mirror of
https://github.com/samba-team/samba.git
synced 2024-12-22 13:34:15 +03:00
idmap: Handle uid->SID mapping
This commit is contained in:
parent
ed8178b110
commit
6ac6de8476
1
.gitignore
vendored
1
.gitignore
vendored
@ -129,6 +129,7 @@ source/utils/net/net_proto.h
|
||||
source/web_server/proto.h
|
||||
source/winbind/wb_helper.h
|
||||
source/winbind/wb_proto.h
|
||||
source/winbind/idmap_proto.h
|
||||
source/wrepl_server/wrepl_server_proto.h
|
||||
tags
|
||||
source/auth/credentials/credentials_krb5_proto.h
|
||||
|
@ -389,6 +389,7 @@ function provision_default_paths(subobj)
|
||||
paths.smbconf = lp.filename()
|
||||
paths.shareconf = lp.get("private dir") + "/" + "share.ldb";
|
||||
paths.samdb = lp.get("sam database");
|
||||
paths.idmapdb = lp.get("idmap database");
|
||||
paths.secrets = lp.get("secrets database");
|
||||
paths.templates = lp.get("private dir") + "/" + "templates.ldb";
|
||||
paths.keytab = "secrets.keytab";
|
||||
@ -679,6 +680,9 @@ function provision(subobj, message, blank, paths, session_info, credentials, lda
|
||||
message("Setting up templates into " + paths.templates + "\n");
|
||||
setup_ldb("provision_templates.ldif", info, paths.templates);
|
||||
|
||||
message("Setting up " + paths.idmapdb +"\n");
|
||||
setup_ldb("idmap_init.ldif", info, paths.idmapdb);
|
||||
|
||||
message("Setting up sam.ldb partitions\n");
|
||||
/* Also wipes the database */
|
||||
setup_ldb("provision_partitions.ldif", info, paths.samdb);
|
||||
|
@ -59,6 +59,7 @@ class ProvisionPaths:
|
||||
self.hkpd = None
|
||||
self.hkpt = None
|
||||
self.samdb = None
|
||||
self.idmapdb = None
|
||||
self.secrets = None
|
||||
self.keytab = None
|
||||
self.dns_keytab = None
|
||||
@ -202,6 +203,7 @@ def provision_paths_from_lp(lp, dnsdomain):
|
||||
|
||||
paths.shareconf = os.path.join(private_dir, "share.ldb")
|
||||
paths.samdb = os.path.join(private_dir, lp.get("sam database") or "samdb.ldb")
|
||||
paths.idmapdb = os.path.join(private_dir, lp.get("idmap database") or "idmap.ldb")
|
||||
paths.secrets = os.path.join(private_dir, lp.get("secrets database") or "secrets.ldb")
|
||||
paths.templates = os.path.join(private_dir, "templates.ldb")
|
||||
paths.dns = os.path.join(private_dir, dnsdomain + ".zone")
|
||||
@ -471,6 +473,24 @@ def setup_registry(path, setup_path, session_info, credentials, lp):
|
||||
assert os.path.exists(provision_reg)
|
||||
reg.diff_apply(provision_reg)
|
||||
|
||||
def setup_idmapdb(path, setup_path, session_info, credentials, lp):
|
||||
"""Setup the idmap database.
|
||||
|
||||
:param path: path to the idmap database
|
||||
:param setup_path: Function that returns a path to a setup file
|
||||
:param session_info: Session information
|
||||
:param credentials: Credentials
|
||||
:param lp: Loadparm context
|
||||
"""
|
||||
if os.path.exists(path):
|
||||
os.unlink(path)
|
||||
|
||||
idmap_ldb = Ldb(path, session_info=session_info, credentials=credentials,
|
||||
lp=lp)
|
||||
|
||||
idmap_ldb.erase()
|
||||
idmap_ldb.load_ldif_file_add(setup_path("idmap_init.ldif"))
|
||||
return idmap_ldb
|
||||
|
||||
def setup_samdb_rootdse(samdb, setup_path, schemadn, domaindn, hostname,
|
||||
dnsdomain, realm, rootdn, configdn, netbiosname,
|
||||
@ -844,6 +864,10 @@ def provision(lp, setup_dir, message, paths, session_info,
|
||||
setup_templatesdb(paths.templates, setup_path, session_info=session_info,
|
||||
credentials=credentials, lp=lp)
|
||||
|
||||
message("Setting up idmap db")
|
||||
setup_idmapdb(paths.idmapdb, setup_path, session_info=session_info,
|
||||
credentials=credentials, lp=lp)
|
||||
|
||||
samdb = setup_samdb(paths.samdb, setup_path, session_info=session_info,
|
||||
credentials=credentials, lp=lp, schemadn=schemadn,
|
||||
configdn=configdn, domaindn=domaindn,
|
||||
|
5
source/setup/idmap_init.ldif
Normal file
5
source/setup/idmap_init.ldif
Normal file
@ -0,0 +1,5 @@
|
||||
dn: CN=CONFIG
|
||||
cn: CONFIG
|
||||
lowerBound: 10000
|
||||
upperBound: 20000
|
||||
|
@ -37,6 +37,7 @@ OBJ_FILES = \
|
||||
wb_sam_logon.o
|
||||
PRIVATE_DEPENDENCIES = \
|
||||
WB_HELPER \
|
||||
IDMAP \
|
||||
NDR_WINBIND \
|
||||
process_model \
|
||||
RPC_NDR_LSA \
|
||||
@ -56,3 +57,13 @@ OBJ_FILES = \
|
||||
PUBLIC_DEPENDENCIES = RPC_NDR_LSA dcerpc_samr
|
||||
# End SUBSYSTEM WB_HELPER
|
||||
################################################
|
||||
|
||||
################################################
|
||||
# Start SUBYSTEM IDMAP
|
||||
[SUBSYSTEM::IDMAP]
|
||||
PRIVATE_PROTO_HEADER = idmap_proto.h
|
||||
OBJ_FILES = \
|
||||
idmap.o
|
||||
PUBLIC_DEPENDENCIES = SAMDB_COMMON
|
||||
# End SUBSYSTEM IDMAP
|
||||
################################################
|
||||
|
415
source/winbind/idmap.c
Normal file
415
source/winbind/idmap.c
Normal file
@ -0,0 +1,415 @@
|
||||
/*
|
||||
Unix SMB/CIFS implementation.
|
||||
|
||||
Map SIDs to uids/gids and back
|
||||
|
||||
Copyright (C) Kai Blin 2008
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#include "includes.h"
|
||||
#include "auth/auth.h"
|
||||
#include "librpc/gen_ndr/lsa.h"
|
||||
#include "librpc/gen_ndr/samr.h"
|
||||
#include "librpc/gen_ndr/ndr_security.h"
|
||||
#include "lib/ldb/include/ldb.h"
|
||||
#include "lib/ldb/include/ldb_errors.h"
|
||||
#include "lib/ldb_wrap.h"
|
||||
#include "param/param.h"
|
||||
#include "winbind/idmap.h"
|
||||
#include "libcli/security/proto.h"
|
||||
#include "libcli/ldap/ldap_ndr.h"
|
||||
|
||||
/**
|
||||
* Get uid/gid bounds from idmap database
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param low lower uid/gid bound is stored here
|
||||
* \param high upper uid/gid bound is stored here
|
||||
* \return 0 on success, nonzero on failure
|
||||
*/
|
||||
static int idmap_get_bounds(struct idmap_context *idmap_ctx, uint32_t *low,
|
||||
uint32_t *high)
|
||||
{
|
||||
int ret = -1;
|
||||
struct ldb_context *ldb = idmap_ctx->ldb_ctx;
|
||||
struct ldb_dn *dn;
|
||||
struct ldb_result *res = NULL;
|
||||
TALLOC_CTX *tmp_ctx = talloc_new(idmap_ctx);
|
||||
uint32_t lower_bound = (uint32_t) -1;
|
||||
uint32_t upper_bound = (uint32_t) -1;
|
||||
|
||||
dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
|
||||
if (dn == NULL) goto failed;
|
||||
|
||||
ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
|
||||
if (ret != LDB_SUCCESS) goto failed;
|
||||
|
||||
talloc_steal(tmp_ctx, res);
|
||||
|
||||
if (res->count != 1) {
|
||||
ret = -1;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
lower_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "lowerBound", -1);
|
||||
if (lower_bound != (uint32_t) -1) {
|
||||
ret = LDB_SUCCESS;
|
||||
} else {
|
||||
ret = -1;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
upper_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "upperBound", -1);
|
||||
if (upper_bound != (uint32_t) -1) {
|
||||
ret = LDB_SUCCESS;
|
||||
} else {
|
||||
ret = -1;
|
||||
}
|
||||
|
||||
failed:
|
||||
talloc_free(tmp_ctx);
|
||||
*low = lower_bound;
|
||||
*high = upper_bound;
|
||||
return ret;
|
||||
}
|
||||
|
||||
/**
|
||||
* Add a dom_sid structure to a ldb_message
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context to use
|
||||
* \param ldb_message ldb message to add dom_sid to
|
||||
* \param attr_name name of the attribute to store the dom_sid in
|
||||
* \param sid dom_sid to store
|
||||
* \return 0 on success, an ldb error code on failure.
|
||||
*/
|
||||
static int idmap_msg_add_dom_sid(struct idmap_context *idmap_ctx,
|
||||
TALLOC_CTX *mem_ctx, struct ldb_message *msg,
|
||||
const char *attr_name, const struct dom_sid *sid)
|
||||
{
|
||||
struct ldb_val val;
|
||||
enum ndr_err_code ndr_err;
|
||||
|
||||
ndr_err = ndr_push_struct_blob(&val, mem_ctx,
|
||||
lp_iconv_convenience(idmap_ctx->lp_ctx),
|
||||
sid,
|
||||
(ndr_push_flags_fn_t)ndr_push_dom_sid);
|
||||
|
||||
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
||||
return -1;
|
||||
}
|
||||
|
||||
return ldb_msg_add_value(msg, attr_name, &val, NULL);
|
||||
}
|
||||
|
||||
/**
|
||||
* Get a dom_sid structure from a ldb message.
|
||||
*
|
||||
* \param mem_ctx talloc context to allocate dom_sid memory in
|
||||
* \param msg ldb_message to get dom_sid from
|
||||
* \param attr_name key that has the dom_sid as data
|
||||
* \return dom_sid structure on success, NULL on failure
|
||||
*/
|
||||
static struct dom_sid *idmap_msg_get_dom_sid(TALLOC_CTX *mem_ctx,
|
||||
struct ldb_message *msg, const char *attr_name)
|
||||
{
|
||||
struct dom_sid *sid;
|
||||
const struct ldb_val *val;
|
||||
enum ndr_err_code ndr_err;
|
||||
|
||||
val = ldb_msg_find_ldb_val(msg, attr_name);
|
||||
if (val == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
sid = talloc(mem_ctx, struct dom_sid);
|
||||
if (sid == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
ndr_err = ndr_pull_struct_blob(val, sid, NULL, sid,
|
||||
(ndr_pull_flags_fn_t)ndr_pull_dom_sid);
|
||||
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
|
||||
talloc_free(sid);
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return sid;
|
||||
}
|
||||
|
||||
/**
|
||||
* Initialize idmap context
|
||||
*
|
||||
* talloc_free to close.
|
||||
*
|
||||
* \param mem_ctx talloc context to use.
|
||||
* \return allocated idmap_context on success, NULL on error
|
||||
*/
|
||||
struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
|
||||
struct loadparm_context *lp_ctx)
|
||||
{
|
||||
struct idmap_context *idmap_ctx;
|
||||
|
||||
idmap_ctx = talloc(mem_ctx, struct idmap_context);
|
||||
if (idmap_ctx == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
idmap_ctx->lp_ctx = lp_ctx;
|
||||
|
||||
idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, lp_ctx,
|
||||
lp_idmap_url(lp_ctx),
|
||||
system_session(mem_ctx, lp_ctx),
|
||||
NULL, 0, NULL);
|
||||
if (idmap_ctx->ldb_ctx == NULL) {
|
||||
return NULL;
|
||||
}
|
||||
|
||||
return idmap_ctx;
|
||||
}
|
||||
|
||||
/**
|
||||
* Convert a uid to the corresponding SID
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context the memory for the struct dom_sid is allocated
|
||||
* from.
|
||||
* \param uid Unix uid to map to a SID
|
||||
* \param sid Pointer that will take the struct dom_sid pointer if the mapping
|
||||
* succeeds.
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
|
||||
* possible or some other NTSTATUS that is more descriptive on failure.
|
||||
*/
|
||||
|
||||
NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const uid_t uid, struct dom_sid **sid)
|
||||
{
|
||||
int ret;
|
||||
NTSTATUS status = NT_STATUS_NONE_MAPPED;
|
||||
struct ldb_context *ldb = idmap_ctx->ldb_ctx;
|
||||
struct ldb_message *msg;
|
||||
struct ldb_result *res = NULL;
|
||||
int trans = -1;
|
||||
uid_t low, high;
|
||||
char *sid_string, *uid_string;
|
||||
struct dom_sid *unix_users_sid, *new_sid;
|
||||
TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
|
||||
|
||||
ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
|
||||
NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
|
||||
uid);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (res->count == 1) {
|
||||
*sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
|
||||
"objectSid");
|
||||
if (*sid == NULL) {
|
||||
DEBUG(1, ("Failed to get sid from db: %u\n", ret));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
}
|
||||
|
||||
DEBUG(6, ("uid not found in idmap db, trying to allocate SID.\n"));
|
||||
|
||||
trans = ldb_transaction_start(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* Now redo the search to make sure noone added a mapping for that SID
|
||||
* while we weren't looking.*/
|
||||
ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
|
||||
NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
|
||||
uid);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (res->count > 0) {
|
||||
DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
|
||||
status = NT_STATUS_RETRY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = idmap_get_bounds(idmap_ctx, &low, &high);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
if (uid >= low && uid <= high) {
|
||||
/* An existing user would have been mapped before */
|
||||
status = NT_STATUS_NO_SUCH_USER;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
/* For local users, we just create a rid = uid +1, so root doesn't end
|
||||
* up with a 0 rid */
|
||||
unix_users_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
|
||||
if (unix_users_sid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
new_sid = dom_sid_add_rid(mem_ctx, unix_users_sid, uid + 1);
|
||||
if (new_sid == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
sid_string = dom_sid_string(tmp_ctx, new_sid);
|
||||
if (sid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
uid_string = talloc_asprintf(tmp_ctx, "%u", uid);
|
||||
if (uid_string == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
msg = ldb_msg_new(tmp_ctx);
|
||||
if (msg == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
|
||||
if (msg->dn == NULL) {
|
||||
status = NT_STATUS_NO_MEMORY;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "uidNumber", uid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
|
||||
new_sid);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_msg_add_string(msg, "cn", sid_string);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
ret = ldb_add(ldb, msg);
|
||||
if (ret != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
trans = ldb_transaction_commit(ldb);
|
||||
if (trans != LDB_SUCCESS) {
|
||||
status = NT_STATUS_NONE_MAPPED;
|
||||
goto failed;
|
||||
}
|
||||
|
||||
*sid = new_sid;
|
||||
talloc_free(tmp_ctx);
|
||||
return NT_STATUS_OK;
|
||||
|
||||
failed:
|
||||
if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
|
||||
talloc_free(tmp_ctx);
|
||||
return status;
|
||||
}
|
||||
|
||||
/**
|
||||
* Map a Unix gid to the corresponding SID
|
||||
*
|
||||
* \todo Create a SID from the S-1-22-2 range for unmapped groups
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context the memory for the struct dom_sid is allocated
|
||||
* from.
|
||||
* \param gid Unix gid to map to a SID
|
||||
* \param sid Pointer that will take the struct dom_sid pointer if mapping
|
||||
* succeeds.
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
|
||||
* possible or some other NTSTATUS that is more descriptive on failure.
|
||||
*/
|
||||
NTSTATUS idmap_gid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const gid_t gid, struct dom_sid **sid)
|
||||
{
|
||||
return NT_STATUS_NONE_MAPPED;
|
||||
}
|
||||
|
||||
/**
|
||||
* Map a SID to a Unix uid.
|
||||
*
|
||||
* If no mapping exists, a new mapping will be created.
|
||||
*
|
||||
* \todo Create mappings for users not from our primary domain.
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context to use
|
||||
* \param sid SID to map to a Unix uid
|
||||
* \param uid pointer to receive the mapped uid
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
|
||||
* a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
|
||||
* mapping failed.
|
||||
*/
|
||||
NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *sid, uid_t *uid)
|
||||
{
|
||||
return NT_STATUS_NONE_MAPPED;
|
||||
}
|
||||
|
||||
/**
|
||||
* Map a SID to a Unix gid.
|
||||
*
|
||||
* If no mapping exist, a new mapping will be created.
|
||||
*
|
||||
* \todo Create mappings for groups not from our primary domain.
|
||||
*
|
||||
* \param idmap_ctx idmap context to use
|
||||
* \param mem_ctx talloc context to use
|
||||
* \param sid SID to map to a Unix gid
|
||||
* \param gid pointer to receive the mapped gid
|
||||
* \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
|
||||
* a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
|
||||
* mapping failed.
|
||||
*/
|
||||
NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
|
||||
const struct dom_sid *sid, gid_t *gid)
|
||||
{
|
||||
return NT_STATUS_NONE_MAPPED;
|
||||
}
|
||||
|
33
source/winbind/idmap.h
Normal file
33
source/winbind/idmap.h
Normal file
@ -0,0 +1,33 @@
|
||||
/*
|
||||
Unix SMB/CIFS implementation.
|
||||
|
||||
Map SIDs to uids/gids and back
|
||||
|
||||
Copyright (C) Kai Blin 2008
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
the Free Software Foundation; either version 3 of the License, or
|
||||
(at your option) any later version.
|
||||
|
||||
This program is distributed in the hope that it will be useful,
|
||||
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
GNU General Public License for more details.
|
||||
|
||||
You should have received a copy of the GNU General Public License
|
||||
along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifndef _IDMAP_H_
|
||||
#define _IDMAP_H_
|
||||
|
||||
struct idmap_context {
|
||||
struct loadparm_context *lp_ctx;
|
||||
struct ldb_context *ldb_ctx;
|
||||
};
|
||||
|
||||
#include "winbind/idmap_proto.h"
|
||||
|
||||
#endif
|
||||
|
@ -149,6 +149,12 @@ static void winbind_task_init(struct task_server *task)
|
||||
return;
|
||||
}
|
||||
|
||||
service->idmap_ctx = idmap_init(service, task->lp_ctx);
|
||||
if (service->idmap_ctx == NULL) {
|
||||
task_server_terminate(task, "Failed to load idmap database");
|
||||
return;
|
||||
}
|
||||
|
||||
/* setup the unprivileged samba3 socket */
|
||||
listen_socket = talloc(service, struct wbsrv_listen_socket);
|
||||
if (!listen_socket) goto nomem;
|
||||
|
@ -21,6 +21,7 @@
|
||||
|
||||
#include "nsswitch/winbind_nss_config.h"
|
||||
#include "nsswitch/winbind_struct_protocol.h"
|
||||
#include "winbind/idmap.h"
|
||||
#include "libnet/libnet.h"
|
||||
|
||||
#define WINBINDD_SAMBA3_SOCKET "pipe"
|
||||
@ -33,6 +34,7 @@ struct wbsrv_service {
|
||||
|
||||
const struct dom_sid *primary_sid;
|
||||
struct wbsrv_domain *domains;
|
||||
struct idmap_context *idmap_ctx;
|
||||
};
|
||||
|
||||
struct wbsrv_samconn {
|
||||
|
@ -3,7 +3,7 @@
|
||||
|
||||
Command backend for wbinfo -U
|
||||
|
||||
Copyright (C) Kai Blin 2007
|
||||
Copyright (C) Kai Blin 2007-2008
|
||||
|
||||
This program is free software; you can redistribute it and/or modify
|
||||
it under the terms of the GNU General Public License as published by
|
||||
@ -25,6 +25,7 @@
|
||||
#include "smbd/service_task.h"
|
||||
#include "winbind/wb_helper.h"
|
||||
#include "libcli/security/proto.h"
|
||||
#include "winbind/idmap.h"
|
||||
|
||||
struct uid2sid_state {
|
||||
struct composite_context *ctx;
|
||||
@ -50,10 +51,14 @@ struct composite_context *wb_uid2sid_send(TALLOC_CTX *mem_ctx,
|
||||
result->private_data = state;
|
||||
state->service = service;
|
||||
|
||||
/* FIXME: This is a stub so far.
|
||||
* We cheat by just using the uid as RID with the domain SID.*/
|
||||
state->sid = dom_sid_add_rid(result, service->primary_sid, uid);
|
||||
if (composite_nomem(state->sid, state->ctx)) return result;
|
||||
state->ctx->status = idmap_uid_to_sid(service->idmap_ctx, mem_ctx, uid,
|
||||
&state->sid);
|
||||
if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
|
||||
state->ctx->status = idmap_uid_to_sid(service->idmap_ctx,
|
||||
mem_ctx, uid,
|
||||
&state->sid);
|
||||
}
|
||||
if (!composite_is_ok(state->ctx)) return result;
|
||||
|
||||
composite_done(state->ctx);
|
||||
return result;
|
||||
|
Loading…
Reference in New Issue
Block a user