r5331: Support SIDs as %s replacements in the afs username map parameter.

Add 'log nt token command' parameter. If set, %s is replaced with the user
sid, and %t takes all the group sids.

Volker

diff --git a/source/auth/auth_util.c b/source/auth/auth_util.c
index 30902a8dad6e443460af67bbb70f3c9641c1fa21..5c933e90c9f33947250f2acb6e327c1c55e0765a 100644 (file)
--- a/source/auth/auth_util.c
+++ b/source/auth/auth_util.c
@@ -592,6 +592,39 @@ static NTSTATUS create_nt_user_token(const DOM_SID *user_sid, const DOM_SID *gro
        
        debug_nt_user_token(DBGC_AUTH, 10, ptoken);
        
+       if ((lp_log_nt_token_command() != NULL) &&
+           (strlen(lp_log_nt_token_command()) > 0)) {
+               TALLOC_CTX *mem_ctx;
+               char *command;
+               fstring sidstr;
+               char *user_sidstr, *group_sidstr;
+
+               mem_ctx = talloc_init("setnttoken");
+               if (mem_ctx == NULL)
+                       return NT_STATUS_NO_MEMORY;
+
+               sid_to_string(sidstr, &ptoken->user_sids[0]);
+               user_sidstr = talloc_strdup(mem_ctx, sidstr);
+
+               group_sidstr = talloc_strdup(mem_ctx, "");
+               for (i=1; i<ptoken->num_sids; i++) {
+                       sid_to_string(sidstr, &ptoken->user_sids[i]);
+                       group_sidstr = talloc_asprintf(mem_ctx, "%s %s",
+                                                      group_sidstr, sidstr);
+               }
+
+               command = strdup(lp_log_nt_token_command());
+               command = realloc_string_sub(command, "%s", user_sidstr);
+               command = realloc_string_sub(command, "%t", group_sidstr);
+               DEBUG(8, ("running command: [%s]\n", command));
+               if (smbrun(command, NULL) != 0) {
+                       DEBUG(0, ("Could not log NT token\n"));
+                       nt_status = NT_STATUS_ACCESS_DENIED;
+               }
+               talloc_destroy(mem_ctx);
+               SAFE_FREE(command);
+       }
+
        *token = ptoken;
 
        return nt_status;

diff --git a/source/lib/afs.c b/source/lib/afs.c
index 5ff027ee01d50f98d563d08b80d68377ecc879b2..7f79429b9ed32b0b60a7c257d84fbb7210e164ad 100644 (file)
--- a/source/lib/afs.c
+++ b/source/lib/afs.c
@@ -214,12 +214,16 @@ BOOL afs_login(connection_struct *conn)
        char *cell;
        BOOL result;
        char *ticket_str;
+       DOM_SID user_sid;
 
        struct ClearToken ct;
 
        pstrcpy(afs_username, lp_afs_username_map());
        standard_sub_conn(conn, afs_username, sizeof(afs_username));
 
+       if (NT_STATUS_IS_OK(uid_to_sid(&user_sid, conn->uid)))
+               pstring_sub(afs_username, "%s", sid_string_static(&user_sid));
+
        /* The pts command always generates completely lower-case user
         * names. */
        strlower_m(afs_username);

diff --git a/source/nsswitch/winbindd_pam.c b/source/nsswitch/winbindd_pam.c
index cb44ec98d76d929a9d654fe3928366b91803ff1d..90613911182734712440b65f3fd9153f8d46e888 100644 (file)
--- a/source/nsswitch/winbindd_pam.c
+++ b/source/nsswitch/winbindd_pam.c
@@ -372,10 +372,22 @@ done:
                afsname = realloc_string_sub(afsname, "%u", name_user);
                afsname = realloc_string_sub(afsname, "%U", name_user);
 
+               {
+                       DOM_SID user_sid;
+                       fstring sidstr;
+
+                       sid_copy(&user_sid, &info3.dom_sid.sid);
+                       sid_append_rid(&user_sid, info3.user_rid);
+                       sid_to_string(sidstr, &user_sid);
+                       afsname = realloc_string_sub(afsname, "%s", sidstr);
+               }
+
                if (afsname == NULL) goto no_token;
 
                strlower_m(afsname);
 
+               DEBUG(10, ("Generating token for user %s\n", afsname));
+
                cell = strchr(afsname, '@');
 
                if (cell == NULL) goto no_token;

diff --git a/source/param/loadparm.c b/source/param/loadparm.c
index 01213a8fb39c8ccf51cafe7fc75ab26dfc45ed00..45245e2cfe5b6c8ec313157c5a7ba60dfd48093d 100644 (file)
--- a/source/param/loadparm.c
+++ b/source/param/loadparm.c
@@ -128,6 +128,7 @@ typedef struct
        char *szRealm;
        char *szAfsUsernameMap;
        int iAfsTokenLifetime;
+       char *szLogNtTokenCommand;
        char *szUsernameMap;
        char *szLogonScript;
        char *szLogonPath;
@@ -1130,6 +1131,7 @@ static struct parm_struct parm_table[] = {
        {"homedir map", P_STRING, P_GLOBAL, &Globals.szNISHomeMapName, NULL, NULL, FLAG_ADVANCED}, 
        {"afs username map", P_STRING, P_GLOBAL, &Globals.szAfsUsernameMap, NULL, NULL, FLAG_ADVANCED}, 
        {"afs token lifetime", P_INTEGER, P_GLOBAL, &Globals.iAfsTokenLifetime, NULL, NULL, FLAG_ADVANCED},
+       {"log nt token command", P_STRING, P_GLOBAL, &Globals.szLogNtTokenCommand, NULL, NULL, FLAG_ADVANCED},
        {"time offset", P_INTEGER, P_GLOBAL, &extra_time_offset, NULL, NULL, FLAG_ADVANCED}, 
        {"NIS homedir", P_BOOL, P_GLOBAL, &Globals.bNISHomeMap, NULL, NULL, FLAG_ADVANCED}, 
        {"-valid", P_BOOL, P_LOCAL, &sDefault.valid, NULL, NULL, FLAG_HIDE}, 
@@ -1664,6 +1666,7 @@ FN_GLOBAL_STRING(lp_name_resolve_order, &Globals.szNameResolveOrder)
 FN_GLOBAL_STRING(lp_realm, &Globals.szRealm)
 FN_GLOBAL_CONST_STRING(lp_afs_username_map, &Globals.szAfsUsernameMap)
 FN_GLOBAL_INTEGER(lp_afs_token_lifetime, &Globals.iAfsTokenLifetime)
+FN_GLOBAL_STRING(lp_log_nt_token_command, &Globals.szLogNtTokenCommand)
 FN_GLOBAL_STRING(lp_username_map, &Globals.szUsernameMap)
 FN_GLOBAL_CONST_STRING(lp_logon_script, &Globals.szLogonScript)
 FN_GLOBAL_CONST_STRING(lp_logon_path, &Globals.szLogonPath)