summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
Diffstat (limited to 'source3')
-rw-r--r--source3/nsswitch/wb_client.c146
-rw-r--r--source3/passdb/passdb.c2
-rw-r--r--source3/smbd/uid.c124
3 files changed, 114 insertions, 158 deletions
diff --git a/source3/nsswitch/wb_client.c b/source3/nsswitch/wb_client.c
index eb9a7e9995..49a48074fa 100644
--- a/source3/nsswitch/wb_client.c
+++ b/source3/nsswitch/wb_client.c
@@ -168,41 +168,6 @@ BOOL winbind_uid_to_sid(DOM_SID *sid, uid_t uid)
return (result == NSS_STATUS_SUCCESS);
}
-/* Call winbindd to convert SID to uid. Do not allocate */
-
-BOOL winbind_sid_to_uid_query(uid_t *puid, const DOM_SID *sid)
-{
- struct winbindd_request request;
- struct winbindd_response response;
- int result;
- fstring sid_str;
-
- if (!puid)
- return False;
-
- /* Initialise request */
-
- ZERO_STRUCT(request);
- ZERO_STRUCT(response);
-
- sid_to_string(sid_str, sid);
- fstrcpy(request.data.sid, sid_str);
-
- request.flags = WBFLAG_QUERY_ONLY;
-
- /* Make request */
-
- result = winbindd_request(WINBINDD_SID_TO_UID, &request, &response);
-
- /* Copy out result */
-
- if (result == NSS_STATUS_SUCCESS) {
- *puid = response.data.uid;
- }
-
- return (result == NSS_STATUS_SUCCESS);
-}
-
/* Call winbindd to convert SID to gid */
BOOL winbind_sid_to_gid(gid_t *pgid, const DOM_SID *sid)
@@ -236,41 +201,6 @@ BOOL winbind_sid_to_gid(gid_t *pgid, const DOM_SID *sid)
return (result == NSS_STATUS_SUCCESS);
}
-/* Call winbindd to convert SID to gid. Do not allocate */
-
-BOOL winbind_sid_to_gid_query(gid_t *pgid, const DOM_SID *sid)
-{
- struct winbindd_request request;
- struct winbindd_response response;
- int result;
- fstring sid_str;
-
- if (!pgid)
- return False;
-
- /* Initialise request */
-
- ZERO_STRUCT(request);
- ZERO_STRUCT(response);
-
- sid_to_string(sid_str, sid);
- fstrcpy(request.data.sid, sid_str);
-
- request.flags = WBFLAG_QUERY_ONLY;
-
- /* Make request */
-
- result = winbindd_request(WINBINDD_SID_TO_GID, &request, &response);
-
- /* Copy out result */
-
- if (result == NSS_STATUS_SUCCESS) {
- *pgid = response.data.gid;
- }
-
- return (result == NSS_STATUS_SUCCESS);
-}
-
/* Call winbindd to convert gid to sid */
BOOL winbind_gid_to_sid(DOM_SID *sid, gid_t gid)
@@ -580,4 +510,80 @@ BOOL winbind_delete_group( const char *group )
return result == NSS_STATUS_SUCCESS;
}
+/***********************************************************************/
+#if 0 /* not needed currently since winbindd_acct was added -- jerry */
+
+/* Call winbindd to convert SID to uid. Do not allocate */
+
+BOOL winbind_sid_to_uid_query(uid_t *puid, const DOM_SID *sid)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ int result;
+ fstring sid_str;
+
+ if (!puid)
+ return False;
+
+ /* Initialise request */
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ sid_to_string(sid_str, sid);
+ fstrcpy(request.data.sid, sid_str);
+
+ request.flags = WBFLAG_QUERY_ONLY;
+
+ /* Make request */
+
+ result = winbindd_request(WINBINDD_SID_TO_UID, &request, &response);
+
+ /* Copy out result */
+
+ if (result == NSS_STATUS_SUCCESS) {
+ *puid = response.data.uid;
+ }
+
+ return (result == NSS_STATUS_SUCCESS);
+}
+
+/* Call winbindd to convert SID to gid. Do not allocate */
+
+BOOL winbind_sid_to_gid_query(gid_t *pgid, const DOM_SID *sid)
+{
+ struct winbindd_request request;
+ struct winbindd_response response;
+ int result;
+ fstring sid_str;
+
+ if (!pgid)
+ return False;
+
+ /* Initialise request */
+
+ ZERO_STRUCT(request);
+ ZERO_STRUCT(response);
+
+ sid_to_string(sid_str, sid);
+ fstrcpy(request.data.sid, sid_str);
+
+ request.flags = WBFLAG_QUERY_ONLY;
+
+ /* Make request */
+
+ result = winbindd_request(WINBINDD_SID_TO_GID, &request, &response);
+
+ /* Copy out result */
+
+ if (result == NSS_STATUS_SUCCESS) {
+ *pgid = response.data.gid;
+ }
+
+ return (result == NSS_STATUS_SUCCESS);
+}
+
+#endif /* JERRY */
+
+/***********************************************************************/
diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index 408695d4bd..ae52b3d4f1 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -1195,7 +1195,7 @@ BOOL local_sid_to_gid(gid_t *pgid, const DOM_SID *psid, enum SID_NAME_USE *name_
*name_type = SID_NAME_UNKNOWN;
- /* This call can enumerate grou mappings for foreign sids as well.
+ /* This call can enumerate group mappings for foreign sids as well.
So don't check for a match against our domain SID */
/* we don't need to disable winbindd since the gid is stored in
diff --git a/source3/smbd/uid.c b/source3/smbd/uid.c
index 8d8ce136a9..8d3e7cd9be 100644
--- a/source3/smbd/uid.c
+++ b/source3/smbd/uid.c
@@ -711,10 +711,6 @@ static void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
/*****************************************************************
*THE CANONICAL* convert uid_t to SID function.
- check idmap if uid is in idmap range, otherwise falls back to
- the legacy algorithmic mapping.
- A special cache is used for uids that maps to Wellknown SIDs
- Returns SID pointer.
*****************************************************************/
NTSTATUS uid_to_sid(DOM_SID *psid, uid_t uid)
@@ -752,10 +748,6 @@ NTSTATUS uid_to_sid(DOM_SID *psid, uid_t uid)
/*****************************************************************
*THE CANONICAL* convert gid_t to SID function.
- check idmap if gid is in idmap range, otherwise falls back to
- the legacy algorithmic mapping.
- Group mapping is used for gids that maps to Wellknown SIDs
- Returns SID pointer.
*****************************************************************/
NTSTATUS gid_to_sid(DOM_SID *psid, gid_t gid)
@@ -793,79 +785,56 @@ NTSTATUS gid_to_sid(DOM_SID *psid, gid_t gid)
/*****************************************************************
*THE CANONICAL* convert SID to uid function.
- if it is a foreign sid or it is in idmap rid range check idmap,
- otherwise falls back to the legacy algorithmic mapping.
- A special cache is used for uids that maps to Wellknown SIDs
- Returns True if this name is a user sid and the conversion
- was done correctly, False if not.
*****************************************************************/
NTSTATUS sid_to_uid(const DOM_SID *psid, uid_t *puid)
{
fstring dom_name, name, sid_str;
enum SID_NAME_USE name_type;
- BOOL ret;
if (fetch_uid_from_cache(puid, psid))
return NT_STATUS_OK;
- /* if this is our DIS then go straight to a local lookup */
+ /* if this is our SID then go straight to a local lookup */
if ( sid_compare_domain(get_global_sam_sid(), psid) == 0 ) {
DEBUG(10,("sid_to_uid: my domain (%s) - trying local.\n",
sid_string_static(psid) ));
- if ( (ret = local_sid_to_uid(puid, psid, &name_type)) == True )
- store_uid_sid_cache(psid, *puid);
+ if ( local_sid_to_uid(puid, psid, &name_type) )
+ goto success;
+
+ DEBUG(10,("sid_to_uid: local lookup failed\n"));
- return (ret ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL);
+ return NT_STATUS_UNSUCCESSFUL;
}
+ /* If it is not our local domain, only hope is winbindd */
- /* look up the name and decide if this is a user sid */
-
- if ( (!winbind_lookup_sid(psid, dom_name, name, &name_type)) || (name_type != SID_NAME_USER) ) {
- DEBUG(10,("sid_to_uid: winbind lookup for sid %s failed - trying local.\n",
+ if ( !winbind_lookup_sid(psid, dom_name, name, &name_type) ) {
+ DEBUG(10,("sid_to_uid: winbind lookup for non-local sid %s failed\n",
sid_string_static(psid) ));
-
- if ( (ret = local_sid_to_uid(puid, psid, &name_type)) == True )
- store_uid_sid_cache(psid, *puid);
-
- return (ret ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL);
+
+ return NT_STATUS_UNSUCCESSFUL;
}
- /*
- * Ensure this is a user sid.
- */
+ /* If winbindd does know the SID, ensure this is a user */
if (name_type != SID_NAME_USER) {
- DEBUG(10,("sid_to_uid: winbind lookup succeeded but SID is not a uid (%u)\n",
+ DEBUG(10,("sid_to_uid: winbind lookup succeeded but SID is not a user (%u)\n",
(unsigned int)name_type ));
return NT_STATUS_INVALID_PARAMETER;
}
- /* query only first */
-
- if ( !winbind_sid_to_uid_query(puid, psid) ) {
- DEBUG(10,("sid_to_uid: winbind query for sid %s failed.\n",
- sid_to_string(sid_str, psid) ));
-
- /* see if we have a local mapping */
-
- if ( local_sid_to_uid(puid, psid, &name_type) ) {
- store_uid_sid_cache(psid, *puid);
- return NT_STATUS_OK;
- }
-
- /* Call back to winbind to allocate a new uid */
+ /* get the uid. Has to work or else we are dead in the water */
- if ( !winbind_sid_to_uid(puid, psid) ) {
- DEBUG(10,("sid_to_uid: winbind failed to allocate a new uid for sid %s\n",
- sid_to_string(sid_str, psid) ));
- return NT_STATUS_UNSUCCESSFUL;
- }
+ if ( !winbind_sid_to_uid(puid, psid) ) {
+ DEBUG(10,("sid_to_uid: winbind failed to allocate a new uid for sid %s\n",
+ sid_to_string(sid_str, psid) ));
+ return NT_STATUS_UNSUCCESSFUL;
}
+success:
DEBUG(10,("sid_to_uid: %s -> %u\n", sid_to_string(sid_str, psid),
(unsigned int)*puid ));
@@ -875,75 +844,56 @@ NTSTATUS sid_to_uid(const DOM_SID *psid, uid_t *puid)
}
/*****************************************************************
*THE CANONICAL* convert SID to gid function.
- if it is a foreign sid or it is in idmap rid range check idmap,
- otherwise falls back to the legacy algorithmic mapping.
Group mapping is used for gids that maps to Wellknown SIDs
- Returns True if this name is a user sid and the conversion
- was done correctly, False if not.
*****************************************************************/
NTSTATUS sid_to_gid(const DOM_SID *psid, gid_t *pgid)
{
fstring dom_name, name, sid_str;
enum SID_NAME_USE name_type;
- BOOL ret;
if (fetch_gid_from_cache(pgid, psid))
return NT_STATUS_OK;
/*
* First we must look up the name and decide if this is a group sid.
+ * Group mapping can deal with foreign SIDs
*/
if (!winbind_lookup_sid(psid, dom_name, name, &name_type)) {
DEBUG(10,("sid_to_gid: winbind lookup for sid %s failed - trying local.\n",
sid_to_string(sid_str, psid) ));
- ret = local_sid_to_gid(pgid, psid, &name_type);
- if (ret)
- store_gid_sid_cache(psid, *pgid);
+ if ( local_sid_to_gid(pgid, psid, &name_type) )
+ goto success;
- return (ret ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL);
+ DEBUG(10,("sid_to_gid: no one knows this SID\n"));
+
+ return NT_STATUS_UNSUCCESSFUL;
}
- /*
- * Ensure this is a group sid.
- */
+ /* winbindd knows it; Ensure this is a group sid */
if ((name_type != SID_NAME_DOM_GRP) && (name_type != SID_NAME_ALIAS) && (name_type != SID_NAME_WKN_GRP)) {
DEBUG(10,("sid_to_gid: winbind lookup succeeded but SID is not a known group (%u)\n",
(unsigned int)name_type ));
- ret = local_sid_to_gid(pgid, psid, &name_type);
- if (ret)
- store_gid_sid_cache(psid, *pgid);
- return (ret ? NT_STATUS_OK : NT_STATUS_INVALID_PARAMETER);
+ /* winbindd is running and knows about this SID. Just the wrong type.
+ Don't fallback to a local lookup here */
+
+ return NT_STATUS_INVALID_PARAMETER;
}
-
- /* query only first */
- if ( !winbind_sid_to_gid_query(pgid, psid) ) {
- DEBUG(10,("sid_to_gid: winbind query for sid %s failed.\n",
- sid_to_string(sid_str, psid) ));
-
- /* see if we have a local mapping */
-
- if ( local_sid_to_gid(pgid, psid, &name_type) ) {
- store_gid_sid_cache(psid, *pgid);
- return NT_STATUS_OK;
- }
-
- /* Call back to winbind to allocate a new uid */
+ /* winbindd knows it and it is a type of group; sid_to_gid must succeed
+ or we are dead in the water */
- if ( !winbind_sid_to_gid(pgid, psid) ) {
- DEBUG(10,("sid_to_uid: winbind failed to allocate a new gid for sid %s\n",
- sid_to_string(sid_str, psid) ));
- return NT_STATUS_UNSUCCESSFUL;
- }
- else
- return NT_STATUS_UNSUCCESSFUL;
+ if ( !winbind_sid_to_gid(pgid, psid) ) {
+ DEBUG(10,("sid_to_uid: winbind failed to allocate a new gid for sid %s\n",
+ sid_to_string(sid_str, psid) ));
+ return NT_STATUS_UNSUCCESSFUL;
}
+success:
DEBUG(10,("sid_to_gid: %s -> %u\n", sid_to_string(sid_str, psid),
(unsigned int)*pgid ));