2 Unix SMB/CIFS implementation.
4 Winbind daemon - user related functions
6 Copyright (C) Tim Potter 2000
7 Copyright (C) Jeremy Allison 2001.
8 Copyright (C) Gerald (Jerry) Carter 2003.
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 #define DBGC_CLASS DBGC_WINBIND
31 extern userdom_struct current_user_info;
33 static BOOL fillup_pw_field(const char *lp_template,
46 if (in && !strequal(in,"") && lp_security() == SEC_ADS && use_nss_info("sfu")) {
47 safe_strcpy(out, in, sizeof(fstring) - 1);
51 /* Home directory and shell - use template config parameters. The
52 defaults are /tmp for the home directory and /bin/false for
55 /* The substitution of %U and %D in the 'template homedir' is done
56 by alloc_sub_specified() below. */
58 templ = alloc_sub_specified(lp_template, username, domname, uid, gid);
63 safe_strcpy(out, templ, sizeof(fstring) - 1);
69 /* Fill a pwent structure with information we have obtained */
71 static BOOL winbindd_fill_pwent(char *dom_name, char *user_name,
72 DOM_SID *user_sid, DOM_SID *group_sid,
73 char *full_name, char *homedir, char *shell,
74 struct winbindd_pw *pw)
76 fstring output_username;
79 if (!pw || !dom_name || !user_name)
82 /* Resolve the uid number */
84 if (!NT_STATUS_IS_OK(idmap_sid_to_uid(user_sid, &pw->pw_uid, 0))) {
85 DEBUG(1, ("error getting user id for sid %s\n", sid_to_string(sid_string, user_sid)));
89 /* Resolve the gid number */
91 if (!NT_STATUS_IS_OK(idmap_sid_to_gid(group_sid, &pw->pw_gid, 0))) {
92 DEBUG(1, ("error getting group id for sid %s\n", sid_to_string(sid_string, group_sid)));
96 strlower_m(user_name);
100 fill_domain_username(output_username, dom_name, user_name);
102 safe_strcpy(pw->pw_name, output_username, sizeof(pw->pw_name) - 1);
104 /* Full name (gecos) */
106 safe_strcpy(pw->pw_gecos, full_name, sizeof(pw->pw_gecos) - 1);
108 /* Home directory and shell - use template config parameters. The
109 defaults are /tmp for the home directory and /bin/false for
112 /* The substitution of %U and %D in the 'template homedir' is done
113 by alloc_sub_specified() below. */
115 fstrcpy(current_user_info.domain, dom_name);
117 if (!fillup_pw_field(lp_template_homedir(), user_name, dom_name,
118 pw->pw_uid, pw->pw_gid, homedir, pw->pw_dir))
121 if (!fillup_pw_field(lp_template_shell(), user_name, dom_name,
122 pw->pw_uid, pw->pw_gid, shell, pw->pw_shell))
125 /* Password - set to "x" as we can't generate anything useful here.
126 Authentication can be done using the pam_winbind module. */
128 safe_strcpy(pw->pw_passwd, "x", sizeof(pw->pw_passwd) - 1);
133 /* Wrapper for domain->methods->query_user, only on the parent->child pipe */
135 enum winbindd_result winbindd_dual_userinfo(struct winbindd_domain *domain,
136 struct winbindd_cli_state *state)
139 WINBIND_USERINFO user_info;
142 /* Ensure null termination */
143 state->request.data.sid[sizeof(state->request.data.sid)-1]='\0';
145 DEBUG(3, ("[%5lu]: lookupsid %s\n", (unsigned long)state->pid,
146 state->request.data.sid));
148 if (!string_to_sid(&sid, state->request.data.sid)) {
149 DEBUG(5, ("%s not a SID\n", state->request.data.sid));
150 return WINBINDD_ERROR;
153 status = domain->methods->query_user(domain, state->mem_ctx,
155 if (!NT_STATUS_IS_OK(status)) {
156 DEBUG(1, ("error getting user info for sid %s\n",
157 sid_string_static(&sid)));
158 return WINBINDD_ERROR;
161 fstrcpy(state->response.data.user_info.acct_name, user_info.acct_name);
162 fstrcpy(state->response.data.user_info.full_name, user_info.full_name);
163 fstrcpy(state->response.data.user_info.homedir, user_info.homedir);
164 fstrcpy(state->response.data.user_info.shell, user_info.shell);
165 if (!sid_peek_check_rid(&domain->sid, &user_info.group_sid,
166 &state->response.data.user_info.group_rid)) {
167 DEBUG(1, ("Could not extract group rid out of %s\n",
168 sid_string_static(&sid)));
169 return WINBINDD_ERROR;
175 struct getpwsid_state {
176 struct winbindd_cli_state *state;
177 struct winbindd_domain *domain;
188 static void getpwsid_queryuser_recv(void *private_data, BOOL success,
189 const char *acct_name,
190 const char *full_name,
194 static void getpwsid_sid2uid_recv(void *private_data, BOOL success, uid_t uid);
195 static void getpwsid_sid2gid_recv(void *private_data, BOOL success, gid_t gid);
197 static void winbindd_getpwsid(struct winbindd_cli_state *state,
200 struct getpwsid_state *s;
202 s = TALLOC_P(state->mem_ctx, struct getpwsid_state);
204 DEBUG(0, ("talloc failed\n"));
209 s->domain = find_domain_from_sid_noinit(sid);
210 if (s->domain == NULL) {
211 DEBUG(3, ("Could not find domain for sid %s\n",
212 sid_string_static(sid)));
216 sid_copy(&s->user_sid, sid);
218 query_user_async(s->state->mem_ctx, s->domain, sid,
219 getpwsid_queryuser_recv, s);
223 request_error(state);
226 static void getpwsid_queryuser_recv(void *private_data, BOOL success,
227 const char *acct_name,
228 const char *full_name,
234 struct getpwsid_state *s =
235 talloc_get_type_abort(private_data, struct getpwsid_state);
238 DEBUG(5, ("Could not query user %s\\%s\n", s->domain->name,
240 request_error(s->state);
244 fstrcpy( username, acct_name );
245 strlower_m( username );
246 s->username = talloc_strdup(s->state->mem_ctx, username);
247 s->fullname = talloc_strdup(s->state->mem_ctx, full_name);
248 s->homedir = talloc_strdup(s->state->mem_ctx, homedir);
249 s->shell = talloc_strdup(s->state->mem_ctx, shell);
250 sid_copy(&s->group_sid, &s->domain->sid);
251 sid_append_rid(&s->group_sid, group_rid);
253 winbindd_sid2uid_async(s->state->mem_ctx, &s->user_sid,
254 getpwsid_sid2uid_recv, s);
257 static void getpwsid_sid2uid_recv(void *private_data, BOOL success, uid_t uid)
259 struct getpwsid_state *s =
260 talloc_get_type_abort(private_data, struct getpwsid_state);
263 DEBUG(5, ("Could not query user's %s\\%s uid\n",
264 s->domain->name, s->username));
265 request_error(s->state);
270 winbindd_sid2gid_async(s->state->mem_ctx, &s->group_sid,
271 getpwsid_sid2gid_recv, s);
274 static void getpwsid_sid2gid_recv(void *private_data, BOOL success, gid_t gid)
276 struct getpwsid_state *s =
277 talloc_get_type_abort(private_data, struct getpwsid_state);
278 struct winbindd_pw *pw;
279 fstring output_username;
282 DEBUG(5, ("Could not query user's %s\\%s\n gid",
283 s->domain->name, s->username));
289 pw = &s->state->response.data.pw;
292 fill_domain_username(output_username, s->domain->name, s->username);
293 safe_strcpy(pw->pw_name, output_username, sizeof(pw->pw_name) - 1);
294 safe_strcpy(pw->pw_gecos, s->fullname, sizeof(pw->pw_gecos) - 1);
296 fstrcpy(current_user_info.domain, s->domain->name);
298 if (!fillup_pw_field(lp_template_homedir(), s->username, s->domain->name,
299 pw->pw_uid, pw->pw_gid, s->homedir, pw->pw_dir)) {
300 DEBUG(5, ("Could not compose homedir\n"));
304 if (!fillup_pw_field(lp_template_shell(), s->username, s->domain->name,
305 pw->pw_uid, pw->pw_gid, s->shell, pw->pw_shell)) {
306 DEBUG(5, ("Could not compose shell\n"));
310 /* Password - set to "x" as we can't generate anything useful here.
311 Authentication can be done using the pam_winbind module. */
313 safe_strcpy(pw->pw_passwd, "x", sizeof(pw->pw_passwd) - 1);
315 request_ok(s->state);
319 request_error(s->state);
322 /* Return a password structure from a username. */
324 static void getpwnam_name2sid_recv(void *private_data, BOOL success,
325 const DOM_SID *sid, enum SID_NAME_USE type);
327 void winbindd_getpwnam(struct winbindd_cli_state *state)
329 struct winbindd_domain *domain;
330 fstring domname, username;
332 /* Ensure null termination */
333 state->request.data.username[sizeof(state->request.data.username)-1]='\0';
335 DEBUG(3, ("[%5lu]: getpwnam %s\n", (unsigned long)state->pid,
336 state->request.data.username));
338 if (!parse_domain_user(state->request.data.username, domname,
340 DEBUG(0, ("Could not parse domain user: %s\n",
341 state->request.data.username));
342 request_error(state);
346 /* Get info for the domain */
348 domain = find_domain_from_name(domname);
350 if (domain == NULL) {
351 DEBUG(7, ("could not find domain entry for domain %s\n",
353 request_error(state);
357 if ( strequal(domname, lp_workgroup()) && lp_winbind_trusted_domains_only() ) {
358 DEBUG(7,("winbindd_getpwnam: My domain -- rejecting getpwnam() for %s\\%s.\n",
360 request_error(state);
364 /* Get rid and name type from name. The following costs 1 packet */
366 winbindd_lookupname_async(state->mem_ctx, domname, username,
367 getpwnam_name2sid_recv, state);
370 static void getpwnam_name2sid_recv(void *private_data, BOOL success,
371 const DOM_SID *sid, enum SID_NAME_USE type)
373 struct winbindd_cli_state *state = private_data;
376 DEBUG(5, ("Could not lookup name for user %s\n",
377 state->request.data.username));
378 request_error(state);
382 if ((type != SID_NAME_USER) && (type != SID_NAME_COMPUTER)) {
383 DEBUG(5, ("%s is not a user\n", state->request.data.username));
384 request_error(state);
388 winbindd_getpwsid(state, sid);
391 /* Return a password structure given a uid number */
393 void winbindd_getpwuid(struct winbindd_cli_state *state)
398 /* Bug out if the uid isn't in the winbind range */
400 if ((state->request.data.uid < server_state.uid_low ) ||
401 (state->request.data.uid > server_state.uid_high)) {
402 request_error(state);
406 DEBUG(3, ("[%5lu]: getpwuid %lu\n", (unsigned long)state->pid,
407 (unsigned long)state->request.data.uid));
409 status = idmap_uid_to_sid(&user_sid, state->request.data.uid,
410 ID_QUERY_ONLY | ID_CACHE_ONLY);
412 if (!NT_STATUS_IS_OK(status)) {
413 DEBUG(5, ("Could not find SID for uid %lu\n",
414 (unsigned long)state->request.data.uid));
415 request_error(state);
419 winbindd_getpwsid(state, &user_sid);
423 * set/get/endpwent functions
426 /* Rewind file pointer for ntdom passwd database */
428 static BOOL winbindd_setpwent_internal(struct winbindd_cli_state *state)
430 struct winbindd_domain *domain;
432 DEBUG(3, ("[%5lu]: setpwent\n", (unsigned long)state->pid));
434 /* Check user has enabled this */
436 if (!lp_winbind_enum_users()) {
440 /* Free old static data if it exists */
442 if (state->getpwent_state != NULL) {
443 free_getent_state(state->getpwent_state);
444 state->getpwent_state = NULL;
448 /* add any local users we have */
450 if ( (domain_state = (struct getent_state *)malloc(sizeof(struct getent_state))) == NULL )
453 ZERO_STRUCTP(domain_state);
455 /* Add to list of open domains */
457 DLIST_ADD(state->getpwent_state, domain_state);
460 /* Create sam pipes for each domain we know about */
462 for(domain = domain_list(); domain != NULL; domain = domain->next) {
463 struct getent_state *domain_state;
466 /* don't add our domaina if we are a PDC or if we
467 are a member of a Samba domain */
469 if ( (IS_DC || lp_winbind_trusted_domains_only())
470 && strequal(domain->name, lp_workgroup()) )
475 /* Create a state record for this domain */
477 if ((domain_state = SMB_MALLOC_P(struct getent_state)) == NULL) {
478 DEBUG(0, ("malloc failed\n"));
482 ZERO_STRUCTP(domain_state);
484 fstrcpy(domain_state->domain_name, domain->name);
486 /* Add to list of open domains */
488 DLIST_ADD(state->getpwent_state, domain_state);
491 state->getpwent_initialized = True;
495 void winbindd_setpwent(struct winbindd_cli_state *state)
497 if (winbindd_setpwent_internal(state)) {
500 request_error(state);
504 /* Close file pointer to ntdom passwd database */
506 void winbindd_endpwent(struct winbindd_cli_state *state)
508 DEBUG(3, ("[%5lu]: endpwent\n", (unsigned long)state->pid));
510 free_getent_state(state->getpwent_state);
511 state->getpwent_initialized = False;
512 state->getpwent_state = NULL;
516 /* Get partial list of domain users for a domain. We fill in the sam_entries,
517 and num_sam_entries fields with domain user information. The dispinfo_ndx
518 field is incremented to the index of the next user to fetch. Return True if
519 some users were returned, False otherwise. */
521 static BOOL get_sam_user_entries(struct getent_state *ent, TALLOC_CTX *mem_ctx)
525 WINBIND_USERINFO *info;
526 struct getpwent_user *name_list = NULL;
528 struct winbindd_domain *domain;
529 struct winbindd_methods *methods;
532 if (ent->num_sam_entries)
535 if (!(domain = find_domain_from_name(ent->domain_name))) {
536 DEBUG(3, ("no such domain %s in get_sam_user_entries\n",
541 methods = domain->methods;
543 /* Free any existing user info */
545 SAFE_FREE(ent->sam_entries);
546 ent->num_sam_entries = 0;
548 /* Call query_user_list to get a list of usernames and user rids */
552 status = methods->query_user_list(domain, mem_ctx, &num_entries,
556 struct getpwent_user *tnl;
558 tnl = SMB_REALLOC_ARRAY(name_list, struct getpwent_user, ent->num_sam_entries + num_entries);
561 DEBUG(0,("get_sam_user_entries realloc failed.\n"));
562 SAFE_FREE(name_list);
568 for (i = 0; i < num_entries; i++) {
569 /* Store account name and gecos */
570 if (!info[i].acct_name) {
571 fstrcpy(name_list[ent->num_sam_entries + i].name, "");
573 fstrcpy(name_list[ent->num_sam_entries + i].name,
576 if (!info[i].full_name) {
577 fstrcpy(name_list[ent->num_sam_entries + i].gecos, "");
579 fstrcpy(name_list[ent->num_sam_entries + i].gecos,
582 if (!info[i].homedir) {
583 fstrcpy(name_list[ent->num_sam_entries + i].homedir, "");
585 fstrcpy(name_list[ent->num_sam_entries + i].homedir,
588 if (!info[i].shell) {
589 fstrcpy(name_list[ent->num_sam_entries + i].shell, "");
591 fstrcpy(name_list[ent->num_sam_entries + i].shell,
596 /* User and group ids */
597 sid_copy(&name_list[ent->num_sam_entries+i].user_sid,
599 sid_copy(&name_list[ent->num_sam_entries+i].group_sid,
603 ent->num_sam_entries += num_entries;
605 /* Fill in remaining fields */
607 ent->sam_entries = name_list;
608 ent->sam_entry_index = 0;
609 result = ent->num_sam_entries > 0;
616 /* Fetch next passwd entry from ntdom database */
618 #define MAX_GETPWENT_USERS 500
620 void winbindd_getpwent(struct winbindd_cli_state *state)
622 struct getent_state *ent;
623 struct winbindd_pw *user_list;
624 int num_users, user_list_ndx = 0, i;
626 DEBUG(3, ("[%5lu]: getpwent\n", (unsigned long)state->pid));
628 /* Check user has enabled this */
630 if (!lp_winbind_enum_users()) {
631 request_error(state);
635 /* Allocate space for returning a chunk of users */
637 num_users = MIN(MAX_GETPWENT_USERS, state->request.data.num_entries);
639 if ((state->response.extra_data = SMB_MALLOC_ARRAY(struct winbindd_pw, num_users)) == NULL) {
640 request_error(state);
644 memset(state->response.extra_data, 0, num_users *
645 sizeof(struct winbindd_pw));
647 user_list = (struct winbindd_pw *)state->response.extra_data;
649 if (!state->getpwent_initialized)
650 winbindd_setpwent_internal(state);
652 if (!(ent = state->getpwent_state)) {
653 request_error(state);
657 /* Start sending back users */
659 for (i = 0; i < num_users; i++) {
660 struct getpwent_user *name_list = NULL;
663 /* Do we need to fetch another chunk of users? */
665 if (ent->num_sam_entries == ent->sam_entry_index) {
668 !get_sam_user_entries(ent, state->mem_ctx)) {
669 struct getent_state *next_ent;
671 /* Free state information for this domain */
673 SAFE_FREE(ent->sam_entries);
675 next_ent = ent->next;
676 DLIST_REMOVE(state->getpwent_state, ent);
682 /* No more domains */
688 name_list = ent->sam_entries;
690 /* Lookup user info */
692 result = winbindd_fill_pwent(
694 name_list[ent->sam_entry_index].name,
695 &name_list[ent->sam_entry_index].user_sid,
696 &name_list[ent->sam_entry_index].group_sid,
697 name_list[ent->sam_entry_index].gecos,
698 name_list[ent->sam_entry_index].homedir,
699 name_list[ent->sam_entry_index].shell,
700 &user_list[user_list_ndx]);
702 ent->sam_entry_index++;
704 /* Add user to return list */
709 state->response.data.num_entries++;
710 state->response.length +=
711 sizeof(struct winbindd_pw);
714 DEBUG(1, ("could not lookup domain user %s\n",
715 name_list[ent->sam_entry_index].name));
720 if (user_list_ndx > 0)
723 request_error(state);
726 /* List domain users without mapping to unix ids */
728 void winbindd_list_users(struct winbindd_cli_state *state)
730 struct winbindd_domain *domain;
731 WINBIND_USERINFO *info;
732 const char *which_domain;
733 uint32 num_entries = 0, total_entries = 0;
734 char *ted, *extra_data = NULL;
735 int extra_data_len = 0;
736 enum winbindd_result rv = WINBINDD_ERROR;
738 DEBUG(3, ("[%5lu]: list users\n", (unsigned long)state->pid));
740 /* Ensure null termination */
741 state->request.domain_name[sizeof(state->request.domain_name)-1]='\0';
742 which_domain = state->request.domain_name;
744 /* Enumerate over trusted domains */
746 for (domain = domain_list(); domain; domain = domain->next) {
748 struct winbindd_methods *methods;
751 /* if we have a domain name restricting the request and this
752 one in the list doesn't match, then just bypass the remainder
755 if ( *which_domain && !strequal(which_domain, domain->name) )
758 methods = domain->methods;
760 /* Query display info */
761 status = methods->query_user_list(domain, state->mem_ctx,
762 &num_entries, &info);
764 if (num_entries == 0)
767 /* Allocate some memory for extra data */
768 total_entries += num_entries;
770 ted = SMB_REALLOC(extra_data, sizeof(fstring) * total_entries);
773 DEBUG(0,("failed to enlarge buffer!\n"));
774 SAFE_FREE(extra_data);
779 /* Pack user list into extra data fields */
781 for (i = 0; i < num_entries; i++) {
782 fstring acct_name, name;
784 if (!info[i].acct_name) {
785 fstrcpy(acct_name, "");
787 fstrcpy(acct_name, info[i].acct_name);
790 fill_domain_username(name, domain->name, acct_name);
792 /* Append to extra data */
793 memcpy(&extra_data[extra_data_len], name,
795 extra_data_len += strlen(name);
796 extra_data[extra_data_len++] = ',';
800 /* Assign extra_data fields in response structure */
803 extra_data[extra_data_len - 1] = '\0';
804 state->response.extra_data = extra_data;
805 state->response.length += extra_data_len;
808 /* No domains responded but that's still OK so don't return an
815 if (rv == WINBINDD_OK)
818 request_error(state);