From 30038de4623bc827ee8019c569faf00583d1fe58 Mon Sep 17 00:00:00 2001 From: Luke Leighton Date: Sun, 29 Nov 1998 20:03:33 +0000 Subject: weekend work. user / group database API. - split sam_passwd and smb_passwd into separate higher-order function tables - renamed struct smb_passwd's "smb_user" to "unix_user". added "nt_user" plus user_rid, and added a "wrap" function in both sam_passwd and smb_passwd password databases to fill in the blank entries that are not obtained from whatever password database API instance is being used. NOTE: whenever a struct smb_passwd or struct sam_passwd is used, it MUST be initialised with pwdb_sam_init() or pwd_smb_init(), see chgpasswd.c for the only example outside of the password database APIs i could find. - added query_useraliases code to rpcclient. - dealt with some nasty interdependencies involving non-smbd programs and the password database API. this is still not satisfactorily resolved completelely, but it's the best i can do for now. - #ifdef'd out some password database options so that people don't mistakenly set them unless they recompile to _use_ those options. lots of debugging done, it's still not finished. the unix/NT uid/gid and user-rid/group-rid issues are better, but not perfect. the "BUILTIN" domain is still missing: users cannot be added to "BUILTIN" groups yet, as we only have an "alias" db API and a "group" db API but not "builtin-alias" db API... (This used to be commit 5d5d7e4de7d1514ab87b07ede629de8aa00519a1) --- source3/rpc_server/srv_lookup.c | 288 +++++++++------------------------------- 1 file changed, 60 insertions(+), 228 deletions(-) (limited to 'source3/rpc_server/srv_lookup.c') diff --git a/source3/rpc_server/srv_lookup.c b/source3/rpc_server/srv_lookup.c index 9981ce0371..fc73edc4ed 100644 --- a/source3/rpc_server/srv_lookup.c +++ b/source3/rpc_server/srv_lookup.c @@ -52,43 +52,9 @@ extern fstring global_sam_name; extern DOM_SID global_sam_sid; extern DOM_SID global_sid_S_1_5_20; -/* - * A list of the rids of well known BUILTIN and Domain users - * and groups. - */ - -rid_name builtin_alias_rids[] = -{ - { BUILTIN_ALIAS_RID_ADMINS , "Administrators" }, - { BUILTIN_ALIAS_RID_USERS , "Users" }, - { BUILTIN_ALIAS_RID_GUESTS , "Guests" }, - { BUILTIN_ALIAS_RID_POWER_USERS , "Power Users" }, - - { BUILTIN_ALIAS_RID_ACCOUNT_OPS , "Account Operators" }, - { BUILTIN_ALIAS_RID_SYSTEM_OPS , "System Operators" }, - { BUILTIN_ALIAS_RID_PRINT_OPS , "Print Operators" }, - { BUILTIN_ALIAS_RID_BACKUP_OPS , "Backup Operators" }, - { BUILTIN_ALIAS_RID_REPLICATOR , "Replicator" }, - { 0 , NULL } -}; - -/* array lookup of well-known Domain RID users. */ -rid_name domain_user_rids[] = -{ - { DOMAIN_USER_RID_ADMIN , "Administrator" }, - { DOMAIN_USER_RID_GUEST , "Guest" }, - { 0 , NULL } -}; - -/* array lookup of well-known Domain RID groups. */ -rid_name domain_group_rids[] = -{ - { DOMAIN_GROUP_RID_ADMINS , "Domain Admins" }, - { DOMAIN_GROUP_RID_USERS , "Domain Users" }, - { DOMAIN_GROUP_RID_GUESTS , "Domain Guests" }, - { 0 , NULL } -}; - +extern rid_name builtin_alias_rids[]; +extern rid_name domain_user_rids[]; +extern rid_name domain_group_rids[]; int make_dom_gids(DOMAIN_GRP *mem, int num_members, DOM_GID **ppgids) { @@ -117,13 +83,20 @@ int make_dom_gids(DOMAIN_GRP *mem, int num_members, DOM_GID **ppgids) char *name = mem[count].name; become_root(True); - status = lookup_group_name(name, &sid, &type); + status = lookup_name(name, &sid, &type); unbecome_root(True); - sid_split_rid(&sid, &rid); - - if (status == 0x0 && sid_equal(&sid, &global_sam_sid)) + if (status == 0x0 && !sid_front_equal(&global_sam_sid, &sid)) + { + fstring sid_str; + sid_to_string(sid_str, &sid); + DEBUG(1,("make_dom_gids: unknown sid %s for groupname %s\n", + sid_str, name)); + } + else if (status == 0x0) { + sid_split_rid(&sid, &rid); + gids = (DOM_GID *)Realloc( gids, sizeof(DOM_GID) * (count+1) ); if (gids == NULL) @@ -141,7 +114,7 @@ int make_dom_gids(DOMAIN_GRP *mem, int num_members, DOM_GID **ppgids) } else { - DEBUG(1,("make_dom_gids: unknown group name %s\n", name)); + DEBUG(1,("make_dom_gids: unknown groupname %s\n", name)); } } @@ -428,7 +401,7 @@ uint32 lookup_user_sid(DOM_SID *sid, char *user_name, uint8 *type) if (disp_info != NULL) { - fstrcpy(user_name, disp_info->smb_name); + fstrcpy(user_name, disp_info->nt_name); DEBUG(5,(" = %s\n", user_name)); return 0x0; } @@ -442,14 +415,21 @@ uint32 lookup_user_sid(DOM_SID *sid, char *user_name, uint8 *type) /******************************************************************* lookup_group_rid ********************************************************************/ -uint32 lookup_group_name(char *grp_name, DOM_SID *sid, uint8 *type) +uint32 lookup_added_group_name(const char *grp_name, const char *domain, + DOM_SID *sid, uint8 *type) { DOMAIN_GRP *grp = NULL; (*type) = SID_NAME_DOM_GRP; - DEBUG(5,("lookup_group_name: name: %s", grp_name)); + DEBUG(5,("lookup_added_group_name: name: %s", grp_name)); - grp = getgroupnam(grp_name, NULL, NULL); + if (!strequal(domain, global_sam_name)) + { + DEBUG(5,(" not our domain\n")); + return 0xC0000000 | NT_STATUS_NONE_MAPPED; + } + + grp = getgroupntnam(grp_name, NULL, NULL); if (grp != NULL) { @@ -465,45 +445,23 @@ uint32 lookup_group_name(char *grp_name, DOM_SID *sid, uint8 *type) } /******************************************************************* - lookup_wk_group_name - ********************************************************************/ -uint32 lookup_wk_group_name(char *group_name, DOM_SID *sid, uint8 *type) -{ - char *grp_name; - int i = -1; /* start do loop at -1 */ - uint32 rid; - (*type) = SID_NAME_WKN_GRP; - - do /* find, if it exists, a group rid for the group name */ - { - i++; - rid = domain_group_rids[i].rid; - grp_name = domain_group_rids[i].name; - - if (strequal(grp_name, group_name)) - { - sid_copy(sid, &global_sam_sid); - sid_append_rid(sid, rid); - - return 0x0; - } - - } while (grp_name != NULL); - - return 0xC0000000 | NT_STATUS_NONE_MAPPED; -} - -/******************************************************************* - lookup_alias_name + lookup_added_alias_name ********************************************************************/ -uint32 lookup_alias_name(char *als_name, DOM_SID *sid, uint8 *type) +uint32 lookup_added_alias_name(const char *als_name, const char *domain, + DOM_SID *sid, uint8 *type) { LOCAL_GRP *als = NULL; (*type) = SID_NAME_ALIAS; - DEBUG(5,("lookup_alias_name: name: %s", als_name)); + DEBUG(5,("lookup_added_alias_name: name: %s\%s", domain, als_name)); - als = getaliasnam(als_name, NULL, NULL); + if (!strequal(domain, global_sam_name)) + { + DEBUG(5,(" not our domain\n")); + return 0xC0000000 | NT_STATUS_NONE_MAPPED; + } + + als = getaliasntnam(als_name, NULL, NULL); if (als != NULL) { @@ -518,40 +476,10 @@ uint32 lookup_alias_name(char *als_name, DOM_SID *sid, uint8 *type) return 0xC0000000 | NT_STATUS_NONE_MAPPED; } -/******************************************************************* - lookup_wk_alias_name - ********************************************************************/ -uint32 lookup_wk_alias_name(char *alias_name, DOM_SID *sid, uint8 *type) -{ - char *als_name; - int i = 0; - uint32 rid; - (*type) = SID_NAME_ALIAS; - - do /* find, if it exists, a alias rid for the alias name*/ - { - rid = builtin_alias_rids[i].rid; - als_name = builtin_alias_rids[i].name; - - i++; - - if (strequal(als_name, alias_name)) - { - sid_copy(sid, &global_sid_S_1_5_20); - sid_append_rid(sid, rid); - - return 0x0; - } - - } while (als_name != NULL); - - return 0xC0000000 | NT_STATUS_NONE_MAPPED; -} - /******************************************************************* lookup_added_user_rid ********************************************************************/ -uint32 lookup_added_user_rids(char *user_name, +uint32 lookup_added_user_rids(char *nt_name, uint32 *usr_rid, uint32 *grp_rid) { struct sam_passwd *sam_pass; @@ -560,7 +488,7 @@ uint32 lookup_added_user_rids(char *user_name, /* find the user account */ become_root(True); - sam_pass = getsam21pwnam(user_name); + sam_pass = getsam21pwntnam(nt_name); unbecome_root(True); if (sam_pass != NULL) @@ -576,14 +504,20 @@ uint32 lookup_added_user_rids(char *user_name, /******************************************************************* lookup_added_user_name ********************************************************************/ -uint32 lookup_added_user_name(char *user_name, DOM_SID *sid, uint8 *type) +static uint32 lookup_added_user_name(const char *nt_name, const char *domain, + DOM_SID *sid, uint8 *type) { struct sam_passwd *sam_pass; (*type) = SID_NAME_USER; + if (!strequal(domain, global_sam_name)) + { + return 0xC0000000 | NT_STATUS_NONE_MAPPED; + } + /* find the user account */ become_root(True); - sam_pass = getsam21pwnam(user_name); + sam_pass = getsam21pwntnam(nt_name); unbecome_root(True); if (sam_pass != NULL) @@ -597,67 +531,18 @@ uint32 lookup_added_user_name(char *user_name, DOM_SID *sid, uint8 *type) return 0xC0000000 | NT_STATUS_NONE_MAPPED; } -/******************************************************************* - lookup_wk_user_name - ********************************************************************/ -uint32 lookup_wk_user_name(char *user_name, DOM_SID *sid, uint8 *type) -{ - char *usr_name; - int i = -1; /* start do loop at -1 */ - (*type) = SID_NAME_USER; - - do /* find, if it exists, a alias rid for the alias name*/ - { - i++; - usr_name = domain_user_rids[i].name; - - } while (usr_name != NULL && !strequal(usr_name, user_name)); - - if (usr_name != NULL) - { - sid_copy(sid, &global_sid_S_1_5_20); - sid_append_rid(sid, domain_user_rids[i].rid); - return 0; - } - - return 0xC0000000 | NT_STATUS_NONE_MAPPED; -} - -/******************************************************************* - lookup_added_grp_name - ********************************************************************/ -uint32 lookup_added_grp_name(char *name, DOM_SID *sid, uint8 *type) -{ - uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED; - - status = (status != 0x0) ? lookup_group_name(name, sid, type) : status; - status = (status != 0x0) ? lookup_alias_name(name, sid, type) : status; - - return status; -} - -/******************************************************************* - lookup_builtin_grp_name - ********************************************************************/ -uint32 lookup_builtin_grp_name(char *name, DOM_SID *sid, uint8 *type) -{ - uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED; - - status = (status != 0x0) ? lookup_wk_group_name(name, sid, type) : status; - status = (status != 0x0) ? lookup_wk_alias_name(name, sid, type) : status; - - return status; -} - /******************************************************************* lookup_grp_name ********************************************************************/ -uint32 lookup_grp_name(char *name, DOM_SID *sid, uint8 *type) +static uint32 lookup_grp_name(const char *name, const char *domain, + DOM_SID *sid, uint8 *type) { uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED; - status = (status != 0x0) ? lookup_builtin_grp_name(name, sid, type) : status; - status = (status != 0x0) ? lookup_added_grp_name (name, sid, type) : status; + status = (status != 0x0) ? lookup_wk_group_name (name, domain, sid, type) : status; + status = (status != 0x0) ? lookup_builtin_alias_name(name, domain, sid, type) : status; + status = (status != 0x0) ? lookup_added_group_name (name, domain, sid, type) : status; + status = (status != 0x0) ? lookup_added_alias_name (name, domain, sid, type) : status; return status; } @@ -665,12 +550,13 @@ uint32 lookup_grp_name(char *name, DOM_SID *sid, uint8 *type) /******************************************************************* lookup_user_name ********************************************************************/ -uint32 lookup_user_name(char *name, DOM_SID *sid, uint8 *type) +static uint32 lookup_user_name(const char *name, const char *domain, + DOM_SID *sid, uint8 *type) { uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED; - status = (status != 0x0) ? lookup_wk_user_name (name, sid, type) : status; - status = (status != 0x0) ? lookup_added_user_name(name, sid, type) : status; + status = (status != 0x0) ? lookup_wk_user_name (name, domain, sid, type) : status; + status = (status != 0x0) ? lookup_added_user_name(name, domain, sid, type) : status; return status; } @@ -692,66 +578,12 @@ uint32 lookup_name(char *name, DOM_SID *sid, uint8 *type) return status; } - status = (status != 0x0) ? lookup_wk_alias_name(user, sid, type) : status; - status = (status != 0x0) ? lookup_alias_name (user, sid, type) : status; - status = (status != 0x0) ? lookup_user_name (name, sid, type) : status; - status = (status != 0x0) ? lookup_grp_name (name, sid, type) : status; + status = (status != 0x0) ? lookup_user_name (name, domain, sid, type) : status; + status = (status != 0x0) ? lookup_grp_name (name, domain, sid, type) : status; #if 0 - status = (status != 0x0) ? lookup_domain_name (user, sid, type) : status; + status = (status != 0x0) ? lookup_domain_name (domain, sid, type) : status; #endif return status; } -/******************************************************************* - lookup_user_rids - ********************************************************************/ -uint32 lookup_user_rids(char *name, uint32 *usr_rid, uint32 *grp_rid) -{ - uint32 status = 0xC0000000 | NT_STATUS_NONE_MAPPED; - uint8 type; - DOM_SID sid; - - /* - * try an ordinary user lookup - */ - - status = lookup_added_user_rids(name, usr_rid, grp_rid); - if (status == 0) - { - return status; - } - - /* - * hm. must be a well-known user, in a well-known group. - */ - - status = lookup_wk_user_name(name, &sid, &type); - sid_split_rid(&sid, usr_rid); - - if (status != 0 || type != SID_NAME_USER) - { - return status; /* ok, maybe not! */ - } - - if (type != SID_NAME_USER) - { - return 0xC0000000 | NT_STATUS_NONE_MAPPED; /* users only... */ - } - - /* - * ok, got the user rid: now try the group rid - */ - - status = lookup_builtin_grp_name(name, &sid, &type); - sid_split_rid(&sid, usr_rid); - - if (type == SID_NAME_DOM_GRP || - type == SID_NAME_ALIAS || - type == SID_NAME_WKN_GRP) - { - status = 0xC0000000 | NT_STATUS_NONE_MAPPED; - } - - return status; -} -- cgit