From 7b53a92f59984211e5ceb731163efa6e767e55a3 Mon Sep 17 00:00:00 2001 From: Jean-François Micouleau Date: Wed, 5 Dec 2001 15:41:44 +0000 Subject: added samr_queryuseralias(). instead of returning BUILTIN_ALIAS_RID_USERS, now return the alias correctly. time to look at the netlogon case. J.F. (This used to be commit 72ee1791084d09e73d8057e37ced4a79cecffb35) --- source3/rpc_server/srv_util.c | 180 ++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 180 insertions(+) (limited to 'source3/rpc_server/srv_util.c') diff --git a/source3/rpc_server/srv_util.c b/source3/rpc_server/srv_util.c index 497771dcab..80090cf6e0 100644 --- a/source3/rpc_server/srv_util.c +++ b/source3/rpc_server/srv_util.c @@ -150,6 +150,183 @@ int make_dom_gids(TALLOC_CTX *ctx, char *gids_str, DOM_GID **ppgids) return count; } +/******************************************************************* + gets a domain user's groups + ********************************************************************/ +NTSTATUS new_get_alias_user_groups(TALLOC_CTX *ctx, DOM_SID *sid, int *numgroups, uint32 **prids, DOM_SID *q_sid) +{ + SAM_ACCOUNT *sam_pass=NULL; + char *sep; + struct sys_grent *glist; + struct sys_grent *grp; + int i, num, cur_rid=0; + gid_t *gid; + GROUP_MAP map; + DOM_SID tmp_sid; + fstring user_name; + fstring str_domsid, str_qsid; + uint32 rid,grid; + uint32 *rids=NULL, *new_rids=NULL; + BOOL ret; + + /* + * this code is far from perfect. + * first it enumerates the full /etc/group and that can be slow. + * second, it works only with users' SIDs + * whereas the day we support nested groups, it will have to + * support both users's SIDs and domain groups' SIDs + * + * having our own ldap backend would be so much faster ! + * we're far from that, but hope one day ;-) JFM. + */ + + *prids=NULL; + *numgroups=0; + + sep = lp_winbind_separator(); + + + DEBUG(10,("new_get_alias_user_groups: looking if SID %s is a member of groups in the SID domain %s\n", + sid_to_string(str_qsid, q_sid), sid_to_string(str_domsid, sid))); + + sid_peek_rid(q_sid, &rid); + + pdb_init_sam(&sam_pass); + become_root(); + ret = pdb_getsampwrid(sam_pass, rid); + unbecome_root(); + if (ret == False) + return NT_STATUS_NO_SUCH_USER; + + fstrcpy(user_name, pdb_get_username(sam_pass)); + grid=pdb_get_group_rid(sam_pass); + gid=pdb_get_gid(sam_pass); + + grp = glist = getgrent_list(); + if (grp == NULL) + return NT_STATUS_NO_MEMORY; + + + for (; grp != NULL; grp = grp->next) { + if(!get_group_from_gid(grp->gr_gid, &map, MAPPING_WITHOUT_PRIV)) { + DEBUG(10,("new_get_alias_user_groups: gid %d. not found\n", (int)grp->gr_gid)); + continue; + } + + /* if it's not an alias, continue */ + if (map.sid_name_use!=SID_NAME_ALIAS) { + DEBUG(10,("new_get_alias_user_groups: not returing %s, not an ALIAS group.\n", map.nt_name)); + continue; + } + + sid_copy(&tmp_sid, &map.sid); + sid_split_rid(&tmp_sid, &rid); + + /* if the sid is not in the correct domain, continue */ + if (!sid_equal(&tmp_sid, sid)) { + DEBUG(10,("new_get_alias_user_groups: not returing %s, not in the domain SID.\n", map.nt_name)); + continue; + } + + /* Don't return winbind groups as they are not local! */ + if (strchr_m(map.nt_name, *sep) != NULL) { + DEBUG(10,("new_get_alias_user_groups: not returing %s, not local.\n", map.nt_name)); + continue; + } + + /* Don't return user private groups... */ + if (Get_Pwnam(map.nt_name) != 0) { + DEBUG(10,("new_get_alias_user_groups: not returing %s, clashes with user.\n", map.nt_name)); + continue; + } + + /* the group is fine, we can check if there is the user we're looking for */ + DEBUG(10,("new_get_alias_user_groups: checking if the user is a member of %s.\n", map.nt_name)); + + for(num=0; grp->gr_mem[num]!=NULL; num++) { + if(strcmp(grp->gr_mem[num], user_name)==0) { + /* we found the user, add the group to the list */ + + new_rids=(uint32 *)Realloc(rids, sizeof(uint32)*(cur_rid+1)); + if (new_rids==NULL) { + DEBUG(10,("new_get_alias_user_groups: could not realloc memory\n")); + return NT_STATUS_NO_MEMORY; + } + rids=new_rids; + + sid_peek_rid(&map.sid, &(rids[cur_rid])); + DEBUG(10,("new_get_alias_user_groups: user found in group %s\n", map.nt_name)); + cur_rid++; + break; + } + } + + } + + grent_free(glist); + + /* now check for the user's gid (the primary group rid) */ + for (i=0; i