usr/src/cmd/idmap/idmapd/adutils.c

   1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21
  22 /*
  23  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  24  */
  25
  26 /*
  27  * Processes name2sid & sid2name batched lookups for a given user or
  28  * computer from an AD Directory server using GSSAPI authentication
  29  */
  30
  31 #include <stdio.h>
  32 #include <stdlib.h>
  33 #include <alloca.h>
  34 #include <string.h>
  35 #include <strings.h>
  36 #include <lber.h>
  37 #include <ldap.h>
  38 #include <sasl/sasl.h>
  39 #include <string.h>
  40 #include <ctype.h>
  41 #include <pthread.h>
  42 #include <synch.h>
  43 #include <atomic.h>
  44 #include <errno.h>
  45 #include <assert.h>
  46 #include <limits.h>
  47 #include <time.h>
  48 #include <sys/u8_textprep.h>
  49 #include "libadutils.h"
  50 #include "nldaputils.h"
  51 #include "idmapd.h"
  52
  53 /* Attribute names and filter format strings */
  54 #define SAN             "sAMAccountName"
  55 #define OBJSID          "objectSid"
  56 #define OBJCLASS        "objectClass"
  57 #define UIDNUMBER       "uidNumber"
  58 #define GIDNUMBER       "gidNumber"
  59 #define UIDNUMBERFILTER "(&(objectclass=user)(uidNumber=%u))"
  60 #define GIDNUMBERFILTER "(&(objectclass=group)(gidNumber=%u))"
  61 #define SANFILTER       "(sAMAccountName=%s)"
  62 #define OBJSIDFILTER    "(objectSid=%s)"
  63
  64 void    idmap_ldap_res_search_cb(LDAP *ld, LDAPMessage **res, int rc,
  65                 int qid, void *argp);
  66
  67 /*
  68  * A place to put the results of a batched (async) query
  69  *
  70  * There is one of these for every query added to a batch object
  71  * (idmap_query_state, see below).
  72  */
  73 typedef struct idmap_q {
  74         /*
  75          * data used for validating search result entries for name->SID
  76          * lookups
  77          */
  78         char                    *ecanonname;    /* expected canon name */
  79         char                    *edomain;       /* expected domain name */
  80         idmap_id_type           esidtype;       /* expected SID type */
  81         /* results */
  82         char                    **canonname;    /* actual canon name */
  83         char                    **domain;       /* name of domain of object */
  84         char                    **sid;          /* stringified SID */
  85         rid_t                   *rid;           /* RID */
  86         idmap_id_type           *sid_type;      /* user or group SID? */
  87         char                    **unixname;     /* unixname for name mapping */
  88         char                    **dn;           /* DN of entry */
  89         char                    **attr;         /* Attr for name mapping */
  90         char                    **value;        /* value for name mapping */
  91         posix_id_t              *pid;           /* Posix ID found via IDMU */
  92         idmap_retcode           *rc;
  93         adutils_rc              ad_rc;
  94         adutils_result_t        *result;
  95
  96         /*
  97          * The LDAP search entry result is placed here to be processed
  98          * when the search done result is received.
  99          */
 100         LDAPMessage             *search_res;    /* The LDAP search result */
 101 } idmap_q_t;
 102
 103 /* Batch context structure; typedef is in header file */
 104 struct idmap_query_state {
 105         adutils_query_state_t   *qs;
 106         int                     qsize;          /* Queue size */
 107         uint32_t                qcount;         /* Number of queued requests */
 108         const char              *ad_unixuser_attr;
 109         const char              *ad_unixgroup_attr;
 110         int                     directory_based_mapping;        /* enum */
 111         char                    *default_domain;
 112         idmap_q_t               queries[1];     /* array of query results */
 113 };
 114
 115 static pthread_t        reaperid = 0;
 116
 117 /*
 118  * Keep connection management simple for now, extend or replace later
 119  * with updated libsldap code.
 120  */
 121 #define ADREAPERSLEEP   60
 122
 123 /*
 124  * Idle connection reaping side of connection management
 125  *
 126  * Every minute wake up and look for connections that have been idle for
 127  * five minutes or more and close them.
 128  */
 129 /*ARGSUSED*/
 130 static
 131 void
 132 adreaper(void *arg)
 133 {
 134         timespec_t      ts;
 135
 136         ts.tv_sec = ADREAPERSLEEP;
 137         ts.tv_nsec = 0;
 138
 139         for (;;) {
 140                 /*
 141                  * nanosleep(3RT) is thead-safe (no SIGALRM) and more
 142                  * portable than usleep(3C)
 143                  */
 144                 (void) nanosleep(&ts, NULL);
 145                 adutils_reap_idle_connections();
 146         }
 147 }
 148
 149 /*
 150  * Take ad_host_config_t information, create a ad_host_t,
 151  * populate it and add it to the list of hosts.
 152  */
 153
 154 int
 155 idmap_add_ds(adutils_ad_t *ad, const char *host, int port)
 156 {
 157         int     ret = -1;
 158
 159         if (adutils_add_ds(ad, host, port) == ADUTILS_SUCCESS)
 160                 ret = 0;
 161
 162         /* Start reaper if it doesn't exist */
 163         if (ret == 0 && reaperid == 0)
 164                 (void) pthread_create(&reaperid, NULL,
 165                     (void *(*)(void *))adreaper, NULL);
 166         return (ret);
 167 }
 168
 169 static
 170 idmap_retcode
 171 map_adrc2idmaprc(adutils_rc adrc)
 172 {
 173         switch (adrc) {
 174         case ADUTILS_SUCCESS:
 175                 return (IDMAP_SUCCESS);
 176         case ADUTILS_ERR_NOTFOUND:
 177                 return (IDMAP_ERR_NOTFOUND);
 178         case ADUTILS_ERR_MEMORY:
 179                 return (IDMAP_ERR_MEMORY);
 180         case ADUTILS_ERR_DOMAIN:
 181                 return (IDMAP_ERR_DOMAIN);
 182         case ADUTILS_ERR_OTHER:
 183                 return (IDMAP_ERR_OTHER);
 184         case ADUTILS_ERR_RETRIABLE_NET_ERR:
 185                 return (IDMAP_ERR_RETRIABLE_NET_ERR);
 186         default:
 187                 return (IDMAP_ERR_INTERNAL);
 188         }
 189         /* NOTREACHED */
 190 }
 191
 192 idmap_retcode
 193 idmap_lookup_batch_start(adutils_ad_t *ad, int nqueries,
 194         int directory_based_mapping, const char *default_domain,
 195         idmap_query_state_t **state)
 196 {
 197         idmap_query_state_t     *new_state;
 198         adutils_rc              rc;
 199
 200         *state = NULL;
 201
 202         assert(ad != NULL);
 203
 204         new_state = calloc(1, sizeof (idmap_query_state_t) +
 205             (nqueries - 1) * sizeof (idmap_q_t));
 206         if (new_state == NULL)
 207                 return (IDMAP_ERR_MEMORY);
 208
 209         if ((rc = adutils_lookup_batch_start(ad, nqueries,
 210             idmap_ldap_res_search_cb, new_state, &new_state->qs))
 211             != ADUTILS_SUCCESS) {
 212                 idmap_lookup_release_batch(&new_state);
 213                 return (map_adrc2idmaprc(rc));
 214         }
 215
 216         new_state->default_domain = strdup(default_domain);
 217         if (new_state->default_domain == NULL) {
 218                 idmap_lookup_release_batch(&new_state);
 219                 return (IDMAP_ERR_MEMORY);
 220         }
 221
 222         new_state->directory_based_mapping = directory_based_mapping;
 223         new_state->qsize = nqueries;
 224         *state = new_state;
 225         return (IDMAP_SUCCESS);
 226 }
 227
 228 /*
 229  * Set unixuser_attr and unixgroup_attr for AD-based name mapping
 230  */
 231 void
 232 idmap_lookup_batch_set_unixattr(idmap_query_state_t *state,
 233                 const char *unixuser_attr, const char *unixgroup_attr)
 234 {
 235         state->ad_unixuser_attr = unixuser_attr;
 236         state->ad_unixgroup_attr = unixgroup_attr;
 237 }
 238
 239 /*
 240  * Take parsed attribute values from a search result entry and check if
 241  * it is the result that was desired and, if so, set the result fields
 242  * of the given idmap_q_t.
 243  *
 244  * Except for dn and attr, all strings are consumed, either by transferring
 245  * them over into the request results (where the caller will eventually free
 246  * them) or by freeing them here.  Note that this aligns with the "const"
 247  * declarations below.
 248  */
 249 static
 250 void
 251 idmap_setqresults(
 252     idmap_q_t *q,
 253     char *san,
 254     const char *dn,
 255     const char *attr,
 256     char *value,
 257     char *sid,
 258     rid_t rid,
 259     int sid_type,
 260     char *unixname,
 261     posix_id_t pid)
 262 {
 263         char *domain;
 264         int err1;
 265
 266         assert(dn != NULL);
 267
 268         if ((domain = adutils_dn2dns(dn)) == NULL)
 269                 goto out;
 270
 271         if (q->ecanonname != NULL && san != NULL) {
 272                 /* Check that this is the canonname that we were looking for */
 273                 if (u8_strcmp(q->ecanonname, san, 0,
 274                     U8_STRCMP_CI_LOWER, /* no normalization, for now */
 275                     U8_UNICODE_LATEST, &err1) != 0 || err1 != 0)
 276                         goto out;
 277         }
 278
 279         if (q->edomain != NULL) {
 280                 /* Check that this is the domain that we were looking for */
 281                 if (!domain_eq(q->edomain, domain))
 282                         goto out;
 283         }
 284
 285         /* Copy the DN and attr and value */
 286         if (q->dn != NULL)
 287                 *q->dn = strdup(dn);
 288
 289         if (q->attr != NULL && attr != NULL)
 290                 *q->attr = strdup(attr);
 291
 292         if (q->value != NULL && value != NULL) {
 293                 *q->value = value;
 294                 value = NULL;
 295         }
 296
 297         /* Set results */
 298         if (q->sid) {
 299                 *q->sid = sid;
 300                 sid = NULL;
 301         }
 302         if (q->rid)
 303                 *q->rid = rid;
 304         if (q->sid_type)
 305                 *q->sid_type = sid_type;
 306         if (q->unixname) {
 307                 *q->unixname = unixname;
 308                 unixname = NULL;
 309         }
 310         if (q->domain != NULL) {
 311                 *q->domain = domain;
 312                 domain = NULL;
 313         }
 314         if (q->canonname != NULL) {
 315                 /*
 316                  * The caller may be replacing the given winname by its
 317                  * canonical name and therefore free any old name before
 318                  * overwriting the field by the canonical name.
 319                  */
 320                 free(*q->canonname);
 321                 *q->canonname = san;
 322                 san = NULL;
 323         }
 324
 325         if (q->pid != NULL && pid != IDMAP_SENTINEL_PID) {
 326                 *q->pid = pid;
 327         }
 328
 329         q->ad_rc = ADUTILS_SUCCESS;
 330
 331 out:
 332         /* Free unused attribute values */
 333         free(san);
 334         free(sid);
 335         free(domain);
 336         free(unixname);
 337         free(value);
 338 }
 339
 340 #define BVAL_CASEEQ(bv, str) \
 341                 (((*(bv))->bv_len == (sizeof (str) - 1)) && \
 342                     strncasecmp((*(bv))->bv_val, str, (*(bv))->bv_len) == 0)
 343
 344 /*
 345  * Extract the class of the result entry.  Returns 1 on success, 0 on
 346  * failure.
 347  */
 348 static
 349 int
 350 idmap_bv_objclass2sidtype(BerValue **bvalues, int *sid_type)
 351 {
 352         BerValue        **cbval;
 353
 354         *sid_type = IDMAP_SID;
 355         if (bvalues == NULL)
 356                 return (0);
 357
 358         /*
 359          * We consider Computer to be a subclass of User, so we can just
 360          * ignore Computer entries and pay attention to the accompanying
 361          * User entries.
 362          */
 363         for (cbval = bvalues; *cbval != NULL; cbval++) {
 364                 if (BVAL_CASEEQ(cbval, "group")) {
 365                         *sid_type = IDMAP_GSID;
 366                         break;
 367                 } else if (BVAL_CASEEQ(cbval, "user")) {
 368                         *sid_type = IDMAP_USID;
 369                         break;
 370                 }
 371                 /*
 372                  * "else if (*sid_type = IDMAP_USID)" then this is a
 373                  * new sub-class of user -- what to do with it??
 374                  */
 375         }
 376
 377         return (1);
 378 }
 379
 380 /*
 381  * Handle a given search result entry
 382  */
 383 static
 384 void
 385 idmap_extract_object(idmap_query_state_t *state, idmap_q_t *q,
 386         LDAPMessage *res, LDAP *ld)
 387 {
 388         BerValue                **bvalues;
 389         const char              *attr = NULL;
 390         char                    *value = NULL;
 391         char                    *unix_name = NULL;
 392         char                    *dn;
 393         char                    *san = NULL;
 394         char                    *sid = NULL;
 395         rid_t                   rid = 0;
 396         int                     sid_type;
 397         int                     ok;
 398         posix_id_t              pid = IDMAP_SENTINEL_PID;
 399
 400         assert(q->rc != NULL);
 401         assert(q->domain == NULL || *q->domain == NULL);
 402
 403         if ((dn = ldap_get_dn(ld, res)) == NULL)
 404                 return;
 405
 406         bvalues = ldap_get_values_len(ld, res, OBJCLASS);
 407         if (bvalues == NULL) {
 408                 /*
 409                  * Didn't find objectclass. Something's wrong with our
 410                  * AD data.
 411                  */
 412                 idmapdlog(LOG_ERR, "%s has no %s", dn, OBJCLASS);
 413                 goto out;
 414         }
 415         ok = idmap_bv_objclass2sidtype(bvalues, &sid_type);
 416         ldap_value_free_len(bvalues);
 417         if (!ok) {
 418                 /*
 419                  * Didn't understand objectclass. Something's wrong with our
 420                  * AD data.
 421                  */
 422                 idmapdlog(LOG_ERR, "%s has unexpected %s", dn, OBJCLASS);
 423                 goto out;
 424         }
 425
 426         if (state->directory_based_mapping == DIRECTORY_MAPPING_IDMU &&
 427             q->pid != NULL) {
 428                 if (sid_type == IDMAP_USID)
 429                         attr = UIDNUMBER;
 430                 else if (sid_type == IDMAP_GSID)
 431                         attr = GIDNUMBER;
 432                 if (attr != NULL) {
 433                         bvalues = ldap_get_values_len(ld, res, attr);
 434                         if (bvalues != NULL) {
 435                                 value = adutils_bv_str(bvalues[0]);
 436                                 if (!adutils_bv_uint(bvalues[0], &pid)) {
 437                                         idmapdlog(LOG_ERR,
 438                                             "%s has Invalid %s value \"%s\"",
 439                                             dn, attr, value);
 440                                 }
 441                                 ldap_value_free_len(bvalues);
 442                         }
 443                 }
 444         }
 445
 446         if (state->directory_based_mapping == DIRECTORY_MAPPING_NAME &&
 447             q->unixname != NULL) {
 448                 /*
 449                  * If the caller has requested unixname then determine the
 450                  * AD attribute name that will have the unixname, and retrieve
 451                  * its value.
 452                  */
 453                 idmap_id_type esidtype;
 454                 /*
 455                  * Determine the target type.
 456                  *
 457                  * If the caller specified one, use that.  Otherwise, give the
 458                  * same type that as we found for the Windows user.
 459                  */
 460                 esidtype = q->esidtype;
 461                 if (esidtype == IDMAP_SID)
 462                         esidtype = sid_type;
 463
 464                 if (esidtype == IDMAP_USID)
 465                         attr = state->ad_unixuser_attr;
 466                 else if (esidtype == IDMAP_GSID)
 467                         attr = state->ad_unixgroup_attr;
 468
 469                 if (attr != NULL) {
 470                         bvalues = ldap_get_values_len(ld, res, attr);
 471                         if (bvalues != NULL) {
 472                                 unix_name = adutils_bv_str(bvalues[0]);
 473                                 ldap_value_free_len(bvalues);
 474                                 value = strdup(unix_name);
 475                         }
 476                 }
 477         }
 478
 479         bvalues = ldap_get_values_len(ld, res, SAN);
 480         if (bvalues != NULL) {
 481                 san = adutils_bv_str(bvalues[0]);
 482                 ldap_value_free_len(bvalues);
 483         }
 484
 485         if (q->sid != NULL) {
 486                 bvalues = ldap_get_values_len(ld, res, OBJSID);
 487                 if (bvalues != NULL) {
 488                         sid = adutils_bv_objsid2sidstr(bvalues[0], &rid);
 489                         ldap_value_free_len(bvalues);
 490                 }
 491         }
 492
 493         idmap_setqresults(q, san, dn,
 494             attr, value,
 495             sid, rid, sid_type,
 496             unix_name, pid);
 497
 498 out:
 499         ldap_memfree(dn);
 500 }
 501
 502 void
 503 idmap_ldap_res_search_cb(LDAP *ld, LDAPMessage **res, int rc, int qid,
 504                 void *argp)
 505 {
 506         idmap_query_state_t     *state = (idmap_query_state_t *)argp;
 507         idmap_q_t               *q = &(state->queries[qid]);
 508
 509         switch (rc) {
 510         case LDAP_RES_SEARCH_RESULT:
 511                 if (q->search_res != NULL) {
 512                         idmap_extract_object(state, q, q->search_res, ld);
 513                         (void) ldap_msgfree(q->search_res);
 514                         q->search_res = NULL;
 515                 } else
 516                         q->ad_rc = ADUTILS_ERR_NOTFOUND;
 517                 break;
 518         case LDAP_RES_SEARCH_ENTRY:
 519                 if (q->search_res == NULL) {
 520                         q->search_res = *res;
 521                         *res = NULL;
 522                 }
 523                 break;
 524         default:
 525                 break;
 526         }
 527 }
 528
 529 static
 530 void
 531 idmap_cleanup_batch(idmap_query_state_t *batch)
 532 {
 533         int i;
 534
 535         for (i = 0; i < batch->qcount; i++) {
 536                 free(batch->queries[i].ecanonname);
 537                 batch->queries[i].ecanonname = NULL;
 538                 free(batch->queries[i].edomain);
 539                 batch->queries[i].edomain = NULL;
 540         }
 541 }
 542
 543 /*
 544  * This routine frees the idmap_query_state_t structure
 545  */
 546 void
 547 idmap_lookup_release_batch(idmap_query_state_t **state)
 548 {
 549         if (state == NULL || *state == NULL)
 550                 return;
 551         adutils_lookup_batch_release(&(*state)->qs);
 552         idmap_cleanup_batch(*state);
 553         free((*state)->default_domain);
 554         free(*state);
 555         *state = NULL;
 556 }
 557
 558 idmap_retcode
 559 idmap_lookup_batch_end(idmap_query_state_t **state)
 560 {
 561         adutils_rc              ad_rc;
 562         int                     i;
 563         idmap_query_state_t     *id_qs = *state;
 564
 565         ad_rc = adutils_lookup_batch_end(&id_qs->qs);
 566
 567         /*
 568          * Map adutils rc to idmap_retcode in each
 569          * query because consumers in dbutils.c
 570          * expects idmap_retcode.
 571          */
 572         for (i = 0; i < id_qs->qcount; i++) {
 573                 *id_qs->queries[i].rc =
 574                     map_adrc2idmaprc(id_qs->queries[i].ad_rc);
 575         }
 576         idmap_lookup_release_batch(state);
 577         return (map_adrc2idmaprc(ad_rc));
 578 }
 579
 580 /*
 581  * Send one prepared search, queue up msgid, process what results are
 582  * available
 583  */
 584 static
 585 idmap_retcode
 586 idmap_batch_add1(idmap_query_state_t *state, const char *filter,
 587         char *ecanonname, char *edomain, idmap_id_type esidtype,
 588         char **dn, char **attr, char **value,
 589         char **canonname, char **dname,
 590         char **sid, rid_t *rid, idmap_id_type *sid_type, char **unixname,
 591         posix_id_t *pid,
 592         idmap_retcode *rc)
 593 {
 594         adutils_rc      ad_rc;
 595         int             qid, i;
 596         idmap_q_t       *q;
 597         char    *attrs[20];     /* Plenty */
 598
 599         qid = atomic_inc_32_nv(&state->qcount) - 1;
 600         q = &(state->queries[qid]);
 601
 602         assert(qid < state->qsize);
 603
 604         /*
 605          * Remember the expected canonname, domainname and unix type
 606          * so we can check the results * against it
 607          */
 608         q->ecanonname = ecanonname;
 609         q->edomain = edomain;
 610         q->esidtype = esidtype;
 611
 612         /* Remember where to put the results */
 613         q->canonname = canonname;
 614         q->sid = sid;
 615         q->domain = dname;
 616         q->rid = rid;
 617         q->sid_type = sid_type;
 618         q->rc = rc;
 619         q->unixname = unixname;
 620         q->dn = dn;
 621         q->attr = attr;
 622         q->value = value;
 623         q->pid = pid;
 624
 625         /* Add attributes that are not always needed */
 626         i = 0;
 627         attrs[i++] = SAN;
 628         attrs[i++] = OBJSID;
 629         attrs[i++] = OBJCLASS;
 630
 631         if (unixname != NULL) {
 632                 /* Add unixuser/unixgroup attribute names to the attrs list */
 633                 if (esidtype != IDMAP_GSID &&
 634                     state->ad_unixuser_attr != NULL)
 635                         attrs[i++] = (char *)state->ad_unixuser_attr;
 636                 if (esidtype != IDMAP_USID &&
 637                     state->ad_unixgroup_attr != NULL)
 638                         attrs[i++] = (char *)state->ad_unixgroup_attr;
 639         }
 640
 641         if (pid != NULL) {
 642                 if (esidtype != IDMAP_GSID)
 643                         attrs[i++] = UIDNUMBER;
 644                 if (esidtype != IDMAP_USID)
 645                         attrs[i++] = GIDNUMBER;
 646         }
 647
 648         attrs[i] = NULL;
 649
 650         /*
 651          * Provide sane defaults for the results in case we never hear
 652          * back from the DS before closing the connection.
 653          *
 654          * In particular we default the result to indicate a retriable
 655          * error.  The first complete matching result entry will cause
 656          * this to be set to IDMAP_SUCCESS, and the end of the results
 657          * for this search will cause this to indicate "not found" if no
 658          * result entries arrived or no complete ones matched the lookup
 659          * we were doing.
 660          */
 661         *rc = IDMAP_ERR_RETRIABLE_NET_ERR;
 662         if (sid_type != NULL)
 663                 *sid_type = IDMAP_SID;
 664         if (sid != NULL)
 665                 *sid = NULL;
 666         if (dname != NULL)
 667                 *dname = NULL;
 668         if (rid != NULL)
 669                 *rid = 0;
 670         if (dn != NULL)
 671                 *dn = NULL;
 672         if (attr != NULL)
 673                 *attr = NULL;
 674         if (value != NULL)
 675                 *value = NULL;
 676
 677         /*
 678          * Don't set *canonname to NULL because it may be pointing to the
 679          * given winname. Later on if we get a canonical name from AD the
 680          * old name if any will be freed before assigning the new name.
 681          */
 682
 683         /*
 684          * Invoke the mother of all APIs i.e. the adutils API
 685          */
 686         ad_rc = adutils_lookup_batch_add(state->qs, filter,
 687             (const char **)attrs,
 688             edomain, &q->result, &q->ad_rc);
 689         return (map_adrc2idmaprc(ad_rc));
 690 }
 691
 692 idmap_retcode
 693 idmap_name2sid_batch_add1(idmap_query_state_t *state,
 694         const char *name, const char *dname, idmap_id_type esidtype,
 695         char **dn, char **attr, char **value,
 696         char **canonname, char **sid, rid_t *rid,
 697         idmap_id_type *sid_type, char **unixname,
 698         posix_id_t *pid, idmap_retcode *rc)
 699 {
 700         idmap_retcode   retcode;
 701         char            *filter, *s_name;
 702         char            *ecanonname, *edomain; /* expected canonname */
 703
 704         /*
 705          * Strategy: search the global catalog for user/group by
 706          * sAMAccountName = user/groupname with "" as the base DN and by
 707          * userPrincipalName = user/groupname@domain.  The result
 708          * entries will be checked to conform to the name and domain
 709          * name given here.  The DN, sAMAccountName, userPrincipalName,
 710          * objectSid and objectClass of the result entries are all we
 711          * need to figure out which entries match the lookup, the SID of
 712          * the user/group and whether it is a user or a group.
 713          */
 714
 715         if ((ecanonname = strdup(name)) == NULL)
 716                 return (IDMAP_ERR_MEMORY);
 717
 718         if (dname == NULL || *dname == '\0') {
 719                 /* 'name' not qualified and dname not given */
 720                 dname = state->default_domain;
 721                 edomain = strdup(dname);
 722                 if (edomain == NULL) {
 723                         free(ecanonname);
 724                         return (IDMAP_ERR_MEMORY);
 725                 }
 726         } else {
 727                 if ((edomain = strdup(dname)) == NULL) {
 728                         free(ecanonname);
 729                         return (IDMAP_ERR_MEMORY);
 730                 }
 731         }
 732
 733         if (!adutils_lookup_check_domain(state->qs, dname)) {
 734                 free(ecanonname);
 735                 free(edomain);
 736                 return (IDMAP_ERR_DOMAIN_NOTFOUND);
 737         }
 738
 739         s_name = sanitize_for_ldap_filter(name);
 740         if (s_name == NULL) {
 741                 free(ecanonname);
 742                 free(edomain);
 743                 return (IDMAP_ERR_MEMORY);
 744         }
 745
 746         /* Assemble filter */
 747         (void) asprintf(&filter, SANFILTER, s_name);
 748         if (s_name != name)
 749                 free(s_name);
 750         if (filter == NULL) {
 751                 free(ecanonname);
 752                 free(edomain);
 753                 return (IDMAP_ERR_MEMORY);
 754         }
 755
 756         retcode = idmap_batch_add1(state, filter, ecanonname, edomain,
 757             esidtype, dn, attr, value, canonname, NULL, sid, rid, sid_type,
 758             unixname, pid, rc);
 759
 760         free(filter);
 761
 762         return (retcode);
 763 }
 764
 765 idmap_retcode
 766 idmap_sid2name_batch_add1(idmap_query_state_t *state,
 767         const char *sid, const rid_t *rid, idmap_id_type esidtype,
 768         char **dn, char **attr, char **value,
 769         char **name, char **dname, idmap_id_type *sid_type,
 770         char **unixname, posix_id_t *pid, idmap_retcode *rc)
 771 {
 772         idmap_retcode   retcode;
 773         int             ret;
 774         char            *filter;
 775         char            cbinsid[ADUTILS_MAXHEXBINSID + 1];
 776
 777         /*
 778          * Strategy: search [the global catalog] for user/group by
 779          * objectSid = SID with empty base DN.  The DN, sAMAccountName
 780          * and objectClass of the result are all we need to figure out
 781          * the name of the SID and whether it is a user, a group or a
 782          * computer.
 783          */
 784
 785         if (!adutils_lookup_check_sid_prefix(state->qs, sid))
 786                 return (IDMAP_ERR_DOMAIN_NOTFOUND);
 787
 788         ret = adutils_txtsid2hexbinsid(sid, rid, &cbinsid[0], sizeof (cbinsid));
 789         if (ret != 0)
 790                 return (IDMAP_ERR_SID);
 791
 792         /* Assemble filter */
 793         (void) asprintf(&filter, OBJSIDFILTER, cbinsid);
 794         if (filter == NULL)
 795                 return (IDMAP_ERR_MEMORY);
 796
 797         retcode = idmap_batch_add1(state, filter, NULL, NULL, esidtype,
 798             dn, attr, value, name, dname, NULL, NULL, sid_type, unixname,
 799             pid, rc);
 800
 801         free(filter);
 802
 803         return (retcode);
 804 }
 805
 806 idmap_retcode
 807 idmap_unixname2sid_batch_add1(idmap_query_state_t *state,
 808         const char *unixname, int is_user, int is_wuser,
 809         char **dn, char **attr, char **value,
 810         char **sid, rid_t *rid, char **name,
 811         char **dname, idmap_id_type *sid_type, idmap_retcode *rc)
 812 {
 813         idmap_retcode   retcode;
 814         char            *filter, *s_unixname;
 815         const char      *attrname;
 816
 817         /* Get unixuser or unixgroup AD attribute name */
 818         attrname = (is_user) ?
 819             state->ad_unixuser_attr : state->ad_unixgroup_attr;
 820         if (attrname == NULL)
 821                 return (IDMAP_ERR_NOTFOUND);
 822
 823         s_unixname = sanitize_for_ldap_filter(unixname);
 824         if (s_unixname == NULL)
 825                 return (IDMAP_ERR_MEMORY);
 826
 827         /*  Assemble filter */
 828         (void) asprintf(&filter, "(&(objectclass=%s)(%s=%s))",
 829             is_wuser ? "user" : "group", attrname, s_unixname);
 830         if (s_unixname != unixname)
 831                 free(s_unixname);
 832         if (filter == NULL) {
 833                 return (IDMAP_ERR_MEMORY);
 834         }
 835
 836         retcode = idmap_batch_add1(state, filter, NULL, NULL,
 837             IDMAP_POSIXID, dn, NULL, NULL, name, dname, sid, rid, sid_type,
 838             NULL, NULL, rc);
 839
 840         if (retcode == IDMAP_SUCCESS && attr != NULL) {
 841                 if ((*attr = strdup(attrname)) == NULL)
 842                         retcode = IDMAP_ERR_MEMORY;
 843         }
 844
 845         if (retcode == IDMAP_SUCCESS && value != NULL) {
 846                 if ((*value = strdup(unixname)) == NULL)
 847                         retcode = IDMAP_ERR_MEMORY;
 848         }
 849
 850         free(filter);
 851
 852         return (retcode);
 853 }
 854
 855 idmap_retcode
 856 idmap_pid2sid_batch_add1(idmap_query_state_t *state,
 857         posix_id_t pid, int is_user,
 858         char **dn, char **attr, char **value,
 859         char **sid, rid_t *rid, char **name,
 860         char **dname, idmap_id_type *sid_type, idmap_retcode *rc)
 861 {
 862         idmap_retcode   retcode;
 863         char            *filter;
 864         const char      *attrname;
 865
 866         /*  Assemble filter */
 867         if (is_user) {
 868                 (void) asprintf(&filter, UIDNUMBERFILTER, pid);
 869                 attrname = UIDNUMBER;
 870         } else {
 871                 (void) asprintf(&filter, GIDNUMBERFILTER, pid);
 872                 attrname = GIDNUMBER;
 873         }
 874         if (filter == NULL)
 875                 return (IDMAP_ERR_MEMORY);
 876
 877         retcode = idmap_batch_add1(state, filter, NULL, NULL,
 878             IDMAP_POSIXID, dn, NULL, NULL, name, dname, sid, rid, sid_type,
 879             NULL, NULL, rc);
 880
 881         if (retcode == IDMAP_SUCCESS && attr != NULL) {
 882                 if ((*attr = strdup(attrname)) == NULL)
 883                         retcode = IDMAP_ERR_MEMORY;
 884         }
 885
 886         if (retcode == IDMAP_SUCCESS && value != NULL) {
 887                 (void) asprintf(value, "%u", pid);
 888                 if (*value == NULL)
 889                         retcode = IDMAP_ERR_MEMORY;
 890         }
 891
 892         free(filter);
 893
 894         return (retcode);
 895 }