This is another *BIG* change...

Samba now features a pluggable passdb interface, along the same lines as the
one in use in the auth subsystem.  In this case, only one backend may be active
at a time by the 'normal' interface, and only one backend per passdb_context is
permitted outside that.

This pluggable interface is designed to allow any number of passdb backends to
be compiled in, with the selection at runtime.  The 'passdb backend' paramater
has been created (and documented!) to support this.

As such, configure has been modfied to allow (for example) --with-ldap and the
old smbpasswd to be selected at the same time.

This patch also introduces two new backends:  smbpasswd_nua and tdbsam_nua.
These two backends accept 'non unix accounts', where the user does *not* exist
in /etc/passwd.  These accounts' don't have UIDs in the unix sense, but to
avoid conflicts in the algroitmic mapping of RIDs, they use the values
specified in the 'non unix account range' paramter - in the same way as the
winbind ranges are specifed.

While I was at it, I cleaned up some of the code in pdb_tdb (code copied
directly from smbpasswd and not really considered properly).  Most of this was
to do with % macro expansion on stored data.  It isn't easy to get the macros
into the tdb, and the first password change will 'expand' them.  tdbsam needs
to use a similar system to pdb_ldap in this regard.

This patch only makes minor adjustments to pdb_nisplus and pdb_ldap, becouse I
don't have the test facilities for these.  I plan to incoroprate at least
pdb_ldap into this scheme after consultation with Jerry.

Each (converted) passdb module now no longer has any 'static' variables, and
only exports 1 init function outside its .c file.

The non-unix-account support in this patch has been proven!  It is now possible
to join a win2k machine to a Samba PDC without an account in /etc/passwd!

Other changes:

Minor interface adjustments:
pdb_delete_sam_account() now takes a SAM_ACCOUNT, not a char*.

pdb_update_sam_account() no longer takes the 'override' argument that was being
ignored so often (every other passdb backend).  Extra checks have been added in
some places.

Minor code changes:
smbpasswd no longer attempts to initialise the passdb at startup, this is
now done on first use.

pdbedit has lost some of its 'machine account' logic, as this behaviour is now
controlled by the passdb subsystem directly.

The samr subsystem no longer calls 'local password change', but does the pdb
interactions directly.  This allow the ACB_ flags specifed to be transferred
direct to the backend, without interference.

Doco:

I've updated the doco to reflect some of the changes, and removed some paramters
no longer applicable to HEAD.
(This used to be commit ff354c99c585068af6dc1ff35a1f109a806b326b)

1 files changed, 38 insertions, 42 deletions

diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index 4460af0545..2bb4ee0a75 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -32,28 +32,6 @@
 
 extern DOM_SID global_sam_sid;
 
-struct passdb_ops *pdb_ops;
-
-#if 0	/* JERRY */
-static void* pdb_handle = NULL;
-#endif
-
-/***************************************************************
- Initialize the password db operations.
-***************************************************************/
-
-BOOL initialize_password_db(BOOL reload)
-{	
-	/* 
-	 * This function is unfinished right now, so just 
-	 * ignore the details and always return True.  It 
-	 * is here only as a placeholder          --jerry 
-	 */
-	return True;
-	
-}
-
-
 /************************************************************
  Fill the SAM_ACCOUNT with default values.
  ***********************************************************/
@@ -639,6 +617,7 @@ BOOL local_lookup_name(const char *c_domain, const char *c_user, DOM_SID *psid,
 	DOM_SID local_sid;
 	fstring user;
 	fstring domain;
+	SAM_ACCOUNT *sam_account = NULL;
 
 	*psid_name_use = SID_NAME_UNKNOWN;
 
@@ -671,9 +650,20 @@ BOOL local_lookup_name(const char *c_domain, const char *c_user, DOM_SID *psid,
 
 	(void)map_username(user);
 
-	if((pass = Get_Pwnam(user))) {
+	if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account))) {
+		return False;
+	}
+	
+	if (pdb_getsampwnam(sam_account, user)) {
+		sid_append_rid( &local_sid, pdb_get_user_rid(sam_account));
+		*psid_name_use = SID_NAME_USER;
+		pdb_free_sam(&sam_account);
+
+	} else if((pass = Get_Pwnam(user))) {
 		sid_append_rid( &local_sid, pdb_uid_to_user_rid(pass->pw_uid));
 		*psid_name_use = SID_NAME_USER;
+		pdb_free_sam(&sam_account);
+
 	} else {
 		/*
 		 * Maybe it was a group ?
@@ -681,6 +671,8 @@ BOOL local_lookup_name(const char *c_domain, const char *c_user, DOM_SID *psid,
 		struct group *grp;
 		GROUP_MAP map;
 		
+		pdb_free_sam(&sam_account);
+
 		/* check if it's a mapped group */
 		if (get_group_map_from_ntname(user, &map, MAPPING_WITHOUT_PRIV)) {
 			if (map.gid!=-1) {
@@ -1021,29 +1013,33 @@ BOOL local_password_change(const char *user_name, int local_flags,
 		pdb_free_sam(&sam_pass);
 		
 		if (local_flags & LOCAL_ADD_USER) {
-			/*
-			 * Check for a local account - if we're adding only.
-			 */
-			
-			if(!(pwd = getpwnam_alloc(user_name))) {
-				slprintf(err_str, err_str_len - 1, "User %s does not \
-exist in system password file (usually /etc/passwd). Cannot add \
-account without a valid local system user.\n", user_name);
-				return False;
-			}
+			pwd = getpwnam_alloc(user_name);
 		} else {
 			slprintf(err_str, err_str_len-1,"Failed to find entry for user %s.\n", user_name);
 			return False;
 		}
-
-		if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sam_pass, pwd))){
-			slprintf(err_str, err_str_len-1, "Failed initialise SAM_ACCOUNT for user %s.\n", user_name);
+		
+		if (pwd) {
+			/* Local user found, so init from this */
+			if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sam_pass, pwd))){
+				slprintf(err_str, err_str_len-1, "Failed initialise SAM_ACCOUNT for user %s.\n", user_name);
+				passwd_free(&pwd);
+				return False;
+			}
+		
 			passwd_free(&pwd);
-			return False;
+		} else {
+			if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_pass))){
+				slprintf(err_str, err_str_len-1, "Failed initialise SAM_ACCOUNT for user %s.\n", user_name);
+				return False;
+			}
+
+	        	if (!pdb_set_username(sam_pass, user_name)) {
+	                	slprintf(err_str, err_str_len - 1, "Failed to set username for user %s.\n", user_name);
+	               	 	pdb_free_sam(&sam_pass);
+	               	 	return False;
+	        	}
 		}
-		
-		passwd_free(&pwd);
-	
 		if (local_flags & LOCAL_TRUST_ACCOUNT) {
 	        	if (!pdb_set_acct_ctrl(sam_pass, ACB_WSTRUST)) {
 	                	slprintf(err_str, err_str_len - 1, "Failed to set 'trusted workstation account' flags for user %s.\n", user_name);
@@ -1135,14 +1131,14 @@ account without a valid local system user.\n", user_name);
 			return False;
 		}
 	} else if (local_flags & LOCAL_DELETE_USER) {
-		if (!pdb_delete_sam_account(user_name)) {
+		if (!pdb_delete_sam_account(sam_pass)) {
 			slprintf(err_str,err_str_len-1, "Failed to delete entry for user %s.\n", user_name);
 			pdb_free_sam(&sam_pass);
 			return False;
 		}
 		slprintf(msg_str, msg_str_len-1, "Deleted user %s.\n", user_name);
 	} else {
-		if(!pdb_update_sam_account(sam_pass, True)) {
+		if(!pdb_update_sam_account(sam_pass)) {
 			slprintf(err_str, err_str_len-1, "Failed to modify entry for user %s.\n", user_name);
 			pdb_free_sam(&sam_pass);
 			return False;