r7992: Adding PADL's idmap_ad plugin (taken from the latest

xad_oss_plugins-tarball).

Guenther

3 files changed, 386 insertions, 0 deletions

diff --git a/source/Makefile.in b/source/Makefile.in
index 0fbd0464f6a..6bf9d0bbea7 100644
--- a/source/Makefile.in
+++ b/source/Makefile.in
@@ -1151,6 +1151,11 @@ bin/idmap_rid.@SHLIBEXT@: sam/idmap_rid.@PICSUFFIX@
 	@$(SHLD) $(LDSHFLAGS) -o $@ sam/idmap_rid.@PICSUFFIX@ \
 		@SONAMEFLAG@`basename $@`
 
+bin/idmap_ad.@SHLIBEXT@: sam/idmap_ad.@PICSUFFIX@
+	@echo "Building plugin $@"
+	@$(SHLD) $(LDSHFLAGS) -o $@ sam/idmap_ad.@PICSUFFIX@ \
+		@SONAMEFLAG@`basename $@`
+
 bin/weird.@SHLIBEXT@: $(DEVEL_HELP_WEIRD_OBJ:.o=.@PICSUFFIX@)
 	@echo "Building plugin $@"
 	@$(SHLD) $(LDSHFLAGS) -o $@ $(DEVEL_HELP_WEIRD_OBJ:.o=.@PICSUFFIX@) \
diff --git a/source/configure.in b/source/configure.in
index e35c95d9322..3f42d9ffed4 100644
--- a/source/configure.in
+++ b/source/configure.in
@@ -4641,6 +4641,7 @@ SMB_SUBSYSTEM(RPC,smbd/server.o)
 SMB_MODULE(idmap_ldap, sam/idmap_ldap.o, "bin/idmap_ldap.$SHLIBEXT", IDMAP)
 SMB_MODULE(idmap_tdb, sam/idmap_tdb.o, "bin/idmap_tdb.$SHLIBEXT", IDMAP)
 SMB_MODULE(idmap_rid, sam/idmap_rid.o, "bin/idmap_rid.$SHLIBEXT", IDMAP)
+SMB_MODULE(idmap_ad, sam/idmap_ad.o, "bin/idmap_ad.$SHLIBEXT", IDMAP)
 SMB_SUBSYSTEM(IDMAP,sam/idmap.o)
 
 SMB_MODULE(charset_weird, modules/weird.o, "bin/weird.$SHLIBEXT", CHARSET)
diff --git a/source/sam/idmap_ad.c b/source/sam/idmap_ad.c
new file mode 100644
index 00000000000..b3b9b7ad47b
--- /dev/null
+++ b/source/sam/idmap_ad.c
@@ -0,0 +1,380 @@
+/*
+ *  idmap_ad: map between Active Directory and RFC 2307 accounts
+ *  Copyright (C) 2001-2004 PADL Software Pty Ltd. All rights reserved.
+ *
+ *  This program is free software; you can redistribute it and/or modify
+ *  it under the terms of the GNU General Public License as published by
+ *  the Free Software Foundation; either version 2 of the License, or
+ *  (at your option) any later version.
+ */
+/*
+ * Unix SMB/CIFS implementation.
+ *
+ * Winbind ADS backend functions
+ *
+ * Copyright (C) Andrew Tridgell 2001
+ * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
+ * Copyright (C) Gerald (Jerry) Carter 2004
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ */
+
+#include "includes.h"
+
+#undef DBGC_CLASS
+#define DBGC_CLASS DBGC_IDMAP
+
+#ifndef ATTR_UIDNUMBER
+/* #define ATTR_UIDNUMBER "msSFU30UidNumber" */
+#define ATTR_UIDNUMBER "uidNumber"
+#endif
+
+#ifndef ATTR_GIDNUMBER
+/* #define ATTR_GIDNUMBER "msSFU30GidNumber" */
+#define ATTR_GIDNUMBER "gidNumber"
+#endif
+
+#define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
+
+NTSTATUS init_module(void);
+
+static ADS_STRUCT *ad_idmap_ads = NULL;
+static char *ad_idmap_uri = NULL;
+
+static ADS_STRUCT *ad_idmap_cached_connection(void)
+{
+	ADS_STRUCT *ads;
+	ADS_STATUS status;
+	BOOL local = False;
+
+#ifdef ADS_AUTH_EXTERNAL_BIND
+	local = ((strncmp(ad_idmap_uri, "ldapi://", sizeof("ldapi://") - 1)) == 0);
+#endif /* ADS_AUTH_EXTERNAL_BIND */
+
+	if (ad_idmap_ads != NULL) {
+		ads = ad_idmap_ads;
+
+		/* check for a valid structure */
+
+		DEBUG(7, ("Current tickets expire at %d, time is now %d\n",
+			  (uint32) ads->auth.expire, (uint32) time(NULL)));
+		if ( ads->config.realm && (ads->auth.expire > time(NULL))) {
+			return ads;
+		} else {
+			/* we own this ADS_STRUCT so make sure it goes away */
+			ads->is_mine = True;
+			ads_destroy( &ads );
+			ads_kdestroy(WINBIND_CCACHE_NAME);
+			ad_idmap_ads = NULL;
+		}
+	}
+
+	if (!local) {
+		/* we don't want this to affect the users ccache */
+		setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
+	}
+
+	ads = ads_init(NULL, NULL, NULL);
+	if (!ads) {
+		DEBUG(1,("ads_init failed\n"));
+		return NULL;
+	}
+
+	/* if ad_imap_uri is not empty we try to connect to
+	 * the given URI in smb.conf. Else try to connect to
+	 * one of the DCs
+	 */
+	if (*ad_idmap_uri != '\0') {
+		ads->server.ldap_uri = SMB_STRDUP(ad_idmap_uri);
+		if (ads->server.ldap_uri == NULL) {
+			return NULL;
+		}
+	}
+	else {
+		ads->server.ldap_uri    = NULL;
+		ads->server.ldap_server = NULL;
+	}
+
+#ifdef ADS_AUTH_EXTERNAL_BIND
+	if (local)
+		ads->auth.flags |= ADS_AUTH_EXTERNAL_BIND;
+	else
+#endif
+	{
+		/* the machine acct password might have change - fetch it every time */
+		SAFE_FREE(ads->auth.password);
+		ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
+
+		SAFE_FREE(ads->auth.realm);
+		ads->auth.realm = SMB_STRDUP(lp_realm());
+	}
+
+	status = ads_connect(ads);
+	if (!ADS_ERR_OK(status)) {
+		DEBUG(1, ("ad_idmap_init: failed to connect to AD\n"));
+		ads_destroy(&ads);
+		return NULL;
+	}
+
+	ads->is_mine = False;
+
+	ad_idmap_ads = ads;
+	return ads;
+}
+
+static NTSTATUS ad_idmap_init(char *uri)
+{
+	ad_idmap_uri = SMB_STRDUP(uri);
+	if (ad_idmap_uri == NULL) {
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	return NT_STATUS_OK;
+}
+
+static NTSTATUS ad_idmap_get_sid_from_id(DOM_SID *sid, unid_t unid, int id_type)
+{
+	ADS_STATUS rc;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	const char *attrs[] = { "objectSid", NULL };
+	void *res = NULL;
+	void *msg = NULL;
+	char *expr = NULL;
+	fstring sid_string;
+	int count;
+	ADS_STRUCT *ads;
+
+	if (sid == NULL) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	ads = ad_idmap_cached_connection();
+	if (ads == NULL) {
+		DEBUG(1, ("ad_idmap_get_id_from_sid ADS uninitialized\n"));
+		return NT_STATUS_NOT_SUPPORTED;
+	}
+
+	switch (id_type & ID_TYPEMASK) {
+		case ID_USERID:
+			if (asprintf(&expr, "(&(|(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d))(%s=%d))",
+				ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
+				ATTR_UIDNUMBER, (int)unid.uid) == -1) {
+				return NT_STATUS_NO_MEMORY;
+			}
+			break;
+		case ID_GROUPID:
+			if (asprintf(&expr, "(&(|(sAMAccountType=%d)(sAMAccountType=%d))(%s=%d))",
+				ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP,
+				ATTR_GIDNUMBER, (int)unid.gid) == -1) {
+				return NT_STATUS_NO_MEMORY;
+			}
+			break;
+		default:
+			return NT_STATUS_INVALID_PARAMETER;
+			break;
+	}
+
+	rc = ads_search_retry(ads, &res, expr, attrs);
+	free(expr);
+	if (!ADS_ERR_OK(rc)) {
+		DEBUG(1, ("ad_idmap_get_sid_from_id: ads_search: %s\n", ads_errstr(rc)));
+		goto done;
+	}
+
+	count = ads_count_replies(ads, res);
+	if (count == 0) {
+		DEBUG(1, ("ad_idmap_get_sid_from_id: ads_count_replies: no results\n"));
+		goto done;
+	} else if (count != 1) {
+		DEBUG(1, ("ad_idmap_get_sid_from_id: ads_count_replies: incorrect cardinality\n"));
+		goto done;
+	}
+
+	msg = ads_first_entry(ads, res);
+	if (msg == NULL) {
+		DEBUG(1, ("ad_idmap_get_sid_from_id: ads_first_entry: could not retrieve search result\n"));
+		goto done;
+	}
+
+	if (!ads_pull_sid(ads, msg, "objectSid", sid)) {
+		DEBUG(1, ("ad_idmap_get_sid_from_id: ads_pull_sid: could not retrieve SID from entry\n"));
+		goto done;
+	}
+
+	status = NT_STATUS_OK;
+	DEBUG(1, ("ad_idmap_get_sid_from_id mapped POSIX %s %d to SID [%s]\n",
+		(id_type == ID_GROUPID) ? "GID" : "UID", (int)unid.uid,
+		sid_to_string(sid_string, sid)));
+
+done:
+	if (res != NULL) {
+		ads_msgfree(ads, res);
+	}
+
+	return status;
+}
+
+static NTSTATUS ad_idmap_get_id_from_sid(unid_t *unid, int *id_type, const DOM_SID *sid)
+{
+	ADS_STATUS rc;
+	NTSTATUS status = NT_STATUS_NONE_MAPPED;
+	const char *attrs[] = { "sAMAccountType", ATTR_UIDNUMBER, ATTR_GIDNUMBER, NULL };
+	void *res = NULL;
+	void *msg = NULL;
+	char *expr = NULL;
+	uint32 atype, uid;
+	char *sidstr;
+	fstring sid_string;
+	int count;
+	ADS_STRUCT *ads;
+
+	if (unid == NULL) {
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	ads = ad_idmap_cached_connection();
+	if (ads == NULL) {
+		DEBUG(1, ("ad_idmap_get_id_from_sid ADS uninitialized\n"));
+		return NT_STATUS_NOT_SUPPORTED;
+	}
+
+	sidstr = sid_binstring(sid);
+	if (asprintf(&expr, "(objectSid=%s)", sidstr) == -1) {
+		free(sidstr);
+		return NT_STATUS_NO_MEMORY;
+	}
+
+	rc = ads_search_retry(ads, &res, expr, attrs);
+	free(sidstr);
+	free(expr);
+	if (!ADS_ERR_OK(rc)) {
+		DEBUG(1, ("ad_idmap_get_id_from_sid: ads_search: %s\n", ads_errstr(rc)));
+		goto done;
+	}
+
+	count = ads_count_replies(ads, res);
+	if (count == 0) {
+		DEBUG(1, ("ad_idmap_get_id_from_sid: ads_count_replies: no results\n"));
+		goto done;
+	} else if (count != 1) {
+		DEBUG(1, ("ad_idmap_get_id_from_sid: ads_count_replies: incorrect cardinality\n"));
+		goto done;
+	}
+
+	msg = ads_first_entry(ads, res);
+	if (msg == NULL) {
+		DEBUG(1, ("ad_idmap_get_id_from_sid: ads_first_entry: could not retrieve search result\n"));
+		goto done;
+	}
+
+	if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype)) {
+		DEBUG(1, ("ad_idmap_get_id_from_sid: ads_pull_uint32: could not read SAM account type\n"));
+		goto done;
+	}
+
+	switch (atype & 0xF0000000) {
+	case ATYPE_SECURITY_GLOBAL_GROUP:
+	case ATYPE_SECURITY_LOCAL_GROUP:
+		*id_type = ID_GROUPID;
+		break;
+	case ATYPE_NORMAL_ACCOUNT:
+	case ATYPE_WORKSTATION_TRUST:
+	case ATYPE_INTERDOMAIN_TRUST:
+		*id_type = ID_USERID;
+		break;
+	default:
+		DEBUG(1, ("ad_idmap_get_id_from_sid: unrecognized SAM account type %08x\n", atype));
+		goto done;
+		break;
+	}
+
+	if (!ads_pull_uint32(ads, msg, (*id_type == ID_GROUPID) ? ATTR_GIDNUMBER : ATTR_UIDNUMBER, &uid)) {
+		DEBUG(1, ("ad_idmap_get_id_from_sid: ads_pull_uint32: could not read attribute '%s'\n",
+			(*id_type == ID_GROUPID) ? ATTR_GIDNUMBER : ATTR_UIDNUMBER));
+		goto done;
+	}
+
+	unid->uid = (uid_t)uid;
+
+	status = NT_STATUS_OK;
+	DEBUG(1, ("ad_idmap_get_id_from_sid mapped SID [%s] to POSIX %s %d\n",
+		sid_to_string(sid_string, sid),
+		(*id_type == ID_GROUPID) ? "GID" : "UID", uid));
+
+done:
+	if (res != NULL) {
+		ads_msgfree(ads, res);
+	}
+
+	return status;
+
+}
+
+static NTSTATUS ad_idmap_set_mapping(const DOM_SID *sid, unid_t id, int id_type)
+{
+	/* Not supported, and probably won't be... */
+	/* (It's not particularly feasible with a single-master model.) */
+
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS ad_idmap_close(void)
+{
+	ADS_STRUCT *ads = ad_idmap_ads;
+
+	if (ads != NULL) {
+		/* we own this ADS_STRUCT so make sure it goes away */
+		ads->is_mine = True;
+		ads_destroy( &ads );
+		ad_idmap_ads = NULL;
+	}
+
+	return NT_STATUS_OK;
+}
+
+/* New for beta3 */
+static NTSTATUS ad_idmap_allocate_rid(uint32 *rid, int rid_type)
+{
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static NTSTATUS ad_idmap_allocate_id(unid_t *id, int id_type)
+{
+	return NT_STATUS_NOT_IMPLEMENTED;
+}
+
+static void ad_idmap_status(void)
+{
+	DEBUG(0, ("AD IDMAP Status not available\n"));
+}
+
+static struct idmap_methods ad_methods = {
+	ad_idmap_init,
+	ad_idmap_allocate_rid,
+	ad_idmap_allocate_id,
+	ad_idmap_get_sid_from_id,
+	ad_idmap_get_id_from_sid,
+	ad_idmap_set_mapping,
+	ad_idmap_close,
+	ad_idmap_status
+};
+
+
+/* support for new authentication subsystem */
+NTSTATUS init_module(void)
+{
+	return smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION, "ad", &ad_methods);
+}
+