Bug #622: Domain-qualified group notation support to wb_group helper

diff --git a/helpers/external_acl/winbind_group/readme.txt b/helpers/external_acl/winbind_group/readme.txt
index 5cbaad8c13bde5b8e613eee44d7637e58653350b..762c2119bd25da6b9b1b3bd3663dc7f8985d46aa 100755 (executable)
--- a/helpers/external_acl/winbind_group/readme.txt
+++ b/helpers/external_acl/winbind_group/readme.txt
@@ -43,6 +43,9 @@ http_access deny all
 In the previous example all validated NT users member of ProxyUsers Global 
 domain group are allowed to use the cache.
 
+Groups name can be specified in both domain-qualified group notation
+(DOMAIN\Groupname) or simple group name notation.
+
 Groups with spaces in name, for example "Domain Users", must be quoted and
 the acl data ("Domain Users") must be placed into a separate file included
 by specifying "/path/to/file". The previous example will be:
@@ -53,7 +56,6 @@ and the DomainUsers files will contain only the following line:
 
 "Domain Users"
 
-
 NOTE: the standard group name comparation is case sensitive, so group name
 must be specified with same case as in the NT/2000 Domain.
 It's possible to enable not case sensitive group name comparation (-c),

diff --git a/helpers/external_acl/winbind_group/wb_check_group.c b/helpers/external_acl/winbind_group/wb_check_group.c
index 7ebe8f1bcb5b8349098dc670ff73e217bf61259b..266423350d60d406c05897606e35bf00075d3791 100755 (executable)
--- a/helpers/external_acl/winbind_group/wb_check_group.c
+++ b/helpers/external_acl/winbind_group/wb_check_group.c
@@ -31,6 +31,13 @@
  *
  * History:
  *
+ * Version 1.20
+ * 10-05-2003 Roberto Moreda
+ *              Added support for domain-qualified group Microsoft notation
+ *              (DOMAIN\Groupname). 
+ *            Guido Serassio
+ *              More debug info.
+ *              Updated documentation.
  * Version 1.10
  * 26-04-2003 Guido Serassio
  *              Added option for case insensitive group name comparation.
@@ -64,16 +71,13 @@
 
 #include "nsswitch/winbind_nss_config.h"
 #include "nsswitch/winbindd_nss.h"
+#include "wb_common.h"
 
 #define BUFSIZE 8192           /* the stdin buffer size */
 char debug_enabled=0;
-char *myname;
+const char *myname;
 pid_t mypid;
-int use_case_insensitive_compare=0;
-
-NSS_STATUS winbindd_request(int req_type,
-                           struct winbindd_request *request,
-                           struct winbindd_response *response);
+static int use_case_insensitive_compare=0;
 
 static char *
 strwordtok(char *buf, char **t)
@@ -121,7 +125,7 @@ strwordtok(char *buf, char **t)
 }
 
 
-int strCaseCmp (const char *s1, const char *s2)
+static int strCaseCmp (const char *s1, const char *s2)
 {
     while (*s1 && toupper (*s1) == toupper (*s2)) s1++, s2++;
     return *s1 - *s2;
@@ -129,7 +133,7 @@ int strCaseCmp (const char *s1, const char *s2)
 
 /* Convert sid to string */
 
-char * wbinfo_lookupsid(char * group, char *sid)
+static char * wbinfo_lookupsid(char * group, char *sid)
 {
     struct winbindd_request request;
     struct winbindd_response response;
@@ -147,13 +151,15 @@ char * wbinfo_lookupsid(char * group, char *sid)
 
     /* Display response */
 
-    strcpy(group,response.data.name.name);
+    strcpy(group,response.data.name.dom_name);
+    strcat(group,"\\");
+    strcat(group,response.data.name.name);
     return group;
 }
 
 /* Convert gid to sid */
 
-char * wbinfo_gid_to_sid(char * sid, gid_t gid)
+static char * wbinfo_gid_to_sid(char * sid, gid_t gid)
 {
     struct winbindd_request request;
     struct winbindd_response response;
@@ -179,9 +185,21 @@ char * wbinfo_gid_to_sid(char * sid, gid_t gid)
 /* returns 0 on match, -1 if no match */
 static inline int strcmparray(const char *str, const char **array)
 {
+    const char *wgroup;
+
     while (*array) {
-       debug("Windows group: %s, Squid group: %s\n", str, *array);
-       if ((use_case_insensitive_compare ? strCaseCmp(str, *array) : strcmp(str, *array)) == 0)
+       /* If the groups we want to match are specified as 'group', and
+        * not as 'DOMAIN\group' we strip the domain from the group to
+        * match against */
+       if (strstr(*array,"\\") == NULL) {
+           wgroup = strstr(str,"\\") + 1;
+           debug("Stripping domain from group name %s\n", str); 
+       } else {
+           wgroup = str;
+       }
+       
+       debug("Windows group: %s, Squid group: %s\n", wgroup, *array);
+       if ((use_case_insensitive_compare ? strCaseCmp(wgroup, *array) : strcmp(wgroup, *array)) == 0)
            return 0;
        array++;
     }
@@ -189,7 +207,7 @@ static inline int strcmparray(const char *str, const char **array)
 }
 
 /* returns 1 on success, 0 on failure */
-int
+static int
 Valid_Groups(char *UserName, const char **UserGroups)
 {
     struct winbindd_request request;
@@ -217,8 +235,10 @@ Valid_Groups(char *UserName, const char **UserGroups)
     for (i = 0; i < response.data.num_entries; i++) {
        if ((wbinfo_gid_to_sid(sid, (int)((gid_t *)response.extra_data)[i])) != NULL) {
            debug("SID: %s\n", sid);    
-           if (wbinfo_lookupsid(group,sid) == NULL)
+           if (wbinfo_lookupsid(group,sid) == NULL) {
+               warn("Can't lookup group SID.\n");
                break;
+           }
            if (strcmparray(group, UserGroups) == 0) {
                match = 1;
                break;
@@ -242,7 +262,7 @@ usage(char *program)
                program);
 }
 
-void
+static void
 process_options(int argc, char *argv[])
 {
     int opt;

diff --git a/helpers/external_acl/winbind_group/wb_common.c b/helpers/external_acl/winbind_group/wb_common.c
index 785ef86ffe1f493f3c41dd68e09f2480f25a734f..c9976ccf59784adcdec5f3c9f69589486a0612fe 100755 (executable)
--- a/helpers/external_acl/winbind_group/wb_common.c
+++ b/helpers/external_acl/winbind_group/wb_common.c
@@ -26,6 +26,7 @@
 #include "nsswitch/winbind_nss_config.h"
 #include "nsswitch/winbindd_nss.h"
 #include "config.h"
+#include "wb_common.h"
 
 
 /* Global variables.  These are effectively the client state information */

diff --git a/helpers/external_acl/winbind_group/wb_common.h b/helpers/external_acl/winbind_group/wb_common.h
new file mode 100644 (file)
index 0000000..b77e5a5
--- /dev/null
+++ b/helpers/external_acl/winbind_group/wb_common.h
@@ -0,0 +1,12 @@
+/* wb_common.c */
+void free_response(struct winbindd_response *response);
+void winbind_exclude_domain(const char *domain);
+void init_request(struct winbindd_request *request, int request_type);
+void init_response(struct winbindd_response *response);
+void close_sock(void);
+int winbind_open_pipe_sock(void);
+int write_sock(void *buffer, int count);
+int read_reply(struct winbindd_response *response);
+NSS_STATUS winbindd_send_request(int req_type, struct winbindd_request *request);
+NSS_STATUS winbindd_get_response(struct winbindd_response *response);
+NSS_STATUS winbindd_request(int req_type, struct winbindd_request *request, struct winbindd_response *response);

diff --git a/helpers/external_acl/winbind_group/wbntlm.h b/helpers/external_acl/winbind_group/wbntlm.h
index 1b01f4709546ed02df8eebaf6d0e0a7cd8ab703d..469dce2ecd4d298fa046f52e87e0fb469d9568c0 100755 (executable)
--- a/helpers/external_acl/winbind_group/wbntlm.h
+++ b/helpers/external_acl/winbind_group/wbntlm.h
@@ -38,8 +38,8 @@
 /************* END CONFIGURATION *************/
 
 /* Debugging stuff */
-extern char *myname;
-static char *__foo;
+extern const char *myname;
+static const char *__foo;
 extern pid_t mypid;
 extern char debug_enabled;