From 30038de4623bc827ee8019c569faf00583d1fe58 Mon Sep 17 00:00:00 2001 From: Luke Leighton Date: Sun, 29 Nov 1998 20:03:33 +0000 Subject: weekend work. user / group database API. - split sam_passwd and smb_passwd into separate higher-order function tables - renamed struct smb_passwd's "smb_user" to "unix_user". added "nt_user" plus user_rid, and added a "wrap" function in both sam_passwd and smb_passwd password databases to fill in the blank entries that are not obtained from whatever password database API instance is being used. NOTE: whenever a struct smb_passwd or struct sam_passwd is used, it MUST be initialised with pwdb_sam_init() or pwd_smb_init(), see chgpasswd.c for the only example outside of the password database APIs i could find. - added query_useraliases code to rpcclient. - dealt with some nasty interdependencies involving non-smbd programs and the password database API. this is still not satisfactorily resolved completelely, but it's the best i can do for now. - #ifdef'd out some password database options so that people don't mistakenly set them unless they recompile to _use_ those options. lots of debugging done, it's still not finished. the unix/NT uid/gid and user-rid/group-rid issues are better, but not perfect. the "BUILTIN" domain is still missing: users cannot be added to "BUILTIN" groups yet, as we only have an "alias" db API and a "group" db API but not "builtin-alias" db API... (This used to be commit 5d5d7e4de7d1514ab87b07ede629de8aa00519a1) --- source3/groupdb/aliasdb.c | 40 ++++++++++--- source3/groupdb/aliasfile.c | 27 +++++++-- source3/groupdb/aliasunix.c | 138 +++++++++++++++++--------------------------- source3/groupdb/groupdb.c | 38 +++++++++--- source3/groupdb/groupfile.c | 24 ++++++-- source3/groupdb/groupunix.c | 124 +++++++++++---------------------------- 6 files changed, 190 insertions(+), 201 deletions(-) (limited to 'source3/groupdb') diff --git a/source3/groupdb/aliasdb.c b/source3/groupdb/aliasdb.c index 648700dd86..011eee0f3d 100644 --- a/source3/groupdb/aliasdb.c +++ b/source3/groupdb/aliasdb.c @@ -26,6 +26,7 @@ extern int DEBUGLEVEL; extern fstring global_sam_name; +extern DOM_SID global_sam_sid; /* * NOTE. All these functions are abstracted into a structure @@ -67,7 +68,28 @@ BOOL initialise_alias_db(void) *************************************************************************/ LOCAL_GRP *iterate_getaliasgid(gid_t gid, LOCAL_GRP_MEMBER **mem, int *num_mem) { - return iterate_getaliasrid(pwdb_gid_to_alias_rid(gid), mem, num_mem); + DOM_NAME_MAP gmep; + uint32 rid; + if (!lookupsmbgrpgid(gid, &gmep)) + { + DEBUG(0,("iterate_getaliasgid: gid %d does not map to one of our Domain's Aliases\n", gid)); + return NULL; + } + + if (gmep.type != SID_NAME_ALIAS ) + { + DEBUG(0,("iterate_getaliasgid: gid %d does not map to one of our Domain's Aliases\n", gid)); + return NULL; + } + + sid_split_rid(&gmep.sid, &rid); + if (!sid_equal(&gmep.sid, &global_sam_sid)) + { + DEBUG(0,("iterate_getaliasgid: gid %d does not map into our Domain SID\n", gid)); + return NULL; + } + + return iterate_getaliasrid(rid, mem, num_mem); } /************************************************************************ @@ -108,7 +130,7 @@ LOCAL_GRP *iterate_getaliasrid(uint32 rid, LOCAL_GRP_MEMBER **mem, int *num_mem) Utility function to search alias database by name. use this if your database does not have search facilities. *************************************************************************/ -LOCAL_GRP *iterate_getaliasnam(char *name, LOCAL_GRP_MEMBER **mem, int *num_mem) +LOCAL_GRP *iterate_getaliasntnam(const char *name, LOCAL_GRP_MEMBER **mem, int *num_mem) { LOCAL_GRP *als = NULL; void *fp = NULL; @@ -167,11 +189,11 @@ BOOL add_domain_alias(LOCAL_GRP **alss, int *num_alss, LOCAL_GRP *als) /************************************************************************* checks to see if a user is a member of a domain alias *************************************************************************/ -static BOOL user_is_member(char *user_name, LOCAL_GRP_MEMBER *mem, int num_mem) +static BOOL user_is_member(const char *user_name, LOCAL_GRP_MEMBER *mem, int num_mem) { int i; pstring name; - slprintf(name, sizeof(name)-1, "\\%s\\%s", global_sam_name, user_name); + slprintf(name, sizeof(name)-1, "%s\\%s", global_sam_name, user_name); for (i = 0; i < num_mem; i++) { @@ -190,7 +212,7 @@ static BOOL user_is_member(char *user_name, LOCAL_GRP_MEMBER *mem, int num_mem) gets an array of aliases that a user is in. use this if your database does not have search facilities *************************************************************************/ -BOOL iterate_getuseraliasnam(char *user_name, LOCAL_GRP **alss, int *num_alss) +BOOL iterate_getuseraliasntnam(const char *user_name, LOCAL_GRP **alss, int *num_alss) { LOCAL_GRP *als = NULL; LOCAL_GRP_MEMBER *mem = NULL; @@ -347,9 +369,9 @@ BOOL mod_alias_entry(LOCAL_GRP* als) Routine to search alias database by name. *************************************************************************/ -LOCAL_GRP *getaliasnam(char *name, LOCAL_GRP_MEMBER **mem, int *num_mem) +LOCAL_GRP *getaliasntnam(const char *name, LOCAL_GRP_MEMBER **mem, int *num_mem) { - return aldb_ops->getaliasnam(name, mem, num_mem); + return aldb_ops->getaliasntnam(name, mem, num_mem); } /************************************************************************ @@ -373,9 +395,9 @@ LOCAL_GRP *getaliasgid(gid_t gid, LOCAL_GRP_MEMBER **mem, int *num_mem) /************************************************************************* gets an array of aliases that a user is in. *************************************************************************/ -BOOL getuseraliasnam(char *user_name, LOCAL_GRP **als, int *num_alss) +BOOL getuseraliasntnam(const char *user_name, LOCAL_GRP **als, int *num_alss) { - return aldb_ops->getuseraliasnam(user_name, als, num_alss); + return aldb_ops->getuseraliasntnam(user_name, als, num_alss); } /************************************************************* diff --git a/source3/groupdb/aliasfile.c b/source3/groupdb/aliasfile.c index e73ff39e74..4ae2c25b94 100644 --- a/source3/groupdb/aliasfile.c +++ b/source3/groupdb/aliasfile.c @@ -131,6 +131,7 @@ static LOCAL_GRP *getalsfilepwent(void *vp, LOCAL_GRP_MEMBER **mem, int *num_mem pstring linebuf; char *p; + uint8 type; aldb_init_als(&al_buf); @@ -139,6 +140,8 @@ static LOCAL_GRP *getalsfilepwent(void *vp, LOCAL_GRP_MEMBER **mem, int *num_mem */ while (getfileline(vp, linebuf, sizeof(linebuf)) > 0) { + DOM_NAME_MAP gmep; + /* get alias name */ p = strncpyn(al_buf.name, linebuf, sizeof(al_buf.name), ':'); @@ -190,9 +193,25 @@ static LOCAL_GRP *getalsfilepwent(void *vp, LOCAL_GRP_MEMBER **mem, int *num_mem } } - /* ok, set up the static data structure and return it */ + /* + * look up the gid, turn it into a rid. the _correct_ type of rid */ + */ - al_buf.rid = pwdb_gid_to_alias_rid((gid_t)gidval); + if (!lookupsmbgrpgid((gid_t)gidval, &gmep)) + { + continue; + } + if (gmep.type != SID_NAME_DOM_GRP && + gmep.type != SID_NAME_WKN_GRP)) + { + continue; + } + + sid_split_rid(&gmep.sid, &gp_buf.rid); + if (!sid_equal(&gmep.sid, &global_sam_sid)) + { + continue; + } make_alias_line(linebuf, sizeof(linebuf), &al_buf, mem, num_mem); DEBUG(10,("line: '%s'\n", linebuf)); @@ -237,7 +256,7 @@ static struct aliasdb_ops file_ops = getalsfilepwpos, setalsfilepwpos, - iterate_getaliasnam, /* In aliasdb.c */ + iterate_getaliasntnam, /* In aliasdb.c */ iterate_getaliasgid, /* In aliasdb.c */ iterate_getaliasrid, /* In aliasdb.c */ getalsfilepwent, @@ -245,7 +264,7 @@ static struct aliasdb_ops file_ops = add_alsfileals_entry, mod_alsfileals_entry, - iterate_getuseraliasnam /* in aliasdb.c */ + iterate_getuseraliasntnam /* in aliasdb.c */ }; struct aliasdb_ops *file_initialise_alias_db(void) diff --git a/source3/groupdb/aliasunix.c b/source3/groupdb/aliasunix.c index b9d9dc6856..715e290643 100644 --- a/source3/groupdb/aliasunix.c +++ b/source3/groupdb/aliasunix.c @@ -65,63 +65,14 @@ static BOOL setalsunixpwpos(void *vp, SMB_BIG_UINT tok) return False; } -/************************************************************************* - maps a unix group to a domain sid and an nt alias name. -*************************************************************************/ -static void map_unix_grp_to_nt_als(char *unix_name, - struct group *unix_grp, char *nt_name, DOM_SID *sid) -{ - BOOL found = False; - uint32 rid; - fstring ntname; - fstring ntdomain; - - if (isdigit(unix_name[0])) - { - unix_grp->gr_gid = get_number(unix_name); - unix_grp->gr_name = unix_name; - found = map_alias_gid(unix_grp->gr_gid, sid, ntname, ntdomain); - } - else - { - unix_grp->gr_name = unix_name; - found = map_unix_alias_name(unix_grp->gr_name, sid, ntname, ntdomain); - } - - if (found) - { - /* - * find the NT name represented by this UNIX gid. - * then, only accept NT aliass that are in our domain - */ - - sid_split_rid(sid, &rid); - } - else - { - /* - * assume that the UNIX group is an NT alias with - * the same name. convert gid to a alias rid. - */ - - fstrcpy(ntdomain, global_sam_name); - fstrcpy(ntname, unix_grp->gr_name); - sid_copy(sid, &global_sam_sid); - } - - slprintf(nt_name, sizeof(fstring)-1, "\\%s\\%s", - ntdomain, ntname); -} - /************************************************************************* Routine to return the next entry in the smbdomainalias list. *************************************************************************/ -BOOL get_unixalias_members(struct group *als, +BOOL get_unixalias_members(struct group *grp, int *num_mem, LOCAL_GRP_MEMBER **members) { int i; char *unix_name; - fstring nt_name; if (num_mem == NULL || members == NULL) { @@ -131,28 +82,43 @@ BOOL get_unixalias_members(struct group *als, (*num_mem) = 0; (*members) = NULL; - for (i = 0; (unix_name = als->gr_mem[i]) != NULL; i++) + for (i = 0; (unix_name = grp->gr_mem[i]) != NULL; i++) { - DOM_SID sid; - struct group unix_grp; + fstring name; + DOM_NAME_MAP gmep; + LOCAL_GRP_MEMBER *mem; + + fstrcpy(name, unix_name); - map_unix_grp_to_nt_als(unix_name, &unix_grp, nt_name, &sid); + if (!lookupsmbgrpnam(name, &gmep) && + !lookupsmbpwnam (name, &gmep)) + { + continue; + } - if (!sid_equal(&sid, &global_sam_sid)) + if (!sid_front_equal(&global_sam_sid, &gmep.sid)) { - DEBUG(0,("alias database: could not resolve name %s in domain %s\n", - unix_name, global_sam_name)); + DEBUG(0,("alias database: could not resolve name %s (wrong Domain SID)\n", + name)); continue; } - (*members) = Realloc((*members), ((*num_mem)+1) * sizeof(LOCAL_GRP_MEMBER)); + (*num_mem)++; + (*members) = Realloc((*members), (*num_mem) * sizeof(LOCAL_GRP_MEMBER)); if ((*members) == NULL) { + DEBUG(0,("get_unixalias_members: could not realloc LOCAL_GRP_MEMBERs\n")); return False; } - fstrcpy((*members)[(*num_mem)].name, nt_name); - (*num_mem)++; + mem = &(*members)[(*num_mem)-1]; + slprintf(mem->name, sizeof(mem->name)-1, "%s\\%s", + gmep.nt_domain, gmep.nt_name); + sid_copy(&mem->sid, &gmep.sid); + mem->sid_use = gmep.type; + + DEBUG(10,("get_unixalias_members: adding alias %s\n", + mem->name)); } return True; } @@ -161,7 +127,7 @@ BOOL get_unixalias_members(struct group *als, Routine to return the next entry in the domain alias list. when we are a PDC or BDC, then unix groups that are explicitly NOT mapped - to aliases (map_alias_gid) are treated as DOMAIN groups (see groupunix.c). + to aliases are treated as DOMAIN groups (see groupunix.c). when we are a member of a domain (not a PDC or BDC) then unix groups that are explicitly NOT mapped to aliases (map_alias_gid) are treated @@ -190,36 +156,36 @@ static LOCAL_GRP *getalsunixpwent(void *vp, LOCAL_GRP_MEMBER **mem, int *num_mem aldb_init_als(&gp_buf); - fstrcpy(gp_buf.comment, ""); - /* cycle through unix groups */ while ((unix_grp = getgrent()) != NULL) { - DOM_SID sid; - if (map_alias_gid(unix_grp->gr_gid, &sid, gp_buf.name, NULL)) + DOM_NAME_MAP gmep; + fstring sid_str; + DEBUG(10,("getgrpunixpwent: enum unix group entry %s\n", + unix_grp->gr_name)); + + if (!lookupsmbgrpgid(unix_grp->gr_gid, &gmep)) { - /* - * find the NT name represented by this UNIX gid. - * then, only accept NT aliases that are in our domain - */ - - sid_split_rid(&sid, &gp_buf.rid); - if (sid_equal(&sid, &global_sam_sid)) - { - break; /* hooray. */ - } + continue; } - else if (lp_server_role() == ROLE_DOMAIN_MEMBER) + + sid_to_string(sid_str, &gmep.sid); + DEBUG(10,("group %s found, sid %s type %d\n", + gmep.nt_name, sid_str, gmep.type)); + + if (gmep.type != SID_NAME_ALIAS) { - /* - * if we are a member of a domain, - * assume that the UNIX alias is an NT alias with - * the same name. convert gid to a alias rid. - */ - - fstrcpy(gp_buf.name, unix_grp->gr_name); - gp_buf.rid = pwdb_gid_to_alias_rid(unix_grp->gr_gid); + continue; } + + sid_split_rid(&gmep.sid, &gp_buf.rid); + if (!sid_equal(&global_sam_sid, &gmep.sid)) + { + continue; + } + + fstrcpy(gp_buf.name, gmep.nt_name); + break; } if (unix_grp == NULL) @@ -279,7 +245,7 @@ static struct aliasdb_ops unix_ops = getalsunixpwpos, setalsunixpwpos, - iterate_getaliasnam, /* In aliasdb.c */ + iterate_getaliasntnam, /* In aliasdb.c */ iterate_getaliasgid, /* In aliasdb.c */ iterate_getaliasrid, /* In aliasdb.c */ getalsunixpwent, @@ -287,7 +253,7 @@ static struct aliasdb_ops unix_ops = add_alsunixgrp_entry, mod_alsunixgrp_entry, - iterate_getuseraliasnam /* in aliasdb.c */ + iterate_getuseraliasntnam /* in aliasdb.c */ }; struct aliasdb_ops *unix_initialise_alias_db(void) diff --git a/source3/groupdb/groupdb.c b/source3/groupdb/groupdb.c index 7b9a14c7df..6bd6c34442 100644 --- a/source3/groupdb/groupdb.c +++ b/source3/groupdb/groupdb.c @@ -24,6 +24,7 @@ #include "nterr.h" extern int DEBUGLEVEL; +extern DOM_SID global_sam_sid; /* * NOTE. All these functions are abstracted into a structure @@ -65,7 +66,28 @@ BOOL initialise_group_db(void) *************************************************************************/ DOMAIN_GRP *iterate_getgroupgid(gid_t gid, DOMAIN_GRP_MEMBER **mem, int *num_mem) { - return iterate_getgrouprid(pwdb_gid_to_group_rid(gid), mem, num_mem); + DOM_NAME_MAP gmep; + uint32 rid; + if (!lookupsmbgrpgid(gid, &gmep)) + { + DEBUG(0,("iterate_getgroupgid: gid %d does not map to one of our Domain's Groups\n", gid)); + return NULL; + } + + if (gmep.type != SID_NAME_DOM_GRP && gmep.type != SID_NAME_WKN_GRP) + { + DEBUG(0,("iterate_getgroupgid: gid %d does not map to one of our Domain's Groups\n", gid)); + return NULL; + } + + sid_split_rid(&gmep.sid, &rid); + if (!sid_equal(&gmep.sid, &global_sam_sid)) + { + DEBUG(0,("iterate_getgroupgid: gid %d does not map into our Domain SID\n", gid)); + return NULL; + } + + return iterate_getgrouprid(rid, mem, num_mem); } /************************************************************************ @@ -105,7 +127,7 @@ DOMAIN_GRP *iterate_getgrouprid(uint32 rid, DOMAIN_GRP_MEMBER **mem, int *num_me Utility function to search group database by name. use this if your database does not have search facilities. *************************************************************************/ -DOMAIN_GRP *iterate_getgroupnam(char *name, DOMAIN_GRP_MEMBER **mem, int *num_mem) +DOMAIN_GRP *iterate_getgroupntnam(const char *name, DOMAIN_GRP_MEMBER **mem, int *num_mem) { DOMAIN_GRP *grp = NULL; void *fp = NULL; @@ -165,7 +187,7 @@ BOOL add_domain_group(DOMAIN_GRP **grps, int *num_grps, DOMAIN_GRP *grp) /************************************************************************* checks to see if a user is a member of a domain group *************************************************************************/ -static BOOL user_is_member(char *user_name, DOMAIN_GRP_MEMBER *mem, int num_mem) +static BOOL user_is_member(const char *user_name, DOMAIN_GRP_MEMBER *mem, int num_mem) { int i; for (i = 0; i < num_mem; i++) @@ -185,7 +207,7 @@ static BOOL user_is_member(char *user_name, DOMAIN_GRP_MEMBER *mem, int num_mem) gets an array of groups that a user is in. use this if your database does not have search facilities *************************************************************************/ -BOOL iterate_getusergroupsnam(char *user_name, DOMAIN_GRP **grps, int *num_grps) +BOOL iterate_getusergroupsnam(const char *user_name, DOMAIN_GRP **grps, int *num_grps) { DOMAIN_GRP *grp = NULL; DOMAIN_GRP_MEMBER *mem = NULL; @@ -342,9 +364,9 @@ BOOL mod_group_entry(DOMAIN_GRP* grp) Routine to search group database by name. *************************************************************************/ -DOMAIN_GRP *getgroupnam(char *name, DOMAIN_GRP_MEMBER **mem, int *num_mem) +DOMAIN_GRP *getgroupntnam(const char *name, DOMAIN_GRP_MEMBER **mem, int *num_mem) { - return gpdb_ops->getgroupnam(name, mem, num_mem); + return gpdb_ops->getgroupntnam(name, mem, num_mem); } /************************************************************************ @@ -368,9 +390,9 @@ DOMAIN_GRP *getgroupgid(gid_t gid, DOMAIN_GRP_MEMBER **mem, int *num_mem) /************************************************************************* gets an array of groups that a user is in. *************************************************************************/ -BOOL getusergroupsnam(char *user_name, DOMAIN_GRP **grp, int *num_grps) +BOOL getusergroupsntnam(const char *user_name, DOMAIN_GRP **grp, int *num_grps) { - return gpdb_ops->getusergroupsnam(user_name, grp, num_grps); + return gpdb_ops->getusergroupsntnam(user_name, grp, num_grps); } /************************************************************* diff --git a/source3/groupdb/groupfile.c b/source3/groupdb/groupfile.c index e0f791cafb..e20ba6434c 100644 --- a/source3/groupdb/groupfile.c +++ b/source3/groupdb/groupfile.c @@ -105,7 +105,7 @@ static char *get_group_members(char *p, int *num_mem, DOMAIN_GRP_MEMBER **member if (!found) { - DEBUG(0,("alias database: could not resolve name %s in domain %s\n", + DEBUG(0,("group database: could not resolve name %s in domain %s\n", name, global_sam_name)); continue; } @@ -130,6 +130,7 @@ static DOMAIN_GRP *getgrpfilepwent(void *vp, DOMAIN_GRP_MEMBER **mem, int *num_m { /* Static buffers we will return. */ static DOMAIN_GRP gp_buf; + DOM_NAME_MAP gmep; int gidval; @@ -196,7 +197,22 @@ static DOMAIN_GRP *getgrpfilepwent(void *vp, DOMAIN_GRP_MEMBER **mem, int *num_m /* ok, set up the static data structure and return it */ - gp_buf.rid = pwdb_gid_to_group_rid((gid_t)gidval); + if (!lookupsmbgrpgid((gid_t)gidval, &gmep)) + { + continue; + } + if (gmep.type != SID_NAME_DOM_GRP && + gmep.type != SID_NAME_WKN_GRP)) + { + continue; + } + + sid_split_rid(&gmep.sid, &gp_buf.rid); + if (!sid_equal(&gmep.sid, &global_sam_sid)) + { + continue; + } + gp_buf.attr = 0x07; make_group_line(linebuf, sizeof(linebuf), &gp_buf, mem, num_mem); @@ -242,7 +258,7 @@ static struct groupdb_ops file_ops = getgrpfilepwpos, setgrpfilepwpos, - iterate_getgroupnam, /* In groupdb.c */ + iterate_getgroupntnam, /* In groupdb.c */ iterate_getgroupgid, /* In groupdb.c */ iterate_getgrouprid, /* In groupdb.c */ getgrpfilepwent, @@ -250,7 +266,7 @@ static struct groupdb_ops file_ops = add_grpfilegrp_entry, mod_grpfilegrp_entry, - iterate_getusergroupsnam /* in groupdb.c */ + iterate_getusergroupntnam /* in groupdb.c */ }; struct groupdb_ops *file_initialise_group_db(void) diff --git a/source3/groupdb/groupunix.c b/source3/groupdb/groupunix.c index 56d9584155..e5ad029e48 100644 --- a/source3/groupdb/groupunix.c +++ b/source3/groupdb/groupunix.c @@ -25,7 +25,6 @@ extern int DEBUGLEVEL; extern DOM_SID global_sam_sid; -extern fstring global_sam_name; /*************************************************************** Start to enumerate the grppasswd list. Returns a void pointer @@ -65,48 +64,6 @@ static BOOL setgrpunixpwpos(void *vp, SMB_BIG_UINT tok) return False; } -/************************************************************************* - maps a unix group to a domain sid and an nt group name. -*************************************************************************/ -static void map_unix_grp_to_nt_grp(char *unix_name, - struct group *unix_grp, char *nt_name, DOM_SID *sid) -{ - BOOL found = False; - uint32 rid; - - if (isdigit(unix_name[0])) - { - unix_grp->gr_gid = get_number(unix_name); - unix_grp->gr_name = unix_name; - found = map_group_gid(unix_grp->gr_gid, sid, nt_name, NULL); - } - else - { - unix_grp->gr_name = unix_name; - found = map_unix_group_name(unix_grp->gr_name, sid, nt_name, NULL); - } - - if (found) - { - /* - * find the NT name represented by this UNIX gid. - * then, only accept NT groups that are in our domain - */ - - sid_split_rid(sid, &rid); - } - else - { - /* - * assume that the UNIX group is an NT group with - * the same name. convert gid to a group rid. - */ - - fstrcpy(nt_name, unix_grp->gr_name); - sid_copy(sid, &global_sam_sid); - } -} - /************************************************************************* Routine to return the next entry in the smbdomaingroup list. *************************************************************************/ @@ -115,7 +72,6 @@ BOOL get_unixgroup_members(struct group *grp, { int i; char *unix_name; - fstring nt_name; if (num_mem == NULL || members == NULL) { @@ -127,15 +83,27 @@ BOOL get_unixgroup_members(struct group *grp, for (i = 0; (unix_name = grp->gr_mem[i]) != NULL; i++) { - DOM_SID sid; - struct group unix_grp; + DOM_NAME_MAP gmep; - map_unix_grp_to_nt_grp(unix_name, &unix_grp, nt_name, &sid); + if (!lookupsmbgrpnam(unix_name, &gmep) && + !lookupsmbpwnam (unix_name, &gmep)) + { + continue; + } - if (!sid_equal(&sid, &global_sam_sid)) + if (gmep.type != SID_NAME_DOM_GRP && + gmep.type != SID_NAME_USER && + gmep.type != SID_NAME_WKN_GRP) + { + DEBUG(0,("group database: name %s is not in a Domain Group\n", + unix_name)); + continue; + } + + if (!sid_front_equal(&global_sam_sid, &gmep.sid)) { - DEBUG(0,("group database: could not resolve name %s in domain %s\n", - unix_name, global_sam_name)); + DEBUG(0,("group database: could not resolve name %s (wrong Domain SID)\n", + unix_name)); continue; } @@ -145,7 +113,7 @@ BOOL get_unixgroup_members(struct group *grp, return False; } - fstrcpy((*members)[(*num_mem)].name, nt_name); + fstrcpy((*members)[(*num_mem)].name, gmep.nt_name); (*members)[(*num_mem)].attr = 0x07; (*num_mem)++; } @@ -189,53 +157,29 @@ static DOMAIN_GRP *getgrpunixpwent(void *vp, DOMAIN_GRP_MEMBER **mem, int *num_m /* cycle through unix groups */ while ((unix_grp = getgrent()) != NULL) { - DOM_SID sid; - BOOL is_alias; - + DOM_NAME_MAP gmep; DEBUG(10,("getgrpunixpwent: enum unix group entry %s\n", unix_grp->gr_name)); - is_alias = map_alias_gid(unix_grp->gr_gid, &sid, NULL, NULL); - if (is_alias) + + if (!lookupsmbgrpgid(unix_grp->gr_gid, &gmep)) { - sid_split_rid(&sid, NULL); - is_alias = sid_equal(&sid, &global_sam_sid); + continue; } - if (map_group_gid(unix_grp->gr_gid, &sid, gp_buf.name, NULL)) + if (gmep.type != SID_NAME_DOM_GRP && + gmep.type != SID_NAME_WKN_GRP) { - fstring sid_str; - /* - * find the NT name represented by this UNIX gid. - * then, only accept NT groups that are in our domain - */ - - sid_to_string(sid_str, &sid); - DEBUG(10,("getgrpunixpwent: entry %s mapped to name %s, SID %s\n", - unix_grp->gr_name, gp_buf.name, sid_str)); - - sid_split_rid(&sid, &gp_buf.rid); - if (sid_equal(&sid, &global_sam_sid)) - { - if (!is_alias) - { - break; /* hooray. */ - } - DEBUG(0,("configuration mistake: unix group %s is mapped to both an NT alias and an NT group\n", - gp_buf.name)); - } + continue; } - else if (!is_alias) - { - /* - * assume that the UNIX group is an NT group with - * the same name. convert gid to a group rid. - */ - - fstrcpy(gp_buf.name, unix_grp->gr_name); - gp_buf.rid = pwdb_gid_to_group_rid(unix_grp->gr_gid); - break; + sid_split_rid(&gmep.sid, &gp_buf.rid); + if (!sid_equal(&gmep.sid, &global_sam_sid)) + { + continue; } + + fstrcpy(gp_buf.name, gmep.nt_name); + break; } if (unix_grp == NULL) @@ -295,7 +239,7 @@ static struct groupdb_ops unix_ops = getgrpunixpwpos, setgrpunixpwpos, - iterate_getgroupnam, /* In groupdb.c */ + iterate_getgroupntnam, /* In groupdb.c */ iterate_getgroupgid, /* In groupdb.c */ iterate_getgrouprid, /* In groupdb.c */ getgrpunixpwent, -- cgit