?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-libnet: fix bug #6364: Pull realm from supplied username on libnet join
[Samba.git] / source3 / libnet / libnet_join.c
blob648912640452adcbdbe1459638fc1bee15febda4
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "libnet/libnet.h"
23
24 /****************************************************************
25 ****************************************************************/
26
27 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
28 do { \
29 char *str = NULL; \
30 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
31 DEBUG(1,("libnet_Join:\n%s", str)); \
32 TALLOC_FREE(str); \
33 } while (0)
34
35 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
36 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
37 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
38 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
39
40 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
41 do { \
42 char *str = NULL; \
43 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
44 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
45 TALLOC_FREE(str); \
46 } while (0)
47
48 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
49 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
50 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
51 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
52
53 /****************************************************************
54 ****************************************************************/
55
56 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
57 struct libnet_JoinCtx *r,
58 const char *format, ...)
59 {
60 va_list args;
61
62 if (r->out.error_string) {
63 return;
64 }
65
66 va_start(args, format);
67 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
68 va_end(args);
69 }
70
71 /****************************************************************
72 ****************************************************************/
73
74 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
75 struct libnet_UnjoinCtx *r,
76 const char *format, ...)
77 {
78 va_list args;
79
80 if (r->out.error_string) {
81 return;
82 }
83
84 va_start(args, format);
85 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
86 va_end(args);
87 }
88
89 #ifdef WITH_ADS
90
91 /****************************************************************
92 ****************************************************************/
93
94 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
95 const char *netbios_domain_name,
96 const char *dc_name,
97 const char *user_name,
98 const char *password,
99 ADS_STRUCT **ads)
100 {
101 ADS_STATUS status;
102 ADS_STRUCT *my_ads = NULL;
103 char *cp;
104
105 my_ads = ads_init(dns_domain_name,
106 netbios_domain_name,
107 dc_name);
108 if (!my_ads) {
109 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
110 }
111
112 if (user_name) {
113 SAFE_FREE(my_ads->auth.user_name);
114 my_ads->auth.user_name = SMB_STRDUP(user_name);
115 if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
116 *cp++ = '\0';
117 SAFE_FREE(my_ads->auth.realm);
118 my_ads->auth.realm = smb_xstrdup(cp);
119 strupper_m(my_ads->auth.realm);
120 }
121 }
122
123 if (password) {
124 SAFE_FREE(my_ads->auth.password);
125 my_ads->auth.password = SMB_STRDUP(password);
126 }
127
128 status = ads_connect_user_creds(my_ads);
129 if (!ADS_ERR_OK(status)) {
130 ads_destroy(&my_ads);
131 return status;
132 }
133
134 *ads = my_ads;
135 return ADS_SUCCESS;
136 }
137
138 /****************************************************************
139 ****************************************************************/
140
141 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
142 struct libnet_JoinCtx *r)
143 {
144 ADS_STATUS status;
145
146 status = libnet_connect_ads(r->out.dns_domain_name,
147 r->out.netbios_domain_name,
148 r->in.dc_name,
149 r->in.admin_account,
150 r->in.admin_password,
151 &r->in.ads);
152 if (!ADS_ERR_OK(status)) {
153 libnet_join_set_error_string(mem_ctx, r,
154 "failed to connect to AD: %s",
155 ads_errstr(status));
156 return status;
157 }
158
159 if (!r->out.netbios_domain_name) {
160 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
161 r->in.ads->server.workgroup);
162 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
163 }
164
165 if (!r->out.dns_domain_name) {
166 r->out.dns_domain_name = talloc_strdup(mem_ctx,
167 r->in.ads->config.realm);
168 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
169 }
170
171 r->out.domain_is_ad = true;
172
173 return ADS_SUCCESS;
174 }
175
176 /****************************************************************
177 ****************************************************************/
178
179 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
180 struct libnet_UnjoinCtx *r)
181 {
182 ADS_STATUS status;
183
184 status = libnet_connect_ads(r->in.domain_name,
185 r->in.domain_name,
186 r->in.dc_name,
187 r->in.admin_account,
188 r->in.admin_password,
189 &r->in.ads);
190 if (!ADS_ERR_OK(status)) {
191 libnet_unjoin_set_error_string(mem_ctx, r,
192 "failed to connect to AD: %s",
193 ads_errstr(status));
194 }
195
196 return status;
197 }
198
199 /****************************************************************
200 join a domain using ADS (LDAP mods)
201 ****************************************************************/
202
203 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
204 struct libnet_JoinCtx *r)
205 {
206 ADS_STATUS status;
207 LDAPMessage *res = NULL;
208 const char *attrs[] = { "dn", NULL };
209 bool moved = false;
210
211 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
212 if (!ADS_ERR_OK(status)) {
213 return status;
214 }
215
216 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
217 if (!ADS_ERR_OK(status)) {
218 return status;
219 }
220
221 if (ads_count_replies(r->in.ads, res) != 1) {
222 ads_msgfree(r->in.ads, res);
223 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
224 }
225
226 ads_msgfree(r->in.ads, res);
227
228 /* Attempt to create the machine account and bail if this fails.
229 Assume that the admin wants exactly what they requested */
230
231 status = ads_create_machine_acct(r->in.ads,
232 r->in.machine_name,
233 r->in.account_ou);
234
235 if (ADS_ERR_OK(status)) {
236 DEBUG(1,("machine account creation created\n"));
237 return status;
238 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
239 (status.err.rc == LDAP_ALREADY_EXISTS)) {
240 status = ADS_SUCCESS;
241 }
242
243 if (!ADS_ERR_OK(status)) {
244 DEBUG(1,("machine account creation failed\n"));
245 return status;
246 }
247
248 status = ads_move_machine_acct(r->in.ads,
249 r->in.machine_name,
250 r->in.account_ou,
251 &moved);
252 if (!ADS_ERR_OK(status)) {
253 DEBUG(1,("failure to locate/move pre-existing "
254 "machine account\n"));
255 return status;
256 }
257
258 DEBUG(1,("The machine account %s the specified OU.\n",
259 moved ? "was moved into" : "already exists in"));
260
261 return status;
262 }
263
264 /****************************************************************
265 ****************************************************************/
266
267 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
268 struct libnet_UnjoinCtx *r)
269 {
270 ADS_STATUS status;
271
272 if (!r->in.ads) {
273 return libnet_unjoin_connect_ads(mem_ctx, r);
274 }
275
276 status = ads_leave_realm(r->in.ads, r->in.machine_name);
277 if (!ADS_ERR_OK(status)) {
278 libnet_unjoin_set_error_string(mem_ctx, r,
279 "failed to leave realm: %s",
280 ads_errstr(status));
281 return status;
282 }
283
284 return ADS_SUCCESS;
285 }
286
287 /****************************************************************
288 ****************************************************************/
289
290 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
291 struct libnet_JoinCtx *r)
292 {
293 ADS_STATUS status;
294 LDAPMessage *res = NULL;
295 char *dn = NULL;
296
297 if (!r->in.machine_name) {
298 return ADS_ERROR(LDAP_NO_MEMORY);
299 }
300
301 status = ads_find_machine_acct(r->in.ads,
302 &res,
303 r->in.machine_name);
304 if (!ADS_ERR_OK(status)) {
305 return status;
306 }
307
308 if (ads_count_replies(r->in.ads, res) != 1) {
309 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
310 goto done;
311 }
312
313 dn = ads_get_dn(r->in.ads, mem_ctx, res);
314 if (!dn) {
315 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
316 goto done;
317 }
318
319 r->out.dn = talloc_strdup(mem_ctx, dn);
320 if (!r->out.dn) {
321 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
322 goto done;
323 }
324
325 done:
326 ads_msgfree(r->in.ads, res);
327 TALLOC_FREE(dn);
328
329 return status;
330 }
331
332 /****************************************************************
333 Set a machines dNSHostName and servicePrincipalName attributes
334 ****************************************************************/
335
336 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
337 struct libnet_JoinCtx *r)
338 {
339 ADS_STATUS status;
340 ADS_MODLIST mods;
341 fstring my_fqdn;
342 const char *spn_array[3] = {NULL, NULL, NULL};
343 char *spn = NULL;
344
345 /* Find our DN */
346
347 status = libnet_join_find_machine_acct(mem_ctx, r);
348 if (!ADS_ERR_OK(status)) {
349 return status;
350 }
351
352 /* Windows only creates HOST/shortname & HOST/fqdn. */
353
354 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
355 if (!spn) {
356 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
357 }
358 strupper_m(spn);
359 spn_array[0] = spn;
360
361 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
362 || (strchr(my_fqdn, '.') == NULL)) {
363 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
364 r->out.dns_domain_name);
365 }
366
367 strlower_m(my_fqdn);
368
369 if (!strequal(my_fqdn, r->in.machine_name)) {
370 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
371 if (!spn) {
372 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
373 }
374 spn_array[1] = spn;
375 }
376
377 mods = ads_init_mods(mem_ctx);
378 if (!mods) {
379 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
380 }
381
382 /* fields of primary importance */
383
384 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
385 if (!ADS_ERR_OK(status)) {
386 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
387 }
388
389 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
390 spn_array);
391 if (!ADS_ERR_OK(status)) {
392 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
393 }
394
395 return ads_gen_mod(r->in.ads, r->out.dn, mods);
396 }
397
398 /****************************************************************
399 ****************************************************************/
400
401 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
402 struct libnet_JoinCtx *r)
403 {
404 ADS_STATUS status;
405 ADS_MODLIST mods;
406
407 if (!r->in.create_upn) {
408 return ADS_SUCCESS;
409 }
410
411 /* Find our DN */
412
413 status = libnet_join_find_machine_acct(mem_ctx, r);
414 if (!ADS_ERR_OK(status)) {
415 return status;
416 }
417
418 if (!r->in.upn) {
419 r->in.upn = talloc_asprintf(mem_ctx,
420 "host/%s@%s",
421 r->in.machine_name,
422 r->out.dns_domain_name);
423 if (!r->in.upn) {
424 return ADS_ERROR(LDAP_NO_MEMORY);
425 }
426 }
427
428 /* now do the mods */
429
430 mods = ads_init_mods(mem_ctx);
431 if (!mods) {
432 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
433 }
434
435 /* fields of primary importance */
436
437 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
438 if (!ADS_ERR_OK(status)) {
439 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
440 }
441
442 return ads_gen_mod(r->in.ads, r->out.dn, mods);
443 }
444
445
446 /****************************************************************
447 ****************************************************************/
448
449 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
450 struct libnet_JoinCtx *r)
451 {
452 ADS_STATUS status;
453 ADS_MODLIST mods;
454 char *os_sp = NULL;
455
456 if (!r->in.os_name || !r->in.os_version ) {
457 return ADS_SUCCESS;
458 }
459
460 /* Find our DN */
461
462 status = libnet_join_find_machine_acct(mem_ctx, r);
463 if (!ADS_ERR_OK(status)) {
464 return status;
465 }
466
467 /* now do the mods */
468
469 mods = ads_init_mods(mem_ctx);
470 if (!mods) {
471 return ADS_ERROR(LDAP_NO_MEMORY);
472 }
473
474 os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
475 if (!os_sp) {
476 return ADS_ERROR(LDAP_NO_MEMORY);
477 }
478
479 /* fields of primary importance */
480
481 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
482 r->in.os_name);
483 if (!ADS_ERR_OK(status)) {
484 return status;
485 }
486
487 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
488 r->in.os_version);
489 if (!ADS_ERR_OK(status)) {
490 return status;
491 }
492
493 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
494 os_sp);
495 if (!ADS_ERR_OK(status)) {
496 return status;
497 }
498
499 return ads_gen_mod(r->in.ads, r->out.dn, mods);
500 }
501
502 /****************************************************************
503 ****************************************************************/
504
505 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
506 struct libnet_JoinCtx *r)
507 {
508 if (!USE_SYSTEM_KEYTAB) {
509 return true;
510 }
511
512 if (ads_keytab_create_default(r->in.ads) != 0) {
513 return false;
514 }
515
516 return true;
517 }
518
519 /****************************************************************
520 ****************************************************************/
521
522 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
523 struct libnet_JoinCtx *r)
524 {
525 uint32_t domain_func;
526 ADS_STATUS status;
527 const char *salt = NULL;
528 char *std_salt = NULL;
529
530 status = ads_domain_func_level(r->in.ads, &domain_func);
531 if (!ADS_ERR_OK(status)) {
532 libnet_join_set_error_string(mem_ctx, r,
533 "failed to determine domain functional level: %s",
534 ads_errstr(status));
535 return false;
536 }
537
538 /* go ahead and setup the default salt */
539
540 std_salt = kerberos_standard_des_salt();
541 if (!std_salt) {
542 libnet_join_set_error_string(mem_ctx, r,
543 "failed to obtain standard DES salt");
544 return false;
545 }
546
547 salt = talloc_strdup(mem_ctx, std_salt);
548 if (!salt) {
549 return false;
550 }
551
552 SAFE_FREE(std_salt);
553
554 /* if it's a Windows functional domain, we have to look for the UPN */
555
556 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
557 char *upn;
558
559 upn = ads_get_upn(r->in.ads, mem_ctx,
560 r->in.machine_name);
561 if (upn) {
562 salt = talloc_strdup(mem_ctx, upn);
563 if (!salt) {
564 return false;
565 }
566 }
567 }
568
569 return kerberos_secrets_store_des_salt(salt);
570 }
571
572 /****************************************************************
573 ****************************************************************/
574
575 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
576 struct libnet_JoinCtx *r)
577 {
578 ADS_STATUS status;
579
580 if (!r->in.ads) {
581 status = libnet_join_connect_ads(mem_ctx, r);
582 if (!ADS_ERR_OK(status)) {
583 return status;
584 }
585 }
586
587 status = libnet_join_set_machine_spn(mem_ctx, r);
588 if (!ADS_ERR_OK(status)) {
589 libnet_join_set_error_string(mem_ctx, r,
590 "failed to set machine spn: %s",
591 ads_errstr(status));
592 return status;
593 }
594
595 status = libnet_join_set_os_attributes(mem_ctx, r);
596 if (!ADS_ERR_OK(status)) {
597 libnet_join_set_error_string(mem_ctx, r,
598 "failed to set machine os attributes: %s",
599 ads_errstr(status));
600 return status;
601 }
602
603 status = libnet_join_set_machine_upn(mem_ctx, r);
604 if (!ADS_ERR_OK(status)) {
605 libnet_join_set_error_string(mem_ctx, r,
606 "failed to set machine upn: %s",
607 ads_errstr(status));
608 return status;
609 }
610
611 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
612 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
613 }
614
615 if (!libnet_join_create_keytab(mem_ctx, r)) {
616 libnet_join_set_error_string(mem_ctx, r,
617 "failed to create kerberos keytab");
618 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
619 }
620
621 return ADS_SUCCESS;
622 }
623 #endif /* WITH_ADS */
624
625 /****************************************************************
626 Store the machine password and domain SID
627 ****************************************************************/
628
629 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
630 struct libnet_JoinCtx *r)
631 {
632 if (!secrets_store_domain_sid(r->out.netbios_domain_name,
633 r->out.domain_sid))
634 {
635 DEBUG(1,("Failed to save domain sid\n"));
636 return false;
637 }
638
639 if (!secrets_store_machine_password(r->in.machine_password,
640 r->out.netbios_domain_name,
641 r->in.secure_channel_type))
642 {
643 DEBUG(1,("Failed to save machine password\n"));
644 return false;
645 }
646
647 return true;
648 }
649
650 /****************************************************************
651 Connect dc's IPC$ share
652 ****************************************************************/
653
654 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
655 const char *user,
656 const char *pass,
657 bool use_kerberos,
658 struct cli_state **cli)
659 {
660 int flags = 0;
661
662 if (use_kerberos) {
663 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
664 }
665
666 if (use_kerberos && pass) {
667 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
668 }
669
670 return cli_full_connection(cli, NULL,
671 dc,
672 NULL, 0,
673 "IPC$", "IPC",
674 user,
675 NULL,
676 pass,
677 flags,
678 Undefined, NULL);
679 }
680
681 /****************************************************************
682 Lookup domain dc's info
683 ****************************************************************/
684
685 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
686 struct libnet_JoinCtx *r,
687 struct cli_state **cli)
688 {
689 struct rpc_pipe_client *pipe_hnd = NULL;
690 struct policy_handle lsa_pol;
691 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
692 union lsa_PolicyInformation *info = NULL;
693
694 status = libnet_join_connect_dc_ipc(r->in.dc_name,
695 r->in.admin_account,
696 r->in.admin_password,
697 r->in.use_kerberos,
698 cli);
699 if (!NT_STATUS_IS_OK(status)) {
700 goto done;
701 }
702
703 status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
704 &pipe_hnd);
705 if (!NT_STATUS_IS_OK(status)) {
706 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
707 nt_errstr(status)));
708 goto done;
709 }
710
711 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
712 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
713 if (!NT_STATUS_IS_OK(status)) {
714 goto done;
715 }
716
717 status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
718 &lsa_pol,
719 LSA_POLICY_INFO_DNS,
720 &info);
721 if (NT_STATUS_IS_OK(status)) {
722 r->out.domain_is_ad = true;
723 r->out.netbios_domain_name = info->dns.name.string;
724 r->out.dns_domain_name = info->dns.dns_domain.string;
725 r->out.forest_name = info->dns.dns_forest.string;
726 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->dns.sid);
727 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
728 }
729
730 if (!NT_STATUS_IS_OK(status)) {
731 status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
732 &lsa_pol,
733 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
734 &info);
735 if (!NT_STATUS_IS_OK(status)) {
736 goto done;
737 }
738
739 r->out.netbios_domain_name = info->account_domain.name.string;
740 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->account_domain.sid);
741 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
742 }
743
744 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
745 TALLOC_FREE(pipe_hnd);
746
747 done:
748 return status;
749 }
750
751 /****************************************************************
752 Do the domain join
753 ****************************************************************/
754
755 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
756 struct libnet_JoinCtx *r,
757 struct cli_state *cli)
758 {
759 struct rpc_pipe_client *pipe_hnd = NULL;
760 struct policy_handle sam_pol, domain_pol, user_pol;
761 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
762 char *acct_name;
763 struct lsa_String lsa_acct_name;
764 uint32_t user_rid;
765 uint32_t acct_flags = ACB_WSTRUST;
766 struct samr_Ids user_rids;
767 struct samr_Ids name_types;
768 union samr_UserInfo user_info;
769
770 struct samr_CryptPassword crypt_pwd;
771 struct samr_CryptPasswordEx crypt_pwd_ex;
772
773 ZERO_STRUCT(sam_pol);
774 ZERO_STRUCT(domain_pol);
775 ZERO_STRUCT(user_pol);
776
777 if (!r->in.machine_password) {
778 r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
779 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
780 }
781
782 /* Open the domain */
783
784 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
785 &pipe_hnd);
786 if (!NT_STATUS_IS_OK(status)) {
787 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
788 nt_errstr(status)));
789 goto done;
790 }
791
792 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
793 pipe_hnd->desthost,
794 SAMR_ACCESS_ENUM_DOMAINS
795 | SAMR_ACCESS_LOOKUP_DOMAIN,
796 &sam_pol);
797 if (!NT_STATUS_IS_OK(status)) {
798 goto done;
799 }
800
801 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
802 &sam_pol,
803 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
804 | SAMR_DOMAIN_ACCESS_CREATE_USER
805 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
806 r->out.domain_sid,
807 &domain_pol);
808 if (!NT_STATUS_IS_OK(status)) {
809 goto done;
810 }
811
812 /* Create domain user */
813
814 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
815 strlower_m(acct_name);
816
817 init_lsa_String(&lsa_acct_name, acct_name);
818
819 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
820 uint32_t access_desired =
821 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
822 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
823 SAMR_USER_ACCESS_SET_PASSWORD |
824 SAMR_USER_ACCESS_GET_ATTRIBUTES |
825 SAMR_USER_ACCESS_SET_ATTRIBUTES;
826 uint32_t access_granted = 0;
827
828 /* Don't try to set any acct_flags flags other than ACB_WSTRUST */
829
830 DEBUG(10,("Creating account with desired access mask: %d\n",
831 access_desired));
832
833 status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
834 &domain_pol,
835 &lsa_acct_name,
836 ACB_WSTRUST,
837 access_desired,
838 &user_pol,
839 &access_granted,
840 &user_rid);
841 if (!NT_STATUS_IS_OK(status) &&
842 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
843
844 DEBUG(10,("Creation of workstation account failed: %s\n",
845 nt_errstr(status)));
846
847 /* If NT_STATUS_ACCESS_DENIED then we have a valid
848 username/password combo but the user does not have
849 administrator access. */
850
851 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
852 libnet_join_set_error_string(mem_ctx, r,
853 "User specified does not have "
854 "administrator privileges");
855 }
856
857 goto done;
858 }
859
860 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
861 if (!(r->in.join_flags &
862 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
863 goto done;
864 }
865 }
866
867 /* We *must* do this.... don't ask... */
868
869 if (NT_STATUS_IS_OK(status)) {
870 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
871 }
872 }
873
874 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
875 &domain_pol,
876 1,
877 &lsa_acct_name,
878 &user_rids,
879 &name_types);
880 if (!NT_STATUS_IS_OK(status)) {
881 goto done;
882 }
883
884 if (name_types.ids[0] != SID_NAME_USER) {
885 DEBUG(0,("%s is not a user account (type=%d)\n",
886 acct_name, name_types.ids[0]));
887 status = NT_STATUS_INVALID_WORKSTATION;
888 goto done;
889 }
890
891 user_rid = user_rids.ids[0];
892
893 /* Open handle on user */
894
895 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
896 &domain_pol,
897 SEC_FLAG_MAXIMUM_ALLOWED,
898 user_rid,
899 &user_pol);
900 if (!NT_STATUS_IS_OK(status)) {
901 goto done;
902 }
903
904 /* Fill in the additional account flags now */
905
906 acct_flags |= ACB_PWNOEXP;
907 if (r->out.domain_is_ad) {
908 #if !defined(ENCTYPE_ARCFOUR_HMAC)
909 acct_flags |= ACB_USE_DES_KEY_ONLY;
910 #endif
911 ;;
912 }
913
914 /* Set account flags on machine account */
915 ZERO_STRUCT(user_info.info16);
916 user_info.info16.acct_flags = acct_flags;
917
918 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
919 &user_pol,
920 16,
921 &user_info);
922
923 if (!NT_STATUS_IS_OK(status)) {
924
925 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
926 &user_pol);
927
928 libnet_join_set_error_string(mem_ctx, r,
929 "Failed to set account flags for machine account (%s)\n",
930 nt_errstr(status));
931 goto done;
932 }
933
934 /* Set password on machine account - first try level 26 */
935
936 init_samr_CryptPasswordEx(r->in.machine_password,
937 &cli->user_session_key,
938 &crypt_pwd_ex);
939
940 user_info.info26.password = crypt_pwd_ex;
941 user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
942
943 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
944 &user_pol,
945 26,
946 &user_info);
947
948 if (NT_STATUS_EQUAL(status, NT_STATUS(DCERPC_FAULT_INVALID_TAG))) {
949
950 /* retry with level 24 */
951
952 init_samr_CryptPassword(r->in.machine_password,
953 &cli->user_session_key,
954 &crypt_pwd);
955
956 user_info.info24.password = crypt_pwd;
957 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
958
959 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
960 &user_pol,
961 24,
962 &user_info);
963 }
964
965 if (!NT_STATUS_IS_OK(status)) {
966
967 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
968 &user_pol);
969
970 libnet_join_set_error_string(mem_ctx, r,
971 "Failed to set password for machine account (%s)\n",
972 nt_errstr(status));
973 goto done;
974 }
975
976 status = NT_STATUS_OK;
977
978 done:
979 if (!pipe_hnd) {
980 return status;
981 }
982
983 if (is_valid_policy_hnd(&sam_pol)) {
984 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
985 }
986 if (is_valid_policy_hnd(&domain_pol)) {
987 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
988 }
989 if (is_valid_policy_hnd(&user_pol)) {
990 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
991 }
992 TALLOC_FREE(pipe_hnd);
993
994 return status;
995 }
996
997 /****************************************************************
998 ****************************************************************/
999
1000 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1001 const char *machine_name,
1002 const char *dc_name)
1003 {
1004 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1005 struct cli_state *cli = NULL;
1006 struct rpc_pipe_client *pipe_hnd = NULL;
1007 struct rpc_pipe_client *netlogon_pipe = NULL;
1008 NTSTATUS status;
1009 char *machine_password = NULL;
1010 char *machine_account = NULL;
1011
1012 if (!dc_name) {
1013 return NT_STATUS_INVALID_PARAMETER;
1014 }
1015
1016 if (!secrets_init()) {
1017 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1018 }
1019
1020 machine_password = secrets_fetch_machine_password(netbios_domain_name,
1021 NULL, NULL);
1022 if (!machine_password) {
1023 return NT_STATUS_NO_TRUST_LSA_SECRET;
1024 }
1025
1026 if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1027 SAFE_FREE(machine_password);
1028 return NT_STATUS_NO_MEMORY;
1029 }
1030
1031 status = cli_full_connection(&cli, NULL,
1032 dc_name,
1033 NULL, 0,
1034 "IPC$", "IPC",
1035 machine_account,
1036 NULL,
1037 machine_password,
1038 0,
1039 Undefined, NULL);
1040 free(machine_account);
1041 free(machine_password);
1042
1043 if (!NT_STATUS_IS_OK(status)) {
1044 status = cli_full_connection(&cli, NULL,
1045 dc_name,
1046 NULL, 0,
1047 "IPC$", "IPC",
1048 "",
1049 NULL,
1050 "",
1051 0,
1052 Undefined, NULL);
1053 }
1054
1055 if (!NT_STATUS_IS_OK(status)) {
1056 return status;
1057 }
1058
1059 status = get_schannel_session_key(cli, netbios_domain_name,
1060 &neg_flags, &netlogon_pipe);
1061 if (!NT_STATUS_IS_OK(status)) {
1062 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1063 cli_shutdown(cli);
1064 return NT_STATUS_OK;
1065 }
1066
1067 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1068 "key from server %s for domain %s. Error was %s\n",
1069 cli->desthost, netbios_domain_name, nt_errstr(status)));
1070 cli_shutdown(cli);
1071 return status;
1072 }
1073
1074 if (!lp_client_schannel()) {
1075 cli_shutdown(cli);
1076 return NT_STATUS_OK;
1077 }
1078
1079 status = cli_rpc_pipe_open_schannel_with_key(
1080 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1081 PIPE_AUTH_LEVEL_PRIVACY,
1082 netbios_domain_name, netlogon_pipe->dc, &pipe_hnd);
1083
1084 cli_shutdown(cli);
1085
1086 if (!NT_STATUS_IS_OK(status)) {
1087 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1088 "on netlogon pipe to server %s for domain %s. "
1089 "Error was %s\n",
1090 cli->desthost, netbios_domain_name, nt_errstr(status)));
1091 return status;
1092 }
1093
1094 return NT_STATUS_OK;
1095 }
1096
1097 /****************************************************************
1098 ****************************************************************/
1099
1100 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1101 struct libnet_JoinCtx *r)
1102 {
1103 NTSTATUS status;
1104
1105 status = libnet_join_ok(r->out.netbios_domain_name,
1106 r->in.machine_name,
1107 r->in.dc_name);
1108 if (!NT_STATUS_IS_OK(status)) {
1109 libnet_join_set_error_string(mem_ctx, r,
1110 "failed to verify domain membership after joining: %s",
1111 get_friendly_nt_error_msg(status));
1112 return WERR_SETUP_NOT_JOINED;
1113 }
1114
1115 return WERR_OK;
1116 }
1117
1118 /****************************************************************
1119 ****************************************************************/
1120
1121 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1122 struct libnet_UnjoinCtx *r)
1123 {
1124 if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1125 return false;
1126 }
1127
1128 if (!secrets_delete_domain_sid(lp_workgroup())) {
1129 return false;
1130 }
1131
1132 return true;
1133 }
1134
1135 /****************************************************************
1136 ****************************************************************/
1137
1138 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1139 struct libnet_UnjoinCtx *r)
1140 {
1141 struct cli_state *cli = NULL;
1142 struct rpc_pipe_client *pipe_hnd = NULL;
1143 struct policy_handle sam_pol, domain_pol, user_pol;
1144 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1145 char *acct_name;
1146 uint32_t user_rid;
1147 struct lsa_String lsa_acct_name;
1148 struct samr_Ids user_rids;
1149 struct samr_Ids name_types;
1150 union samr_UserInfo *info = NULL;
1151
1152 ZERO_STRUCT(sam_pol);
1153 ZERO_STRUCT(domain_pol);
1154 ZERO_STRUCT(user_pol);
1155
1156 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1157 r->in.admin_account,
1158 r->in.admin_password,
1159 r->in.use_kerberos,
1160 &cli);
1161 if (!NT_STATUS_IS_OK(status)) {
1162 goto done;
1163 }
1164
1165 /* Open the domain */
1166
1167 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1168 &pipe_hnd);
1169 if (!NT_STATUS_IS_OK(status)) {
1170 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1171 nt_errstr(status)));
1172 goto done;
1173 }
1174
1175 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1176 pipe_hnd->desthost,
1177 SEC_FLAG_MAXIMUM_ALLOWED,
1178 &sam_pol);
1179 if (!NT_STATUS_IS_OK(status)) {
1180 goto done;
1181 }
1182
1183 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1184 &sam_pol,
1185 SEC_FLAG_MAXIMUM_ALLOWED,
1186 r->in.domain_sid,
1187 &domain_pol);
1188 if (!NT_STATUS_IS_OK(status)) {
1189 goto done;
1190 }
1191
1192 /* Create domain user */
1193
1194 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1195 strlower_m(acct_name);
1196
1197 init_lsa_String(&lsa_acct_name, acct_name);
1198
1199 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1200 &domain_pol,
1201 1,
1202 &lsa_acct_name,
1203 &user_rids,
1204 &name_types);
1205
1206 if (!NT_STATUS_IS_OK(status)) {
1207 goto done;
1208 }
1209
1210 if (name_types.ids[0] != SID_NAME_USER) {
1211 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1212 name_types.ids[0]));
1213 status = NT_STATUS_INVALID_WORKSTATION;
1214 goto done;
1215 }
1216
1217 user_rid = user_rids.ids[0];
1218
1219 /* Open handle on user */
1220
1221 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1222 &domain_pol,
1223 SEC_FLAG_MAXIMUM_ALLOWED,
1224 user_rid,
1225 &user_pol);
1226 if (!NT_STATUS_IS_OK(status)) {
1227 goto done;
1228 }
1229
1230 /* Get user info */
1231
1232 status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1233 &user_pol,
1234 16,
1235 &info);
1236 if (!NT_STATUS_IS_OK(status)) {
1237 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1238 goto done;
1239 }
1240
1241 /* now disable and setuser info */
1242
1243 info->info16.acct_flags |= ACB_DISABLED;
1244
1245 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1246 &user_pol,
1247 16,
1248 info);
1249
1250 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1251
1252 done:
1253 if (pipe_hnd) {
1254 if (is_valid_policy_hnd(&domain_pol)) {
1255 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1256 }
1257 if (is_valid_policy_hnd(&sam_pol)) {
1258 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1259 }
1260 TALLOC_FREE(pipe_hnd);
1261 }
1262
1263 if (cli) {
1264 cli_shutdown(cli);
1265 }
1266
1267 return status;
1268 }
1269
1270 /****************************************************************
1271 ****************************************************************/
1272
1273 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1274 {
1275 WERROR werr;
1276 struct smbconf_ctx *ctx;
1277
1278 werr = smbconf_init_reg(r, &ctx, NULL);
1279 if (!W_ERROR_IS_OK(werr)) {
1280 goto done;
1281 }
1282
1283 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1284
1285 werr = smbconf_set_global_parameter(ctx, "security", "user");
1286 W_ERROR_NOT_OK_GOTO_DONE(werr);
1287
1288 werr = smbconf_set_global_parameter(ctx, "workgroup",
1289 r->in.domain_name);
1290
1291 smbconf_delete_global_parameter(ctx, "realm");
1292 goto done;
1293 }
1294
1295 werr = smbconf_set_global_parameter(ctx, "security", "domain");
1296 W_ERROR_NOT_OK_GOTO_DONE(werr);
1297
1298 werr = smbconf_set_global_parameter(ctx, "workgroup",
1299 r->out.netbios_domain_name);
1300 W_ERROR_NOT_OK_GOTO_DONE(werr);
1301
1302 if (r->out.domain_is_ad) {
1303 werr = smbconf_set_global_parameter(ctx, "security", "ads");
1304 W_ERROR_NOT_OK_GOTO_DONE(werr);
1305
1306 werr = smbconf_set_global_parameter(ctx, "realm",
1307 r->out.dns_domain_name);
1308 W_ERROR_NOT_OK_GOTO_DONE(werr);
1309 }
1310
1311 done:
1312 smbconf_shutdown(ctx);
1313 return werr;
1314 }
1315
1316 /****************************************************************
1317 ****************************************************************/
1318
1319 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1320 {
1321 WERROR werr = WERR_OK;
1322 struct smbconf_ctx *ctx;
1323
1324 werr = smbconf_init_reg(r, &ctx, NULL);
1325 if (!W_ERROR_IS_OK(werr)) {
1326 goto done;
1327 }
1328
1329 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1330
1331 werr = smbconf_set_global_parameter(ctx, "security", "user");
1332 W_ERROR_NOT_OK_GOTO_DONE(werr);
1333
1334 werr = smbconf_delete_global_parameter(ctx, "workgroup");
1335 W_ERROR_NOT_OK_GOTO_DONE(werr);
1336
1337 smbconf_delete_global_parameter(ctx, "realm");
1338 }
1339
1340 done:
1341 smbconf_shutdown(ctx);
1342 return werr;
1343 }
1344
1345 /****************************************************************
1346 ****************************************************************/
1347
1348 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1349 {
1350 WERROR werr;
1351
1352 if (!W_ERROR_IS_OK(r->out.result)) {
1353 return r->out.result;
1354 }
1355
1356 if (!r->in.modify_config) {
1357 return WERR_OK;
1358 }
1359
1360 werr = do_join_modify_vals_config(r);
1361 if (!W_ERROR_IS_OK(werr)) {
1362 return werr;
1363 }
1364
1365 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1366
1367 r->out.modified_config = true;
1368 r->out.result = werr;
1369
1370 return werr;
1371 }
1372
1373 /****************************************************************
1374 ****************************************************************/
1375
1376 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1377 {
1378 WERROR werr;
1379
1380 if (!W_ERROR_IS_OK(r->out.result)) {
1381 return r->out.result;
1382 }
1383
1384 if (!r->in.modify_config) {
1385 return WERR_OK;
1386 }
1387
1388 werr = do_unjoin_modify_vals_config(r);
1389 if (!W_ERROR_IS_OK(werr)) {
1390 return werr;
1391 }
1392
1393 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1394
1395 r->out.modified_config = true;
1396 r->out.result = werr;
1397
1398 return werr;
1399 }
1400
1401 /****************************************************************
1402 ****************************************************************/
1403
1404 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1405 const char *domain_str,
1406 const char **domain_p,
1407 const char **dc_p)
1408 {
1409 char *domain = NULL;
1410 char *dc = NULL;
1411 const char *p = NULL;
1412
1413 if (!domain_str || !domain_p || !dc_p) {
1414 return false;
1415 }
1416
1417 p = strchr_m(domain_str, '\\');
1418
1419 if (p != NULL) {
1420 domain = talloc_strndup(mem_ctx, domain_str,
1421 PTR_DIFF(p, domain_str));
1422 dc = talloc_strdup(mem_ctx, p+1);
1423 if (!dc) {
1424 return false;
1425 }
1426 } else {
1427 domain = talloc_strdup(mem_ctx, domain_str);
1428 dc = NULL;
1429 }
1430 if (!domain) {
1431 return false;
1432 }
1433
1434 *domain_p = domain;
1435
1436 if (!*dc_p && dc) {
1437 *dc_p = dc;
1438 }
1439
1440 return true;
1441 }
1442
1443 /****************************************************************
1444 ****************************************************************/
1445
1446 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1447 struct libnet_JoinCtx *r)
1448 {
1449 if (!r->in.domain_name) {
1450 libnet_join_set_error_string(mem_ctx, r,
1451 "No domain name defined");
1452 return WERR_INVALID_PARAM;
1453 }
1454
1455 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1456 &r->in.domain_name,
1457 &r->in.dc_name)) {
1458 libnet_join_set_error_string(mem_ctx, r,
1459 "Failed to parse domain name");
1460 return WERR_INVALID_PARAM;
1461 }
1462
1463 if (IS_DC) {
1464 return WERR_SETUP_DOMAIN_CONTROLLER;
1465 }
1466
1467 if (!secrets_init()) {
1468 libnet_join_set_error_string(mem_ctx, r,
1469 "Unable to open secrets database");
1470 return WERR_CAN_NOT_COMPLETE;
1471 }
1472
1473 return WERR_OK;
1474 }
1475
1476 /****************************************************************
1477 ****************************************************************/
1478
1479 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1480 {
1481 NTSTATUS status;
1482
1483 /* Try adding dom admins to builtin\admins. Only log failures. */
1484 status = create_builtin_administrators(domain_sid);
1485 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1486 DEBUG(10,("Unable to auto-add domain administrators to "
1487 "BUILTIN\\Administrators during join because "
1488 "winbindd must be running."));
1489 } else if (!NT_STATUS_IS_OK(status)) {
1490 DEBUG(5, ("Failed to auto-add domain administrators to "
1491 "BUILTIN\\Administrators during join: %s\n",
1492 nt_errstr(status)));
1493 }
1494
1495 /* Try adding dom users to builtin\users. Only log failures. */
1496 status = create_builtin_users(domain_sid);
1497 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1498 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1499 "during join because winbindd must be running."));
1500 } else if (!NT_STATUS_IS_OK(status)) {
1501 DEBUG(5, ("Failed to auto-add domain administrators to "
1502 "BUILTIN\\Administrators during join: %s\n",
1503 nt_errstr(status)));
1504 }
1505 }
1506
1507 /****************************************************************
1508 ****************************************************************/
1509
1510 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1511 struct libnet_JoinCtx *r)
1512 {
1513 WERROR werr;
1514
1515 if (!W_ERROR_IS_OK(r->out.result)) {
1516 return r->out.result;
1517 }
1518
1519 werr = do_JoinConfig(r);
1520 if (!W_ERROR_IS_OK(werr)) {
1521 return werr;
1522 }
1523
1524 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1525 return WERR_OK;
1526 }
1527
1528 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1529 if (r->out.dns_domain_name) {
1530 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1531 }
1532
1533 #ifdef WITH_ADS
1534 if (r->out.domain_is_ad) {
1535 ADS_STATUS ads_status;
1536
1537 ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1538 if (!ADS_ERR_OK(ads_status)) {
1539 return WERR_GENERAL_FAILURE;
1540 }
1541 }
1542 #endif /* WITH_ADS */
1543
1544 libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1545
1546 return WERR_OK;
1547 }
1548
1549 /****************************************************************
1550 ****************************************************************/
1551
1552 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1553 {
1554 const char *krb5_cc_env = NULL;
1555
1556 if (r->in.ads) {
1557 ads_destroy(&r->in.ads);
1558 }
1559
1560 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1561 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1562 unsetenv(KRB5_ENV_CCNAME);
1563 }
1564
1565 return 0;
1566 }
1567
1568 /****************************************************************
1569 ****************************************************************/
1570
1571 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1572 {
1573 const char *krb5_cc_env = NULL;
1574
1575 if (r->in.ads) {
1576 ads_destroy(&r->in.ads);
1577 }
1578
1579 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1580 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1581 unsetenv(KRB5_ENV_CCNAME);
1582 }
1583
1584 return 0;
1585 }
1586
1587 /****************************************************************
1588 ****************************************************************/
1589
1590 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1591 struct libnet_JoinCtx **r)
1592 {
1593 struct libnet_JoinCtx *ctx;
1594 const char *krb5_cc_env = NULL;
1595
1596 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1597 if (!ctx) {
1598 return WERR_NOMEM;
1599 }
1600
1601 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1602
1603 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1604 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1605
1606 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1607 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1608 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1609 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1610 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1611 }
1612
1613 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1614
1615 *r = ctx;
1616
1617 return WERR_OK;
1618 }
1619
1620 /****************************************************************
1621 ****************************************************************/
1622
1623 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1624 struct libnet_UnjoinCtx **r)
1625 {
1626 struct libnet_UnjoinCtx *ctx;
1627 const char *krb5_cc_env = NULL;
1628
1629 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1630 if (!ctx) {
1631 return WERR_NOMEM;
1632 }
1633
1634 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1635
1636 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1637 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1638
1639 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1640 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1641 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1642 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1643 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1644 }
1645
1646 *r = ctx;
1647
1648 return WERR_OK;
1649 }
1650
1651 /****************************************************************
1652 ****************************************************************/
1653
1654 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1655 struct libnet_JoinCtx *r)
1656 {
1657 bool valid_security = false;
1658 bool valid_workgroup = false;
1659 bool valid_realm = false;
1660
1661 /* check if configuration is already set correctly */
1662
1663 valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1664
1665 switch (r->out.domain_is_ad) {
1666 case false:
1667 valid_security = (lp_security() == SEC_DOMAIN);
1668 if (valid_workgroup && valid_security) {
1669 /* nothing to be done */
1670 return WERR_OK;
1671 }
1672 break;
1673 case true:
1674 valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1675 switch (lp_security()) {
1676 case SEC_DOMAIN:
1677 case SEC_ADS:
1678 valid_security = true;
1679 }
1680
1681 if (valid_workgroup && valid_realm && valid_security) {
1682 /* nothing to be done */
1683 return WERR_OK;
1684 }
1685 break;
1686 }
1687
1688 /* check if we are supposed to manipulate configuration */
1689
1690 if (!r->in.modify_config) {
1691
1692 char *wrong_conf = talloc_strdup(mem_ctx, "");
1693
1694 if (!valid_workgroup) {
1695 wrong_conf = talloc_asprintf_append(wrong_conf,
1696 "\"workgroup\" set to '%s', should be '%s'",
1697 lp_workgroup(), r->out.netbios_domain_name);
1698 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1699 }
1700
1701 if (!valid_realm) {
1702 wrong_conf = talloc_asprintf_append(wrong_conf,
1703 "\"realm\" set to '%s', should be '%s'",
1704 lp_realm(), r->out.dns_domain_name);
1705 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1706 }
1707
1708 if (!valid_security) {
1709 const char *sec = NULL;
1710 switch (lp_security()) {
1711 case SEC_SHARE: sec = "share"; break;
1712 case SEC_USER: sec = "user"; break;
1713 case SEC_DOMAIN: sec = "domain"; break;
1714 case SEC_ADS: sec = "ads"; break;
1715 }
1716 wrong_conf = talloc_asprintf_append(wrong_conf,
1717 "\"security\" set to '%s', should be %s",
1718 sec, r->out.domain_is_ad ?
1719 "either 'domain' or 'ads'" : "'domain'");
1720 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1721 }
1722
1723 libnet_join_set_error_string(mem_ctx, r,
1724 "Invalid configuration (%s) and configuration modification "
1725 "was not requested", wrong_conf);
1726 return WERR_CAN_NOT_COMPLETE;
1727 }
1728
1729 /* check if we are able to manipulate configuration */
1730
1731 if (!lp_config_backend_is_registry()) {
1732 libnet_join_set_error_string(mem_ctx, r,
1733 "Configuration manipulation requested but not "
1734 "supported by backend");
1735 return WERR_NOT_SUPPORTED;
1736 }
1737
1738 return WERR_OK;
1739 }
1740
1741 /****************************************************************
1742 ****************************************************************/
1743
1744 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1745 struct libnet_JoinCtx *r)
1746 {
1747 NTSTATUS status;
1748 WERROR werr;
1749 struct cli_state *cli = NULL;
1750 #ifdef WITH_ADS
1751 ADS_STATUS ads_status;
1752 #endif /* WITH_ADS */
1753
1754 if (!r->in.dc_name) {
1755 struct netr_DsRGetDCNameInfo *info;
1756 const char *dc;
1757 status = dsgetdcname(mem_ctx,
1758 r->in.msg_ctx,
1759 r->in.domain_name,
1760 NULL,
1761 NULL,
1762 DS_FORCE_REDISCOVERY |
1763 DS_DIRECTORY_SERVICE_REQUIRED |
1764 DS_WRITABLE_REQUIRED |
1765 DS_RETURN_DNS_NAME,
1766 &info);
1767 if (!NT_STATUS_IS_OK(status)) {
1768 libnet_join_set_error_string(mem_ctx, r,
1769 "failed to find DC for domain %s",
1770 r->in.domain_name,
1771 get_friendly_nt_error_msg(status));
1772 return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1773 }
1774
1775 dc = strip_hostname(info->dc_unc);
1776 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1777 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1778 }
1779
1780 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1781 if (!NT_STATUS_IS_OK(status)) {
1782 libnet_join_set_error_string(mem_ctx, r,
1783 "failed to lookup DC info for domain '%s' over rpc: %s",
1784 r->in.domain_name, get_friendly_nt_error_msg(status));
1785 return ntstatus_to_werror(status);
1786 }
1787
1788 werr = libnet_join_check_config(mem_ctx, r);
1789 if (!W_ERROR_IS_OK(werr)) {
1790 goto done;
1791 }
1792
1793 #ifdef WITH_ADS
1794 if (r->out.domain_is_ad && r->in.account_ou) {
1795
1796 ads_status = libnet_join_connect_ads(mem_ctx, r);
1797 if (!ADS_ERR_OK(ads_status)) {
1798 return WERR_DEFAULT_JOIN_REQUIRED;
1799 }
1800
1801 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1802 if (!ADS_ERR_OK(ads_status)) {
1803 libnet_join_set_error_string(mem_ctx, r,
1804 "failed to precreate account in ou %s: %s",
1805 r->in.account_ou,
1806 ads_errstr(ads_status));
1807 return WERR_DEFAULT_JOIN_REQUIRED;
1808 }
1809
1810 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1811 }
1812 #endif /* WITH_ADS */
1813
1814 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
1815 if (!NT_STATUS_IS_OK(status)) {
1816 libnet_join_set_error_string(mem_ctx, r,
1817 "failed to join domain '%s' over rpc: %s",
1818 r->in.domain_name, get_friendly_nt_error_msg(status));
1819 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1820 return WERR_SETUP_ALREADY_JOINED;
1821 }
1822 werr = ntstatus_to_werror(status);
1823 goto done;
1824 }
1825
1826 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1827 werr = WERR_SETUP_NOT_JOINED;
1828 goto done;
1829 }
1830
1831 werr = WERR_OK;
1832
1833 done:
1834 if (cli) {
1835 cli_shutdown(cli);
1836 }
1837
1838 return werr;
1839 }
1840
1841 /****************************************************************
1842 ****************************************************************/
1843
1844 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
1845 struct libnet_JoinCtx *r)
1846 {
1847 WERROR werr;
1848 struct libnet_UnjoinCtx *u = NULL;
1849
1850 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
1851 if (!W_ERROR_IS_OK(werr)) {
1852 return werr;
1853 }
1854
1855 u->in.debug = r->in.debug;
1856 u->in.dc_name = r->in.dc_name;
1857 u->in.domain_name = r->in.domain_name;
1858 u->in.admin_account = r->in.admin_account;
1859 u->in.admin_password = r->in.admin_password;
1860 u->in.modify_config = r->in.modify_config;
1861 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1862 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
1863
1864 werr = libnet_Unjoin(mem_ctx, u);
1865 TALLOC_FREE(u);
1866
1867 return werr;
1868 }
1869
1870 /****************************************************************
1871 ****************************************************************/
1872
1873 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1874 struct libnet_JoinCtx *r)
1875 {
1876 WERROR werr;
1877
1878 if (r->in.debug) {
1879 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1880 }
1881
1882 werr = libnet_join_pre_processing(mem_ctx, r);
1883 if (!W_ERROR_IS_OK(werr)) {
1884 goto done;
1885 }
1886
1887 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1888 werr = libnet_DomainJoin(mem_ctx, r);
1889 if (!W_ERROR_IS_OK(werr)) {
1890 goto done;
1891 }
1892 }
1893
1894 werr = libnet_join_post_processing(mem_ctx, r);
1895 if (!W_ERROR_IS_OK(werr)) {
1896 goto done;
1897 }
1898
1899 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1900 werr = libnet_join_post_verify(mem_ctx, r);
1901 if (!W_ERROR_IS_OK(werr)) {
1902 libnet_join_rollback(mem_ctx, r);
1903 }
1904 }
1905
1906 done:
1907 r->out.result = werr;
1908
1909 if (r->in.debug) {
1910 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
1911 }
1912 return werr;
1913 }
1914
1915 /****************************************************************
1916 ****************************************************************/
1917
1918 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1919 struct libnet_UnjoinCtx *r)
1920 {
1921 NTSTATUS status;
1922
1923 if (!r->in.domain_sid) {
1924 struct dom_sid sid;
1925 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
1926 libnet_unjoin_set_error_string(mem_ctx, r,
1927 "Unable to fetch domain sid: are we joined?");
1928 return WERR_SETUP_NOT_JOINED;
1929 }
1930 r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
1931 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
1932 }
1933
1934 if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
1935 !r->in.delete_machine_account) {
1936 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1937 return WERR_OK;
1938 }
1939
1940 if (!r->in.dc_name) {
1941 struct netr_DsRGetDCNameInfo *info;
1942 const char *dc;
1943 status = dsgetdcname(mem_ctx,
1944 r->in.msg_ctx,
1945 r->in.domain_name,
1946 NULL,
1947 NULL,
1948 DS_DIRECTORY_SERVICE_REQUIRED |
1949 DS_WRITABLE_REQUIRED |
1950 DS_RETURN_DNS_NAME,
1951 &info);
1952 if (!NT_STATUS_IS_OK(status)) {
1953 libnet_unjoin_set_error_string(mem_ctx, r,
1954 "failed to find DC for domain %s",
1955 r->in.domain_name,
1956 get_friendly_nt_error_msg(status));
1957 return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1958 }
1959
1960 dc = strip_hostname(info->dc_unc);
1961 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1962 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1963 }
1964
1965 #ifdef WITH_ADS
1966 /* for net ads leave, try to delete the account. If it works,
1967 no sense in disabling. If it fails, we can still try to
1968 disable it. jmcd */
1969
1970 if (r->in.delete_machine_account) {
1971 ADS_STATUS ads_status;
1972 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
1973 if (ADS_ERR_OK(ads_status)) {
1974 /* dirty hack */
1975 r->out.dns_domain_name =
1976 talloc_strdup(mem_ctx,
1977 r->in.ads->server.realm);
1978 ads_status =
1979 libnet_unjoin_remove_machine_acct(mem_ctx, r);
1980 }
1981 if (!ADS_ERR_OK(ads_status)) {
1982 libnet_unjoin_set_error_string(mem_ctx, r,
1983 "failed to remove machine account from AD: %s",
1984 ads_errstr(ads_status));
1985 } else {
1986 r->out.deleted_machine_account = true;
1987 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
1988 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1989 return WERR_OK;
1990 }
1991 }
1992 #endif /* WITH_ADS */
1993
1994 /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
1995 "disable". */
1996 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1997 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1998 if (!NT_STATUS_IS_OK(status)) {
1999 libnet_unjoin_set_error_string(mem_ctx, r,
2000 "failed to disable machine account via rpc: %s",
2001 get_friendly_nt_error_msg(status));
2002 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2003 return WERR_SETUP_NOT_JOINED;
2004 }
2005 return ntstatus_to_werror(status);
2006 }
2007
2008 r->out.disabled_machine_account = true;
2009 }
2010
2011 /* If disable succeeded or was not requested at all, we
2012 should be getting rid of our end of things */
2013
2014 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2015
2016 return WERR_OK;
2017 }
2018
2019 /****************************************************************
2020 ****************************************************************/
2021
2022 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2023 struct libnet_UnjoinCtx *r)
2024 {
2025 if (!r->in.domain_name) {
2026 libnet_unjoin_set_error_string(mem_ctx, r,
2027 "No domain name defined");
2028 return WERR_INVALID_PARAM;
2029 }
2030
2031 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2032 &r->in.domain_name,
2033 &r->in.dc_name)) {
2034 libnet_unjoin_set_error_string(mem_ctx, r,
2035 "Failed to parse domain name");
2036 return WERR_INVALID_PARAM;
2037 }
2038
2039 if (IS_DC) {
2040 return WERR_SETUP_DOMAIN_CONTROLLER;
2041 }
2042
2043 if (!secrets_init()) {
2044 libnet_unjoin_set_error_string(mem_ctx, r,
2045 "Unable to open secrets database");
2046 return WERR_CAN_NOT_COMPLETE;
2047 }
2048
2049 return WERR_OK;
2050 }
2051
2052 /****************************************************************
2053 ****************************************************************/
2054
2055 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2056 struct libnet_UnjoinCtx *r)
2057 {
2058 saf_delete(r->out.netbios_domain_name);
2059 saf_delete(r->out.dns_domain_name);
2060
2061 return libnet_unjoin_config(r);
2062 }
2063
2064 /****************************************************************
2065 ****************************************************************/
2066
2067 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2068 struct libnet_UnjoinCtx *r)
2069 {
2070 WERROR werr;
2071
2072 if (r->in.debug) {
2073 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2074 }
2075
2076 werr = libnet_unjoin_pre_processing(mem_ctx, r);
2077 if (!W_ERROR_IS_OK(werr)) {
2078 goto done;
2079 }
2080
2081 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2082 werr = libnet_DomainUnjoin(mem_ctx, r);
2083 if (!W_ERROR_IS_OK(werr)) {
2084 libnet_unjoin_config(r);
2085 goto done;
2086 }
2087 }
2088
2089 werr = libnet_unjoin_post_processing(mem_ctx, r);
2090 if (!W_ERROR_IS_OK(werr)) {
2091 goto done;
2092 }
2093
2094 done:
2095 r->out.result = werr;
2096
2097 if (r->in.debug) {
2098 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2099 }
2100
2101 return werr;
2102 }
Samba GIT mirror