summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLuke Leighton <lkcl@samba.org>1998-12-20 00:35:43 +0000
committerLuke Leighton <lkcl@samba.org>1998-12-20 00:35:43 +0000
commitedc708db021f118704d9e846abd2fdae14cd34f4 (patch)
tree561d5c6adf84c04c9b009abba9b99e99d586fa1b
parenta8e26983060f6a723124353e9ae8e481f5dbc882 (diff)
downloadsamba-edc708db021f118704d9e846abd2fdae14cd34f4.tar.gz
samba-edc708db021f118704d9e846abd2fdae14cd34f4.tar.bz2
samba-edc708db021f118704d9e846abd2fdae14cd34f4.zip
adding start of remote lookup for domain member role.
(This used to be commit 090512e18770bab9222a30e68dee83d1612eca10)
-rw-r--r--source3/lib/domain_namemap.c154
1 files changed, 125 insertions, 29 deletions
diff --git a/source3/lib/domain_namemap.c b/source3/lib/domain_namemap.c
index 9ea3dd6ada..cb0e315ef5 100644
--- a/source3/lib/domain_namemap.c
+++ b/source3/lib/domain_namemap.c
@@ -49,6 +49,8 @@
#include "includes.h"
extern int DEBUGLEVEL;
+extern fstring global_myworkgroup;
+extern DOM_SID global_member_sid;
extern fstring global_sam_name;
extern DOM_SID global_sam_sid;
extern DOM_SID global_sid_S_1_5_20;
@@ -892,6 +894,116 @@ BOOL lookupsmbpwnam(const char *unix_usr_name, DOM_NAME_MAP *grp)
}
}
+/************************************************************************
+ Routine to look up a remote nt name
+*************************************************************************/
+static BOOL lookup_remote_ntname(const char *ntname, DOM_SID *sid, uint8 *type)
+{
+ struct cli_state cli;
+ POLICY_HND lsa_pol;
+ uint16 fnum_lsa;
+ fstring srv_name;
+
+ BOOL res3 = True;
+ BOOL res4 = True;
+ uint32 num_sids;
+ DOM_SID *sids;
+ uint8 *types;
+ const char *names[1];
+
+ if (!cli_connect_serverlist(&cli, lp_passwordserver()))
+ {
+ return False;
+ }
+
+ names[0] = ntname;
+
+ fstrcpy(srv_name, "\\\\");
+ fstrcat(srv_name, cli.desthost);
+ strupper(srv_name);
+
+ /* open LSARPC session. */
+ res3 = res3 ? cli_nt_session_open(&cli, PIPE_LSARPC, &fnum_lsa) : False;
+
+ /* lookup domain controller; receive a policy handle */
+ res3 = res3 ? lsa_open_policy(&cli, fnum_lsa,
+ srv_name,
+ &lsa_pol, True) : False;
+
+ /* send lsa lookup sids call */
+ res4 = res3 ? lsa_lookup_names(&cli, fnum_lsa,
+ &lsa_pol,
+ 1, names,
+ &sids, &types, &num_sids) : False;
+
+ res3 = res3 ? lsa_close(&cli, fnum_lsa, &lsa_pol) : False;
+
+ cli_nt_session_close(&cli, fnum_lsa);
+
+ if (res4 && res3 && sids != NULL && types != NULL)
+ {
+ sid_copy(sid, &sids[0]);
+ *type = types[0];
+ }
+ else
+ {
+ res3 = False;
+ }
+ if (types != NULL)
+ {
+ free(types);
+ }
+
+ if (sids != NULL)
+ {
+ free(sids);
+ }
+
+ return res3 && res4;
+}
+
+/************************************************************************
+ Routine to look up a remote nt name
+*************************************************************************/
+static BOOL get_sid_and_type(const char *fullntname, uint8 expected_type,
+ DOM_NAME_MAP *gmep)
+{
+ /*
+ * check with the PDC to see if it owns the name. if so,
+ * the SID is resolved with the PDC database.
+ */
+
+ if (lp_server_role() == ROLE_DOMAIN_MEMBER)
+ {
+ if (lookup_remote_ntname(fullntname, &gmep->sid, &gmep->type))
+ {
+ if (sid_front_equal(&gmep->sid, &global_member_sid) &&
+ strequal(gmep->nt_domain, global_myworkgroup) &&
+ gmep->type == expected_type)
+ {
+ return True;
+ }
+ return False;
+ }
+ }
+
+ /*
+ * ... otherwise, it's one of ours. map the sid ourselves,
+ * which can only happen in our own SAM database.
+ */
+
+ if (!strequal(gmep->nt_domain, global_sam_name))
+ {
+ return False;
+ }
+ if (!pwdb_unixid_to_sam_sid(gmep->unix_id, gmep->type, &gmep->sid))
+ {
+ return False;
+ }
+
+ return True;
+}
+
/*
* used by lookup functions below
*/
@@ -918,6 +1030,15 @@ BOOL lookupsmbpwuid(uid_t uid, DOM_NAME_MAP *gmep)
gmep->unix_id = (uint32)uid;
/*
+ * ok, assume it's one of ours. then double-check it
+ * if we are a member of a domain
+ */
+
+ gmep->type = SID_NAME_USER;
+ fstrcpy(gmep->nt_name, uidtoname(uid));
+ fstrcpy(gmep->unix_name, gmep->nt_name);
+
+ /*
* here we should do a LsaLookupNames() call
* to check the status of the name with the PDC.
* if the PDC know nothing of the name, it's ours.
@@ -931,15 +1052,9 @@ BOOL lookupsmbpwuid(uid_t uid, DOM_NAME_MAP *gmep)
}
/*
- * ok, it's one of ours. we therefore "create" an nt user named
- * after the unix user. this is the point where "appliance mode"
- * should get its teeth in, as unix users won't really exist,
- * they will only be numbers...
+ * ok, it's one of ours.
*/
- gmep->type = SID_NAME_USER;
- fstrcpy(gmep->nt_name, uidtoname(uid));
- fstrcpy(gmep->unix_name, gmep->nt_name);
gmep->nt_domain = global_sam_name;
pwdb_unixid_to_sam_sid(gmep->unix_id, gmep->type, &gmep->sid);
@@ -975,19 +1090,6 @@ BOOL lookupsmbpwntnam(char *fullntname, DOM_NAME_MAP *gmep)
gmep->nt_domain = nt_domain;
/*
- * here we should do a LsaLookupNames() call
- * to check the status of the name with the PDC.
- * if the PDC know nothing of the name, it's ours.
- */
-
- if (lp_server_role() == ROLE_DOMAIN_MEMBER)
- {
-#if 0
- lsa_lookup_names(global_myworkgroup, gmep->nt_name, gmep->nt_domain, &gmep->sid...);
-#endif
- }
-
- /*
* ok, it's one of ours. we therefore "create" an nt user named
* after the unix user. this is the point where "appliance mode"
* should get its teeth in, as unix users won't really exist,
@@ -1001,12 +1103,8 @@ BOOL lookupsmbpwntnam(char *fullntname, DOM_NAME_MAP *gmep)
return False;
}
gmep->unix_id = (uint32)uid;
- if (!pwdb_unixid_to_sam_sid(gmep->unix_id, gmep->type, &gmep->sid))
- {
- return False;
- }
- return True;
+ return get_sid_and_type(fullntname, gmep->type, gmep);
}
/* oops. */
@@ -1042,7 +1140,7 @@ BOOL lookupsmbpwsid(DOM_SID *sid, DOM_NAME_MAP *gmep)
if (lp_server_role() == ROLE_DOMAIN_MEMBER)
{
#if 0
- lsa_lookup_sids(global_myworkgroup, gmep->sid, gmep->nt_name, gmep->nt_domain...);
+ if (lookup_remote_sid(global_myworkgroup, gmep->sid, gmep->nt_name, gmep->nt_domain...);
#endif
}
@@ -1224,10 +1322,8 @@ BOOL lookupsmbgrpgid(gid_t gid, DOM_NAME_MAP *gmep)
}
fstrcpy(gmep->nt_name, gidtoname(gid));
fstrcpy(gmep->unix_name, gmep->nt_name);
- gmep->nt_domain = global_sam_name;
- pwdb_unixid_to_sam_sid(gmep->unix_id, gmep->type, &gmep->sid);
- return True;
+ return get_sid_and_type(gmep->nt_name, gmep->type, gmep);
}
/* oops */