2 * Unix SMB/CIFS implementation.
3 * Authentication utility functions
4 * Copyright (C) Andrew Tridgell 1992-1998
5 * Copyright (C) Andrew Bartlett 2001
6 * Copyright (C) Jeremy Allison 2000-2001
7 * Copyright (C) Rafal Szczesniak 2002
8 * Copyright (C) Volker Lendecke 2006
9 * Copyright (C) Michael Adam 2007
11 * This program is free software; you can redistribute it and/or modify
12 * it under the terms of the GNU General Public License as published by
13 * the Free Software Foundation; either version 3 of the License, or
14 * (at your option) any later version.
16 * This program is distributed in the hope that it will be useful,
17 * but WITHOUT ANY WARRANTY; without even the implied warranty of
18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 * GNU General Public License for more details.
21 * You should have received a copy of the GNU General Public License
22 * along with this program; if not, see <http://www.gnu.org/licenses/>.
25 /* functions moved from auth/auth_util.c to minimize linker deps */
29 /****************************************************************************
30 Check for a SID in an NT_USER_TOKEN
31 ****************************************************************************/
33 bool nt_token_check_sid ( const struct dom_sid
*sid
, const NT_USER_TOKEN
*token
)
40 for ( i
=0; i
<token
->num_sids
; i
++ ) {
41 if ( sid_equal( sid
, &token
->user_sids
[i
] ) )
48 bool nt_token_check_domain_rid( NT_USER_TOKEN
*token
, uint32 rid
)
50 struct dom_sid domain_sid
;
52 /* if we are a domain member, the get the domain SID, else for
53 a DC or standalone server, use our own SID */
55 if ( lp_server_role() == ROLE_DOMAIN_MEMBER
) {
56 if ( !secrets_fetch_domain_sid( lp_workgroup(),
58 DEBUG(1,("nt_token_check_domain_rid: Cannot lookup "
59 "SID for domain [%s]\n", lp_workgroup()));
64 sid_copy( &domain_sid
, get_global_sam_sid() );
66 sid_append_rid( &domain_sid
, rid
);
68 return nt_token_check_sid( &domain_sid
, token
);\
71 /******************************************************************************
72 Create a token for the root user to be used internally by smbd.
73 This is similar to running under the context of the LOCAL_SYSTEM account
74 in Windows. This is a read-only token. Do not modify it or free() it.
75 Create a copy if your need to change it.
76 ******************************************************************************/
78 NT_USER_TOKEN
*get_root_nt_token( void )
80 struct nt_user_token
*token
, *for_cache
;
81 struct dom_sid u_sid
, g_sid
;
85 cache_data
= memcache_lookup_talloc(
86 NULL
, SINGLETON_CACHE_TALLOC
,
87 data_blob_string_const_null("root_nt_token"));
89 if (cache_data
!= NULL
) {
90 return talloc_get_type_abort(
91 cache_data
, struct nt_user_token
);
94 if ( !(pw
= sys_getpwuid(0)) ) {
95 if ( !(pw
= sys_getpwnam("root")) ) {
96 DEBUG(0,("get_root_nt_token: both sys_getpwuid(0) "
97 "and sys_getpwnam(\"root\") failed!\n"));
102 /* get the user and primary group SIDs; although the
103 BUILTIN\Administrators SId is really the one that matters here */
105 uid_to_sid(&u_sid
, pw
->pw_uid
);
106 gid_to_sid(&g_sid
, pw
->pw_gid
);
108 token
= create_local_nt_token(talloc_autofree_context(), &u_sid
, False
,
109 1, &global_sid_Builtin_Administrators
);
111 token
->privileges
= se_disk_operators
;
116 NULL
, SINGLETON_CACHE_TALLOC
,
117 data_blob_string_const_null("root_nt_token"), &for_cache
);
124 * Add alias SIDs from memberships within the partially created token SID list
127 NTSTATUS
add_aliases(const struct dom_sid
*domain_sid
,
128 struct nt_user_token
*token
)
131 size_t i
, num_aliases
;
135 if (!(tmp_ctx
= talloc_init("add_aliases"))) {
136 return NT_STATUS_NO_MEMORY
;
142 status
= pdb_enum_alias_memberships(tmp_ctx
, domain_sid
,
145 &aliases
, &num_aliases
);
147 if (!NT_STATUS_IS_OK(status
)) {
148 DEBUG(10, ("pdb_enum_alias_memberships failed: %s\n",
153 for (i
=0; i
<num_aliases
; i
++) {
154 struct dom_sid alias_sid
;
155 sid_compose(&alias_sid
, domain_sid
, aliases
[i
]);
156 status
= add_sid_to_array_unique(token
, &alias_sid
,
159 if (!NT_STATUS_IS_OK(status
)) {
160 DEBUG(0, ("add_sid_to_array failed\n"));
166 TALLOC_FREE(tmp_ctx
);
170 /*******************************************************************
171 *******************************************************************/
173 static NTSTATUS
add_builtin_administrators(struct nt_user_token
*token
,
174 const struct dom_sid
*dom_sid
)
176 struct dom_sid domadm
;
179 /* nothing to do if we aren't in a domain */
181 if ( !(IS_DC
|| lp_server_role()==ROLE_DOMAIN_MEMBER
) ) {
185 /* Find the Domain Admins SID */
188 sid_copy( &domadm
, get_global_sam_sid() );
190 sid_copy(&domadm
, dom_sid
);
192 sid_append_rid( &domadm
, DOMAIN_RID_ADMINS
);
194 /* Add Administrators if the user beloongs to Domain Admins */
196 if ( nt_token_check_sid( &domadm
, token
) ) {
197 status
= add_sid_to_array(token
,
198 &global_sid_Builtin_Administrators
,
199 &token
->user_sids
, &token
->num_sids
);
200 if (!NT_STATUS_IS_OK(status
)) {
209 * Create the requested BUILTIN if it doesn't already exist. This requires
210 * winbindd to be running.
212 * @param[in] rid BUILTIN rid to create
213 * @return Normal NTSTATUS return.
215 static NTSTATUS
create_builtin(uint32 rid
)
217 NTSTATUS status
= NT_STATUS_OK
;
221 if (!sid_compose(&sid
, &global_sid_Builtin
, rid
)) {
222 return NT_STATUS_NO_SUCH_ALIAS
;
225 if (!sid_to_gid(&sid
, &gid
)) {
226 if (!lp_winbind_nested_groups() || !winbind_ping()) {
227 return NT_STATUS_PROTOCOL_UNREACHABLE
;
229 status
= pdb_create_builtin_alias(rid
);
235 * Add sid as a member of builtin_sid.
237 * @param[in] builtin_sid An existing builtin group.
238 * @param[in] dom_sid sid to add as a member of builtin_sid.
239 * @return Normal NTSTATUS return
241 static NTSTATUS
add_sid_to_builtin(const struct dom_sid
*builtin_sid
,
242 const struct dom_sid
*dom_sid
)
244 NTSTATUS status
= NT_STATUS_OK
;
246 if (!dom_sid
|| !builtin_sid
) {
247 return NT_STATUS_INVALID_PARAMETER
;
250 status
= pdb_add_aliasmem(builtin_sid
, dom_sid
);
252 if (NT_STATUS_EQUAL(status
, NT_STATUS_MEMBER_IN_ALIAS
)) {
253 DEBUG(5, ("add_sid_to_builtin %s is already a member of %s\n",
254 sid_string_dbg(dom_sid
),
255 sid_string_dbg(builtin_sid
)));
259 if (!NT_STATUS_IS_OK(status
)) {
260 DEBUG(4, ("add_sid_to_builtin %s could not be added to %s: "
261 "%s\n", sid_string_dbg(dom_sid
),
262 sid_string_dbg(builtin_sid
), nt_errstr(status
)));
267 /*******************************************************************
268 *******************************************************************/
270 NTSTATUS
create_builtin_users(const struct dom_sid
*dom_sid
)
273 struct dom_sid dom_users
;
275 status
= create_builtin(BUILTIN_RID_USERS
);
276 if ( !NT_STATUS_IS_OK(status
) ) {
277 DEBUG(5,("create_builtin_users: Failed to create Users\n"));
281 /* add domain users */
282 if ((IS_DC
|| (lp_server_role() == ROLE_DOMAIN_MEMBER
))
283 && sid_compose(&dom_users
, dom_sid
, DOMAIN_RID_USERS
))
285 status
= add_sid_to_builtin(&global_sid_Builtin_Users
,
292 /*******************************************************************
293 *******************************************************************/
295 NTSTATUS
create_builtin_administrators(const struct dom_sid
*dom_sid
)
298 struct dom_sid dom_admins
, root_sid
;
300 enum lsa_SidType type
;
304 status
= create_builtin(BUILTIN_RID_ADMINISTRATORS
);
305 if ( !NT_STATUS_IS_OK(status
) ) {
306 DEBUG(5,("create_builtin_administrators: Failed to create Administrators\n"));
310 /* add domain admins */
311 if ((IS_DC
|| (lp_server_role() == ROLE_DOMAIN_MEMBER
))
312 && sid_compose(&dom_admins
, dom_sid
, DOMAIN_RID_ADMINS
))
314 status
= add_sid_to_builtin(&global_sid_Builtin_Administrators
,
316 if (!NT_STATUS_IS_OK(status
)) {
322 if ( (ctx
= talloc_init("create_builtin_administrators")) == NULL
) {
323 return NT_STATUS_NO_MEMORY
;
325 fstr_sprintf( root_name
, "%s\\root", get_global_sam_name() );
326 ret
= lookup_name(ctx
, root_name
, LOOKUP_NAME_DOMAIN
, NULL
, NULL
,
331 status
= add_sid_to_builtin(&global_sid_Builtin_Administrators
,
339 /*******************************************************************
340 Create a NT token for the user, expanding local aliases
341 *******************************************************************/
343 struct nt_user_token
*create_local_nt_token(TALLOC_CTX
*mem_ctx
,
344 const struct dom_sid
*user_sid
,
347 const struct dom_sid
*groupsids
)
349 struct nt_user_token
*result
= NULL
;
353 struct dom_sid dom_sid
;
355 DEBUG(10, ("Create local NT token for %s\n",
356 sid_string_dbg(user_sid
)));
358 if (!(result
= TALLOC_ZERO_P(mem_ctx
, struct nt_user_token
))) {
359 DEBUG(0, ("talloc failed\n"));
363 /* Add the user and primary group sid */
365 status
= add_sid_to_array(result
, user_sid
,
366 &result
->user_sids
, &result
->num_sids
);
367 if (!NT_STATUS_IS_OK(status
)) {
371 /* For guest, num_groupsids may be zero. */
373 status
= add_sid_to_array(result
, &groupsids
[0],
376 if (!NT_STATUS_IS_OK(status
)) {
381 /* Add in BUILTIN sids */
383 status
= add_sid_to_array(result
, &global_sid_World
,
384 &result
->user_sids
, &result
->num_sids
);
385 if (!NT_STATUS_IS_OK(status
)) {
388 status
= add_sid_to_array(result
, &global_sid_Network
,
389 &result
->user_sids
, &result
->num_sids
);
390 if (!NT_STATUS_IS_OK(status
)) {
395 status
= add_sid_to_array(result
, &global_sid_Builtin_Guests
,
398 if (!NT_STATUS_IS_OK(status
)) {
402 status
= add_sid_to_array(result
,
403 &global_sid_Authenticated_Users
,
406 if (!NT_STATUS_IS_OK(status
)) {
411 /* Now the SIDs we got from authentication. These are the ones from
412 * the info3 struct or from the pdb_enum_group_memberships, depending
413 * on who authenticated the user.
414 * Note that we start the for loop at "1" here, we already added the
415 * first group sid as primary above. */
417 for (i
=1; i
<num_groupsids
; i
++) {
418 status
= add_sid_to_array_unique(result
, &groupsids
[i
],
421 if (!NT_STATUS_IS_OK(status
)) {
426 /* Deal with the BUILTIN\Administrators group. If the SID can
427 be resolved then assume that the add_aliasmem( S-1-5-32 )
430 if (!sid_to_gid(&global_sid_Builtin_Administrators
, &gid
)) {
433 if (!secrets_fetch_domain_sid(lp_workgroup(), &dom_sid
)) {
434 status
= NT_STATUS_OK
;
435 DEBUG(3, ("Failed to fetch domain sid for %s\n",
438 status
= create_builtin_administrators(&dom_sid
);
442 if (NT_STATUS_EQUAL(status
, NT_STATUS_PROTOCOL_UNREACHABLE
)) {
443 /* Add BUILTIN\Administrators directly to token. */
444 status
= add_builtin_administrators(result
, &dom_sid
);
445 if ( !NT_STATUS_IS_OK(status
) ) {
446 DEBUG(3, ("Failed to check for local "
447 "Administrators membership (%s)\n",
450 } else if (!NT_STATUS_IS_OK(status
)) {
451 DEBUG(2, ("WARNING: Failed to create "
452 "BUILTIN\\Administrators group! Can "
453 "Winbind allocate gids?\n"));
457 /* Deal with the BUILTIN\Users group. If the SID can
458 be resolved then assume that the add_aliasmem( S-1-5-32 )
461 if (!sid_to_gid(&global_sid_Builtin_Users
, &gid
)) {
464 if (!secrets_fetch_domain_sid(lp_workgroup(), &dom_sid
)) {
465 status
= NT_STATUS_OK
;
466 DEBUG(3, ("Failed to fetch domain sid for %s\n",
469 status
= create_builtin_users(&dom_sid
);
473 if (!NT_STATUS_EQUAL(status
, NT_STATUS_PROTOCOL_UNREACHABLE
) &&
474 !NT_STATUS_IS_OK(status
))
476 DEBUG(2, ("WARNING: Failed to create BUILTIN\\Users group! "
477 "Can Winbind allocate gids?\n"));
481 /* Deal with local groups */
483 if (lp_winbind_nested_groups()) {
487 /* Now add the aliases. First the one from our local SAM */
489 status
= add_aliases(get_global_sam_sid(), result
);
491 if (!NT_STATUS_IS_OK(status
)) {
497 /* Finally the builtin ones */
499 status
= add_aliases(&global_sid_Builtin
, result
);
501 if (!NT_STATUS_IS_OK(status
)) {
511 get_privileges_for_sids(&result
->privileges
, result
->user_sids
,
516 /****************************************************************************
517 prints a NT_USER_TOKEN to debug output.
518 ****************************************************************************/
520 void debug_nt_user_token(int dbg_class
, int dbg_lev
, NT_USER_TOKEN
*token
)
525 DEBUGC(dbg_class
, dbg_lev
, ("NT user token: (NULL)\n"));
529 DEBUGC(dbg_class
, dbg_lev
,
530 ("NT user token of user %s\n",
531 sid_string_dbg(&token
->user_sids
[0]) ));
532 DEBUGADDC(dbg_class
, dbg_lev
,
533 ("contains %lu SIDs\n", (unsigned long)token
->num_sids
));
534 for (i
= 0; i
< token
->num_sids
; i
++)
535 DEBUGADDC(dbg_class
, dbg_lev
,
536 ("SID[%3lu]: %s\n", (unsigned long)i
,
537 sid_string_dbg(&token
->user_sids
[i
])));
539 dump_se_priv( dbg_class
, dbg_lev
, &token
->privileges
);
542 /****************************************************************************
543 prints a UNIX 'token' to debug output.
544 ****************************************************************************/
546 void debug_unix_user_token(int dbg_class
, int dbg_lev
, uid_t uid
, gid_t gid
,
547 int n_groups
, gid_t
*groups
)
550 DEBUGC(dbg_class
, dbg_lev
,
551 ("UNIX token of user %ld\n", (long int)uid
));
553 DEBUGADDC(dbg_class
, dbg_lev
,
554 ("Primary group is %ld and contains %i supplementary "
555 "groups\n", (long int)gid
, n_groups
));
556 for (i
= 0; i
< n_groups
; i
++)
557 DEBUGADDC(dbg_class
, dbg_lev
, ("Group[%3i]: %ld\n", i
,
558 (long int)groups
[i
]));
562 * Create an artificial NT token given just a username. (Initially intended
565 * We go through lookup_name() to avoid problems we had with 'winbind use
570 * unmapped unix users: Go directly to nss to find the user's group.
572 * A passdb user: The list of groups is provided by pdb_enum_group_memberships.
574 * If the user is provided by winbind, the primary gid is set to "domain
575 * users" of the user's domain. For an explanation why this is necessary, see
576 * the thread starting at
577 * http://lists.samba.org/archive/samba-technical/2006-January/044803.html.
580 NTSTATUS
create_token_from_username(TALLOC_CTX
*mem_ctx
, const char *username
,
582 uid_t
*uid
, gid_t
*gid
,
583 char **found_username
,
584 struct nt_user_token
**token
)
586 NTSTATUS result
= NT_STATUS_NO_SUCH_USER
;
587 TALLOC_CTX
*tmp_ctx
= talloc_stackframe();
588 struct dom_sid user_sid
;
589 enum lsa_SidType type
;
591 struct dom_sid
*group_sids
;
592 struct dom_sid unix_group_sid
;
593 size_t num_group_sids
;
597 if (!lookup_name_smbconf(tmp_ctx
, username
, LOOKUP_NAME_ALL
,
598 NULL
, NULL
, &user_sid
, &type
)) {
599 DEBUG(1, ("lookup_name_smbconf for %s failed\n", username
));
603 if (type
!= SID_NAME_USER
) {
604 DEBUG(1, ("%s is a %s, not a user\n", username
,
605 sid_type_lookup(type
)));
609 if (sid_check_is_in_our_domain(&user_sid
)) {
612 /* This is a passdb user, so ask passdb */
614 struct samu
*sam_acct
= NULL
;
616 if ( !(sam_acct
= samu_new( tmp_ctx
)) ) {
617 result
= NT_STATUS_NO_MEMORY
;
622 ret
= pdb_getsampwsid(sam_acct
, &user_sid
);
626 DEBUG(1, ("pdb_getsampwsid(%s) for user %s failed\n",
627 sid_string_dbg(&user_sid
), username
));
628 DEBUGADD(1, ("Fall back to unix user %s\n", username
));
632 result
= pdb_enum_group_memberships(tmp_ctx
, sam_acct
,
635 if (!NT_STATUS_IS_OK(result
)) {
636 DEBUG(1, ("enum_group_memberships failed for %s (%s): "
637 "%s\n", username
, sid_string_dbg(&user_sid
),
639 DEBUGADD(1, ("Fall back to unix user %s\n", username
));
643 /* see the smb_panic() in pdb_default_enum_group_memberships */
644 SMB_ASSERT(num_group_sids
> 0);
648 /* Ensure we're returning the found_username on the right context. */
649 *found_username
= talloc_strdup(mem_ctx
,
650 pdb_get_username(sam_acct
));
653 * If the SID from lookup_name() was the guest sid, passdb knows
654 * about the mapping of guest sid to lp_guestaccount()
655 * username and will return the unix_pw info for a guest
656 * user. Use it if it's there, else lookup the *uid details
657 * using getpwnam_alloc(). See bug #6291 for details. JRA.
660 /* We must always assign the *uid. */
661 if (sam_acct
->unix_pw
== NULL
) {
662 struct passwd
*pwd
= getpwnam_alloc(sam_acct
, *found_username
);
664 DEBUG(10, ("getpwnam_alloc failed for %s\n",
666 result
= NT_STATUS_NO_SUCH_USER
;
669 result
= samu_set_unix(sam_acct
, pwd
);
670 if (!NT_STATUS_IS_OK(result
)) {
671 DEBUG(10, ("samu_set_unix failed for %s\n",
673 result
= NT_STATUS_NO_SUCH_USER
;
677 *uid
= sam_acct
->unix_pw
->pw_uid
;
679 } else if (sid_check_is_in_unix_users(&user_sid
)) {
681 /* This is a unix user not in passdb. We need to ask nss
682 * directly, without consulting passdb */
687 * This goto target is used as a fallback for the passdb
688 * case. The concrete bug report is when passdb gave us an
694 if (!sid_to_uid(&user_sid
, uid
)) {
695 DEBUG(1, ("unix_user case, sid_to_uid for %s (%s) failed\n",
696 username
, sid_string_dbg(&user_sid
)));
697 result
= NT_STATUS_NO_SUCH_USER
;
701 uid_to_unix_users_sid(*uid
, &user_sid
);
703 pass
= getpwuid_alloc(tmp_ctx
, *uid
);
705 DEBUG(1, ("getpwuid(%u) for user %s failed\n",
706 (unsigned int)*uid
, username
));
710 if (!getgroups_unix_user(tmp_ctx
, username
, pass
->pw_gid
,
711 &gids
, &num_group_sids
)) {
712 DEBUG(1, ("getgroups_unix_user for user %s failed\n",
717 if (num_group_sids
) {
718 group_sids
= TALLOC_ARRAY(tmp_ctx
, struct dom_sid
, num_group_sids
);
719 if (group_sids
== NULL
) {
720 DEBUG(1, ("TALLOC_ARRAY failed\n"));
721 result
= NT_STATUS_NO_MEMORY
;
728 for (i
=0; i
<num_group_sids
; i
++) {
729 gid_to_sid(&group_sids
[i
], gids
[i
]);
732 /* In getgroups_unix_user we always set the primary gid */
733 SMB_ASSERT(num_group_sids
> 0);
737 /* Ensure we're returning the found_username on the right context. */
738 *found_username
= talloc_strdup(mem_ctx
, pass
->pw_name
);
741 /* This user is from winbind, force the primary gid to the
742 * user's "domain users" group. Under certain circumstances
743 * (user comes from NT4), this might be a loss of
744 * information. But we can not rely on winbind getting the
745 * correct info. AD might prohibit winbind looking up that
750 /* We must always assign the *uid. */
751 if (!sid_to_uid(&user_sid
, uid
)) {
752 DEBUG(1, ("winbindd case, sid_to_uid for %s (%s) failed\n",
753 username
, sid_string_dbg(&user_sid
)));
754 result
= NT_STATUS_NO_SUCH_USER
;
759 group_sids
= TALLOC_ARRAY(tmp_ctx
, struct dom_sid
, num_group_sids
);
760 if (group_sids
== NULL
) {
761 DEBUG(1, ("TALLOC_ARRAY failed\n"));
762 result
= NT_STATUS_NO_MEMORY
;
766 sid_copy(&group_sids
[0], &user_sid
);
767 sid_split_rid(&group_sids
[0], &dummy
);
768 sid_append_rid(&group_sids
[0], DOMAIN_RID_USERS
);
770 if (!sid_to_gid(&group_sids
[0], gid
)) {
771 DEBUG(1, ("sid_to_gid(%s) failed\n",
772 sid_string_dbg(&group_sids
[0])));
778 /* Ensure we're returning the found_username on the right context. */
779 *found_username
= talloc_strdup(mem_ctx
, username
);
782 /* Add the "Unix Group" SID for each gid to catch mapped groups
783 and their Unix equivalent. This is to solve the backwards
784 compatibility problem of 'valid users = +ntadmin' where
785 ntadmin has been paired with "Domain Admins" in the group
786 mapping table. Otherwise smb.conf would need to be changed
787 to 'valid user = "Domain Admins"'. --jerry */
789 num_gids
= num_group_sids
;
790 for ( i
=0; i
<num_gids
; i
++ ) {
793 /* don't pickup anything managed by Winbind */
795 if ( lp_idmap_gid(&low
, &high
) && (gids
[i
] >= low
) && (gids
[i
] <= high
) )
798 if ( !gid_to_unix_groups_sid( gids
[i
], &unix_group_sid
) ) {
799 DEBUG(1,("create_token_from_username: Failed to create SID "
800 "for gid %u!\n", (unsigned int)gids
[i
]));
803 result
= add_sid_to_array_unique(tmp_ctx
, &unix_group_sid
,
804 &group_sids
, &num_group_sids
);
805 if (!NT_STATUS_IS_OK(result
)) {
810 /* Ensure we're creating the nt_token on the right context. */
811 *token
= create_local_nt_token(mem_ctx
, &user_sid
,
812 is_guest
, num_group_sids
, group_sids
);
814 if ((*token
== NULL
) || (*found_username
== NULL
)) {
815 result
= NT_STATUS_NO_MEMORY
;
819 result
= NT_STATUS_OK
;
821 TALLOC_FREE(tmp_ctx
);
825 /***************************************************************************
826 Build upon create_token_from_username:
828 Expensive helper function to figure out whether a user given its name is
829 member of a particular group.
830 ***************************************************************************/
832 bool user_in_group_sid(const char *username
, const struct dom_sid
*group_sid
)
837 char *found_username
;
838 struct nt_user_token
*token
;
840 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
842 status
= create_token_from_username(mem_ctx
, username
, False
,
843 &uid
, &gid
, &found_username
,
846 if (!NT_STATUS_IS_OK(status
)) {
847 DEBUG(10, ("could not create token for %s\n", username
));
848 TALLOC_FREE(mem_ctx
);
852 result
= nt_token_check_sid(group_sid
, token
);
854 TALLOC_FREE(mem_ctx
);
858 bool user_in_group(const char *username
, const char *groupname
)
860 TALLOC_CTX
*mem_ctx
= talloc_stackframe();
861 struct dom_sid group_sid
;
864 ret
= lookup_name(mem_ctx
, groupname
, LOOKUP_NAME_ALL
,
865 NULL
, NULL
, &group_sid
, NULL
);
866 TALLOC_FREE(mem_ctx
);
869 DEBUG(10, ("lookup_name for (%s) failed.\n", groupname
));
873 return user_in_group_sid(username
, &group_sid
);