2 Unix SMB/CIFS implementation.
4 Copyright (C) Simo Sorce 2003
5 Copyright (C) Jeremy Allison 2006
6 Copyright (C) Michael Adam 2010
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.*/
23 #include "winbindd_proto.h"
25 #include "idmap_cache.h"
26 #include "../libcli/security/security.h"
30 #define DBGC_CLASS DBGC_IDMAP
32 /*****************************************************************
33 Returns the SID mapped to the given UID.
34 If mapping is not possible returns an error.
35 *****************************************************************/
37 NTSTATUS idmap_uid_to_sid(const char *domname, struct dom_sid *sid, uid_t uid)
43 DEBUG(10,("idmap_uid_to_sid: uid = [%lu], domain = '%s'\n",
44 (unsigned long)uid, domname?domname:"NULL"));
46 if (winbindd_use_idmap_cache()
47 && idmap_cache_find_uid2sid(uid, sid, &expired)) {
48 DEBUG(10, ("idmap_cache_find_uid2sid found %u%s\n",
50 expired ? " (expired)": ""));
51 if (expired && idmap_is_online()) {
52 DEBUG(10, ("revalidating expired entry\n"));
55 if (is_null_sid(sid)) {
56 DEBUG(10, ("Returning negative cache entry\n"));
57 return NT_STATUS_NONE_MAPPED;
59 DEBUG(10, ("Returning positive cache entry\n"));
66 map.xid.type = ID_TYPE_UID;
69 ret = idmap_backends_unixid_to_sid(domname, &map);
70 if ( ! NT_STATUS_IS_OK(ret)) {
71 DEBUG(10, ("error mapping uid [%lu]: %s\n", (unsigned long)uid,
76 if (map.status != ID_MAPPED) {
77 if (winbindd_use_idmap_cache()) {
78 struct dom_sid null_sid;
80 id.type = ID_TYPE_UID;
82 ZERO_STRUCT(null_sid);
83 idmap_cache_set_sid2unixid(&null_sid, &id);
85 DEBUG(10, ("uid [%lu] not mapped\n", (unsigned long)uid));
86 return NT_STATUS_NONE_MAPPED;
89 if (winbindd_use_idmap_cache()) {
90 idmap_cache_set_sid2unixid(sid, &map.xid);
96 /*****************************************************************
97 Returns SID mapped to the given GID.
98 If mapping is not possible returns an error.
99 *****************************************************************/
101 NTSTATUS idmap_gid_to_sid(const char *domname, struct dom_sid *sid, gid_t gid)
107 DEBUG(10,("idmap_gid_to_sid: gid = [%lu], domain = '%s'\n",
108 (unsigned long)gid, domname?domname:"NULL"));
110 if (winbindd_use_idmap_cache()
111 && idmap_cache_find_gid2sid(gid, sid, &expired)) {
112 DEBUG(10, ("idmap_cache_find_gid2sid found %u%s\n",
114 expired ? " (expired)": ""));
115 if (expired && idmap_is_online()) {
116 DEBUG(10, ("revalidating expired entry\n"));
119 if (is_null_sid(sid)) {
120 DEBUG(10, ("Returning negative cache entry\n"));
121 return NT_STATUS_NONE_MAPPED;
123 DEBUG(10, ("Returning positive cache entry\n"));
130 map.xid.type = ID_TYPE_GID;
133 ret = idmap_backends_unixid_to_sid(domname, &map);
134 if ( ! NT_STATUS_IS_OK(ret)) {
135 DEBUG(10, ("error mapping gid [%lu]: %s\n", (unsigned long)gid,
140 if (map.status != ID_MAPPED) {
141 if (winbindd_use_idmap_cache()) {
142 struct dom_sid null_sid;
144 id.type = ID_TYPE_GID;
146 ZERO_STRUCT(null_sid);
147 idmap_cache_set_sid2unixid(&null_sid, &id);
149 DEBUG(10, ("gid [%lu] not mapped\n", (unsigned long)gid));
150 return NT_STATUS_NONE_MAPPED;
153 if (winbindd_use_idmap_cache()) {
154 idmap_cache_set_sid2unixid(sid, &map.xid);
161 * check whether a given unix id is inside the filter range of an idmap domain
163 bool idmap_unix_id_is_in_range(uint32_t id, struct idmap_domain *dom)
166 /* 0 is not an allowed unix id for id mapping */
170 if ((dom->low_id && (id < dom->low_id)) ||
171 (dom->high_id && (id > dom->high_id)))
180 * Helper for unixids_to_sids: find entry by id in mapping array,
181 * search up to IDMAP_AD_MAX_IDS entries
183 struct id_map *idmap_find_map_by_id(struct id_map **maps, enum id_type type,
188 for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
189 if (maps[i] == NULL) { /* end of the run */
192 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
201 * Helper for sids_to_unix_ids: find entry by SID in mapping array,
202 * search up to IDMAP_AD_MAX_IDS entries
204 struct id_map *idmap_find_map_by_sid(struct id_map **maps, struct dom_sid *sid)
208 for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
209 if (maps[i] == NULL) { /* end of the run */
212 if (dom_sid_equal(maps[i]->sid, sid)) {
220 char *idmap_fetch_secret(const char *backend, const char *domain,
221 const char *identity)
226 r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
231 /* make sure the key is case insensitive */
232 if (!strupper_m(tmp)) {
237 ret = secrets_fetch_generic(tmp, identity);