summaryrefslogtreecommitdiff
path: root/source3/winbindd/idmap_autorid.c
AgeCommit message (Collapse)AuthorFilesLines
2023-03-10idmap_autorid: fix ID_REQUIRE_TYPE for more than one SID for an unknown domainStefan Metzmacher1-3/+12
When we see a trusted domain SID for the first time, idmap_autorid returns ID_REQUIRE_TYPE only for the first sid and leaves the others with ID_TYPE_NOT_SPECIFIED. It means the winbindd parent only retries the first sid. BUG: https://bugzilla.samba.org/show_bug.cgi?id=15318 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2022-02-16s3:winbindd: Add a sanity check for the rangeAndreas Schneider1-3/+4
What we want to avoid: $ ./bin/testparm -s | grep "idmap config" idmap config * : rangesize = 10000 idmap config * : range = 10000-19999 idmap config * : backend = autorid $ ./bin/wbinfo --name-to-sid BUILTIN/Administrators S-1-5-32-544 SID_ALIAS (4) $ ./bin/wbinfo --sid-to-gid S-1-5-32-544 10000 $ ./bin/wbinfo --name-to-sid ADDOMAIN/alice S-1-5-21-4058748110-895691256-3682847423-1107 SID_USER (1) $ ./bin/wbinfo --sid-to-gid S-1-5-21-984165912-589366285-3903095728-1107 failed to call wbcSidToGid: WBC_ERR_DOMAIN_NOT_FOUND Could not convert sid S-1-5-21-984165912-589366285-3903095728-1107 to gid If only one range is configured we are either not able to map users/groups from our primary *and* the BUILTIN domain. We need at least two ranges to also cover the BUILTIN domain! BUG: https://bugzilla.samba.org/show_bug.cgi?id=14967 Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
2020-10-23winbindd: allow idmap backends to mark entries with ID_[TYPE_WB_]REQUIRE_TYPEStefan Metzmacher1-3/+3
This must only be used between winbindd parent and child! It must not leak into outside world. Some backends require ID_TYPE_UID or ID_TYPE_GID as type_hint, while others may only need ID_TYPE_BOTH in order to validate that the domain exists. This will allow us to skip the wb_lookupsids_send/recv in the winbindd parent in future and only do that on demand. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-10-23winbindd/idmap: apply const to struct idmap_methods pointersStefan Metzmacher1-1/+1
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14539 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2020-08-28s3: safe_string: do not include string_wrappers.hMatthew DeVore1-0/+1
Rather than have safe_string.h #include string_wrappers.h, make users of string_wrappers.h include it explicitly. includes.h now no longer includes string_wrappers.h transitively. Still allow includes.h to #include safe_string.h for now so that as many modules as possible get the safety checks in it. Signed-off-by: Matthew DeVore <matvore@google.com> Reviewed-by: David Mulder <dmulder@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2019-01-08winbind: Fix a typoVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2018-12-20winbindd: Use dom_sid_str_bufVolker Lendecke1-8/+14
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Gary Lockyer <gary@catalyst.net.nz>
2018-08-17lib: Pass mem_ctx to state_path()Volker Lendecke1-1/+1
Fix a confusing API: Many places TALLOC_FREE the path where it's not clear you have to do it. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2018-03-01s3:winbindd: Add FALL_THROUGH statements in idmap_autorid.cAndreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
2017-05-03s3:winbindd:idmap_autorid remove a stray commentChristian Ambach1-3/+0
Signed-off-by: Christian Ambach <ambi@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org> Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org> Autobuild-Date(master): Wed May 3 03:35:34 CEST 2017 on sn-devel-144
2017-04-22lib: modules: Change XXX_init interface from XXX_init(void) to ↵Jeremy Allison1-1/+1
XXX_init(TALLOC_CTX *) Not currently used - no logic changes inside. This will make it possible to pass down a long-lived talloc context from the loading function for modules to use instead of having them internally all use talloc_autofree_context() which is a hidden global. Updated all known module interface numbers, and added a WHATSNEW. Signed-off-by: Jeremy Allison <jra@samba.org> Signed-off-by: Ralph Böhme <slow@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Sat Apr 22 01:17:00 CEST 2017 on sn-devel-144
2017-03-20idmap_autorid: Use idmap_config_intVolker Lendecke1-2/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Michael Adam <obnox@samba.org> Autobuild-Date(master): Mon Mar 20 23:28:38 CET 2017 on sn-devel-144
2017-03-20idmap_autorid: Use idmap_config_boolVolker Lendecke1-2/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2017-03-08idmap_autorid: allocate new domain range if the callers knows the sid is validStefan Metzmacher1-0/+13
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12613 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Mar 8 04:06:59 CET 2017 on sn-devel-144
2016-12-27idmap_autorid: Add the error string in a debugVolker Lendecke1-2/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
2016-12-16idmap_autorid: Use acquire_range directlyVolker Lendecke1-1/+1
idmap_autorid_get_domainrange is reading again for an existing mapping. We know we need to allocate here, so avoid passing down that r/o boolean :-) Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: Fix checks for valid domains to allocate ranges forVolker Lendecke1-17/+61
The tdc cache is not reliable. The main dynamic check is netsamlogon_cache_have: The only reliable way to see a domain as valid for allocating a range for is a successful login. With a recent addition to netsamlogon_cache_store, we can now reliably tell from there whether a domain is trusted. This also adds a few heuristic checks, such as allocation for the local domains and additional ranges where we already have a mapping for range index 0 for. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: Add ntstatus to a debug messageVolker Lendecke1-2/+3
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: Only look at the tdc cache when allocating rangesVolker Lendecke1-0/+7
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: Do a readonly attempt before looking at the tdc cacheVolker Lendecke1-4/+12
If autorid.tdb already has a mapping for a domain range, we can just return that. Even if the volatile tdc cache at this point does not have the domain, we should return a correct mapping. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: idmap_autorid_sid_to_id_rid only uses rangesize from "global"Volker Lendecke1-3/+4
Simplification -- from the callers perspective looks like a complex routine which it is not Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: idmap_autorid_sid_to_id_rid only uses low_id from "range"Volker Lendecke1-3/+3
Simplification -- from the callers perspective looks like a complex routine which it is not Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: Tighten idmap_autorid_id_to_sid a bitVolker Lendecke1-9/+23
We should only allow '#' as a sid/range-number separator in autorid.tdb. The logic might be a bit clumsy. But the switch statement with failure fall thru was the clearest I could come up with. Signed-off-by: Volker Lendecke <vl@samba.org>
2016-12-16idmap_autorid: Fix a commentVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: Protect against dsize==0Volker Lendecke1-1/+1
Not sure it can happen, but you never know... Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-16idmap_autorid: Slightly simplify idmap_autorid_unixids_to_sidsVolker Lendecke1-1/+2
Avoid an else branch where it's not necessary Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2016-12-06idmap_autorid: dom_sid_parse_endp always initializes "endp" when okVolker Lendecke1-1/+1
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-12-06idmap_autorid: Add a {} pair in an if-statementVolker Lendecke1-1/+2
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-07idmap_autorid: Protect against corrupt databasesVolker Lendecke1-0/+7
Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2016-03-07idmap_autorid: Fix a use-after-freeVolker Lendecke1-1/+4
Parsing the domain_range_index references data.dptr Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2015-08-20s3:winbindd/idmap_*: make function prototypes available via static_decl_idmap;Stefan Metzmacher1-0/+1
This allows the static build of the modules. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org>
2014-11-03idmap_autorid: don't leak state_path onto talloc tosDavid Disseldorp1-1/+9
Also check for allocation failures. Signed-off-by: David Disseldorp <ddiss@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
2014-04-25autorid: Add allocation from above in alloc range for well known sidsMichael Adam1-0/+86
This way, we achieve a better determinism for the id mappings of the well knowns without wasting a separate range. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Michael Adam <obnox@samba.org> Autobuild-Date(master): Fri Apr 25 17:52:10 CEST 2014 on sn-devel-104
2014-04-25autorid: use dbwrap_trans_do() in idmap_autorid_sid_to_id_alloc()Michael Adam1-22/+26
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: reserve 500 IDs at the top of the ALLOC range.Michael Adam1-1/+4
The wellknowns are now allocated into this sub-range. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: reverse order of arguments of idmap_autorid_sid_to_id_alloc()Michael Adam1-4/+5
for consistency Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: introduce idmap_autorid_domsid_is_for_alloc()Michael Adam1-2/+14
Currently, this checks if the sid is a wellknown domain sid. But the code reads more nicely and more domains might be added in the future. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: factor idmap_autorid_sid_to_id() out of idmap_autorid_sids_to_unixids()Michael Adam1-95/+76
- reduces indentation - unifies error code paths and bumping counters - makes the code more easy to read Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: make the checks for bumping num_mapped identical for alloc and rid caseMichael Adam1-2/+2
in idmap_autorid_sids_to_unixids() Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: explicitly return NTSTATUS_OK in idmap_autorid_sid_to_id_alloc().Michael Adam1-1/+1
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: more explicitly and reasonably set map->state in ↵Michael Adam1-3/+5
idmap_autorid_sid_to_id_alloc Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: rename idmap_autorid_sid_to_id() -> idmap_autorid_sid_to_id_rid()Michael Adam1-2/+3
For consistency. This is the function that does the calculation if the sid is treated by a rid range. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: rename idmap_autorid_map_sid_to_id() -> idmap_autorid_sid_to_id_alloc()Michael Adam1-5/+5
for consistency. this is the sid->id function for the alloc range. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: rename idmap_autorid_map_id_to_sid() -> idmap_autorid_id_to_sid_alloc()Michael Adam1-3/+3
for consistency. This is the function that maps id to sid for the alloc range. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: factor idmap_autorid_get_alloc_range() out of ↵Michael Adam1-6/+17
idmap_autorid_allocate_id() Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: improve a debug message in idmap_autorid_map_sid_to_id()Michael Adam1-2/+2
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-25autorid: remove a legacy comment from sid_to_idMichael Adam1-5/+0
With the introduction of the ID_TYPE_BOTH mapping to idmap_autorid, it is not a deficiency but a virtue of the autorid backend that it does not care about the existence or type of the sid to be mapped. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2014-04-03autorid: use the db argument in the initialize traverse action.Michael Adam1-2/+2
By a copy and paste error, the global autorid_db was used. This was not currently a problem in behaviour, because this autorid_db is passed as the argument. This change fixes the callback function for consistency. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Apr 3 08:36:55 CEST 2014 on sn-devel-104
2014-04-03autorid: make the whole initialization atomic with one transaction.Michael Adam1-10/+38
Originally, there were several writing operations: - store the range HWM - store the alloc uid HWM - store the alloc gid HWM - store the config - create mappings for a whole list of wellknown sids Each of these consisted of its own transaction, the wellknown preallocation even of one transaction per sid. This change wrapps all of these in one big transaction. Thereby making the whole initialization atomic, and with respect to the creation of the wellknown mappings also more deterministic. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Thu Apr 3 02:41:25 CEST 2014 on sn-devel-104
2014-04-03autorid: initialize: fix typo in and further improve a debug message.Michael Adam1-2/+2
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
generated by cgit v1.2.3 (git 2.25.1) at 2026-06-26 02:39:52 +0000