summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGünther Deschner <gd@samba.org>2006-04-28 14:44:43 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 11:16:33 -0500
commit34e810076df8720a145f5a619ed648c384898563 (patch)
treeb8a248e9eb110109d009cf33088b0b5cdf5e60f6
parent2720db90c110908c3d077028b82c4a6a5f8c2c51 (diff)
downloadsamba-34e810076df8720a145f5a619ed648c384898563.tar.gz
samba-34e810076df8720a145f5a619ed648c384898563.tar.bz2
samba-34e810076df8720a145f5a619ed648c384898563.zip
r15305: Let winbind search by sid directly (or in windows terms: "bind to a
sid"); works in all AD versions I tested. Also add "net ads sid" search tool. Guenther (This used to be commit 5557ada6943b817d28a5471c613c7291febe2ad5)
-rw-r--r--source3/lib/util_sid.c18
-rw-r--r--source3/lib/util_str.c18
-rw-r--r--source3/libads/ads_ldap.c104
-rw-r--r--source3/libads/ldap_utils.c25
-rw-r--r--source3/nsswitch/winbindd_ads.c22
-rw-r--r--source3/utils/net_ads.c68
6 files changed, 144 insertions, 111 deletions
diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c
index 0710337637..307f3e3415 100644
--- a/source3/lib/util_sid.c
+++ b/source3/lib/util_sid.c
@@ -535,6 +535,24 @@ char *sid_binstring(const DOM_SID *sid)
if (!buf)
return NULL;
sid_linearize(buf, len, sid);
+ s = binary_string_rfc2254(buf, len);
+ free(buf);
+ return s;
+}
+
+/*****************************************************************
+ Return the binary string representation of a DOM_SID.
+ Caller must free.
+*****************************************************************/
+
+char *sid_binstring_hex(const DOM_SID *sid)
+{
+ char *buf, *s;
+ int len = sid_size(sid);
+ buf = SMB_MALLOC(len);
+ if (!buf)
+ return NULL;
+ sid_linearize(buf, len, sid);
s = binary_string(buf, len);
free(buf);
return s;
diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index 439cbea6d9..df84fa90a5 100644
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -1566,7 +1566,7 @@ void strupper_m(char *s)
Caller must free.
**/
-char *binary_string(char *buf, int len)
+char *binary_string_rfc2254(char *buf, int len)
{
char *s;
int i, j;
@@ -1584,6 +1584,22 @@ char *binary_string(char *buf, int len)
return s;
}
+char *binary_string(char *buf, int len)
+{
+ char *s;
+ int i, j;
+ const char *hex = "0123456789ABCDEF";
+ s = SMB_MALLOC(len * 2 + 1);
+ if (!s)
+ return NULL;
+ for (j=i=0;i<len;i++) {
+ s[j] = hex[((unsigned char)buf[i]) >> 4];
+ s[j+1] = hex[((unsigned char)buf[i]) & 0xF];
+ j += 2;
+ }
+ s[j] = 0;
+ return s;
+}
/**
Just a typesafety wrapper for snprintf into a pstring.
**/
diff --git a/source3/libads/ads_ldap.c b/source3/libads/ads_ldap.c
deleted file mode 100644
index 42821496c3..0000000000
--- a/source3/libads/ads_ldap.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/*
- Unix SMB/CIFS implementation.
-
- Winbind ADS backend functions
-
- Copyright (C) Andrew Tridgell 2001
- Copyright (C) Andrew Bartlett 2002
-
- This program is free software; you can redistribute it and/or modify
- it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
- (at your option) any later version.
-
- This program is distributed in the hope that it will be useful,
- but WITHOUT ANY WARRANTY; without even the implied warranty of
- MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
- GNU General Public License for more details.
-
- You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "includes.h"
-#ifdef HAVE_LDAP
-
-/* convert a sid to a DN */
-
-ADS_STATUS ads_sid_to_dn(ADS_STRUCT *ads,
- TALLOC_CTX *mem_ctx,
- const DOM_SID *sid,
- char **dn)
-{
- ADS_STATUS rc;
- LDAPMessage *msg = NULL;
- LDAPMessage *entry = NULL;
- char *ldap_exp;
- char *sidstr = NULL;
- int count;
- char *dn2 = NULL;
-
- const char *attr[] = {
- "dn",
- NULL
- };
-
- if (!(sidstr = sid_binstring(sid))) {
- DEBUG(1,("ads_sid_to_dn: sid_binstring failed!\n"));
- rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
- goto done;
- }
-
- if(!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr))) {
- DEBUG(1,("ads_sid_to_dn: talloc_asprintf failed!\n"));
- rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
- goto done;
- }
-
- rc = ads_search_retry(ads, (void **)(void *)&msg, ldap_exp, attr);
-
- if (!ADS_ERR_OK(rc)) {
- DEBUG(1,("ads_sid_to_dn ads_search: %s\n", ads_errstr(rc)));
- goto done;
- }
-
- if ((count = ads_count_replies(ads, msg)) != 1) {
- fstring sid_string;
- DEBUG(1,("ads_sid_to_dn (sid=%s): Not found (count=%d)\n",
- sid_to_string(sid_string, sid), count));
- rc = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
- goto done;
- }
-
- entry = ads_first_entry(ads, msg);
-
- dn2 = ads_get_dn(ads, entry);
-
- if (!dn2) {
- rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
- goto done;
- }
-
- *dn = talloc_strdup(mem_ctx, dn2);
-
- if (!*dn) {
- rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
- goto done;
- }
-
- rc = ADS_ERROR_NT(NT_STATUS_OK);
-
- DEBUG(3,("ads sid_to_dn mapped %s\n", dn2));
-
- SAFE_FREE(dn2);
-done:
- if (msg) ads_msgfree(ads, msg);
- if (dn2) ads_memfree(ads, dn2);
-
- SAFE_FREE(sidstr);
-
- return rc;
-}
-
-#endif
diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c
index 18caa2c63a..105fd2e5b9 100644
--- a/source3/libads/ldap_utils.c
+++ b/source3/libads/ldap_utils.c
@@ -105,4 +105,29 @@ ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, void **res,
return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
"(objectclass=*)", attrs, res);
}
+
+ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, void **res,
+ const DOM_SID *sid,
+ const char **attrs)
+{
+ char *dn, *sid_string;
+ ADS_STATUS status;
+
+ sid_string = sid_binstring_hex(sid);
+ if (sid_string == NULL) {
+ return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+ }
+
+ if (!asprintf(&dn, "<SID=%s>", sid_string)) {
+ SAFE_FREE(sid_string);
+ return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+ }
+
+ status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
+ "(objectclass=*)", attrs, res);
+ SAFE_FREE(dn);
+ SAFE_FREE(sid_string);
+ return status;
+}
+
#endif
diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c
index 5e0d4cfe8e..336f27e6a1 100644
--- a/source3/nsswitch/winbindd_ads.c
+++ b/source3/nsswitch/winbindd_ads.c
@@ -634,13 +634,8 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
goto done;
}
- rc = ads_sid_to_dn(ads, mem_ctx, sid, &user_dn);
- if (!ADS_ERR_OK(rc)) {
- status = ads_ntstatus(rc);
- goto done;
- }
+ rc = ads_search_retry_sid(ads, (void**)(void *)&msg, sid, attrs);
- rc = ads_search_retry_dn(ads, (void**)(void *)&msg, user_dn, attrs);
if (!ADS_ERR_OK(rc)) {
status = ads_ntstatus(rc);
DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n",
@@ -648,6 +643,15 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
goto done;
}
+ count = ads_count_replies(ads, msg);
+ if (count != 1) {
+ status = NT_STATUS_UNSUCCESSFUL;
+ DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
+ "invalid number of results (count=%d)\n",
+ sid_to_string(sid_string, sid), count));
+ goto done;
+ }
+
if (!msg) {
DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
sid_to_string(sid_string, sid)));
@@ -655,6 +659,12 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
goto done;
}
+ user_dn = ads_get_dn(ads, msg);
+ if (user_dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
DEBUG(1,("%s: No primary group for sid=%s !?\n",
domain->name, sid_to_string(sid_string, sid)));
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 538a269614..c7e9529c97 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -55,6 +55,8 @@ int net_ads_usage(int argc, const char **argv)
"\n\tperform a raw LDAP search and dump the results\n"
"\nnet ads dn"\
"\n\tperform a raw LDAP search and dump attributes of a particular DN\n"
+"\nnet ads sid"\
+"\n\tperform a raw LDAP search and dump attributes of a particular SID\n"
"\nnet ads keytab"\
"\n\tcreates and updates the kerberos system keytab file\n"
);
@@ -1387,6 +1389,71 @@ static int net_ads_dn(int argc, const char **argv)
return 0;
}
+/*
+ help for net ads sid search
+*/
+static int net_ads_sid_usage(int argc, const char **argv)
+{
+ d_printf(
+ "\nnet ads sid <sid> <attributes...>\n"\
+ "\nperform a raw LDAP search on a ADS server and dump the results\n"\
+ "The SID is in string format, and the attributes are a list of LDAP fields \n"\
+ "to show in the results\n\n"\
+ "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
+ );
+ net_common_flags_usage(argc, argv);
+ return -1;
+}
+
+
+/*
+ general ADS search function. Useful in diagnosing problems in ADS
+*/
+static int net_ads_sid(int argc, const char **argv)
+{
+ ADS_STRUCT *ads;
+ ADS_STATUS rc;
+ const char *sid_string;
+ const char **attrs;
+ void *res = NULL;
+ DOM_SID sid;
+
+ if (argc < 1) {
+ return net_ads_sid_usage(argc, argv);
+ }
+
+ if (!(ads = ads_startup())) {
+ return -1;
+ }
+
+ sid_string = argv[0];
+ attrs = (argv + 1);
+
+ if (!string_to_sid(&sid, sid_string)) {
+ d_fprintf(stderr, "could not convert sid\ņ");
+ ads_destroy(&ads);
+ return -1;
+ }
+
+ rc = ads_search_retry_sid(ads, &res, &sid, attrs);
+ if (!ADS_ERR_OK(rc)) {
+ d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
+ ads_destroy(&ads);
+ return -1;
+ }
+
+ d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
+
+ /* dump the results */
+ ads_dump(ads, res);
+
+ ads_msgfree(ads, res);
+ ads_destroy(&ads);
+
+ return 0;
+}
+
+
static int net_ads_keytab_usage(int argc, const char **argv)
{
d_printf(
@@ -1504,6 +1571,7 @@ int net_ads(int argc, const char **argv)
{"PRINTER", net_ads_printer},
{"SEARCH", net_ads_search},
{"DN", net_ads_dn},
+ {"SID", net_ads_sid},
{"WORKGROUP", net_ads_workgroup},
{"LOOKUP", net_ads_lookup},
{"KEYTAB", net_ads_keytab},