?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ctdb: make use of ctdb_canonicalize_ip_inplace() in ctdb_control_tcp_client()
[Samba.git] / source3 / auth / server_info.c
blob1eae63664cbcd099191d858c67bde04c3378dc24
1 /*
2 Unix SMB/CIFS implementation.
3 Authentication utility functions
4 Copyright (C) Volker Lendecke 2010
5
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
10
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
15
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "auth.h"
22 #include "lib/util_unixsids.h"
23 #include "../librpc/gen_ndr/netlogon.h"
24 #include "../libcli/security/security.h"
25 #include "rpc_client/util_netlogon.h"
26 #include "nsswitch/libwbclient/wbclient.h"
27 #include "lib/winbind_util.h"
28 #include "passdb.h"
29
30 #undef DBGC_CLASS
31 #define DBGC_CLASS DBGC_AUTH
32
33 /***************************************************************************
34 Make a server_info struct. Free with TALLOC_FREE().
35 ***************************************************************************/
36
37 struct auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
38 {
39 struct auth_serversupplied_info *result;
40
41 result = talloc_zero(mem_ctx, struct auth_serversupplied_info);
42 if (result == NULL) {
43 DEBUG(0, ("talloc failed\n"));
44 return NULL;
45 }
46
47 /* Initialise the uid and gid values to something non-zero
48 which may save us from giving away root access if there
49 is a bug in allocating these fields. */
50
51 result->utok.uid = -1;
52 result->utok.gid = -1;
53
54 return result;
55 }
56
57 /****************************************************************************
58 inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
59 already be initialized and is used as the talloc parent for its members.
60 *****************************************************************************/
61
62 NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
63 struct netr_SamInfo2 *sam2)
64 {
65 struct netr_SamInfo3 *info3 = NULL;
66 NTSTATUS status;
67
68 status = copy_netr_SamInfo3(sam2,
69 server_info->info3,
70 &info3);
71 if (!NT_STATUS_IS_OK(status)) {
72 return status;
73 }
74
75 if (server_info->session_key.length) {
76 memcpy(info3->base.key.key,
77 server_info->session_key.data,
78 MIN(sizeof(info3->base.key.key),
79 server_info->session_key.length));
80 }
81 if (server_info->lm_session_key.length) {
82 memcpy(info3->base.LMSessKey.key,
83 server_info->lm_session_key.data,
84 MIN(sizeof(info3->base.LMSessKey.key),
85 server_info->lm_session_key.length));
86 }
87
88 sam2->base = info3->base;
89
90 return NT_STATUS_OK;
91 }
92
93 /****************************************************************************
94 inits a netr_SamInfo3 structure from an auth_serversupplied_info. sam3 must
95 already be initialized and is used as the talloc parent for its members.
96 *****************************************************************************/
97
98 NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_info,
99 struct netr_SamInfo3 *sam3)
100 {
101 struct netr_SamInfo3 *info3 = NULL;
102 NTSTATUS status;
103
104 status = copy_netr_SamInfo3(sam3,
105 server_info->info3,
106 &info3);
107 if (!NT_STATUS_IS_OK(status)) {
108 return status;
109 }
110
111 if (server_info->session_key.length) {
112 memcpy(info3->base.key.key,
113 server_info->session_key.data,
114 MIN(sizeof(info3->base.key.key),
115 server_info->session_key.length));
116 }
117 if (server_info->lm_session_key.length) {
118 memcpy(info3->base.LMSessKey.key,
119 server_info->lm_session_key.data,
120 MIN(sizeof(info3->base.LMSessKey.key),
121 server_info->lm_session_key.length));
122 }
123
124 sam3->base = info3->base;
125
126 sam3->sidcount = 0;
127 sam3->sids = NULL;
128
129 return NT_STATUS_OK;
130 }
131
132 /****************************************************************************
133 inits a netr_SamInfo6 structure from an auth_serversupplied_info. sam6 must
134 already be initialized and is used as the talloc parent for its members.
135 *****************************************************************************/
136
137 NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
138 struct netr_SamInfo6 *sam6)
139 {
140 struct pdb_domain_info *dominfo;
141 struct netr_SamInfo3 *info3 = NULL;
142 NTSTATUS status;
143
144 if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
145 DEBUG(10,("Not adding validation info level 6 "
146 "without ADS passdb backend\n"));
147 return NT_STATUS_INVALID_INFO_CLASS;
148 }
149
150 dominfo = pdb_get_domain_info(sam6);
151 if (dominfo == NULL) {
152 return NT_STATUS_NO_MEMORY;
153 }
154
155 status = copy_netr_SamInfo3(sam6,
156 server_info->info3,
157 &info3);
158 if (!NT_STATUS_IS_OK(status)) {
159 return status;
160 }
161
162 if (server_info->session_key.length) {
163 memcpy(info3->base.key.key,
164 server_info->session_key.data,
165 MIN(sizeof(info3->base.key.key),
166 server_info->session_key.length));
167 }
168 if (server_info->lm_session_key.length) {
169 memcpy(info3->base.LMSessKey.key,
170 server_info->lm_session_key.data,
171 MIN(sizeof(info3->base.LMSessKey.key),
172 server_info->lm_session_key.length));
173 }
174
175 sam6->base = info3->base;
176
177 sam6->sidcount = 0;
178 sam6->sids = NULL;
179
180 sam6->dns_domainname.string = talloc_strdup(sam6, dominfo->dns_domain);
181 if (sam6->dns_domainname.string == NULL) {
182 return NT_STATUS_NO_MEMORY;
183 }
184
185 sam6->principal_name.string = talloc_asprintf(
186 sam6, "%s@%s", sam6->base.account_name.string,
187 sam6->dns_domainname.string);
188 if (sam6->principal_name.string == NULL) {
189 return NT_STATUS_NO_MEMORY;
190 }
191
192 return NT_STATUS_OK;
193 }
194
195 static NTSTATUS append_netr_SidAttr(TALLOC_CTX *mem_ctx,
196 struct netr_SidAttr **sids,
197 uint32_t *count,
198 const struct dom_sid2 *asid,
199 uint32_t attributes)
200 {
201 uint32_t t = *count;
202
203 *sids = talloc_realloc(mem_ctx, *sids, struct netr_SidAttr, t + 1);
204 if (*sids == NULL) {
205 return NT_STATUS_NO_MEMORY;
206 }
207 (*sids)[t].sid = dom_sid_dup(*sids, asid);
208 if ((*sids)[t].sid == NULL) {
209 return NT_STATUS_NO_MEMORY;
210 }
211 (*sids)[t].attributes = attributes;
212 *count = t + 1;
213
214 return NT_STATUS_OK;
215 }
216
217 /* Fills the samr_RidWithAttributeArray with the provided sids.
218 * If it happens that we have additional groups that do not belong
219 * to the domain, add their sids as extra sids */
220 static NTSTATUS group_sids_to_info3(struct netr_SamInfo3 *info3,
221 const struct dom_sid *sids,
222 size_t num_sids)
223 {
224 uint32_t attributes = SE_GROUP_DEFAULT_FLAGS;
225 struct samr_RidWithAttributeArray *groups;
226 struct dom_sid *domain_sid;
227 unsigned int i;
228 NTSTATUS status;
229 uint32_t rid;
230 bool ok;
231
232 domain_sid = info3->base.domain_sid;
233 groups = &info3->base.groups;
234
235 groups->rids = talloc_array(info3,
236 struct samr_RidWithAttribute, num_sids);
237 if (!groups->rids) {
238 return NT_STATUS_NO_MEMORY;
239 }
240
241 for (i = 0; i < num_sids; i++) {
242 ok = sid_peek_check_rid(domain_sid, &sids[i], &rid);
243 if (ok) {
244 /* store domain group rid */
245 groups->rids[groups->count].rid = rid;
246 groups->rids[groups->count].attributes = attributes;
247 groups->count++;
248 continue;
249 }
250
251 /* if this wasn't a domain sid, add it as extra sid */
252 status = append_netr_SidAttr(info3, &info3->sids,
253 &info3->sidcount,
254 &sids[i], attributes);
255 if (!NT_STATUS_IS_OK(status)) {
256 return status;
257 }
258 }
259
260 return NT_STATUS_OK;
261 }
262
263 /*
264 * Merge resource SIDs, if any, into the passed in info3 structure.
265 */
266
267 static NTSTATUS merge_resource_sids(const struct PAC_LOGON_INFO *logon_info,
268 struct netr_SamInfo3 *info3)
269 {
270 uint32_t i = 0;
271 const struct PAC_DOMAIN_GROUP_MEMBERSHIP *rg = NULL;
272
273 if (logon_info->info3.base.user_flags & NETLOGON_RESOURCE_GROUPS) {
274 rg = &logon_info->resource_groups;
275 }
276
277 if (rg == NULL) {
278 return NT_STATUS_OK;
279 }
280
281 if (rg->domain_sid == NULL) {
282 DEBUG(10, ("Missing Resource Group Domain SID\n"));
283 return NT_STATUS_INVALID_PARAMETER;
284 }
285
286 /* The IDL layer would be a better place to check this, but to
287 * guard the integer addition below, we double-check */
288 if (rg->groups.count > 65535) {
289 DEBUG(10, ("Too much Resource Group RIDs %u\n",
290 (unsigned)rg->groups.count));
291 return NT_STATUS_INVALID_PARAMETER;
292 }
293
294 /*
295 * If there are any resource groups (SID Compression) add
296 * them to the extra sids portion of the info3 in the PAC.
297 *
298 * This makes the info3 look like it would if we got the info
299 * from the DC rather than the PAC.
300 */
301
302 /*
303 * Construct a SID for each RID in the list and then append it
304 * to the info3.
305 */
306 for (i = 0; i < rg->groups.count; i++) {
307 NTSTATUS status;
308 struct dom_sid new_sid;
309 uint32_t attributes = rg->groups.rids[i].attributes;
310 struct dom_sid_buf buf;
311
312 sid_compose(&new_sid,
313 rg->domain_sid,
314 rg->groups.rids[i].rid);
315
316 DEBUG(10, ("Adding SID %s to extra SIDS\n",
317 dom_sid_str_buf(&new_sid, &buf)));
318
319 status = append_netr_SidAttr(info3, &info3->sids,
320 &info3->sidcount,
321 &new_sid,
322 attributes);
323 if (!NT_STATUS_IS_OK(status)) {
324 DEBUG(1, ("failed to append SID %s to extra SIDS: %s\n",
325 dom_sid_str_buf(&new_sid, &buf),
326 nt_errstr(status)));
327 return status;
328 }
329 }
330
331 return NT_STATUS_OK;
332 }
333
334 /*
335 * Create a copy of an info3 struct from the struct PAC_LOGON_INFO,
336 * then merge resource SIDs, if any, into it. If successful return
337 * the created info3 struct.
338 */
339
340 NTSTATUS create_info3_from_pac_logon_info(TALLOC_CTX *mem_ctx,
341 const struct PAC_LOGON_INFO *logon_info,
342 struct netr_SamInfo3 **pp_info3)
343 {
344 NTSTATUS status;
345 struct netr_SamInfo3 *info3 = NULL;
346
347 status = copy_netr_SamInfo3(mem_ctx,
348 &logon_info->info3,
349 &info3);
350 if (!NT_STATUS_IS_OK(status)) {
351 return status;
352 }
353
354 status = merge_resource_sids(logon_info, info3);
355 if (!NT_STATUS_IS_OK(status)) {
356 TALLOC_FREE(info3);
357 return status;
358 }
359 *pp_info3 = info3;
360 return NT_STATUS_OK;
361 }
362
363 /*
364 * Create a copy of an info6 struct from the PAC_UPN_DNS_INFO and PAC_LOGON_INFO
365 * then merge resource SIDs, if any, into it. If successful return the created
366 * info6 struct.
367 */
368 NTSTATUS create_info6_from_pac(TALLOC_CTX *mem_ctx,
369 const struct PAC_LOGON_INFO *logon_info,
370 const struct PAC_UPN_DNS_INFO *upn_dns_info,
371 struct netr_SamInfo6 **pp_info6)
372 {
373 NTSTATUS status;
374 struct netr_SamInfo6 *info6 = NULL;
375 struct netr_SamInfo3 *info3 = NULL;
376
377 info6 = talloc_zero(mem_ctx, struct netr_SamInfo6);
378 if (info6 == NULL) {
379 return NT_STATUS_NO_MEMORY;
380 }
381
382 status = copy_netr_SamInfo3(info6,
383 &logon_info->info3,
384 &info3);
385 if (!NT_STATUS_IS_OK(status)) {
386 TALLOC_FREE(info6);
387 return status;
388 }
389
390 status = merge_resource_sids(logon_info, info3);
391 if (!NT_STATUS_IS_OK(status)) {
392 TALLOC_FREE(info6);
393 return status;
394 }
395
396 info6->base = info3->base;
397 info6->sids = info3->sids;
398 info6->sidcount = info3->sidcount;
399
400 if (upn_dns_info != NULL) {
401 info6->dns_domainname.string = talloc_strdup(info6,
402 upn_dns_info->dns_domain_name);
403 if (info6->dns_domainname.string == NULL) {
404 TALLOC_FREE(info6);
405 return NT_STATUS_NO_MEMORY;
406 }
407 info6->principal_name.string = talloc_strdup(info6,
408 upn_dns_info->upn_name);
409 if (info6->principal_name.string == NULL) {
410 TALLOC_FREE(info6);
411 return NT_STATUS_NO_MEMORY;
412 }
413 }
414
415 *pp_info6 = info6;
416 return NT_STATUS_OK;
417 }
418
419 /*
420 * Check if this is a "Unix Users" domain user, or a
421 * "Unix Groups" domain group, we need to handle it
422 * in a special way if that's the case.
423 */
424
425 static NTSTATUS SamInfo3_handle_sids(const char *username,
426 const struct dom_sid *user_sid,
427 const struct dom_sid *group_sid,
428 struct netr_SamInfo3 *info3,
429 struct dom_sid *domain_sid,
430 struct extra_auth_info *extra)
431 {
432 struct dom_sid_buf buf;
433
434 if (sid_check_is_in_unix_users(user_sid)) {
435 /* in info3 you can only set rids for the user and the
436 * primary group, and the domain sid must be that of
437 * the sam domain.
438 *
439 * Store a completely bogus value here.
440 * The real SID is stored in the extra sids.
441 * Other code will know to look there if (-1) is found
442 */
443 info3->base.rid = (uint32_t)(-1);
444 sid_copy(&extra->user_sid, user_sid);
445
446 DEBUG(10, ("Unix User found. Rid marked as "
447 "special and sid (%s) saved as extra sid\n",
448 dom_sid_str_buf(user_sid, &buf)));
449 } else {
450 sid_copy(domain_sid, user_sid);
451 sid_split_rid(domain_sid, &info3->base.rid);
452 }
453
454 if (is_null_sid(domain_sid)) {
455 sid_copy(domain_sid, get_global_sam_sid());
456 }
457
458 /* check if this is a "Unix Groups" domain group,
459 * if so we need special handling */
460 if (sid_check_is_in_unix_groups(group_sid)) {
461 /* in info3 you can only set rids for the user and the
462 * primary group, and the domain sid must be that of
463 * the sam domain.
464 *
465 * Store a completely bogus value here.
466 * The real SID is stored in the extra sids.
467 * Other code will know to look there if (-1) is found
468 */
469 info3->base.primary_gid = (uint32_t)(-1);
470 sid_copy(&extra->pgid_sid, group_sid);
471
472 DEBUG(10, ("Unix Group found. Rid marked as "
473 "special and sid (%s) saved as extra sid\n",
474 dom_sid_str_buf(group_sid, &buf)));
475 } else {
476 bool ok = sid_peek_check_rid(domain_sid, group_sid,
477 &info3->base.primary_gid);
478 if (!ok) {
479 struct dom_sid_buf buf2, buf3;
480 DEBUG(1, ("The primary group domain sid(%s) does not "
481 "match the domain sid(%s) for %s(%s)\n",
482 dom_sid_str_buf(group_sid, &buf),
483 dom_sid_str_buf(domain_sid, &buf2),
484 username,
485 dom_sid_str_buf(user_sid, &buf3)));
486 return NT_STATUS_INVALID_SID;
487 }
488 }
489 return NT_STATUS_OK;
490 }
491
492 #define RET_NOMEM(ptr) do { \
493 if (!ptr) { \
494 TALLOC_FREE(info3); \
495 return NT_STATUS_NO_MEMORY; \
496 } } while(0)
497
498 NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
499 struct samu *samu,
500 const char *login_server,
501 struct netr_SamInfo3 **_info3,
502 struct extra_auth_info *extra)
503 {
504 struct netr_SamInfo3 *info3;
505 const struct dom_sid *user_sid;
506 const struct dom_sid *group_sid;
507 struct dom_sid domain_sid = {0};
508 struct dom_sid *group_sids;
509 uint32_t num_group_sids = 0;
510 const char *tmp;
511 gid_t *gids;
512 NTSTATUS status;
513
514 user_sid = pdb_get_user_sid(samu);
515 group_sid = pdb_get_group_sid(samu);
516
517 if (!user_sid || !group_sid) {
518 DEBUG(1, ("Sam account is missing sids!\n"));
519 return NT_STATUS_UNSUCCESSFUL;
520 }
521
522 info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
523 if (!info3) {
524 return NT_STATUS_NO_MEMORY;
525 }
526
527 status = SamInfo3_handle_sids(pdb_get_username(samu),
528 user_sid,
529 group_sid,
530 info3,
531 &domain_sid,
532 extra);
533
534 if (!NT_STATUS_IS_OK(status)) {
535 TALLOC_FREE(info3);
536 return status;
537 }
538
539 unix_to_nt_time(&info3->base.logon_time, pdb_get_logon_time(samu));
540 unix_to_nt_time(&info3->base.logoff_time, get_time_t_max());
541 unix_to_nt_time(&info3->base.kickoff_time, get_time_t_max());
542 unix_to_nt_time(&info3->base.last_password_change,
543 pdb_get_pass_last_set_time(samu));
544 unix_to_nt_time(&info3->base.allow_password_change,
545 pdb_get_pass_can_change_time(samu));
546 unix_to_nt_time(&info3->base.force_password_change,
547 pdb_get_pass_must_change_time(samu));
548
549 tmp = pdb_get_username(samu);
550 if (tmp) {
551 info3->base.account_name.string = talloc_strdup(info3, tmp);
552 RET_NOMEM(info3->base.account_name.string);
553 }
554 tmp = pdb_get_fullname(samu);
555 if (tmp) {
556 info3->base.full_name.string = talloc_strdup(info3, tmp);
557 RET_NOMEM(info3->base.full_name.string);
558 }
559 tmp = pdb_get_logon_script(samu);
560 if (tmp) {
561 info3->base.logon_script.string = talloc_strdup(info3, tmp);
562 RET_NOMEM(info3->base.logon_script.string);
563 }
564 tmp = pdb_get_profile_path(samu);
565 if (tmp) {
566 info3->base.profile_path.string = talloc_strdup(info3, tmp);
567 RET_NOMEM(info3->base.profile_path.string);
568 }
569 tmp = pdb_get_homedir(samu);
570 if (tmp) {
571 info3->base.home_directory.string = talloc_strdup(info3, tmp);
572 RET_NOMEM(info3->base.home_directory.string);
573 }
574 tmp = pdb_get_dir_drive(samu);
575 if (tmp) {
576 info3->base.home_drive.string = talloc_strdup(info3, tmp);
577 RET_NOMEM(info3->base.home_drive.string);
578 }
579
580 info3->base.logon_count = pdb_get_logon_count(samu);
581 info3->base.bad_password_count = pdb_get_bad_password_count(samu);
582
583 info3->base.logon_domain.string = talloc_strdup(info3,
584 pdb_get_domain(samu));
585 RET_NOMEM(info3->base.logon_domain.string);
586
587 info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
588 RET_NOMEM(info3->base.domain_sid);
589
590 status = pdb_enum_group_memberships(mem_ctx, samu,
591 &group_sids, &gids,
592 &num_group_sids);
593 if (!NT_STATUS_IS_OK(status)) {
594 DEBUG(1, ("Failed to get groups from sam account.\n"));
595 TALLOC_FREE(info3);
596 return status;
597 }
598
599 if (num_group_sids) {
600 status = group_sids_to_info3(info3, group_sids, num_group_sids);
601 if (!NT_STATUS_IS_OK(status)) {
602 TALLOC_FREE(info3);
603 return status;
604 }
605 }
606
607 /* We don't need sids and gids after the conversion */
608 TALLOC_FREE(group_sids);
609 TALLOC_FREE(gids);
610 num_group_sids = 0;
611
612 /* FIXME: should we add other flags ? */
613 info3->base.user_flags = NETLOGON_EXTRA_SIDS;
614
615 if (login_server) {
616 info3->base.logon_server.string = talloc_strdup(info3, login_server);
617 RET_NOMEM(info3->base.logon_server.string);
618 }
619
620 info3->base.acct_flags = pdb_get_acct_ctrl(samu);
621
622 *_info3 = info3;
623 return NT_STATUS_OK;
624 }
625
626 NTSTATUS passwd_to_SamInfo3(TALLOC_CTX *mem_ctx,
627 const char *unix_username,
628 const struct passwd *pwd,
629 struct netr_SamInfo3 **pinfo3,
630 struct extra_auth_info *extra)
631 {
632 struct netr_SamInfo3 *info3;
633 NTSTATUS status;
634 TALLOC_CTX *tmp_ctx;
635 const char *domain_name = NULL;
636 const char *user_name = NULL;
637 struct dom_sid domain_sid;
638 struct dom_sid user_sid;
639 struct dom_sid group_sid;
640 enum lsa_SidType type;
641 uint32_t num_sids = 0;
642 struct dom_sid *user_sids = NULL;
643 bool is_null;
644 bool ok;
645
646 tmp_ctx = talloc_stackframe();
647
648 ok = lookup_name_smbconf(tmp_ctx,
649 unix_username,
650 LOOKUP_NAME_ALL,
651 &domain_name,
652 &user_name,
653 &user_sid,
654 &type);
655 if (!ok) {
656 status = NT_STATUS_NO_SUCH_USER;
657 goto done;
658 }
659
660 if (type != SID_NAME_USER) {
661 status = NT_STATUS_NO_SUCH_USER;
662 goto done;
663 }
664
665 ok = winbind_lookup_usersids(tmp_ctx,
666 &user_sid,
667 &num_sids,
668 &user_sids);
669 /* Check if winbind is running */
670 if (ok) {
671 /*
672 * Winbind is running and the first element of the user_sids
673 * is the primary group.
674 */
675 if (num_sids > 0) {
676 group_sid = user_sids[0];
677 }
678 } else {
679 /*
680 * Winbind is not running, try to create the group_sid from the
681 * passwd group id.
682 */
683
684 /*
685 * This can lead to a primary group of S-1-22-2-XX which
686 * will be rejected by other Samba code.
687 */
688 gid_to_sid(&group_sid, pwd->pw_gid);
689 }
690
691 /*
692 * If we are a unix group, or a wellknown/builtin alias,
693 * set the group_sid to the
694 * 'Domain Users' RID of 513 which will always resolve to a
695 * name.
696 */
697 if (sid_check_is_in_unix_groups(&group_sid) ||
698 sid_check_is_in_builtin(&group_sid) ||
699 sid_check_is_in_wellknown_domain(&group_sid)) {
700 if (sid_check_is_in_unix_users(&user_sid)) {
701 sid_compose(&group_sid,
702 get_global_sam_sid(),
703 DOMAIN_RID_USERS);
704 } else {
705 sid_copy(&domain_sid, &user_sid);
706 sid_split_rid(&domain_sid, NULL);
707 sid_compose(&group_sid,
708 &domain_sid,
709 DOMAIN_RID_USERS);
710 }
711 }
712
713 /* Make sure we have a valid group sid */
714 is_null = is_null_sid(&group_sid);
715 if (is_null) {
716 status = NT_STATUS_NO_SUCH_USER;
717 goto done;
718 }
719
720 /* Construct a netr_SamInfo3 from the information we have */
721 info3 = talloc_zero(tmp_ctx, struct netr_SamInfo3);
722 if (!info3) {
723 status = NT_STATUS_NO_MEMORY;
724 goto done;
725 }
726
727 info3->base.account_name.string = talloc_strdup(info3, unix_username);
728 if (info3->base.account_name.string == NULL) {
729 status = NT_STATUS_NO_MEMORY;
730 goto done;
731 }
732
733 info3->base.logon_domain.string = talloc_strdup(info3, domain_name);
734 if (info3->base.logon_domain.string == NULL) {
735 status = NT_STATUS_NO_MEMORY;
736 goto done;
737 }
738
739 ZERO_STRUCT(domain_sid);
740
741 status = SamInfo3_handle_sids(unix_username,
742 &user_sid,
743 &group_sid,
744 info3,
745 &domain_sid,
746 extra);
747
748 if (!NT_STATUS_IS_OK(status)) {
749 goto done;
750 }
751
752 info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
753 if (info3->base.domain_sid == NULL) {
754 status = NT_STATUS_NO_MEMORY;
755 goto done;
756 }
757
758 ok = sid_peek_check_rid(&domain_sid, &group_sid,
759 &info3->base.primary_gid);
760 if (!ok) {
761 struct dom_sid_buf buf1, buf2, buf3;
762
763 DEBUG(1, ("The primary group domain sid(%s) does not "
764 "match the domain sid(%s) for %s(%s)\n",
765 dom_sid_str_buf(&group_sid, &buf1),
766 dom_sid_str_buf(&domain_sid, &buf2),
767 unix_username,
768 dom_sid_str_buf(&user_sid, &buf3)));
769 status = NT_STATUS_INVALID_SID;
770 goto done;
771 }
772
773 info3->base.acct_flags = ACB_NORMAL;
774
775 if (num_sids) {
776 status = group_sids_to_info3(info3, user_sids, num_sids);
777 if (!NT_STATUS_IS_OK(status)) {
778 goto done;
779 }
780 }
781
782 *pinfo3 = talloc_move(mem_ctx, &info3);
783
784 status = NT_STATUS_OK;
785 done:
786 talloc_free(tmp_ctx);
787
788 return status;
789 }
Samba GIT mirror