From 895874d9663ccb95883579d145018ec8a8add9c8 Mon Sep 17 00:00:00 2001
From: Kai Blin <kai@samba.org>
Date: Mon, 18 Feb 2008 14:33:58 +0100
Subject: idmap: Handle uid->SID mapping (This used to be commit
 6ac6de8476ba036eb041e054bc37e4503dc2fde8)

---
 source4/winbind/idmap.c | 415 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 415 insertions(+)
 create mode 100644 source4/winbind/idmap.c

(limited to 'source4/winbind/idmap.c')

diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
new file mode 100644
index 0000000000..b14885213e
--- /dev/null
+++ b/source4/winbind/idmap.c
@@ -0,0 +1,415 @@
+/*
+   Unix SMB/CIFS implementation.
+
+   Map SIDs to uids/gids and back
+
+   Copyright (C) Kai Blin 2008
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+
+#include "includes.h"
+#include "auth/auth.h"
+#include "librpc/gen_ndr/lsa.h"
+#include "librpc/gen_ndr/samr.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "lib/ldb/include/ldb.h"
+#include "lib/ldb/include/ldb_errors.h"
+#include "lib/ldb_wrap.h"
+#include "param/param.h"
+#include "winbind/idmap.h"
+#include "libcli/security/proto.h"
+#include "libcli/ldap/ldap_ndr.h"
+
+/**
+ * Get uid/gid bounds from idmap database
+ *
+ * \param idmap_ctx idmap context to use
+ * \param low lower uid/gid bound is stored here
+ * \param high upper uid/gid bound is stored here
+ * \return 0 on success, nonzero on failure
+ */
+static int idmap_get_bounds(struct idmap_context *idmap_ctx, uint32_t *low,
+		uint32_t *high)
+{
+	int ret = -1;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_dn *dn;
+	struct ldb_result *res = NULL;
+	TALLOC_CTX *tmp_ctx = talloc_new(idmap_ctx);
+	uint32_t lower_bound = (uint32_t) -1;
+	uint32_t upper_bound = (uint32_t) -1;
+
+	dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+	if (dn == NULL) goto failed;
+
+	ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+	if (ret != LDB_SUCCESS) goto failed;
+
+	talloc_steal(tmp_ctx, res);
+
+	if (res->count != 1) {
+		ret = -1;
+		goto failed;
+	}
+
+	lower_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "lowerBound", -1);
+	if (lower_bound != (uint32_t) -1) {
+		ret = LDB_SUCCESS;
+	} else {
+		ret = -1;
+		goto failed;
+	}
+
+	upper_bound = ldb_msg_find_attr_as_uint(res->msgs[0], "upperBound", -1);
+	if (upper_bound != (uint32_t) -1) {
+		ret = LDB_SUCCESS;
+	} else {
+		ret = -1;
+	}
+
+failed:
+	talloc_free(tmp_ctx);
+	*low  = lower_bound;
+	*high = upper_bound;
+	return ret;
+}
+
+/**
+ * Add a dom_sid structure to a ldb_message
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param ldb_message ldb message to add dom_sid to
+ * \param attr_name name of the attribute to store the dom_sid in
+ * \param sid dom_sid to store
+ * \return 0 on success, an ldb error code on failure.
+ */
+static int idmap_msg_add_dom_sid(struct idmap_context *idmap_ctx,
+		TALLOC_CTX *mem_ctx, struct ldb_message *msg,
+		const char *attr_name, const struct dom_sid *sid)
+{
+	struct ldb_val val;
+	enum ndr_err_code ndr_err;
+
+	ndr_err = ndr_push_struct_blob(&val, mem_ctx,
+				       lp_iconv_convenience(idmap_ctx->lp_ctx),
+				       sid,
+				       (ndr_push_flags_fn_t)ndr_push_dom_sid);
+
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		return -1;
+	}
+
+	return ldb_msg_add_value(msg, attr_name, &val, NULL);
+}
+
+/**
+ * Get a dom_sid structure from a ldb message.
+ *
+ * \param mem_ctx talloc context to allocate dom_sid memory in
+ * \param msg ldb_message to get dom_sid from
+ * \param attr_name key that has the dom_sid as data
+ * \return dom_sid structure on success, NULL on failure
+ */
+static struct dom_sid *idmap_msg_get_dom_sid(TALLOC_CTX *mem_ctx,
+		struct ldb_message *msg, const char *attr_name)
+{
+	struct dom_sid *sid;
+	const struct ldb_val *val;
+	enum ndr_err_code ndr_err;
+
+	val = ldb_msg_find_ldb_val(msg, attr_name);
+	if (val == NULL) {
+		return NULL;
+	}
+
+	sid = talloc(mem_ctx, struct dom_sid);
+	if (sid == NULL) {
+		return NULL;
+	}
+
+	ndr_err = ndr_pull_struct_blob(val, sid, NULL, sid,
+				       (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
+	if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+		talloc_free(sid);
+		return NULL;
+	}
+
+	return sid;
+}
+
+/**
+ * Initialize idmap context
+ *
+ * talloc_free to close.
+ *
+ * \param mem_ctx talloc context to use.
+ * \return allocated idmap_context on success, NULL on error
+ */
+struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
+		struct loadparm_context *lp_ctx)
+{
+	struct idmap_context *idmap_ctx;
+
+	idmap_ctx = talloc(mem_ctx, struct idmap_context);
+	if (idmap_ctx == NULL) {
+		return NULL;
+	}
+
+	idmap_ctx->lp_ctx = lp_ctx;
+
+	idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, lp_ctx,
+					      lp_idmap_url(lp_ctx),
+					      system_session(mem_ctx, lp_ctx),
+					      NULL, 0, NULL);
+	if (idmap_ctx->ldb_ctx == NULL) {
+		return NULL;
+	}
+
+	return idmap_ctx;
+}
+
+/**
+ * Convert a uid to the corresponding SID
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
+ * from.
+ * \param uid Unix uid to map to a SID
+ * \param sid Pointer that will take the struct dom_sid pointer if the mapping
+ * succeeds.
+ * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
+ * possible or some other NTSTATUS that is more descriptive on failure.
+ */
+
+NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const uid_t uid, struct dom_sid **sid)
+{
+	int ret;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_message *msg;
+	struct ldb_result *res = NULL;
+	int trans = -1;
+	uid_t low, high;
+	char *sid_string, *uid_string;
+	struct dom_sid *unix_users_sid, *new_sid;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
+				 uid);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count == 1) {
+		*sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
+					     "objectSid");
+		if (*sid == NULL) {
+			DEBUG(1, ("Failed to get sid from db: %u\n", ret));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	DEBUG(6, ("uid not found in idmap db, trying to allocate SID.\n"));
+
+	trans = ldb_transaction_start(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	/* Now redo the search to make sure noone added a mapping for that SID
+	 * while we weren't looking.*/
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
+				 uid);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count > 0) {
+		DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
+		status = NT_STATUS_RETRY;
+		goto failed;
+	}
+
+	ret = idmap_get_bounds(idmap_ctx, &low, &high);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (uid >= low && uid <= high) {
+		/* An existing user would have been mapped before */
+		status = NT_STATUS_NO_SUCH_USER;
+		goto failed;
+	}
+
+	/* For local users, we just create a rid = uid +1, so root doesn't end
+	 * up with a 0 rid */
+	unix_users_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
+	if (unix_users_sid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	new_sid = dom_sid_add_rid(mem_ctx, unix_users_sid, uid + 1);
+	if (new_sid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	sid_string = dom_sid_string(tmp_ctx, new_sid);
+	if (sid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	uid_string = talloc_asprintf(tmp_ctx, "%u", uid);
+	if (uid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	msg = ldb_msg_new(tmp_ctx);
+	if (msg == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+	if (msg->dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "uidNumber", uid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
+				    new_sid);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "cn", sid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_add(ldb, msg);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	trans = ldb_transaction_commit(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	*sid = new_sid;
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+
+failed:
+	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+	talloc_free(tmp_ctx);
+	return status;
+}
+
+/**
+ * Map a Unix gid to the corresponding SID
+ *
+ * \todo Create a SID from the S-1-22-2 range for unmapped groups
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
+ * from.
+ * \param gid Unix gid to map to a SID
+ * \param sid Pointer that will take the struct dom_sid pointer if mapping
+ * succeeds.
+ * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
+ * possible or some other NTSTATUS that is more descriptive on failure.
+ */
+NTSTATUS idmap_gid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const gid_t gid, struct dom_sid **sid)
+{
+	return NT_STATUS_NONE_MAPPED;
+}
+
+/**
+ * Map a SID to a Unix uid.
+ *
+ * If no mapping exists, a new mapping will be created.
+ *
+ * \todo Create mappings for users not from our primary domain.
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param sid SID to map to a Unix uid
+ * \param uid pointer to receive the mapped uid
+ * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
+ * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
+ * mapping failed.
+ */
+NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const struct dom_sid *sid, uid_t *uid)
+{
+	return NT_STATUS_NONE_MAPPED;
+}
+
+/**
+ * Map a SID to a Unix gid.
+ *
+ * If no mapping exist, a new mapping will be created.
+ *
+ * \todo Create mappings for groups not from our primary domain.
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context to use
+ * \param sid SID to map to a Unix gid
+ * \param gid pointer to receive the mapped gid
+ * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
+ * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
+ * mapping failed.
+ */
+NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const struct dom_sid *sid, gid_t *gid)
+{
+	return NT_STATUS_NONE_MAPPED;
+}
+
-- 
cgit 


From 9c7f714962bdfe280baed42ed6a1e35a422a0267 Mon Sep 17 00:00:00 2001
From: Kai Blin <kai@samba.org>
Date: Mon, 18 Feb 2008 14:30:17 +0100
Subject: idmap: Handle gid->SID mapping (This used to be commit
 6f2d95030cd7b4b22d1b75d15b76881449eda697)

---
 source4/winbind/idmap.c | 157 +++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 154 insertions(+), 3 deletions(-)

(limited to 'source4/winbind/idmap.c')

diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index b14885213e..af026a4d5c 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -354,8 +354,6 @@ failed:
 /**
  * Map a Unix gid to the corresponding SID
  *
- * \todo Create a SID from the S-1-22-2 range for unmapped groups
- *
  * \param idmap_ctx idmap context to use
  * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
  * from.
@@ -368,7 +366,160 @@ failed:
 NTSTATUS idmap_gid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		const gid_t gid, struct dom_sid **sid)
 {
-	return NT_STATUS_NONE_MAPPED;
+	int ret;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_message *msg;
+	struct ldb_result *res = NULL;
+	int trans = -1;
+	gid_t low, high;
+	char *sid_string, *gid_string;
+	struct dom_sid *unix_groups_sid, *new_sid;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+			NULL, "(&(objectClass=sidMap)(gidNumber=%u))", gid);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count == 1) {
+		*sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
+				"objectSid");
+		if (*sid == NULL) {
+			DEBUG(1, ("Failed to get sid from db: %u\n", ret));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+		/* No change, so cancel the transaction */
+		ldb_transaction_cancel(ldb);
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	DEBUG(6, ("gid not found in idmap db, trying to allocate SID.\n"));
+
+	trans = ldb_transaction_start(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	/* Now redo the search to make sure noone added a mapping for that SID
+	 * while we weren't looking.*/
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(gidNumber=%u))",
+				 gid);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count > 0) {
+		DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
+		status = NT_STATUS_RETRY;
+		goto failed;
+	}
+
+	ret = idmap_get_bounds(idmap_ctx, &low, &high);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (gid >= low && gid <= high) {
+		/* An existing group would have been mapped before */
+		status = NT_STATUS_NO_SUCH_USER;
+		goto failed;
+	}
+
+	/* For local groups, we just create a rid = gid +1, so root doesn't end
+	 * up with a 0 rid */
+	unix_groups_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
+	if (unix_groups_sid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	new_sid = dom_sid_add_rid(mem_ctx, unix_groups_sid, gid + 1);
+	if (new_sid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	sid_string = dom_sid_string(tmp_ctx, new_sid);
+	if (sid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	gid_string = talloc_asprintf(tmp_ctx, "%u", gid);
+	if (gid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	msg = ldb_msg_new(tmp_ctx);
+	if (msg == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+	if (msg->dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "gidNumber", gid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
+			new_sid);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(msg, "cn", sid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_add(ldb, msg);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	trans = ldb_transaction_commit(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	*sid = new_sid;
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+
+failed:
+	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+	talloc_free(tmp_ctx);
+	return status;
 }
 
 /**
-- 
cgit 


From 705abe2cb3bc67f4e225ed38f32f77a2b433abc8 Mon Sep 17 00:00:00 2001
From: Kai Blin <kai@samba.org>
Date: Mon, 18 Feb 2008 18:53:12 +0100
Subject: idmap: Handle SID->uid (This used to be commit
 4037ca6b9cf14219b4a4475399a51db01c655da6)

---
 source4/winbind/idmap.c | 257 +++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 255 insertions(+), 2 deletions(-)

(limited to 'source4/winbind/idmap.c')

diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index af026a4d5c..53276114dd 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -527,7 +527,7 @@ failed:
  *
  * If no mapping exists, a new mapping will be created.
  *
- * \todo Create mappings for users not from our primary domain.
+ * \todo Check if SIDs can be resolved if lp_idmap_trusted_only() == true
  *
  * \param idmap_ctx idmap context to use
  * \param mem_ctx talloc context to use
@@ -540,7 +540,260 @@ failed:
 NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		const struct dom_sid *sid, uid_t *uid)
 {
-	return NT_STATUS_NONE_MAPPED;
+	int ret;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_dn *dn;
+	struct ldb_message *hwm_msg, *map_msg;
+	struct ldb_result *res = NULL;
+	int trans;
+	uid_t low, high, hwm, new_uid;
+	char *sid_string, *uid_string, *hwm_string;
+	bool hwm_entry_exists;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count == 1) {
+		new_uid = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber",
+						    -1);
+		if (new_uid == (uid_t) -1) {
+			DEBUG(1, ("Invalid uid mapping.\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+		*uid = new_uid;
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
+
+	trans = ldb_transaction_start(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	/* Redo the search to make sure noone changed the mapping while we
+	 * weren't looking */
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count > 0) {
+		DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
+		status = NT_STATUS_RETRY;
+		goto failed;
+	}
+
+	/*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
+	 * resolved here. */
+
+	ret = idmap_get_bounds(idmap_ctx, &low, &high);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+	if (dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	talloc_steal(tmp_ctx, res);
+
+	if (res->count != 1) {
+		DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber", -1);
+	if (hwm == (uid_t)-1) {
+		hwm = low;
+		hwm_entry_exists = false;
+	} else {
+		hwm_entry_exists = true;
+	}
+
+	if (hwm > high) {
+		DEBUG(1, ("Out of uids to allocate.\n"));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	hwm_msg = ldb_msg_new(tmp_ctx);
+	if (hwm_msg == NULL) {
+		DEBUG(1, ("Out of memory when creating ldb_message\n"));
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	hwm_msg->dn = dn;
+
+	new_uid = hwm;
+	hwm++;
+
+	hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
+	if (hwm_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	sid_string = dom_sid_string(tmp_ctx, sid);
+	if (sid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	uid_string = talloc_asprintf(tmp_ctx, "%u", new_uid);
+	if (uid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	if (hwm_entry_exists) {
+		struct ldb_message_element *els;
+		struct ldb_val *vals;
+
+		/* We're modifying the entry, not just adding a new one. */
+		els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
+		if (els == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		vals = talloc_array(tmp_ctx, struct ldb_val, 2);
+		if (els == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		hwm_msg->num_elements = 2;
+		hwm_msg->elements = els;
+
+		els[0].num_values = 1;
+		els[0].values = &vals[0];
+		els[0].flags = LDB_FLAG_MOD_DELETE;
+		els[0].name = talloc_strdup(tmp_ctx, "uidNumber");
+		if (els[0].name == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		els[1].num_values = 1;
+		els[1].values = &vals[1];
+		els[1].flags = LDB_FLAG_MOD_ADD;
+		els[1].name = els[0].name;
+
+		vals[0].data = (uint8_t *)uid_string;
+		vals[0].length = strlen(uid_string);
+		vals[1].data = (uint8_t *)hwm_string;
+		vals[1].length = strlen(hwm_string);
+	} else {
+		ret = ldb_msg_add_empty(hwm_msg, "uidNumber", LDB_FLAG_MOD_ADD,
+					NULL);
+		if (ret != LDB_SUCCESS) {
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+
+		ret = ldb_msg_add_string(hwm_msg, "uidNumber", hwm_string);
+		if (ret != LDB_SUCCESS)
+		{
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+	}
+
+	ret = ldb_modify(ldb, hwm_msg);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Updating the uid high water mark failed: %s\n",
+			  ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	map_msg = ldb_msg_new(tmp_ctx);
+	if (map_msg == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+	if (map_msg->dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "uidNumber", uid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
+			sid);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "cn", sid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_add(ldb, map_msg);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	trans = ldb_transaction_commit(ldb);
+	if (trans != LDB_SUCCESS) {
+		DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	*uid = new_uid;
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+
+failed:
+	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+	talloc_free(tmp_ctx);
+	return status;
 }
 
 /**
-- 
cgit 


From 99b311449f494c0318127dc9140c4a22bb932884 Mon Sep 17 00:00:00 2001
From: Kai Blin <kai@samba.org>
Date: Mon, 18 Feb 2008 23:47:30 +0100
Subject: idmap: Handle SID->gid (This used to be commit
 78d22a28eca4dd89f629dbe75287e9ac3940606b)

---
 source4/winbind/idmap.c | 257 +++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 255 insertions(+), 2 deletions(-)

(limited to 'source4/winbind/idmap.c')

diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index 53276114dd..3372ad51ee 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -801,7 +801,7 @@ failed:
  *
  * If no mapping exist, a new mapping will be created.
  *
- * \todo Create mappings for groups not from our primary domain.
+ * \todo Check if SID resolve when lp_idmap_trusted_only() == true
  *
  * \param idmap_ctx idmap context to use
  * \param mem_ctx talloc context to use
@@ -814,6 +814,259 @@ failed:
 NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		const struct dom_sid *sid, gid_t *gid)
 {
-	return NT_STATUS_NONE_MAPPED;
+	int ret;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
+	struct ldb_dn *dn;
+	struct ldb_message *hwm_msg, *map_msg;
+	struct ldb_result *res = NULL;
+	int trans = -1;
+	gid_t low, high, hwm, new_gid;
+	char *sid_string, *gid_string, *hwm_string;
+	bool hwm_entry_exists;
+	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count == 1) {
+		new_gid = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber",
+				-1);
+		if (new_gid == (gid_t) -1) {
+			DEBUG(1, ("Invalid gid mapping.\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+		*gid = new_gid;
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
+
+	trans = ldb_transaction_start(ldb);
+	if (trans != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	/* Redo the search to make sure noone changed the mapping while we
+	 * weren't looking */
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	if (res->count > 0) {
+		DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
+		status = NT_STATUS_RETRY;
+		goto failed;
+	}
+
+	/*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
+	 * resolved here. */
+
+	ret = idmap_get_bounds(idmap_ctx, &low, &high);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
+	if (dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	talloc_steal(tmp_ctx, res);
+
+	if (res->count != 1) {
+		DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber", -1);
+	if (hwm == (gid_t)-1) {
+		hwm = low;
+		hwm_entry_exists = false;
+	} else {
+		hwm_entry_exists = true;
+	}
+
+	if (hwm > high) {
+		DEBUG(1, ("Out of gids to allocate.\n"));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	hwm_msg = ldb_msg_new(tmp_ctx);
+	if (hwm_msg == NULL) {
+		DEBUG(1, ("Out of memory when creating ldb_message\n"));
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	hwm_msg->dn = dn;
+
+	new_gid = hwm;
+	hwm++;
+
+	hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
+	if (hwm_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	sid_string = dom_sid_string(tmp_ctx, sid);
+	if (sid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	gid_string = talloc_asprintf(tmp_ctx, "%u", new_gid);
+	if (gid_string == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	if (hwm_entry_exists) {
+		struct ldb_message_element *els;
+		struct ldb_val *vals;
+
+		/* We're modifying the entry, not just adding a new one. */
+		els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
+		if (els == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		vals = talloc_array(tmp_ctx, struct ldb_val, 2);
+		if (els == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		hwm_msg->num_elements = 2;
+		hwm_msg->elements = els;
+
+		els[0].num_values = 1;
+		els[0].values = &vals[0];
+		els[0].flags = LDB_FLAG_MOD_DELETE;
+		els[0].name = talloc_strdup(tmp_ctx, "gidNumber");
+		if (els[0].name == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		els[1].num_values = 1;
+		els[1].values = &vals[1];
+		els[1].flags = LDB_FLAG_MOD_ADD;
+		els[1].name = els[0].name;
+
+		vals[0].data = (uint8_t *)gid_string;
+		vals[0].length = strlen(gid_string);
+		vals[1].data = (uint8_t *)hwm_string;
+		vals[1].length = strlen(hwm_string);
+	} else {
+		ret = ldb_msg_add_empty(hwm_msg, "gidNumber", LDB_FLAG_MOD_ADD,
+					NULL);
+		if (ret != LDB_SUCCESS) {
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+
+		ret = ldb_msg_add_string(hwm_msg, "gidNumber", hwm_string);
+		if (ret != LDB_SUCCESS)
+		{
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+	}
+
+	ret = ldb_modify(ldb, hwm_msg);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Updating the gid high water mark failed: %s\n",
+			  ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	map_msg = ldb_msg_new(tmp_ctx);
+	if (map_msg == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
+	if (map_msg->dn == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "gidNumber", gid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
+			sid);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_msg_add_string(map_msg, "cn", sid_string);
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	ret = ldb_add(ldb, map_msg);
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	trans = ldb_transaction_commit(ldb);
+	if (trans != LDB_SUCCESS) {
+		DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
+	*gid = new_gid;
+	talloc_free(tmp_ctx);
+	return NT_STATUS_OK;
+
+failed:
+	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
+	talloc_free(tmp_ctx);
+	return status;
 }
 
-- 
cgit 


From a1875b039bb77bad9c3cef4e1ebe037a7e645938 Mon Sep 17 00:00:00 2001
From: Kai Blin <kai@samba.org>
Date: Thu, 6 Mar 2008 00:52:37 +0100
Subject: idmap: Map SIDs to unixids instead of uids/gids (This used to be
 commit 73ac7c4a1ce937bddd3c52d048665cd0078c6aaa)

---
 source4/winbind/idmap.c | 722 ++++++++++++------------------------------------
 1 file changed, 182 insertions(+), 540 deletions(-)

(limited to 'source4/winbind/idmap.c')

diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index 3372ad51ee..de8a43ec02 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -1,7 +1,7 @@
 /*
    Unix SMB/CIFS implementation.
 
-   Map SIDs to uids/gids and back
+   Map SIDs to unixids and back
 
    Copyright (C) Kai Blin 2008
 
@@ -177,39 +177,46 @@ struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
 		return NULL;
 	}
 
+	idmap_ctx->unix_groups_sid = dom_sid_parse_talloc(mem_ctx, "S-1-22-2");
+	if (idmap_ctx->unix_groups_sid == NULL) {
+		return NULL;
+	}
+
+	idmap_ctx->unix_users_sid = dom_sid_parse_talloc(mem_ctx, "S-1-22-1");
+	if (idmap_ctx->unix_users_sid == NULL) {
+		return NULL;
+	}
+
 	return idmap_ctx;
 }
 
 /**
- * Convert a uid to the corresponding SID
+ * Convert an unixid to the corresponding SID
  *
  * \param idmap_ctx idmap context to use
  * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
  * from.
- * \param uid Unix uid to map to a SID
- * \param sid Pointer that will take the struct dom_sid pointer if the mapping
+ * \param unixid pointer to a unixid struct to convert
+ * \param sid pointer that will take the struct dom_sid pointer if the mapping
  * succeeds.
  * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
  * possible or some other NTSTATUS that is more descriptive on failure.
  */
 
-NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
-		const uid_t uid, struct dom_sid **sid)
+NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const struct unixid *unixid, struct dom_sid **sid)
 {
 	int ret;
 	NTSTATUS status = NT_STATUS_NONE_MAPPED;
 	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
-	struct ldb_message *msg;
 	struct ldb_result *res = NULL;
-	int trans = -1;
-	uid_t low, high;
-	char *sid_string, *uid_string;
-	struct dom_sid *unix_users_sid, *new_sid;
+	uint32_t low, high;
+	struct dom_sid *unix_sid, *new_sid;
 	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 
 	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
-				 uid);
+				 NULL, "(&(objectClass=sidMap)(xidNumber=%u))",
+				 unixid->id);
 	if (ret != LDB_SUCCESS) {
 		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
 		status = NT_STATUS_NONE_MAPPED;
@@ -228,19 +235,13 @@ NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		return NT_STATUS_OK;
 	}
 
-	DEBUG(6, ("uid not found in idmap db, trying to allocate SID.\n"));
-
-	trans = ldb_transaction_start(ldb);
-	if (trans != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
+	DEBUG(6, ("xid not found in idmap db, trying to allocate SID.\n"));
 
 	/* Now redo the search to make sure noone added a mapping for that SID
 	 * while we weren't looking.*/
 	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(uidNumber=%u))",
-				 uid);
+				 NULL, "(&(objectClass=sidMap)(xidNumber=%u))",
+				 unixid->id);
 	if (ret != LDB_SUCCESS) {
 		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
 		status = NT_STATUS_NONE_MAPPED;
@@ -260,285 +261,58 @@ NTSTATUS idmap_uid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
-	if (uid >= low && uid <= high) {
-		/* An existing user would have been mapped before */
-		status = NT_STATUS_NO_SUCH_USER;
+	if (unixid->id >= low && unixid->id <= high) {
+		/* An existing xid would have been mapped before */
+		status = NT_STATUS_NONE_MAPPED;
 		goto failed;
 	}
 
 	/* For local users, we just create a rid = uid +1, so root doesn't end
 	 * up with a 0 rid */
-	unix_users_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
-	if (unix_users_sid == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	new_sid = dom_sid_add_rid(mem_ctx, unix_users_sid, uid + 1);
-	if (new_sid == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	sid_string = dom_sid_string(tmp_ctx, new_sid);
-	if (sid_string == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	uid_string = talloc_asprintf(tmp_ctx, "%u", uid);
-	if (uid_string == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	msg = ldb_msg_new(tmp_ctx);
-	if (msg == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
-	if (msg->dn == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(msg, "uidNumber", uid_string);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
-				    new_sid);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(msg, "cn", sid_string);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_add(ldb, msg);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	trans = ldb_transaction_commit(ldb);
-	if (trans != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	*sid = new_sid;
-	talloc_free(tmp_ctx);
-	return NT_STATUS_OK;
-
-failed:
-	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
-	talloc_free(tmp_ctx);
-	return status;
-}
-
-/**
- * Map a Unix gid to the corresponding SID
- *
- * \param idmap_ctx idmap context to use
- * \param mem_ctx talloc context the memory for the struct dom_sid is allocated
- * from.
- * \param gid Unix gid to map to a SID
- * \param sid Pointer that will take the struct dom_sid pointer if mapping
- * succeeds.
- * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping not
- * possible or some other NTSTATUS that is more descriptive on failure.
- */
-NTSTATUS idmap_gid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
-		const gid_t gid, struct dom_sid **sid)
-{
-	int ret;
-	NTSTATUS status = NT_STATUS_NONE_MAPPED;
-	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
-	struct ldb_message *msg;
-	struct ldb_result *res = NULL;
-	int trans = -1;
-	gid_t low, high;
-	char *sid_string, *gid_string;
-	struct dom_sid *unix_groups_sid, *new_sid;
-	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
-
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-			NULL, "(&(objectClass=sidMap)(gidNumber=%u))", gid);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (res->count == 1) {
-		*sid = idmap_msg_get_dom_sid(mem_ctx, res->msgs[0],
-				"objectSid");
-		if (*sid == NULL) {
-			DEBUG(1, ("Failed to get sid from db: %u\n", ret));
-			status = NT_STATUS_NONE_MAPPED;
-			goto failed;
-		}
-		/* No change, so cancel the transaction */
-		ldb_transaction_cancel(ldb);
-		talloc_free(tmp_ctx);
-		return NT_STATUS_OK;
-	}
-
-	DEBUG(6, ("gid not found in idmap db, trying to allocate SID.\n"));
-
-	trans = ldb_transaction_start(ldb);
-	if (trans != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	/* Now redo the search to make sure noone added a mapping for that SID
-	 * while we weren't looking.*/
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(gidNumber=%u))",
-				 gid);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (res->count > 0) {
-		DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
-		status = NT_STATUS_RETRY;
-		goto failed;
-	}
-
-	ret = idmap_get_bounds(idmap_ctx, &low, &high);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (gid >= low && gid <= high) {
-		/* An existing group would have been mapped before */
-		status = NT_STATUS_NO_SUCH_USER;
-		goto failed;
+	if (unixid->type == ID_TYPE_UID) {
+		unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
+	} else {
+		unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
 	}
-
-	/* For local groups, we just create a rid = gid +1, so root doesn't end
-	 * up with a 0 rid */
-	unix_groups_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-2");
-	if (unix_groups_sid == NULL) {
+	if (unix_sid == NULL) {
 		status = NT_STATUS_NO_MEMORY;
 		goto failed;
 	}
 
-	new_sid = dom_sid_add_rid(mem_ctx, unix_groups_sid, gid + 1);
+	new_sid = dom_sid_add_rid(mem_ctx, unix_sid, unixid->id + 1);
 	if (new_sid == NULL) {
 		status = NT_STATUS_NO_MEMORY;
 		goto failed;
 	}
 
-	sid_string = dom_sid_string(tmp_ctx, new_sid);
-	if (sid_string == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	gid_string = talloc_asprintf(tmp_ctx, "%u", gid);
-	if (gid_string == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	msg = ldb_msg_new(tmp_ctx);
-	if (msg == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
-	if (msg->dn == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(msg, "gidNumber", gid_string);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, msg, "objectSid",
-			new_sid);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(msg, "objectClass", "sidMap");
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(msg, "cn", sid_string);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_add(ldb, msg);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	trans = ldb_transaction_commit(ldb);
-	if (trans != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
 	*sid = new_sid;
 	talloc_free(tmp_ctx);
 	return NT_STATUS_OK;
 
 failed:
-	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
 	talloc_free(tmp_ctx);
 	return status;
 }
 
+
 /**
- * Map a SID to a Unix uid.
+ * Map a SID to an unixid struct.
  *
  * If no mapping exists, a new mapping will be created.
  *
  * \todo Check if SIDs can be resolved if lp_idmap_trusted_only() == true
+ * \todo Fix backwards compatibility for Samba3
  *
  * \param idmap_ctx idmap context to use
  * \param mem_ctx talloc context to use
- * \param sid SID to map to a Unix uid
- * \param uid pointer to receive the mapped uid
+ * \param sid SID to map to an unixid struct
+ * \param unixid pointer to a unixid struct pointer
  * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
  * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
  * mapping failed.
  */
-NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
-		const struct dom_sid *sid, uid_t *uid)
+NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
+		const struct dom_sid *sid, struct unixid **unixid)
 {
 	int ret;
 	NTSTATUS status = NT_STATUS_NONE_MAPPED;
@@ -547,8 +321,8 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 	struct ldb_message *hwm_msg, *map_msg;
 	struct ldb_result *res = NULL;
 	int trans;
-	uid_t low, high, hwm, new_uid;
-	char *sid_string, *uid_string, *hwm_string;
+	uint32_t low, high, hwm, new_xid;
+	char *sid_string, *unixid_string, *hwm_string;
 	bool hwm_entry_exists;
 	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 
@@ -562,20 +336,65 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 	}
 
 	if (res->count == 1) {
-		new_uid = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber",
+		new_xid = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber",
 						    -1);
-		if (new_uid == (uid_t) -1) {
-			DEBUG(1, ("Invalid uid mapping.\n"));
+		if (new_xid == (uint32_t) -1) {
+			DEBUG(1, ("Invalid xid mapping.\n"));
 			status = NT_STATUS_NONE_MAPPED;
 			goto failed;
 		}
-		*uid = new_uid;
+
+		*unixid = talloc(mem_ctx, struct unixid);
+		if (*unixid == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+
+		(*unixid)->id = new_xid;
+		(*unixid)->type = ID_TYPE_BOTH;
+
 		talloc_free(tmp_ctx);
 		return NT_STATUS_OK;
 	}
 
 	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
 
+	if (dom_sid_in_domain(idmap_ctx->unix_users_sid, sid)) {
+		uint32_t rid;
+		DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
+		status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
+		if (!NT_STATUS_IS_OK(status)) goto failed;
+
+		*unixid = talloc(mem_ctx, struct unixid);
+		if (*unixid == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+		(*unixid)->id = rid - 1;
+		(*unixid)->type = ID_TYPE_UID;
+
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	}
+
+	if (dom_sid_in_domain(idmap_ctx->unix_groups_sid, sid)) {
+		uint32_t rid;
+		DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
+		status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
+		if (!NT_STATUS_IS_OK(status)) goto failed;
+
+		*unixid = talloc(mem_ctx, struct unixid);
+		if (*unixid == NULL) {
+			status = NT_STATUS_NO_MEMORY;
+			goto failed;
+		}
+		(*unixid)->id = rid - 1;
+		(*unixid)->type = ID_TYPE_GID;
+
+		talloc_free(tmp_ctx);
+		return NT_STATUS_OK;
+	 }
+
 	trans = ldb_transaction_start(ldb);
 	if (trans != LDB_SUCCESS) {
 		status = NT_STATUS_NONE_MAPPED;
@@ -629,8 +448,8 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
-	hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "uidNumber", -1);
-	if (hwm == (uid_t)-1) {
+	hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber", -1);
+	if (hwm == (uint32_t)-1) {
 		hwm = low;
 		hwm_entry_exists = false;
 	} else {
@@ -638,7 +457,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 	}
 
 	if (hwm > high) {
-		DEBUG(1, ("Out of uids to allocate.\n"));
+		DEBUG(1, ("Out of xids to allocate.\n"));
 		status = NT_STATUS_NONE_MAPPED;
 		goto failed;
 	}
@@ -652,7 +471,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 
 	hwm_msg->dn = dn;
 
-	new_uid = hwm;
+	new_xid = hwm;
 	hwm++;
 
 	hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
@@ -667,8 +486,8 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
-	uid_string = talloc_asprintf(tmp_ctx, "%u", new_uid);
-	if (uid_string == NULL) {
+	unixid_string = talloc_asprintf(tmp_ctx, "%u", new_xid);
+	if (unixid_string == NULL) {
 		status = NT_STATUS_NO_MEMORY;
 		goto failed;
 	}
@@ -696,7 +515,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		els[0].num_values = 1;
 		els[0].values = &vals[0];
 		els[0].flags = LDB_FLAG_MOD_DELETE;
-		els[0].name = talloc_strdup(tmp_ctx, "uidNumber");
+		els[0].name = talloc_strdup(tmp_ctx, "xidNumber");
 		if (els[0].name == NULL) {
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
@@ -707,19 +526,19 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		els[1].flags = LDB_FLAG_MOD_ADD;
 		els[1].name = els[0].name;
 
-		vals[0].data = (uint8_t *)uid_string;
-		vals[0].length = strlen(uid_string);
+		vals[0].data = (uint8_t *)unixid_string;
+		vals[0].length = strlen(unixid_string);
 		vals[1].data = (uint8_t *)hwm_string;
 		vals[1].length = strlen(hwm_string);
 	} else {
-		ret = ldb_msg_add_empty(hwm_msg, "uidNumber", LDB_FLAG_MOD_ADD,
+		ret = ldb_msg_add_empty(hwm_msg, "xidNumber", LDB_FLAG_MOD_ADD,
 					NULL);
 		if (ret != LDB_SUCCESS) {
 			status = NT_STATUS_NONE_MAPPED;
 			goto failed;
 		}
 
-		ret = ldb_msg_add_string(hwm_msg, "uidNumber", hwm_string);
+		ret = ldb_msg_add_string(hwm_msg, "xidNumber", hwm_string);
 		if (ret != LDB_SUCCESS)
 		{
 			status = NT_STATUS_NONE_MAPPED;
@@ -729,7 +548,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 
 	ret = ldb_modify(ldb, hwm_msg);
 	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Updating the uid high water mark failed: %s\n",
+		DEBUG(1, ("Updating the xid high water mark failed: %s\n",
 			  ldb_errstring(ldb)));
 		status = NT_STATUS_NONE_MAPPED;
 		goto failed;
@@ -747,7 +566,7 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
-	ret = ldb_msg_add_string(map_msg, "uidNumber", uid_string);
+	ret = ldb_msg_add_string(map_msg, "xidNumber", unixid_string);
 	if (ret != LDB_SUCCESS) {
 		status = NT_STATUS_NONE_MAPPED;
 		goto failed;
@@ -786,7 +605,14 @@ NTSTATUS idmap_sid_to_uid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
-	*uid = new_uid;
+	*unixid = talloc(mem_ctx, struct unixid);
+	if (*unixid == NULL) {
+		status = NT_STATUS_NO_MEMORY;
+		goto failed;
+	}
+
+	(*unixid)->id = new_xid;
+	(*unixid)->type = ID_TYPE_BOTH;
 	talloc_free(tmp_ctx);
 	return NT_STATUS_OK;
 
@@ -797,276 +623,92 @@ failed:
 }
 
 /**
- * Map a SID to a Unix gid.
- *
- * If no mapping exist, a new mapping will be created.
- *
- * \todo Check if SID resolve when lp_idmap_trusted_only() == true
+ * Convert an array of unixids to the corresponding array of SIDs
  *
  * \param idmap_ctx idmap context to use
- * \param mem_ctx talloc context to use
- * \param sid SID to map to a Unix gid
- * \param gid pointer to receive the mapped gid
- * \return NT_STATUS_OK on success, NT_STATUS_INVALID_SID if the sid is not from
- * a trusted domain and idmap trusted only = true, NT_STATUS_NONE_MAPPED if the
- * mapping failed.
+ * \param mem_ctx talloc context the memory for the dom_sids is allocated
+ * from.
+ * \param count length of id_mapping array.
+ * \param id array of id_mappings.
+ * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
+ * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
+ * did not.
  */
-NTSTATUS idmap_sid_to_gid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
-		const struct dom_sid *sid, gid_t *gid)
-{
-	int ret;
-	NTSTATUS status = NT_STATUS_NONE_MAPPED;
-	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
-	struct ldb_dn *dn;
-	struct ldb_message *hwm_msg, *map_msg;
-	struct ldb_result *res = NULL;
-	int trans = -1;
-	gid_t low, high, hwm, new_gid;
-	char *sid_string, *gid_string, *hwm_string;
-	bool hwm_entry_exists;
-	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
-				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (res->count == 1) {
-		new_gid = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber",
-				-1);
-		if (new_gid == (gid_t) -1) {
-			DEBUG(1, ("Invalid gid mapping.\n"));
-			status = NT_STATUS_NONE_MAPPED;
-			goto failed;
+NTSTATUS idmap_xids_to_sids(struct idmap_context *idmap_ctx,
+			    TALLOC_CTX *mem_ctx, int count,
+			    struct id_mapping *id)
+{
+	int i;
+	int error_count = 0;
+
+	for (i = 0; i < count; ++i) {
+		id[i].status = idmap_xid_to_sid(idmap_ctx, mem_ctx,
+						id[i].unixid, &id[i].sid);
+		if (NT_STATUS_EQUAL(id[i].status, NT_STATUS_RETRY)) {
+			id[i].status = idmap_xid_to_sid(idmap_ctx, mem_ctx,
+							id[i].unixid,
+							&id[i].sid);
+		}
+		if (!NT_STATUS_IS_OK(id[i].status)) {
+			DEBUG(1, ("idmapping failed for id[%d]\n", i));
+			error_count++;
 		}
-		*gid = new_gid;
-		talloc_free(tmp_ctx);
-		return NT_STATUS_OK;
-	}
-
-	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
-
-	trans = ldb_transaction_start(ldb);
-	if (trans != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	/* Redo the search to make sure noone changed the mapping while we
-	 * weren't looking */
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
-				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (res->count > 0) {
-		DEBUG(1, ("Database changed while trying to add a sidmap.\n"));
-		status = NT_STATUS_RETRY;
-		goto failed;
-	}
-
-	/*FIXME: if lp_idmap_trusted_only() == true, check if SID can be
-	 * resolved here. */
-
-	ret = idmap_get_bounds(idmap_ctx, &low, &high);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	dn = ldb_dn_new(tmp_ctx, ldb, "CN=CONFIG");
-	if (dn == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, NULL, NULL, &res);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	talloc_steal(tmp_ctx, res);
-
-	if (res->count != 1) {
-		DEBUG(1, ("No CN=CONFIG record, idmap database is broken.\n"));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
 	}
 
-	hwm = ldb_msg_find_attr_as_uint(res->msgs[0], "gidNumber", -1);
-	if (hwm == (gid_t)-1) {
-		hwm = low;
-		hwm_entry_exists = false;
+	if (error_count == count) {
+		/* Mapping did not work at all. */
+		return NT_STATUS_NONE_MAPPED;
+	} else if (error_count > 0) {
+		/* Some mappings worked, some did not. */
+		return STATUS_SOME_UNMAPPED;
 	} else {
-		hwm_entry_exists = true;
-	}
-
-	if (hwm > high) {
-		DEBUG(1, ("Out of gids to allocate.\n"));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	hwm_msg = ldb_msg_new(tmp_ctx);
-	if (hwm_msg == NULL) {
-		DEBUG(1, ("Out of memory when creating ldb_message\n"));
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	hwm_msg->dn = dn;
-
-	new_gid = hwm;
-	hwm++;
-
-	hwm_string = talloc_asprintf(tmp_ctx, "%u", hwm);
-	if (hwm_string == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	sid_string = dom_sid_string(tmp_ctx, sid);
-	if (sid_string == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	gid_string = talloc_asprintf(tmp_ctx, "%u", new_gid);
-	if (gid_string == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
+		return NT_STATUS_OK;
 	}
+}
 
-	if (hwm_entry_exists) {
-		struct ldb_message_element *els;
-		struct ldb_val *vals;
-
-		/* We're modifying the entry, not just adding a new one. */
-		els = talloc_array(tmp_ctx, struct ldb_message_element, 2);
-		if (els == NULL) {
-			status = NT_STATUS_NO_MEMORY;
-			goto failed;
-		}
-
-		vals = talloc_array(tmp_ctx, struct ldb_val, 2);
-		if (els == NULL) {
-			status = NT_STATUS_NO_MEMORY;
-			goto failed;
-		}
-
-		hwm_msg->num_elements = 2;
-		hwm_msg->elements = els;
-
-		els[0].num_values = 1;
-		els[0].values = &vals[0];
-		els[0].flags = LDB_FLAG_MOD_DELETE;
-		els[0].name = talloc_strdup(tmp_ctx, "gidNumber");
-		if (els[0].name == NULL) {
-			status = NT_STATUS_NO_MEMORY;
-			goto failed;
-		}
-
-		els[1].num_values = 1;
-		els[1].values = &vals[1];
-		els[1].flags = LDB_FLAG_MOD_ADD;
-		els[1].name = els[0].name;
+/**
+ * Convert an array of SIDs to the corresponding array of unixids
+ *
+ * \param idmap_ctx idmap context to use
+ * \param mem_ctx talloc context the memory for the unixids is allocated
+ * from.
+ * \param count length of id_mapping array.
+ * \param id array of id_mappings.
+ * \return NT_STATUS_OK on success, NT_STATUS_NONE_MAPPED if mapping is not
+ * possible at all, NT_STATUS_SOME_UNMAPPED if some mappings worked and some
+ * did not.
+ */
 
-		vals[0].data = (uint8_t *)gid_string;
-		vals[0].length = strlen(gid_string);
-		vals[1].data = (uint8_t *)hwm_string;
-		vals[1].length = strlen(hwm_string);
-	} else {
-		ret = ldb_msg_add_empty(hwm_msg, "gidNumber", LDB_FLAG_MOD_ADD,
-					NULL);
-		if (ret != LDB_SUCCESS) {
-			status = NT_STATUS_NONE_MAPPED;
-			goto failed;
+NTSTATUS idmap_sids_to_xids(struct idmap_context *idmap_ctx,
+			    TALLOC_CTX *mem_ctx, int count,
+			    struct id_mapping *id)
+{
+	int i;
+	int error_count = 0;
+
+	for (i = 0; i < count; ++i) {
+		id[i].status = idmap_sid_to_xid(idmap_ctx, mem_ctx,
+						id[i].sid, &id[i].unixid);
+		if (NT_STATUS_EQUAL(id[i].status, NT_STATUS_RETRY)) {
+			id[i].status = idmap_sid_to_xid(idmap_ctx, mem_ctx,
+							id[i].sid,
+							&id[i].unixid);
 		}
-
-		ret = ldb_msg_add_string(hwm_msg, "gidNumber", hwm_string);
-		if (ret != LDB_SUCCESS)
-		{
-			status = NT_STATUS_NONE_MAPPED;
-			goto failed;
+		if (!NT_STATUS_IS_OK(id[i].status)) {
+			DEBUG(1, ("idmapping failed for id[%d]\n", i));
+			error_count++;
 		}
 	}
 
-	ret = ldb_modify(ldb, hwm_msg);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Updating the gid high water mark failed: %s\n",
-			  ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	map_msg = ldb_msg_new(tmp_ctx);
-	if (map_msg == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	map_msg->dn = ldb_dn_new_fmt(tmp_ctx, ldb, "CN=%s", sid_string);
-	if (map_msg->dn == NULL) {
-		status = NT_STATUS_NO_MEMORY;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(map_msg, "gidNumber", gid_string);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = idmap_msg_add_dom_sid(idmap_ctx, tmp_ctx, map_msg, "objectSid",
-			sid);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(map_msg, "objectClass", "sidMap");
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_msg_add_string(map_msg, "cn", sid_string);
-	if (ret != LDB_SUCCESS) {
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	ret = ldb_add(ldb, map_msg);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Adding a sidmap failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	trans = ldb_transaction_commit(ldb);
-	if (trans != LDB_SUCCESS) {
-		DEBUG(1, ("Transaction failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
+	if (error_count == count) {
+		/* Mapping did not work at all. */
+		return NT_STATUS_NONE_MAPPED;
+	} else if (error_count > 0) {
+		/* Some mappings worked, some did not. */
+		return STATUS_SOME_UNMAPPED;
+	} else {
+		return NT_STATUS_OK;
 	}
-
-	*gid = new_gid;
-	talloc_free(tmp_ctx);
-	return NT_STATUS_OK;
-
-failed:
-	if (trans == LDB_SUCCESS) ldb_transaction_cancel(ldb);
-	talloc_free(tmp_ctx);
-	return status;
 }
 
-- 
cgit 


From b6c48091d442781d5f22d703a00aa242de8f7226 Mon Sep 17 00:00:00 2001
From: Kai Blin <kai@samba.org>
Date: Tue, 1 Apr 2008 00:05:02 +0200
Subject: idmap: Also store sid type in the idmap db (This used to be commit
 018eb64f038210279b90925e6a981c067aef4be9)

---
 source4/winbind/idmap.c | 145 ++++++++++++++++++++++++------------------------
 1 file changed, 74 insertions(+), 71 deletions(-)

(limited to 'source4/winbind/idmap.c')

diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index de8a43ec02..92ac41f1d2 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -210,13 +210,26 @@ NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 	NTSTATUS status = NT_STATUS_NONE_MAPPED;
 	struct ldb_context *ldb = idmap_ctx->ldb_ctx;
 	struct ldb_result *res = NULL;
-	uint32_t low, high;
 	struct dom_sid *unix_sid, *new_sid;
 	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+	const char *id_type;
+
+	switch (unixid->type) {
+		case ID_TYPE_UID:
+			id_type = "ID_TYPE_UID";
+			break;
+		case ID_TYPE_GID:
+			id_type = "ID_TYPE_GID";
+			break;
+		default:
+			DEBUG(1, ("unixid->type must be type gid or uid\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+	}
 
 	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(xidNumber=%u))",
-				 unixid->id);
+				 NULL, "(&(|(type=ID_TYPE_BOTH)(type=%s))"
+				 "(xidNumber=%u))", id_type, unixid->id);
 	if (ret != LDB_SUCCESS) {
 		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
 		status = NT_STATUS_NONE_MAPPED;
@@ -235,40 +248,9 @@ NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		return NT_STATUS_OK;
 	}
 
-	DEBUG(6, ("xid not found in idmap db, trying to allocate SID.\n"));
-
-	/* Now redo the search to make sure noone added a mapping for that SID
-	 * while we weren't looking.*/
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(xidNumber=%u))",
-				 unixid->id);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (res->count > 0) {
-		DEBUG(1, ("sidMap modified while trying to add a mapping.\n"));
-		status = NT_STATUS_RETRY;
-		goto failed;
-	}
-
-	ret = idmap_get_bounds(idmap_ctx, &low, &high);
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Failed to get id bounds from db: %u\n", ret));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (unixid->id >= low && unixid->id <= high) {
-		/* An existing xid would have been mapped before */
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
+	DEBUG(6, ("xid not found in idmap db, create S-1-22- SID.\n"));
 
-	/* For local users, we just create a rid = uid +1, so root doesn't end
-	 * up with a 0 rid */
+	/* For local users/groups , we just create a rid = uid/gid */
 	if (unixid->type == ID_TYPE_UID) {
 		unix_sid = dom_sid_parse_talloc(tmp_ctx, "S-1-22-1");
 	} else {
@@ -279,7 +261,7 @@ NTSTATUS idmap_xid_to_sid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
-	new_sid = dom_sid_add_rid(mem_ctx, unix_sid, unixid->id + 1);
+	new_sid = dom_sid_add_rid(mem_ctx, unix_sid, unixid->id);
 	if (new_sid == NULL) {
 		status = NT_STATUS_NO_MEMORY;
 		goto failed;
@@ -326,42 +308,27 @@ NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 	bool hwm_entry_exists;
 	TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 
-	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
-				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
-				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
-	if (ret != LDB_SUCCESS) {
-		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
-		status = NT_STATUS_NONE_MAPPED;
-		goto failed;
-	}
-
-	if (res->count == 1) {
-		new_xid = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber",
-						    -1);
-		if (new_xid == (uint32_t) -1) {
-			DEBUG(1, ("Invalid xid mapping.\n"));
-			status = NT_STATUS_NONE_MAPPED;
-			goto failed;
-		}
+	if (dom_sid_in_domain(idmap_ctx->unix_users_sid, sid)) {
+		uint32_t rid;
+		DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
+		status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
+		if (!NT_STATUS_IS_OK(status)) goto failed;
 
 		*unixid = talloc(mem_ctx, struct unixid);
 		if (*unixid == NULL) {
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
 		}
-
-		(*unixid)->id = new_xid;
-		(*unixid)->type = ID_TYPE_BOTH;
+		(*unixid)->id = rid;
+		(*unixid)->type = ID_TYPE_UID;
 
 		talloc_free(tmp_ctx);
 		return NT_STATUS_OK;
 	}
 
-	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
-
-	if (dom_sid_in_domain(idmap_ctx->unix_users_sid, sid)) {
+	if (dom_sid_in_domain(idmap_ctx->unix_groups_sid, sid)) {
 		uint32_t rid;
-		DEBUG(6, ("This is a local unix uid, just calculate that.\n"));
+		DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
 		status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
 		if (!NT_STATUS_IS_OK(status)) goto failed;
 
@@ -370,30 +337,60 @@ NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
 		}
-		(*unixid)->id = rid - 1;
-		(*unixid)->type = ID_TYPE_UID;
+		(*unixid)->id = rid;
+		(*unixid)->type = ID_TYPE_GID;
 
 		talloc_free(tmp_ctx);
 		return NT_STATUS_OK;
+	 }
+
+	ret = ldb_search_exp_fmt(ldb, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+				 NULL, "(&(objectClass=sidMap)(objectSid=%s))",
+				 ldap_encode_ndr_dom_sid(tmp_ctx, sid));
+	if (ret != LDB_SUCCESS) {
+		DEBUG(1, ("Search failed: %s\n", ldb_errstring(ldb)));
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
 	}
 
-	if (dom_sid_in_domain(idmap_ctx->unix_groups_sid, sid)) {
-		uint32_t rid;
-		DEBUG(6, ("This is a local unix gid, just calculate that.\n"));
-		status = dom_sid_split_rid(tmp_ctx, sid, NULL, &rid);
-		if (!NT_STATUS_IS_OK(status)) goto failed;
+	if (res->count == 1) {
+		const char *type = ldb_msg_find_attr_as_string(res->msgs[0],
+							       "type", NULL);
+		new_xid = ldb_msg_find_attr_as_uint(res->msgs[0], "xidNumber",
+						    -1);
+		if (new_xid == (uint32_t) -1) {
+			DEBUG(1, ("Invalid xid mapping.\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
+
+		if (type == NULL) {
+			DEBUG(1, ("Invalid type for mapping entry.\n"));
+			status = NT_STATUS_NONE_MAPPED;
+			goto failed;
+		}
 
 		*unixid = talloc(mem_ctx, struct unixid);
 		if (*unixid == NULL) {
 			status = NT_STATUS_NO_MEMORY;
 			goto failed;
 		}
-		(*unixid)->id = rid - 1;
-		(*unixid)->type = ID_TYPE_GID;
+
+		(*unixid)->id = new_xid;
+
+		if (strcmp(type, "ID_TYPE_BOTH") == 0) {
+			(*unixid)->type = ID_TYPE_BOTH;
+		} else if (strcmp(type, "ID_TYPE_UID") == 0) {
+			(*unixid)->type = ID_TYPE_UID;
+		} else {
+			(*unixid)->type = ID_TYPE_GID;
+		}
 
 		talloc_free(tmp_ctx);
 		return NT_STATUS_OK;
-	 }
+	}
+
+	DEBUG(6, ("No existing mapping found, attempting to create one.\n"));
 
 	trans = ldb_transaction_start(ldb);
 	if (trans != LDB_SUCCESS) {
@@ -585,6 +582,12 @@ NTSTATUS idmap_sid_to_xid(struct idmap_context *idmap_ctx, TALLOC_CTX *mem_ctx,
 		goto failed;
 	}
 
+	ret = ldb_msg_add_string(map_msg, "type", "ID_TYPE_BOTH");
+	if (ret != LDB_SUCCESS) {
+		status = NT_STATUS_NONE_MAPPED;
+		goto failed;
+	}
+
 	ret = ldb_msg_add_string(map_msg, "cn", sid_string);
 	if (ret != LDB_SUCCESS) {
 		status = NT_STATUS_NONE_MAPPED;
-- 
cgit 


From 6abdaefb0f726d1b45b7eb698a88bfe8e354743a Mon Sep 17 00:00:00 2001
From: Andrew Tridgell <tridge@samba.org>
Date: Mon, 14 Apr 2008 11:30:10 +0200
Subject: show what type of idmapping has failed (This used to be commit
 8a222419528153b889cb1a7eae09a155f196b9b5)

---
 source4/winbind/idmap.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

(limited to 'source4/winbind/idmap.c')

diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index 92ac41f1d2..0c729825db 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -654,7 +654,7 @@ NTSTATUS idmap_xids_to_sids(struct idmap_context *idmap_ctx,
 							&id[i].sid);
 		}
 		if (!NT_STATUS_IS_OK(id[i].status)) {
-			DEBUG(1, ("idmapping failed for id[%d]\n", i));
+			DEBUG(1, ("idmapping xid_to_sid failed for id[%d]\n", i));
 			error_count++;
 		}
 	}
@@ -699,7 +699,7 @@ NTSTATUS idmap_sids_to_xids(struct idmap_context *idmap_ctx,
 							&id[i].unixid);
 		}
 		if (!NT_STATUS_IS_OK(id[i].status)) {
-			DEBUG(1, ("idmapping failed for id[%d]\n", i));
+			DEBUG(1, ("idmapping sid_to_xid failed for id[%d]\n", i));
 			error_count++;
 		}
 	}
-- 
cgit 


From 21fc7673780aa1d7c0caab7b17ff9171238913ba Mon Sep 17 00:00:00 2001
From: Jelmer Vernooij <jelmer@samba.org>
Date: Thu, 17 Apr 2008 12:23:44 +0200
Subject: Specify event_context to ldb_wrap_connect explicitly. (This used to
 be commit b4e1ae07a284c044704322446c94351c2decff91)

---
 source4/winbind/idmap.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

(limited to 'source4/winbind/idmap.c')

diff --git a/source4/winbind/idmap.c b/source4/winbind/idmap.c
index 0c729825db..333a86445a 100644
--- a/source4/winbind/idmap.c
+++ b/source4/winbind/idmap.c
@@ -158,6 +158,7 @@ static struct dom_sid *idmap_msg_get_dom_sid(TALLOC_CTX *mem_ctx,
  * \return allocated idmap_context on success, NULL on error
  */
 struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
+				 struct event_context *ev_ctx,
 		struct loadparm_context *lp_ctx)
 {
 	struct idmap_context *idmap_ctx;
@@ -169,7 +170,7 @@ struct idmap_context *idmap_init(TALLOC_CTX *mem_ctx,
 
 	idmap_ctx->lp_ctx = lp_ctx;
 
-	idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, lp_ctx,
+	idmap_ctx->ldb_ctx = ldb_wrap_connect(mem_ctx, ev_ctx, lp_ctx,
 					      lp_idmap_url(lp_ctx),
 					      system_session(mem_ctx, lp_ctx),
 					      NULL, 0, NULL);
-- 
cgit