source4/torture/rpc/testjoin.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    utility code to join/leave a domain
   5
   6    Copyright (C) Andrew Tridgell 2004
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23   this code is used by other torture modules to join/leave a domain
  24   as either a member, bdc or thru a trust relationship
  25 */
  26
  27 #include "includes.h"
  28 #include "system/time.h"
  29 #include "../lib/crypto/crypto.h"
  30 #include "libnet/libnet.h"
  31 #include "lib/cmdline/popt_common.h"
  32 #include "librpc/gen_ndr/ndr_samr_c.h"
  33
  34 #include "libcli/auth/libcli_auth.h"
  35 #include "torture/rpc/rpc.h"
  36 #include "libcli/security/security.h"
  37 #include "param/param.h"
  38
  39 struct test_join {
  40         struct dcerpc_pipe *p;
  41         struct policy_handle user_handle;
  42         struct libnet_JoinDomain *libnet_r;
  43         struct dom_sid *dom_sid;
  44         const char *dom_netbios_name;
  45         const char *dom_dns_name;
  46         struct dom_sid *user_sid;
  47         struct GUID user_guid;
  48         const char *netbios_name;
  49 };
  50
  51
  52 static NTSTATUS DeleteUser_byname(struct dcerpc_binding_handle *b,
  53                                   TALLOC_CTX *mem_ctx,
  54                                   struct policy_handle *handle, const char *name)
  55 {
  56         NTSTATUS status;
  57         struct samr_DeleteUser d;
  58         struct policy_handle user_handle;
  59         uint32_t rid;
  60         struct samr_LookupNames n;
  61         struct samr_Ids rids, types;
  62         struct lsa_String sname;
  63         struct samr_OpenUser r;
  64
  65         sname.string = name;
  66
  67         n.in.domain_handle = handle;
  68         n.in.num_names = 1;
  69         n.in.names = &sname;
  70         n.out.rids = &rids;
  71         n.out.types = &types;
  72
  73         status = dcerpc_samr_LookupNames_r(b, mem_ctx, &n);
  74         if (NT_STATUS_IS_OK(status)) {
  75                 rid = n.out.rids->ids[0];
  76         } else {
  77                 return status;
  78         }
  79
  80         r.in.domain_handle = handle;
  81         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
  82         r.in.rid = rid;
  83         r.out.user_handle = &user_handle;
  84
  85         status = dcerpc_samr_OpenUser_r(b, mem_ctx, &r);
  86         if (!NT_STATUS_IS_OK(status)) {
  87                 printf("OpenUser(%s) failed - %s\n", name, nt_errstr(status));
  88                 return status;
  89         }
  90
  91         d.in.user_handle = &user_handle;
  92         d.out.user_handle = &user_handle;
  93         status = dcerpc_samr_DeleteUser_r(b, mem_ctx, &d);
  94         if (!NT_STATUS_IS_OK(status)) {
  95                 return status;
  96         }
  97
  98         return NT_STATUS_OK;
  99 }
 100
 101 /*
 102   create a test user in the domain
 103   an opaque pointer is returned. Pass it to torture_leave_domain()
 104   when finished
 105 */
 106
 107 struct test_join *torture_create_testuser(struct torture_context *torture,
 108                                           const char *username,
 109                                           const char *domain,
 110                                           uint16_t acct_type,
 111                                           const char **random_password)
 112 {
 113         NTSTATUS status;
 114         struct samr_Connect c;
 115         struct samr_CreateUser2 r;
 116         struct samr_OpenDomain o;
 117         struct samr_LookupDomain l;
 118         struct dom_sid2 *sid = NULL;
 119         struct samr_GetUserPwInfo pwp;
 120         struct samr_PwInfo info;
 121         struct samr_SetUserInfo s;
 122         union samr_UserInfo u;
 123         struct policy_handle handle;
 124         struct policy_handle domain_handle;
 125         uint32_t access_granted;
 126         uint32_t rid;
 127         DATA_BLOB session_key;
 128         struct lsa_String name;
 129
 130         int policy_min_pw_len = 0;
 131         struct test_join *join;
 132         char *random_pw;
 133         const char *dc_binding = torture_setting_string(torture, "dc_binding", NULL);
 134         struct dcerpc_binding_handle *b = NULL;
 135
 136         join = talloc(NULL, struct test_join);
 137         if (join == NULL) {
 138                 return NULL;
 139         }
 140
 141         ZERO_STRUCTP(join);
 142
 143         printf("Connecting to SAMR\n");
 144
 145         if (dc_binding) {
 146                 status = dcerpc_pipe_connect(join,
 147                                              &join->p,
 148                                              dc_binding,
 149                                              &ndr_table_samr,
 150                                              cmdline_credentials, NULL, torture->lp_ctx);
 151
 152         } else {
 153                 status = torture_rpc_connection(torture,
 154                                                 &join->p,
 155                                                 &ndr_table_samr);
 156         }
 157         if (!NT_STATUS_IS_OK(status)) {
 158                 return NULL;
 159         }
 160         b = join->p->binding_handle;
 161
 162         c.in.system_name = NULL;
 163         c.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 164         c.out.connect_handle = &handle;
 165
 166         status = dcerpc_samr_Connect_r(b, join, &c);
 167         if (!NT_STATUS_IS_OK(status)) {
 168                 const char *errstr = nt_errstr(status);
 169                 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
 170                         errstr = dcerpc_errstr(join, join->p->last_fault_code);
 171                 }
 172                 printf("samr_Connect failed - %s\n", errstr);
 173                 return NULL;
 174         }
 175
 176         printf("Opening domain %s\n", domain);
 177
 178         name.string = domain;
 179         l.in.connect_handle = &handle;
 180         l.in.domain_name = &name;
 181         l.out.sid = &sid;
 182
 183         status = dcerpc_samr_LookupDomain_r(b, join, &l);
 184         if (!NT_STATUS_IS_OK(status)) {
 185                 printf("LookupDomain failed - %s\n", nt_errstr(status));
 186                 goto failed;
 187         }
 188
 189         talloc_steal(join, *l.out.sid);
 190         join->dom_sid = *l.out.sid;
 191         join->dom_netbios_name = talloc_strdup(join, domain);
 192         if (!join->dom_netbios_name) goto failed;
 193
 194         o.in.connect_handle = &handle;
 195         o.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 196         o.in.sid = *l.out.sid;
 197         o.out.domain_handle = &domain_handle;
 198
 199         status = dcerpc_samr_OpenDomain_r(b, join, &o);
 200         if (!NT_STATUS_IS_OK(status)) {
 201                 printf("OpenDomain failed - %s\n", nt_errstr(status));
 202                 goto failed;
 203         }
 204
 205         printf("Creating account %s\n", username);
 206
 207 again:
 208         name.string = username;
 209         r.in.domain_handle = &domain_handle;
 210         r.in.account_name = &name;
 211         r.in.acct_flags = acct_type;
 212         r.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
 213         r.out.user_handle = &join->user_handle;
 214         r.out.access_granted = &access_granted;
 215         r.out.rid = &rid;
 216
 217         status = dcerpc_samr_CreateUser2_r(b, join, &r);
 218
 219         if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
 220                 status = DeleteUser_byname(b, join, &domain_handle, name.string);
 221                 if (NT_STATUS_IS_OK(status)) {
 222                         goto again;
 223                 }
 224         }
 225
 226         if (!NT_STATUS_IS_OK(status)) {
 227                 printf("CreateUser2 failed - %s\n", nt_errstr(status));
 228                 goto failed;
 229         }
 230
 231         join->user_sid = dom_sid_add_rid(join, join->dom_sid, rid);
 232
 233         pwp.in.user_handle = &join->user_handle;
 234         pwp.out.info = &info;
 235
 236         status = dcerpc_samr_GetUserPwInfo_r(b, join, &pwp);
 237         if (NT_STATUS_IS_OK(status)) {
 238                 policy_min_pw_len = pwp.out.info->min_password_length;
 239         }
 240
 241         random_pw = generate_random_password(join, MAX(8, policy_min_pw_len), 255);
 242
 243         printf("Setting account password '%s'\n", random_pw);
 244
 245         ZERO_STRUCT(u);
 246         s.in.user_handle = &join->user_handle;
 247         s.in.info = &u;
 248         s.in.level = 24;
 249
 250         encode_pw_buffer(u.info24.password.data, random_pw, STR_UNICODE);
 251         u.info24.password_expired = 0;
 252
 253         status = dcerpc_fetch_session_key(join->p, &session_key);
 254         if (!NT_STATUS_IS_OK(status)) {
 255                 printf("SetUserInfo level %u - no session key - %s\n",
 256                        s.in.level, nt_errstr(status));
 257                 torture_leave_domain(torture, join);
 258                 goto failed;
 259         }
 260
 261         arcfour_crypt_blob(u.info24.password.data, 516, &session_key);
 262
 263         status = dcerpc_samr_SetUserInfo_r(b, join, &s);
 264         if (!NT_STATUS_IS_OK(status)) {
 265                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 266                 goto failed;
 267         }
 268
 269         ZERO_STRUCT(u);
 270         s.in.user_handle = &join->user_handle;
 271         s.in.info = &u;
 272         s.in.level = 21;
 273
 274         u.info21.acct_flags = acct_type | ACB_PWNOEXP;
 275         u.info21.fields_present = SAMR_FIELD_ACCT_FLAGS | SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 276
 277         u.info21.comment.string = talloc_asprintf(join,
 278                                                   "Tortured by Samba4: %s",
 279                                                   timestring(join, time(NULL)));
 280
 281         u.info21.full_name.string = talloc_asprintf(join,
 282                                                     "Torture account for Samba4: %s",
 283                                                     timestring(join, time(NULL)));
 284
 285         u.info21.description.string = talloc_asprintf(join,
 286                                          "Samba4 torture account created by host %s: %s",
 287                                          lp_netbios_name(torture->lp_ctx),
 288                                          timestring(join, time(NULL)));
 289
 290         printf("Resetting ACB flags, force pw change time\n");
 291
 292         status = dcerpc_samr_SetUserInfo_r(b, join, &s);
 293         if (!NT_STATUS_IS_OK(status)) {
 294                 printf("SetUserInfo failed - %s\n", nt_errstr(status));
 295                 goto failed;
 296         }
 297
 298         if (random_password) {
 299                 *random_password = random_pw;
 300         }
 301
 302         return join;
 303
 304 failed:
 305         torture_leave_domain(torture, join);
 306         return NULL;
 307 }
 308
 309
 310 _PUBLIC_ struct test_join *torture_join_domain(struct torture_context *tctx,
 311                                                const char *machine_name,
 312                                       uint32_t acct_flags,
 313                                       struct cli_credentials **machine_credentials)
 314 {
 315         NTSTATUS status;
 316         struct libnet_context *libnet_ctx;
 317         struct libnet_JoinDomain *libnet_r;
 318         struct test_join *tj;
 319         struct samr_SetUserInfo s;
 320         union samr_UserInfo u;
 321
 322         tj = talloc(tctx, struct test_join);
 323         if (!tj) return NULL;
 324
 325         libnet_r = talloc(tj, struct libnet_JoinDomain);
 326         if (!libnet_r) {
 327                 talloc_free(tj);
 328                 return NULL;
 329         }
 330
 331         libnet_ctx = libnet_context_init(tctx->ev, tctx->lp_ctx);
 332         if (!libnet_ctx) {
 333                 talloc_free(tj);
 334                 return NULL;
 335         }
 336
 337         tj->libnet_r = libnet_r;
 338
 339         libnet_ctx->cred = cmdline_credentials;
 340         libnet_r->in.binding = torture_setting_string(tctx, "binding", NULL);
 341         if (!libnet_r->in.binding) {
 342                 libnet_r->in.binding = talloc_asprintf(libnet_r, "ncacn_np:%s", torture_setting_string(tctx, "host", NULL));
 343         }
 344         libnet_r->in.level = LIBNET_JOINDOMAIN_SPECIFIED;
 345         libnet_r->in.netbios_name = machine_name;
 346         libnet_r->in.account_name = talloc_asprintf(libnet_r, "%s$", machine_name);
 347         if (!libnet_r->in.account_name) {
 348                 talloc_free(tj);
 349                 return NULL;
 350         }
 351
 352         libnet_r->in.acct_type = acct_flags;
 353         libnet_r->in.recreate_account = true;
 354
 355         status = libnet_JoinDomain(libnet_ctx, libnet_r, libnet_r);
 356         if (!NT_STATUS_IS_OK(status)) {
 357                 if (libnet_r->out.error_string) {
 358                         DEBUG(0, ("Domain join failed - %s\n", libnet_r->out.error_string));
 359                 } else {
 360                         DEBUG(0, ("Domain join failed - %s\n", nt_errstr(status)));
 361                 }
 362                 talloc_free(tj);
 363                 return NULL;
 364         }
 365         tj->p = libnet_r->out.samr_pipe;
 366         tj->user_handle = *libnet_r->out.user_handle;
 367         tj->dom_sid = libnet_r->out.domain_sid;
 368         talloc_steal(tj, libnet_r->out.domain_sid);
 369         tj->dom_netbios_name    = libnet_r->out.domain_name;
 370         talloc_steal(tj, libnet_r->out.domain_name);
 371         tj->dom_dns_name        = libnet_r->out.realm;
 372         talloc_steal(tj, libnet_r->out.realm);
 373         tj->user_guid = libnet_r->out.account_guid;
 374         tj->netbios_name = talloc_strdup(tj, machine_name);
 375         if (!tj->netbios_name) {
 376                 talloc_free(tj);
 377                 return NULL;
 378         }
 379
 380         ZERO_STRUCT(u);
 381         s.in.user_handle = &tj->user_handle;
 382         s.in.info = &u;
 383         s.in.level = 21;
 384
 385         u.info21.fields_present = SAMR_FIELD_DESCRIPTION | SAMR_FIELD_COMMENT | SAMR_FIELD_FULL_NAME;
 386         u.info21.comment.string = talloc_asprintf(tj,
 387                                                   "Tortured by Samba4: %s",
 388                                                   timestring(tj, time(NULL)));
 389         u.info21.full_name.string = talloc_asprintf(tj,
 390                                                     "Torture account for Samba4: %s",
 391                                                     timestring(tj, time(NULL)));
 392
 393         u.info21.description.string = talloc_asprintf(tj,
 394                                                       "Samba4 torture account created by host %s: %s",
 395                                                       lp_netbios_name(tctx->lp_ctx), timestring(tj, time(NULL)));
 396
 397         status = dcerpc_samr_SetUserInfo_r(tj->p->binding_handle, tj, &s);
 398         if (!NT_STATUS_IS_OK(status)) {
 399                 printf("SetUserInfo (non-critical) failed - %s\n", nt_errstr(status));
 400         }
 401
 402         *machine_credentials = cli_credentials_init(tj);
 403         cli_credentials_set_conf(*machine_credentials, tctx->lp_ctx);
 404         cli_credentials_set_workstation(*machine_credentials, machine_name, CRED_SPECIFIED);
 405         cli_credentials_set_domain(*machine_credentials, libnet_r->out.domain_name, CRED_SPECIFIED);
 406         if (libnet_r->out.realm) {
 407                 cli_credentials_set_realm(*machine_credentials, libnet_r->out.realm, CRED_SPECIFIED);
 408         }
 409         cli_credentials_set_username(*machine_credentials, libnet_r->in.account_name, CRED_SPECIFIED);
 410         cli_credentials_set_password(*machine_credentials, libnet_r->out.join_password, CRED_SPECIFIED);
 411         cli_credentials_set_kvno(*machine_credentials, libnet_r->out.kvno);
 412         if (acct_flags & ACB_SVRTRUST) {
 413                 cli_credentials_set_secure_channel_type(*machine_credentials,
 414                                                         SEC_CHAN_BDC);
 415         } else if (acct_flags & ACB_WSTRUST) {
 416                 cli_credentials_set_secure_channel_type(*machine_credentials,
 417                                                         SEC_CHAN_WKSTA);
 418         } else {
 419                 DEBUG(0, ("Invalid account type specificed to torture_join_domain\n"));
 420                 talloc_free(*machine_credentials);
 421                 return NULL;
 422         }
 423
 424         return tj;
 425 }
 426
 427 struct dcerpc_pipe *torture_join_samr_pipe(struct test_join *join)
 428 {
 429         return join->p;
 430 }
 431
 432 struct policy_handle *torture_join_samr_user_policy(struct test_join *join)
 433 {
 434         return &join->user_handle;
 435 }
 436
 437 static NTSTATUS torture_leave_ads_domain(struct torture_context *torture,
 438                                          TALLOC_CTX *mem_ctx,
 439                                          struct libnet_JoinDomain *libnet_r)
 440 {
 441         int rtn;
 442         TALLOC_CTX *tmp_ctx;
 443
 444         struct ldb_dn *server_dn;
 445         struct ldb_context *ldb_ctx;
 446
 447         char *remote_ldb_url;
 448
 449         /* Check if we are a domain controller. If not, exit. */
 450         if (!libnet_r->out.server_dn_str) {
 451                 return NT_STATUS_OK;
 452         }
 453
 454         tmp_ctx = talloc_named(mem_ctx, 0, "torture_leave temporary context");
 455         if (!tmp_ctx) {
 456                 libnet_r->out.error_string = NULL;
 457                 return NT_STATUS_NO_MEMORY;
 458         }
 459
 460         ldb_ctx = ldb_init(tmp_ctx, torture->ev);
 461         if (!ldb_ctx) {
 462                 libnet_r->out.error_string = NULL;
 463                 talloc_free(tmp_ctx);
 464                 return NT_STATUS_NO_MEMORY;
 465         }
 466
 467         /* Remove CN=Servers,... entry from the AD. */
 468         server_dn = ldb_dn_new(tmp_ctx, ldb_ctx, libnet_r->out.server_dn_str);
 469         if (! ldb_dn_validate(server_dn)) {
 470                 libnet_r->out.error_string = NULL;
 471                 talloc_free(tmp_ctx);
 472                 return NT_STATUS_NO_MEMORY;
 473         }
 474
 475         remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s", libnet_r->out.samr_binding->host);
 476         if (!remote_ldb_url) {
 477                 libnet_r->out.error_string = NULL;
 478                 talloc_free(tmp_ctx);
 479                 return NT_STATUS_NO_MEMORY;
 480         }
 481
 482         ldb_set_opaque(ldb_ctx, "credentials", cmdline_credentials);
 483         ldb_set_opaque(ldb_ctx, "loadparm", cmdline_lp_ctx);
 484
 485         rtn = ldb_connect(ldb_ctx, remote_ldb_url, 0, NULL);
 486         if (rtn != 0) {
 487                 libnet_r->out.error_string = NULL;
 488                 talloc_free(tmp_ctx);
 489                 return NT_STATUS_UNSUCCESSFUL;
 490         }
 491
 492         rtn = ldb_delete(ldb_ctx, server_dn);
 493         if (rtn != 0) {
 494                 libnet_r->out.error_string = NULL;
 495                 talloc_free(tmp_ctx);
 496                 return NT_STATUS_UNSUCCESSFUL;
 497         }
 498
 499         DEBUG(0, ("%s removed successfully.\n", libnet_r->out.server_dn_str));
 500
 501         talloc_free(tmp_ctx);
 502         return NT_STATUS_OK;
 503 }
 504
 505 /*
 506   leave the domain, deleting the machine acct
 507 */
 508
 509 _PUBLIC_ void torture_leave_domain(struct torture_context *torture, struct test_join *join)
 510 {
 511         struct samr_DeleteUser d;
 512         NTSTATUS status;
 513
 514         if (!join) {
 515                 return;
 516         }
 517         d.in.user_handle = &join->user_handle;
 518         d.out.user_handle = &join->user_handle;
 519
 520         /* Delete machine account */
 521         status = dcerpc_samr_DeleteUser_r(join->p->binding_handle, join, &d);
 522         if (!NT_STATUS_IS_OK(status)) {
 523                 printf("Delete of machine account %s failed\n",
 524                        join->netbios_name);
 525         } else {
 526                 printf("Delete of machine account %s was successful.\n",
 527                        join->netbios_name);
 528         }
 529
 530         if (join->libnet_r) {
 531                 status = torture_leave_ads_domain(torture, join, join->libnet_r);
 532         }
 533
 534         talloc_free(join);
 535 }
 536
 537 /*
 538   return the dom sid for a test join
 539 */
 540 _PUBLIC_ const struct dom_sid *torture_join_sid(struct test_join *join)
 541 {
 542         return join->dom_sid;
 543 }
 544
 545 const struct dom_sid *torture_join_user_sid(struct test_join *join)
 546 {
 547         return join->user_sid;
 548 }
 549
 550 const char *torture_join_netbios_name(struct test_join *join)
 551 {
 552         return join->netbios_name;
 553 }
 554
 555 const struct GUID *torture_join_user_guid(struct test_join *join)
 556 {
 557         return &join->user_guid;
 558 }
 559
 560 const char *torture_join_dom_netbios_name(struct test_join *join)
 561 {
 562         return join->dom_netbios_name;
 563 }
 564
 565 const char *torture_join_dom_dns_name(struct test_join *join)
 566 {
 567         return join->dom_dns_name;
 568 }
 569
 570 const char *torture_join_server_dn_str(struct test_join *join)
 571 {
 572         if (join->libnet_r) {
 573                 return join->libnet_r->out.server_dn_str;
 574         }
 575         return NULL;
 576 }
 577
 578
 579 #if 0 /* Left as the documentation of the join process, but see new implementation in libnet_become_dc.c */
 580 struct test_join_ads_dc {
 581         struct test_join *join;
 582 };
 583
 584 struct test_join_ads_dc *torture_join_domain_ads_dc(const char *machine_name,
 585                                                     const char *domain,
 586                                                     struct cli_credentials **machine_credentials)
 587 {
 588         struct test_join_ads_dc *join;
 589
 590         join = talloc(NULL, struct test_join_ads_dc);
 591         if (join == NULL) {
 592                 return NULL;
 593         }
 594
 595         join->join = torture_join_domain(machine_name,
 596                                         ACB_SVRTRUST,
 597                                         machine_credentials);
 598
 599         if (!join->join) {
 600                 return NULL;
 601         }
 602
 603 /* W2K: */
 604         /* W2K: modify userAccountControl from 4096 to 532480 */
 605
 606         /* W2K: modify RDN to OU=Domain Controllers and skip the $ from server name */
 607
 608         /* ask objectVersion of Schema Partition */
 609
 610         /* ask rIDManagerReferenz of the Domain Partition */
 611
 612         /* ask fsMORoleOwner of the RID-Manager$ object
 613          * returns CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ...
 614          */
 615
 616         /* ask for dnsHostName of CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 617
 618         /* ask for objectGUID of CN=NTDS Settings,CN=<DC>,CN=Servers,CN=Default-First-Site-Name, ... */
 619
 620         /* ask for * of CN=Default-First-Site-Name, ... */
 621
 622         /* search (&(|(objectClass=user)(objectClass=computer))(sAMAccountName=<machine_name>$)) in Domain Partition
 623          * attributes : distinguishedName, userAccountControl
 624          */
 625
 626         /* ask * for CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 627          * should fail with noSuchObject
 628          */
 629
 630         /* add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 631          *
 632          * objectClass = server
 633          * systemFlags = 50000000
 634          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 635          */
 636
 637         /* ask for * of CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 638          * should fail with noSuchObject
 639          */
 640
 641         /* search for (ncname=<domain_nc>) in CN=Partitions,CN=Configuration,...
 642          * attributes: ncName, dnsRoot
 643          */
 644
 645         /* modify add CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 646          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 647          * should fail with attributeOrValueExists
 648          */
 649
 650         /* modify replace CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name,...
 651          * serverReferenz = CN=<machine_name>,OU=Domain Controllers,...
 652          */
 653
 654         /* DsAddEntry to create the CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 655          *
 656          */
 657
 658         /* replicate CN=Schema,CN=Configuration,...
 659          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 660          *
 661          */
 662
 663         /* replicate CN=Configuration,...
 664          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 665          *
 666          */
 667
 668         /* replicate Domain Partition
 669          * using DRSUAPI_DS_BIND_GUID_W2K ("6abec3d1-3054-41c8-a362-5a0c5b7d5d71")
 670          *
 671          */
 672
 673         /* call DsReplicaUpdateRefs() for all partitions like this:
 674          *     req1: struct drsuapi_DsReplicaUpdateRefsRequest1
 675          *           naming_context           : *
 676          *                 naming_context: struct drsuapi_DsReplicaObjectIdentifier
 677          *                     __ndr_size               : 0x000000ae (174)
 678          *                     __ndr_size_sid           : 0x00000000 (0)
 679          *                     guid                     : 00000000-0000-0000-0000-000000000000
 680          *                     sid                      : S-0-0
 681          *                     dn                       : 'CN=Schema,CN=Configuration,DC=w2k3,DC=vmnet1,DC=vm,DC=base'
 682          *           dest_dsa_dns_name        : *
 683          *                 dest_dsa_dns_name        : '4a0df188-a0b8-47ea-bbe5-e614723f16dd._msdcs.w2k3.vmnet1.vm.base'
 684          *           dest_dsa_guid            : 4a0df188-a0b8-47ea-bbe5-e614723f16dd
 685          *           options                  : 0x0000001c (28)
 686          *                 0: DRSUAPI_DS_REPLICA_UPDATE_ASYNCHRONOUS_OPERATION
 687          *                 0: DRSUAPI_DS_REPLICA_UPDATE_WRITEABLE
 688          *                 1: DRSUAPI_DS_REPLICA_UPDATE_ADD_REFERENCE
 689          *                 1: DRSUAPI_DS_REPLICA_UPDATE_DELETE_REFERENCE
 690          *                 1: DRSUAPI_DS_REPLICA_UPDATE_0x00000010
 691          *
 692          * 4a0df188-a0b8-47ea-bbe5-e614723f16dd is the objectGUID the DsAddEntry() returned for the
 693          * CN=NTDS Settings,CN=<machine_name>,CN=Servers,CN=Default-First-Site-Name, ...
 694          */
 695
 696 /* W2K3: see libnet/libnet_become_dc.c */
 697         return join;
 698 }
 699
 700 #endif