diff options
| -rw-r--r-- | source3/nsswitch/pam_winbind.h | 85 | ||||
| -rw-r--r-- | source3/nsswitch/winbindd_glue.c | 364 | ||||
| -rw-r--r-- | source3/nsswitch/winbindd_misc.c | 159 | ||||
| -rw-r--r-- | source3/nsswitch/winbindd_sid.c | 244 |
4 files changed, 852 insertions, 0 deletions
diff --git a/source3/nsswitch/pam_winbind.h b/source3/nsswitch/pam_winbind.h new file mode 100644 index 0000000000..85707cb4dc --- /dev/null +++ b/source3/nsswitch/pam_winbind.h @@ -0,0 +1,85 @@ +/* pam_winbind header file + (Solaris needs some macros from Linux for common PAM code) + + Shirish Kalele 2000 +*/ + +#ifdef HAVE_FEATURES_H +#include <features.h> +#endif + +#include <stdlib.h> +#include <unistd.h> +#include <string.h> +#include <syslog.h> +#include <stdarg.h> +#include <sys/types.h> +#include <sys/stat.h> +#include <fcntl.h> +#include <errno.h> + +#include <config.h> + +#define MODULE_NAME "pam_winbind" +#define PAM_SM_AUTH +#define PAM_SM_ACCOUNT +#define PAM_SM_PASSWORD + +#if defined(SUNOS5) || defined(SUNOS4) + +/* Solaris always uses dynamic pam modules */ +#define PAM_EXTERN extern +#include <security/pam_appl.h> + +#define PAM_AUTHTOK_RECOVER_ERR PAM_AUTHTOK_RECOVERY_ERR +#endif + +#include <security/pam_modules.h> + +#ifdef HAVE_SECURITY__PAM_MACROS_H +#include <security/_pam_macros.h> +#else +/* Define required macros from (Linux PAM 0.68) security/_pam_macros.h */ +#define _pam_drop_reply(/* struct pam_response * */ reply, /* int */ replies) \ +do { \ + int reply_i; \ + \ + for (reply_i=0; reply_i<replies; ++reply_i) { \ + if (reply[reply_i].resp) { \ + _pam_overwrite(reply[reply_i].resp); \ + free(reply[reply_i].resp); \ + } \ + } \ + if (reply) \ + free(reply); \ +} while (0) + +#define _pam_overwrite(x) \ +do { \ + register char *__xx__; \ + if ((__xx__=(x))) \ + while (*__xx__) \ + *__xx__++ = '\0'; \ +} while (0) + +/* + * Don't just free it, forget it too. + */ + +#define _pam_drop(X) \ +do { \ + if (X) { \ + free(X); \ + X=NULL; \ + } \ +} while (0) + +#define x_strdup(s) ( (s) ? strdup(s):NULL ) +#endif + +#define PAM_DEBUG_ARG (1<<0) +#define PAM_USE_AUTHTOK_ARG (1<<1) +#define PAM_UNKNOWN_OK_ARG (1<<2) + +#include "winbind_nss_config.h" +#include "winbindd_nss.h" diff --git a/source3/nsswitch/winbindd_glue.c b/source3/nsswitch/winbindd_glue.c new file mode 100644 index 0000000000..ac8c60d26c --- /dev/null +++ b/source3/nsswitch/winbindd_glue.c @@ -0,0 +1,364 @@ +/* + Unix SMB/Netbios implementation. + Version 2.0 + + Winbind daemon glue functions to connect new cli interface + to older style lsa_ and samr_ functions + + Copyright (C) tridge@samba.org 2001 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "winbindd.h" + +/**************************************************************************** +do a LSA Open Policy +****************************************************************************/ +BOOL lsa_open_policy(char *server, BOOL sec_qos, uint32 des_access, + CLI_POLICY_HND *pol) +{ + struct nmb_name calling, called; + struct ntuser_creds creds; + struct in_addr dest_ip; + fstring dest_host; + uint32 result = NT_STATUS_UNSUCCESSFUL; + extern pstring global_myname; + + ZERO_STRUCTP(pol); + + pol->cli = (struct cli_state *)malloc(sizeof(struct cli_state)); + pol->mem_ctx = talloc_init(); + + if (!pol->cli || !pol->mem_ctx) + return False; + + /* Initialise RPC connection */ + + ZERO_STRUCT(creds); + creds.pwd.null_pwd = 1; + + cli_init_creds(pol->cli, &creds); + + /* Establish a SMB connection */ + + if (!resolve_srv_name(server, dest_host, &dest_ip)) { + goto done; + } + + make_nmb_name(&called, dns_to_netbios_name(dest_host), 0x20); + make_nmb_name(&calling, dns_to_netbios_name(global_myname), 0); + + if (!cli_establish_connection(pol->cli, dest_host, &dest_ip, &calling, + &called, "IPC$", "IPC", False, True)) { + goto done; + } + + if (!cli_nt_session_open (pol->cli, PIPE_LSARPC)) { + goto done; + } + + result = cli_lsa_open_policy(pol->cli, pol->mem_ctx, sec_qos, + des_access, &pol->handle); + + done: + if (result != NT_STATUS_NOPROBLEMO && pol->cli) { + if (pol->cli->initialised) + cli_shutdown(pol->cli); + free(pol->cli); + } + + return (result == NT_STATUS_NOPROBLEMO); +} + +/**************************************************************************** +do a LSA Enumerate Trusted Domain +****************************************************************************/ +BOOL lsa_enum_trust_dom(CLI_POLICY_HND *hnd, uint32 *enum_ctx, + uint32 * num_doms, char ***names, DOM_SID **sids) +{ + uint32 ret; + + ret = cli_lsa_enum_trust_dom(hnd->cli, hnd->mem_ctx, &hnd->handle, + enum_ctx, num_doms, names, sids); + + return (ret == NT_STATUS_NOPROBLEMO); +} + +/**************************************************************************** +do a LSA Query Info Policy +****************************************************************************/ +BOOL lsa_query_info_pol(CLI_POLICY_HND *hnd, uint16 info_class, + fstring domain_name, DOM_SID *domain_sid) +{ + uint32 ret; + + ret = cli_lsa_query_info_policy(hnd->cli, hnd->mem_ctx, &hnd->handle, + info_class, domain_name, domain_sid); + + return (ret == NT_STATUS_NOPROBLEMO); +} + +/**************************************************************************** +do a LSA Lookup Names +****************************************************************************/ +BOOL lsa_lookup_names(CLI_POLICY_HND *hnd, int num_names, char **names, + DOM_SID **sids, uint32 **types, int *num_sids) +{ + uint32 ret; + + ret = cli_lsa_lookup_names(hnd->cli, hnd->mem_ctx, &hnd->handle, + num_names, names, sids, types, num_sids); + + return (ret == NT_STATUS_NOPROBLEMO); +} + +/**************************************************************************** +do a LSA Lookup SIDS +****************************************************************************/ +BOOL lsa_lookup_sids(CLI_POLICY_HND *hnd, int num_sids, DOM_SID *sids, + char ***names, uint32 **types, int *num_names) +{ + uint32 ret; + + ret = cli_lsa_lookup_sids(hnd->cli, hnd->mem_ctx, &hnd->handle, + num_sids, sids, names, types, num_names); + + return (ret == NT_STATUS_NOPROBLEMO); +} + +/**************************************************************************** +lsa_close glue +****************************************************************************/ +BOOL lsa_close(CLI_POLICY_HND *hnd) +{ + uint32 ret; + + ret = cli_lsa_close(hnd->cli, hnd->mem_ctx, &hnd->handle); + + return (ret == NT_STATUS_NOPROBLEMO); +} + + +/**************************************************************************** +samr_close glue +****************************************************************************/ +BOOL samr_close(CLI_POLICY_HND *hnd) +{ + uint32 ret; + + ret = cli_samr_close(hnd->cli, hnd->mem_ctx, &hnd->handle); + + return (ret == NT_STATUS_NOPROBLEMO); +} + + +/**************************************************************************** +samr_connect glue +****************************************************************************/ +BOOL samr_connect(char *srv_name, uint32 access_mask, + CLI_POLICY_HND *connect_pol) +{ + uint32 ret; + + ret = cli_samr_connect(connect_pol->cli, connect_pol->mem_ctx, + srv_name, access_mask, + &connect_pol->handle); + + return (ret == NT_STATUS_NOPROBLEMO); +} + + +/**************************************************************************** +samr_open_domain glue +****************************************************************************/ +BOOL samr_open_domain(CLI_POLICY_HND *connect_pol, + uint32 ace_perms, + DOM_SID *sid, + CLI_POLICY_HND *domain_pol) +{ + uint32 ret; + + ret = cli_samr_open_domain(connect_pol->cli, + connect_pol->mem_ctx, + &connect_pol->handle, + ace_perms, + sid, + &domain_pol->handle); + + if (ret == NT_STATUS_NOPROBLEMO) { + domain_pol->cli = connect_pol->cli; + return True; + } + + return False; +} + +/******************************************************************* +frees a structure. +********************************************************************/ +void free_samr_userinfo_ctr(SAM_USERINFO_CTR * ctr) +{ + if (ctr == NULL) + return; + safe_free(ctr->info.id); + ctr->info.id = NULL; +} + +/**************************************************************************** +do a SAMR enumerate groups +****************************************************************************/ +uint32 samr_enum_dom_groups(CLI_POLICY_HND *pol, + uint32 *start_idx, uint32 size, + struct acct_info **sam, + uint32 *num_sam_groups) +{ + DEBUG(0,("unimplemented samr_enum_dom_groups\n")); + return -1; +} + +/**************************************************************************** +do a SAMR enumerate groups +****************************************************************************/ +BOOL get_samr_query_userinfo(CLI_POLICY_HND *pol, uint32 info_level, + uint32 user_rid, SAM_USERINFO_CTR *ctr) +{ + POLICY_HND user_pol; + BOOL got_user_pol = False; + uint32 result; + + if ((result = cli_samr_open_user(pol->cli, pol->mem_ctx, + &pol->handle, MAXIMUM_ALLOWED_ACCESS, + user_rid, &user_pol)) + != NT_STATUS_NOPROBLEMO) + goto done; + + got_user_pol = True; + + if ((result = cli_samr_query_userinfo(pol->cli, pol->mem_ctx, + &user_pol, info_level, ctr)) + != NT_STATUS_NOPROBLEMO) + goto done; + + done: + if (got_user_pol) cli_samr_close(pol->cli, pol->mem_ctx, &user_pol); + + return (result != NT_STATUS_NOPROBLEMO); +} + +/**************************************************************************** +do a SAMR enumerate groups +****************************************************************************/ +BOOL samr_open_user(CLI_POLICY_HND *pol, uint32 access_mask, uint32 rid, + POLICY_HND *user_pol) +{ + uint32 ret; + + ret = cli_samr_open_user(pol->cli, pol->mem_ctx, &pol->handle, + access_mask, rid, user_pol); + + return (ret == NT_STATUS_NOPROBLEMO); +} + +BOOL samr_query_usergroups(CLI_POLICY_HND *pol, uint32 *num_groups, + DOM_GID **gid) +{ + uint32 ret; + + ret = cli_samr_query_usergroups(pol->cli, pol->mem_ctx, &pol->handle, + num_groups, gid); + + return (ret == NT_STATUS_NOPROBLEMO); +} + +BOOL get_samr_query_groupinfo(CLI_POLICY_HND *pol, uint32 info_level, + uint32 group_rid, GROUP_INFO_CTR *ctr) +{ + POLICY_HND group_pol; + BOOL got_group_pol = False; + uint32 result; + + if ((result = cli_samr_open_group(pol->cli, pol->mem_ctx, + &pol->handle, MAXIMUM_ALLOWED_ACCESS, + group_rid, &group_pol)) + != NT_STATUS_NOPROBLEMO) + goto done; + + got_group_pol = True; + + if ((result = cli_samr_query_groupinfo(pol->cli, pol->mem_ctx, + &group_pol, info_level, + ctr)) != NT_STATUS_NOPROBLEMO) + goto done; + + done: + if (got_group_pol) cli_samr_close(pol->cli, pol->mem_ctx, &group_pol); + + return (result == NT_STATUS_NOPROBLEMO); +} + +BOOL sam_query_groupmem(CLI_POLICY_HND *pol, uint32 group_rid, + uint32 *num_names, uint32 **rid_mem, char ***names, + uint32 **name_types) +{ + BOOL got_group_pol = False; + POLICY_HND group_pol; + uint32 result; + + if ((result = cli_samr_open_group(pol->cli, pol->mem_ctx, + &pol->handle, MAXIMUM_ALLOWED_ACCESS, + group_rid, &group_pol)) + != NT_STATUS_NOPROBLEMO) + goto done; + + got_group_pol = True; + + if ((result = cli_samr_query_groupmem(pol->cli, pol->mem_ctx, + &group_pol, num_names, rid_mem, + name_types)) + != NT_STATUS_NOPROBLEMO) + goto done; + + /* do a samr_query_lookup_rids() */ + + done: + if (got_group_pol) cli_samr_close(pol->cli, pol->mem_ctx, &group_pol); + + return (result == NT_STATUS_NOPROBLEMO); +} + +BOOL samr_query_dom_info(CLI_POLICY_HND *pol, uint16 switch_value, + SAM_UNK_CTR *ctr) +{ + uint32 ret; + + ret = cli_samr_query_dom_info(pol->cli, pol->mem_ctx, + &pol->handle, switch_value, ctr); + + return (ret == NT_STATUS_NOPROBLEMO); +} + +BOOL samr_query_dispinfo(CLI_POLICY_HND *pol, uint32 *start_ndx, + uint16 info_level, uint32 *num_entries, + SAM_DISPINFO_CTR *ctr) +{ + uint32 ret; + + ret = cli_samr_query_dispinfo(pol->cli, pol->mem_ctx, + &pol->handle, start_ndx, info_level, + num_entries, 0xffff, ctr); + + return (ret == NT_STATUS_NOPROBLEMO); +} diff --git a/source3/nsswitch/winbindd_misc.c b/source3/nsswitch/winbindd_misc.c new file mode 100644 index 0000000000..182f983efb --- /dev/null +++ b/source3/nsswitch/winbindd_misc.c @@ -0,0 +1,159 @@ +/* + Unix SMB/Netbios implementation. + Version 2.0 + + Winbind daemon - miscellaneous other functions + + Copyright (C) Tim Potter 2000 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "winbindd.h" + +extern pstring global_myname; + +/* Some routines to fetch the trust account password from a HEAD + version of Samba. Yuck. )-: */ + +/************************************************************************ +form a key for fetching a domain trust password from +************************************************************************/ +static char *trust_keystr(char *domain) +{ + static fstring keystr; + + snprintf(keystr,sizeof(keystr),"%s/%s", SECRETS_MACHINE_ACCT_PASS, + domain); + + return keystr; +} + +/************************************************************************ + Routine to get the trust account password for a domain +************************************************************************/ +BOOL _get_trust_account_password(char *domain, unsigned char *ret_pwd, + time_t *pass_last_set_time) +{ + struct machine_acct_pass *pass; + fstring dos_domain; + size_t size; + + fstrcpy(dos_domain, domain); + unix_to_dos(dos_domain, True); + + if (!(pass = secrets_fetch(trust_keystr(dos_domain), &size)) || + size != sizeof(*pass)) return False; + + if (pass_last_set_time) *pass_last_set_time = pass->mod_time; + memcpy(ret_pwd, pass->hash, 16); + free(pass); + return True; +} + +/* Check the machine account password is valid */ + +enum winbindd_result winbindd_check_machine_acct( + struct winbindd_cli_state *state) +{ + int result = WINBINDD_ERROR; + uchar trust_passwd[16]; + struct in_addr *ip_list = NULL; + int count; + uint16 validation_level; + fstring controller, trust_account; + + DEBUG(3, ("[%5d]: check machine account\n", state->pid)); + + /* Get trust account password */ + + if (!_get_trust_account_password(lp_workgroup(), trust_passwd, NULL)) { + result = NT_STATUS_INTERNAL_ERROR; + goto done; + } + + /* Get domain controller */ + + if (!get_dc_list(True, lp_workgroup(), &ip_list, &count) || + !lookup_pdc_name(global_myname, lp_workgroup(), &ip_list[0], + controller)) { + DEBUG(0, ("could not find domain controller for " + "domain %s\n", lp_workgroup())); + result = NT_STATUS_DOMAIN_CONTROLLER_NOT_FOUND; + goto done; + } + + DEBUG(3, ("contacting controller %s to check secret\n", controller)); + + /* Contact domain controller to check secret */ + + slprintf(trust_account, sizeof(trust_account) - 1, "%s$", + global_myname); + +#if 0 /* XXX */ + result = cli_nt_setup_creds(controller, lp_workgroup(), global_myname, + trust_account, trust_passwd, + SEC_CHAN_WKSTA, &validation_level); +#endif + + /* Pass back result code - zero for success, other values for + specific failures. */ + + DEBUG(3, ("secret is %s\n", (result == NT_STATUS_NOPROBLEMO) ? + "good" : "bad")); + + done: + state->response.data.num_entries = result; + return WINBINDD_OK; +} + +enum winbindd_result winbindd_list_trusted_domains(struct winbindd_cli_state + *state) +{ + struct winbindd_domain *domain; + int total_entries = 0, extra_data_len = 0; + char *extra_data = NULL; + + DEBUG(3, ("[%5d]: list trusted domains\n", state->pid)); + + for(domain = domain_list; domain; domain = domain->next) { + + /* Skip own domain */ + + if (strequal(domain->name, lp_workgroup())) continue; + + /* Add domain to list */ + + total_entries++; + extra_data = Realloc(extra_data, sizeof(fstring) * + total_entries); + + if (!extra_data) return WINBINDD_ERROR; + + memcpy(&extra_data[extra_data_len], domain->name, + strlen(domain->name)); + + extra_data_len += strlen(domain->name); + extra_data[extra_data_len++] = ','; + } + + if (extra_data) { + if (extra_data_len > 1) extra_data[extra_data_len - 1] = '\0'; + state->response.extra_data = extra_data; + state->response.length += extra_data_len; + } + + return WINBINDD_OK; +} diff --git a/source3/nsswitch/winbindd_sid.c b/source3/nsswitch/winbindd_sid.c new file mode 100644 index 0000000000..bc014f2691 --- /dev/null +++ b/source3/nsswitch/winbindd_sid.c @@ -0,0 +1,244 @@ +/* + Unix SMB/Netbios implementation. + Version 2.0 + + Winbind daemon - sid related functions + + Copyright (C) Tim Potter 2000 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#include "winbindd.h" +#include "sids.h" + +/* Convert a string */ + +enum winbindd_result winbindd_lookupsid(struct winbindd_cli_state *state) +{ + extern DOM_SID global_sid_Builtin; + enum SID_NAME_USE type; + DOM_SID sid, tmp_sid; + uint32 rid; + fstring name; + + DEBUG(3, ("[%5d]: lookupsid %s\n", state->pid, + state->request.data.sid)); + + /* Lookup sid from PDC using lsa_lookup_sids() */ + + string_to_sid(&sid, state->request.data.sid); + + /* Don't look up BUILTIN sids */ + + sid_copy(&tmp_sid, &sid); + sid_split_rid(&tmp_sid, &rid); + + if (sid_equal(&tmp_sid, &global_sid_Builtin)) { + return WINBINDD_ERROR; + } + + /* Lookup the sid */ + + if (!winbindd_lookup_name_by_sid(&sid, name, &type)) { + return WINBINDD_ERROR; + } + + string_sub(name, "\\", lp_winbind_separator(), sizeof(fstring)); + fstrcpy(state->response.data.name.name, name); + state->response.data.name.type = type; + + return WINBINDD_OK; +} + +/* Convert a sid to a string */ + +enum winbindd_result winbindd_lookupname(struct winbindd_cli_state *state) +{ + enum SID_NAME_USE type; + fstring sid_str, name_domain, name_user, name; + DOM_SID sid; + + DEBUG(3, ("[%5d]: lookupname %s\n", state->pid, + state->request.data.name)); + + parse_domain_user(state->request.data.name, name_domain, name_user); + + snprintf(name, sizeof(name), "%s\\%s", name_domain, name_user); + + /* Lookup name from PDC using lsa_lookup_names() */ + + if (!winbindd_lookup_sid_by_name(name, &sid, &type)) { + return WINBINDD_ERROR; + } + + sid_to_string(sid_str, &sid); + fstrcpy(state->response.data.sid.sid, sid_str); + state->response.data.sid.type = type; + + return WINBINDD_OK; +} + +/* Convert a sid to a uid. We assume we only have one rid attached to the + sid. */ + +enum winbindd_result winbindd_sid_to_uid(struct winbindd_cli_state *state) +{ + DOM_SID sid; + uint32 user_rid; + struct winbindd_domain *domain; + + DEBUG(3, ("[%5d]: sid to uid %s\n", state->pid, + state->request.data.sid)); + + /* Split sid into domain sid and user rid */ + + string_to_sid(&sid, state->request.data.sid); + sid_split_rid(&sid, &user_rid); + + /* Find domain this sid belongs to */ + + if ((domain = find_domain_from_sid(&sid)) == NULL) { + fstring sid_str; + + sid_to_string(sid_str, &sid); + DEBUG(1, ("Could not find domain for sid %s\n", sid_str)); + return WINBINDD_ERROR; + } + + /* Find uid for this sid and return it */ + + if (!winbindd_idmap_get_uid_from_rid(domain->name, user_rid, + &state->response.data.uid)) { + DEBUG(1, ("Could not get uid for sid %s\n", + state->request.data.sid)); + return WINBINDD_ERROR; + } + + return WINBINDD_OK; +} + +/* Convert a sid to a gid. We assume we only have one rid attached to the + sid.*/ + +enum winbindd_result winbindd_sid_to_gid(struct winbindd_cli_state *state) +{ + DOM_SID sid; + uint32 group_rid; + struct winbindd_domain *domain; + + DEBUG(3, ("[%5d]: sid to gid %s\n", state->pid, + state->request.data.sid)); + + /* Split sid into domain sid and user rid */ + + string_to_sid(&sid, state->request.data.sid); + sid_split_rid(&sid, &group_rid); + + /* Find domain this sid belongs to */ + + if ((domain = find_domain_from_sid(&sid)) == NULL) { + fstring sid_str; + + sid_to_string(sid_str, &sid); + DEBUG(1, ("Could not find domain for sid %s\n", sid_str)); + return WINBINDD_ERROR; + } + + /* Find uid for this sid and return it */ + + if (!winbindd_idmap_get_gid_from_rid(domain->name, group_rid, + &state->response.data.gid)) { + DEBUG(1, ("Could not get gid for sid %s\n", + state->request.data.sid)); + return WINBINDD_ERROR; + } + + return WINBINDD_OK; +} + +/* Convert a uid to a sid */ + +enum winbindd_result winbindd_uid_to_sid(struct winbindd_cli_state *state) +{ + struct winbindd_domain *domain; + uint32 user_rid; + DOM_SID sid; + + /* Bug out if the uid isn't in the winbind range */ + + if ((state->request.data.uid < server_state.uid_low ) || + (state->request.data.uid > server_state.uid_high)) { + return WINBINDD_ERROR; + } + + DEBUG(3, ("[%5d]: uid to sid %d\n", state->pid, + state->request.data.uid)); + + /* Lookup rid for this uid */ + + if (!winbindd_idmap_get_rid_from_uid(state->request.data.uid, + &user_rid, &domain)) { + DEBUG(1, ("Could not convert uid %d to rid\n", + state->request.data.uid)); + return WINBINDD_ERROR; + } + + /* Construct sid and return it */ + + sid_copy(&sid, &domain->sid); + sid_append_rid(&sid, user_rid); + sid_to_string(state->response.data.sid.sid, &sid); + state->response.data.sid.type = SID_NAME_USER; + + return WINBINDD_OK; +} + +/* Convert a gid to a sid */ + +enum winbindd_result winbindd_gid_to_sid(struct winbindd_cli_state *state) +{ + struct winbindd_domain *domain; + uint32 group_rid; + DOM_SID sid; + + /* Bug out if the gid isn't in the winbind range */ + + if ((state->request.data.gid < server_state.gid_low) || + (state->request.data.gid > server_state.gid_high)) { + return WINBINDD_ERROR; + } + + DEBUG(3, ("[%5d]: gid to sid %d\n", state->pid, + state->request.data.gid)); + + /* Lookup rid for this uid */ + + if (!winbindd_idmap_get_rid_from_gid(state->request.data.gid, + &group_rid, &domain)) { + DEBUG(1, ("Could not convert gid %d to rid\n", + state->request.data.gid)); + return WINBINDD_ERROR; + } + + /* Construct sid and return it */ + + sid_copy(&sid, &domain->sid); + sid_append_rid(&sid, group_rid); + sid_to_string(state->response.data.sid.sid, &sid); + state->response.data.sid.type = SID_NAME_DOM_GRP; + + return WINBINDD_OK; +} |