diff options
Diffstat (limited to 'source3/sam/idmap_smbldap.c')
| -rw-r--r-- | source3/sam/idmap_smbldap.c | 447 |
1 files changed, 0 insertions, 447 deletions
diff --git a/source3/sam/idmap_smbldap.c b/source3/sam/idmap_smbldap.c deleted file mode 100644 index 9850921fa3..0000000000 --- a/source3/sam/idmap_smbldap.c +++ /dev/null @@ -1,447 +0,0 @@ -/* - Unix SMB/CIFS implementation. - - idmap LDAP backend - - Copyright (C) Tim Potter 2000 - Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2003 - Copyright (C) Simo Sorce 2003 - Copyright (C) Gerald Carter 2003 - - This program is free software; you can redistribute it and/or modify - it under the terms of the GNU General Public License as published by - the Free Software Foundation; either version 2 of the License, or - (at your option) any later version. - - This program is distributed in the hope that it will be useful, - but WITHOUT ANY WARRANTY; without even the implied warranty of - MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - GNU General Public License for more details. - - You should have received a copy of the GNU General Public License - along with this program; if not, write to the Free Software - Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. -*/ - -#include "includes.h" - -#undef DBGC_CLASS -#define DBGC_CLASS DBGC_IDMAP - -struct ldap_connection *ldap_conn = NULL; - -/* number tries while allocating new id */ -#define LDAP_MAX_ALLOC_ID 128 - - -/*********************************************************************** - This function cannot be called to modify a mapping, only set a new one -***********************************************************************/ - -static NTSTATUS ldap_set_mapping(const DOM_SID *sid, unid_t id, int id_type) -{ - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - pstring id_str; - const char *type; - fstring sid_string; - struct ldap_message *msg; - struct ldap_message *mod_res = NULL; - char *mod; - - type = (id_type & ID_USERID) ? "uidNumber" : "gidNumber"; - - sid_to_string( sid_string, sid ); - - pstr_sprintf(id_str, "%lu", - ((id_type & ID_USERID) ? - (unsigned long)id.uid : (unsigned long)id.gid)); - - asprintf(&mod, - "dn: sambaSID=%s,%s\n" - "changetype: add\n" - "objectClass: sambaIdmapEntry\n" - "objectClass: sambaSidEntry\n" - "sambaSID: %s\n" - "%s: %lu\n", - sid_string, lp_ldap_idmap_suffix(), sid_string, type, - ((id_type & ID_USERID) ? - (unsigned long)id.uid : (unsigned long)id.gid)); - - msg = ldap_ldif2msg(mod); - - SAFE_FREE(mod); - - if (msg == NULL) - return NT_STATUS_NO_MEMORY; - - mod_res = ldap_transaction(ldap_conn, msg); - - if ((mod_res == NULL) || (mod_res->r.ModifyResponse.resultcode != 0)) - goto out; - - ret = NT_STATUS_OK; - out: - destroy_ldap_message(msg); - destroy_ldap_message(mod_res); - return ret; -} - -/***************************************************************************** - Allocate a new uid or gid -*****************************************************************************/ - -static NTSTATUS ldap_allocate_id(unid_t *id, enum idmap_type id_type) -{ - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - uid_t luid, huid; - gid_t lgid, hgid; - const char *attrs[] = { "uidNumber", "gidNumber" }; - struct ldap_message *idpool_s = NULL; - struct ldap_message *idpool = NULL; - struct ldap_message *mod_msg = NULL; - struct ldap_message *mod_res = NULL; - int value; - const char *id_attrib; - char *mod; - - if (id_type != ID_USERID && id_type != ID_GROUPID) { - return NT_STATUS_INVALID_PARAMETER; - } - - id_attrib = (id_type == ID_USERID) ? "uidNumber" : "gidNumber"; - - idpool_s = new_ldap_search_message(lp_ldap_suffix(), - LDAP_SEARCH_SCOPE_SUB, - "(objectclass=sambaUnixIdPool)", - 2, attrs); - - if (idpool_s == NULL) - return NT_STATUS_NO_MEMORY; - - idpool = ldap_searchone(ldap_conn, idpool_s, NULL); - - if (idpool == NULL) - goto out; - - if (!ldap_find_single_int(idpool, id_attrib, &value)) - goto out; - - /* this must succeed or else we wouldn't have initialized */ - - lp_idmap_uid( &luid, &huid); - lp_idmap_gid( &lgid, &hgid); - - /* make sure we still have room to grow */ - - if (id_type == ID_USERID) { - id->uid = value; - if (id->uid > huid ) { - DEBUG(0,("ldap_allocate_id: Cannot allocate uid " - "above %lu!\n", (unsigned long)huid)); - goto out; - } - } - else { - id->gid = value; - if (id->gid > hgid ) { - DEBUG(0,("ldap_allocate_id: Cannot allocate gid " - "above %lu!\n", (unsigned long)hgid)); - goto out; - } - } - - asprintf(&mod, - "dn: %s\n" - "changetype: modify\n" - "delete: %s\n" - "%s: %d\n" - "-\n" - "add: %s\n" - "%s: %d\n", - idpool->r.SearchResultEntry.dn, id_attrib, id_attrib, value, - id_attrib, id_attrib, value+1); - - mod_msg = ldap_ldif2msg(mod); - - SAFE_FREE(mod); - - if (mod_msg == NULL) - goto out; - - mod_res = ldap_transaction(ldap_conn, mod_msg); - - if ((mod_res == NULL) || (mod_res->r.ModifyResponse.resultcode != 0)) - goto out; - - ret = NT_STATUS_OK; -out: - destroy_ldap_message(idpool_s); - destroy_ldap_message(idpool); - destroy_ldap_message(mod_msg); - destroy_ldap_message(mod_res); - - return ret; -} - -/***************************************************************************** - get a sid from an id -*****************************************************************************/ - -static NTSTATUS ldap_get_sid_from_id(DOM_SID *sid, unid_t id, int id_type) -{ - pstring filter; - const char *type; - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - const char *attr_list[] = { "sambaSID" }; - struct ldap_message *msg; - struct ldap_message *entry = NULL; - char *sid_str; - - type = (id_type & ID_USERID) ? "uidNumber" : "gidNumber"; - - pstr_sprintf(filter, "(&(objectClass=%s)(%s=%lu))", "sambaIdmapEntry", - type, - ((id_type & ID_USERID) ? - (unsigned long)id.uid : (unsigned long)id.gid)); - - msg = new_ldap_search_message(lp_ldap_idmap_suffix(), - LDAP_SEARCH_SCOPE_SUB, - filter, 1, attr_list); - - if (msg == NULL) - return NT_STATUS_NO_MEMORY; - - entry = ldap_searchone(ldap_conn, msg, NULL); - - if (entry == NULL) - goto out; - - if (!ldap_find_single_string(entry, "sambaSID", entry->mem_ctx, - &sid_str)) - goto out; - - if (!string_to_sid(sid, sid_str)) - goto out; - - ret = NT_STATUS_OK; -out: - destroy_ldap_message(msg); - destroy_ldap_message(entry); - - return ret; -} - -/*********************************************************************** - Get an id from a sid -***********************************************************************/ - -static NTSTATUS ldap_get_id_from_sid(unid_t *id, int *id_type, - const DOM_SID *sid) -{ - pstring filter; - const char *type; - NTSTATUS ret = NT_STATUS_UNSUCCESSFUL; - struct ldap_message *msg; - struct ldap_message *entry = NULL; - int i; - - DEBUG(8,("ldap_get_id_from_sid: %s (%s)\n", sid_string_static(sid), - (*id_type & ID_GROUPID ? "group" : "user") )); - - type = ((*id_type) & ID_USERID) ? "uidNumber" : "gidNumber"; - - pstr_sprintf(filter, "(&(objectClass=%s)(%s=%s))", - "sambaIdmapEntry", "sambaSID", sid_string_static(sid)); - - msg = new_ldap_search_message(lp_ldap_idmap_suffix(), - LDAP_SEARCH_SCOPE_SUB, - filter, 1, &type); - - if (msg == NULL) - return NT_STATUS_NO_MEMORY; - - entry = ldap_searchone(ldap_conn, msg, NULL); - - if (entry != NULL) { - int value; - - if (!ldap_find_single_int(entry, type, &value)) - goto out; - - if ((*id_type) & ID_USERID) - id->uid = value; - else - id->gid = value; - - ret = NT_STATUS_OK; - goto out; - } - - if ((*id_type) & ID_QUERY_ONLY) - goto out; - - /* Allocate a new RID */ - - for (i = 0; i < LDAP_MAX_ALLOC_ID; i++) { - ret = ldap_allocate_id(id, *id_type); - if ( NT_STATUS_IS_OK(ret) ) - break; - } - - if ( !NT_STATUS_IS_OK(ret) ) { - DEBUG(0,("Could not allocate id\n")); - goto out; - } - - DEBUG(10,("ldap_get_id_from_sid: Allocated new %cid [%ul]\n", - (*id_type & ID_GROUPID ? 'g' : 'u'), (uint32)id->uid )); - - ret = ldap_set_mapping(sid, *id, *id_type); - -out: - destroy_ldap_message(msg); - destroy_ldap_message(entry); - - return ret; -} - -/********************************************************************** - Verify the sambaUnixIdPool entry in the directory. -**********************************************************************/ -static NTSTATUS verify_idpool(void) -{ - const char *attr_list[3] = { "uidnumber", "gidnumber", "objectclass" }; - BOOL result; - char *mod; - struct ldap_message *msg, *entry, *res; - - uid_t luid, huid; - gid_t lgid, hgid; - - msg = new_ldap_search_message(lp_ldap_suffix(), - LDAP_SEARCH_SCOPE_SUB, - "(objectClass=sambaUnixIdPool)", - 3, attr_list); - - if (msg == NULL) - return NT_STATUS_NO_MEMORY; - - entry = ldap_searchone(ldap_conn, msg, NULL); - - result = (entry != NULL); - - destroy_ldap_message(msg); - destroy_ldap_message(entry); - - if (result) - return NT_STATUS_OK; - - if ( !lp_idmap_uid(&luid, &huid) || !lp_idmap_gid( &lgid, &hgid ) ) { - DEBUG(3,("ldap_idmap_init: idmap uid/gid parameters not " - "specified\n")); - return NT_STATUS_UNSUCCESSFUL; - } - - asprintf(&mod, - "dn: %s\n" - "changetype: modify\n" - "add: objectClass\n" - "objectClass: sambaUnixIdPool\n" - "-\n" - "add: uidNumber\n" - "uidNumber: %lu\n" - "-\n" - "add: gidNumber\n" - "gidNumber: %lu\n", - lp_ldap_idmap_suffix(), - (unsigned long)luid, (unsigned long)lgid); - - msg = ldap_ldif2msg(mod); - - SAFE_FREE(mod); - - if (msg == NULL) - return NT_STATUS_NO_MEMORY; - - res = ldap_transaction(ldap_conn, msg); - - if ((res == NULL) || (res->r.ModifyResponse.resultcode != 0)) { - destroy_ldap_message(msg); - destroy_ldap_message(res); - DEBUG(5, ("Could not add sambaUnixIdPool\n")); - return NT_STATUS_UNSUCCESSFUL; - } - - destroy_ldap_message(msg); - destroy_ldap_message(res); - return NT_STATUS_OK; -} - -/***************************************************************************** - Initialise idmap database. -*****************************************************************************/ - -static NTSTATUS ldap_idmap_init( char *params ) -{ - NTSTATUS nt_status; - char *dn, *pw; - - ldap_conn = new_ldap_connection(); - - if (!fetch_ldap_pw(&dn, &pw)) - return NT_STATUS_UNSUCCESSFUL; - - ldap_conn->auth_dn = talloc_strdup(ldap_conn->mem_ctx, dn); - ldap_conn->simple_pw = talloc_strdup(ldap_conn->mem_ctx, pw); - - SAFE_FREE(dn); - SAFE_FREE(pw); - - if (!ldap_setup_connection(ldap_conn, params, NULL, NULL)) - return NT_STATUS_UNSUCCESSFUL; - - /* see if the idmap suffix and sub entries exists */ - - nt_status = verify_idpool(); - if ( !NT_STATUS_IS_OK(nt_status) ) - return nt_status; - - return NT_STATUS_OK; -} - -/***************************************************************************** - End the LDAP session -*****************************************************************************/ - -static NTSTATUS ldap_idmap_close(void) -{ - - DEBUG(5,("The connection to the LDAP server was closed\n")); - /* maybe free the results here --metze */ - - return NT_STATUS_OK; -} - - -/* This function doesn't make as much sense in an LDAP world since the calling - node doesn't really control the ID ranges */ -static void ldap_idmap_status(void) -{ - DEBUG(0, ("LDAP IDMAP Status not available\n")); -} - -static struct idmap_methods ldap_methods = { - ldap_idmap_init, - ldap_allocate_id, - ldap_get_sid_from_id, - ldap_get_id_from_sid, - ldap_set_mapping, - ldap_idmap_close, - ldap_idmap_status - -}; - -NTSTATUS idmap_smbldap_init(void) -{ - return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "smbldap", &ldap_methods); -} |