sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-11 05:18:09 +03:00
Code

r15305: Let winbind search by sid directly (or in windows terms: "bind to a

Browse Source 
sid"); works in all AD versions I tested. Also add "net ads sid" search
tool.

Guenther
This commit is contained in:
Günther Deschner 2006-04-28 14:44:43 +00:00 committed by Gerald (Jerry) Carter
parent 7ca24b9966
commit 5557ada694
6 changed files with 144 additions and 111 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
source/lib/util_sid.c
View File

@ -528,6 +528,24 @@ BOOL non_mappable_sid(DOM_SID *sid)
*****************************************************************/
char *sid_binstring(const DOM_SID *sid)
{
char *buf, *s;
int len = sid_size(sid);
buf = SMB_MALLOC(len);
if (!buf)
return NULL;
sid_linearize(buf, len, sid);
s = binary_string_rfc2254(buf, len);
free(buf);
return s;
}
/*****************************************************************
Return the binary string representation of a DOM_SID.
Caller must free.
*****************************************************************/
char *sid_binstring_hex(const DOM_SID *sid)
{
char *buf, *s;
int len = sid_size(sid);

18
source/lib/util_str.c
View File

@ -1566,7 +1566,7 @@ void strupper_m(char *s)
Caller must free.
**/
char *binary_string(char *buf, int len)
char *binary_string_rfc2254(char *buf, int len)
{
char *s;
int i, j;
@ -1584,6 +1584,22 @@ char *binary_string(char *buf, int len)
return s;
}
char *binary_string(char *buf, int len)
{
char *s;
int i, j;
const char *hex = "0123456789ABCDEF";
s = SMB_MALLOC(len * 2 + 1);
if (!s)
return NULL;
for (j=i=0;i<len;i++) {
s[j] = hex[((unsigned char)buf[i]) >> 4];
s[j+1] = hex[((unsigned char)buf[i]) & 0xF];
j += 2;
}
s[j] = 0;
return s;
}
/**
Just a typesafety wrapper for snprintf into a pstring.
**/

104
source/libads/ads_ldap.c
View File

@ -1,104 +0,0 @@
/*
Unix SMB/CIFS implementation.
Winbind ADS backend functions
Copyright (C) Andrew Tridgell 2001
Copyright (C) Andrew Bartlett 2002
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#ifdef HAVE_LDAP
/* convert a sid to a DN */
ADS_STATUS ads_sid_to_dn(ADS_STRUCT *ads,
TALLOC_CTX *mem_ctx,
const DOM_SID *sid,
char **dn)
{
ADS_STATUS rc;
LDAPMessage *msg = NULL;
LDAPMessage *entry = NULL;
char *ldap_exp;
char *sidstr = NULL;
int count;
char *dn2 = NULL;
const char *attr[] = {
"dn",
NULL
};
if (!(sidstr = sid_binstring(sid))) {
DEBUG(1,("ads_sid_to_dn: sid_binstring failed!\n"));
rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
goto done;
}
if(!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr))) {
DEBUG(1,("ads_sid_to_dn: talloc_asprintf failed!\n"));
rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
goto done;
}
rc = ads_search_retry(ads, (void **)(void *)&msg, ldap_exp, attr);
if (!ADS_ERR_OK(rc)) {
DEBUG(1,("ads_sid_to_dn ads_search: %s\n", ads_errstr(rc)));
goto done;
}
if ((count = ads_count_replies(ads, msg)) != 1) {
fstring sid_string;
DEBUG(1,("ads_sid_to_dn (sid=%s): Not found (count=%d)\n",
sid_to_string(sid_string, sid), count));
rc = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
goto done;
}
entry = ads_first_entry(ads, msg);
dn2 = ads_get_dn(ads, entry);
if (!dn2) {
rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
goto done;
}
*dn = talloc_strdup(mem_ctx, dn2);
if (!*dn) {
rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
goto done;
}
rc = ADS_ERROR_NT(NT_STATUS_OK);
DEBUG(3,("ads sid_to_dn mapped %s\n", dn2));
SAFE_FREE(dn2);
done:
if (msg) ads_msgfree(ads, msg);
if (dn2) ads_memfree(ads, dn2);
SAFE_FREE(sidstr);
return rc;
}
#endif

25
source/libads/ldap_utils.c
View File

@ -105,4 +105,29 @@ ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, void **res,
return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
"(objectclass=*)", attrs, res);
}
ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, void **res,
const DOM_SID *sid,
const char **attrs)
{
char *dn, *sid_string;
ADS_STATUS status;
sid_string = sid_binstring_hex(sid);
if (sid_string == NULL) {
return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
}
if (!asprintf(&dn, "<SID=%s>", sid_string)) {
SAFE_FREE(sid_string);
return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
}
status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
"(objectclass=*)", attrs, res);
SAFE_FREE(dn);
SAFE_FREE(sid_string);
return status;
}
#endif

22
source/nsswitch/winbindd_ads.c
View File

@ -634,13 +634,8 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
goto done;
}
rc = ads_sid_to_dn(ads, mem_ctx, sid, &user_dn);
if (!ADS_ERR_OK(rc)) {
status = ads_ntstatus(rc);
goto done;
}
rc = ads_search_retry_sid(ads, (void**)(void *)&msg, sid, attrs);
rc = ads_search_retry_dn(ads, (void**)(void *)&msg, user_dn, attrs);
if (!ADS_ERR_OK(rc)) {
status = ads_ntstatus(rc);
DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n",
@ -648,6 +643,15 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
goto done;
}
count = ads_count_replies(ads, msg);
if (count != 1) {
status = NT_STATUS_UNSUCCESSFUL;
DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
"invalid number of results (count=%d)\n",
sid_to_string(sid_string, sid), count));
goto done;
}
if (!msg) {
DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
sid_to_string(sid_string, sid)));
@ -655,6 +659,12 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
goto done;
}
user_dn = ads_get_dn(ads, msg);
if (user_dn == NULL) {
status = NT_STATUS_NO_MEMORY;
goto done;
}
if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
DEBUG(1,("%s: No primary group for sid=%s !?\n",
domain->name, sid_to_string(sid_string, sid)));

68
source/utils/net_ads.c
View File

@ -55,6 +55,8 @@ int net_ads_usage(int argc, const char **argv)
"\n\tperform a raw LDAP search and dump the results\n"
"\nnet ads dn"\
"\n\tperform a raw LDAP search and dump attributes of a particular DN\n"
"\nnet ads sid"\
"\n\tperform a raw LDAP search and dump attributes of a particular SID\n"
"\nnet ads keytab"\
"\n\tcreates and updates the kerberos system keytab file\n"
);
@ -1387,6 +1389,71 @@ static int net_ads_dn(int argc, const char **argv)
return 0;
}
/*
help for net ads sid search
*/
static int net_ads_sid_usage(int argc, const char **argv)
{
d_printf(
"\nnet ads sid <sid> <attributes...>\n"\
"\nperform a raw LDAP search on a ADS server and dump the results\n"\
"The SID is in string format, and the attributes are a list of LDAP fields \n"\
"to show in the results\n\n"\
"Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
);
net_common_flags_usage(argc, argv);
return -1;
}
/*
general ADS search function. Useful in diagnosing problems in ADS
*/
static int net_ads_sid(int argc, const char **argv)
{
ADS_STRUCT *ads;
ADS_STATUS rc;
const char *sid_string;
const char **attrs;
void *res = NULL;
DOM_SID sid;
if (argc < 1) {
return net_ads_sid_usage(argc, argv);
}
if (!(ads = ads_startup())) {
return -1;
}
sid_string = argv[0];
attrs = (argv + 1);
if (!string_to_sid(&sid, sid_string)) {
d_fprintf(stderr, "could not convert sid\ņ");
ads_destroy(&ads);
return -1;
}
rc = ads_search_retry_sid(ads, &res, &sid, attrs);
if (!ADS_ERR_OK(rc)) {
d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
ads_destroy(&ads);
return -1;
}
d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
/* dump the results */
ads_dump(ads, res);
ads_msgfree(ads, res);
ads_destroy(&ads);
return 0;
}
static int net_ads_keytab_usage(int argc, const char **argv)
{
d_printf(
@ -1504,6 +1571,7 @@ int net_ads(int argc, const char **argv)
{"PRINTER", net_ads_printer},
{"SEARCH", net_ads_search},
{"DN", net_ads_dn},
{"SID", net_ads_sid},
{"WORKGROUP", net_ads_workgroup},
{"LOOKUP", net_ads_lookup},
{"KEYTAB", net_ads_keytab},