From 92d067497c60c5eab43bae11e6c1236e6cf760bb Mon Sep 17 00:00:00 2001
From: Jeremy Allison <jra@samba.org>
Date: Fri, 30 May 2008 23:11:31 -0700
Subject: [PATCH] Split the winbindd_passdb backend into a 'builtin' and a
 'sam' backend. This allows winbindd when running on a Samba PDC to correctly
 answer wbinfo -u lists and other queries. I will forward port this to 3.2 and
 3.3 over the weekend. Passes running under valgrind. Jeremy.

---
 source/nsswitch/winbindd_cache.c  |   4 +-
 source/nsswitch/winbindd_passdb.c | 429 ++++++++++++++++++++++--------
 source/nsswitch/winbindd_util.c   |   7 +-
 3 files changed, 329 insertions(+), 111 deletions(-)

diff --git a/source/nsswitch/winbindd_cache.c b/source/nsswitch/winbindd_cache.c
index 71e0688ae8e..a6733dbdd24 100644
--- a/source/nsswitch/winbindd_cache.c
+++ b/source/nsswitch/winbindd_cache.c
@@ -37,7 +37,7 @@ extern BOOL opt_nocache;
 #ifdef HAVE_ADS
 extern struct winbindd_methods ads_methods;
 #endif
-extern struct winbindd_methods passdb_methods;
+extern struct winbindd_methods builtin_passdb_methods;
 
 /*
  * JRA. KEEP THIS LIST UP TO DATE IF YOU ADD CACHE ENTRIES.
@@ -138,7 +138,7 @@ static struct winbind_cache *get_cache(struct winbindd_domain *domain)
 	/* We have to know what type of domain we are dealing with first. */
 
 	if (domain->internal) {
-		domain->backend = &passdb_methods;
+		domain->backend = &builtin_passdb_methods;
 		domain->initialized = True;
 	}
 	if ( !domain->initialized ) {
diff --git a/source/nsswitch/winbindd_passdb.c b/source/nsswitch/winbindd_passdb.c
index 56166be7d31..08c78a16c97 100644
--- a/source/nsswitch/winbindd_passdb.c
+++ b/source/nsswitch/winbindd_passdb.c
@@ -6,6 +6,7 @@
    Copyright (C) Tim Potter 2000-2001,2003
    Copyright (C) Simo Sorce 2003
    Copyright (C) Volker Lendecke 2004
+   Copyright (C) Jeremy Allison 2008
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -28,20 +29,6 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_WINBIND
 
-/* Query display info for a domain.  This returns enough information plus a
-   bit extra to give an overview of domain users for the User Manager
-   application. */
-static NTSTATUS query_user_list(struct winbindd_domain *domain,
-			       TALLOC_CTX *mem_ctx,
-			       uint32 *num_entries, 
-			       WINBIND_USERINFO **info)
-{
-	/* We don't have users */
-	*num_entries = 0;
-	*info = NULL;
-	return NT_STATUS_OK;
-}
-
 /* list all domain groups */
 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
 				TALLOC_CTX *mem_ctx,
@@ -143,23 +130,68 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain,
 
 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
 			      TALLOC_CTX *mem_ctx,
-			      const DOM_SID *sid,
+			      const DOM_SID *domain_sid,
 			      uint32 *rids,
 			      size_t num_rids,
 			      char **domain_name,
 			      char ***names,
 			      enum lsa_SidType **types)
 {
-	return NT_STATUS_UNSUCCESSFUL;
-}
+	size_t i;
+	bool have_mapped;
+	bool have_unmapped;
 
-/* Lookup user information from a rid or username. */
-static NTSTATUS query_user(struct winbindd_domain *domain, 
-			   TALLOC_CTX *mem_ctx, 
-			   const DOM_SID *user_sid,
-			   WINBIND_USERINFO *user_info)
-{
-	return NT_STATUS_NO_SUCH_USER;
+	*domain_name = NULL;
+	*names = NULL;
+	*types = NULL;
+
+	if (!num_rids) {
+		return NT_STATUS_OK;
+	}
+
+	*names = TALLOC_ARRAY(mem_ctx, char *, num_rids);
+	*types = TALLOC_ARRAY(mem_ctx, enum lsa_SidType, num_rids);
+
+	if ((*names == NULL) || (*types == NULL)) {
+		return NT_STATUS_NO_MEMORY;
+        }
+
+	have_mapped = have_unmapped = false;
+
+	for (i=0; i<num_rids; i++) {
+		DOM_SID sid;
+		const char *dom = NULL, *nam = NULL;
+		enum lsa_SidType type = SID_NAME_UNKNOWN;
+
+		if (!sid_compose(&sid, domain_sid, rids[i])) {
+			return NT_STATUS_INTERNAL_ERROR;
+                }
+
+		if (!lookup_sid(mem_ctx, &sid, &dom, &nam, &type)) {
+			have_unmapped = true;
+			(*types)[i] = SID_NAME_UNKNOWN;
+			(*names)[i] = talloc_strdup(mem_ctx, "");
+		} else {
+			have_mapped = true;
+			(*types)[i] = type;
+			(*names)[i] = CONST_DISCARD(char *, nam);
+		}
+
+		if (domain_name == NULL) {
+			*domain_name = CONST_DISCARD(char *, dom);
+		} else {
+			char *dname = CONST_DISCARD(char *, dom);
+			TALLOC_FREE(dname);
+		}
+	}
+
+	if (!have_mapped) {
+		return NT_STATUS_NONE_MAPPED;
+	}
+	if (!have_unmapped) {
+		return NT_STATUS_OK;
+	}
+	return STATUS_SOME_UNMAPPED;
 }
 
 /* Lookup groups a user is a member of.  I wish Unix had a call like this! */
@@ -178,7 +210,7 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	if ( !pdb_getsampwsid( user, user_sid ) ) {
+	if (!pdb_getsampwsid(user, user_sid ) ) {
 		return NT_STATUS_NO_SUCH_USER;
 	}
 
@@ -207,12 +239,249 @@ static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
 	return result;
 }
 
-/* Lookup group membership given a rid.   */
-static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
+/* find the sequence number for a domain */
+static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
+{
+	BOOL result;
+	time_t seq_num;
+
+	result = pdb_get_seq_num(&seq_num);
+	if (!result) {
+		*seq = 1;
+	}
+
+	*seq = (int) seq_num;
+	/* *seq = 1; */
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS lockout_policy(struct winbindd_domain *domain,
+			       TALLOC_CTX *mem_ctx,
+			       SAM_UNK_INFO_12 *policy)
+{
+	/* actually we have that */
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS password_policy(struct winbindd_domain *domain,
+				TALLOC_CTX *mem_ctx,
+				SAM_UNK_INFO_1 *policy)
+{
+	uint32 min_pass_len,pass_hist,password_properties;
+	time_t u_expire, u_min_age;
+	NTTIME nt_expire, nt_min_age;
+	uint32 account_policy_temp;
+
+	if ((policy = TALLOC_ZERO_P(mem_ctx, SAM_UNK_INFO_1)) == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	if (!pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp)) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	min_pass_len = account_policy_temp;
+
+	if (!pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp)) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	pass_hist = account_policy_temp;
+
+	if (!pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp)) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	password_properties = account_policy_temp;
+
+	if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp)) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	u_expire = account_policy_temp;
+
+	if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp)) {
+		return NT_STATUS_ACCESS_DENIED;
+	}
+	u_min_age = account_policy_temp;
+
+	unix_to_nt_time_abs(&nt_expire, u_expire);
+	unix_to_nt_time_abs(&nt_min_age, u_min_age);
+
+	init_unk_info1(policy, (uint16)min_pass_len, (uint16)pass_hist, 
+	               password_properties, nt_expire, nt_min_age);
+
+	return NT_STATUS_OK;
+}
+
+/*********************************************************************
+ BUILTIN specific functions.
+*********************************************************************/
+
+/* Query display info for a domain.  This returns enough information plus a
+   bit extra to give an overview of domain users for the User Manager
+   application. */
+static NTSTATUS builtin_query_user_list(struct winbindd_domain *domain,
+			       TALLOC_CTX *mem_ctx,
+			       uint32 *num_entries, 
+			       WINBIND_USERINFO **info)
+{
+	/* We don't have users */
+	*num_entries = 0;
+	*info = NULL;
+	return NT_STATUS_OK;
+}
+
+/* Lookup user information from a rid or username. */
+static NTSTATUS builtin_query_user(struct winbindd_domain *domain, 
+			   TALLOC_CTX *mem_ctx, 
+			   const DOM_SID *user_sid,
+			   WINBIND_USERINFO *user_info)
+{
+	return NT_STATUS_NO_SUCH_USER;
+}
+
+static NTSTATUS builtin_lookup_groupmem(struct winbindd_domain *domain,
 				TALLOC_CTX *mem_ctx,
 				const DOM_SID *group_sid, uint32 *num_names, 
 				DOM_SID **sid_mem, char ***names, 
 				uint32 **name_types)
+{
+	*num_names = 0;
+	*sid_mem = NULL;
+	*names = NULL;
+	*name_types = 0;
+	return NT_STATUS_NO_SUCH_GROUP;
+}
+
+/* get a list of trusted domains - builtin domain */
+static NTSTATUS builtin_trusted_domains(struct winbindd_domain *domain,
+				TALLOC_CTX *mem_ctx,
+				uint32 *num_domains,
+				char ***names,
+				char ***alt_names,
+				DOM_SID **dom_sids)
+{
+	*num_domains = 0;
+	*names = NULL;
+	*alt_names = NULL;
+	*dom_sids = NULL;
+	return NT_STATUS_OK;
+}
+
+/*********************************************************************
+ SAM specific functions.
+*********************************************************************/
+
+static NTSTATUS sam_query_user_list(struct winbindd_domain *domain,
+			       TALLOC_CTX *mem_ctx,
+			       uint32 *num_entries, 
+			       WINBIND_USERINFO **info)
+{
+	struct pdb_search *ps = pdb_search_users(ACB_NORMAL);
+	struct samr_displayentry *entries = NULL;
+	uint32 i;
+
+	*num_entries = 0;
+	*info = NULL;
+
+	if (!ps) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	*num_entries = pdb_search_entries(ps,
+					1, 0xffffffff,
+					&entries);
+
+	*info = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, *num_entries);
+	if (!(*info)) {
+		pdb_search_destroy(ps);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	for (i = 0; i < *num_entries; i++) {
+		struct samr_displayentry *e = &entries[i];
+
+		(*info)[i].acct_name = talloc_strdup(mem_ctx, e->account_name );
+		(*info)[i].full_name = talloc_strdup(mem_ctx, e->fullname );
+		(*info)[i].homedir = NULL;
+		(*info)[i].shell = NULL;
+		sid_compose(&(*info)[i].user_sid, &domain->sid, e->rid);
+
+		/* For the moment we set the primary group for
+		every user to be the Domain Users group.
+		There are serious problems with determining
+		the actual primary group for large domains.
+		This should really be made into a 'winbind
+		force group' smb.conf parameter or
+		something like that. */
+
+		sid_compose(&(*info)[i].group_sid, &domain->sid,
+				DOMAIN_GROUP_RID_USERS);
+	}
+
+	pdb_search_destroy(ps);
+	return NT_STATUS_OK;
+}
+
+/* Lookup user information from a rid or username. */
+static NTSTATUS sam_query_user(struct winbindd_domain *domain,
+			   TALLOC_CTX *mem_ctx,
+			   const DOM_SID *user_sid,
+			   WINBIND_USERINFO *user_info)
+{
+	struct samu *sampass = NULL;
+	fstring sidstr;
+
+	ZERO_STRUCTP(user_info);
+
+	if (!sid_check_is_in_our_domain(user_sid)) {
+		return NT_STATUS_NO_SUCH_USER;
+	}
+
+	sid_to_string(sidstr, user_sid);
+	DEBUG(10,("sam_query_user: getting samu info for sid %s\n",
+		sidstr ));
+
+	if (!(sampass = samu_new(mem_ctx))) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	if (!pdb_getsampwsid(sampass, user_sid)) {
+		TALLOC_FREE(sampass);
+		return NT_STATUS_NO_SUCH_USER;
+	}
+
+	if (pdb_get_group_sid(sampass) == NULL) {
+		TALLOC_FREE(sampass);
+		return NT_STATUS_NO_SUCH_GROUP;
+	}
+
+	sid_to_string(sidstr, sampass->group_sid);
+	DEBUG(10,("sam_query_user: group sid %s\n", sidstr ));
+
+	sid_copy(&user_info->user_sid, user_sid);
+	sid_copy(&user_info->group_sid, sampass->group_sid);
+
+	user_info->acct_name = talloc_strdup(mem_ctx, sampass->username ?
+					sampass->username : "");
+	user_info->full_name = talloc_strdup(mem_ctx, sampass->full_name ?
+					sampass->full_name : "");
+	user_info->homedir = talloc_strdup(mem_ctx, sampass->home_dir ?
+					sampass->home_dir : "");
+	if (sampass->unix_pw && sampass->unix_pw->pw_shell) {
+		user_info->shell = talloc_strdup(mem_ctx, sampass->unix_pw->pw_shell);
+	} else {
+		user_info->shell = talloc_strdup(mem_ctx, "");
+	}
+	user_info->primary_gid = sampass->unix_pw ? sampass->unix_pw->pw_gid : (gid_t)-1;
+
+	TALLOC_FREE(sampass);
+	return NT_STATUS_OK;
+}
+
+/* Lookup group membership given a rid.   */
+static NTSTATUS sam_lookup_groupmem(struct winbindd_domain *domain,
+				TALLOC_CTX *mem_ctx,
+				const DOM_SID *group_sid, uint32 *num_names,
+				DOM_SID **sid_mem, char ***names,
+				uint32 **name_types)
 {
 	size_t i, num_members, num_mapped;
 	uint32 *rids;
@@ -303,79 +572,8 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 	return NT_STATUS_OK;
 }
 
-/* find the sequence number for a domain */
-static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
-{
-	BOOL result;
-	time_t seq_num;
-
-	result = pdb_get_seq_num(&seq_num);
-	if (!result) {
-		*seq = 1;
-	}
-
-	*seq = (int) seq_num;
-	/* *seq = 1; */
-	return NT_STATUS_OK;
-}
-
-static NTSTATUS lockout_policy(struct winbindd_domain *domain,
-			       TALLOC_CTX *mem_ctx,
-			       SAM_UNK_INFO_12 *policy)
-{
-	/* actually we have that */
-	return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-static NTSTATUS password_policy(struct winbindd_domain *domain,
-				TALLOC_CTX *mem_ctx,
-				SAM_UNK_INFO_1 *policy)
-{
-	uint32 min_pass_len,pass_hist,password_properties;
-	time_t u_expire, u_min_age;
-	NTTIME nt_expire, nt_min_age;
-	uint32 account_policy_temp;
-
-	if ((policy = TALLOC_ZERO_P(mem_ctx, SAM_UNK_INFO_1)) == NULL) {
-		return NT_STATUS_NO_MEMORY;
-	}
-
-	if (!pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp)) {
-		return NT_STATUS_ACCESS_DENIED;
-	}
-	min_pass_len = account_policy_temp;
-
-	if (!pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp)) {
-		return NT_STATUS_ACCESS_DENIED;
-	}
-	pass_hist = account_policy_temp;
-
-	if (!pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp)) {
-		return NT_STATUS_ACCESS_DENIED;
-	}
-	password_properties = account_policy_temp;
-	
-	if (!pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp)) {
-		return NT_STATUS_ACCESS_DENIED;
-	}
-	u_expire = account_policy_temp;
-
-	if (!pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp)) {
-		return NT_STATUS_ACCESS_DENIED;
-	}
-	u_min_age = account_policy_temp;
-
-	unix_to_nt_time_abs(&nt_expire, u_expire);
-	unix_to_nt_time_abs(&nt_min_age, u_min_age);
-
-	init_unk_info1(policy, (uint16)min_pass_len, (uint16)pass_hist, 
-	               password_properties, nt_expire, nt_min_age);
-
-	return NT_STATUS_OK;
-}
-
-/* get a list of trusted domains */
-static NTSTATUS trusted_domains(struct winbindd_domain *domain,
+/* get a list of trusted domains - sam */
+static NTSTATUS sam_trusted_domains(struct winbindd_domain *domain,
 				TALLOC_CTX *mem_ctx,
 				uint32 *num_domains,
 				char ***names,
@@ -433,20 +631,39 @@ static NTSTATUS trusted_domains(struct winbindd_domain *domain,
 }
 
 /* the rpc backend methods are exposed via this structure */
-struct winbindd_methods passdb_methods = {
-	False,
-	query_user_list,
+struct winbindd_methods builtin_passdb_methods = {
+	false,
+	builtin_query_user_list,
+	enum_dom_groups,
+	enum_local_groups,
+	name_to_sid,
+	sid_to_name,
+	rids_to_names,
+	builtin_query_user,
+	lookup_usergroups,
+	lookup_useraliases,
+	builtin_lookup_groupmem,
+	sequence_number,
+	lockout_policy,
+	password_policy,
+	builtin_trusted_domains,
+};
+
+/* the rpc backend methods are exposed via this structure */
+struct winbindd_methods sam_passdb_methods = {
+	false,
+	sam_query_user_list,
 	enum_dom_groups,
 	enum_local_groups,
 	name_to_sid,
 	sid_to_name,
 	rids_to_names,
-	query_user,
+	sam_query_user,
 	lookup_usergroups,
 	lookup_useraliases,
-	lookup_groupmem,
+	sam_lookup_groupmem,
 	sequence_number,
 	lockout_policy,
 	password_policy,
-	trusted_domains,
+	sam_trusted_domains,
 };
diff --git a/source/nsswitch/winbindd_util.c b/source/nsswitch/winbindd_util.c
index d2daf7830db..50e3c0a5b9e 100644
--- a/source/nsswitch/winbindd_util.c
+++ b/source/nsswitch/winbindd_util.c
@@ -28,7 +28,8 @@
 #define DBGC_CLASS DBGC_WINBIND
 
 extern struct winbindd_methods cache_methods;
-extern struct winbindd_methods passdb_methods;
+extern struct winbindd_methods builtin_passdb_methods;
+extern struct winbindd_methods sam_passdb_methods;
 
 /**
  * @file winbindd_util.c
@@ -529,7 +530,7 @@ BOOL init_domain_list(void)
 	/* Local SAM */
 
 	domain = add_trusted_domain(get_global_sam_name(), NULL,
-				    &passdb_methods, get_global_sam_sid());
+				    &sam_passdb_methods, get_global_sam_sid());
 	if ( role != ROLE_DOMAIN_MEMBER ) {
 		domain->primary = True;
 	}
@@ -537,7 +538,7 @@ BOOL init_domain_list(void)
 
 	/* BUILTIN domain */
 
-	domain = add_trusted_domain("BUILTIN", NULL, &passdb_methods,
+	domain = add_trusted_domain("BUILTIN", NULL, &builtin_passdb_methods,
 				    &global_sid_Builtin);
 	setup_domain_child(domain, &domain->child, NULL);
 
-- 
2.34.1