diff options
| -rw-r--r-- | source3/Makefile.in | 5 | ||||
| -rw-r--r-- | source3/configure.in | 1 | ||||
| -rw-r--r-- | source3/sam/idmap_ad.c | 380 |
3 files changed, 386 insertions, 0 deletions
diff --git a/source3/Makefile.in b/source3/Makefile.in index 0fbd0464f6..6bf9d0bbea 100644 --- a/source3/Makefile.in +++ b/source3/Makefile.in @@ -1151,6 +1151,11 @@ bin/idmap_rid.@SHLIBEXT@: sam/idmap_rid.@PICSUFFIX@ @$(SHLD) $(LDSHFLAGS) -o $@ sam/idmap_rid.@PICSUFFIX@ \ @SONAMEFLAG@`basename $@` +bin/idmap_ad.@SHLIBEXT@: sam/idmap_ad.@PICSUFFIX@ + @echo "Building plugin $@" + @$(SHLD) $(LDSHFLAGS) -o $@ sam/idmap_ad.@PICSUFFIX@ \ + @SONAMEFLAG@`basename $@` + bin/weird.@SHLIBEXT@: $(DEVEL_HELP_WEIRD_OBJ:.o=.@PICSUFFIX@) @echo "Building plugin $@" @$(SHLD) $(LDSHFLAGS) -o $@ $(DEVEL_HELP_WEIRD_OBJ:.o=.@PICSUFFIX@) \ diff --git a/source3/configure.in b/source3/configure.in index e35c95d932..3f42d9ffed 100644 --- a/source3/configure.in +++ b/source3/configure.in @@ -4641,6 +4641,7 @@ SMB_SUBSYSTEM(RPC,smbd/server.o) SMB_MODULE(idmap_ldap, sam/idmap_ldap.o, "bin/idmap_ldap.$SHLIBEXT", IDMAP) SMB_MODULE(idmap_tdb, sam/idmap_tdb.o, "bin/idmap_tdb.$SHLIBEXT", IDMAP) SMB_MODULE(idmap_rid, sam/idmap_rid.o, "bin/idmap_rid.$SHLIBEXT", IDMAP) +SMB_MODULE(idmap_ad, sam/idmap_ad.o, "bin/idmap_ad.$SHLIBEXT", IDMAP) SMB_SUBSYSTEM(IDMAP,sam/idmap.o) SMB_MODULE(charset_weird, modules/weird.o, "bin/weird.$SHLIBEXT", CHARSET) diff --git a/source3/sam/idmap_ad.c b/source3/sam/idmap_ad.c new file mode 100644 index 0000000000..b3b9b7ad47 --- /dev/null +++ b/source3/sam/idmap_ad.c @@ -0,0 +1,380 @@ +/* + * idmap_ad: map between Active Directory and RFC 2307 accounts + * Copyright (C) 2001-2004 PADL Software Pty Ltd. All rights reserved. + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + */ +/* + * Unix SMB/CIFS implementation. + * + * Winbind ADS backend functions + * + * Copyright (C) Andrew Tridgell 2001 + * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003 + * Copyright (C) Gerald (Jerry) Carter 2004 + * + * This program is free software; you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation; either version 2 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program; if not, write to the Free Software + * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. + */ + +#include "includes.h" + +#undef DBGC_CLASS +#define DBGC_CLASS DBGC_IDMAP + +#ifndef ATTR_UIDNUMBER +/* #define ATTR_UIDNUMBER "msSFU30UidNumber" */ +#define ATTR_UIDNUMBER "uidNumber" +#endif + +#ifndef ATTR_GIDNUMBER +/* #define ATTR_GIDNUMBER "msSFU30GidNumber" */ +#define ATTR_GIDNUMBER "gidNumber" +#endif + +#define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache" + +NTSTATUS init_module(void); + +static ADS_STRUCT *ad_idmap_ads = NULL; +static char *ad_idmap_uri = NULL; + +static ADS_STRUCT *ad_idmap_cached_connection(void) +{ + ADS_STRUCT *ads; + ADS_STATUS status; + BOOL local = False; + +#ifdef ADS_AUTH_EXTERNAL_BIND + local = ((strncmp(ad_idmap_uri, "ldapi://", sizeof("ldapi://") - 1)) == 0); +#endif /* ADS_AUTH_EXTERNAL_BIND */ + + if (ad_idmap_ads != NULL) { + ads = ad_idmap_ads; + + /* check for a valid structure */ + + DEBUG(7, ("Current tickets expire at %d, time is now %d\n", + (uint32) ads->auth.expire, (uint32) time(NULL))); + if ( ads->config.realm && (ads->auth.expire > time(NULL))) { + return ads; + } else { + /* we own this ADS_STRUCT so make sure it goes away */ + ads->is_mine = True; + ads_destroy( &ads ); + ads_kdestroy(WINBIND_CCACHE_NAME); + ad_idmap_ads = NULL; + } + } + + if (!local) { + /* we don't want this to affect the users ccache */ + setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1); + } + + ads = ads_init(NULL, NULL, NULL); + if (!ads) { + DEBUG(1,("ads_init failed\n")); + return NULL; + } + + /* if ad_imap_uri is not empty we try to connect to + * the given URI in smb.conf. Else try to connect to + * one of the DCs + */ + if (*ad_idmap_uri != '\0') { + ads->server.ldap_uri = SMB_STRDUP(ad_idmap_uri); + if (ads->server.ldap_uri == NULL) { + return NULL; + } + } + else { + ads->server.ldap_uri = NULL; + ads->server.ldap_server = NULL; + } + +#ifdef ADS_AUTH_EXTERNAL_BIND + if (local) + ads->auth.flags |= ADS_AUTH_EXTERNAL_BIND; + else +#endif + { + /* the machine acct password might have change - fetch it every time */ + SAFE_FREE(ads->auth.password); + ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL); + + SAFE_FREE(ads->auth.realm); + ads->auth.realm = SMB_STRDUP(lp_realm()); + } + + status = ads_connect(ads); + if (!ADS_ERR_OK(status)) { + DEBUG(1, ("ad_idmap_init: failed to connect to AD\n")); + ads_destroy(&ads); + return NULL; + } + + ads->is_mine = False; + + ad_idmap_ads = ads; + return ads; +} + +static NTSTATUS ad_idmap_init(char *uri) +{ + ad_idmap_uri = SMB_STRDUP(uri); + if (ad_idmap_uri == NULL) { + return NT_STATUS_NO_MEMORY; + } + + return NT_STATUS_OK; +} + +static NTSTATUS ad_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, int id_type) +{ + ADS_STATUS rc; + NTSTATUS status = NT_STATUS_NONE_MAPPED; + const char *attrs[] = { "objectSid", NULL }; + void *res = NULL; + void *msg = NULL; + char *expr = NULL; + fstring sid_string; + int count; + ADS_STRUCT *ads; + + if (sid == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + ads = ad_idmap_cached_connection(); + if (ads == NULL) { + DEBUG(1, ("ad_idmap_get_id_from_sid ADS uninitialized\n")); + return NT_STATUS_NOT_SUPPORTED; + } + + switch (id_type & ID_TYPEMASK) { + case ID_USERID: + if (asprintf(&expr, "(&(|(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d))(%s=%d))", + ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST, + ATTR_UIDNUMBER, (int)unid.uid) == -1) { + return NT_STATUS_NO_MEMORY; + } + break; + case ID_GROUPID: + if (asprintf(&expr, "(&(|(sAMAccountType=%d)(sAMAccountType=%d))(%s=%d))", + ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP, + ATTR_GIDNUMBER, (int)unid.gid) == -1) { + return NT_STATUS_NO_MEMORY; + } + break; + default: + return NT_STATUS_INVALID_PARAMETER; + break; + } + + rc = ads_search_retry(ads, &res, expr, attrs); + free(expr); + if (!ADS_ERR_OK(rc)) { + DEBUG(1, ("ad_idmap_get_sid_from_id: ads_search: %s\n", ads_errstr(rc))); + goto done; + } + + count = ads_count_replies(ads, res); + if (count == 0) { + DEBUG(1, ("ad_idmap_get_sid_from_id: ads_count_replies: no results\n")); + goto done; + } else if (count != 1) { + DEBUG(1, ("ad_idmap_get_sid_from_id: ads_count_replies: incorrect cardinality\n")); + goto done; + } + + msg = ads_first_entry(ads, res); + if (msg == NULL) { + DEBUG(1, ("ad_idmap_get_sid_from_id: ads_first_entry: could not retrieve search result\n")); + goto done; + } + + if (!ads_pull_sid(ads, msg, "objectSid", sid)) { + DEBUG(1, ("ad_idmap_get_sid_from_id: ads_pull_sid: could not retrieve SID from entry\n")); + goto done; + } + + status = NT_STATUS_OK; + DEBUG(1, ("ad_idmap_get_sid_from_id mapped POSIX %s %d to SID [%s]\n", + (id_type == ID_GROUPID) ? "GID" : "UID", (int)unid.uid, + sid_to_string(sid_string, sid))); + +done: + if (res != NULL) { + ads_msgfree(ads, res); + } + + return status; +} + +static NTSTATUS ad_idmap_get_id_from_sid(unid_t *unid, int *id_type, const DOM_SID *sid) +{ + ADS_STATUS rc; + NTSTATUS status = NT_STATUS_NONE_MAPPED; + const char *attrs[] = { "sAMAccountType", ATTR_UIDNUMBER, ATTR_GIDNUMBER, NULL }; + void *res = NULL; + void *msg = NULL; + char *expr = NULL; + uint32 atype, uid; + char *sidstr; + fstring sid_string; + int count; + ADS_STRUCT *ads; + + if (unid == NULL) { + return NT_STATUS_INVALID_PARAMETER; + } + + ads = ad_idmap_cached_connection(); + if (ads == NULL) { + DEBUG(1, ("ad_idmap_get_id_from_sid ADS uninitialized\n")); + return NT_STATUS_NOT_SUPPORTED; + } + + sidstr = sid_binstring(sid); + if (asprintf(&expr, "(objectSid=%s)", sidstr) == -1) { + free(sidstr); + return NT_STATUS_NO_MEMORY; + } + + rc = ads_search_retry(ads, &res, expr, attrs); + free(sidstr); + free(expr); + if (!ADS_ERR_OK(rc)) { + DEBUG(1, ("ad_idmap_get_id_from_sid: ads_search: %s\n", ads_errstr(rc))); + goto done; + } + + count = ads_count_replies(ads, res); + if (count == 0) { + DEBUG(1, ("ad_idmap_get_id_from_sid: ads_count_replies: no results\n")); + goto done; + } else if (count != 1) { + DEBUG(1, ("ad_idmap_get_id_from_sid: ads_count_replies: incorrect cardinality\n")); + goto done; + } + + msg = ads_first_entry(ads, res); + if (msg == NULL) { + DEBUG(1, ("ad_idmap_get_id_from_sid: ads_first_entry: could not retrieve search result\n")); + goto done; + } + + if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype)) { + DEBUG(1, ("ad_idmap_get_id_from_sid: ads_pull_uint32: could not read SAM account type\n")); + goto done; + } + + switch (atype & 0xF0000000) { + case ATYPE_SECURITY_GLOBAL_GROUP: + case ATYPE_SECURITY_LOCAL_GROUP: + *id_type = ID_GROUPID; + break; + case ATYPE_NORMAL_ACCOUNT: + case ATYPE_WORKSTATION_TRUST: + case ATYPE_INTERDOMAIN_TRUST: + *id_type = ID_USERID; + break; + default: + DEBUG(1, ("ad_idmap_get_id_from_sid: unrecognized SAM account type %08x\n", atype)); + goto done; + break; + } + + if (!ads_pull_uint32(ads, msg, (*id_type == ID_GROUPID) ? ATTR_GIDNUMBER : ATTR_UIDNUMBER, &uid)) { + DEBUG(1, ("ad_idmap_get_id_from_sid: ads_pull_uint32: could not read attribute '%s'\n", + (*id_type == ID_GROUPID) ? ATTR_GIDNUMBER : ATTR_UIDNUMBER)); + goto done; + } + + unid->uid = (uid_t)uid; + + status = NT_STATUS_OK; + DEBUG(1, ("ad_idmap_get_id_from_sid mapped SID [%s] to POSIX %s %d\n", + sid_to_string(sid_string, sid), + (*id_type == ID_GROUPID) ? "GID" : "UID", uid)); + +done: + if (res != NULL) { + ads_msgfree(ads, res); + } + + return status; + +} + +static NTSTATUS ad_idmap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) +{ + /* Not supported, and probably won't be... */ + /* (It's not particularly feasible with a single-master model.) */ + + return NT_STATUS_NOT_IMPLEMENTED; +} + +static NTSTATUS ad_idmap_close(void) +{ + ADS_STRUCT *ads = ad_idmap_ads; + + if (ads != NULL) { + /* we own this ADS_STRUCT so make sure it goes away */ + ads->is_mine = True; + ads_destroy( &ads ); + ad_idmap_ads = NULL; + } + + return NT_STATUS_OK; +} + +/* New for beta3 */ +static NTSTATUS ad_idmap_allocate_rid(uint32 *rid, int rid_type) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +static NTSTATUS ad_idmap_allocate_id(unid_t *id, int id_type) +{ + return NT_STATUS_NOT_IMPLEMENTED; +} + +static void ad_idmap_status(void) +{ + DEBUG(0, ("AD IDMAP Status not available\n")); +} + +static struct idmap_methods ad_methods = { + ad_idmap_init, + ad_idmap_allocate_rid, + ad_idmap_allocate_id, + ad_idmap_get_sid_from_id, + ad_idmap_get_id_from_sid, + ad_idmap_set_mapping, + ad_idmap_close, + ad_idmap_status +}; + + +/* support for new authentication subsystem */ +NTSTATUS init_module(void) +{ + return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ad", &ad_methods); +} + |