source3/winbindd/idmap_ad.c

   1 /*
   2  * idmap_ad: map between Active Directory and RFC 2307 accounts
   3  *
   4  * Copyright (C) Volker Lendecke 2015
   5  *
   6  * This program is free software; you can redistribute it and/or modify
   7  * it under the terms of the GNU General Public License as published by
   8  * the Free Software Foundation; either version 3 of the License, or
   9  * (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License
  17  * along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "idmap.h"
  23 #include "tldap_gensec_bind.h"
  24 #include "tldap_util.h"
  25 #include "lib/param/param.h"
  26 #include "utils/net.h"
  27 #include "auth/gensec/gensec.h"
  28 #include "librpc/gen_ndr/ndr_netlogon.h"
  29 #include "libads/ldap_schema_oids.h"
  30 #include "../libds/common/flags.h"
  31 #include "libcli/ldap/ldap_ndr.h"
  32 #include "libcli/security/dom_sid.h"
  33
  34 struct idmap_ad_schema_names;
  35
  36 struct idmap_ad_context {
  37         struct idmap_domain *dom;
  38         struct tldap_context *ld;
  39         struct idmap_ad_schema_names *schema;
  40         const char *default_nc;
  41 };
  42
  43 static char *get_schema_path(TALLOC_CTX *mem_ctx, struct tldap_context *ld)
  44 {
  45         struct tldap_message *rootdse;
  46
  47         rootdse = tldap_rootdse(ld);
  48         if (rootdse == NULL) {
  49                 return NULL;
  50         }
  51
  52         return tldap_talloc_single_attribute(rootdse, "schemaNamingContext",
  53                                              mem_ctx);
  54 }
  55
  56 static char *get_default_nc(TALLOC_CTX *mem_ctx, struct tldap_context *ld)
  57 {
  58         struct tldap_message *rootdse;
  59
  60         rootdse = tldap_rootdse(ld);
  61         if (rootdse == NULL) {
  62                 return NULL;
  63         }
  64
  65         return tldap_talloc_single_attribute(rootdse, "defaultNamingContext",
  66                                              mem_ctx);
  67 }
  68
  69 struct idmap_ad_schema_names {
  70         char *name;
  71         char *uid;
  72         char *gid;
  73         char *gecos;
  74         char *dir;
  75         char *shell;
  76 };
  77
  78 static TLDAPRC get_attrnames_by_oids(struct tldap_context *ld,
  79                                      TALLOC_CTX *mem_ctx,
  80                                      const char *schema_path,
  81                                      size_t num_oids,
  82                                      const char **oids,
  83                                      char **names)
  84 {
  85         char *filter;
  86         const char *attrs[] = { "lDAPDisplayName", "attributeId" };
  87         size_t i;
  88         TLDAPRC rc;
  89         struct tldap_message **msgs;
  90         size_t num_msgs;
  91
  92         filter = talloc_strdup(mem_ctx, "(|");
  93         if (filter == NULL) {
  94                 return TLDAP_NO_MEMORY;
  95         }
  96
  97         for (i=0; i<num_oids; i++) {
  98                 filter = talloc_asprintf_append_buffer(
  99                         filter, "(attributeId=%s)", oids[i]);
 100                 if (filter == NULL) {
 101                         return TLDAP_NO_MEMORY;
 102                 }
 103         }
 104
 105         filter = talloc_asprintf_append_buffer(filter, ")");
 106         if (filter == NULL) {
 107                 return TLDAP_NO_MEMORY;
 108         }
 109
 110         rc = tldap_search(ld, schema_path, TLDAP_SCOPE_SUB, filter,
 111                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 112                           0, 0, 0, mem_ctx, &msgs);;
 113         TALLOC_FREE(filter);
 114         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 115                 return rc;
 116         }
 117
 118         for (i=0; i<num_oids; i++) {
 119                 names[i] = NULL;
 120         }
 121
 122         num_msgs = talloc_array_length(msgs);
 123
 124         for (i=0; i<num_msgs; i++) {
 125                 struct tldap_message *msg = msgs[i];
 126                 char *oid;
 127                 size_t j;
 128
 129                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 130                         /* Could be a TLDAP_RES_SEARCH_REFERENCE */
 131                         continue;
 132                 }
 133
 134                 oid = tldap_talloc_single_attribute(
 135                         msg, "attributeId", msg);
 136                 if (oid == NULL) {
 137                         continue;
 138                 }
 139
 140                 for (j=0; j<num_oids; j++) {
 141                         if (strequal(oid, oids[j])) {
 142                                 break;
 143                         }
 144                 }
 145                 TALLOC_FREE(oid);
 146
 147                 if (j == num_oids) {
 148                         /* not found */
 149                         continue;
 150                 }
 151
 152                 names[j] = tldap_talloc_single_attribute(
 153                         msg, "lDAPDisplayName", mem_ctx);
 154         }
 155
 156         TALLOC_FREE(msgs);
 157
 158         return TLDAP_SUCCESS;
 159 }
 160
 161 static TLDAPRC get_posix_schema_names(struct tldap_context *ld,
 162                                       const char *schema_mode,
 163                                       TALLOC_CTX *mem_ctx,
 164                                       struct idmap_ad_schema_names **pschema)
 165 {
 166         char *schema_path;
 167         struct idmap_ad_schema_names *schema;
 168         char *names[6];
 169         const char *oids_sfu[] = {
 170                 ADS_ATTR_SFU_UIDNUMBER_OID,
 171                 ADS_ATTR_SFU_GIDNUMBER_OID,
 172                 ADS_ATTR_SFU_HOMEDIR_OID,
 173                 ADS_ATTR_SFU_SHELL_OID,
 174                 ADS_ATTR_SFU_GECOS_OID,
 175                 ADS_ATTR_SFU_UID_OID
 176         };
 177         const char *oids_sfu20[] = {
 178                 ADS_ATTR_SFU20_UIDNUMBER_OID,
 179                 ADS_ATTR_SFU20_GIDNUMBER_OID,
 180                 ADS_ATTR_SFU20_HOMEDIR_OID,
 181                 ADS_ATTR_SFU20_SHELL_OID,
 182                 ADS_ATTR_SFU20_GECOS_OID,
 183                 ADS_ATTR_SFU20_UID_OID
 184         };
 185         const char *oids_rfc2307[] = {
 186                 ADS_ATTR_RFC2307_UIDNUMBER_OID,
 187                 ADS_ATTR_RFC2307_GIDNUMBER_OID,
 188                 ADS_ATTR_RFC2307_HOMEDIR_OID,
 189                 ADS_ATTR_RFC2307_SHELL_OID,
 190                 ADS_ATTR_RFC2307_GECOS_OID,
 191                 ADS_ATTR_RFC2307_UID_OID
 192         };
 193         const char **oids;
 194
 195         TLDAPRC rc;
 196
 197         schema = talloc(mem_ctx, struct idmap_ad_schema_names);
 198         if (schema == NULL) {
 199                 return TLDAP_NO_MEMORY;
 200         }
 201
 202         schema_path = get_schema_path(schema, ld);
 203         if (schema_path == NULL) {
 204                 TALLOC_FREE(schema);
 205                 return TLDAP_NO_MEMORY;
 206         }
 207
 208         oids = oids_rfc2307;
 209
 210         if ((schema_mode != NULL) && (schema_mode[0] != '\0')) {
 211                 if (strequal(schema_mode, "sfu")) {
 212                         oids = oids_sfu;
 213                 } else if (strequal(schema_mode, "sfu20")) {
 214                         oids = oids_sfu20;
 215                 } else if (strequal(schema_mode, "rfc2307" )) {
 216                         oids = oids_rfc2307;
 217                 } else {
 218                         DBG_WARNING("Unknown schema mode %s\n", schema_mode);
 219                 }
 220         }
 221
 222         rc = get_attrnames_by_oids(ld, schema, schema_path, 6, oids, names);
 223         TALLOC_FREE(schema_path);
 224         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 225                 TALLOC_FREE(schema);
 226                 return rc;
 227         }
 228
 229         schema->uid = names[0];
 230         schema->gid = names[1];
 231         schema->dir = names[2];
 232         schema->shell = names[3];
 233         schema->gecos = names[4];
 234         schema->name = names[5];
 235
 236         *pschema = schema;
 237
 238         return TLDAP_SUCCESS;
 239 }
 240
 241 static NTSTATUS idmap_ad_get_tldap_ctx(TALLOC_CTX *mem_ctx,
 242                                        const char *domname,
 243                                        struct tldap_context **pld)
 244 {
 245         struct netr_DsRGetDCNameInfo *dcinfo;
 246         struct sockaddr_storage dcaddr;
 247         struct cli_credentials *creds;
 248         struct loadparm_context *lp_ctx;
 249         struct tldap_context *ld;
 250         int fd;
 251         NTSTATUS status;
 252         bool ok;
 253         TLDAPRC rc;
 254
 255         status = wb_dsgetdcname_gencache_get(mem_ctx, domname, &dcinfo);
 256         if (!NT_STATUS_IS_OK(status)) {
 257                 DBG_DEBUG("Could not get dcinfo for %s: %s\n", domname,
 258                           nt_errstr(status));
 259                 return status;
 260         }
 261
 262         if (dcinfo->dc_unc == NULL) {
 263                 TALLOC_FREE(dcinfo);
 264                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
 265         }
 266         if (dcinfo->dc_unc[0] == '\\') {
 267                 dcinfo->dc_unc += 1;
 268         }
 269         if (dcinfo->dc_unc[0] == '\\') {
 270                 dcinfo->dc_unc += 1;
 271         }
 272
 273         ok = resolve_name(dcinfo->dc_unc, &dcaddr, 0x20, true);
 274         if (!ok) {
 275                 DBG_DEBUG("Could not resolve name %s\n", dcinfo->dc_unc);
 276                 TALLOC_FREE(dcinfo);
 277                 return NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND;
 278         }
 279
 280         status = open_socket_out(&dcaddr, 389, 10000, &fd);
 281         if (!NT_STATUS_IS_OK(status)) {
 282                 DBG_DEBUG("open_socket_out failed: %s\n", nt_errstr(status));
 283                 TALLOC_FREE(dcinfo);
 284                 return status;
 285         }
 286
 287         ld = tldap_context_create(dcinfo, fd);
 288         if (ld == NULL) {
 289                 DBG_DEBUG("tldap_context_create failed\n");
 290                 close(fd);
 291                 TALLOC_FREE(dcinfo);
 292                 return NT_STATUS_NO_MEMORY;
 293         }
 294
 295         creds = cli_credentials_init(dcinfo);
 296         if (creds == NULL) {
 297                 DBG_DEBUG("cli_credentials_init failed\n");
 298                 TALLOC_FREE(dcinfo);
 299                 return NT_STATUS_NO_MEMORY;
 300         }
 301
 302         lp_ctx = loadparm_init_s3(dcinfo, loadparm_s3_helpers());
 303         if (lp_ctx == NULL) {
 304                 DBG_DEBUG("loadparm_init_s3 failed\n");
 305                 TALLOC_FREE(dcinfo);
 306                 return NT_STATUS_NO_MEMORY;
 307         }
 308
 309         cli_credentials_set_conf(creds, lp_ctx);
 310
 311         status = cli_credentials_set_machine_account(creds, lp_ctx);
 312         if (!NT_STATUS_IS_OK(status)) {
 313                 DBG_DEBUG("cli_credentials_set_machine_account "
 314                           "failed: %s\n", nt_errstr(status));
 315                 TALLOC_FREE(dcinfo);
 316                 return status;
 317         }
 318
 319         rc = tldap_gensec_bind(ld, creds, "ldap", dcinfo->dc_unc, NULL, lp_ctx,
 320                                GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
 321         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 322                 DBG_DEBUG("tldap_gensec_bind failed: %s\n",
 323                           tldap_errstr(dcinfo, ld, rc));
 324                 TALLOC_FREE(dcinfo);
 325                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 326         }
 327
 328         rc = tldap_fetch_rootdse(ld);
 329         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 330                 DBG_DEBUG("tldap_fetch_rootdse failed: %s\n",
 331                           tldap_errstr(dcinfo, ld, rc));
 332                 TALLOC_FREE(dcinfo);
 333                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 334         }
 335
 336         *pld = talloc_move(mem_ctx, &ld);
 337         TALLOC_FREE(dcinfo);
 338         return NT_STATUS_OK;
 339 }
 340
 341 static int idmap_ad_context_destructor(struct idmap_ad_context *ctx)
 342 {
 343         if ((ctx->dom != NULL) && (ctx->dom->private_data == ctx)) {
 344                 ctx->dom->private_data = NULL;
 345         }
 346         return 0;
 347 }
 348
 349 static NTSTATUS idmap_ad_context_create(TALLOC_CTX *mem_ctx,
 350                                         struct idmap_domain *dom,
 351                                         const char *domname,
 352                                         struct idmap_ad_context **pctx)
 353 {
 354         struct idmap_ad_context *ctx;
 355         char *schema_config_option;
 356         const char *schema_mode;
 357         NTSTATUS status;
 358         TLDAPRC rc;
 359
 360         ctx = talloc(mem_ctx, struct idmap_ad_context);
 361         if (ctx == NULL) {
 362                 return NT_STATUS_NO_MEMORY;
 363         }
 364         ctx->dom = dom;
 365
 366         talloc_set_destructor(ctx, idmap_ad_context_destructor);
 367
 368         status = idmap_ad_get_tldap_ctx(ctx, domname, &ctx->ld);
 369         if (!NT_STATUS_IS_OK(status)) {
 370                 DBG_DEBUG("idmap_ad_get_tldap_ctx failed: %s\n",
 371                           nt_errstr(status));
 372                 TALLOC_FREE(ctx);
 373                 return status;
 374         }
 375
 376         ctx->default_nc = get_default_nc(ctx, ctx->ld);
 377         if (ctx->default_nc == NULL) {
 378                 DBG_DEBUG("No default nc\n");
 379                 TALLOC_FREE(ctx);
 380                 return status;
 381         }
 382
 383         schema_config_option = talloc_asprintf(
 384                 ctx, "idmap config %s", domname);
 385         if (schema_config_option == NULL) {
 386                 TALLOC_FREE(ctx);
 387                 return NT_STATUS_NO_MEMORY;
 388         }
 389
 390         schema_mode = lp_parm_const_string(
 391                 -1, schema_config_option, "schema_mode", "rfc2307");
 392         TALLOC_FREE(schema_config_option);
 393
 394         rc = get_posix_schema_names(ctx->ld, schema_mode, ctx, &ctx->schema);
 395         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 396                 DBG_DEBUG("get_posix_schema_names failed: %s\n",
 397                           tldap_errstr(ctx, ctx->ld, rc));
 398                 TALLOC_FREE(ctx);
 399                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 400         }
 401
 402         *pctx = ctx;
 403         return NT_STATUS_OK;
 404 }
 405
 406 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
 407 {
 408         dom->private_data = NULL;
 409         return NT_STATUS_OK;
 410 }
 411
 412 static NTSTATUS idmap_ad_get_context(struct idmap_domain *dom,
 413                                      struct idmap_ad_context **pctx)
 414 {
 415         struct idmap_ad_context *ctx = NULL;
 416         NTSTATUS status;
 417
 418         if (dom->private_data != NULL) {
 419                 *pctx = talloc_get_type_abort(dom->private_data,
 420                                               struct idmap_ad_context);
 421                 return NT_STATUS_OK;
 422         }
 423
 424         status = idmap_ad_context_create(dom, dom, dom->name, &ctx);
 425         if (!NT_STATUS_IS_OK(status)) {
 426                 DBG_DEBUG("idmap_ad_context_create failed: %s\n",
 427                           nt_errstr(status));
 428                 return status;
 429         }
 430
 431         dom->private_data = ctx;
 432         *pctx = ctx;
 433         return NT_STATUS_OK;
 434 }
 435
 436 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom,
 437                                          struct id_map **ids)
 438 {
 439         struct idmap_ad_context *ctx;
 440         TLDAPRC rc;
 441         NTSTATUS status;
 442         struct tldap_message **msgs;
 443
 444         size_t i, num_msgs;
 445         char *u_filter, *g_filter, *filter;
 446
 447         const char *attrs[] = {
 448                 "sAMAccountType",
 449                 "objectSid",
 450                 NULL, /* attr_uidnumber */
 451                 NULL, /* attr_gidnumber */
 452         };
 453
 454         status = idmap_ad_get_context(dom, &ctx);
 455         if (!NT_STATUS_IS_OK(status)) {
 456                 return status;
 457         }
 458
 459         attrs[2] = ctx->schema->uid;
 460         attrs[3] = ctx->schema->gid;
 461
 462         u_filter = talloc_strdup(talloc_tos(), "");
 463         if (u_filter == NULL) {
 464                 return NT_STATUS_NO_MEMORY;
 465         }
 466
 467         g_filter = talloc_strdup(talloc_tos(), "");
 468         if (g_filter == NULL) {
 469                 return NT_STATUS_NO_MEMORY;
 470         }
 471
 472         for (i=0; ids[i] != NULL; i++) {
 473                 struct id_map *id = ids[i];
 474
 475                 id->status = ID_UNKNOWN;
 476
 477                 switch (id->xid.type) {
 478                     case ID_TYPE_UID: {
 479                             u_filter = talloc_asprintf_append_buffer(
 480                                     u_filter, "(%s=%ju)", ctx->schema->uid,
 481                                     (uintmax_t)id->xid.id);
 482                             if (u_filter == NULL) {
 483                                     return NT_STATUS_NO_MEMORY;
 484                             }
 485                             break;
 486                     }
 487
 488                     case ID_TYPE_GID: {
 489                             g_filter = talloc_asprintf_append_buffer(
 490                                     g_filter, "(%s=%ju)", ctx->schema->gid,
 491                                     (uintmax_t)id->xid.id);
 492                             if (g_filter == NULL) {
 493                                     return NT_STATUS_NO_MEMORY;
 494                             }
 495                             break;
 496                     }
 497
 498                     default:
 499                             DBG_WARNING("Unknown id type: %u\n",
 500                                         (unsigned)id->xid.type);
 501                             break;
 502                 }
 503         }
 504
 505         filter = talloc_strdup(talloc_tos(), "(|");
 506         if (filter == NULL) {
 507                 return NT_STATUS_NO_MEMORY;
 508         }
 509
 510         if (*u_filter != '\0') {
 511                 filter = talloc_asprintf_append_buffer(
 512                         filter,
 513                         "(&(|(sAMAccountType=%d)(sAMAccountType=%d)"
 514                         "(sAMAccountType=%d))(|%s))",
 515                         ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST,
 516                         ATYPE_INTERDOMAIN_TRUST, u_filter);
 517                 if (filter == NULL) {
 518                         return NT_STATUS_NO_MEMORY;
 519                 }
 520         }
 521         TALLOC_FREE(u_filter);
 522
 523         if (*g_filter != '\0') {
 524                 filter = talloc_asprintf_append_buffer(
 525                         filter,
 526                         "(&(|(sAMAccountType=%d)(sAMAccountType=%d))(|%s))",
 527                         ATYPE_SECURITY_GLOBAL_GROUP,
 528                         ATYPE_SECURITY_LOCAL_GROUP,
 529                         g_filter);
 530                 if (filter == NULL) {
 531                         return NT_STATUS_NO_MEMORY;
 532                 }
 533         }
 534         TALLOC_FREE(g_filter);
 535
 536         filter = talloc_asprintf_append_buffer(filter, ")");
 537         if (filter == NULL) {
 538                 return NT_STATUS_NO_MEMORY;
 539         }
 540
 541         DBG_DEBUG("Filter: [%s]\n", filter);
 542
 543         rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
 544                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 545                           0, 0, 0, talloc_tos(), &msgs);
 546         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 547                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 548         }
 549
 550         TALLOC_FREE(filter);
 551
 552         num_msgs = talloc_array_length(msgs);
 553
 554         for (i=0; i<num_msgs; i++) {
 555                 struct tldap_message *msg = msgs[i];
 556                 char *dn;
 557                 struct id_map *map;
 558                 struct dom_sid sid;
 559                 size_t j;
 560                 bool ok;
 561                 uint32_t atype, xid;
 562                 enum id_type type;
 563
 564                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 565                         continue;
 566                 }
 567
 568                 ok = tldap_entry_dn(msg, &dn);
 569                 if (!ok) {
 570                         DBG_DEBUG("No dn found in msg %zu\n", i);
 571                         continue;
 572                 }
 573
 574                 ok = tldap_pull_uint32(msg, "sAMAccountType", &atype);
 575                 if (!ok) {
 576                         DBG_DEBUG("No atype in object %s\n", dn);
 577                         continue;
 578                 }
 579
 580                 switch (atype & 0xF0000000) {
 581                     case ATYPE_SECURITY_GLOBAL_GROUP:
 582                     case ATYPE_SECURITY_LOCAL_GROUP:
 583                             type = ID_TYPE_GID;
 584                             break;
 585                     case ATYPE_NORMAL_ACCOUNT:
 586                     case ATYPE_WORKSTATION_TRUST:
 587                     case ATYPE_INTERDOMAIN_TRUST:
 588                             type = ID_TYPE_UID;
 589                             break;
 590                     default:
 591                             DBG_WARNING("unrecognized SAM account type %08x\n",
 592                                         atype);
 593                         continue;
 594                 }
 595
 596                 ok = tldap_pull_uint32(msg, (type == ID_TYPE_UID) ?
 597                                        ctx->schema->uid : ctx->schema->gid,
 598                                        &xid);
 599                 if (!ok) {
 600                         DBG_WARNING("No unix id in object %s\n", dn);
 601                         continue;
 602                 }
 603
 604                 ok = tldap_pull_binsid(msg, "objectSid", &sid);
 605                 if (!ok) {
 606                         DBG_DEBUG("No objectSid in object %s\n", dn);
 607                         continue;
 608                 }
 609
 610                 map = NULL;
 611                 for (j=0; ids[j]; j++) {
 612                         if ((type == ids[j]->xid.type) &&
 613                             (xid == ids[j]->xid.id)) {
 614                                 map = ids[j];
 615                                 break;
 616                         }
 617                 }
 618                 if (map == NULL) {
 619                         DBG_DEBUG("Got unexpected sid %s from object %s\n",
 620                                   sid_string_tos(&sid), dn);
 621                         continue;
 622                 }
 623
 624                 sid_copy(map->sid, &sid);
 625                 map->status = ID_MAPPED;
 626
 627                 DBG_DEBUG("Mapped %s -> %ju (%d)\n", sid_string_dbg(map->sid),
 628                           (uintmax_t)map->xid.id, map->xid.type);
 629         }
 630
 631         TALLOC_FREE(msgs);
 632
 633         return NT_STATUS_OK;
 634 }
 635
 636 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom,
 637                                          struct id_map **ids)
 638 {
 639         struct idmap_ad_context *ctx;
 640         TLDAPRC rc;
 641         NTSTATUS status;
 642         struct tldap_message **msgs;
 643
 644         char *filter;
 645         size_t i, num_msgs;
 646
 647         const char *attrs[] = {
 648                 "sAMAccountType",
 649                 "objectSid",
 650                 NULL, /* attr_uidnumber */
 651                 NULL, /* attr_gidnumber */
 652         };
 653
 654         status = idmap_ad_get_context(dom, &ctx);
 655         if (!NT_STATUS_IS_OK(status)) {
 656                 return status;
 657         }
 658
 659         attrs[2] = ctx->schema->uid;
 660         attrs[3] = ctx->schema->gid;
 661
 662         filter = talloc_asprintf(
 663                 talloc_tos(),
 664                 "(&(|(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)"
 665                 "(sAMAccountType=%d)(sAMAccountType=%d))(|",
 666                 ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST,
 667                 ATYPE_INTERDOMAIN_TRUST, ATYPE_SECURITY_GLOBAL_GROUP,
 668                 ATYPE_SECURITY_LOCAL_GROUP);
 669         if (filter == NULL) {
 670                 return NT_STATUS_NO_MEMORY;
 671         }
 672
 673         for (i=0; ids[i]; i++) {
 674                 char *sidstr;
 675
 676                 ids[i]->status = ID_UNKNOWN;
 677
 678                 sidstr = ldap_encode_ndr_dom_sid(talloc_tos(), ids[i]->sid);
 679                 if (sidstr == NULL) {
 680                         return NT_STATUS_NO_MEMORY;
 681                 }
 682
 683                 filter = talloc_asprintf_append_buffer(
 684                         filter, "(objectSid=%s)", sidstr);
 685                 TALLOC_FREE(sidstr);
 686                 if (filter == NULL) {
 687                         return NT_STATUS_NO_MEMORY;
 688                 }
 689         }
 690
 691         filter = talloc_asprintf_append_buffer(filter, "))");
 692         if (filter == NULL) {
 693                 return NT_STATUS_NO_MEMORY;
 694         }
 695
 696         DBG_DEBUG("Filter: [%s]\n", filter);
 697
 698         rc = tldap_search(ctx->ld, ctx->default_nc, TLDAP_SCOPE_SUB, filter,
 699                           attrs, ARRAY_SIZE(attrs), 0, NULL, 0, NULL, 0,
 700                           0, 0, 0, talloc_tos(), &msgs);
 701         if (!TLDAP_RC_IS_SUCCESS(rc)) {
 702                 return NT_STATUS_LDAP(TLDAP_RC_V(rc));
 703         }
 704
 705         TALLOC_FREE(filter);
 706
 707         num_msgs = talloc_array_length(msgs);
 708
 709         for (i=0; i<num_msgs; i++) {
 710                 struct tldap_message *msg = msgs[i];
 711                 char *dn;
 712                 struct id_map *map;
 713                 struct dom_sid sid;
 714                 size_t j;
 715                 bool ok;
 716                 uint64_t account_type, xid;
 717                 enum id_type type;
 718
 719                 if (tldap_msg_type(msg) != TLDAP_RES_SEARCH_ENTRY) {
 720                         continue;
 721                 }
 722
 723                 ok = tldap_entry_dn(msg, &dn);
 724                 if (!ok) {
 725                         DBG_DEBUG("No dn found in msg %zu\n", i);
 726                         continue;
 727                 }
 728
 729                 ok = tldap_pull_binsid(msg, "objectSid", &sid);
 730                 if (!ok) {
 731                         DBG_DEBUG("No objectSid in object %s\n", dn);
 732                         continue;
 733                 }
 734
 735                 map = NULL;
 736                 for (j=0; ids[j]; j++) {
 737                         if (dom_sid_equal(&sid, ids[j]->sid)) {
 738                                 map = ids[j];
 739                                 break;
 740                         }
 741                 }
 742                 if (map == NULL) {
 743                         DBG_DEBUG("Got unexpected sid %s from object %s\n",
 744                                   sid_string_tos(&sid), dn);
 745                         continue;
 746                 }
 747
 748                 ok = tldap_pull_uint64(msg, "sAMAccountType", &account_type);
 749                 if (!ok) {
 750                         DBG_DEBUG("No sAMAccountType in %s\n", dn);
 751                         continue;
 752                 }
 753
 754                 switch (account_type & 0xF0000000) {
 755                 case ATYPE_SECURITY_GLOBAL_GROUP:
 756                 case ATYPE_SECURITY_LOCAL_GROUP:
 757                         type = ID_TYPE_GID;
 758                         break;
 759                 case ATYPE_NORMAL_ACCOUNT:
 760                 case ATYPE_WORKSTATION_TRUST:
 761                 case ATYPE_INTERDOMAIN_TRUST:
 762                         type = ID_TYPE_UID;
 763                         break;
 764                 default:
 765                         DBG_WARNING("unrecognized SAM account type %"PRIu64"\n",
 766                                     account_type);
 767                         continue;
 768                 }
 769
 770                 ok = tldap_pull_uint64(msg,
 771                                        type == ID_TYPE_UID ?
 772                                        ctx->schema->uid : ctx->schema->gid,
 773                                        &xid);
 774                 if (!ok) {
 775                         DBG_DEBUG("No xid in %s\n", dn);
 776                         continue;
 777                 }
 778
 779                 /* mapped */
 780                 map->xid.type = type;
 781                 map->xid.id = xid;
 782                 map->status = ID_MAPPED;
 783
 784                 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
 785                            (unsigned long)map->xid.id, map->xid.type));
 786         }
 787
 788         TALLOC_FREE(msgs);
 789
 790         return NT_STATUS_OK;
 791 }
 792
 793 static NTSTATUS idmap_ad_unixids_to_sids_retry(struct idmap_domain *dom,
 794                                                struct id_map **ids)
 795 {
 796         const NTSTATUS status_server_down =
 797                 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN));
 798         NTSTATUS status;
 799
 800         status = idmap_ad_unixids_to_sids(dom, ids);
 801
 802         if (NT_STATUS_EQUAL(status, status_server_down)) {
 803                 TALLOC_FREE(dom->private_data);
 804                 status = idmap_ad_unixids_to_sids(dom, ids);
 805         }
 806
 807         return status;
 808 }
 809
 810 static NTSTATUS idmap_ad_sids_to_unixids_retry(struct idmap_domain *dom,
 811                                                struct id_map **ids)
 812 {
 813         const NTSTATUS status_server_down =
 814                 NT_STATUS_LDAP(TLDAP_RC_V(TLDAP_SERVER_DOWN));
 815         NTSTATUS status;
 816
 817         status = idmap_ad_sids_to_unixids(dom, ids);
 818
 819         if (NT_STATUS_EQUAL(status, status_server_down)) {
 820                 TALLOC_FREE(dom->private_data);
 821                 status = idmap_ad_sids_to_unixids(dom, ids);
 822         }
 823
 824         return status;
 825 }
 826
 827 static struct idmap_methods ad_methods = {
 828         .init            = idmap_ad_initialize,
 829         .unixids_to_sids = idmap_ad_unixids_to_sids_retry,
 830         .sids_to_unixids = idmap_ad_sids_to_unixids_retry,
 831 };
 832
 833 static_decl_idmap;
 834 NTSTATUS idmap_ad_init(void)
 835 {
 836         NTSTATUS status;
 837
 838         status = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
 839                                     "ad", &ad_methods);
 840         if (!NT_STATUS_IS_OK(status)) {
 841                 return status;
 842         }
 843
 844         status = idmap_ad_nss_init();
 845         if (!NT_STATUS_IS_OK(status)) {
 846                 return status;
 847         }
 848
 849         return NT_STATUS_OK;
 850 }