source3/winbindd/winbindd_ads.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Winbind ADS backend functions
   5
   6    Copyright (C) Andrew Tridgell 2001
   7    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
   8    Copyright (C) Gerald (Jerry) Carter 2004
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24 #include "includes.h"
  25 #include "winbindd.h"
  26
  27 #ifdef HAVE_ADS
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_WINBIND
  31
  32 extern struct winbindd_methods reconnect_methods;
  33
  34 /*
  35   return our ads connections structure for a domain. We keep the connection
  36   open to make things faster
  37 */
  38 static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
  39 {
  40         ADS_STRUCT *ads;
  41         ADS_STATUS status;
  42         fstring dc_name;
  43         struct sockaddr_storage dc_ss;
  44
  45         DEBUG(10,("ads_cached_connection\n"));
  46
  47         if (domain->private_data) {
  48
  49                 time_t expire;
  50                 time_t now = time(NULL);
  51
  52                 /* check for a valid structure */
  53                 ads = (ADS_STRUCT *)domain->private_data;
  54
  55                 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
  56
  57                 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
  58                           (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
  59
  60                 if ( ads->config.realm && (expire > now)) {
  61                         return ads;
  62                 } else {
  63                         /* we own this ADS_STRUCT so make sure it goes away */
  64                         DEBUG(7,("Deleting expired krb5 credential cache\n"));
  65                         ads->is_mine = True;
  66                         ads_destroy( &ads );
  67                         ads_kdestroy("MEMORY:winbind_ccache");
  68                         domain->private_data = NULL;
  69                 }
  70         }
  71
  72         /* we don't want this to affect the users ccache */
  73         setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
  74
  75         ads = ads_init(domain->alt_name, domain->name, NULL);
  76         if (!ads) {
  77                 DEBUG(1,("ads_init for domain %s failed\n", domain->name));
  78                 return NULL;
  79         }
  80
  81         /* the machine acct password might have change - fetch it every time */
  82
  83         SAFE_FREE(ads->auth.password);
  84         SAFE_FREE(ads->auth.realm);
  85
  86         if ( IS_DC ) {
  87                 DOM_SID sid;
  88                 time_t last_set_time;
  89
  90                 if ( !pdb_get_trusteddom_pw( domain->name, &ads->auth.password, &sid, &last_set_time ) ) {
  91                         ads_destroy( &ads );
  92                         return NULL;
  93                 }
  94                 ads->auth.realm = SMB_STRDUP( ads->server.realm );
  95                 strupper_m( ads->auth.realm );
  96         }
  97         else {
  98                 struct winbindd_domain *our_domain = domain;
  99
 100                 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
 101
 102                 /* always give preference to the alt_name in our
 103                    primary domain if possible */
 104
 105                 if ( !domain->primary )
 106                         our_domain = find_our_domain();
 107
 108                 if ( our_domain->alt_name[0] != '\0' ) {
 109                         ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
 110                         strupper_m( ads->auth.realm );
 111                 }
 112                 else
 113                         ads->auth.realm = SMB_STRDUP( lp_realm() );
 114         }
 115
 116         ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME;
 117
 118         /* Setup the server affinity cache.  We don't reaally care
 119            about the name.  Just setup affinity and the KRB5_CONFIG
 120            file. */
 121
 122         get_dc_name( ads->server.workgroup, ads->server.realm, dc_name, &dc_ss );
 123
 124         status = ads_connect(ads);
 125         if (!ADS_ERR_OK(status) || !ads->config.realm) {
 126                 DEBUG(1,("ads_connect for domain %s failed: %s\n",
 127                          domain->name, ads_errstr(status)));
 128                 ads_destroy(&ads);
 129
 130                 /* if we get ECONNREFUSED then it might be a NT4
 131                    server, fall back to MSRPC */
 132                 if (status.error_type == ENUM_ADS_ERROR_SYSTEM &&
 133                     status.err.rc == ECONNREFUSED) {
 134                         /* 'reconnect_methods' is the MS-RPC backend. */
 135                         DEBUG(1,("Trying MSRPC methods\n"));
 136                         domain->backend = &reconnect_methods;
 137                 }
 138                 return NULL;
 139         }
 140
 141         /* set the flag that says we don't own the memory even
 142            though we do so that ads_destroy() won't destroy the
 143            structure we pass back by reference */
 144
 145         ads->is_mine = False;
 146
 147         domain->private_data = (void *)ads;
 148         return ads;
 149 }
 150
 151
 152 /* Query display info for a realm. This is the basic user list fn */
 153 static NTSTATUS query_user_list(struct winbindd_domain *domain,
 154                                TALLOC_CTX *mem_ctx,
 155                                uint32 *num_entries,
 156                                WINBIND_USERINFO **info)
 157 {
 158         ADS_STRUCT *ads = NULL;
 159         const char *attrs[] = { "*", NULL };
 160         int i, count;
 161         ADS_STATUS rc;
 162         LDAPMessage *res = NULL;
 163         LDAPMessage *msg = NULL;
 164         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 165
 166         *num_entries = 0;
 167
 168         DEBUG(3,("ads: query_user_list\n"));
 169
 170         if ( !winbindd_can_contact_domain( domain ) ) {
 171                 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
 172                           domain->name));
 173                 return NT_STATUS_OK;
 174         }
 175
 176         ads = ads_cached_connection(domain);
 177
 178         if (!ads) {
 179                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 180                 goto done;
 181         }
 182
 183         rc = ads_search_retry(ads, &res, "(objectCategory=user)", attrs);
 184         if (!ADS_ERR_OK(rc) || !res) {
 185                 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
 186                 goto done;
 187         }
 188
 189         count = ads_count_replies(ads, res);
 190         if (count == 0) {
 191                 DEBUG(1,("query_user_list: No users found\n"));
 192                 goto done;
 193         }
 194
 195         (*info) = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, count);
 196         if (!*info) {
 197                 status = NT_STATUS_NO_MEMORY;
 198                 goto done;
 199         }
 200
 201         i = 0;
 202
 203         for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
 204                 char *name, *gecos = NULL;
 205                 char *homedir = NULL;
 206                 char *shell = NULL;
 207                 uint32 group;
 208                 uint32 atype;
 209                 DOM_SID user_sid;
 210                 gid_t primary_gid = (gid_t)-1;
 211
 212                 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
 213                     ads_atype_map(atype) != SID_NAME_USER) {
 214                         DEBUG(1,("Not a user account? atype=0x%x\n", atype));
 215                         continue;
 216                 }
 217
 218                 name = ads_pull_username(ads, mem_ctx, msg);
 219
 220                 if ( ads_pull_sid( ads, msg, "objectSid", &user_sid ) ) {
 221                         status = nss_get_info_cached( domain, &user_sid, mem_ctx,
 222                                                ads, msg, &homedir, &shell, &gecos,
 223                                                &primary_gid );
 224                 }
 225
 226                 if (gecos == NULL) {
 227                         gecos = ads_pull_string(ads, mem_ctx, msg, "name");
 228                 }
 229
 230                 if (!ads_pull_sid(ads, msg, "objectSid",
 231                                   &(*info)[i].user_sid)) {
 232                         DEBUG(1,("No sid for %s !?\n", name));
 233                         continue;
 234                 }
 235                 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
 236                         DEBUG(1,("No primary group for %s !?\n", name));
 237                         continue;
 238                 }
 239
 240                 (*info)[i].acct_name = name;
 241                 (*info)[i].full_name = gecos;
 242                 (*info)[i].homedir = homedir;
 243                 (*info)[i].shell = shell;
 244                 (*info)[i].primary_gid = primary_gid;
 245                 sid_compose(&(*info)[i].group_sid, &domain->sid, group);
 246                 i++;
 247         }
 248
 249         (*num_entries) = i;
 250         status = NT_STATUS_OK;
 251
 252         DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries)));
 253
 254 done:
 255         if (res)
 256                 ads_msgfree(ads, res);
 257
 258         return status;
 259 }
 260
 261 /* list all domain groups */
 262 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
 263                                 TALLOC_CTX *mem_ctx,
 264                                 uint32 *num_entries,
 265                                 struct acct_info **info)
 266 {
 267         ADS_STRUCT *ads = NULL;
 268         const char *attrs[] = {"userPrincipalName", "sAMAccountName",
 269                                "name", "objectSid", NULL};
 270         int i, count;
 271         ADS_STATUS rc;
 272         LDAPMessage *res = NULL;
 273         LDAPMessage *msg = NULL;
 274         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 275         const char *filter;
 276         bool enum_dom_local_groups = False;
 277
 278         *num_entries = 0;
 279
 280         DEBUG(3,("ads: enum_dom_groups\n"));
 281
 282         if ( !winbindd_can_contact_domain( domain ) ) {
 283                 DEBUG(10,("enum_dom_groups: No incoming trust for domain %s\n",
 284                           domain->name));
 285                 return NT_STATUS_OK;
 286         }
 287
 288         /* only grab domain local groups for our domain */
 289         if ( domain->active_directory && strequal(lp_realm(), domain->alt_name)  ) {
 290                 enum_dom_local_groups = True;
 291         }
 292
 293         /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
 294          * rollup-fixes:
 295          *
 296          * According to Section 5.1(4) of RFC 2251 if a value of a type is it's
 297          * default value, it MUST be absent. In case of extensible matching the
 298          * "dnattr" boolean defaults to FALSE and so it must be only be present
 299          * when set to TRUE.
 300          *
 301          * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
 302          * filter using bitwise matching rule then the buggy AD fails to decode
 303          * the extensible match. As a workaround set it to TRUE and thereby add
 304          * the dnAttributes "dn" field to cope with those older AD versions.
 305          * It should not harm and won't put any additional load on the AD since
 306          * none of the dn components have a bitmask-attribute.
 307          *
 308          * Thanks to Ralf Haferkamp for input and testing - Guenther */
 309
 310         filter = talloc_asprintf(mem_ctx, "(&(objectCategory=group)(&(groupType:dn:%s:=%d)(!(groupType:dn:%s:=%d))))",
 311                                  ADS_LDAP_MATCHING_RULE_BIT_AND, GROUP_TYPE_SECURITY_ENABLED,
 312                                  ADS_LDAP_MATCHING_RULE_BIT_AND,
 313                                  enum_dom_local_groups ? GROUP_TYPE_BUILTIN_LOCAL_GROUP : GROUP_TYPE_RESOURCE_GROUP);
 314
 315         if (filter == NULL) {
 316                 status = NT_STATUS_NO_MEMORY;
 317                 goto done;
 318         }
 319
 320         ads = ads_cached_connection(domain);
 321
 322         if (!ads) {
 323                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 324                 goto done;
 325         }
 326
 327         rc = ads_search_retry(ads, &res, filter, attrs);
 328         if (!ADS_ERR_OK(rc) || !res) {
 329                 DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc)));
 330                 goto done;
 331         }
 332
 333         count = ads_count_replies(ads, res);
 334         if (count == 0) {
 335                 DEBUG(1,("enum_dom_groups: No groups found\n"));
 336                 goto done;
 337         }
 338
 339         (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
 340         if (!*info) {
 341                 status = NT_STATUS_NO_MEMORY;
 342                 goto done;
 343         }
 344
 345         i = 0;
 346
 347         for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
 348                 char *name, *gecos;
 349                 DOM_SID sid;
 350                 uint32 rid;
 351
 352                 name = ads_pull_username(ads, mem_ctx, msg);
 353                 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
 354                 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
 355                         DEBUG(1,("No sid for %s !?\n", name));
 356                         continue;
 357                 }
 358
 359                 if (!sid_peek_check_rid(&domain->sid, &sid, &rid)) {
 360                         DEBUG(1,("No rid for %s !?\n", name));
 361                         continue;
 362                 }
 363
 364                 fstrcpy((*info)[i].acct_name, name);
 365                 fstrcpy((*info)[i].acct_desc, gecos);
 366                 (*info)[i].rid = rid;
 367                 i++;
 368         }
 369
 370         (*num_entries) = i;
 371
 372         status = NT_STATUS_OK;
 373
 374         DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries)));
 375
 376 done:
 377         if (res)
 378                 ads_msgfree(ads, res);
 379
 380         return status;
 381 }
 382
 383 /* list all domain local groups */
 384 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
 385                                 TALLOC_CTX *mem_ctx,
 386                                 uint32 *num_entries,
 387                                 struct acct_info **info)
 388 {
 389         /*
 390          * This is a stub function only as we returned the domain
 391          * local groups in enum_dom_groups() if the domain->native field
 392          * was true.  This is a simple performance optimization when
 393          * using LDAP.
 394          *
 395          * if we ever need to enumerate domain local groups separately,
 396          * then this optimization in enum_dom_groups() will need
 397          * to be split out
 398          */
 399         *num_entries = 0;
 400
 401         return NT_STATUS_OK;
 402 }
 403
 404 /* convert a single name to a sid in a domain - use rpc methods */
 405 static NTSTATUS name_to_sid(struct winbindd_domain *domain,
 406                             TALLOC_CTX *mem_ctx,
 407                             enum winbindd_cmd orig_cmd,
 408                             const char *domain_name,
 409                             const char *name,
 410                             DOM_SID *sid,
 411                             enum lsa_SidType *type)
 412 {
 413         return reconnect_methods.name_to_sid(domain, mem_ctx, orig_cmd,
 414                                              domain_name, name,
 415                                              sid, type);
 416 }
 417
 418 /* convert a domain SID to a user or group name - use rpc methods */
 419 static NTSTATUS sid_to_name(struct winbindd_domain *domain,
 420                             TALLOC_CTX *mem_ctx,
 421                             const DOM_SID *sid,
 422                             char **domain_name,
 423                             char **name,
 424                             enum lsa_SidType *type)
 425 {
 426         return reconnect_methods.sid_to_name(domain, mem_ctx, sid,
 427                                              domain_name, name, type);
 428 }
 429
 430 /* convert a list of rids to names - use rpc methods */
 431 static NTSTATUS rids_to_names(struct winbindd_domain *domain,
 432                               TALLOC_CTX *mem_ctx,
 433                               const DOM_SID *sid,
 434                               uint32 *rids,
 435                               size_t num_rids,
 436                               char **domain_name,
 437                               char ***names,
 438                               enum lsa_SidType **types)
 439 {
 440         return reconnect_methods.rids_to_names(domain, mem_ctx, sid,
 441                                                rids, num_rids,
 442                                                domain_name, names, types);
 443 }
 444
 445 /* If you are looking for "dn_lookup": Yes, it used to be here!
 446  * It has gone now since it was a major speed bottleneck in
 447  * lookup_groupmem (its only use). It has been replaced by
 448  * an rpc lookup sids call... R.I.P. */
 449
 450 /* Lookup user information from a rid */
 451 static NTSTATUS query_user(struct winbindd_domain *domain,
 452                            TALLOC_CTX *mem_ctx,
 453                            const DOM_SID *sid,
 454                            WINBIND_USERINFO *info)
 455 {
 456         ADS_STRUCT *ads = NULL;
 457         const char *attrs[] = { "*", NULL };
 458         ADS_STATUS rc;
 459         int count;
 460         LDAPMessage *msg = NULL;
 461         char *ldap_exp;
 462         char *sidstr;
 463         uint32 group_rid;
 464         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 465         struct netr_SamInfo3 *user = NULL;
 466
 467         DEBUG(3,("ads: query_user\n"));
 468
 469         info->homedir = NULL;
 470         info->shell = NULL;
 471         info->primary_gid = (gid_t)-1;
 472
 473         /* try netsamlogon cache first */
 474
 475         if ( (user = netsamlogon_cache_get( mem_ctx, sid )) != NULL )
 476         {
 477
 478                 DEBUG(5,("query_user: Cache lookup succeeded for %s\n",
 479                          sid_string_dbg(sid)));
 480
 481                 sid_compose(&info->user_sid, &domain->sid, user->base.rid);
 482                 sid_compose(&info->group_sid, &domain->sid, user->base.primary_gid);
 483
 484                 info->acct_name = talloc_strdup(mem_ctx, user->base.account_name.string);
 485                 info->full_name = talloc_strdup(mem_ctx, user->base.full_name.string);
 486
 487                 nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL,
 488                               &info->homedir, &info->shell, &info->full_name,
 489                               &info->primary_gid );
 490
 491                 TALLOC_FREE(user);
 492
 493                 return NT_STATUS_OK;
 494         }
 495
 496         if ( !winbindd_can_contact_domain(domain)) {
 497                 DEBUG(8,("query_user: No incoming trust from domain %s\n",
 498                          domain->name));
 499
 500                 /* We still need to generate some basic information
 501                    about the user even if we cannot contact the
 502                    domain.  Most of this stuff we can deduce. */
 503
 504                 sid_copy( &info->user_sid, sid );
 505
 506                 /* Assume "Domain Users" for the primary group */
 507
 508                 sid_compose(&info->group_sid, &domain->sid, DOMAIN_GROUP_RID_USERS );
 509
 510                 /* Try to fill in what the nss_info backend can do */
 511
 512                 nss_get_info_cached( domain, sid, mem_ctx, NULL, NULL,
 513                               &info->homedir, &info->shell, &info->full_name,
 514                               &info->primary_gid );
 515
 516                 status = NT_STATUS_OK;
 517                 goto done;
 518         }
 519
 520         /* no cache...do the query */
 521
 522         if ( (ads = ads_cached_connection(domain)) == NULL ) {
 523                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 524                 goto done;
 525         }
 526
 527         sidstr = sid_binstring(sid);
 528         if (asprintf(&ldap_exp, "(objectSid=%s)", sidstr) == -1) {
 529                 status = NT_STATUS_NO_MEMORY;
 530                 goto done;
 531         }
 532         rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
 533         free(ldap_exp);
 534         free(sidstr);
 535         if (!ADS_ERR_OK(rc) || !msg) {
 536                 DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
 537                          sid_string_dbg(sid), ads_errstr(rc)));
 538                 goto done;
 539         }
 540
 541         count = ads_count_replies(ads, msg);
 542         if (count != 1) {
 543                 DEBUG(1,("query_user(sid=%s): Not found\n",
 544                          sid_string_dbg(sid)));
 545                 goto done;
 546         }
 547
 548         info->acct_name = ads_pull_username(ads, mem_ctx, msg);
 549
 550         nss_get_info_cached( domain, sid, mem_ctx, ads, msg,
 551                       &info->homedir, &info->shell, &info->full_name,
 552                       &info->primary_gid );
 553
 554         if (info->full_name == NULL) {
 555                 info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
 556         }
 557
 558         if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
 559                 DEBUG(1,("No primary group for %s !?\n",
 560                          sid_string_dbg(sid)));
 561                 goto done;
 562         }
 563
 564         sid_copy(&info->user_sid, sid);
 565         sid_compose(&info->group_sid, &domain->sid, group_rid);
 566
 567         status = NT_STATUS_OK;
 568
 569         DEBUG(3,("ads query_user gave %s\n", info->acct_name));
 570 done:
 571         if (msg)
 572                 ads_msgfree(ads, msg);
 573
 574         return status;
 575 }
 576
 577 /* Lookup groups a user is a member of - alternate method, for when
 578    tokenGroups are not available. */
 579 static NTSTATUS lookup_usergroups_member(struct winbindd_domain *domain,
 580                                          TALLOC_CTX *mem_ctx,
 581                                          const char *user_dn,
 582                                          DOM_SID *primary_group,
 583                                          size_t *p_num_groups, DOM_SID **user_sids)
 584 {
 585         ADS_STATUS rc;
 586         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 587         int count;
 588         LDAPMessage *res = NULL;
 589         LDAPMessage *msg = NULL;
 590         char *ldap_exp;
 591         ADS_STRUCT *ads;
 592         const char *group_attrs[] = {"objectSid", NULL};
 593         char *escaped_dn;
 594         size_t num_groups = 0;
 595
 596         DEBUG(3,("ads: lookup_usergroups_member\n"));
 597
 598         if ( !winbindd_can_contact_domain( domain ) ) {
 599                 DEBUG(10,("lookup_usergroups_members: No incoming trust for domain %s\n",
 600                           domain->name));
 601                 return NT_STATUS_OK;
 602         }
 603
 604         ads = ads_cached_connection(domain);
 605
 606         if (!ads) {
 607                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 608                 goto done;
 609         }
 610
 611         if (!(escaped_dn = escape_ldap_string_alloc(user_dn))) {
 612                 status = NT_STATUS_NO_MEMORY;
 613                 goto done;
 614         }
 615
 616         ldap_exp = talloc_asprintf(mem_ctx,
 617                 "(&(member=%s)(objectCategory=group)(groupType:dn:%s:=%d))",
 618                 escaped_dn,
 619                 ADS_LDAP_MATCHING_RULE_BIT_AND,
 620                 GROUP_TYPE_SECURITY_ENABLED);
 621         if (!ldap_exp) {
 622                 DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn));
 623                 SAFE_FREE(escaped_dn);
 624                 status = NT_STATUS_NO_MEMORY;
 625                 goto done;
 626         }
 627
 628         SAFE_FREE(escaped_dn);
 629
 630         rc = ads_search_retry(ads, &res, ldap_exp, group_attrs);
 631
 632         if (!ADS_ERR_OK(rc) || !res) {
 633                 DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc)));
 634                 return ads_ntstatus(rc);
 635         }
 636
 637         count = ads_count_replies(ads, res);
 638
 639         *user_sids = NULL;
 640         num_groups = 0;
 641
 642         /* always add the primary group to the sid array */
 643         status = add_sid_to_array(mem_ctx, primary_group, user_sids,
 644                                   &num_groups);
 645         if (!NT_STATUS_IS_OK(status)) {
 646                 goto done;
 647         }
 648
 649         if (count > 0) {
 650                 for (msg = ads_first_entry(ads, res); msg;
 651                      msg = ads_next_entry(ads, msg)) {
 652                         DOM_SID group_sid;
 653
 654                         if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
 655                                 DEBUG(1,("No sid for this group ?!?\n"));
 656                                 continue;
 657                         }
 658
 659                         /* ignore Builtin groups from ADS - Guenther */
 660                         if (sid_check_is_in_builtin(&group_sid)) {
 661                                 continue;
 662                         }
 663
 664                         status = add_sid_to_array(mem_ctx, &group_sid,
 665                                                   user_sids, &num_groups);
 666                         if (!NT_STATUS_IS_OK(status)) {
 667                                 goto done;
 668                         }
 669                 }
 670
 671         }
 672
 673         *p_num_groups = num_groups;
 674         status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 675
 676         DEBUG(3,("ads lookup_usergroups (member) succeeded for dn=%s\n", user_dn));
 677 done:
 678         if (res)
 679                 ads_msgfree(ads, res);
 680
 681         return status;
 682 }
 683
 684 /* Lookup groups a user is a member of - alternate method, for when
 685    tokenGroups are not available. */
 686 static NTSTATUS lookup_usergroups_memberof(struct winbindd_domain *domain,
 687                                            TALLOC_CTX *mem_ctx,
 688                                            const char *user_dn,
 689                                            DOM_SID *primary_group,
 690                                            size_t *p_num_groups,
 691                                            DOM_SID **user_sids)
 692 {
 693         ADS_STATUS rc;
 694         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 695         ADS_STRUCT *ads;
 696         const char *attrs[] = {"memberOf", NULL};
 697         size_t num_groups = 0;
 698         DOM_SID *group_sids = NULL;
 699         int i;
 700         char **strings = NULL;
 701         size_t num_strings = 0, num_sids = 0;
 702
 703
 704         DEBUG(3,("ads: lookup_usergroups_memberof\n"));
 705
 706         if ( !winbindd_can_contact_domain( domain ) ) {
 707                 DEBUG(10,("lookup_usergroups_memberof: No incoming trust for "
 708                           "domain %s\n", domain->name));
 709                 return NT_STATUS_OK;
 710         }
 711
 712         ads = ads_cached_connection(domain);
 713
 714         if (!ads) {
 715                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 716                 return NT_STATUS_UNSUCCESSFUL;
 717         }
 718
 719         rc = ads_search_retry_extended_dn_ranged(ads, mem_ctx, user_dn, attrs,
 720                                                  ADS_EXTENDED_DN_HEX_STRING,
 721                                                  &strings, &num_strings);
 722
 723         if (!ADS_ERR_OK(rc)) {
 724                 DEBUG(1,("lookup_usergroups_memberof ads_search "
 725                         "member=%s: %s\n", user_dn, ads_errstr(rc)));
 726                 return ads_ntstatus(rc);
 727         }
 728
 729         *user_sids = NULL;
 730         num_groups = 0;
 731
 732         /* always add the primary group to the sid array */
 733         status = add_sid_to_array(mem_ctx, primary_group, user_sids,
 734                                   &num_groups);
 735         if (!NT_STATUS_IS_OK(status)) {
 736                 goto done;
 737         }
 738
 739         group_sids = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_strings + 1);
 740         if (!group_sids) {
 741                 status = NT_STATUS_NO_MEMORY;
 742                 goto done;
 743         }
 744
 745         for (i=0; i<num_strings; i++) {
 746                 rc = ads_get_sid_from_extended_dn(mem_ctx, strings[i],
 747                                                   ADS_EXTENDED_DN_HEX_STRING,
 748                                                   &(group_sids)[i]);
 749                 if (!ADS_ERR_OK(rc)) {
 750                         /* ignore members without SIDs */
 751                         if (NT_STATUS_EQUAL(ads_ntstatus(rc),
 752                             NT_STATUS_NOT_FOUND)) {
 753                                 continue;
 754                         }
 755                         else {
 756                                 status = ads_ntstatus(rc);
 757                                 goto done;
 758                         }
 759                 }
 760                 num_sids++;
 761         }
 762
 763         if (i == 0) {
 764                 DEBUG(1,("No memberOf for this user?!?\n"));
 765                 status = NT_STATUS_NO_MEMORY;
 766                 goto done;
 767         }
 768
 769         for (i=0; i<num_sids; i++) {
 770
 771                 /* ignore Builtin groups from ADS - Guenther */
 772                 if (sid_check_is_in_builtin(&group_sids[i])) {
 773                         continue;
 774                 }
 775
 776                 status = add_sid_to_array(mem_ctx, &group_sids[i], user_sids,
 777                                           &num_groups);
 778                 if (!NT_STATUS_IS_OK(status)) {
 779                         goto done;
 780                 }
 781
 782         }
 783
 784         *p_num_groups = num_groups;
 785         status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 786
 787         DEBUG(3,("ads lookup_usergroups (memberof) succeeded for dn=%s\n",
 788                 user_dn));
 789
 790 done:
 791         TALLOC_FREE(strings);
 792         TALLOC_FREE(group_sids);
 793
 794         return status;
 795 }
 796
 797
 798 /* Lookup groups a user is a member of. */
 799 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 800                                   TALLOC_CTX *mem_ctx,
 801                                   const DOM_SID *sid,
 802                                   uint32 *p_num_groups, DOM_SID **user_sids)
 803 {
 804         ADS_STRUCT *ads = NULL;
 805         const char *attrs[] = {"tokenGroups", "primaryGroupID", NULL};
 806         ADS_STATUS rc;
 807         int count;
 808         LDAPMessage *msg = NULL;
 809         char *user_dn = NULL;
 810         DOM_SID *sids;
 811         int i;
 812         DOM_SID primary_group;
 813         uint32 primary_group_rid;
 814         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 815         size_t num_groups = 0;
 816
 817         DEBUG(3,("ads: lookup_usergroups\n"));
 818         *p_num_groups = 0;
 819
 820         status = lookup_usergroups_cached(domain, mem_ctx, sid,
 821                                           p_num_groups, user_sids);
 822         if (NT_STATUS_IS_OK(status)) {
 823                 return NT_STATUS_OK;
 824         }
 825
 826         if ( !winbindd_can_contact_domain( domain ) ) {
 827                 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
 828                           domain->name));
 829
 830                 /* Tell the cache manager not to remember this one */
 831
 832                 return NT_STATUS_SYNCHRONIZATION_REQUIRED;
 833         }
 834
 835         ads = ads_cached_connection(domain);
 836
 837         if (!ads) {
 838                 domain->last_status = NT_STATUS_SERVER_DISABLED;
 839                 status = NT_STATUS_SERVER_DISABLED;
 840                 goto done;
 841         }
 842
 843         rc = ads_search_retry_sid(ads, &msg, sid, attrs);
 844
 845         if (!ADS_ERR_OK(rc)) {
 846                 status = ads_ntstatus(rc);
 847                 DEBUG(1, ("lookup_usergroups(sid=%s) ads_search tokenGroups: "
 848                           "%s\n", sid_string_dbg(sid), ads_errstr(rc)));
 849                 goto done;
 850         }
 851
 852         count = ads_count_replies(ads, msg);
 853         if (count != 1) {
 854                 status = NT_STATUS_UNSUCCESSFUL;
 855                 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
 856                          "invalid number of results (count=%d)\n",
 857                          sid_string_dbg(sid), count));
 858                 goto done;
 859         }
 860
 861         if (!msg) {
 862                 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
 863                          sid_string_dbg(sid)));
 864                 status = NT_STATUS_UNSUCCESSFUL;
 865                 goto done;
 866         }
 867
 868         user_dn = ads_get_dn(ads, mem_ctx, msg);
 869         if (user_dn == NULL) {
 870                 status = NT_STATUS_NO_MEMORY;
 871                 goto done;
 872         }
 873
 874         if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
 875                 DEBUG(1,("%s: No primary group for sid=%s !?\n",
 876                          domain->name, sid_string_dbg(sid)));
 877                 goto done;
 878         }
 879
 880         sid_copy(&primary_group, &domain->sid);
 881         sid_append_rid(&primary_group, primary_group_rid);
 882
 883         count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
 884
 885         /* there must always be at least one group in the token,
 886            unless we are talking to a buggy Win2k server */
 887
 888         /* actually this only happens when the machine account has no read
 889          * permissions on the tokenGroup attribute - gd */
 890
 891         if (count == 0) {
 892
 893                 /* no tokenGroups */
 894
 895                 /* lookup what groups this user is a member of by DN search on
 896                  * "memberOf" */
 897
 898                 status = lookup_usergroups_memberof(domain, mem_ctx, user_dn,
 899                                                     &primary_group,
 900                                                     &num_groups, user_sids);
 901                 *p_num_groups = (uint32)num_groups;
 902                 if (NT_STATUS_IS_OK(status)) {
 903                         goto done;
 904                 }
 905
 906                 /* lookup what groups this user is a member of by DN search on
 907                  * "member" */
 908
 909                 status = lookup_usergroups_member(domain, mem_ctx, user_dn,
 910                                                   &primary_group,
 911                                                   &num_groups, user_sids);
 912                 *p_num_groups = (uint32)num_groups;
 913                 goto done;
 914         }
 915
 916         *user_sids = NULL;
 917         num_groups = 0;
 918
 919         status = add_sid_to_array(mem_ctx, &primary_group, user_sids,
 920                                   &num_groups);
 921         if (!NT_STATUS_IS_OK(status)) {
 922                 goto done;
 923         }
 924
 925         for (i=0;i<count;i++) {
 926
 927                 /* ignore Builtin groups from ADS - Guenther */
 928                 if (sid_check_is_in_builtin(&sids[i])) {
 929                         continue;
 930                 }
 931
 932                 status = add_sid_to_array_unique(mem_ctx, &sids[i],
 933                                                  user_sids, &num_groups);
 934                 if (!NT_STATUS_IS_OK(status)) {
 935                         goto done;
 936                 }
 937         }
 938
 939         *p_num_groups = (uint32)num_groups;
 940         status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
 941
 942         DEBUG(3,("ads lookup_usergroups (tokenGroups) succeeded for sid=%s\n",
 943                  sid_string_dbg(sid)));
 944 done:
 945         TALLOC_FREE(user_dn);
 946         ads_msgfree(ads, msg);
 947         return status;
 948 }
 949
 950 /* Lookup aliases a user is member of - use rpc methods */
 951 static NTSTATUS lookup_useraliases(struct winbindd_domain *domain,
 952                                    TALLOC_CTX *mem_ctx,
 953                                    uint32 num_sids, const DOM_SID *sids,
 954                                    uint32 *num_aliases, uint32 **alias_rids)
 955 {
 956         return reconnect_methods.lookup_useraliases(domain, mem_ctx,
 957                                                     num_sids, sids,
 958                                                     num_aliases,
 959                                                     alias_rids);
 960 }
 961
 962 /*
 963   find the members of a group, given a group rid and domain
 964  */
 965 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 966                                 TALLOC_CTX *mem_ctx,
 967                                 const DOM_SID *group_sid, uint32 *num_names,
 968                                 DOM_SID **sid_mem, char ***names,
 969                                 uint32 **name_types)
 970 {
 971         ADS_STATUS rc;
 972         ADS_STRUCT *ads = NULL;
 973         char *ldap_exp;
 974         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 975         char *sidbinstr;
 976         char **members = NULL;
 977         int i;
 978         size_t num_members = 0;
 979         ads_control args;
 980         DOM_SID *sid_mem_nocache = NULL;
 981         char **names_nocache = NULL;
 982         enum lsa_SidType *name_types_nocache = NULL;
 983         char **domains_nocache = NULL;     /* only needed for rpccli_lsa_lookup_sids */
 984         uint32 num_nocache = 0;
 985         TALLOC_CTX *tmp_ctx = NULL;
 986
 987         DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
 988                   sid_string_dbg(group_sid)));
 989
 990         *num_names = 0;
 991
 992         tmp_ctx = talloc_new(mem_ctx);
 993         if (!tmp_ctx) {
 994                 DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
 995                 status = NT_STATUS_NO_MEMORY;
 996                 goto done;
 997         }
 998
 999         if ( !winbindd_can_contact_domain( domain ) ) {
1000                 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
1001                           domain->name));
1002                 return NT_STATUS_OK;
1003         }
1004
1005         ads = ads_cached_connection(domain);
1006
1007         if (!ads) {
1008                 domain->last_status = NT_STATUS_SERVER_DISABLED;
1009                 goto done;
1010         }
1011
1012         if ((sidbinstr = sid_binstring(group_sid)) == NULL) {
1013                 status = NT_STATUS_NO_MEMORY;
1014                 goto done;
1015         }
1016
1017         /* search for all members of the group */
1018         if (!(ldap_exp = talloc_asprintf(tmp_ctx, "(objectSid=%s)",
1019                                          sidbinstr)))
1020         {
1021                 SAFE_FREE(sidbinstr);
1022                 DEBUG(1, ("ads: lookup_groupmem: talloc_asprintf for ldap_exp failed!\n"));
1023                 status = NT_STATUS_NO_MEMORY;
1024                 goto done;
1025         }
1026         SAFE_FREE(sidbinstr);
1027
1028         args.control = ADS_EXTENDED_DN_OID;
1029         args.val = ADS_EXTENDED_DN_HEX_STRING;
1030         args.critical = True;
1031
1032         rc = ads_ranged_search(ads, tmp_ctx, LDAP_SCOPE_SUBTREE, ads->config.bind_path,
1033                                ldap_exp, &args, "member", &members, &num_members);
1034
1035         if (!ADS_ERR_OK(rc)) {
1036                 DEBUG(0,("ads_ranged_search failed with: %s\n", ads_errstr(rc)));
1037                 status = NT_STATUS_UNSUCCESSFUL;
1038                 goto done;
1039         }
1040
1041         DEBUG(10, ("ads lookup_groupmem: got %d sids via extended dn call\n", (int)num_members));
1042
1043         /* Now that we have a list of sids, we need to get the
1044          * lists of names and name_types belonging to these sids.
1045          * even though conceptually not quite clean,  we use the
1046          * RPC call lsa_lookup_sids for this since it can handle a
1047          * list of sids. ldap calls can just resolve one sid at a time.
1048          *
1049          * At this stage, the sids are still hidden in the exetended dn
1050          * member output format. We actually do a little better than
1051          * stated above: In extracting the sids from the member strings,
1052          * we try to resolve as many sids as possible from the
1053          * cache. Only the rest is passed to the lsa_lookup_sids call. */
1054
1055         if (num_members) {
1056                 (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
1057                 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
1058                 (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
1059                 (sid_mem_nocache) = TALLOC_ZERO_ARRAY(tmp_ctx, DOM_SID, num_members);
1060
1061                 if ((members == NULL) || (*sid_mem == NULL) ||
1062                     (*names == NULL) || (*name_types == NULL) ||
1063                     (sid_mem_nocache == NULL))
1064                 {
1065                         DEBUG(1, ("ads: lookup_groupmem: talloc failed\n"));
1066                         status = NT_STATUS_NO_MEMORY;
1067                         goto done;
1068                 }
1069         }
1070         else {
1071                 (*sid_mem) = NULL;
1072                 (*names) = NULL;
1073                 (*name_types) = NULL;
1074         }
1075
1076         for (i=0; i<num_members; i++) {
1077                 enum lsa_SidType name_type;
1078                 char *name, *domain_name;
1079                 DOM_SID sid;
1080
1081                 rc = ads_get_sid_from_extended_dn(tmp_ctx, members[i], args.val,
1082                     &sid);
1083                 if (!ADS_ERR_OK(rc)) {
1084                         if (NT_STATUS_EQUAL(ads_ntstatus(rc),
1085                             NT_STATUS_NOT_FOUND)) {
1086                                 /* Group members can be objects, like Exchange
1087                                  * Public Folders, that don't have a SID.  Skip
1088                                  * them. */
1089                                 continue;
1090                         }
1091                         else {
1092                                 status = ads_ntstatus(rc);
1093                                 goto done;
1094                         }
1095                 }
1096                 if (lookup_cached_sid(mem_ctx, &sid, &domain_name, &name,
1097                     &name_type)) {
1098                         DEBUG(10,("ads: lookup_groupmem: got sid %s from "
1099                                   "cache\n", sid_string_dbg(&sid)));
1100                         sid_copy(&(*sid_mem)[*num_names], &sid);
1101                         (*names)[*num_names] = fill_domain_username_talloc(
1102                                                         *names,
1103                                                         domain_name,
1104                                                         name,
1105                                                         true);
1106
1107                         (*name_types)[*num_names] = name_type;
1108                         (*num_names)++;
1109                 }
1110                 else {
1111                         DEBUG(10, ("ads: lookup_groupmem: sid %s not found in "
1112                                    "cache\n", sid_string_dbg(&sid)));
1113                         sid_copy(&(sid_mem_nocache)[num_nocache], &sid);
1114                         num_nocache++;
1115                 }
1116         }
1117
1118         DEBUG(10, ("ads: lookup_groupmem: %d sids found in cache, "
1119                   "%d left for lsa_lookupsids\n", *num_names, num_nocache));
1120
1121         /* handle sids not resolved from cache by lsa_lookup_sids */
1122         if (num_nocache > 0) {
1123
1124                 status = winbindd_lookup_sids(tmp_ctx,
1125                                               domain,
1126                                               num_nocache,
1127                                               sid_mem_nocache,
1128                                               &domains_nocache,
1129                                               &names_nocache,
1130                                               &name_types_nocache);
1131
1132                 if (!(NT_STATUS_IS_OK(status) ||
1133                       NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED) ||
1134                       NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)))
1135                 {
1136                         DEBUG(1, ("lsa_lookupsids call failed with %s "
1137                                   "- retrying...\n", nt_errstr(status)));
1138
1139                         status = winbindd_lookup_sids(tmp_ctx,
1140                                                       domain,
1141                                                       num_nocache,
1142                                                       sid_mem_nocache,
1143                                                       &domains_nocache,
1144                                                       &names_nocache,
1145                                                       &name_types_nocache);
1146                 }
1147
1148                 if (NT_STATUS_IS_OK(status) ||
1149                     NT_STATUS_EQUAL(status, STATUS_SOME_UNMAPPED))
1150                 {
1151                         /* Copy the entries over from the "_nocache" arrays
1152                          * to the result arrays, skipping the gaps the
1153                          * lookup_sids call left. */
1154                         for (i=0; i < num_nocache; i++) {
1155                                 if (((names_nocache)[i] != NULL) &&
1156                                     ((name_types_nocache)[i] != SID_NAME_UNKNOWN))
1157                                 {
1158                                         sid_copy(&(*sid_mem)[*num_names],
1159                                                  &sid_mem_nocache[i]);
1160                                         (*names)[*num_names] =
1161                                                 fill_domain_username_talloc(
1162                                                         *names,
1163                                                         domains_nocache[i],
1164                                                         names_nocache[i],
1165                                                         true);
1166                                         (*name_types)[*num_names] = name_types_nocache[i];
1167                                         (*num_names)++;
1168                                 }
1169                         }
1170                 }
1171                 else if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED)) {
1172                         DEBUG(10, ("lookup_groupmem: lsa_lookup_sids could "
1173                                    "not map any SIDs at all.\n"));
1174                         /* Don't handle this as an error here.
1175                          * There is nothing left to do with respect to the
1176                          * overall result... */
1177                 }
1178                 else if (!NT_STATUS_IS_OK(status)) {
1179                         DEBUG(10, ("lookup_groupmem: Error looking up %d "
1180                                    "sids via rpc_lsa_lookup_sids: %s\n",
1181                                    (int)num_members, nt_errstr(status)));
1182                         goto done;
1183                 }
1184         }
1185
1186         status = NT_STATUS_OK;
1187         DEBUG(3,("ads lookup_groupmem for sid=%s succeeded\n",
1188                  sid_string_dbg(group_sid)));
1189
1190 done:
1191
1192         TALLOC_FREE(tmp_ctx);
1193
1194         return status;
1195 }
1196
1197 /* find the sequence number for a domain */
1198 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
1199 {
1200         ADS_STRUCT *ads = NULL;
1201         ADS_STATUS rc;
1202
1203         DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
1204
1205         if ( !winbindd_can_contact_domain( domain ) ) {
1206                 DEBUG(10,("sequence: No incoming trust for domain %s\n",
1207                           domain->name));
1208                 *seq = time(NULL);
1209                 return NT_STATUS_OK;
1210         }
1211
1212         *seq = DOM_SEQUENCE_NONE;
1213
1214         ads = ads_cached_connection(domain);
1215
1216         if (!ads) {
1217                 domain->last_status = NT_STATUS_SERVER_DISABLED;
1218                 return NT_STATUS_UNSUCCESSFUL;
1219         }
1220
1221         rc = ads_USN(ads, seq);
1222
1223         if (!ADS_ERR_OK(rc)) {
1224
1225                 /* its a dead connection, destroy it */
1226
1227                 if (domain->private_data) {
1228                         ads = (ADS_STRUCT *)domain->private_data;
1229                         ads->is_mine = True;
1230                         ads_destroy(&ads);
1231                         ads_kdestroy("MEMORY:winbind_ccache");
1232                         domain->private_data = NULL;
1233                 }
1234         }
1235         return ads_ntstatus(rc);
1236 }
1237
1238 /* find the lockout policy of a domain - use rpc methods */
1239 static NTSTATUS lockout_policy(struct winbindd_domain *domain,
1240                                TALLOC_CTX *mem_ctx,
1241                                struct samr_DomInfo12 *policy)
1242 {
1243         return reconnect_methods.lockout_policy(domain, mem_ctx, policy);
1244 }
1245
1246 /* find the password policy of a domain - use rpc methods */
1247 static NTSTATUS password_policy(struct winbindd_domain *domain,
1248                                 TALLOC_CTX *mem_ctx,
1249                                 struct samr_DomInfo1 *policy)
1250 {
1251         return reconnect_methods.password_policy(domain, mem_ctx, policy);
1252 }
1253
1254 /* get a list of trusted domains */
1255 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
1256                                 TALLOC_CTX *mem_ctx,
1257                                 uint32 *num_domains,
1258                                 char ***names,
1259                                 char ***alt_names,
1260                                 DOM_SID **dom_sids)
1261 {
1262         NTSTATUS                result = NT_STATUS_UNSUCCESSFUL;
1263         struct netr_DomainTrustList trusts;
1264         int                     i;
1265         uint32                  flags;
1266         struct rpc_pipe_client *cli;
1267         uint32                 fr_flags = (NETR_TRUST_FLAG_IN_FOREST | NETR_TRUST_FLAG_TREEROOT);
1268         int ret_count;
1269
1270         DEBUG(3,("ads: trusted_domains\n"));
1271
1272         *num_domains = 0;
1273         *alt_names   = NULL;
1274         *names       = NULL;
1275         *dom_sids    = NULL;
1276
1277         /* If this is our primary domain or a root in our forest,
1278            query for all trusts.  If not, then just look for domain
1279            trusts in the target forest */
1280
1281         if ( domain->primary ||
1282                 ((domain->domain_flags&fr_flags) == fr_flags) )
1283         {
1284                 flags = NETR_TRUST_FLAG_OUTBOUND |
1285                         NETR_TRUST_FLAG_INBOUND |
1286                         NETR_TRUST_FLAG_IN_FOREST;
1287         } else {
1288                 flags = NETR_TRUST_FLAG_IN_FOREST;
1289         }
1290
1291         result = cm_connect_netlogon(domain, &cli);
1292
1293         if (!NT_STATUS_IS_OK(result)) {
1294                 DEBUG(5, ("trusted_domains: Could not open a connection to %s "
1295                           "for PIPE_NETLOGON (%s)\n",
1296                           domain->name, nt_errstr(result)));
1297                 return NT_STATUS_UNSUCCESSFUL;
1298         }
1299
1300         result = rpccli_netr_DsrEnumerateDomainTrusts(cli, mem_ctx,
1301                                                       cli->desthost,
1302                                                       flags,
1303                                                       &trusts,
1304                                                       NULL);
1305         if ( NT_STATUS_IS_OK(result) && trusts.count) {
1306
1307                 /* Allocate memory for trusted domain names and sids */
1308
1309                 if ( !(*names = TALLOC_ARRAY(mem_ctx, char *, trusts.count)) ) {
1310                         DEBUG(0, ("trusted_domains: out of memory\n"));
1311                         return NT_STATUS_NO_MEMORY;
1312                 }
1313
1314                 if ( !(*alt_names = TALLOC_ARRAY(mem_ctx, char *, trusts.count)) ) {
1315                         DEBUG(0, ("trusted_domains: out of memory\n"));
1316                         return NT_STATUS_NO_MEMORY;
1317                 }
1318
1319                 if ( !(*dom_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, trusts.count)) ) {
1320                         DEBUG(0, ("trusted_domains: out of memory\n"));
1321                         return NT_STATUS_NO_MEMORY;
1322                 }
1323
1324                 /* Copy across names and sids */
1325
1326
1327                 ret_count = 0;
1328                 for (i = 0; i < trusts.count; i++) {
1329                         struct winbindd_domain d;
1330
1331                         ZERO_STRUCT(d);
1332
1333                         /* drop external trusts if this is not our primary
1334                            domain.  This means that the returned number of
1335                            domains may be less that the ones actually trusted
1336                            by the DC. */
1337
1338                         if ( (trusts.array[i].trust_attributes == NETR_TRUST_ATTRIBUTE_QUARANTINED_DOMAIN) &&
1339                              !domain->primary )
1340                         {
1341                                 DEBUG(10,("trusted_domains: Skipping external trusted domain "
1342                                           "%s because it is outside of our primary domain\n",
1343                                           trusts.array[i].netbios_name));
1344                                 continue;
1345                         }
1346
1347                         (*names)[ret_count] = CONST_DISCARD(char *, trusts.array[i].netbios_name);
1348                         (*alt_names)[ret_count] = CONST_DISCARD(char *, trusts.array[i].dns_name);
1349                         if (trusts.array[i].sid) {
1350                                 sid_copy(&(*dom_sids)[ret_count], trusts.array[i].sid);
1351                         } else {
1352                                 sid_copy(&(*dom_sids)[ret_count], &global_sid_NULL);
1353                         }
1354
1355                         /* add to the trusted domain cache */
1356
1357                         fstrcpy( d.name,  trusts.array[i].netbios_name);
1358                         fstrcpy( d.alt_name, trusts.array[i].dns_name);
1359                         if (trusts.array[i].sid) {
1360                                 sid_copy( &d.sid, trusts.array[i].sid);
1361                         } else {
1362                                 sid_copy(&d.sid, &global_sid_NULL);
1363                         }
1364
1365                         if ( domain->primary ) {
1366                                 DEBUG(10,("trusted_domains(ads):  Searching "
1367                                           "trusted domain list of %s and storing "
1368                                           "trust flags for domain %s\n",
1369                                           domain->name, d.alt_name));
1370
1371                                 d.domain_flags = trusts.array[i].trust_flags;
1372                                 d.domain_type = trusts.array[i].trust_type;
1373                                 d.domain_trust_attribs = trusts.array[i].trust_attributes;
1374
1375                                 wcache_tdc_add_domain( &d );
1376                                 ret_count++;
1377                         } else if ( (domain->domain_flags&fr_flags) == fr_flags ) {
1378                                 /* Check if we already have this record. If
1379                                  * we are following our forest root that is not
1380                                  * our primary domain, we want to keep trust
1381                                  * flags from the perspective of our primary
1382                                  * domain not our forest root. */
1383                                 struct winbindd_tdc_domain *exist = NULL;
1384
1385                                 exist =
1386                                     wcache_tdc_fetch_domain(NULL, trusts.array[i].netbios_name);
1387                                 if (!exist) {
1388                                         DEBUG(10,("trusted_domains(ads):  Searching "
1389                                                   "trusted domain list of %s and storing "
1390                                                   "trust flags for domain %s\n",
1391                                                   domain->name, d.alt_name));
1392                                         d.domain_flags = trusts.array[i].trust_flags;
1393                                         d.domain_type = trusts.array[i].trust_type;
1394                                         d.domain_trust_attribs = trusts.array[i].trust_attributes;
1395
1396                                         wcache_tdc_add_domain( &d );
1397                                         ret_count++;
1398                                 }
1399                                 TALLOC_FREE(exist);
1400                         } else {
1401                                 /* This gets a little tricky.  If we are
1402                                    following a transitive forest trust, then
1403                                    innerit the flags, type, and attribs from
1404                                    the domain we queried to make sure we don't
1405                                    record the view of the trust from the wrong
1406                                    side.  Always view it from the side of our
1407                                    primary domain.   --jerry */
1408                                 struct winbindd_tdc_domain *parent = NULL;
1409
1410                                 DEBUG(10,("trusted_domains(ads):  Searching "
1411                                           "trusted domain list of %s and inheriting "
1412                                           "trust flags for domain %s\n",
1413                                           domain->name, d.alt_name));
1414
1415                                 parent = wcache_tdc_fetch_domain(NULL, domain->name);
1416                                 if (parent) {
1417                                         d.domain_flags = parent->trust_flags;
1418                                         d.domain_type  = parent->trust_type;
1419                                         d.domain_trust_attribs = parent->trust_attribs;
1420                                 } else {
1421                                         d.domain_flags = domain->domain_flags;
1422                                         d.domain_type  = domain->domain_type;
1423                                         d.domain_trust_attribs = domain->domain_trust_attribs;
1424                                 }
1425                                 TALLOC_FREE(parent);
1426
1427                                 wcache_tdc_add_domain( &d );
1428                                 ret_count++;
1429                         }
1430                 }
1431
1432                 *num_domains = ret_count;
1433         }
1434
1435         return result;
1436 }
1437
1438 /* the ADS backend methods are exposed via this structure */
1439 struct winbindd_methods ads_methods = {
1440         True,
1441         query_user_list,
1442         enum_dom_groups,
1443         enum_local_groups,
1444         name_to_sid,
1445         sid_to_name,
1446         rids_to_names,
1447         query_user,
1448         lookup_usergroups,
1449         lookup_useraliases,
1450         lookup_groupmem,
1451         sequence_number,
1452         lockout_policy,
1453         password_policy,
1454         trusted_domains,
1455 };
1456
1457 #endif