?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:libnet_join.c - only write the really essential SPNs
[Samba.git] / source4 / libnet / libnet_join.c
blob235304423e7889f21c5f5dc9ed85df0fa37bccae
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Brad Henry 2005
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libnet/libnet.h"
24 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
25 #include "lib/ldb/include/ldb.h"
26 #include "lib/ldb/include/ldb_errors.h"
27 #include "param/secrets.h"
28 #include "dsdb/samdb/samdb.h"
29 #include "ldb_wrap.h"
30 #include "libcli/security/security.h"
31 #include "auth/credentials/credentials.h"
32 #include "auth/credentials/credentials_krb5.h"
33 #include "librpc/gen_ndr/ndr_samr_c.h"
34 #include "param/param.h"
35 #include "param/provision.h"
36 #include "system/kerberos.h"
37 #include "auth/kerberos/kerberos.h"
38
39 /*
40 * complete a domain join, when joining to a AD domain:
41 * 1.) connect and bind to the DRSUAPI pipe
42 * 2.) do a DsCrackNames() to find the machine account dn
43 * 3.) connect to LDAP
44 * 4.) do an ldap search to find the "msDS-KeyVersionNumber" of the machine account
45 * 5.) set the servicePrincipalName's of the machine account via LDAP, (maybe we should use DsWriteAccountSpn()...)
46 * 6.) do a DsCrackNames() to find the domain dn
47 * 7.) find out Site specific stuff, look at libnet_JoinSite() for details
48 */
49 static NTSTATUS libnet_JoinADSDomain(struct libnet_context *ctx, struct libnet_JoinDomain *r)
50 {
51 NTSTATUS status;
52
53 TALLOC_CTX *tmp_ctx;
54
55 const char *realm = r->out.realm;
56
57 struct dcerpc_binding *samr_binding = r->out.samr_binding;
58
59 struct dcerpc_pipe *drsuapi_pipe;
60 struct dcerpc_binding *drsuapi_binding;
61 struct drsuapi_DsBind r_drsuapi_bind;
62 struct drsuapi_DsCrackNames r_crack_names;
63 struct drsuapi_DsNameString names[1];
64 struct policy_handle drsuapi_bind_handle;
65 struct GUID drsuapi_bind_guid;
66
67 struct ldb_context *remote_ldb;
68 struct ldb_dn *account_dn;
69 const char *account_dn_str;
70 const char *remote_ldb_url;
71 struct ldb_result *res;
72 struct ldb_message *msg;
73
74 int ret, rtn;
75
76 const char * const attrs[] = {
77 "msDS-KeyVersionNumber",
78 "servicePrincipalName",
79 "dNSHostName",
80 "objectGUID",
81 NULL,
82 };
83
84 r->out.error_string = NULL;
85
86 /* We need to convert between a samAccountName and domain to a
87 * DN in the directory. The correct way to do this is with
88 * DRSUAPI CrackNames */
89
90 /* Fiddle with the bindings, so get to DRSUAPI on
91 * NCACN_IP_TCP, sealed */
92 tmp_ctx = talloc_named(r, 0, "libnet_JoinADSDomain temp context");
93 if (!tmp_ctx) {
94 r->out.error_string = NULL;
95 return NT_STATUS_NO_MEMORY;
96 }
97
98 drsuapi_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
99 if (!drsuapi_binding) {
100 r->out.error_string = NULL;
101 talloc_free(tmp_ctx);
102 return NT_STATUS_NO_MEMORY;
103 }
104
105 *drsuapi_binding = *samr_binding;
106
107 /* DRSUAPI is only available on IP_TCP, and locally on NCALRPC */
108 if (drsuapi_binding->transport != NCALRPC) {
109 drsuapi_binding->transport = NCACN_IP_TCP;
110 }
111 drsuapi_binding->endpoint = NULL;
112 drsuapi_binding->flags |= DCERPC_SEAL;
113
114 status = dcerpc_pipe_connect_b(tmp_ctx,
115 &drsuapi_pipe,
116 drsuapi_binding,
117 &ndr_table_drsuapi,
118 ctx->cred,
119 ctx->event_ctx,
120 ctx->lp_ctx);
121 if (!NT_STATUS_IS_OK(status)) {
122 r->out.error_string = talloc_asprintf(r,
123 "Connection to DRSUAPI pipe of PDC of domain '%s' failed: %s",
124 r->out.domain_name,
125 nt_errstr(status));
126 talloc_free(tmp_ctx);
127 return status;
128 }
129
130 /* get a DRSUAPI pipe handle */
131 GUID_from_string(DRSUAPI_DS_BIND_GUID, &drsuapi_bind_guid);
132
133 r_drsuapi_bind.in.bind_guid = &drsuapi_bind_guid;
134 r_drsuapi_bind.in.bind_info = NULL;
135 r_drsuapi_bind.out.bind_handle = &drsuapi_bind_handle;
136
137 status = dcerpc_drsuapi_DsBind_r(drsuapi_pipe->binding_handle, tmp_ctx, &r_drsuapi_bind);
138 if (!NT_STATUS_IS_OK(status)) {
139 r->out.error_string
140 = talloc_asprintf(r,
141 "dcerpc_drsuapi_DsBind failed - %s",
142 nt_errstr(status));
143 talloc_free(tmp_ctx);
144 return status;
145 } else if (!W_ERROR_IS_OK(r_drsuapi_bind.out.result)) {
146 r->out.error_string
147 = talloc_asprintf(r,
148 "DsBind failed - %s",
149 win_errstr(r_drsuapi_bind.out.result));
150 talloc_free(tmp_ctx);
151 return NT_STATUS_UNSUCCESSFUL;
152 }
153
154 /* Actually 'crack' the names */
155 ZERO_STRUCT(r_crack_names);
156 r_crack_names.in.bind_handle = &drsuapi_bind_handle;
157 r_crack_names.in.level = 1;
158 r_crack_names.in.req = talloc(r, union drsuapi_DsNameRequest);
159 if (!r_crack_names.in.req) {
160 r->out.error_string = NULL;
161 talloc_free(tmp_ctx);
162 return NT_STATUS_NO_MEMORY;
163 }
164 r_crack_names.in.req->req1.codepage = 1252; /* western european */
165 r_crack_names.in.req->req1.language = 0x00000407; /* german */
166 r_crack_names.in.req->req1.count = 1;
167 r_crack_names.in.req->req1.names = names;
168 r_crack_names.in.req->req1.format_flags = DRSUAPI_DS_NAME_FLAG_NO_FLAGS;
169 r_crack_names.in.req->req1.format_offered = DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY;
170 r_crack_names.in.req->req1.format_desired = DRSUAPI_DS_NAME_FORMAT_FQDN_1779;
171 names[0].str = dom_sid_string(tmp_ctx, r->out.account_sid);
172 if (!names[0].str) {
173 r->out.error_string = NULL;
174 talloc_free(tmp_ctx);
175 return NT_STATUS_NO_MEMORY;
176 }
177
178 r_crack_names.out.ctr = talloc(r, union drsuapi_DsNameCtr);
179 r_crack_names.out.level_out = talloc(r, uint32_t);
180 if (!r_crack_names.out.ctr || !r_crack_names.out.level_out) {
181 r->out.error_string = NULL;
182 talloc_free(tmp_ctx);
183 return NT_STATUS_NO_MEMORY;
184 }
185
186 status = dcerpc_drsuapi_DsCrackNames_r(drsuapi_pipe->binding_handle, tmp_ctx, &r_crack_names);
187 if (!NT_STATUS_IS_OK(status)) {
188 r->out.error_string
189 = talloc_asprintf(r,
190 "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
191 names[0].str,
192 nt_errstr(status));
193 talloc_free(tmp_ctx);
194 return status;
195 } else if (!W_ERROR_IS_OK(r_crack_names.out.result)) {
196 r->out.error_string
197 = talloc_asprintf(r,
198 "DsCrackNames failed - %s", win_errstr(r_crack_names.out.result));
199 talloc_free(tmp_ctx);
200 return NT_STATUS_UNSUCCESSFUL;
201 } else if (*r_crack_names.out.level_out != 1
202 || !r_crack_names.out.ctr->ctr1
203 || r_crack_names.out.ctr->ctr1->count != 1) {
204 r->out.error_string = talloc_asprintf(r, "DsCrackNames failed");
205 talloc_free(tmp_ctx);
206 return NT_STATUS_INVALID_PARAMETER;
207 } else if (r_crack_names.out.ctr->ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) {
208 r->out.error_string = talloc_asprintf(r, "DsCrackNames failed: %d", r_crack_names.out.ctr->ctr1->array[0].status);
209 talloc_free(tmp_ctx);
210 return NT_STATUS_UNSUCCESSFUL;
211 } else if (r_crack_names.out.ctr->ctr1->array[0].result_name == NULL) {
212 r->out.error_string = talloc_asprintf(r, "DsCrackNames failed: no result name");
213 talloc_free(tmp_ctx);
214 return NT_STATUS_INVALID_PARAMETER;
215 }
216
217 /* Store the DN of our machine account. */
218 account_dn_str = r_crack_names.out.ctr->ctr1->array[0].result_name;
219
220 /* Now we know the user's DN, open with LDAP, read and modify a few things */
221
222 remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s",
223 drsuapi_binding->target_hostname);
224 if (!remote_ldb_url) {
225 r->out.error_string = NULL;
226 talloc_free(tmp_ctx);
227 return NT_STATUS_NO_MEMORY;
228 }
229
230 remote_ldb = ldb_wrap_connect(tmp_ctx, ctx->event_ctx, ctx->lp_ctx,
231 remote_ldb_url,
232 NULL, ctx->cred, 0);
233 if (!remote_ldb) {
234 r->out.error_string = NULL;
235 talloc_free(tmp_ctx);
236 return NT_STATUS_UNSUCCESSFUL;
237 }
238
239 account_dn = ldb_dn_new(tmp_ctx, remote_ldb, account_dn_str);
240 if (! ldb_dn_validate(account_dn)) {
241 r->out.error_string = talloc_asprintf(r, "Invalid account dn: %s",
242 account_dn_str);
243 talloc_free(tmp_ctx);
244 return NT_STATUS_UNSUCCESSFUL;
245 }
246
247 /* search for the user's record */
248 ret = ldb_search(remote_ldb, tmp_ctx, &res,
249 account_dn, LDB_SCOPE_BASE, attrs, NULL);
250 if (ret != LDB_SUCCESS) {
251 r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - %s",
252 account_dn_str, ldb_errstring(remote_ldb));
253 talloc_free(tmp_ctx);
254 return NT_STATUS_UNSUCCESSFUL;
255 }
256
257 if (res->count != 1) {
258 r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - found %d entries",
259 account_dn_str, res->count);
260 talloc_free(tmp_ctx);
261 return NT_STATUS_UNSUCCESSFUL;
262 }
263
264 /* Prepare a new message, for the modify */
265 msg = ldb_msg_new(tmp_ctx);
266 if (!msg) {
267 r->out.error_string = NULL;
268 talloc_free(tmp_ctx);
269 return NT_STATUS_NO_MEMORY;
270 }
271 msg->dn = res->msgs[0]->dn;
272
273 {
274 unsigned int i;
275 const char *service_principal_name[2];
276 const char *dns_host_name = strlower_talloc(tmp_ctx,
277 talloc_asprintf(tmp_ctx,
278 "%s.%s",
279 r->in.netbios_name,
280 realm));
281
282 if (!dns_host_name) {
283 r->out.error_string = NULL;
284 talloc_free(tmp_ctx);
285 return NT_STATUS_NO_MEMORY;
286 }
287
288 service_principal_name[0] = talloc_asprintf(tmp_ctx, "HOST/%s",
289 dns_host_name);
290 service_principal_name[1] = talloc_asprintf(tmp_ctx, "HOST/%s",
291 r->in.netbios_name);
292
293 for (i=0; i < ARRAY_SIZE(service_principal_name); i++) {
294 if (!service_principal_name[i]) {
295 r->out.error_string = NULL;
296 talloc_free(tmp_ctx);
297 return NT_STATUS_NO_MEMORY;
298 }
299 rtn = samdb_msg_add_string(remote_ldb, tmp_ctx, msg, "servicePrincipalName", service_principal_name[i]);
300 if (rtn != LDB_SUCCESS) {
301 r->out.error_string = NULL;
302 talloc_free(tmp_ctx);
303 return NT_STATUS_NO_MEMORY;
304 }
305 }
306
307 rtn = samdb_msg_add_string(remote_ldb, tmp_ctx, msg,
308 "dNSHostName", dns_host_name);
309 if (rtn != LDB_SUCCESS) {
310 r->out.error_string = NULL;
311 talloc_free(tmp_ctx);
312 return NT_STATUS_NO_MEMORY;
313 }
314
315 rtn = dsdb_replace(remote_ldb, msg, 0);
316 if (rtn != LDB_SUCCESS) {
317 r->out.error_string
318 = talloc_asprintf(r,
319 "Failed to replace entries on %s",
320 ldb_dn_get_linearized(msg->dn));
321 talloc_free(tmp_ctx);
322 return NT_STATUS_INTERNAL_DB_CORRUPTION;
323 }
324 }
325
326 msg = ldb_msg_new(tmp_ctx);
327 if (!msg) {
328 r->out.error_string = NULL;
329 talloc_free(tmp_ctx);
330 return NT_STATUS_NO_MEMORY;
331 }
332 msg->dn = res->msgs[0]->dn;
333
334 rtn = samdb_msg_add_uint(remote_ldb, msg, msg,
335 "msDS-SupportedEncryptionTypes", ENC_ALL_TYPES);
336 if (rtn != LDB_SUCCESS) {
337 r->out.error_string = NULL;
338 talloc_free(tmp_ctx);
339 return NT_STATUS_NO_MEMORY;
340 }
341
342 rtn = dsdb_replace(remote_ldb, msg, 0);
343 /* The remote server may not support this attribute, if it
344 * isn't a modern schema */
345 if (rtn != LDB_SUCCESS && rtn != LDB_ERR_NO_SUCH_ATTRIBUTE) {
346 r->out.error_string
347 = talloc_asprintf(r,
348 "Failed to replace msDS-SupportedEncryptionTypes on %s",
349 ldb_dn_get_linearized(msg->dn));
350 talloc_free(tmp_ctx);
351 return NT_STATUS_INTERNAL_DB_CORRUPTION;
352 }
353
354 /* DsCrackNames to find out the DN of the domain. */
355 r_crack_names.in.req->req1.format_offered = DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT;
356 r_crack_names.in.req->req1.format_desired = DRSUAPI_DS_NAME_FORMAT_FQDN_1779;
357 names[0].str = talloc_asprintf(tmp_ctx, "%s\\", r->out.domain_name);
358 if (!names[0].str) {
359 r->out.error_string = NULL;
360 talloc_free(tmp_ctx);
361 return NT_STATUS_NO_MEMORY;
362 }
363
364 status = dcerpc_drsuapi_DsCrackNames_r(drsuapi_pipe->binding_handle, tmp_ctx, &r_crack_names);
365 if (!NT_STATUS_IS_OK(status)) {
366 r->out.error_string
367 = talloc_asprintf(r,
368 "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
369 r->in.domain_name,
370 nt_errstr(status));
371 talloc_free(tmp_ctx);
372 return status;
373 } else if (!W_ERROR_IS_OK(r_crack_names.out.result)) {
374 r->out.error_string
375 = talloc_asprintf(r,
376 "DsCrackNames failed - %s", win_errstr(r_crack_names.out.result));
377 talloc_free(tmp_ctx);
378 return NT_STATUS_UNSUCCESSFUL;
379 } else if (*r_crack_names.out.level_out != 1
380 || !r_crack_names.out.ctr->ctr1
381 || r_crack_names.out.ctr->ctr1->count != 1
382 || !r_crack_names.out.ctr->ctr1->array[0].result_name
383 || r_crack_names.out.ctr->ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) {
384 r->out.error_string = talloc_asprintf(r, "DsCrackNames failed");
385 talloc_free(tmp_ctx);
386 return NT_STATUS_UNSUCCESSFUL;
387 }
388
389 /* Store the account DN. */
390 r->out.account_dn_str = account_dn_str;
391 talloc_steal(r, account_dn_str);
392
393 /* Store the domain DN. */
394 r->out.domain_dn_str = r_crack_names.out.ctr->ctr1->array[0].result_name;
395 talloc_steal(r, r_crack_names.out.ctr->ctr1->array[0].result_name);
396
397 /* Store the KVNO of the account, critical for some kerberos
398 * operations */
399 r->out.kvno = ldb_msg_find_attr_as_uint(res->msgs[0], "msDS-KeyVersionNumber", 0);
400
401 /* Store the account GUID. */
402 r->out.account_guid = samdb_result_guid(res->msgs[0], "objectGUID");
403
404 if (r->in.acct_type == ACB_SVRTRUST) {
405 status = libnet_JoinSite(ctx, remote_ldb, r);
406 }
407 talloc_free(tmp_ctx);
408
409 return status;
410 }
411
412 /*
413 * do a domain join using DCERPC/SAMR calls
414 * - connect to the LSA pipe, to try and find out information about the domain
415 * - create a secondary connection to SAMR pipe
416 * - do a samr_Connect to get a policy handle
417 * - do a samr_LookupDomain to get the domain sid
418 * - do a samr_OpenDomain to get a domain handle
419 * - do a samr_CreateAccount to try and get a new account
420 *
421 * If that fails, do:
422 * - do a samr_LookupNames to get the users rid
423 * - do a samr_OpenUser to get a user handle
424 * - potentially delete and recreate the user
425 * - assert the account is of the right type with samrQueryUserInfo
426 *
427 * - call libnet_SetPassword_samr_handle to set the password,
428 * and pass a samr_UserInfo21 struct to set full_name and the account flags
429 *
430 * - do some ADS specific things when we join as Domain Controller,
431 * look at libnet_joinADSDomain() for the details
432 */
433 NTSTATUS libnet_JoinDomain(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *r)
434 {
435 TALLOC_CTX *tmp_ctx;
436
437 NTSTATUS status, cu_status;
438
439 struct libnet_RpcConnect *connect_with_info;
440 struct dcerpc_pipe *samr_pipe;
441
442 struct samr_Connect sc;
443 struct policy_handle p_handle;
444 struct samr_OpenDomain od;
445 struct policy_handle d_handle;
446 struct samr_LookupNames ln;
447 struct samr_Ids rids, types;
448 struct samr_OpenUser ou;
449 struct samr_CreateUser2 cu;
450 struct policy_handle *u_handle = NULL;
451 struct samr_QueryUserInfo qui;
452 union samr_UserInfo *uinfo;
453 struct samr_UserInfo21 u_info21;
454 union libnet_SetPassword r2;
455 struct samr_GetUserPwInfo pwp;
456 struct samr_PwInfo info;
457 struct lsa_String samr_account_name;
458
459 uint32_t acct_flags, old_acct_flags;
460 uint32_t rid, access_granted;
461 int policy_min_pw_len = 0;
462
463 struct dom_sid *account_sid = NULL;
464 const char *password_str = NULL;
465
466 r->out.error_string = NULL;
467 r2.samr_handle.out.error_string = NULL;
468
469 tmp_ctx = talloc_named(mem_ctx, 0, "libnet_Join temp context");
470 if (!tmp_ctx) {
471 r->out.error_string = NULL;
472 return NT_STATUS_NO_MEMORY;
473 }
474
475 u_handle = talloc(tmp_ctx, struct policy_handle);
476 if (!u_handle) {
477 r->out.error_string = NULL;
478 talloc_free(tmp_ctx);
479 return NT_STATUS_NO_MEMORY;
480 }
481
482 connect_with_info = talloc_zero(tmp_ctx, struct libnet_RpcConnect);
483 if (!connect_with_info) {
484 r->out.error_string = NULL;
485 talloc_free(tmp_ctx);
486 return NT_STATUS_NO_MEMORY;
487 }
488
489 /* prepare connect to the SAMR pipe of PDC */
490 if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) {
491 connect_with_info->in.binding = NULL;
492 connect_with_info->in.name = r->in.domain_name;
493 } else {
494 connect_with_info->in.binding = r->in.binding;
495 connect_with_info->in.name = NULL;
496 }
497
498 /* This level makes a connection to the LSA pipe on the way,
499 * to get some useful bits of information about the domain */
500 connect_with_info->level = LIBNET_RPC_CONNECT_DC_INFO;
501 connect_with_info->in.dcerpc_iface = &ndr_table_samr;
502
503 /*
504 establish the SAMR connection
505 */
506 status = libnet_RpcConnect(ctx, tmp_ctx, connect_with_info);
507 if (!NT_STATUS_IS_OK(status)) {
508 if (r->in.binding) {
509 r->out.error_string = talloc_asprintf(mem_ctx,
510 "Connection to SAMR pipe of DC %s failed: %s",
511 r->in.binding, connect_with_info->out.error_string);
512 } else {
513 r->out.error_string = talloc_asprintf(mem_ctx,
514 "Connection to SAMR pipe of PDC for %s failed: %s",
515 r->in.domain_name, connect_with_info->out.error_string);
516 }
517 talloc_free(tmp_ctx);
518 return status;
519 }
520
521 samr_pipe = connect_with_info->out.dcerpc_pipe;
522
523 status = dcerpc_pipe_auth(tmp_ctx, &samr_pipe,
524 connect_with_info->out.dcerpc_pipe->binding,
525 &ndr_table_samr, ctx->cred, ctx->lp_ctx);
526 if (!NT_STATUS_IS_OK(status)) {
527 r->out.error_string = talloc_asprintf(mem_ctx,
528 "SAMR bind failed: %s",
529 nt_errstr(status));
530 talloc_free(tmp_ctx);
531 return status;
532 }
533
534 /* prepare samr_Connect */
535 ZERO_STRUCT(p_handle);
536 sc.in.system_name = NULL;
537 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
538 sc.out.connect_handle = &p_handle;
539
540 /* 2. do a samr_Connect to get a policy handle */
541 status = dcerpc_samr_Connect_r(samr_pipe->binding_handle, tmp_ctx, &sc);
542 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(sc.out.result)) {
543 status = sc.out.result;
544 }
545 if (!NT_STATUS_IS_OK(status)) {
546 r->out.error_string = talloc_asprintf(mem_ctx,
547 "samr_Connect failed: %s",
548 nt_errstr(status));
549 talloc_free(tmp_ctx);
550 return status;
551 }
552
553 /* If this is a connection on ncacn_ip_tcp to Win2k3 SP1, we don't get back this useful info */
554 if (!connect_with_info->out.domain_name) {
555 if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) {
556 connect_with_info->out.domain_name = talloc_strdup(tmp_ctx, r->in.domain_name);
557 } else {
558 /* Bugger, we just lost our way to automatically find the domain name */
559 connect_with_info->out.domain_name = talloc_strdup(tmp_ctx, lpcfg_workgroup(ctx->lp_ctx));
560 connect_with_info->out.realm = talloc_strdup(tmp_ctx, lpcfg_realm(ctx->lp_ctx));
561 }
562 }
563
564 /* Perhaps we didn't get a SID above, because we are against ncacn_ip_tcp */
565 if (!connect_with_info->out.domain_sid) {
566 struct lsa_String name;
567 struct samr_LookupDomain l;
568 struct dom_sid2 *sid = NULL;
569 name.string = connect_with_info->out.domain_name;
570 l.in.connect_handle = &p_handle;
571 l.in.domain_name = &name;
572 l.out.sid = &sid;
573
574 status = dcerpc_samr_LookupDomain_r(samr_pipe->binding_handle, tmp_ctx, &l);
575 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(l.out.result)) {
576 status = l.out.result;
577 }
578 if (!NT_STATUS_IS_OK(status)) {
579 r->out.error_string = talloc_asprintf(mem_ctx,
580 "SAMR LookupDomain failed: %s",
581 nt_errstr(status));
582 talloc_free(tmp_ctx);
583 return status;
584 }
585 connect_with_info->out.domain_sid = *l.out.sid;
586 }
587
588 /* prepare samr_OpenDomain */
589 ZERO_STRUCT(d_handle);
590 od.in.connect_handle = &p_handle;
591 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
592 od.in.sid = connect_with_info->out.domain_sid;
593 od.out.domain_handle = &d_handle;
594
595 /* do a samr_OpenDomain to get a domain handle */
596 status = dcerpc_samr_OpenDomain_r(samr_pipe->binding_handle, tmp_ctx, &od);
597 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(od.out.result)) {
598 status = od.out.result;
599 }
600 if (!NT_STATUS_IS_OK(status)) {
601 r->out.error_string = talloc_asprintf(mem_ctx,
602 "samr_OpenDomain for [%s] failed: %s",
603 dom_sid_string(tmp_ctx, connect_with_info->out.domain_sid),
604 nt_errstr(status));
605 talloc_free(tmp_ctx);
606 return status;
607 }
608
609 /* prepare samr_CreateUser2 */
610 ZERO_STRUCTP(u_handle);
611 cu.in.domain_handle = &d_handle;
612 cu.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
613 samr_account_name.string = r->in.account_name;
614 cu.in.account_name = &samr_account_name;
615 cu.in.acct_flags = r->in.acct_type;
616 cu.out.user_handle = u_handle;
617 cu.out.rid = &rid;
618 cu.out.access_granted = &access_granted;
619
620 /* do a samr_CreateUser2 to get an account handle, or an error */
621 cu_status = dcerpc_samr_CreateUser2_r(samr_pipe->binding_handle, tmp_ctx, &cu);
622 if (NT_STATUS_IS_OK(cu_status) && !NT_STATUS_IS_OK(cu.out.result)) {
623 cu_status = cu.out.result;
624 }
625 status = cu_status;
626 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
627 /* prepare samr_LookupNames */
628 ln.in.domain_handle = &d_handle;
629 ln.in.num_names = 1;
630 ln.in.names = talloc_array(tmp_ctx, struct lsa_String, 1);
631 ln.out.rids = &rids;
632 ln.out.types = &types;
633 if (!ln.in.names) {
634 r->out.error_string = NULL;
635 talloc_free(tmp_ctx);
636 return NT_STATUS_NO_MEMORY;
637 }
638 ln.in.names[0].string = r->in.account_name;
639
640 /* 5. do a samr_LookupNames to get the users rid */
641 status = dcerpc_samr_LookupNames_r(samr_pipe->binding_handle, tmp_ctx, &ln);
642 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ln.out.result)) {
643 status = ln.out.result;
644 }
645 if (!NT_STATUS_IS_OK(status)) {
646 r->out.error_string = talloc_asprintf(mem_ctx,
647 "samr_LookupNames for [%s] failed: %s",
648 r->in.account_name,
649 nt_errstr(status));
650 talloc_free(tmp_ctx);
651 return status;
652 }
653
654 /* check if we got one RID for the user */
655 if (ln.out.rids->count != 1) {
656 r->out.error_string = talloc_asprintf(mem_ctx,
657 "samr_LookupNames for [%s] returns %d RIDs",
658 r->in.account_name, ln.out.rids->count);
659 talloc_free(tmp_ctx);
660 return NT_STATUS_INVALID_PARAMETER;
661 }
662
663 /* prepare samr_OpenUser */
664 ZERO_STRUCTP(u_handle);
665 ou.in.domain_handle = &d_handle;
666 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
667 ou.in.rid = ln.out.rids->ids[0];
668 rid = ou.in.rid;
669 ou.out.user_handle = u_handle;
670
671 /* 6. do a samr_OpenUser to get a user handle */
672 status = dcerpc_samr_OpenUser_r(samr_pipe->binding_handle, tmp_ctx, &ou);
673 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(ou.out.result)) {
674 status = ou.out.result;
675 }
676 if (!NT_STATUS_IS_OK(status)) {
677 r->out.error_string = talloc_asprintf(mem_ctx,
678 "samr_OpenUser for [%s] failed: %s",
679 r->in.account_name,
680 nt_errstr(status));
681 talloc_free(tmp_ctx);
682 return status;
683 }
684
685 if (r->in.recreate_account) {
686 struct samr_DeleteUser d;
687 d.in.user_handle = u_handle;
688 d.out.user_handle = u_handle;
689 status = dcerpc_samr_DeleteUser_r(samr_pipe->binding_handle, mem_ctx, &d);
690 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(d.out.result)) {
691 status = d.out.result;
692 }
693 if (!NT_STATUS_IS_OK(status)) {
694 r->out.error_string = talloc_asprintf(mem_ctx,
695 "samr_DeleteUser (for recreate) of [%s] failed: %s",
696 r->in.account_name,
697 nt_errstr(status));
698 talloc_free(tmp_ctx);
699 return status;
700 }
701
702 /* We want to recreate, so delete and another samr_CreateUser2 */
703
704 /* &cu filled in above */
705 status = dcerpc_samr_CreateUser2_r(samr_pipe->binding_handle, tmp_ctx, &cu);
706 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(cu.out.result)) {
707 status = cu.out.result;
708 }
709 if (!NT_STATUS_IS_OK(status)) {
710 r->out.error_string = talloc_asprintf(mem_ctx,
711 "samr_CreateUser2 (recreate) for [%s] failed: %s",
712 r->in.account_name, nt_errstr(status));
713 talloc_free(tmp_ctx);
714 return status;
715 }
716 }
717 } else if (!NT_STATUS_IS_OK(status)) {
718 r->out.error_string = talloc_asprintf(mem_ctx,
719 "samr_CreateUser2 for [%s] failed: %s",
720 r->in.account_name, nt_errstr(status));
721 talloc_free(tmp_ctx);
722 return status;
723 }
724
725 /* prepare samr_QueryUserInfo (get flags) */
726 qui.in.user_handle = u_handle;
727 qui.in.level = 16;
728 qui.out.info = &uinfo;
729
730 status = dcerpc_samr_QueryUserInfo_r(samr_pipe->binding_handle, tmp_ctx, &qui);
731 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(qui.out.result)) {
732 status = qui.out.result;
733 }
734 if (!NT_STATUS_IS_OK(status)) {
735 r->out.error_string = talloc_asprintf(mem_ctx,
736 "samr_QueryUserInfo for [%s] failed: %s",
737 r->in.account_name,
738 nt_errstr(status));
739 talloc_free(tmp_ctx);
740 return status;
741 }
742
743 if (!uinfo) {
744 status = NT_STATUS_INVALID_PARAMETER;
745 r->out.error_string
746 = talloc_asprintf(mem_ctx,
747 "samr_QueryUserInfo failed to return qui.out.info for [%s]: %s",
748 r->in.account_name, nt_errstr(status));
749 talloc_free(tmp_ctx);
750 return status;
751 }
752
753 old_acct_flags = (uinfo->info16.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST | ACB_DOMTRUST));
754 /* Possibly bail if the account is of the wrong type */
755 if (old_acct_flags
756 != r->in.acct_type) {
757 const char *old_account_type, *new_account_type;
758 switch (old_acct_flags) {
759 case ACB_WSTRUST:
760 old_account_type = "domain member (member)";
761 break;
762 case ACB_SVRTRUST:
763 old_account_type = "domain controller (bdc)";
764 break;
765 case ACB_DOMTRUST:
766 old_account_type = "trusted domain";
767 break;
768 default:
769 return NT_STATUS_INVALID_PARAMETER;
770 }
771 switch (r->in.acct_type) {
772 case ACB_WSTRUST:
773 new_account_type = "domain member (member)";
774 break;
775 case ACB_SVRTRUST:
776 new_account_type = "domain controller (bdc)";
777 break;
778 case ACB_DOMTRUST:
779 new_account_type = "trusted domain";
780 break;
781 default:
782 return NT_STATUS_INVALID_PARAMETER;
783 }
784
785 if (!NT_STATUS_EQUAL(cu_status, NT_STATUS_USER_EXISTS)) {
786 /* We created a new user, but they didn't come out the right type?!? */
787 r->out.error_string
788 = talloc_asprintf(mem_ctx,
789 "We asked to create a new machine account (%s) of type %s, "
790 "but we got an account of type %s. This is unexpected. "
791 "Perhaps delete the account and try again.",
792 r->in.account_name, new_account_type, old_account_type);
793 talloc_free(tmp_ctx);
794 return NT_STATUS_INVALID_PARAMETER;
795 } else {
796 /* The account is of the wrong type, so bail */
797
798 /* TODO: We should allow a --force option to override, and redo this from the top setting r.in.recreate_account */
799 r->out.error_string
800 = talloc_asprintf(mem_ctx,
801 "The machine account (%s) already exists in the domain %s, "
802 "but is a %s. You asked to join as a %s. Please delete "
803 "the account and try again.",
804 r->in.account_name, connect_with_info->out.domain_name, old_account_type, new_account_type);
805 talloc_free(tmp_ctx);
806 return NT_STATUS_USER_EXISTS;
807 }
808 } else {
809 acct_flags = uinfo->info16.acct_flags;
810 }
811
812 acct_flags = (acct_flags & ~(ACB_DISABLED|ACB_PWNOTREQ));
813
814 /* Find out what password policy this user has */
815 pwp.in.user_handle = u_handle;
816 pwp.out.info = &info;
817
818 status = dcerpc_samr_GetUserPwInfo_r(samr_pipe->binding_handle, tmp_ctx, &pwp);
819 if (NT_STATUS_IS_OK(status) && !NT_STATUS_IS_OK(pwp.out.result)) {
820 status = pwp.out.result;
821 }
822 if (NT_STATUS_IS_OK(status)) {
823 policy_min_pw_len = pwp.out.info->min_password_length;
824 }
825
826 /* Grab a password of that minimum length */
827
828 password_str = generate_random_password(tmp_ctx, MAX(8, policy_min_pw_len), 255);
829
830 /* set full_name and reset flags */
831 ZERO_STRUCT(u_info21);
832 u_info21.full_name.string = r->in.account_name;
833 u_info21.acct_flags = acct_flags;
834 u_info21.fields_present = SAMR_FIELD_FULL_NAME | SAMR_FIELD_ACCT_FLAGS;
835
836 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
837 r2.samr_handle.in.account_name = r->in.account_name;
838 r2.samr_handle.in.newpassword = password_str;
839 r2.samr_handle.in.user_handle = u_handle;
840 r2.samr_handle.in.dcerpc_pipe = samr_pipe;
841 r2.samr_handle.in.info21 = &u_info21;
842
843 status = libnet_SetPassword(ctx, tmp_ctx, &r2);
844 if (!NT_STATUS_IS_OK(status)) {
845 r->out.error_string = talloc_steal(mem_ctx, r2.samr_handle.out.error_string);
846 talloc_free(tmp_ctx);
847 return status;
848 }
849
850 account_sid = dom_sid_add_rid(mem_ctx, connect_with_info->out.domain_sid, rid);
851 if (!account_sid) {
852 r->out.error_string = NULL;
853 talloc_free(tmp_ctx);
854 return NT_STATUS_NO_MEMORY;
855 }
856
857 /* Finish out by pushing various bits of status data out for the caller to use */
858 r->out.join_password = password_str;
859 talloc_steal(mem_ctx, r->out.join_password);
860
861 r->out.domain_sid = connect_with_info->out.domain_sid;
862 talloc_steal(mem_ctx, r->out.domain_sid);
863
864 r->out.account_sid = account_sid;
865 talloc_steal(mem_ctx, r->out.account_sid);
866
867 r->out.domain_name = connect_with_info->out.domain_name;
868 talloc_steal(mem_ctx, r->out.domain_name);
869 r->out.realm = connect_with_info->out.realm;
870 talloc_steal(mem_ctx, r->out.realm);
871 r->out.samr_pipe = samr_pipe;
872 talloc_reparent(tmp_ctx, mem_ctx, samr_pipe);
873 r->out.samr_binding = samr_pipe->binding;
874 talloc_steal(mem_ctx, r->out.samr_binding);
875 r->out.user_handle = u_handle;
876 talloc_steal(mem_ctx, u_handle);
877 r->out.error_string = r2.samr_handle.out.error_string;
878 talloc_steal(mem_ctx, r2.samr_handle.out.error_string);
879 r->out.kvno = 0;
880 r->out.server_dn_str = NULL;
881 talloc_free(tmp_ctx);
882
883 /* Now, if it was AD, then we want to start looking changing a
884 * few more things. Otherwise, we are done. */
885 if (r->out.realm) {
886 status = libnet_JoinADSDomain(ctx, r);
887 return status;
888 }
889
890 return status;
891 }
892
893 static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
894 TALLOC_CTX *mem_ctx,
895 struct libnet_Join *r)
896 {
897 NTSTATUS status;
898 TALLOC_CTX *tmp_mem;
899 struct libnet_JoinDomain *r2;
900 struct provision_store_self_join_settings *set_secrets;
901 uint32_t acct_type = 0;
902 const char *account_name;
903 const char *netbios_name;
904 const char *error_string;
905
906 r->out.error_string = NULL;
907
908 tmp_mem = talloc_new(mem_ctx);
909 if (!tmp_mem) {
910 return NT_STATUS_NO_MEMORY;
911 }
912
913 r2 = talloc(tmp_mem, struct libnet_JoinDomain);
914 if (!r2) {
915 r->out.error_string = NULL;
916 talloc_free(tmp_mem);
917 return NT_STATUS_NO_MEMORY;
918 }
919
920 if (r->in.join_type == SEC_CHAN_BDC) {
921 acct_type = ACB_SVRTRUST;
922 } else if (r->in.join_type == SEC_CHAN_WKSTA) {
923 acct_type = ACB_WSTRUST;
924 } else {
925 r->out.error_string = NULL;
926 talloc_free(tmp_mem);
927 return NT_STATUS_INVALID_PARAMETER;
928 }
929
930 if (r->in.netbios_name != NULL) {
931 netbios_name = r->in.netbios_name;
932 } else {
933 netbios_name = talloc_strdup(tmp_mem, lpcfg_netbios_name(ctx->lp_ctx));
934 if (!netbios_name) {
935 r->out.error_string = NULL;
936 talloc_free(tmp_mem);
937 return NT_STATUS_NO_MEMORY;
938 }
939 }
940
941 account_name = talloc_asprintf(tmp_mem, "%s$", netbios_name);
942 if (!account_name) {
943 r->out.error_string = NULL;
944 talloc_free(tmp_mem);
945 return NT_STATUS_NO_MEMORY;
946 }
947
948 /*
949 * join the domain
950 */
951 ZERO_STRUCTP(r2);
952 r2->in.domain_name = r->in.domain_name;
953 r2->in.account_name = account_name;
954 r2->in.netbios_name = netbios_name;
955 r2->in.level = LIBNET_JOINDOMAIN_AUTOMATIC;
956 r2->in.acct_type = acct_type;
957 r2->in.recreate_account = false;
958 status = libnet_JoinDomain(ctx, r2, r2);
959 if (!NT_STATUS_IS_OK(status)) {
960 r->out.error_string = talloc_steal(mem_ctx, r2->out.error_string);
961 talloc_free(tmp_mem);
962 return status;
963 }
964
965 set_secrets = talloc(tmp_mem, struct provision_store_self_join_settings);
966 if (!set_secrets) {
967 r->out.error_string = NULL;
968 talloc_free(tmp_mem);
969 return NT_STATUS_NO_MEMORY;
970 }
971
972 ZERO_STRUCTP(set_secrets);
973 set_secrets->domain_name = r2->out.domain_name;
974 set_secrets->realm = r2->out.realm;
975 set_secrets->netbios_name = netbios_name;
976 set_secrets->secure_channel_type = r->in.join_type;
977 set_secrets->machine_password = r2->out.join_password;
978 set_secrets->key_version_number = r2->out.kvno;
979 set_secrets->domain_sid = r2->out.domain_sid;
980
981 status = provision_store_self_join(ctx, ctx->lp_ctx, ctx->event_ctx, set_secrets, &error_string);
982 if (!NT_STATUS_IS_OK(status)) {
983 r->out.error_string = talloc_steal(mem_ctx, error_string);
984 talloc_free(tmp_mem);
985 return status;
986 }
987
988 /* move all out parameter to the callers TALLOC_CTX */
989 r->out.error_string = NULL;
990 r->out.join_password = r2->out.join_password;
991 talloc_reparent(r2, mem_ctx, r2->out.join_password);
992 r->out.domain_sid = r2->out.domain_sid;
993 talloc_reparent(r2, mem_ctx, r2->out.domain_sid);
994 r->out.domain_name = r2->out.domain_name;
995 talloc_reparent(r2, mem_ctx, r2->out.domain_name);
996 talloc_free(tmp_mem);
997 return NT_STATUS_OK;
998 }
999
1000 NTSTATUS libnet_Join(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_Join *r)
1001 {
1002 switch (r->in.join_type) {
1003 case SEC_CHAN_WKSTA:
1004 return libnet_Join_primary_domain(ctx, mem_ctx, r);
1005 case SEC_CHAN_BDC:
1006 return libnet_Join_primary_domain(ctx, mem_ctx, r);
1007 case SEC_CHAN_DOMAIN:
1008 case SEC_CHAN_DNS_DOMAIN:
1009 case SEC_CHAN_NULL:
1010 break;
1011 }
1012
1013 r->out.error_string = talloc_asprintf(mem_ctx,
1014 "Invalid join type specified (%08X) attempting to join domain %s",
1015 r->in.join_type, r->in.domain_name);
1016 return NT_STATUS_INVALID_PARAMETER;
1017 }
Samba GIT mirror