?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:smbd: only set user_info->auth_description on success
[Samba.git] / source3 / libnet / libnet_samsync_passdb.c
blob9ba637e744cb7d5d1179fd3ef6a29a30661e2556
1 /*
2 Unix SMB/CIFS implementation.
3 dump the remote SAM using rpc samsync operations
4
5 Copyright (C) Andrew Tridgell 2002
6 Copyright (C) Tim Potter 2001,2002
7 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2005
8 Modified by Volker Lendecke 2002
9 Copyright (C) Jeremy Allison 2005.
10 Copyright (C) Guenther Deschner 2008.
11
12 This program is free software; you can redistribute it and/or modify
13 it under the terms of the GNU General Public License as published by
14 the Free Software Foundation; either version 3 of the License, or
15 (at your option) any later version.
16
17 This program is distributed in the hope that it will be useful,
18 but WITHOUT ANY WARRANTY; without even the implied warranty of
19 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
20 GNU General Public License for more details.
21
22 You should have received a copy of the GNU General Public License
23 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 */
25
26 #include "includes.h"
27 #include "system/passwd.h"
28 #include "libnet/libnet_samsync.h"
29 #include "../libcli/security/security.h"
30 #include "passdb.h"
31 #include "lib/util/base64.h"
32
33 /* Convert a struct samu_DELTA to a struct samu. */
34 #define STRING_CHANGED (old_string && !new_string) ||\
35 (!old_string && new_string) ||\
36 (old_string && new_string && (strcmp(old_string, new_string) != 0))
37
38 #define STRING_CHANGED_NC(s1,s2) ((s1) && !(s2)) ||\
39 (!(s1) && (s2)) ||\
40 ((s1) && (s2) && (strcmp((s1), (s2)) != 0))
41
42 /****************************************************************
43 ****************************************************************/
44
45 static NTSTATUS sam_account_from_delta(struct samu *account,
46 struct netr_DELTA_USER *r)
47 {
48 const char *old_string, *new_string;
49 time_t unix_time, stored_time;
50
51 /* Username, fullname, home dir, dir drive, logon script, acct
52 desc, workstations, profile. */
53
54 if (r->account_name.string) {
55 old_string = pdb_get_nt_username(account);
56 new_string = r->account_name.string;
57
58 if (STRING_CHANGED) {
59 pdb_set_nt_username(account, new_string, PDB_CHANGED);
60 }
61
62 /* Unix username is the same - for sanity */
63 old_string = pdb_get_username( account );
64 if (STRING_CHANGED) {
65 pdb_set_username(account, new_string, PDB_CHANGED);
66 }
67 }
68
69 if (r->full_name.string) {
70 old_string = pdb_get_fullname(account);
71 new_string = r->full_name.string;
72
73 if (STRING_CHANGED)
74 pdb_set_fullname(account, new_string, PDB_CHANGED);
75 }
76
77 if (r->home_directory.string) {
78 old_string = pdb_get_homedir(account);
79 new_string = r->home_directory.string;
80
81 if (STRING_CHANGED)
82 pdb_set_homedir(account, new_string, PDB_CHANGED);
83 }
84
85 if (r->home_drive.string) {
86 old_string = pdb_get_dir_drive(account);
87 new_string = r->home_drive.string;
88
89 if (STRING_CHANGED)
90 pdb_set_dir_drive(account, new_string, PDB_CHANGED);
91 }
92
93 if (r->logon_script.string) {
94 old_string = pdb_get_logon_script(account);
95 new_string = r->logon_script.string;
96
97 if (STRING_CHANGED)
98 pdb_set_logon_script(account, new_string, PDB_CHANGED);
99 }
100
101 if (r->description.string) {
102 old_string = pdb_get_acct_desc(account);
103 new_string = r->description.string;
104
105 if (STRING_CHANGED)
106 pdb_set_acct_desc(account, new_string, PDB_CHANGED);
107 }
108
109 if (r->workstations.string) {
110 old_string = pdb_get_workstations(account);
111 new_string = r->workstations.string;
112
113 if (STRING_CHANGED)
114 pdb_set_workstations(account, new_string, PDB_CHANGED);
115 }
116
117 if (r->profile_path.string) {
118 old_string = pdb_get_profile_path(account);
119 new_string = r->profile_path.string;
120
121 if (STRING_CHANGED)
122 pdb_set_profile_path(account, new_string, PDB_CHANGED);
123 }
124
125 if (r->parameters.array) {
126 DATA_BLOB mung;
127 char *newstr = NULL;
128 old_string = pdb_get_munged_dial(account);
129 mung.length = r->parameters.length * 2;
130 mung.data = (uint8_t *) r->parameters.array;
131
132 if (mung.length != 0) {
133 newstr = base64_encode_data_blob(talloc_tos(), mung);
134 SMB_ASSERT(newstr != NULL);
135 }
136
137 if (STRING_CHANGED_NC(old_string, newstr))
138 pdb_set_munged_dial(account, newstr, PDB_CHANGED);
139 TALLOC_FREE(newstr);
140 }
141
142 /* User and group sid */
143 if (pdb_get_user_rid(account) != r->rid)
144 pdb_set_user_sid_from_rid(account, r->rid, PDB_CHANGED);
145 if (pdb_get_group_rid(account) != r->primary_gid)
146 pdb_set_group_sid_from_rid(account, r->primary_gid, PDB_CHANGED);
147
148 /* Logon and password information */
149 if (!nt_time_is_zero(&r->last_logon)) {
150 unix_time = nt_time_to_unix(r->last_logon);
151 stored_time = pdb_get_logon_time(account);
152 if (stored_time != unix_time)
153 pdb_set_logon_time(account, unix_time, PDB_CHANGED);
154 }
155
156 if (!nt_time_is_zero(&r->last_logoff)) {
157 unix_time = nt_time_to_unix(r->last_logoff);
158 stored_time = pdb_get_logoff_time(account);
159 if (stored_time != unix_time)
160 pdb_set_logoff_time(account, unix_time,PDB_CHANGED);
161 }
162
163 /* Logon Divs */
164 if (pdb_get_logon_divs(account) != r->logon_hours.units_per_week)
165 pdb_set_logon_divs(account, r->logon_hours.units_per_week, PDB_CHANGED);
166
167 #if 0
168 /* no idea what to do with this one - gd */
169 /* Max Logon Hours */
170 if (delta->unknown1 != pdb_get_unknown_6(account)) {
171 pdb_set_unknown_6(account, delta->unknown1, PDB_CHANGED);
172 }
173 #endif
174 /* Logon Hours Len */
175 if (r->logon_hours.units_per_week/8 != pdb_get_hours_len(account)) {
176 pdb_set_hours_len(account, r->logon_hours.units_per_week/8, PDB_CHANGED);
177 }
178
179 /* Logon Hours */
180 if (r->logon_hours.bits) {
181 char oldstr[44], newstr[44];
182 pdb_sethexhours(oldstr, pdb_get_hours(account));
183 pdb_sethexhours(newstr, r->logon_hours.bits);
184 if (!strequal(oldstr, newstr))
185 pdb_set_hours(account, r->logon_hours.bits,
186 pdb_get_hours_len(account), PDB_CHANGED);
187 }
188
189 if (pdb_get_bad_password_count(account) != r->bad_password_count)
190 pdb_set_bad_password_count(account, r->bad_password_count, PDB_CHANGED);
191
192 if (pdb_get_logon_count(account) != r->logon_count)
193 pdb_set_logon_count(account, r->logon_count, PDB_CHANGED);
194
195 if (!nt_time_is_zero(&r->last_password_change)) {
196 unix_time = nt_time_to_unix(r->last_password_change);
197 stored_time = pdb_get_pass_last_set_time(account);
198 if (stored_time != unix_time)
199 pdb_set_pass_last_set_time(account, unix_time, PDB_CHANGED);
200 } else {
201 /* no last set time, make it now */
202 pdb_set_pass_last_set_time(account, time(NULL), PDB_CHANGED);
203 }
204
205 if (!nt_time_is_zero(&r->acct_expiry)) {
206 unix_time = nt_time_to_unix(r->acct_expiry);
207 stored_time = pdb_get_kickoff_time(account);
208 if (stored_time != unix_time)
209 pdb_set_kickoff_time(account, unix_time, PDB_CHANGED);
210 }
211
212 /* Decode hashes from password hash
213 Note that win2000 may send us all zeros for the hashes if it doesn't
214 think this channel is secure enough - don't set the passwords at all
215 in that case
216 */
217 if (!all_zero(r->lmpassword.hash, 16)) {
218 pdb_set_lanman_passwd(account, r->lmpassword.hash, PDB_CHANGED);
219 }
220
221 if (!all_zero(r->ntpassword.hash, 16)) {
222 pdb_set_nt_passwd(account, r->ntpassword.hash, PDB_CHANGED);
223 }
224
225 /* TODO: account expiry time */
226
227 pdb_set_acct_ctrl(account, r->acct_flags, PDB_CHANGED);
228
229 pdb_set_domain(account, lp_workgroup(), PDB_CHANGED);
230
231 return NT_STATUS_OK;
232 }
233
234
235 /****************************************************************
236 ****************************************************************/
237
238 static NTSTATUS smb_create_user(TALLOC_CTX *mem_ctx,
239 uint32_t acct_flags,
240 const char *account,
241 struct passwd **passwd_p)
242 {
243 struct passwd *passwd;
244 char *add_script = NULL;
245
246 passwd = Get_Pwnam_alloc(mem_ctx, account);
247 if (passwd) {
248 *passwd_p = passwd;
249 return NT_STATUS_OK;
250 }
251
252 /* Create appropriate user */
253 if (acct_flags & ACB_NORMAL) {
254 add_script = lp_add_user_script(mem_ctx);
255 } else if ( (acct_flags & ACB_WSTRUST) ||
256 (acct_flags & ACB_SVRTRUST) ||
257 (acct_flags & ACB_DOMTRUST) ) {
258 add_script = lp_add_machine_script(mem_ctx);
259 } else {
260 DEBUG(1, ("Unknown user type: %s\n",
261 pdb_encode_acct_ctrl(acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
262 return NT_STATUS_UNSUCCESSFUL;
263 }
264
265 if (!add_script) {
266 return NT_STATUS_NO_MEMORY;
267 }
268
269 if (*add_script) {
270 int add_ret;
271 add_script = talloc_all_string_sub(mem_ctx, add_script,
272 "%u", account);
273 if (!add_script) {
274 return NT_STATUS_NO_MEMORY;
275 }
276 add_ret = smbrun(add_script, NULL, NULL);
277 DEBUG(add_ret ? 0 : 1,("fetch_account: Running the command `%s' "
278 "gave %d\n", add_script, add_ret));
279 if (add_ret == 0) {
280 smb_nscd_flush_user_cache();
281 }
282 }
283
284 /* try and find the possible unix account again */
285 passwd = Get_Pwnam_alloc(mem_ctx, account);
286 if (!passwd) {
287 return NT_STATUS_NO_SUCH_USER;
288 }
289
290 *passwd_p = passwd;
291
292 return NT_STATUS_OK;
293 }
294 /****************************************************************
295 ****************************************************************/
296
297 static NTSTATUS fetch_account_info(TALLOC_CTX *mem_ctx,
298 uint32_t rid,
299 struct netr_DELTA_USER *r)
300 {
301
302 NTSTATUS nt_ret = NT_STATUS_UNSUCCESSFUL;
303 fstring account;
304 struct samu *sam_account=NULL;
305 GROUP_MAP *map = NULL;
306 struct group *grp;
307 struct dom_sid user_sid;
308 struct dom_sid group_sid;
309 struct passwd *passwd = NULL;
310 fstring sid_string;
311
312 fstrcpy(account, r->account_name.string);
313 d_printf("Creating account: %s\n", account);
314
315 if ( !(sam_account = samu_new(mem_ctx)) ) {
316 return NT_STATUS_NO_MEMORY;
317 }
318
319 nt_ret = smb_create_user(sam_account, r->acct_flags, account, &passwd);
320 if (!NT_STATUS_IS_OK(nt_ret)) {
321 d_fprintf(stderr, "Could not create posix account info for '%s'\n",
322 account);
323 goto done;
324 }
325
326 sid_compose(&user_sid, get_global_sam_sid(), r->rid);
327
328 DEBUG(3, ("Attempting to find SID %s for user %s in the passdb\n",
329 sid_to_fstring(sid_string, &user_sid), account));
330 if (!pdb_getsampwsid(sam_account, &user_sid)) {
331 sam_account_from_delta(sam_account, r);
332 DEBUG(3, ("Attempting to add user SID %s for user %s in the passdb\n",
333 sid_to_fstring(sid_string, &user_sid),
334 pdb_get_username(sam_account)));
335 if (!NT_STATUS_IS_OK(pdb_add_sam_account(sam_account))) {
336 DEBUG(1, ("SAM Account for %s failed to be added to the passdb!\n",
337 account));
338 return NT_STATUS_ACCESS_DENIED;
339 }
340 } else {
341 sam_account_from_delta(sam_account, r);
342 DEBUG(3, ("Attempting to update user SID %s for user %s in the passdb\n",
343 sid_to_fstring(sid_string, &user_sid),
344 pdb_get_username(sam_account)));
345 if (!NT_STATUS_IS_OK(pdb_update_sam_account(sam_account))) {
346 DEBUG(1, ("SAM Account for %s failed to be updated in the passdb!\n",
347 account));
348 TALLOC_FREE(sam_account);
349 return NT_STATUS_ACCESS_DENIED;
350 }
351 }
352
353 if (pdb_get_group_sid(sam_account) == NULL) {
354 return NT_STATUS_UNSUCCESSFUL;
355 }
356
357 group_sid = *pdb_get_group_sid(sam_account);
358
359 map = talloc_zero(mem_ctx, GROUP_MAP);
360 if (!map) {
361 return NT_STATUS_NO_MEMORY;
362 }
363
364 if (!pdb_getgrsid(map, group_sid)) {
365 DEBUG(0, ("Primary group of %s has no mapping!\n",
366 pdb_get_username(sam_account)));
367 } else {
368 if (map->gid != passwd->pw_gid) {
369 if (!(grp = getgrgid(map->gid))) {
370 DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n",
371 (unsigned long)map->gid, pdb_get_username(sam_account), sid_string_tos(&group_sid)));
372 } else {
373 smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account));
374 }
375 }
376 }
377
378 if ( !passwd ) {
379 DEBUG(1, ("No unix user for this account (%s), cannot adjust mappings\n",
380 pdb_get_username(sam_account)));
381 }
382
383 done:
384 TALLOC_FREE(sam_account);
385 TALLOC_FREE(map);
386 return nt_ret;
387 }
388
389 /****************************************************************
390 ****************************************************************/
391
392 static NTSTATUS fetch_group_info(TALLOC_CTX *mem_ctx,
393 uint32_t rid,
394 struct netr_DELTA_GROUP *r)
395 {
396 struct group *grp = NULL;
397 struct dom_sid group_sid;
398 fstring sid_string;
399 GROUP_MAP *map;
400 bool insert = true;
401
402 map = talloc_zero(mem_ctx, GROUP_MAP);
403 if (!map) {
404 return NT_STATUS_NO_MEMORY;
405 }
406 /* add the group to the mapping table */
407 sid_compose(&group_sid, get_global_sam_sid(), rid);
408 sid_to_fstring(sid_string, &group_sid);
409
410 if (pdb_getgrsid(map, group_sid)) {
411 if (map->gid != -1) {
412 grp = getgrgid(map->gid);
413 }
414 insert = false;
415 }
416
417 map->nt_name = talloc_strdup(map, r->group_name.string);
418 if (!map->nt_name) {
419 return NT_STATUS_NO_MEMORY;
420 }
421 map->comment = talloc_strdup(map, r->description.string);
422 if (!map->comment) {
423 return NT_STATUS_NO_MEMORY;
424 }
425
426 if (grp == NULL) {
427 gid_t gid;
428
429 /* No group found from mapping, find it from its name. */
430 if ((grp = getgrnam(map->nt_name)) == NULL) {
431
432 /* No appropriate group found, create one */
433
434 d_printf("Creating unix group: '%s'\n", map->nt_name);
435
436 if (smb_create_group(map->nt_name, &gid) != 0)
437 return NT_STATUS_ACCESS_DENIED;
438
439 if ((grp = getgrnam(map->nt_name)) == NULL)
440 return NT_STATUS_ACCESS_DENIED;
441 }
442 }
443
444 map->gid = grp->gr_gid;
445 map->sid = group_sid;
446 map->sid_name_use = SID_NAME_DOM_GRP;
447
448 if (insert) {
449 pdb_add_group_mapping_entry(map);
450 } else {
451 pdb_update_group_mapping_entry(map);
452 }
453
454 TALLOC_FREE(map);
455 return NT_STATUS_OK;
456 }
457
458 /****************************************************************
459 ****************************************************************/
460
461 static NTSTATUS fetch_group_mem_info(TALLOC_CTX *mem_ctx,
462 uint32_t rid,
463 struct netr_DELTA_GROUP_MEMBER *r)
464 {
465 int i;
466 char **nt_members = NULL;
467 char **unix_members;
468 struct dom_sid group_sid;
469 GROUP_MAP *map;
470 struct group *grp;
471
472 if (r->num_rids == 0) {
473 return NT_STATUS_OK;
474 }
475
476 sid_compose(&group_sid, get_global_sam_sid(), rid);
477
478 map = talloc_zero(mem_ctx, GROUP_MAP);
479 if (!map) {
480 return NT_STATUS_NO_MEMORY;
481 }
482
483 if (!get_domain_group_from_sid(group_sid, map)) {
484 DEBUG(0, ("Could not find global group %d\n", rid));
485 TALLOC_FREE(map);
486 return NT_STATUS_NO_SUCH_GROUP;
487 }
488
489 if (!(grp = getgrgid(map->gid))) {
490 DEBUG(0, ("Could not find unix group %lu\n",
491 (unsigned long)map->gid));
492 TALLOC_FREE(map);
493 return NT_STATUS_NO_SUCH_GROUP;
494 }
495
496 TALLOC_FREE(map);
497
498 d_printf("Group members of %s: ", grp->gr_name);
499
500 if (r->num_rids) {
501 if ((nt_members = talloc_zero_array(mem_ctx, char *, r->num_rids)) == NULL) {
502 DEBUG(0, ("talloc failed\n"));
503 return NT_STATUS_NO_MEMORY;
504 }
505 } else {
506 nt_members = NULL;
507 }
508
509 for (i=0; i < r->num_rids; i++) {
510 struct samu *member = NULL;
511 struct dom_sid member_sid;
512
513 if ( !(member = samu_new(mem_ctx)) ) {
514 return NT_STATUS_NO_MEMORY;
515 }
516
517 sid_compose(&member_sid, get_global_sam_sid(), r->rids[i]);
518
519 if (!pdb_getsampwsid(member, &member_sid)) {
520 DEBUG(1, ("Found bogus group member: %d (member_sid=%s group=%s)\n",
521 r->rids[i], sid_string_tos(&member_sid), grp->gr_name));
522 TALLOC_FREE(member);
523 continue;
524 }
525
526 if (pdb_get_group_rid(member) == rid) {
527 d_printf("%s(primary),", pdb_get_username(member));
528 TALLOC_FREE(member);
529 continue;
530 }
531
532 d_printf("%s,", pdb_get_username(member));
533 nt_members[i] = talloc_strdup(mem_ctx, pdb_get_username(member));
534 TALLOC_FREE(member);
535 }
536
537 d_printf("\n");
538
539 unix_members = grp->gr_mem;
540
541 while (*unix_members) {
542 bool is_nt_member = false;
543 for (i=0; i < r->num_rids; i++) {
544 if (nt_members[i] == NULL) {
545 /* This was a primary group */
546 continue;
547 }
548
549 if (strcmp(*unix_members, nt_members[i]) == 0) {
550 is_nt_member = true;
551 break;
552 }
553 }
554 if (!is_nt_member) {
555 /* We look at a unix group member that is not
556 an nt group member. So, remove it. NT is
557 boss here. */
558 smb_delete_user_group(grp->gr_name, *unix_members);
559 }
560 unix_members += 1;
561 }
562
563 for (i=0; i < r->num_rids; i++) {
564 bool is_unix_member = false;
565
566 if (nt_members[i] == NULL) {
567 /* This was the primary group */
568 continue;
569 }
570
571 unix_members = grp->gr_mem;
572
573 while (*unix_members) {
574 if (strcmp(*unix_members, nt_members[i]) == 0) {
575 is_unix_member = true;
576 break;
577 }
578 unix_members += 1;
579 }
580
581 if (!is_unix_member) {
582 /* We look at a nt group member that is not a
583 unix group member currently. So, add the nt
584 group member. */
585 smb_add_user_group(grp->gr_name, nt_members[i]);
586 }
587 }
588
589 return NT_STATUS_OK;
590 }
591
592 /****************************************************************
593 ****************************************************************/
594
595 static NTSTATUS fetch_alias_info(TALLOC_CTX *mem_ctx,
596 uint32_t rid,
597 struct netr_DELTA_ALIAS *r,
598 const struct dom_sid *dom_sid)
599 {
600 struct group *grp = NULL;
601 struct dom_sid alias_sid;
602 fstring sid_string;
603 GROUP_MAP *map;
604 bool insert = true;
605
606 map = talloc_zero(mem_ctx, GROUP_MAP);
607 if (!map) {
608 return NT_STATUS_NO_MEMORY;
609 }
610
611 /* Find out whether the group is already mapped */
612 sid_compose(&alias_sid, dom_sid, rid);
613 sid_to_fstring(sid_string, &alias_sid);
614
615 if (pdb_getgrsid(map, alias_sid)) {
616 grp = getgrgid(map->gid);
617 insert = false;
618 }
619
620 map->nt_name = talloc_strdup(map, r->alias_name.string);
621 if (!map->nt_name) {
622 return NT_STATUS_NO_MEMORY;
623 }
624 map->comment = talloc_strdup(map, r->description.string);
625 if (!map->comment) {
626 return NT_STATUS_NO_MEMORY;
627 }
628
629 if (grp == NULL) {
630 gid_t gid;
631
632 /* No group found from mapping, find it from its name. */
633 if ((grp = getgrnam(map->nt_name)) == NULL) {
634 /* No appropriate group found, create one */
635 d_printf("Creating unix group: '%s'\n", map->nt_name);
636 if (smb_create_group(map->nt_name, &gid) != 0)
637 return NT_STATUS_ACCESS_DENIED;
638 if ((grp = getgrgid(gid)) == NULL)
639 return NT_STATUS_ACCESS_DENIED;
640 }
641 }
642
643 map->gid = grp->gr_gid;
644 map->sid = alias_sid;
645
646 if (dom_sid_equal(dom_sid, &global_sid_Builtin)) {
647 map->sid_name_use = SID_NAME_WKN_GRP;
648 } else {
649 map->sid_name_use = SID_NAME_ALIAS;
650 }
651
652 if (insert) {
653 pdb_add_group_mapping_entry(map);
654 } else {
655 pdb_update_group_mapping_entry(map);
656 }
657
658 TALLOC_FREE(map);
659 return NT_STATUS_OK;
660 }
661
662 /****************************************************************
663 ****************************************************************/
664
665 static NTSTATUS fetch_alias_mem(TALLOC_CTX *mem_ctx,
666 uint32_t rid,
667 struct netr_DELTA_ALIAS_MEMBER *r,
668 const struct dom_sid *dom_sid)
669 {
670 return NT_STATUS_OK;
671 }
672
673 /****************************************************************
674 ****************************************************************/
675
676 static NTSTATUS fetch_domain_info(TALLOC_CTX *mem_ctx,
677 uint32_t rid,
678 struct netr_DELTA_DOMAIN *r)
679 {
680 time_t u_max_age, u_min_age, u_logout;
681 NTSTATUS nt_status = NT_STATUS_UNSUCCESSFUL;
682 const char *domname;
683 struct netr_AcctLockStr *lockstr = NULL;
684 NTSTATUS status;
685
686 status = pull_netr_AcctLockStr(mem_ctx, &r->account_lockout,
687 &lockstr);
688 if (!NT_STATUS_IS_OK(status)) {
689 d_printf("failed to pull account lockout string: %s\n",
690 nt_errstr(status));
691 }
692
693 u_max_age = uint64s_nt_time_to_unix_abs((uint64_t *)&r->max_password_age);
694 u_min_age = uint64s_nt_time_to_unix_abs((uint64_t *)&r->min_password_age);
695 u_logout = uint64s_nt_time_to_unix_abs((uint64_t *)&r->force_logoff_time);
696
697 domname = r->domain_name.string;
698 if (!domname) {
699 return NT_STATUS_NO_MEMORY;
700 }
701
702 /* we don't handle BUILTIN account policies */
703 if (!strequal(domname, get_global_sam_name())) {
704 printf("skipping SAM_DOMAIN_INFO delta for '%s' (is not my domain)\n", domname);
705 return NT_STATUS_OK;
706 }
707
708
709 if (!pdb_set_account_policy(PDB_POLICY_PASSWORD_HISTORY,
710 r->password_history_length))
711 return nt_status;
712
713 if (!pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
714 r->min_password_length))
715 return nt_status;
716
717 if (!pdb_set_account_policy(PDB_POLICY_MAX_PASSWORD_AGE,
718 (uint32_t)u_max_age))
719 return nt_status;
720
721 if (!pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_AGE,
722 (uint32_t)u_min_age))
723 return nt_status;
724
725 if (!pdb_set_account_policy(PDB_POLICY_TIME_TO_LOGOUT,
726 (uint32_t)u_logout))
727 return nt_status;
728
729 if (lockstr) {
730 time_t u_lockoutreset, u_lockouttime;
731
732 u_lockoutreset = uint64s_nt_time_to_unix_abs(&lockstr->reset_count);
733 u_lockouttime = uint64s_nt_time_to_unix_abs((uint64_t *)&lockstr->lockout_duration);
734
735 if (!pdb_set_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT,
736 lockstr->bad_attempt_lockout))
737 return nt_status;
738
739 if (!pdb_set_account_policy(PDB_POLICY_RESET_COUNT_TIME,
740 (uint32_t)u_lockoutreset/60))
741 return nt_status;
742
743 if (u_lockouttime != -1)
744 u_lockouttime /= 60;
745
746 if (!pdb_set_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION,
747 (uint32_t)u_lockouttime))
748 return nt_status;
749 }
750
751 if (!pdb_set_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
752 r->logon_to_chgpass))
753 return nt_status;
754
755 return NT_STATUS_OK;
756 }
757
758 /****************************************************************
759 ****************************************************************/
760
761 static NTSTATUS fetch_sam_entry(TALLOC_CTX *mem_ctx,
762 enum netr_SamDatabaseID database_id,
763 struct netr_DELTA_ENUM *r,
764 struct samsync_context *ctx)
765 {
766 NTSTATUS status = NT_STATUS_NOT_IMPLEMENTED;
767
768 switch (r->delta_type) {
769 case NETR_DELTA_USER:
770 status = fetch_account_info(mem_ctx,
771 r->delta_id_union.rid,
772 r->delta_union.user);
773 break;
774 case NETR_DELTA_GROUP:
775 status = fetch_group_info(mem_ctx,
776 r->delta_id_union.rid,
777 r->delta_union.group);
778 break;
779 case NETR_DELTA_GROUP_MEMBER:
780 status = fetch_group_mem_info(mem_ctx,
781 r->delta_id_union.rid,
782 r->delta_union.group_member);
783 break;
784 case NETR_DELTA_ALIAS:
785 status = fetch_alias_info(mem_ctx,
786 r->delta_id_union.rid,
787 r->delta_union.alias,
788 ctx->domain_sid);
789 break;
790 case NETR_DELTA_ALIAS_MEMBER:
791 status = fetch_alias_mem(mem_ctx,
792 r->delta_id_union.rid,
793 r->delta_union.alias_member,
794 ctx->domain_sid);
795 break;
796 case NETR_DELTA_DOMAIN:
797 status = fetch_domain_info(mem_ctx,
798 r->delta_id_union.rid,
799 r->delta_union.domain);
800 break;
801 /* The following types are recognised but not handled */
802 case NETR_DELTA_RENAME_GROUP:
803 d_printf("NETR_DELTA_RENAME_GROUP not handled\n");
804 break;
805 case NETR_DELTA_RENAME_USER:
806 d_printf("NETR_DELTA_RENAME_USER not handled\n");
807 break;
808 case NETR_DELTA_RENAME_ALIAS:
809 d_printf("NETR_DELTA_RENAME_ALIAS not handled\n");
810 break;
811 case NETR_DELTA_POLICY:
812 d_printf("NETR_DELTA_POLICY not handled\n");
813 break;
814 case NETR_DELTA_TRUSTED_DOMAIN:
815 d_printf("NETR_DELTA_TRUSTED_DOMAIN not handled\n");
816 break;
817 case NETR_DELTA_ACCOUNT:
818 d_printf("NETR_DELTA_ACCOUNT not handled\n");
819 break;
820 case NETR_DELTA_SECRET:
821 d_printf("NETR_DELTA_SECRET not handled\n");
822 break;
823 case NETR_DELTA_DELETE_GROUP:
824 d_printf("NETR_DELTA_DELETE_GROUP not handled\n");
825 break;
826 case NETR_DELTA_DELETE_USER:
827 d_printf("NETR_DELTA_DELETE_USER not handled\n");
828 break;
829 case NETR_DELTA_MODIFY_COUNT:
830 d_printf("NETR_DELTA_MODIFY_COUNT not handled\n");
831 break;
832 case NETR_DELTA_DELETE_ALIAS:
833 d_printf("NETR_DELTA_DELETE_ALIAS not handled\n");
834 break;
835 case NETR_DELTA_DELETE_TRUST:
836 d_printf("NETR_DELTA_DELETE_TRUST not handled\n");
837 break;
838 case NETR_DELTA_DELETE_ACCOUNT:
839 d_printf("NETR_DELTA_DELETE_ACCOUNT not handled\n");
840 break;
841 case NETR_DELTA_DELETE_SECRET:
842 d_printf("NETR_DELTA_DELETE_SECRET not handled\n");
843 break;
844 case NETR_DELTA_DELETE_GROUP2:
845 d_printf("NETR_DELTA_DELETE_GROUP2 not handled\n");
846 break;
847 case NETR_DELTA_DELETE_USER2:
848 d_printf("NETR_DELTA_DELETE_USER2 not handled\n");
849 break;
850 default:
851 d_printf("Unknown delta record type %d\n", r->delta_type);
852 status = NT_STATUS_INVALID_PARAMETER;
853 break;
854 }
855
856 return status;
857 }
858
859 /****************************************************************
860 ****************************************************************/
861
862 static NTSTATUS fetch_sam_entries(TALLOC_CTX *mem_ctx,
863 enum netr_SamDatabaseID database_id,
864 struct netr_DELTA_ENUM_ARRAY *r,
865 uint64_t *sequence_num,
866 struct samsync_context *ctx)
867 {
868 int i;
869
870 for (i = 0; i < r->num_deltas; i++) {
871 fetch_sam_entry(mem_ctx, database_id, &r->delta_enum[i], ctx);
872 }
873
874 return NT_STATUS_OK;
875 }
876
877 /****************************************************************
878 ****************************************************************/
879
880 const struct samsync_ops libnet_samsync_passdb_ops = {
881 .process_objects = fetch_sam_entries,
882 };
Samba GIT mirror