summaryrefslogtreecommitdiff
path: root/source4/winbind
diff options
context:
space:
mode:
authorJelmer Vernooij <jelmer@samba.org>2008-02-21 16:11:13 +0100
committerJelmer Vernooij <jelmer@samba.org>2008-02-21 16:11:13 +0100
commit10e7f9f02d3b952c924e7c98ce01d27cc6baac84 (patch)
treecdc3655b8ebf084031aa84c4967333d176994315 /source4/winbind
parent426e7fef1f080f22a10e89cebae58a40db8bc77f (diff)
parent141f4b8f838f750b979eeef11743244008bfa339 (diff)
downloadsamba-10e7f9f02d3b952c924e7c98ce01d27cc6baac84.tar.gz
samba-10e7f9f02d3b952c924e7c98ce01d27cc6baac84.tar.bz2
samba-10e7f9f02d3b952c924e7c98ce01d27cc6baac84.zip
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into v4-0-trivial
(This used to be commit 52a8d06f00ab3900e2186e047902dbcbe3138a01)
Diffstat (limited to 'source4/winbind')
-rw-r--r--source4/winbind/config.mk11
-rw-r--r--source4/winbind/idmap.c1072
-rw-r--r--source4/winbind/idmap.h33
-rw-r--r--source4/winbind/wb_gid2sid.c13
-rw-r--r--source4/winbind/wb_server.c6
-rw-r--r--source4/winbind/wb_server.h2
-rw-r--r--source4/winbind/wb_sid2gid.c11
-rw-r--r--source4/winbind/wb_sid2uid.c15
-rw-r--r--source4/winbind/wb_uid2sid.c15
9 files changed, 1160 insertions, 18 deletions
diff --git a/source4/winbind/config.mk b/source4/winbind/config.mk
index da5b71f2ae..2567d617da 100644
--- a/source4/winbind/config.mk
+++ b/source4/winbind/config.mk
@@ -37,6 +37,7 @@ OBJ_FILES = \
wb_sam_logon.o
PRIVATE_DEPENDENCIES = \
WB_HELPER \
+ IDMAP \
NDR_WINBIND \
process_model \
RPC_NDR_LSA \
@@ -56,3 +57,13 @@ OBJ_FILES = \
PUBLIC_DEPENDENCIES = RPC_NDR_LSA dcerpc_samr
# End SUBSYSTEM WB_HELPER
################################################
+
+################################################
+# Start SUBYSTEM IDMAP
+[SUBSYSTEM::IDMAP]
+PRIVATE_PROTO_HEADER = idmap_proto.h
+OBJ_FILES = \
+ idmap.o
+PUBLIC_DEPENDENCIES = SAMDB_COMMON
+# End SUBSYSTEM IDMAP
+################################################
diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
new file mode 100644
index 0000000000..3372ad51ee
--- /dev/null
+++ b/source4/winbind/idmap.c
@@ -0,0 +1,1072 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ Map SIDs to uids/gids and back
+
+ Copyright (C) Kai Blin 2008
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "auth/auth.h"
+#include "librpc/gen_ndr/lsa.h"
+#include "librpc/gen_ndr/samr.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "lib/ldb_wrap.h"
+#include "param/param.h"
+#include "winbind/idmap.h"
+#include "libcli/security/proto.h"
+#include "libcli/ldap/ldap_ndr.h"
+
+/**
+ * Get uid/gid bounds from idmap database
+ *
+ * \param idmap_ctx idmap context to use
+ * \param low lower uid/gid bound is stored here
+ * \param high upper uid/gid bound is stored here
+ * \return 0 on success, nonzero on failure
+ */
+static int idmap_get_bounds(struct idmap_context *idmap_ctx, uint32_t *low,
+ uint32_t *high)
+{
+ int ret = -1;
+ struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+ struct ldb_dn *dn;
+ struct ldb_result *res = NULL;
+ TALLOC_CTX *tmp_ctx = talloc_new(idmap_ctx);
+ uint32_t lower_bound = (uint32_t) -1;
+ uint32_t upper_bound = (uint32_t) -1;
+
+ dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+ if (dn == NULL) goto failed;
+
+ ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+ if (ret != LDB_SUCCESS) goto failed;
+
+ talloc_steal(tmp_ctx, res);
+
+ if (res->count != 1) {
+ ret = -1;
+ goto failed;
+ }
+
+ lower_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "lowerBound", -1);
+ if (lower_bound != (uint32_t) -1) {
+ ret = LDB_SUCCESS;
+ } else {
+ ret = -1;
+ goto failed;
+ }
+
+ upper_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "upperBound", -1);
+ if (upper_bound != (uint32_t) -1) {
+ ret = LDB_SUCCESS;
+ } else {
+ ret = -1;
+ }
+
+failed:
+ talloc_free(tmp_ctx);
+ *low = lower_bound;
+ *high = upper_bound;
+ return ret;
+}
+
+/**
+ * Add a dom_sid structure to a ldb_message
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param ldb_message ldb message to add dom_sid to
+ * \param attr_name name of the attribute to store the dom_sid in
+ * \param sid dom_sid to store
+ * \return 0 on success, an ldb error code on failure.
+ */
+static int idmap_msg_add_dom_sid(struct idmap_context *idmap_ctx,
+ TALLOC_CTX *mem_ctx, struct ldb_message *msg,
+ const char *attr_name, const struct dom_sid *sid)
+{
+ struct ldb_val val;
+ enum ndr_err_code ndr_err;
+
+ ndr_err = ndr_push_struct_blob(&val, mem_ctx,
+ lp_iconv_convenience(idmap_ctx->lp_ctx),
+ sid,
+ (ndr_push_flags_fn_t)ndr_push_dom_sid);
+
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return -1;
+ }
+
+ return ldb_msg_add_value(msg, attr_name, &val, NULL);
+}
+
+/**
+ * Get a dom_sid structure from a ldb message.
+ *
+ * \param mem_ctx talloc context to allocate dom_sid memory in
+ * \param msg ldb_message to get dom_sid from
+ * \param attr_name key that has the dom_sid as data
+ * \return dom_sid structure on success, NULL on failure
+ */
+static struct dom_sid *idmap_msg_get_dom_sid(TALLOC_CTX *mem_ctx,
+ struct ldb_message *msg, const char *attr_name)
+{
+ struct dom_sid *sid;
+ const struct ldb_val *val;
+ enum ndr_err_code ndr_err;
+
+ val = ldb_msg_find_ldb_val(msg, attr_name);
+ if (val == NULL) {
+ return NULL;
+ }
+
+ sid = talloc(mem_ctx, struct dom_sid);
+ if (sid == NULL) {
+ return NULL;
+ }
+
+ ndr_err = ndr_pull_struct_blob(val, sid, NULL, sid,
+ (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ talloc_free(sid);
+ return NULL;
+ }
+
+ return sid;
+}
+
+/**
+ * Initialize idmap context
+ *
+ * talloc_free to close.
+ *
+ * \param mem_ctx talloc context to use.
+ * \return allocated idmap_context on success, NULL on error
+ */
+struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
+ struct loadparm_context *lp_ctx)
+{
+ struct idmap_context *idmap_ctx;
+
+ idmap_ctx = talloc(mem_ctx, struct idmap_context);
+ if (idmap_ctx == NULL) {
+ return NULL;
+ }
+
+ idmap_ctx->lp_ctx = lp_ctx;
+
+ idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, lp_ctx,
+ lp_idmap_url(lp_ctx),
+ system_session(mem_ctx, lp_ctx),
+ NULL, 0, NULL);
+ if (idmap_ctx->ldb_ctx == NULL) {
+ return NULL;
+ }
+
+ return idmap_ctx;
+}
+
+/**
+ * Convert a uid to the corresponding SID
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
+ * from.
+ * \param uid Unix uid to map to a SID
+ * \param sid Pointer that will take the struct dom_sid pointer if the mapping
+ * succeeds.
+ * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
+ * possible or some other NTSTATUS that is more descriptive on failure.
+ */
+
+NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+ const uid_t uid, struct dom_sid **sid)
+{
+ int ret;
+ NTSTATUS status = NT_STATUS_NONE_MAPPED;
+ struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+ struct ldb_message *msg;
+ struct ldb_result *res = NULL;
+ int trans = -1;
+ uid_t low, high;
+ char *sid_string, *uid_string;
+ struct dom_sid *unix_users_sid, *new_sid;
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
+ uid);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count == 1) {
+ *sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
+ "objectSid");
+ if (*sid == NULL) {
+ DEBUG(1, ("Failed to get sid from db: %u\n", ret));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+ }
+
+ DEBUG(6, ("uid not found in idmap db, trying to allocate SID.\n"));
+
+ trans = ldb_transaction_start(ldb);
+ if (trans != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ /* Now redo the search to make sure noone added a mapping for that SID
+ * while we weren't looking.*/
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
+ uid);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count > 0) {
+ DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
+ status = NT_STATUS_RETRY;
+ goto failed;
+ }
+
+ ret = idmap_get_bounds(idmap_ctx, &low, &high);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (uid >= low && uid <= high) {
+ /* An existing user would have been mapped before */
+ status = NT_STATUS_NO_SUCH_USER;
+ goto failed;
+ }
+
+ /* For local users, we just create a rid = uid +1, so root doesn't end
+ * up with a 0 rid */
+ unix_users_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
+ if (unix_users_sid == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ new_sid = dom_sid_add_rid(mem_ctx, unix_users_sid, uid + 1);
+ if (new_sid == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ sid_string = dom_sid_string(tmp_ctx, new_sid);
+ if (sid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ uid_string = talloc_asprintf(tmp_ctx, "%u", uid);
+ if (uid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ msg = ldb_msg_new(tmp_ctx);
+ if (msg == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+ if (msg->dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(msg, "uidNumber", uid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
+ new_sid);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(msg, "cn", sid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_add(ldb, msg);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ trans = ldb_transaction_commit(ldb);
+ if (trans != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ *sid = new_sid;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+
+failed:
+ if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+ talloc_free(tmp_ctx);
+ return status;
+}
+
+/**
+ * Map a Unix gid to the corresponding SID
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
+ * from.
+ * \param gid Unix gid to map to a SID
+ * \param sid Pointer that will take the struct dom_sid pointer if mapping
+ * succeeds.
+ * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
+ * possible or some other NTSTATUS that is more descriptive on failure.
+ */
+NTSTATUS idmap_gid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+ const gid_t gid, struct dom_sid **sid)
+{
+ int ret;
+ NTSTATUS status = NT_STATUS_NONE_MAPPED;
+ struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+ struct ldb_message *msg;
+ struct ldb_result *res = NULL;
+ int trans = -1;
+ gid_t low, high;
+ char *sid_string, *gid_string;
+ struct dom_sid *unix_groups_sid, *new_sid;
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(gidNumber=%u))", gid);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count == 1) {
+ *sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
+ "objectSid");
+ if (*sid == NULL) {
+ DEBUG(1, ("Failed to get sid from db: %u\n", ret));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+ /* No change, so cancel the transaction */
+ ldb_transaction_cancel(ldb);
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+ }
+
+ DEBUG(6, ("gid not found in idmap db, trying to allocate SID.\n"));
+
+ trans = ldb_transaction_start(ldb);
+ if (trans != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ /* Now redo the search to make sure noone added a mapping for that SID
+ * while we weren't looking.*/
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(gidNumber=%u))",
+ gid);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count > 0) {
+ DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
+ status = NT_STATUS_RETRY;
+ goto failed;
+ }
+
+ ret = idmap_get_bounds(idmap_ctx, &low, &high);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (gid >= low && gid <= high) {
+ /* An existing group would have been mapped before */
+ status = NT_STATUS_NO_SUCH_USER;
+ goto failed;
+ }
+
+ /* For local groups, we just create a rid = gid +1, so root doesn't end
+ * up with a 0 rid */
+ unix_groups_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
+ if (unix_groups_sid == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ new_sid = dom_sid_add_rid(mem_ctx, unix_groups_sid, gid + 1);
+ if (new_sid == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ sid_string = dom_sid_string(tmp_ctx, new_sid);
+ if (sid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ gid_string = talloc_asprintf(tmp_ctx, "%u", gid);
+ if (gid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ msg = ldb_msg_new(tmp_ctx);
+ if (msg == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+ if (msg->dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(msg, "gidNumber", gid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
+ new_sid);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(msg, "cn", sid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_add(ldb, msg);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ trans = ldb_transaction_commit(ldb);
+ if (trans != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ *sid = new_sid;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+
+failed:
+ if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+ talloc_free(tmp_ctx);
+ return status;
+}
+
+/**
+ * Map a SID to a Unix uid.
+ *
+ * If no mapping exists, a new mapping will be created.
+ *
+ * \todo Check if SIDs can be resolved if lp_idmap_trusted_only() == true
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param sid SID to map to a Unix uid
+ * \param uid pointer to receive the mapped uid
+ * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
+ * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
+ * mapping failed.
+ */
+NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+ const struct dom_sid *sid, uid_t *uid)
+{
+ int ret;
+ NTSTATUS status = NT_STATUS_NONE_MAPPED;
+ struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+ struct ldb_dn *dn;
+ struct ldb_message *hwm_msg, *map_msg;
+ struct ldb_result *res = NULL;
+ int trans;
+ uid_t low, high, hwm, new_uid;
+ char *sid_string, *uid_string, *hwm_string;
+ bool hwm_entry_exists;
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+ ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count == 1) {
+ new_uid = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber",
+ -1);
+ if (new_uid == (uid_t) -1) {
+ DEBUG(1, ("Invalid uid mapping.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+ *uid = new_uid;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+ }
+
+ DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
+
+ trans = ldb_transaction_start(ldb);
+ if (trans != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ /* Redo the search to make sure noone changed the mapping while we
+ * weren't looking */
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+ ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count > 0) {
+ DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
+ status = NT_STATUS_RETRY;
+ goto failed;
+ }
+
+ /*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
+ * resolved here. */
+
+ ret = idmap_get_bounds(idmap_ctx, &low, &high);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+ if (dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ talloc_steal(tmp_ctx, res);
+
+ if (res->count != 1) {
+ DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber", -1);
+ if (hwm == (uid_t)-1) {
+ hwm = low;
+ hwm_entry_exists = false;
+ } else {
+ hwm_entry_exists = true;
+ }
+
+ if (hwm > high) {
+ DEBUG(1, ("Out of uids to allocate.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ hwm_msg = ldb_msg_new(tmp_ctx);
+ if (hwm_msg == NULL) {
+ DEBUG(1, ("Out of memory when creating ldb_message\n"));
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ hwm_msg->dn = dn;
+
+ new_uid = hwm;
+ hwm++;
+
+ hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
+ if (hwm_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ sid_string = dom_sid_string(tmp_ctx, sid);
+ if (sid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ uid_string = talloc_asprintf(tmp_ctx, "%u", new_uid);
+ if (uid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ if (hwm_entry_exists) {
+ struct ldb_message_element *els;
+ struct ldb_val *vals;
+
+ /* We're modifying the entry, not just adding a new one. */
+ els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
+ if (els == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ vals = talloc_array(tmp_ctx, struct ldb_val, 2);
+ if (els == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ hwm_msg->num_elements = 2;
+ hwm_msg->elements = els;
+
+ els[0].num_values = 1;
+ els[0].values = &vals[0];
+ els[0].flags = LDB_FLAG_MOD_DELETE;
+ els[0].name = talloc_strdup(tmp_ctx, "uidNumber");
+ if (els[0].name == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ els[1].num_values = 1;
+ els[1].values = &vals[1];
+ els[1].flags = LDB_FLAG_MOD_ADD;
+ els[1].name = els[0].name;
+
+ vals[0].data = (uint8_t *)uid_string;
+ vals[0].length = strlen(uid_string);
+ vals[1].data = (uint8_t *)hwm_string;
+ vals[1].length = strlen(hwm_string);
+ } else {
+ ret = ldb_msg_add_empty(hwm_msg, "uidNumber", LDB_FLAG_MOD_ADD,
+ NULL);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(hwm_msg, "uidNumber", hwm_string);
+ if (ret != LDB_SUCCESS)
+ {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+ }
+
+ ret = ldb_modify(ldb, hwm_msg);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Updating the uid high water mark failed: %s\n",
+ ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ map_msg = ldb_msg_new(tmp_ctx);
+ if (map_msg == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+ if (map_msg->dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "uidNumber", uid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
+ sid);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "cn", sid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_add(ldb, map_msg);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ trans = ldb_transaction_commit(ldb);
+ if (trans != LDB_SUCCESS) {
+ DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ *uid = new_uid;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+
+failed:
+ if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+ talloc_free(tmp_ctx);
+ return status;
+}
+
+/**
+ * Map a SID to a Unix gid.
+ *
+ * If no mapping exist, a new mapping will be created.
+ *
+ * \todo Check if SID resolve when lp_idmap_trusted_only() == true
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param sid SID to map to a Unix gid
+ * \param gid pointer to receive the mapped gid
+ * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
+ * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
+ * mapping failed.
+ */
+NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+ const struct dom_sid *sid, gid_t *gid)
+{
+ int ret;
+ NTSTATUS status = NT_STATUS_NONE_MAPPED;
+ struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+ struct ldb_dn *dn;
+ struct ldb_message *hwm_msg, *map_msg;
+ struct ldb_result *res = NULL;
+ int trans = -1;
+ gid_t low, high, hwm, new_gid;
+ char *sid_string, *gid_string, *hwm_string;
+ bool hwm_entry_exists;
+ TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+ ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count == 1) {
+ new_gid = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber",
+ -1);
+ if (new_gid == (gid_t) -1) {
+ DEBUG(1, ("Invalid gid mapping.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+ *gid = new_gid;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+ }
+
+ DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
+
+ trans = ldb_transaction_start(ldb);
+ if (trans != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ /* Redo the search to make sure noone changed the mapping while we
+ * weren't looking */
+ ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+ ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ if (res->count > 0) {
+ DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
+ status = NT_STATUS_RETRY;
+ goto failed;
+ }
+
+ /*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
+ * resolved here. */
+
+ ret = idmap_get_bounds(idmap_ctx, &low, &high);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+ if (dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ talloc_steal(tmp_ctx, res);
+
+ if (res->count != 1) {
+ DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber", -1);
+ if (hwm == (gid_t)-1) {
+ hwm = low;
+ hwm_entry_exists = false;
+ } else {
+ hwm_entry_exists = true;
+ }
+
+ if (hwm > high) {
+ DEBUG(1, ("Out of gids to allocate.\n"));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ hwm_msg = ldb_msg_new(tmp_ctx);
+ if (hwm_msg == NULL) {
+ DEBUG(1, ("Out of memory when creating ldb_message\n"));
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ hwm_msg->dn = dn;
+
+ new_gid = hwm;
+ hwm++;
+
+ hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
+ if (hwm_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ sid_string = dom_sid_string(tmp_ctx, sid);
+ if (sid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ gid_string = talloc_asprintf(tmp_ctx, "%u", new_gid);
+ if (gid_string == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ if (hwm_entry_exists) {
+ struct ldb_message_element *els;
+ struct ldb_val *vals;
+
+ /* We're modifying the entry, not just adding a new one. */
+ els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
+ if (els == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ vals = talloc_array(tmp_ctx, struct ldb_val, 2);
+ if (els == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ hwm_msg->num_elements = 2;
+ hwm_msg->elements = els;
+
+ els[0].num_values = 1;
+ els[0].values = &vals[0];
+ els[0].flags = LDB_FLAG_MOD_DELETE;
+ els[0].name = talloc_strdup(tmp_ctx, "gidNumber");
+ if (els[0].name == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ els[1].num_values = 1;
+ els[1].values = &vals[1];
+ els[1].flags = LDB_FLAG_MOD_ADD;
+ els[1].name = els[0].name;
+
+ vals[0].data = (uint8_t *)gid_string;
+ vals[0].length = strlen(gid_string);
+ vals[1].data = (uint8_t *)hwm_string;
+ vals[1].length = strlen(hwm_string);
+ } else {
+ ret = ldb_msg_add_empty(hwm_msg, "gidNumber", LDB_FLAG_MOD_ADD,
+ NULL);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(hwm_msg, "gidNumber", hwm_string);
+ if (ret != LDB_SUCCESS)
+ {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+ }
+
+ ret = ldb_modify(ldb, hwm_msg);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Updating the gid high water mark failed: %s\n",
+ ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ map_msg = ldb_msg_new(tmp_ctx);
+ if (map_msg == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+ if (map_msg->dn == NULL) {
+ status = NT_STATUS_NO_MEMORY;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "gidNumber", gid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
+ sid);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_msg_add_string(map_msg, "cn", sid_string);
+ if (ret != LDB_SUCCESS) {
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ ret = ldb_add(ldb, map_msg);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ trans = ldb_transaction_commit(ldb);
+ if (trans != LDB_SUCCESS) {
+ DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
+ status = NT_STATUS_NONE_MAPPED;
+ goto failed;
+ }
+
+ *gid = new_gid;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_OK;
+
+failed:
+ if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+ talloc_free(tmp_ctx);
+ return status;
+}
+
diff --git a/source4/winbind/idmap.h b/source4/winbind/idmap.h
new file mode 100644
index 0000000000..8781819be0
--- /dev/null
+++ b/source4/winbind/idmap.h
@@ -0,0 +1,33 @@
+/*
+ Unix SMB/CIFS implementation.
+
+ Map SIDs to uids/gids and back
+
+ Copyright (C) Kai Blin 2008
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#ifndef _IDMAP_H_
+#define _IDMAP_H_
+
+struct idmap_context {
+ struct loadparm_context *lp_ctx;
+ struct ldb_context *ldb_ctx;
+};
+
+#include "winbind/idmap_proto.h"
+
+#endif
+
diff --git a/source4/winbind/wb_gid2sid.c b/source4/winbind/wb_gid2sid.c
index 5c0b87118d..f2577029aa 100644
--- a/source4/winbind/wb_gid2sid.c
+++ b/source4/winbind/wb_gid2sid.c
@@ -25,6 +25,7 @@
#include "smbd/service_task.h"
#include "winbind/wb_helper.h"
#include "libcli/security/proto.h"
+#include "winbind/idmap.h"
struct gid2sid_state {
struct composite_context *ctx;
@@ -50,10 +51,14 @@ struct composite_context *wb_gid2sid_send(TALLOC_CTX *mem_ctx,
result->private_data = state;
state->service = service;
- /* FIXME: This is a stub so far.
- * We cheat by just using the gid as RID with the domain SID.*/
- state->sid = dom_sid_add_rid(result, service->primary_sid, gid);
- if (composite_nomem(state->sid, state->ctx)) return result;
+ state->ctx->status = idmap_gid_to_sid(service->idmap_ctx, mem_ctx, gid,
+ &state->sid);
+ if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+ state->ctx->status = idmap_gid_to_sid(service->idmap_ctx,
+ mem_ctx, gid,
+ &state->sid);
+ }
+ if (!composite_is_ok(state->ctx)) return result;
composite_done(state->ctx);
return result;
diff --git a/source4/winbind/wb_server.c b/source4/winbind/wb_server.c
index 9b303f3615..99191f3c6c 100644
--- a/source4/winbind/wb_server.c
+++ b/source4/winbind/wb_server.c
@@ -149,6 +149,12 @@ static void winbind_task_init(struct task_server *task)
return;
}
+ service->idmap_ctx = idmap_init(service, task->lp_ctx);
+ if (service->idmap_ctx == NULL) {
+ task_server_terminate(task, "Failed to load idmap database");
+ return;
+ }
+
/* setup the unprivileged samba3 socket */
listen_socket = talloc(service, struct wbsrv_listen_socket);
if (!listen_socket) goto nomem;
diff --git a/source4/winbind/wb_server.h b/source4/winbind/wb_server.h
index f3cfc18565..ce972932f5 100644
--- a/source4/winbind/wb_server.h
+++ b/source4/winbind/wb_server.h
@@ -21,6 +21,7 @@
#include "nsswitch/winbind_nss_config.h"
#include "nsswitch/winbind_struct_protocol.h"
+#include "winbind/idmap.h"
#include "libnet/libnet.h"
#define WINBINDD_SAMBA3_SOCKET "pipe"
@@ -33,6 +34,7 @@ struct wbsrv_service {
const struct dom_sid *primary_sid;
struct wbsrv_domain *domains;
+ struct idmap_context *idmap_ctx;
};
struct wbsrv_samconn {
diff --git a/source4/winbind/wb_sid2gid.c b/source4/winbind/wb_sid2gid.c
index 8cb5608b2f..12129226be 100644
--- a/source4/winbind/wb_sid2gid.c
+++ b/source4/winbind/wb_sid2gid.c
@@ -25,6 +25,7 @@
#include "smbd/service_task.h"
#include "winbind/wb_helper.h"
#include "libcli/security/proto.h"
+#include "winbind/idmap.h"
struct sid2gid_state {
struct composite_context *ctx;
@@ -50,9 +51,13 @@ struct composite_context *wb_sid2gid_send(TALLOC_CTX *mem_ctx,
result->private_data = state;
state->service = service;
- /*FIXME: This is a stub so far. */
- state->ctx->status = dom_sid_split_rid(result, sid, NULL, &state->gid);
- if(!composite_is_ok(state->ctx)) return result;
+ state->ctx->status = idmap_sid_to_gid(service->idmap_ctx, state, sid,
+ &state->gid);
+ if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+ state->ctx->status = idmap_sid_to_gid(service->idmap_ctx, state,
+ sid, &state->gid);
+ }
+ if (!composite_is_ok(state->ctx)) return result;
composite_done(state->ctx);
return result;
diff --git a/source4/winbind/wb_sid2uid.c b/source4/winbind/wb_sid2uid.c
index 449596ef38..0de45fdea9 100644
--- a/source4/winbind/wb_sid2uid.c
+++ b/source4/winbind/wb_sid2uid.c
@@ -3,7 +3,7 @@
Map a SID to a uid
- Copyright (C) Kai Blin 2007
+ Copyright (C) Kai Blin 2007-2008
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -25,6 +25,7 @@
#include "smbd/service_task.h"
#include "winbind/wb_helper.h"
#include "libcli/security/proto.h"
+#include "winbind/idmap.h"
struct sid2uid_state {
struct composite_context *ctx;
@@ -50,11 +51,13 @@ struct composite_context *wb_sid2uid_send(TALLOC_CTX *mem_ctx,
result->private_data = state;
state->service = service;
- /*FIXME: This is a stub so far. */
- state->ctx->status = dom_sid_split_rid(result, sid, NULL, &state->uid);
- if(!composite_is_ok(state->ctx)) return result;
-
- DEBUG(5, ("Rid is %d\n", state->uid));
+ state->ctx->status = idmap_sid_to_uid(service->idmap_ctx, state, sid,
+ &state->uid);
+ if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+ state->ctx->status = idmap_sid_to_uid(service->idmap_ctx, state,
+ sid, &state->uid);
+ }
+ if (!composite_is_ok(state->ctx)) return result;
composite_done(state->ctx);
return result;
diff --git a/source4/winbind/wb_uid2sid.c b/source4/winbind/wb_uid2sid.c
index d7a909fda2..e81d2e4671 100644
--- a/source4/winbind/wb_uid2sid.c
+++ b/source4/winbind/wb_uid2sid.c
@@ -3,7 +3,7 @@
Command backend for wbinfo -U
- Copyright (C) Kai Blin 2007
+ Copyright (C) Kai Blin 2007-2008
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -25,6 +25,7 @@
#include "smbd/service_task.h"
#include "winbind/wb_helper.h"
#include "libcli/security/proto.h"
+#include "winbind/idmap.h"
struct uid2sid_state {
struct composite_context *ctx;
@@ -50,10 +51,14 @@ struct composite_context *wb_uid2sid_send(TALLOC_CTX *mem_ctx,
result->private_data = state;
state->service = service;
- /* FIXME: This is a stub so far.
- * We cheat by just using the uid as RID with the domain SID.*/
- state->sid = dom_sid_add_rid(result, service->primary_sid, uid);
- if (composite_nomem(state->sid, state->ctx)) return result;
+ state->ctx->status = idmap_uid_to_sid(service->idmap_ctx, mem_ctx, uid,
+ &state->sid);
+ if (NT_STATUS_EQUAL(state->ctx->status, NT_STATUS_RETRY)) {
+ state->ctx->status = idmap_uid_to_sid(service->idmap_ctx,
+ mem_ctx, uid,
+ &state->sid);
+ }
+ if (!composite_is_ok(state->ctx)) return result;
composite_done(state->ctx);
return result;