h"
-#include "memcache.h"
+#include "../lib/util/memcache.h"
 #include "nsswitch/winbind_client.h"
 #include "../libcli/security/security.h"
 #include "../lib/util/util_pw.h"
 #include "passdb/pdb_secrets.h"
 #include "lib/util_sid_passdb.h"
+#include "idmap_cache.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_PASSDB
@@ -557,7 +558,7 @@ static int smb_delete_user(const char *unix_user)
                return -1;
        }
 
-       del_script = lp_deluser_script(talloc_tos());
+       del_script = lp_delete_user_script(talloc_tos());
        if (!del_script || !*del_script) {
                return -1;
        }
@@ -1203,28 +1204,45 @@ bool pdb_get_seq_num(time_t *seq_num)
        return NT_STATUS_IS_OK(pdb->get_seq_num(pdb, seq_num));
 }
 
-bool pdb_uid_to_sid(uid_t uid, struct dom_sid *sid)
+/* 
+ * Instead of passing down a gid or uid, this function sends down a pointer
+ * to a unixid. 
+ *
+ * This acts as an in-out variable so that the idmap functions can correctly
+ * receive ID_TYPE_BOTH, filling in cache details correctly rather than forcing
+ * the cache to store ID_TYPE_UID or ID_TYPE_GID. 
+ */
+bool pdb_id_to_sid(struct unixid *id, struct dom_sid *sid)
 {
        struct pdb_methods *pdb = pdb_get_methods();
-       return pdb->uid_to_sid(pdb, uid, sid);
-}
+       bool ret;
 
-bool pdb_gid_to_sid(gid_t gid, struct dom_sid *sid)
-{
-       struct pdb_methods *pdb = pdb_get_methods();
-       return pdb->gid_to_sid(pdb, gid, sid);
+       ret = pdb->id_to_sid(pdb, id, sid);
+
+       if (ret == true) {
+               idmap_cache_set_sid2unixid(sid, id);
+       }
+
+       return ret;
 }
 
 bool pdb_sid_to_id(const struct dom_sid *sid, struct unixid *id)
 {
        struct pdb_methods *pdb = pdb_get_methods();
+       bool ret;
 
        /* only ask the backend if it is responsible */
        if (!sid_check_object_is_for_passdb(sid)) {
                return false;
        }
 
-       return pdb->sid_to_id(pdb, sid, id);
+       ret = pdb->sid_to_id(pdb, sid, id);
+
+       if (ret == true) {
+               idmap_cache_set_sid2unixid(sid, id);
+       }
+
+       return ret;
 }
 
 uint32_t pdb_capabilities(void)
@@ -1428,6 +1446,20 @@ static bool pdb_default_gid_to_sid(struct pdb_methods *methods, gid_t gid,
        return true;
 }
 
+static bool pdb_default_id_to_sid(struct pdb_methods *methods, struct unixid *id,
+                                  struct dom_sid *sid)
+{
+       switch (id->type) {
+       case ID_TYPE_UID:
+               return pdb_default_uid_to_sid(methods, id->id, sid);
+
+       case ID_TYPE_GID:
+               return pdb_default_gid_to_sid(methods, id->id, sid);
+
+       default:
+               return false;
+       }
+}
 /**
  * The "Unix User" and "Unix Group" domains have a special
  * id mapping that is a rid-algorithm with range starting at 0.
@@ -1489,12 +1521,16 @@ static bool pdb_default_sid_to_id(struct pdb_methods *methods,
                                id->id = uid;
                                break;
                        default:
-                               DEBUG(5, ("SID %s is our domain, but is not mapped to a user or group (got %d)\n",
+                               DEBUG(5, ("SID %s belongs to our domain, and "
+                                         "an object exists in the database, "
+                                          "but it is neither a user nor a "
+                                          "group (got type %d).\n",
                                          sid_string_dbg(sid), type));
                                ret = false;
                        }
                } else {
-                       DEBUG(5, ("SID %s is or domain, but is unmapped\n",
+                       DEBUG(5, ("SID %s belongs to our domain, but there is "
+                                 "no corresponding object in the database.\n",
                                  sid_string_dbg(sid)));
                }
                goto done;
@@ -2109,6 +2145,13 @@ bool pdb_get_trusteddom_pw(const char *domain, char** pwd, struct dom_sid *sid,
                        pass_last_set_time);
 }
 
+NTSTATUS pdb_get_trusteddom_creds(const char *domain, TALLOC_CTX *mem_ctx,
+                                 struct cli_credentials **creds)
+{
+       struct pdb_methods *pdb = pdb_get_methods();
+       return pdb->get_trusteddom_creds(pdb, domain, mem_ctx, creds);
+}
+
 bool pdb_set_trusteddom_pw(const char* domain, const char* pwd,
                           const struct dom_sid *sid)
 {
@@ -2146,6 +2189,15 @@ static bool pdb_default_get_trusteddom_pw(struct pdb_methods *methods,
 
 }
 
+static NTSTATUS pdb_default_get_trusteddom_creds(struct pdb_methods *methods,
+                                                const char *domain,
+                                                TALLOC_CTX *mem_ctx,
+                                                struct cli_credentials **creds)
+{
+       *creds = NULL;
+       return NT_STATUS_NOT_IMPLEMENTED;
+}
+
 static bool pdb_default_set_trusteddom_pw(struct pdb_methods *methods, 
                                          const char* domain, 
                                          const char* pwd,
@@ -2413,6 +2465,12 @@ static bool pdb_default_is_responsible_for_unix_groups(
        return true;
 }
 
+static bool pdb_default_is_responsible_for_everything_else(
+                                       struct pdb_methods *methods)
+{
+       return false;
+}
+
 bool pdb_is_responsible_for_our_sam(void)
 {
        struct pdb_methods *pdb = pdb_get_methods();
@@ -2443,6 +2501,12 @@ bool pdb_is_responsible_for_unix_groups(void)
        return pdb->is_responsible_for_unix_groups(pdb);
 }
 
+bool pdb_is_responsible_for_everything_else(void)
+{
+       struct pdb_methods *pdb = pdb_get_methods();
+       return pdb->is_responsible_for_everything_else(pdb);
+}
+
 /*******************************************************************
  secret methods
  *******************************************************************/
@@ -2568,14 +2632,14 @@ NTSTATUS make_pdb_method( struct pdb_methods **methods )
        (*methods)->get_account_policy = pdb_default_get_account_policy;
        (*methods)->set_account_policy = pdb_default_set_account_policy;
        (*methods)->get_seq_num = pdb_default_get_seq_num;
-       (*methods)->uid_to_sid = pdb_default_uid_to_sid;
-       (*methods)->gid_to_sid = pdb_default_gid_to_sid;
+       (*methods)->id_to_sid = pdb_default_id_to_sid;
        (*methods)->sid_to_id = pdb_default_sid_to_id;
 
        (*methods)->search_groups = pdb_default_search_groups;
        (*methods)->search_aliases = pdb_default_search_aliases;
 
        (*methods)->get_trusteddom_pw = pdb_default_get_trusteddom_pw;
+       (*methods)->get_trusteddom_creds = pdb_default_get_trusteddom_creds;
        (*methods)->set_trusteddom_pw = pdb_default_set_trusteddom_pw;
        (*methods)->del_trusteddom_pw = pdb_default_del_trusteddom_pw;
        (*methods)->enum_trusteddoms  = pdb_default_enum_trusteddoms;
@@ -2603,6 +2667,8 @@ NTSTATUS make_pdb_method( struct pdb_methods **methods )
                                pdb_default_is_responsible_for_unix_users;
        (*methods)->is_responsible_for_unix_groups =
                                pdb_default_is_responsible_for_unix_groups;
+       (*methods)->is_responsible_for_everything_else =
+                               pdb_default_is_responsible_for_everything_else;
 
        return NT_STATUS_OK;
 }