Context Navigation

source: branches/samba-3.3.x/source/winbindd/idmap_ldap.c@ 274

Last change on this file since 274 was 274, checked in by Herwig Bauernfeind, 17 years ago
Update 3.3 branch to 3.3.5
File size: 37.7 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3
4	idmap LDAP backend
5
6	Copyright (C) Tim Potter 2000
7	Copyright (C) Jim McDonough <[email protected]> 2003
8	Copyright (C) Gerald Carter 2003
9	Copyright (C) Simo Sorce 2003-2007
10
11	This program is free software; you can redistribute it and/or modify
12	it under the terms of the GNU General Public License as published by
13	the Free Software Foundation; either version 3 of the License, or
14	(at your option) any later version.
15
16	This program is distributed in the hope that it will be useful,
17	but WITHOUT ANY WARRANTY; without even the implied warranty of
18	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19	GNU General Public License for more details.
20
21	You should have received a copy of the GNU General Public License
22	along with this program. If not, see <http://www.gnu.org/licenses/>.
23	*/
24
25	#include "includes.h"
26	#include "winbindd.h"
27
28	#undef DBGC_CLASS
29	#define DBGC_CLASS DBGC_IDMAP
30
31	#include <lber.h>
32	#include <ldap.h>
33
34	#include "smbldap.h"
35
36	static char idmap_fetch_secret(const char backend, bool alloc,
37	const char domain, const char identity)
38	{
39	char tmp, ret;
40	int r;
41
42	if (alloc) {
43	r = asprintf(&tmp, "IDMAP_ALLOC_%s", backend);
44	} else {
45	r = asprintf(&tmp, "IDMAP_%s_%s", backend, domain);
46	}
47
48	if (r < 0)
49	return NULL;
50
51	strupper_m(tmp); /* make sure the key is case insensitive */
52	ret = secrets_fetch_generic(tmp, identity);
53
54	SAFE_FREE(tmp);
55
56	return ret;
57	}
58
59	struct idmap_ldap_context {
60	struct smbldap_state *smbldap_state;
61	char *url;
62	char *suffix;
63	char *user_dn;
64	uint32_t filter_low_id, filter_high_id; /* Filter range */
65	bool anon;
66	};
67
68	struct idmap_ldap_alloc_context {
69	struct smbldap_state *smbldap_state;
70	char *url;
71	char *suffix;
72	char *user_dn;
73	uid_t low_uid, high_uid; /* Range of uids */
74	gid_t low_gid, high_gid; /* Range of gids */
75
76	};
77
78	#define CHECK_ALLOC_DONE(mem) do { \
79	if (!mem) { \
80	DEBUG(0, ("Out of memory!\n")); \
81	ret = NT_STATUS_NO_MEMORY; \
82	goto done; \
83	} } while (0)
84
85	/**********************************************************************
86	IDMAP ALLOC TDB BACKEND
87	**********************************************************************/
88
89	static struct idmap_ldap_alloc_context *idmap_alloc_ldap;
90
91	/*********************************************************************
92	********************************************************************/
93
94	static NTSTATUS get_credentials( TALLOC_CTX *mem_ctx,
95	struct smbldap_state *ldap_state,
96	const char *config_option,
97	struct idmap_domain *dom,
98	char **dn )
99	{
100	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
101	char *secret = NULL;
102	const char *tmp = NULL;
103	char *user_dn = NULL;
104	bool anon = False;
105
106	/* assume anonymous if we don't have a specified user */
107
108	tmp = lp_parm_const_string(-1, config_option, "ldap_user_dn", NULL);
109
110	if ( tmp ) {
111	if (!dom) {
112	/* only the alloc backend can pass in a NULL dom */
113	secret = idmap_fetch_secret("ldap", True,
114	NULL, tmp);
115	} else {
116	secret = idmap_fetch_secret("ldap", False,
117	dom->name, tmp);
118	}
119
120	if (!secret) {
121	DEBUG(0, ("get_credentials: Unable to fetch "
122	"auth credentials for %s in %s\n",
123	tmp, (dom==NULL)?"ALLOC":dom->name));
124	ret = NT_STATUS_ACCESS_DENIED;
125	goto done;
126	}
127	*dn = talloc_strdup(mem_ctx, tmp);
128	CHECK_ALLOC_DONE(*dn);
129	} else {
130	if (!fetch_ldap_pw(&user_dn, &secret)) {
131	DEBUG(2, ("get_credentials: Failed to lookup ldap "
132	"bind creds. Using anonymous connection.\n"));
133	anon = True;
134	} else {
135	*dn = talloc_strdup(mem_ctx, user_dn);
136	SAFE_FREE( user_dn );
137	CHECK_ALLOC_DONE(*dn);
138	}
139	}
140
141	smbldap_set_creds(ldap_state, anon, *dn, secret);
142	ret = NT_STATUS_OK;
143
144	done:
145	SAFE_FREE(secret);
146
147	return ret;
148	}
149
150
151	/**********************************************************************
152	Verify the sambaUnixIdPool entry in the directory.
153	**********************************************************************/
154
155	static NTSTATUS verify_idpool(void)
156	{
157	NTSTATUS ret;
158	TALLOC_CTX *ctx;
159	LDAPMessage *result = NULL;
160	LDAPMod **mods = NULL;
161	const char **attr_list;
162	char *filter;
163	int count;
164	int rc;
165
166	if ( ! idmap_alloc_ldap) {
167	return NT_STATUS_UNSUCCESSFUL;
168	}
169
170	ctx = talloc_new(idmap_alloc_ldap);
171	if ( ! ctx) {
172	DEBUG(0, ("Out of memory!\n"));
173	return NT_STATUS_NO_MEMORY;
174	}
175
176	filter = talloc_asprintf(ctx, "(objectclass=%s)", LDAP_OBJ_IDPOOL);
177	CHECK_ALLOC_DONE(filter);
178
179	attr_list = get_attr_list(ctx, idpool_attr_list);
180	CHECK_ALLOC_DONE(attr_list);
181
182	rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
183	idmap_alloc_ldap->suffix,
184	LDAP_SCOPE_SUBTREE,
185	filter,
186	attr_list,
187	0,
188	&result);
189
190	if (rc != LDAP_SUCCESS) {
191	DEBUG(1, ("Unable to verify the idpool, "
192	"cannot continue initialization!\n"));
193	return NT_STATUS_UNSUCCESSFUL;
194	}
195
196	count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
197	result);
198
199	ldap_msgfree(result);
200
201	if ( count > 1 ) {
202	DEBUG(0,("Multiple entries returned from %s (base == %s)\n",
203	filter, idmap_alloc_ldap->suffix));
204	ret = NT_STATUS_UNSUCCESSFUL;
205	goto done;
206	}
207	else if (count == 0) {
208	char uid_str, gid_str;
209
210	uid_str = talloc_asprintf(ctx, "%lu",
211	(unsigned long)idmap_alloc_ldap->low_uid);
212	gid_str = talloc_asprintf(ctx, "%lu",
213	(unsigned long)idmap_alloc_ldap->low_gid);
214
215	smbldap_set_mod(&mods, LDAP_MOD_ADD,
216	"objectClass", LDAP_OBJ_IDPOOL);
217	smbldap_set_mod(&mods, LDAP_MOD_ADD,
218	get_attr_key2string(idpool_attr_list,
219	LDAP_ATTR_UIDNUMBER),
220	uid_str);
221	smbldap_set_mod(&mods, LDAP_MOD_ADD,
222	get_attr_key2string(idpool_attr_list,
223	LDAP_ATTR_GIDNUMBER),
224	gid_str);
225	if (mods) {
226	rc = smbldap_modify(idmap_alloc_ldap->smbldap_state,
227	idmap_alloc_ldap->suffix,
228	mods);
229	ldap_mods_free(mods, True);
230	} else {
231	ret = NT_STATUS_UNSUCCESSFUL;
232	goto done;
233	}
234	}
235
236	ret = (rc == LDAP_SUCCESS)?NT_STATUS_OK:NT_STATUS_UNSUCCESSFUL;
237	done:
238	talloc_free(ctx);
239	return ret;
240	}
241
242	/*****************************************************************************
243	Initialise idmap database.
244	*****************************************************************************/
245
246	static NTSTATUS idmap_ldap_alloc_init(const char *params)
247	{
248	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
249	const char *tmp;
250	uid_t low_uid = 0;
251	uid_t high_uid = 0;
252	gid_t low_gid = 0;
253	gid_t high_gid = 0;
254
255	/* Only do init if we are online */
256	if (idmap_is_offline()) {
257	return NT_STATUS_FILE_IS_OFFLINE;
258	}
259
260	idmap_alloc_ldap = TALLOC_ZERO_P(NULL, struct idmap_ldap_alloc_context);
261	CHECK_ALLOC_DONE( idmap_alloc_ldap );
262
263	/* load ranges */
264
265	if (!lp_idmap_uid(&low_uid, &high_uid)
266	\|\| !lp_idmap_gid(&low_gid, &high_gid)) {
267	DEBUG(1, ("idmap uid or idmap gid missing\n"));
268	ret = NT_STATUS_UNSUCCESSFUL;
269	goto done;
270	}
271
272	idmap_alloc_ldap->low_uid = low_uid;
273	idmap_alloc_ldap->high_uid = high_uid;
274	idmap_alloc_ldap->low_gid = low_gid;
275	idmap_alloc_ldap->high_gid= high_gid;
276
277	if (idmap_alloc_ldap->high_uid <= idmap_alloc_ldap->low_uid) {
278	DEBUG(1, ("idmap uid range invalid\n"));
279	DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
280	ret = NT_STATUS_UNSUCCESSFUL;
281	goto done;
282	}
283
284	if (idmap_alloc_ldap->high_gid <= idmap_alloc_ldap->low_gid) {
285	DEBUG(1, ("idmap gid range invalid\n"));
286	DEBUGADD(1, ("idmap will be unable to map foreign SIDs\n"));
287	ret = NT_STATUS_UNSUCCESSFUL;
288	goto done;
289	}
290
291	if (params && *params) {
292	/* assume location is the only parameter */
293	idmap_alloc_ldap->url = talloc_strdup(idmap_alloc_ldap, params);
294	} else {
295	tmp = lp_parm_const_string(-1, "idmap alloc config",
296	"ldap_url", NULL);
297
298	if ( ! tmp) {
299	DEBUG(1, ("ERROR: missing idmap ldap url\n"));
300	ret = NT_STATUS_UNSUCCESSFUL;
301	goto done;
302	}
303
304	idmap_alloc_ldap->url = talloc_strdup(idmap_alloc_ldap, tmp);
305	}
306	CHECK_ALLOC_DONE( idmap_alloc_ldap->url );
307
308	tmp = lp_parm_const_string(-1, "idmap alloc config",
309	"ldap_base_dn", NULL);
310	if ( ! tmp \|\| ! *tmp) {
311	tmp = lp_ldap_idmap_suffix();
312	if ( ! tmp) {
313	DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
314	ret = NT_STATUS_UNSUCCESSFUL;
315	goto done;
316	}
317	}
318
319	idmap_alloc_ldap->suffix = talloc_strdup(idmap_alloc_ldap, tmp);
320	CHECK_ALLOC_DONE( idmap_alloc_ldap->suffix );
321
322	ret = smbldap_init(idmap_alloc_ldap, winbind_event_context(),
323	idmap_alloc_ldap->url,
324	&idmap_alloc_ldap->smbldap_state);
325	if (!NT_STATUS_IS_OK(ret)) {
326	DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n",
327	idmap_alloc_ldap->url));
328	goto done;
329	}
330
331	ret = get_credentials( idmap_alloc_ldap,
332	idmap_alloc_ldap->smbldap_state,
333	"idmap alloc config", NULL,
334	&idmap_alloc_ldap->user_dn );
335	if ( !NT_STATUS_IS_OK(ret) ) {
336	DEBUG(1,("idmap_ldap_alloc_init: Failed to get connection "
337	"credentials (%s)\n", nt_errstr(ret)));
338	goto done;
339	}
340
341	/* see if the idmap suffix and sub entries exists */
342
343	ret = verify_idpool();
344
345	done:
346	if ( !NT_STATUS_IS_OK( ret ) )
347	TALLOC_FREE( idmap_alloc_ldap );
348
349	return ret;
350	}
351
352	/********************************
353	Allocate a new uid or gid
354	********************************/
355
356	static NTSTATUS idmap_ldap_allocate_id(struct unixid *xid)
357	{
358	TALLOC_CTX *ctx;
359	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
360	int rc = LDAP_SERVER_DOWN;
361	int count = 0;
362	LDAPMessage *result = NULL;
363	LDAPMessage *entry = NULL;
364	LDAPMod **mods = NULL;
365	char *id_str;
366	char *new_id_str;
367	char *filter = NULL;
368	const char *dn = NULL;
369	const char **attr_list;
370	const char *type;
371
372	/* Only do query if we are online */
373	if (idmap_is_offline()) {
374	return NT_STATUS_FILE_IS_OFFLINE;
375	}
376
377	if ( ! idmap_alloc_ldap) {
378	return NT_STATUS_UNSUCCESSFUL;
379	}
380
381	ctx = talloc_new(idmap_alloc_ldap);
382	if ( ! ctx) {
383	DEBUG(0, ("Out of memory!\n"));
384	return NT_STATUS_NO_MEMORY;
385	}
386
387	/* get type */
388	switch (xid->type) {
389
390	case ID_TYPE_UID:
391	type = get_attr_key2string(idpool_attr_list,
392	LDAP_ATTR_UIDNUMBER);
393	break;
394
395	case ID_TYPE_GID:
396	type = get_attr_key2string(idpool_attr_list,
397	LDAP_ATTR_GIDNUMBER);
398	break;
399
400	default:
401	DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
402	return NT_STATUS_INVALID_PARAMETER;
403	}
404
405	filter = talloc_asprintf(ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
406	CHECK_ALLOC_DONE(filter);
407
408	attr_list = get_attr_list(ctx, idpool_attr_list);
409	CHECK_ALLOC_DONE(attr_list);
410
411	DEBUG(10, ("Search of the id pool (filter: %s)\n", filter));
412
413	rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
414	idmap_alloc_ldap->suffix,
415	LDAP_SCOPE_SUBTREE, filter,
416	attr_list, 0, &result);
417
418	if (rc != LDAP_SUCCESS) {
419	DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
420	goto done;
421	}
422
423	talloc_autofree_ldapmsg(ctx, result);
424
425	count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
426	result);
427	if (count != 1) {
428	DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
429	goto done;
430	}
431
432	entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
433	result);
434
435	dn = smbldap_talloc_dn(ctx,
436	idmap_alloc_ldap->smbldap_state->ldap_struct,
437	entry);
438	if ( ! dn) {
439	goto done;
440	}
441
442	if ( ! (id_str = smbldap_talloc_single_attribute(idmap_alloc_ldap->smbldap_state->ldap_struct,
443	entry, type, ctx))) {
444	DEBUG(0,("%s attribute not found\n", type));
445	goto done;
446	}
447	if ( ! id_str) {
448	DEBUG(0,("Out of memory\n"));
449	ret = NT_STATUS_NO_MEMORY;
450	goto done;
451	}
452
453	xid->id = strtoul(id_str, NULL, 10);
454
455	/* make sure we still have room to grow */
456
457	switch (xid->type) {
458	case ID_TYPE_UID:
459	if (xid->id > idmap_alloc_ldap->high_uid) {
460	DEBUG(0,("Cannot allocate uid above %lu!\n",
461	(unsigned long)idmap_alloc_ldap->high_uid));
462	goto done;
463	}
464	break;
465
466	case ID_TYPE_GID:
467	if (xid->id > idmap_alloc_ldap->high_gid) {
468	DEBUG(0,("Cannot allocate gid above %lu!\n",
469	(unsigned long)idmap_alloc_ldap->high_uid));
470	goto done;
471	}
472	break;
473
474	default:
475	/* impossible */
476	goto done;
477	}
478
479	new_id_str = talloc_asprintf(ctx, "%lu", (unsigned long)xid->id + 1);
480	if ( ! new_id_str) {
481	DEBUG(0,("Out of memory\n"));
482	ret = NT_STATUS_NO_MEMORY;
483	goto done;
484	}
485
486	smbldap_set_mod(&mods, LDAP_MOD_DELETE, type, id_str);
487	smbldap_set_mod(&mods, LDAP_MOD_ADD, type, new_id_str);
488
489	if (mods == NULL) {
490	DEBUG(0,("smbldap_set_mod() failed.\n"));
491	goto done;
492	}
493
494	DEBUG(10, ("Try to atomically increment the id (%s -> %s)\n",
495	id_str, new_id_str));
496
497	rc = smbldap_modify(idmap_alloc_ldap->smbldap_state, dn, mods);
498
499	ldap_mods_free(mods, True);
500
501	if (rc != LDAP_SUCCESS) {
502	DEBUG(1,("Failed to allocate new %s. "
503	"smbldap_modify() failed.\n", type));
504	goto done;
505	}
506
507	ret = NT_STATUS_OK;
508
509	done:
510	talloc_free(ctx);
511	return ret;
512	}
513
514	/**********************************
515	Get current highest id.
516	**********************************/
517
518	static NTSTATUS idmap_ldap_get_hwm(struct unixid *xid)
519	{
520	TALLOC_CTX *memctx;
521	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
522	int rc = LDAP_SERVER_DOWN;
523	int count = 0;
524	LDAPMessage *result = NULL;
525	LDAPMessage *entry = NULL;
526	char *id_str;
527	char *filter = NULL;
528	const char **attr_list;
529	const char *type;
530
531	/* Only do query if we are online */
532	if (idmap_is_offline()) {
533	return NT_STATUS_FILE_IS_OFFLINE;
534	}
535
536	if ( ! idmap_alloc_ldap) {
537	return NT_STATUS_UNSUCCESSFUL;
538	}
539
540	memctx = talloc_new(idmap_alloc_ldap);
541	if ( ! memctx) {
542	DEBUG(0, ("Out of memory!\n"));
543	return NT_STATUS_NO_MEMORY;
544	}
545
546	/* get type */
547	switch (xid->type) {
548
549	case ID_TYPE_UID:
550	type = get_attr_key2string(idpool_attr_list,
551	LDAP_ATTR_UIDNUMBER);
552	break;
553
554	case ID_TYPE_GID:
555	type = get_attr_key2string(idpool_attr_list,
556	LDAP_ATTR_GIDNUMBER);
557	break;
558
559	default:
560	DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
561	return NT_STATUS_INVALID_PARAMETER;
562	}
563
564	filter = talloc_asprintf(memctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
565	CHECK_ALLOC_DONE(filter);
566
567	attr_list = get_attr_list(memctx, idpool_attr_list);
568	CHECK_ALLOC_DONE(attr_list);
569
570	rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
571	idmap_alloc_ldap->suffix,
572	LDAP_SCOPE_SUBTREE, filter,
573	attr_list, 0, &result);
574
575	if (rc != LDAP_SUCCESS) {
576	DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
577	goto done;
578	}
579
580	talloc_autofree_ldapmsg(memctx, result);
581
582	count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
583	result);
584	if (count != 1) {
585	DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
586	goto done;
587	}
588
589	entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
590	result);
591
592	id_str = smbldap_talloc_single_attribute(idmap_alloc_ldap->smbldap_state->ldap_struct,
593	entry, type, memctx);
594	if ( ! id_str) {
595	DEBUG(0,("%s attribute not found\n", type));
596	goto done;
597	}
598	if ( ! id_str) {
599	DEBUG(0,("Out of memory\n"));
600	ret = NT_STATUS_NO_MEMORY;
601	goto done;
602	}
603
604	xid->id = strtoul(id_str, NULL, 10);
605
606	ret = NT_STATUS_OK;
607	done:
608	talloc_free(memctx);
609	return ret;
610	}
611	/**********************************
612	Set highest id.
613	**********************************/
614
615	static NTSTATUS idmap_ldap_set_hwm(struct unixid *xid)
616	{
617	TALLOC_CTX *ctx;
618	NTSTATUS ret = NT_STATUS_UNSUCCESSFUL;
619	int rc = LDAP_SERVER_DOWN;
620	int count = 0;
621	LDAPMessage *result = NULL;
622	LDAPMessage *entry = NULL;
623	LDAPMod **mods = NULL;
624	char *new_id_str;
625	char *filter = NULL;
626	const char *dn = NULL;
627	const char **attr_list;
628	const char *type;
629
630	/* Only do query if we are online */
631	if (idmap_is_offline()) {
632	return NT_STATUS_FILE_IS_OFFLINE;
633	}
634
635	if ( ! idmap_alloc_ldap) {
636	return NT_STATUS_UNSUCCESSFUL;
637	}
638
639	ctx = talloc_new(idmap_alloc_ldap);
640	if ( ! ctx) {
641	DEBUG(0, ("Out of memory!\n"));
642	return NT_STATUS_NO_MEMORY;
643	}
644
645	/* get type */
646	switch (xid->type) {
647
648	case ID_TYPE_UID:
649	type = get_attr_key2string(idpool_attr_list,
650	LDAP_ATTR_UIDNUMBER);
651	break;
652
653	case ID_TYPE_GID:
654	type = get_attr_key2string(idpool_attr_list,
655	LDAP_ATTR_GIDNUMBER);
656	break;
657
658	default:
659	DEBUG(2, ("Invalid ID type (0x%x)\n", xid->type));
660	return NT_STATUS_INVALID_PARAMETER;
661	}
662
663	filter = talloc_asprintf(ctx, "(objectClass=%s)", LDAP_OBJ_IDPOOL);
664	CHECK_ALLOC_DONE(filter);
665
666	attr_list = get_attr_list(ctx, idpool_attr_list);
667	CHECK_ALLOC_DONE(attr_list);
668
669	rc = smbldap_search(idmap_alloc_ldap->smbldap_state,
670	idmap_alloc_ldap->suffix,
671	LDAP_SCOPE_SUBTREE, filter,
672	attr_list, 0, &result);
673
674	if (rc != LDAP_SUCCESS) {
675	DEBUG(0,("%s object not found\n", LDAP_OBJ_IDPOOL));
676	goto done;
677	}
678
679	talloc_autofree_ldapmsg(ctx, result);
680
681	count = ldap_count_entries(idmap_alloc_ldap->smbldap_state->ldap_struct,
682	result);
683	if (count != 1) {
684	DEBUG(0,("Single %s object not found\n", LDAP_OBJ_IDPOOL));
685	goto done;
686	}
687
688	entry = ldap_first_entry(idmap_alloc_ldap->smbldap_state->ldap_struct,
689	result);
690
691	dn = smbldap_talloc_dn(ctx,
692	idmap_alloc_ldap->smbldap_state->ldap_struct,
693	entry);
694	if ( ! dn) {
695	goto done;
696	}
697
698	new_id_str = talloc_asprintf(ctx, "%lu", (unsigned long)xid->id);
699	if ( ! new_id_str) {
700	DEBUG(0,("Out of memory\n"));
701	ret = NT_STATUS_NO_MEMORY;
702	goto done;
703	}
704
705	smbldap_set_mod(&mods, LDAP_MOD_REPLACE, type, new_id_str);
706
707	if (mods == NULL) {
708	DEBUG(0,("smbldap_set_mod() failed.\n"));
709	goto done;
710	}
711
712	rc = smbldap_modify(idmap_alloc_ldap->smbldap_state, dn, mods);
713
714	ldap_mods_free(mods, True);
715
716	if (rc != LDAP_SUCCESS) {
717	DEBUG(1,("Failed to allocate new %s. "
718	"smbldap_modify() failed.\n", type));
719	goto done;
720	}
721
722	ret = NT_STATUS_OK;
723
724	done:
725	talloc_free(ctx);
726	return ret;
727	}
728
729	/**********************************
730	Close idmap ldap alloc
731	**********************************/
732
733	static NTSTATUS idmap_ldap_alloc_close(void)
734	{
735	if (idmap_alloc_ldap) {
736	smbldap_free_struct(&idmap_alloc_ldap->smbldap_state);
737	DEBUG(5,("The connection to the LDAP server was closed\n"));
738	/* maybe free the results here --metze */
739	TALLOC_FREE(idmap_alloc_ldap);
740	}
741	return NT_STATUS_OK;
742	}
743
744
745	/**********************************************************************
746	IDMAP MAPPING LDAP BACKEND
747	**********************************************************************/
748
749	static int idmap_ldap_close_destructor(struct idmap_ldap_context *ctx)
750	{
751	smbldap_free_struct(&ctx->smbldap_state);
752	DEBUG(5,("The connection to the LDAP server was closed\n"));
753	/* maybe free the results here --metze */
754
755	return 0;
756	}
757
758	/********************************
759	Initialise idmap database.
760	********************************/
761
762	static NTSTATUS idmap_ldap_db_init(struct idmap_domain *dom,
763	const char *params)
764	{
765	NTSTATUS ret;
766	struct idmap_ldap_context *ctx = NULL;
767	char *config_option = NULL;
768	const char *tmp = NULL;
769
770	/* Only do init if we are online */
771	if (idmap_is_offline()) {
772	return NT_STATUS_FILE_IS_OFFLINE;
773	}
774
775	ctx = TALLOC_ZERO_P(dom, struct idmap_ldap_context);
776	if ( ! ctx) {
777	DEBUG(0, ("Out of memory!\n"));
778	return NT_STATUS_NO_MEMORY;
779	}
780
781	if (strequal(dom->name, "*")) {
782	uid_t low_uid = 0;
783	uid_t high_uid = 0;
784	gid_t low_gid = 0;
785	gid_t high_gid = 0;
786
787	ctx->filter_low_id = 0;
788	ctx->filter_high_id = 0;
789
790	if (lp_idmap_uid(&low_uid, &high_uid)) {
791	ctx->filter_low_id = low_uid;
792	ctx->filter_high_id = high_uid;
793	} else {
794	DEBUG(3, ("Warning: 'idmap uid' not set!\n"));
795	}
796
797	if (lp_idmap_gid(&low_gid, &high_gid)) {
798	if ((low_gid != low_uid) \|\| (high_gid != high_uid)) {
799	DEBUG(1, ("Warning: 'idmap uid' and 'idmap gid'"
800	" ranges do not agree -- building "
801	"intersection\n"));
802	ctx->filter_low_id = MAX(ctx->filter_low_id,
803	low_gid);
804	ctx->filter_high_id = MIN(ctx->filter_high_id,
805	high_gid);
806	}
807	} else {
808	DEBUG(3, ("Warning: 'idmap gid' not set!\n"));
809	}
810	} else {
811	const char *range = NULL;
812
813	config_option = talloc_asprintf(ctx, "idmap config %s", dom->name);
814	if ( ! config_option) {
815	DEBUG(0, ("Out of memory!\n"));
816	ret = NT_STATUS_NO_MEMORY;
817	goto done;
818	}
819
820	/* load ranges */
821	range = lp_parm_const_string(-1, config_option, "range", NULL);
822	if (range && range[0]) {
823	if ((sscanf(range, "%u - %u", &ctx->filter_low_id,
824	&ctx->filter_high_id) != 2))
825	{
826	DEBUG(1, ("ERROR: invalid filter range [%s]", range));
827	ctx->filter_low_id = 0;
828	ctx->filter_high_id = 0;
829	}
830	}
831	}
832
833	if (ctx->filter_low_id > ctx->filter_high_id) {
834	DEBUG(1, ("ERROR: invalid filter range [%u-%u]",
835	ctx->filter_low_id, ctx->filter_high_id));
836	ctx->filter_low_id = 0;
837	ctx->filter_high_id = 0;
838	}
839
840	if (params != NULL) {
841	/* assume location is the only parameter */
842	ctx->url = talloc_strdup(ctx, params);
843	} else {
844	tmp = lp_parm_const_string(-1, config_option, "ldap_url", NULL);
845
846	if ( ! tmp) {
847	DEBUG(1, ("ERROR: missing idmap ldap url\n"));
848	ret = NT_STATUS_UNSUCCESSFUL;
849	goto done;
850	}
851
852	ctx->url = talloc_strdup(ctx, tmp);
853	}
854	CHECK_ALLOC_DONE(ctx->url);
855
856	tmp = lp_parm_const_string(-1, config_option, "ldap_base_dn", NULL);
857	if ( ! tmp \|\| ! *tmp) {
858	tmp = lp_ldap_idmap_suffix();
859	if ( ! tmp) {
860	DEBUG(1, ("ERROR: missing idmap ldap suffix\n"));
861	ret = NT_STATUS_UNSUCCESSFUL;
862	goto done;
863	}
864	}
865
866	ctx->suffix = talloc_strdup(ctx, tmp);
867	CHECK_ALLOC_DONE(ctx->suffix);
868
869	ret = smbldap_init(ctx, winbind_event_context(), ctx->url,
870	&ctx->smbldap_state);
871	if (!NT_STATUS_IS_OK(ret)) {
872	DEBUG(1, ("ERROR: smbldap_init (%s) failed!\n", ctx->url));
873	goto done;
874	}
875
876	ret = get_credentials( ctx, ctx->smbldap_state, config_option,
877	dom, &ctx->user_dn );
878	if ( !NT_STATUS_IS_OK(ret) ) {
879	DEBUG(1,("idmap_ldap_db_init: Failed to get connection "
880	"credentials (%s)\n", nt_errstr(ret)));
881	goto done;
882	}
883
884	/* set the destructor on the context, so that resource are properly
885	freed if the contexts is released */
886
887	talloc_set_destructor(ctx, idmap_ldap_close_destructor);
888
889	dom->private_data = ctx;
890
891	talloc_free(config_option);
892	return NT_STATUS_OK;
893
894	/failed /
895	done:
896	talloc_free(ctx);
897	return ret;
898	}
899
900	/* max number of ids requested per batch query */
901	#define IDMAP_LDAP_MAX_IDS 30
902
903	/**********************************
904	lookup a set of unix ids.
905	**********************************/
906
907	/* this function searches up to IDMAP_LDAP_MAX_IDS entries
908	* in maps for a match */
909	static struct id_map find_map_by_id(struct id_map *maps,
910	enum id_type type,
911	uint32_t id)
912	{
913	int i;
914
915	for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
916	if (maps[i] == NULL) { /* end of the run */
917	return NULL;
918	}
919	if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
920	return maps[i];
921	}
922	}
923
924	return NULL;
925	}
926
927	static NTSTATUS idmap_ldap_unixids_to_sids(struct idmap_domain *dom,
928	struct id_map **ids)
929	{
930	NTSTATUS ret;
931	TALLOC_CTX *memctx;
932	struct idmap_ldap_context *ctx;
933	LDAPMessage *result = NULL;
934	const char *uidNumber;
935	const char *gidNumber;
936	const char **attr_list;
937	char *filter = NULL;
938	bool multi = False;
939	int idx = 0;
940	int bidx = 0;
941	int count;
942	int rc;
943	int i;
944
945	/* Only do query if we are online */
946	if (idmap_is_offline()) {
947	return NT_STATUS_FILE_IS_OFFLINE;
948	}
949
950	ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
951
952	memctx = talloc_new(ctx);
953	if ( ! memctx) {
954	DEBUG(0, ("Out of memory!\n"));
955	return NT_STATUS_NO_MEMORY;
956	}
957
958	uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
959	gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
960
961	attr_list = get_attr_list(memctx, sidmap_attr_list);
962
963	if ( ! ids[1]) {
964	/* if we are requested just one mapping use the simple filter */
965
966	filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%lu))",
967	LDAP_OBJ_IDMAP_ENTRY,
968	(ids[0]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
969	(unsigned long)ids[0]->xid.id);
970	CHECK_ALLOC_DONE(filter);
971	DEBUG(10, ("Filter: [%s]\n", filter));
972	} else {
973	/* multiple mappings */
974	multi = True;
975	}
976
977	for (i = 0; ids[i]; i++) {
978	ids[i]->status = ID_UNKNOWN;
979	}
980
981	again:
982	if (multi) {
983
984	talloc_free(filter);
985	filter = talloc_asprintf(memctx,
986	"(&(objectClass=%s)(\|",
987	LDAP_OBJ_IDMAP_ENTRY);
988	CHECK_ALLOC_DONE(filter);
989
990	bidx = idx;
991	for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
992	filter = talloc_asprintf_append_buffer(filter, "(%s=%lu)",
993	(ids[idx]->xid.type==ID_TYPE_UID)?uidNumber:gidNumber,
994	(unsigned long)ids[idx]->xid.id);
995	CHECK_ALLOC_DONE(filter);
996	}
997	filter = talloc_asprintf_append_buffer(filter, "))");
998	CHECK_ALLOC_DONE(filter);
999	DEBUG(10, ("Filter: [%s]\n", filter));
1000	} else {
1001	bidx = 0;
1002	idx = 1;
1003	}
1004
1005	rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
1006	filter, attr_list, 0, &result);
1007
1008	if (rc != LDAP_SUCCESS) {
1009	DEBUG(3,("Failure looking up ids (%s)\n", ldap_err2string(rc)));
1010	ret = NT_STATUS_UNSUCCESSFUL;
1011	goto done;
1012	}
1013
1014	count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
1015
1016	if (count == 0) {
1017	DEBUG(10, ("NO SIDs found\n"));
1018	}
1019
1020	for (i = 0; i < count; i++) {
1021	LDAPMessage *entry = NULL;
1022	char *sidstr = NULL;
1023	char *tmp = NULL;
1024	enum id_type type;
1025	struct id_map *map;
1026	uint32_t id;
1027
1028	if (i == 0) { /* first entry */
1029	entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
1030	result);
1031	} else { /* following ones */
1032	entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
1033	entry);
1034	}
1035	if ( ! entry) {
1036	DEBUG(2, ("ERROR: Unable to fetch ldap entries "
1037	"from results\n"));
1038	break;
1039	}
1040
1041	/* first check if the SID is present */
1042	sidstr = smbldap_talloc_single_attribute(
1043	ctx->smbldap_state->ldap_struct,
1044	entry, LDAP_ATTRIBUTE_SID, memctx);
1045	if ( ! sidstr) { /* no sid, skip entry */
1046	DEBUG(2, ("WARNING SID not found on entry\n"));
1047	continue;
1048	}
1049
1050	/* now try to see if it is a uid, if not try with a gid
1051	* (gid is more common, but in case both uidNumber and
1052	* gidNumber are returned the SID is mapped to the uid
1053	not the gid) /
1054	type = ID_TYPE_UID;
1055	tmp = smbldap_talloc_single_attribute(
1056	ctx->smbldap_state->ldap_struct,
1057	entry, uidNumber, memctx);
1058	if ( ! tmp) {
1059	type = ID_TYPE_GID;
1060	tmp = smbldap_talloc_single_attribute(
1061	ctx->smbldap_state->ldap_struct,
1062	entry, gidNumber, memctx);
1063	}
1064	if ( ! tmp) { /* wow very strange entry, how did it match ? */
1065	DEBUG(5, ("Unprobable match on (%s), no uidNumber, "
1066	"nor gidNumber returned\n", sidstr));
1067	TALLOC_FREE(sidstr);
1068	continue;
1069	}
1070
1071	id = strtoul(tmp, NULL, 10);
1072	if ((id == 0) \|\|
1073	(ctx->filter_low_id && (id < ctx->filter_low_id)) \|\|
1074	(ctx->filter_high_id && (id > ctx->filter_high_id))) {
1075	DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1076	"Filtered!\n", id,
1077	ctx->filter_low_id, ctx->filter_high_id));
1078	TALLOC_FREE(sidstr);
1079	TALLOC_FREE(tmp);
1080	continue;
1081	}
1082	TALLOC_FREE(tmp);
1083
1084	map = find_map_by_id(&ids[bidx], type, id);
1085	if (!map) {
1086	DEBUG(2, ("WARNING: couldn't match sid (%s) "
1087	"with requested ids\n", sidstr));
1088	TALLOC_FREE(sidstr);
1089	continue;
1090	}
1091
1092	if ( ! string_to_sid(map->sid, sidstr)) {
1093	DEBUG(2, ("ERROR: Invalid SID on entry\n"));
1094	TALLOC_FREE(sidstr);
1095	continue;
1096	}
1097	TALLOC_FREE(sidstr);
1098
1099	/* mapped */
1100	map->status = ID_MAPPED;
1101
1102	DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1103	(unsigned long)map->xid.id, map->xid.type));
1104	}
1105
1106	/* free the ldap results */
1107	if (result) {
1108	ldap_msgfree(result);
1109	result = NULL;
1110	}
1111
1112	if (multi && ids[idx]) { /* still some values to map */
1113	goto again;
1114	}
1115
1116	ret = NT_STATUS_OK;
1117
1118	/* mark all unknwon/expired ones as unmapped */
1119	for (i = 0; ids[i]; i++) {
1120	if (ids[i]->status != ID_MAPPED)
1121	ids[i]->status = ID_UNMAPPED;
1122	}
1123
1124	done:
1125	talloc_free(memctx);
1126	return ret;
1127	}
1128
1129	/**********************************
1130	lookup a set of sids.
1131	**********************************/
1132
1133	/* this function searches up to IDMAP_LDAP_MAX_IDS entries
1134	* in maps for a match */
1135	static struct id_map find_map_by_sid(struct id_map maps, DOM_SID sid)
1136	{
1137	int i;
1138
1139	for (i = 0; i < IDMAP_LDAP_MAX_IDS; i++) {
1140	if (maps[i] == NULL) { /* end of the run */
1141	return NULL;
1142	}
1143	if (sid_equal(maps[i]->sid, sid)) {
1144	return maps[i];
1145	}
1146	}
1147
1148	return NULL;
1149	}
1150
1151	static NTSTATUS idmap_ldap_sids_to_unixids(struct idmap_domain *dom,
1152	struct id_map **ids)
1153	{
1154	LDAPMessage *entry = NULL;
1155	NTSTATUS ret;
1156	TALLOC_CTX *memctx;
1157	struct idmap_ldap_context *ctx;
1158	LDAPMessage *result = NULL;
1159	const char *uidNumber;
1160	const char *gidNumber;
1161	const char **attr_list;
1162	char *filter = NULL;
1163	bool multi = False;
1164	int idx = 0;
1165	int bidx = 0;
1166	int count;
1167	int rc;
1168	int i;
1169
1170	/* Only do query if we are online */
1171	if (idmap_is_offline()) {
1172	return NT_STATUS_FILE_IS_OFFLINE;
1173	}
1174
1175	ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
1176
1177	memctx = talloc_new(ctx);
1178	if ( ! memctx) {
1179	DEBUG(0, ("Out of memory!\n"));
1180	return NT_STATUS_NO_MEMORY;
1181	}
1182
1183	uidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_UIDNUMBER);
1184	gidNumber = get_attr_key2string(idpool_attr_list, LDAP_ATTR_GIDNUMBER);
1185
1186	attr_list = get_attr_list(memctx, sidmap_attr_list);
1187
1188	if ( ! ids[1]) {
1189	/* if we are requested just one mapping use the simple filter */
1190
1191	filter = talloc_asprintf(memctx, "(&(objectClass=%s)(%s=%s))",
1192	LDAP_OBJ_IDMAP_ENTRY,
1193	LDAP_ATTRIBUTE_SID,
1194	sid_string_talloc(memctx, ids[0]->sid));
1195	CHECK_ALLOC_DONE(filter);
1196	DEBUG(10, ("Filter: [%s]\n", filter));
1197	} else {
1198	/* multiple mappings */
1199	multi = True;
1200	}
1201
1202	for (i = 0; ids[i]; i++) {
1203	ids[i]->status = ID_UNKNOWN;
1204	}
1205
1206	again:
1207	if (multi) {
1208
1209	TALLOC_FREE(filter);
1210	filter = talloc_asprintf(memctx,
1211	"(&(objectClass=%s)(\|",
1212	LDAP_OBJ_IDMAP_ENTRY);
1213	CHECK_ALLOC_DONE(filter);
1214
1215	bidx = idx;
1216	for (i = 0; (i < IDMAP_LDAP_MAX_IDS) && ids[idx]; i++, idx++) {
1217	filter = talloc_asprintf_append_buffer(filter, "(%s=%s)",
1218	LDAP_ATTRIBUTE_SID,
1219	sid_string_talloc(memctx,
1220	ids[idx]->sid));
1221	CHECK_ALLOC_DONE(filter);
1222	}
1223	filter = talloc_asprintf_append_buffer(filter, "))");
1224	CHECK_ALLOC_DONE(filter);
1225	DEBUG(10, ("Filter: [%s]", filter));
1226	} else {
1227	bidx = 0;
1228	idx = 1;
1229	}
1230
1231	rc = smbldap_search(ctx->smbldap_state, ctx->suffix, LDAP_SCOPE_SUBTREE,
1232	filter, attr_list, 0, &result);
1233
1234	if (rc != LDAP_SUCCESS) {
1235	DEBUG(3,("Failure looking up sids (%s)\n",
1236	ldap_err2string(rc)));
1237	ret = NT_STATUS_UNSUCCESSFUL;
1238	goto done;
1239	}
1240
1241	count = ldap_count_entries(ctx->smbldap_state->ldap_struct, result);
1242
1243	if (count == 0) {
1244	DEBUG(10, ("NO SIDs found\n"));
1245	}
1246
1247	for (i = 0; i < count; i++) {
1248	char *sidstr = NULL;
1249	char *tmp = NULL;
1250	enum id_type type;
1251	struct id_map *map;
1252	DOM_SID sid;
1253	uint32_t id;
1254
1255	if (i == 0) { /* first entry */
1256	entry = ldap_first_entry(ctx->smbldap_state->ldap_struct,
1257	result);
1258	} else { /* following ones */
1259	entry = ldap_next_entry(ctx->smbldap_state->ldap_struct,
1260	entry);
1261	}
1262	if ( ! entry) {
1263	DEBUG(2, ("ERROR: Unable to fetch ldap entries "
1264	"from results\n"));
1265	break;
1266	}
1267
1268	/* first check if the SID is present */
1269	sidstr = smbldap_talloc_single_attribute(
1270	ctx->smbldap_state->ldap_struct,
1271	entry, LDAP_ATTRIBUTE_SID, memctx);
1272	if ( ! sidstr) { /* no sid ??, skip entry */
1273	DEBUG(2, ("WARNING SID not found on entry\n"));
1274	continue;
1275	}
1276
1277	if ( ! string_to_sid(&sid, sidstr)) {
1278	DEBUG(2, ("ERROR: Invalid SID on entry\n"));
1279	TALLOC_FREE(sidstr);
1280	continue;
1281	}
1282
1283	map = find_map_by_sid(&ids[bidx], &sid);
1284	if (!map) {
1285	DEBUG(2, ("WARNING: couldn't find entry sid (%s) "
1286	"in ids", sidstr));
1287	TALLOC_FREE(sidstr);
1288	continue;
1289	}
1290
1291	TALLOC_FREE(sidstr);
1292
1293	/* now try to see if it is a uid, if not try with a gid
1294	* (gid is more common, but in case both uidNumber and
1295	* gidNumber are returned the SID is mapped to the uid
1296	* not the gid) */
1297	type = ID_TYPE_UID;
1298	tmp = smbldap_talloc_single_attribute(
1299	ctx->smbldap_state->ldap_struct,
1300	entry, uidNumber, memctx);
1301	if ( ! tmp) {
1302	type = ID_TYPE_GID;
1303	tmp = smbldap_talloc_single_attribute(
1304	ctx->smbldap_state->ldap_struct,
1305	entry, gidNumber, memctx);
1306	}
1307	if ( ! tmp) { /* no ids ?? */
1308	DEBUG(5, ("no uidNumber, "
1309	"nor gidNumber attributes found\n"));
1310	continue;
1311	}
1312
1313	id = strtoul(tmp, NULL, 10);
1314	if ((id == 0) \|\|
1315	(ctx->filter_low_id && (id < ctx->filter_low_id)) \|\|
1316	(ctx->filter_high_id && (id > ctx->filter_high_id))) {
1317	DEBUG(5, ("Requested id (%u) out of range (%u - %u). "
1318	"Filtered!\n", id,
1319	ctx->filter_low_id, ctx->filter_high_id));
1320	TALLOC_FREE(tmp);
1321	continue;
1322	}
1323	TALLOC_FREE(tmp);
1324
1325	/* mapped */
1326	map->xid.type = type;
1327	map->xid.id = id;
1328	map->status = ID_MAPPED;
1329
1330	DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
1331	(unsigned long)map->xid.id, map->xid.type));
1332	}
1333
1334	/* free the ldap results */
1335	if (result) {
1336	ldap_msgfree(result);
1337	result = NULL;
1338	}
1339
1340	if (multi && ids[idx]) { /* still some values to map */
1341	goto again;
1342	}
1343
1344	ret = NT_STATUS_OK;
1345
1346	/* mark all unknwon/expired ones as unmapped */
1347	for (i = 0; ids[i]; i++) {
1348	if (ids[i]->status != ID_MAPPED)
1349	ids[i]->status = ID_UNMAPPED;
1350	}
1351
1352	done:
1353	talloc_free(memctx);
1354	return ret;
1355	}
1356
1357	/**********************************
1358	set a mapping.
1359	**********************************/
1360
1361	/* TODO: change this: This function cannot be called to modify a mapping,
1362	* only set a new one */
1363
1364	static NTSTATUS idmap_ldap_set_mapping(struct idmap_domain *dom,
1365	const struct id_map *map)
1366	{
1367	NTSTATUS ret;
1368	TALLOC_CTX *memctx;
1369	struct idmap_ldap_context *ctx;
1370	LDAPMessage *entry = NULL;
1371	LDAPMod **mods = NULL;
1372	const char *type;
1373	char *id_str;
1374	char *sid;
1375	char *dn;
1376	int rc = -1;
1377
1378	/* Only do query if we are online */
1379	if (idmap_is_offline()) {
1380	return NT_STATUS_FILE_IS_OFFLINE;
1381	}
1382
1383	ctx = talloc_get_type(dom->private_data, struct idmap_ldap_context);
1384
1385	switch(map->xid.type) {
1386	case ID_TYPE_UID:
1387	type = get_attr_key2string(sidmap_attr_list,
1388	LDAP_ATTR_UIDNUMBER);
1389	break;
1390
1391	case ID_TYPE_GID:
1392	type = get_attr_key2string(sidmap_attr_list,
1393	LDAP_ATTR_GIDNUMBER);
1394	break;
1395
1396	default:
1397	return NT_STATUS_INVALID_PARAMETER;
1398	}
1399
1400	memctx = talloc_new(ctx);
1401	if ( ! memctx) {
1402	DEBUG(0, ("Out of memory!\n"));
1403	return NT_STATUS_NO_MEMORY;
1404	}
1405
1406	id_str = talloc_asprintf(memctx, "%lu", (unsigned long)map->xid.id);
1407	CHECK_ALLOC_DONE(id_str);
1408
1409	sid = talloc_strdup(memctx, sid_string_talloc(memctx, map->sid));
1410	CHECK_ALLOC_DONE(sid);
1411
1412	dn = talloc_asprintf(memctx, "%s=%s,%s",
1413	get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
1414	sid,
1415	ctx->suffix);
1416	CHECK_ALLOC_DONE(dn);
1417
1418	smbldap_set_mod(&mods, LDAP_MOD_ADD,
1419	"objectClass", LDAP_OBJ_IDMAP_ENTRY);
1420
1421	smbldap_make_mod(ctx->smbldap_state->ldap_struct,
1422	entry, &mods, type, id_str);
1423
1424	smbldap_make_mod(ctx->smbldap_state->ldap_struct, entry, &mods,
1425	get_attr_key2string(sidmap_attr_list, LDAP_ATTR_SID),
1426	sid);
1427
1428	if ( ! mods) {
1429	DEBUG(2, ("ERROR: No mods?\n"));
1430	ret = NT_STATUS_UNSUCCESSFUL;
1431	goto done;
1432	}
1433
1434	/* TODO: remove conflicting mappings! */
1435
1436	smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SID_ENTRY);
1437
1438	DEBUG(10, ("Set DN %s (%s -> %s)\n", dn, sid, id_str));
1439
1440	rc = smbldap_add(ctx->smbldap_state, dn, mods);
1441	ldap_mods_free(mods, True);
1442
1443	if (rc != LDAP_SUCCESS) {
1444	char *ld_error = NULL;
1445	ldap_get_option(ctx->smbldap_state->ldap_struct,
1446	LDAP_OPT_ERROR_STRING, &ld_error);
1447	DEBUG(0,("ldap_set_mapping_internals: Failed to add %s to %lu "
1448	"mapping [%s]\n", sid,
1449	(unsigned long)map->xid.id, type));
1450	DEBUG(0, ("ldap_set_mapping_internals: Error was: %s (%s)\n",
1451	ld_error ? ld_error : "(NULL)", ldap_err2string (rc)));
1452	if (ld_error) {
1453	ldap_memfree(ld_error);
1454	}
1455	ret = NT_STATUS_UNSUCCESSFUL;
1456	goto done;
1457	}
1458
1459	DEBUG(10,("ldap_set_mapping: Successfully created mapping from %s to "
1460	"%lu [%s]\n", sid, (unsigned long)map->xid.id, type));
1461
1462	ret = NT_STATUS_OK;
1463
1464	done:
1465	talloc_free(memctx);
1466	return ret;
1467	}
1468
1469	/**********************************
1470	Close the idmap ldap instance
1471	**********************************/
1472
1473	static NTSTATUS idmap_ldap_close(struct idmap_domain *dom)
1474	{
1475	struct idmap_ldap_context *ctx;
1476
1477	if (dom->private_data) {
1478	ctx = talloc_get_type(dom->private_data,
1479	struct idmap_ldap_context);
1480
1481	talloc_free(ctx);
1482	dom->private_data = NULL;
1483	}
1484
1485	return NT_STATUS_OK;
1486	}
1487
1488	static struct idmap_methods idmap_ldap_methods = {
1489
1490	.init = idmap_ldap_db_init,
1491	.unixids_to_sids = idmap_ldap_unixids_to_sids,
1492	.sids_to_unixids = idmap_ldap_sids_to_unixids,
1493	.set_mapping = idmap_ldap_set_mapping,
1494	.close_fn = idmap_ldap_close
1495	};
1496
1497	static struct idmap_alloc_methods idmap_ldap_alloc_methods = {
1498
1499	.init = idmap_ldap_alloc_init,
1500	.allocate_id = idmap_ldap_allocate_id,
1501	.get_id_hwm = idmap_ldap_get_hwm,
1502	.set_id_hwm = idmap_ldap_set_hwm,
1503	.close_fn = idmap_ldap_alloc_close,
1504	/* .dump_data = TODO */
1505	};
1506
1507	static NTSTATUS idmap_alloc_ldap_init(void)
1508	{
1509	return smb_register_idmap_alloc(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1510	&idmap_ldap_alloc_methods);
1511	}
1512
1513	NTSTATUS idmap_ldap_init(void);
1514	NTSTATUS idmap_ldap_init(void)
1515	{
1516	NTSTATUS ret;
1517
1518	/* FIXME: bad hack to actually register also the alloc_ldap module
1519	* without changining configure.in */
1520	ret = idmap_alloc_ldap_init();
1521	if (! NT_STATUS_IS_OK(ret)) {
1522	return ret;
1523	}
1524	return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ldap",
1525	&idmap_ldap_methods);
1526	}
1527

Note: See TracBrowser for help on using the repository browser.

Download in other formats: