Context Navigation

← Previous Revision
Latest Revision
Next Revision →
Blame
Revision Log

winbindd_ads.c@ 1

Visit:

Last change on this file since 1 was 1, checked in by Paul Smedley, 19 years ago
Initial code import
File size: 27.4 KB

Line
1	/*
2	Unix SMB/CIFS implementation.
3
4	Winbind ADS backend functions
5
6	Copyright (C) Andrew Tridgell 2001
7	Copyright (C) Andrew Bartlett <[email protected]> 2003
8	Copyright (C) Gerald (Jerry) Carter 2004
9
10	This program is free software; you can redistribute it and/or modify
11	it under the terms of the GNU General Public License as published by
12	the Free Software Foundation; either version 2 of the License, or
13	(at your option) any later version.
14
15	This program is distributed in the hope that it will be useful,
16	but WITHOUT ANY WARRANTY; without even the implied warranty of
17	MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18	GNU General Public License for more details.
19
20	You should have received a copy of the GNU General Public License
21	along with this program; if not, write to the Free Software
22	Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
23	*/
24
25	#include "includes.h"
26	#include "winbindd.h"
27
28	#ifdef HAVE_ADS
29
30	#undef DBGC_CLASS
31	#define DBGC_CLASS DBGC_WINBIND
32
33	extern struct winbindd_methods reconnect_methods;
34
35	/*
36	return our ads connections structure for a domain. We keep the connection
37	open to make things faster
38	*/
39	static ADS_STRUCT ads_cached_connection(struct winbindd_domain domain)
40	{
41	ADS_STRUCT *ads;
42	ADS_STATUS status;
43
44	DEBUG(10,("ads_cached_connection\n"));
45
46	if (domain->private_data) {
47
48	time_t expire;
49	time_t now = time(NULL);
50
51	/* check for a valid structure */
52	ads = (ADS_STRUCT *)domain->private_data;
53
54	expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
55
56	DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
57	(uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
58
59	if ( ads->config.realm && (expire > now)) {
60	return ads;
61	} else {
62	/* we own this ADS_STRUCT so make sure it goes away */
63	DEBUG(7,("Deleting expired krb5 credential cache\n"));
64	ads->is_mine = True;
65	ads_destroy( &ads );
66	ads_kdestroy("MEMORY:winbind_ccache");
67	domain->private_data = NULL;
68	}
69	}
70
71	/* we don't want this to affect the users ccache */
72	setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
73
74	ads = ads_init(domain->alt_name, domain->name, NULL);
75	if (!ads) {
76	DEBUG(1,("ads_init for domain %s failed\n", domain->name));
77	return NULL;
78	}
79
80	/* the machine acct password might have change - fetch it every time */
81
82	SAFE_FREE(ads->auth.password);
83	SAFE_FREE(ads->auth.realm);
84
85	if ( IS_DC ) {
86	DOM_SID sid;
87	time_t last_set_time;
88
89	if ( !secrets_fetch_trusted_domain_password( domain->name, &ads->auth.password, &sid, &last_set_time ) ) {
90	ads_destroy( &ads );
91	return NULL;
92	}
93	ads->auth.realm = SMB_STRDUP( ads->server.realm );
94	strupper_m( ads->auth.realm );
95	}
96	else {
97	struct winbindd_domain *our_domain = domain;
98
99	ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
100
101	/* always give preference to the alt_name in our
102	primary domain if possible */
103
104	if ( !domain->primary )
105	our_domain = find_our_domain();
106
107	if ( our_domain->alt_name[0] != '\0' ) {
108	ads->auth.realm = SMB_STRDUP( our_domain->alt_name );
109	strupper_m( ads->auth.realm );
110	}
111	else
112	ads->auth.realm = SMB_STRDUP( lp_realm() );
113	}
114
115	ads->auth.renewable = WINBINDD_PAM_AUTH_KRB5_RENEW_TIME;
116
117	status = ads_connect(ads);
118	if (!ADS_ERR_OK(status) \|\| !ads->config.realm) {
119	DEBUG(1,("ads_connect for domain %s failed: %s\n",
120	domain->name, ads_errstr(status)));
121	ads_destroy(&ads);
122
123	/* if we get ECONNREFUSED then it might be a NT4
124	server, fall back to MSRPC */
125	if (status.error_type == ENUM_ADS_ERROR_SYSTEM &&
126	status.err.rc == ECONNREFUSED) {
127	/* 'reconnect_methods' is the MS-RPC backend. */
128	DEBUG(1,("Trying MSRPC methods\n"));
129	domain->backend = &reconnect_methods;
130	}
131	return NULL;
132	}
133
134	/* set the flag that says we don't own the memory even
135	though we do so that ads_destroy() won't destroy the
136	structure we pass back by reference */
137
138	ads->is_mine = False;
139
140	domain->private_data = (void *)ads;
141	return ads;
142	}
143
144
145	/* Query display info for a realm. This is the basic user list fn */
146	static NTSTATUS query_user_list(struct winbindd_domain *domain,
147	TALLOC_CTX *mem_ctx,
148	uint32 *num_entries,
149	WINBIND_USERINFO **info)
150	{
151	ADS_STRUCT *ads = NULL;
152	const char attrs[] = { "", NULL };
153	int i, count;
154	ADS_STATUS rc;
155	LDAPMessage *res = NULL;
156	LDAPMessage *msg = NULL;
157	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
158
159	*num_entries = 0;
160
161	DEBUG(3,("ads: query_user_list\n"));
162
163	ads = ads_cached_connection(domain);
164
165	if (!ads) {
166	domain->last_status = NT_STATUS_SERVER_DISABLED;
167	goto done;
168	}
169
170	rc = ads_search_retry(ads, &res, "(objectCategory=user)", attrs);
171	if (!ADS_ERR_OK(rc) \|\| !res) {
172	DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
173	goto done;
174	}
175
176	count = ads_count_replies(ads, res);
177	if (count == 0) {
178	DEBUG(1,("query_user_list: No users found\n"));
179	goto done;
180	}
181
182	(*info) = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, count);
183	if (!*info) {
184	status = NT_STATUS_NO_MEMORY;
185	goto done;
186	}
187
188	i = 0;
189
190	for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
191	char name, gecos = NULL;
192	char *homedir = NULL;
193	char *shell = NULL;
194	uint32 group;
195	uint32 atype;
196	DOM_SID user_sid;
197	gid_t primary_gid = (gid_t)-1;
198
199	if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) \|\|
200	ads_atype_map(atype) != SID_NAME_USER) {
201	DEBUG(1,("Not a user account? atype=0x%x\n", atype));
202	continue;
203	}
204
205	name = ads_pull_username(ads, mem_ctx, msg);
206
207	if ( ads_pull_sid( ads, msg, "objectSid", &user_sid ) ) {
208	status = nss_get_info( domain->name, &user_sid, mem_ctx,
209	ads, msg, &homedir, &shell, &gecos,
210	&primary_gid );
211	}
212
213	if (gecos == NULL) {
214	gecos = ads_pull_string(ads, mem_ctx, msg, "name");
215	}
216
217	if (!ads_pull_sid(ads, msg, "objectSid",
218	&(*info)[i].user_sid)) {
219	DEBUG(1,("No sid for %s !?\n", name));
220	continue;
221	}
222	if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
223	DEBUG(1,("No primary group for %s !?\n", name));
224	continue;
225	}
226
227	(*info)[i].acct_name = name;
228	(*info)[i].full_name = gecos;
229	(*info)[i].homedir = homedir;
230	(*info)[i].shell = shell;
231	(*info)[i].primary_gid = primary_gid;
232	sid_compose(&(*info)[i].group_sid, &domain->sid, group);
233	i++;
234	}
235
236	(*num_entries) = i;
237	status = NT_STATUS_OK;
238
239	DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries)));
240
241	done:
242	if (res)
243	ads_msgfree(ads, res);
244
245	return status;
246	}
247
248	/* list all domain groups */
249	static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
250	TALLOC_CTX *mem_ctx,
251	uint32 *num_entries,
252	struct acct_info **info)
253	{
254	ADS_STRUCT *ads = NULL;
255	const char *attrs[] = {"userPrincipalName", "sAMAccountName",
256	"name", "objectSid", NULL};
257	int i, count;
258	ADS_STATUS rc;
259	LDAPMessage *res = NULL;
260	LDAPMessage *msg = NULL;
261	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
262	const char *filter;
263	BOOL enum_dom_local_groups = False;
264
265	*num_entries = 0;
266
267	DEBUG(3,("ads: enum_dom_groups\n"));
268
269	/* only grab domain local groups for our domain */
270	if ( domain->native_mode && strequal(lp_realm(), domain->alt_name) ) {
271	enum_dom_local_groups = True;
272	}
273
274	/* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
275	* rollup-fixes:
276	*
277	* According to Section 5.1(4) of RFC 2251 if a value of a type is it's
278	* default value, it MUST be absent. In case of extensible matching the
279	* "dnattr" boolean defaults to FALSE and so it must be only be present
280	* when set to TRUE.
281	*
282	* When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
283	* filter using bitwise matching rule then the buggy AD fails to decode
284	* the extensible match. As a workaround set it to TRUE and thereby add
285	* the dnAttributes "dn" field to cope with those older AD versions.
286	* It should not harm and won't put any additional load on the AD since
287	* none of the dn components have a bitmask-attribute.
288	*
289	* Thanks to Ralf Haferkamp for input and testing - Guenther */
290
291	filter = talloc_asprintf(mem_ctx, "(&(objectCategory=group)(&(groupType:dn:%s:=%d)(!(groupType:dn:%s:=%d))))",
292	ADS_LDAP_MATCHING_RULE_BIT_AND, GROUP_TYPE_SECURITY_ENABLED,
293	ADS_LDAP_MATCHING_RULE_BIT_AND,
294	enum_dom_local_groups ? GROUP_TYPE_BUILTIN_LOCAL_GROUP : GROUP_TYPE_RESOURCE_GROUP);
295
296	if (filter == NULL) {
297	status = NT_STATUS_NO_MEMORY;
298	goto done;
299	}
300
301	ads = ads_cached_connection(domain);
302
303	if (!ads) {
304	domain->last_status = NT_STATUS_SERVER_DISABLED;
305	goto done;
306	}
307
308	rc = ads_search_retry(ads, &res, filter, attrs);
309	if (!ADS_ERR_OK(rc) \|\| !res) {
310	DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc)));
311	goto done;
312	}
313
314	count = ads_count_replies(ads, res);
315	if (count == 0) {
316	DEBUG(1,("enum_dom_groups: No groups found\n"));
317	goto done;
318	}
319
320	(*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
321	if (!*info) {
322	status = NT_STATUS_NO_MEMORY;
323	goto done;
324	}
325
326	i = 0;
327
328	for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
329	char name, gecos;
330	DOM_SID sid;
331	uint32 rid;
332
333	name = ads_pull_username(ads, mem_ctx, msg);
334	gecos = ads_pull_string(ads, mem_ctx, msg, "name");
335	if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
336	DEBUG(1,("No sid for %s !?\n", name));
337	continue;
338	}
339
340	if (!sid_peek_check_rid(&domain->sid, &sid, &rid)) {
341	DEBUG(1,("No rid for %s !?\n", name));
342	continue;
343	}
344
345	fstrcpy((*info)[i].acct_name, name);
346	fstrcpy((*info)[i].acct_desc, gecos);
347	(*info)[i].rid = rid;
348	i++;
349	}
350
351	(*num_entries) = i;
352
353	status = NT_STATUS_OK;
354
355	DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries)));
356
357	done:
358	if (res)
359	ads_msgfree(ads, res);
360
361	return status;
362	}
363
364	/* list all domain local groups */
365	static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
366	TALLOC_CTX *mem_ctx,
367	uint32 *num_entries,
368	struct acct_info **info)
369	{
370	/*
371	* This is a stub function only as we returned the domain
372	* local groups in enum_dom_groups() if the domain->native field
373	* was true. This is a simple performance optimization when
374	* using LDAP.
375	*
376	* if we ever need to enumerate domain local groups separately,
377	* then this the optimization in enum_dom_groups() will need
378	* to be split out
379	*/
380	*num_entries = 0;
381
382	return NT_STATUS_OK;
383	}
384
385	/* convert a DN to a name, SID and name type
386	this might become a major speed bottleneck if groups have
387	lots of users, in which case we could cache the results
388	*/
389	static BOOL dn_lookup(ADS_STRUCT ads, TALLOC_CTX mem_ctx,
390	const char *dn,
391	char *name, uint32 name_type, DOM_SID *sid)
392	{
393	LDAPMessage *res = NULL;
394	const char *attrs[] = {"userPrincipalName", "sAMAccountName",
395	"objectSid", "sAMAccountType", NULL};
396	ADS_STATUS rc;
397	uint32 atype;
398	DEBUG(3,("ads: dn_lookup\n"));
399
400	rc = ads_search_retry_dn(ads, &res, dn, attrs);
401
402	if (!ADS_ERR_OK(rc) \|\| !res) {
403	goto failed;
404	}
405
406	(*name) = ads_pull_username(ads, mem_ctx, res);
407
408	if (!ads_pull_uint32(ads, res, "sAMAccountType", &atype)) {
409	goto failed;
410	}
411	(*name_type) = ads_atype_map(atype);
412
413	if (!ads_pull_sid(ads, res, "objectSid", sid)) {
414	goto failed;
415	}
416
417	if (res)
418	ads_msgfree(ads, res);
419
420	return True;
421
422	failed:
423	if (res)
424	ads_msgfree(ads, res);
425
426	return False;
427	}
428
429	/* Lookup user information from a rid */
430	static NTSTATUS query_user(struct winbindd_domain *domain,
431	TALLOC_CTX *mem_ctx,
432	const DOM_SID *sid,
433	WINBIND_USERINFO *info)
434	{
435	ADS_STRUCT *ads = NULL;
436	const char attrs[] = { "", NULL };
437	ADS_STATUS rc;
438	int count;
439	LDAPMessage *msg = NULL;
440	char *ldap_exp;
441	char *sidstr;
442	uint32 group_rid;
443	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
444
445	DEBUG(3,("ads: query_user\n"));
446
447	if ( (ads = ads_cached_connection(domain)) == NULL ) {
448	domain->last_status = NT_STATUS_SERVER_DISABLED;
449	goto done;
450	}
451
452	sidstr = sid_binstring(sid);
453	asprintf(&ldap_exp, "(objectSid=%s)", sidstr);
454	rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
455	free(ldap_exp);
456	free(sidstr);
457	if (!ADS_ERR_OK(rc) \|\| !msg) {
458	DEBUG(1,("query_user(sid=%s) ads_search: %s\n",
459	sid_string_static(sid), ads_errstr(rc)));
460	goto done;
461	}
462
463	count = ads_count_replies(ads, msg);
464	if (count != 1) {
465	DEBUG(1,("query_user(sid=%s): Not found\n",
466	sid_string_static(sid)));
467	goto done;
468	}
469
470	info->acct_name = ads_pull_username(ads, mem_ctx, msg);
471
472	info->primary_gid = (gid_t)-1;
473	nss_get_info( domain->name, sid, mem_ctx, ads, msg,
474	&info->homedir, &info->shell, &info->full_name, &info->primary_gid );
475
476	if (info->full_name == NULL) {
477	info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
478	}
479
480	if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
481	DEBUG(1,("No primary group for %s !?\n",
482	sid_string_static(sid)));
483	goto done;
484	}
485
486	sid_copy(&info->user_sid, sid);
487	sid_compose(&info->group_sid, &domain->sid, group_rid);
488
489	status = NT_STATUS_OK;
490
491	DEBUG(3,("ads query_user gave %s\n", info->acct_name));
492	done:
493	if (msg)
494	ads_msgfree(ads, msg);
495
496	return status;
497	}
498
499	/* Lookup groups a user is a member of - alternate method, for when
500	tokenGroups are not available. */
501	static NTSTATUS lookup_usergroups_member(struct winbindd_domain *domain,
502	TALLOC_CTX *mem_ctx,
503	const char *user_dn,
504	DOM_SID *primary_group,
505	size_t p_num_groups, DOM_SID *user_sids)
506	{
507	ADS_STATUS rc;
508	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
509	int count;
510	LDAPMessage *res = NULL;
511	LDAPMessage *msg = NULL;
512	char *ldap_exp;
513	ADS_STRUCT *ads;
514	const char *group_attrs[] = {"objectSid", NULL};
515	char *escaped_dn;
516	size_t num_groups = 0;
517
518	DEBUG(3,("ads: lookup_usergroups_member\n"));
519
520	ads = ads_cached_connection(domain);
521
522	if (!ads) {
523	domain->last_status = NT_STATUS_SERVER_DISABLED;
524	goto done;
525	}
526
527	if (!(escaped_dn = escape_ldap_string_alloc(user_dn))) {
528	status = NT_STATUS_NO_MEMORY;
529	goto done;
530	}
531
532	if (!(ldap_exp = talloc_asprintf(mem_ctx, "(&(member=%s)(objectCategory=group))", escaped_dn))) {
533	DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn));
534	SAFE_FREE(escaped_dn);
535	status = NT_STATUS_NO_MEMORY;
536	goto done;
537	}
538
539	SAFE_FREE(escaped_dn);
540
541	rc = ads_search_retry(ads, &res, ldap_exp, group_attrs);
542
543	if (!ADS_ERR_OK(rc) \|\| !res) {
544	DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc)));
545	return ads_ntstatus(rc);
546	}
547
548	count = ads_count_replies(ads, res);
549
550	*user_sids = NULL;
551	num_groups = 0;
552
553	/* always add the primary group to the sid array */
554	if (!add_sid_to_array(mem_ctx, primary_group, user_sids, &num_groups)) {
555	status = NT_STATUS_NO_MEMORY;
556	goto done;
557	}
558
559	if (count > 0) {
560	for (msg = ads_first_entry(ads, res); msg;
561	msg = ads_next_entry(ads, msg)) {
562	DOM_SID group_sid;
563
564	if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
565	DEBUG(1,("No sid for this group ?!?\n"));
566	continue;
567	}
568
569	/* ignore Builtin groups from ADS - Guenther */
570	if (sid_check_is_in_builtin(&group_sid)) {
571	continue;
572	}
573
574	if (!add_sid_to_array(mem_ctx, &group_sid, user_sids,
575	&num_groups)) {
576	status = NT_STATUS_NO_MEMORY;
577	goto done;
578	}
579	}
580
581	}
582
583	*p_num_groups = num_groups;
584	status = (user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
585
586	DEBUG(3,("ads lookup_usergroups (member) succeeded for dn=%s\n", user_dn));
587	done:
588	if (res)
589	ads_msgfree(ads, res);
590
591	return status;
592	}
593
594	/* Lookup groups a user is a member of - alternate method, for when
595	tokenGroups are not available. */
596	static NTSTATUS lookup_usergroups_memberof(struct winbindd_domain *domain,
597	TALLOC_CTX *mem_ctx,
598	const char *user_dn,
599	DOM_SID *primary_group,
600	size_t p_num_groups, DOM_SID *user_sids)
601	{
602	ADS_STATUS rc;
603	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
604	int count;
605	LDAPMessage *res = NULL;
606	ADS_STRUCT *ads;
607	const char *attrs[] = {"memberOf", NULL};
608	size_t num_groups = 0;
609	DOM_SID *group_sids = NULL;
610	char *escaped_dn;
611	int i;
612
613	DEBUG(3,("ads: lookup_usergroups_memberof\n"));
614
615	ads = ads_cached_connection(domain);
616
617	if (!ads) {
618	domain->last_status = NT_STATUS_SERVER_DISABLED;
619	goto done;
620	}
621
622	if (!(escaped_dn = escape_ldap_string_alloc(user_dn))) {
623	status = NT_STATUS_NO_MEMORY;
624	goto done;
625	}
626
627	rc = ads_search_retry_extended_dn(ads, &res, escaped_dn, attrs,
628	ADS_EXTENDED_DN_HEX_STRING);
629
630	SAFE_FREE(escaped_dn);
631
632	if (!ADS_ERR_OK(rc) \|\| !res) {
633	DEBUG(1,("lookup_usergroups_memberof ads_search member=%s: %s\n",
634	user_dn, ads_errstr(rc)));
635	return ads_ntstatus(rc);
636	}
637
638	count = ads_count_replies(ads, res);
639
640	if (count == 0) {
641	status = NT_STATUS_NO_SUCH_USER;
642	goto done;
643	}
644
645	*user_sids = NULL;
646	num_groups = 0;
647
648	/* always add the primary group to the sid array */
649	if (!add_sid_to_array(mem_ctx, primary_group, user_sids, &num_groups)) {
650	status = NT_STATUS_NO_MEMORY;
651	goto done;
652	}
653
654	count = ads_pull_sids_from_extendeddn(ads, mem_ctx, res, "memberOf",
655	ADS_EXTENDED_DN_HEX_STRING,
656	&group_sids);
657	if (count == 0) {
658	DEBUG(1,("No memberOf for this user?!?\n"));
659	status = NT_STATUS_NO_MEMORY;
660	goto done;
661	}
662
663	for (i=0; i<count; i++) {
664
665	/* ignore Builtin groups from ADS - Guenther */
666	if (sid_check_is_in_builtin(&group_sids[i])) {
667	continue;
668	}
669
670	if (!add_sid_to_array(mem_ctx, &group_sids[i], user_sids,
671	&num_groups)) {
672	status = NT_STATUS_NO_MEMORY;
673	goto done;
674	}
675
676	}
677
678	*p_num_groups = num_groups;
679	status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
680
681	DEBUG(3,("ads lookup_usergroups (memberof) succeeded for dn=%s\n", user_dn));
682	done:
683	TALLOC_FREE(group_sids);
684	if (res)
685	ads_msgfree(ads, res);
686
687	return status;
688	}
689
690
691	/* Lookup groups a user is a member of. */
692	static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
693	TALLOC_CTX *mem_ctx,
694	const DOM_SID *sid,
695	uint32 p_num_groups, DOM_SID *user_sids)
696	{
697	ADS_STRUCT *ads = NULL;
698	const char *attrs[] = {"tokenGroups", "primaryGroupID", NULL};
699	ADS_STATUS rc;
700	int count;
701	LDAPMessage *msg = NULL;
702	char *user_dn = NULL;
703	DOM_SID *sids;
704	int i;
705	DOM_SID primary_group;
706	uint32 primary_group_rid;
707	fstring sid_string;
708	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
709	size_t num_groups = 0;
710
711	DEBUG(3,("ads: lookup_usergroups\n"));
712	*p_num_groups = 0;
713
714	status = lookup_usergroups_cached(domain, mem_ctx, sid,
715	p_num_groups, user_sids);
716	if (NT_STATUS_IS_OK(status)) {
717	return NT_STATUS_OK;
718	}
719
720	ads = ads_cached_connection(domain);
721
722	if (!ads) {
723	domain->last_status = NT_STATUS_SERVER_DISABLED;
724	status = NT_STATUS_SERVER_DISABLED;
725	goto done;
726	}
727
728	rc = ads_search_retry_sid(ads, &msg, sid, attrs);
729
730	if (!ADS_ERR_OK(rc)) {
731	status = ads_ntstatus(rc);
732	DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n",
733	sid_to_string(sid_string, sid), ads_errstr(rc)));
734	goto done;
735	}
736
737	count = ads_count_replies(ads, msg);
738	if (count != 1) {
739	status = NT_STATUS_UNSUCCESSFUL;
740	DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
741	"invalid number of results (count=%d)\n",
742	sid_to_string(sid_string, sid), count));
743	goto done;
744	}
745
746	if (!msg) {
747	DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
748	sid_to_string(sid_string, sid)));
749	status = NT_STATUS_UNSUCCESSFUL;
750	goto done;
751	}
752
753	user_dn = ads_get_dn(ads, msg);
754	if (user_dn == NULL) {
755	status = NT_STATUS_NO_MEMORY;
756	goto done;
757	}
758
759	if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
760	DEBUG(1,("%s: No primary group for sid=%s !?\n",
761	domain->name, sid_to_string(sid_string, sid)));
762	goto done;
763	}
764
765	sid_copy(&primary_group, &domain->sid);
766	sid_append_rid(&primary_group, primary_group_rid);
767
768	count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
769
770	/* there must always be at least one group in the token,
771	unless we are talking to a buggy Win2k server */
772
773	/* actually this only happens when the machine account has no read
774	* permissions on the tokenGroup attribute - gd */
775
776	if (count == 0) {
777
778	/* no tokenGroups */
779
780	/* lookup what groups this user is a member of by DN search on
781	* "memberOf" */
782
783	status = lookup_usergroups_memberof(domain, mem_ctx, user_dn,
784	&primary_group,
785	&num_groups, user_sids);
786	*p_num_groups = (uint32)num_groups;
787	if (NT_STATUS_IS_OK(status)) {
788	goto done;
789	}
790
791	/* lookup what groups this user is a member of by DN search on
792	* "member" */
793
794	status = lookup_usergroups_member(domain, mem_ctx, user_dn,
795	&primary_group,
796	&num_groups, user_sids);
797	*p_num_groups = (uint32)num_groups;
798	goto done;
799	}
800
801	*user_sids = NULL;
802	num_groups = 0;
803
804	if (!add_sid_to_array(mem_ctx, &primary_group, user_sids, &num_groups)) {
805	status = NT_STATUS_NO_MEMORY;
806	goto done;
807	}
808
809	for (i=0;i<count;i++) {
810
811	/* ignore Builtin groups from ADS - Guenther */
812	if (sid_check_is_in_builtin(&sids[i])) {
813	continue;
814	}
815
816	if (!add_sid_to_array_unique(mem_ctx, &sids[i],
817	user_sids, &num_groups)) {
818	status = NT_STATUS_NO_MEMORY;
819	goto done;
820	}
821	}
822
823	*p_num_groups = (uint32)num_groups;
824	status = (*user_sids != NULL) ? NT_STATUS_OK : NT_STATUS_NO_MEMORY;
825
826	DEBUG(3,("ads lookup_usergroups (tokenGroups) succeeded for sid=%s\n",
827	sid_to_string(sid_string, sid)));
828	done:
829	ads_memfree(ads, user_dn);
830	ads_msgfree(ads, msg);
831	return status;
832	}
833
834	/*
835	find the members of a group, given a group rid and domain
836	*/
837	static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
838	TALLOC_CTX *mem_ctx,
839	const DOM_SID group_sid, uint32 num_names,
840	DOM_SID sid_mem, char *names,
841	uint32 **name_types)
842	{
843	ADS_STATUS rc;
844	int count;
845	LDAPMessage *res=NULL;
846	ADS_STRUCT *ads = NULL;
847	char *ldap_exp;
848	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
849	char *sidstr;
850	char **members;
851	int i;
852	size_t num_members;
853	fstring sid_string;
854	BOOL more_values;
855	const char **attrs;
856	uint32 first_usn;
857	uint32 current_usn;
858	int num_retries = 0;
859
860	DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
861	sid_string_static(group_sid)));
862
863	*num_names = 0;
864
865	ads = ads_cached_connection(domain);
866
867	if (!ads) {
868	domain->last_status = NT_STATUS_SERVER_DISABLED;
869	goto done;
870	}
871
872	if ((sidstr = sid_binstring(group_sid)) == NULL) {
873	status = NT_STATUS_NO_MEMORY;
874	goto done;
875	}
876
877	/* search for all members of the group */
878	if (!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)",sidstr))) {
879	SAFE_FREE(sidstr);
880	DEBUG(1, ("ads: lookup_groupmem: tallloc_asprintf for ldap_exp failed!\n"));
881	status = NT_STATUS_NO_MEMORY;
882	goto done;
883	}
884	SAFE_FREE(sidstr);
885
886	members = NULL;
887	num_members = 0;
888
889	if ((attrs = TALLOC_ARRAY(mem_ctx, const char *, 3)) == NULL) {
890	status = NT_STATUS_NO_MEMORY;
891	goto done;
892	}
893
894	attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
895	attrs[2] = NULL;
896
897	do {
898	if (num_members == 0)
899	attrs[0] = talloc_strdup(mem_ctx, "member");
900
901	DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
902
903	rc = ads_search_retry(ads, &res, ldap_exp, attrs);
904
905	if (!ADS_ERR_OK(rc) \|\| !res) {
906	DEBUG(1,("ads: lookup_groupmem ads_search: %s\n",
907	ads_errstr(rc)));
908	status = ads_ntstatus(rc);
909	goto done;
910	}
911
912	count = ads_count_replies(ads, res);
913	if (count == 0)
914	break;
915
916	if (num_members == 0) {
917	if (!ads_pull_uint32(ads, res, "usnChanged", &first_usn)) {
918	DEBUG(1, ("ads: lookup_groupmem could not pull usnChanged!\n"));
919	goto done;
920	}
921	}
922
923	if (!ads_pull_uint32(ads, res, "usnChanged", &current_usn)) {
924	DEBUG(1, ("ads: lookup_groupmem could not pull usnChanged!\n"));
925	goto done;
926	}
927
928	if (first_usn != current_usn) {
929	DEBUG(5, ("ads: lookup_groupmem USN on this record changed"
930	" - restarting search\n"));
931	if (num_retries < 5) {
932	num_retries++;
933	num_members = 0;
934	continue;
935	} else {
936	DEBUG(5, ("ads: lookup_groupmem USN on this record changed"
937	" - restarted search too many times, aborting!\n"));
938	status = NT_STATUS_UNSUCCESSFUL;
939	goto done;
940	}
941	}
942
943	members = ads_pull_strings_range(ads, mem_ctx, res,
944	"member",
945	members,
946	&attrs[0],
947	&num_members,
948	&more_values);
949
950	if ((members == NULL) \|\| (num_members == 0))
951	break;
952
953	} while (more_values);
954
955	/* now we need to turn a list of members into rids, names and name types
956	the problem is that the members are in the form of distinguised names
957	*/
958
959	(*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID, num_members);
960	(*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
961	(names) = TALLOC_ZERO_ARRAY(mem_ctx, char , num_members);
962
963	if ((num_members != 0) &&
964	((members == NULL) \|\| (*sid_mem == NULL) \|\|
965	(name_types == NULL) \|\| (names == NULL))) {
966	DEBUG(1, ("talloc failed\n"));
967	status = NT_STATUS_NO_MEMORY;
968	goto done;
969	}
970
971	for (i=0;i<num_members;i++) {
972	uint32 name_type;
973	char *name;
974	DOM_SID sid;
975
976	if (dn_lookup(ads, mem_ctx, members[i], &name, &name_type, &sid)) {
977	(names)[num_names] = name;
978	(name_types)[num_names] = name_type;
979	sid_copy(&(sid_mem)[num_names], &sid);
980	(*num_names)++;
981	}
982	}
983
984	status = NT_STATUS_OK;
985	DEBUG(3,("ads lookup_groupmem for sid=%s\n", sid_to_string(sid_string, group_sid)));
986	done:
987
988	if (res)
989	ads_msgfree(ads, res);
990
991	return status;
992	}
993
994	/* find the sequence number for a domain */
995	static NTSTATUS sequence_number(struct winbindd_domain domain, uint32 seq)
996	{
997	ADS_STRUCT *ads = NULL;
998	ADS_STATUS rc;
999
1000	DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
1001
1002	*seq = DOM_SEQUENCE_NONE;
1003
1004	ads = ads_cached_connection(domain);
1005
1006	if (!ads) {
1007	domain->last_status = NT_STATUS_SERVER_DISABLED;
1008	return NT_STATUS_UNSUCCESSFUL;
1009	}
1010
1011	rc = ads_USN(ads, seq);
1012
1013	if (!ADS_ERR_OK(rc)) {
1014
1015	/* its a dead connection, destroy it */
1016
1017	if (domain->private_data) {
1018	ads = (ADS_STRUCT *)domain->private_data;
1019	ads->is_mine = True;
1020	ads_destroy(&ads);
1021	ads_kdestroy("MEMORY:winbind_ccache");
1022	domain->private_data = NULL;
1023	}
1024	}
1025	return ads_ntstatus(rc);
1026	}
1027
1028	/* get a list of trusted domains */
1029	static NTSTATUS trusted_domains(struct winbindd_domain *domain,
1030	TALLOC_CTX *mem_ctx,
1031	uint32 *num_domains,
1032	char ***names,
1033	char ***alt_names,
1034	DOM_SID **dom_sids)
1035	{
1036	NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
1037	struct ds_domain_trust *domains = NULL;
1038	int count = 0;
1039	int i;
1040	uint32 flags = DS_DOMAIN_IN_FOREST \| DS_DOMAIN_DIRECT_OUTBOUND;
1041	struct rpc_pipe_client *cli;
1042
1043	DEBUG(3,("ads: trusted_domains\n"));
1044
1045	*num_domains = 0;
1046	*alt_names = NULL;
1047	*names = NULL;
1048	*dom_sids = NULL;
1049
1050	result = cm_connect_netlogon(domain, &cli);
1051
1052	if (!NT_STATUS_IS_OK(result)) {
1053	DEBUG(5, ("trusted_domains: Could not open a connection to %s "
1054	"for PIPE_NETLOGON (%s)\n",
1055	domain->name, nt_errstr(result)));
1056	return NT_STATUS_UNSUCCESSFUL;
1057	}
1058
1059	if ( NT_STATUS_IS_OK(result) ) {
1060	result = rpccli_ds_enum_domain_trusts(cli, mem_ctx,
1061	cli->cli->desthost,
1062	flags, &domains,
1063	(unsigned int *)&count);
1064	}
1065
1066	if ( NT_STATUS_IS_OK(result) && count) {
1067
1068	/* Allocate memory for trusted domain names and sids */
1069
1070	if ( !(names = TALLOC_ARRAY(mem_ctx, char , count)) ) {