r15305: Let winbind search by sid directly (or in windows terms: "bind to a

sid"); works in all AD versions I tested. Also add "net ads sid" search
tool.

Guenther
(This used to be commit 5557ada6943b817d28a5471c613c7291febe2ad5)

6 files changed, 144 insertions, 111 deletions

diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c
index 0710337637..307f3e3415 100644
--- a/source3/lib/util_sid.c
+++ b/source3/lib/util_sid.c
@@ -535,6 +535,24 @@ char *sid_binstring(const DOM_SID *sid)
 	if (!buf)
 		return NULL;
 	sid_linearize(buf, len, sid);
+	s = binary_string_rfc2254(buf, len);
+	free(buf);
+	return s;
+}
+
+/*****************************************************************
+ Return the binary string representation of a DOM_SID.
+ Caller must free.
+*****************************************************************/
+
+char *sid_binstring_hex(const DOM_SID *sid)
+{
+	char *buf, *s;
+	int len = sid_size(sid);
+	buf = SMB_MALLOC(len);
+	if (!buf)
+		return NULL;
+	sid_linearize(buf, len, sid);
 	s = binary_string(buf, len);
 	free(buf);
 	return s;
diff --git a/source3/lib/util_str.c b/source3/lib/util_str.c
index 439cbea6d9..df84fa90a5 100644
--- a/source3/lib/util_str.c
+++ b/source3/lib/util_str.c
@@ -1566,7 +1566,7 @@ void strupper_m(char *s)
  Caller must free.
 **/
 
-char *binary_string(char *buf, int len)
+char *binary_string_rfc2254(char *buf, int len)
 {
 	char *s;
 	int i, j;
@@ -1584,6 +1584,22 @@ char *binary_string(char *buf, int len)
 	return s;
 }
 
+char *binary_string(char *buf, int len)
+{
+	char *s;
+	int i, j;
+	const char *hex = "0123456789ABCDEF";
+	s = SMB_MALLOC(len * 2 + 1);
+	if (!s)
+		return NULL;
+	for (j=i=0;i<len;i++) {
+		s[j]   = hex[((unsigned char)buf[i]) >> 4];
+		s[j+1] = hex[((unsigned char)buf[i]) & 0xF];
+		j += 2;
+	}
+	s[j] = 0;
+	return s;
+}
 /**
  Just a typesafety wrapper for snprintf into a pstring.
 **/
diff --git a/source3/libads/ads_ldap.c b/source3/libads/ads_ldap.c
deleted file mode 100644
index 42821496c3..0000000000
--- a/source3/libads/ads_ldap.c
+++ /dev/null
@@ -1,104 +0,0 @@
-/* 
-   Unix SMB/CIFS implementation.
-
-   Winbind ADS backend functions
-
-   Copyright (C) Andrew Tridgell 2001
-   Copyright (C) Andrew Bartlett 2002
-   
-   This program is free software; you can redistribute it and/or modify
-   it under the terms of the GNU General Public License as published by
-   the Free Software Foundation; either version 2 of the License, or
-   (at your option) any later version.
-   
-   This program is distributed in the hope that it will be useful,
-   but WITHOUT ANY WARRANTY; without even the implied warranty of
-   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-   GNU General Public License for more details.
-   
-   You should have received a copy of the GNU General Public License
-   along with this program; if not, write to the Free Software
-   Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
-*/
-
-#include "includes.h"
-#ifdef HAVE_LDAP
-
-/* convert a sid to a DN */
-
-ADS_STATUS ads_sid_to_dn(ADS_STRUCT *ads,
-			 TALLOC_CTX *mem_ctx,
-			 const DOM_SID *sid,
-			 char **dn)
-{
-	ADS_STATUS rc;
-	LDAPMessage *msg = NULL;
-	LDAPMessage *entry = NULL;
-	char *ldap_exp;
-	char *sidstr = NULL;
-	int count;
-	char *dn2 = NULL;
-
-	const char *attr[] = {
-		"dn",
-		NULL
-	};
-
-	if (!(sidstr = sid_binstring(sid))) {
-		DEBUG(1,("ads_sid_to_dn: sid_binstring failed!\n"));
-		rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-		goto done;
-	}
-
-	if(!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)", sidstr))) {
-		DEBUG(1,("ads_sid_to_dn: talloc_asprintf failed!\n"));
-		rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-		goto done;
-	}
-
-	rc = ads_search_retry(ads, (void **)(void *)&msg, ldap_exp, attr);
-
-	if (!ADS_ERR_OK(rc)) {
-		DEBUG(1,("ads_sid_to_dn ads_search: %s\n", ads_errstr(rc)));
-		goto done;
-	}
-
-	if ((count = ads_count_replies(ads, msg)) != 1) {
-		fstring sid_string;
-		DEBUG(1,("ads_sid_to_dn (sid=%s): Not found (count=%d)\n", 
-			 sid_to_string(sid_string, sid), count));
-		rc = ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
-		goto done;
-	}
-
-	entry = ads_first_entry(ads, msg);
-
-	dn2 = ads_get_dn(ads, entry);
-
-	if (!dn2) {
-		rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-		goto done;
-	}
-
-	*dn = talloc_strdup(mem_ctx, dn2);
-
-	if (!*dn) {
-		rc = ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
-		goto done;
-	}
-
-	rc = ADS_ERROR_NT(NT_STATUS_OK);
-
-	DEBUG(3,("ads sid_to_dn mapped %s\n", dn2));
-
-	SAFE_FREE(dn2);
-done:
-	if (msg) ads_msgfree(ads, msg);
-	if (dn2) ads_memfree(ads, dn2);
-
-	SAFE_FREE(sidstr);
-
-	return rc;
-}
-
-#endif
diff --git a/source3/libads/ldap_utils.c b/source3/libads/ldap_utils.c
index 18caa2c63a..105fd2e5b9 100644
--- a/source3/libads/ldap_utils.c
+++ b/source3/libads/ldap_utils.c
@@ -105,4 +105,29 @@ ADS_STATUS ads_search_retry_dn(ADS_STRUCT *ads, void **res,
 	return ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
 				   "(objectclass=*)", attrs, res);
 }
+
+ADS_STATUS ads_search_retry_sid(ADS_STRUCT *ads, void **res, 
+				const DOM_SID *sid,
+				const char **attrs)
+{
+	char *dn, *sid_string;
+	ADS_STATUS status;
+	
+	sid_string = sid_binstring_hex(sid);
+	if (sid_string == NULL) {
+		return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+	}
+
+	if (!asprintf(&dn, "<SID=%s>", sid_string)) {
+		SAFE_FREE(sid_string);
+		return ADS_ERROR_NT(NT_STATUS_NO_MEMORY);
+	}
+
+	status = ads_do_search_retry(ads, dn, LDAP_SCOPE_BASE,
+				   "(objectclass=*)", attrs, res);
+	SAFE_FREE(dn);
+	SAFE_FREE(sid_string);
+	return status;
+}
+
 #endif
diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c
index 5e0d4cfe8e..336f27e6a1 100644
--- a/source3/nsswitch/winbindd_ads.c
+++ b/source3/nsswitch/winbindd_ads.c
@@ -634,13 +634,8 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 		goto done;
 	}
 
-	rc = ads_sid_to_dn(ads, mem_ctx, sid, &user_dn);
-	if (!ADS_ERR_OK(rc)) {
-		status = ads_ntstatus(rc);
-		goto done;
-	}
+	rc = ads_search_retry_sid(ads, (void**)(void *)&msg, sid, attrs);
 
-	rc = ads_search_retry_dn(ads, (void**)(void *)&msg, user_dn, attrs);
 	if (!ADS_ERR_OK(rc)) {
 		status = ads_ntstatus(rc);
 		DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n", 
@@ -648,6 +643,15 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 		goto done;
 	}
 	
+	count = ads_count_replies(ads, msg);
+	if (count != 1) {
+		status = NT_STATUS_UNSUCCESSFUL;
+		DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: "
+			 "invalid number of results (count=%d)\n", 
+			 sid_to_string(sid_string, sid), count));
+		goto done;
+	}
+
 	if (!msg) {
 		DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n", 
 			 sid_to_string(sid_string, sid)));
@@ -655,6 +659,12 @@ static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
 		goto done;
 	}
 
+	user_dn = ads_get_dn(ads, msg);
+	if (user_dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto done;
+	}
+
 	if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
 		DEBUG(1,("%s: No primary group for sid=%s !?\n", 
 			 domain->name, sid_to_string(sid_string, sid)));
diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 538a269614..c7e9529c97 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -55,6 +55,8 @@ int net_ads_usage(int argc, const char **argv)
 "\n\tperform a raw LDAP search and dump the results\n"
 "\nnet ads dn"\
 "\n\tperform a raw LDAP search and dump attributes of a particular DN\n"
+"\nnet ads sid"\
+"\n\tperform a raw LDAP search and dump attributes of a particular SID\n"
 "\nnet ads keytab"\
 "\n\tcreates and updates the kerberos system keytab file\n"
 		);
@@ -1387,6 +1389,71 @@ static int net_ads_dn(int argc, const char **argv)
 	return 0;
 }
 
+/*
+  help for net ads sid search
+*/
+static int net_ads_sid_usage(int argc, const char **argv)
+{
+	d_printf(
+		"\nnet ads sid <sid> <attributes...>\n"\
+		"\nperform a raw LDAP search on a ADS server and dump the results\n"\
+		"The SID is in string format, and the attributes are a list of LDAP fields \n"\
+		"to show in the results\n\n"\
+		"Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
+		);
+	net_common_flags_usage(argc, argv);
+	return -1;
+}
+
+
+/*
+  general ADS search function. Useful in diagnosing problems in ADS
+*/
+static int net_ads_sid(int argc, const char **argv)
+{
+	ADS_STRUCT *ads;
+	ADS_STATUS rc;
+	const char *sid_string;
+	const char **attrs;
+	void *res = NULL;
+	DOM_SID sid;
+
+	if (argc < 1) {
+		return net_ads_sid_usage(argc, argv);
+	}
+
+	if (!(ads = ads_startup())) {
+		return -1;
+	}
+
+	sid_string = argv[0];
+	attrs = (argv + 1);
+
+	if (!string_to_sid(&sid, sid_string)) {
+		d_fprintf(stderr, "could not convert sid\ņ");
+		ads_destroy(&ads);
+		return -1;
+	}
+
+	rc = ads_search_retry_sid(ads, &res, &sid, attrs);
+	if (!ADS_ERR_OK(rc)) {
+		d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
+		ads_destroy(&ads);
+		return -1;
+	}	
+
+	d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
+
+	/* dump the results */
+	ads_dump(ads, res);
+
+	ads_msgfree(ads, res);
+	ads_destroy(&ads);
+
+	return 0;
+}
+
+
 static int net_ads_keytab_usage(int argc, const char **argv)
 {
 	d_printf(
@@ -1504,6 +1571,7 @@ int net_ads(int argc, const char **argv)
 		{"PRINTER", net_ads_printer},
 		{"SEARCH", net_ads_search},
 		{"DN", net_ads_dn},
+		{"SID", net_ads_sid},
 		{"WORKGROUP", net_ads_workgroup},
 		{"LOOKUP", net_ads_lookup},
 		{"KEYTAB", net_ads_keytab},