2 Unix SMB/CIFS implementation.
4 Winbind rpc backend functions
6 Copyright (C) Tim Potter 2000-2001,2003
7 Copyright (C) Andrew Tridgell 2001
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2008 (pidl conversion)
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "winbindd_rpc.h"
29 #include "../librpc/gen_ndr/ndr_samr_c.h"
30 #include "rpc_client/cli_pipe.h"
31 #include "rpc_client/cli_samr.h"
32 #include "rpc_client/cli_lsarpc.h"
33 #include "../libcli/security/security.h"
36 #define DBGC_CLASS DBGC_WINBIND
38 static NTSTATUS
winbindd_lookup_names(TALLOC_CTX
*mem_ctx
,
39 struct winbindd_domain
*domain
,
42 const char ***domains
,
43 struct dom_sid
**sids
,
44 enum lsa_SidType
**types
);
46 /* Query display info for a domain. This returns enough information plus a
47 bit extra to give an overview of domain users for the User Manager
49 static NTSTATUS
msrpc_query_user_list(struct winbindd_domain
*domain
,
52 struct wbint_userinfo
**pinfo
)
54 struct rpc_pipe_client
*samr_pipe
= NULL
;
55 struct policy_handle dom_pol
;
56 struct wbint_userinfo
*info
= NULL
;
57 uint32_t num_info
= 0;
61 DEBUG(3, ("msrpc_query_user_list\n"));
67 tmp_ctx
= talloc_stackframe();
68 if (tmp_ctx
== NULL
) {
69 return NT_STATUS_NO_MEMORY
;
72 if ( !winbindd_can_contact_domain( domain
) ) {
73 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
75 status
= NT_STATUS_OK
;
79 status
= cm_connect_sam(domain
, tmp_ctx
, &samr_pipe
, &dom_pol
);
80 if (!NT_STATUS_IS_OK(status
)) {
84 status
= rpc_query_user_list(tmp_ctx
,
90 if (!NT_STATUS_IS_OK(status
)) {
95 *pnum_info
= num_info
;
99 *pinfo
= talloc_move(mem_ctx
, &info
);
103 TALLOC_FREE(tmp_ctx
);
107 /* list all domain groups */
108 static NTSTATUS
msrpc_enum_dom_groups(struct winbindd_domain
*domain
,
111 struct wb_acct_info
**pinfo
)
113 struct rpc_pipe_client
*samr_pipe
;
114 struct policy_handle dom_pol
;
115 struct wb_acct_info
*info
= NULL
;
116 uint32_t num_info
= 0;
120 DEBUG(3,("msrpc_enum_dom_groups\n"));
126 tmp_ctx
= talloc_stackframe();
127 if (tmp_ctx
== NULL
) {
128 return NT_STATUS_NO_MEMORY
;
131 if ( !winbindd_can_contact_domain( domain
) ) {
132 DEBUG(10,("enum_domain_groups: No incoming trust for domain %s\n",
134 status
= NT_STATUS_OK
;
138 status
= cm_connect_sam(domain
, tmp_ctx
, &samr_pipe
, &dom_pol
);
139 if (!NT_STATUS_IS_OK(status
)) {
143 status
= rpc_enum_dom_groups(tmp_ctx
,
148 if (!NT_STATUS_IS_OK(status
)) {
153 *pnum_info
= num_info
;
157 *pinfo
= talloc_move(mem_ctx
, &info
);
161 TALLOC_FREE(tmp_ctx
);
165 /* List all domain groups */
167 static NTSTATUS
msrpc_enum_local_groups(struct winbindd_domain
*domain
,
170 struct wb_acct_info
**pinfo
)
172 struct rpc_pipe_client
*samr_pipe
;
173 struct policy_handle dom_pol
;
174 struct wb_acct_info
*info
= NULL
;
175 uint32_t num_info
= 0;
179 DEBUG(3,("msrpc_enum_local_groups\n"));
185 tmp_ctx
= talloc_stackframe();
186 if (tmp_ctx
== NULL
) {
187 return NT_STATUS_NO_MEMORY
;
190 if ( !winbindd_can_contact_domain( domain
) ) {
191 DEBUG(10,("enum_local_groups: No incoming trust for domain %s\n",
193 status
= NT_STATUS_OK
;
197 status
= cm_connect_sam(domain
, tmp_ctx
, &samr_pipe
, &dom_pol
);
198 if (!NT_STATUS_IS_OK(status
)) {
202 status
= rpc_enum_local_groups(mem_ctx
,
207 if (!NT_STATUS_IS_OK(status
)) {
212 *pnum_info
= num_info
;
216 *pinfo
= talloc_move(mem_ctx
, &info
);
220 TALLOC_FREE(tmp_ctx
);
224 /* convert a single name to a sid in a domain */
225 static NTSTATUS
msrpc_name_to_sid(struct winbindd_domain
*domain
,
227 const char *domain_name
,
231 enum lsa_SidType
*type
)
234 struct dom_sid
*sids
= NULL
;
235 enum lsa_SidType
*types
= NULL
;
236 char *full_name
= NULL
;
237 NTSTATUS name_map_status
= NT_STATUS_UNSUCCESSFUL
;
238 char *mapped_name
= NULL
;
240 if (name
== NULL
|| *name
=='\0') {
241 full_name
= talloc_asprintf(mem_ctx
, "%s", domain_name
);
242 } else if (domain_name
== NULL
|| *domain_name
== '\0') {
243 full_name
= talloc_asprintf(mem_ctx
, "%s", name
);
245 full_name
= talloc_asprintf(mem_ctx
, "%s\\%s", domain_name
, name
);
248 DEBUG(0, ("talloc_asprintf failed!\n"));
249 return NT_STATUS_NO_MEMORY
;
252 DEBUG(3, ("msrpc_name_to_sid: name=%s\n", full_name
));
254 name_map_status
= normalize_name_unmap(mem_ctx
, full_name
,
257 /* Reset the full_name pointer if we mapped anything */
259 if (NT_STATUS_IS_OK(name_map_status
) ||
260 NT_STATUS_EQUAL(name_map_status
, NT_STATUS_FILE_RENAMED
))
262 full_name
= mapped_name
;
265 DEBUG(3,("name_to_sid [rpc] %s for domain %s\n",
266 full_name
?full_name
:"", domain_name
));
268 result
= winbindd_lookup_names(mem_ctx
, domain
, 1,
269 (const char **)&full_name
, NULL
,
271 if (!NT_STATUS_IS_OK(result
))
274 /* Return rid and type if lookup successful */
276 sid_copy(sid
, &sids
[0]);
283 convert a domain SID to a user or group name
285 static NTSTATUS
msrpc_sid_to_name(struct winbindd_domain
*domain
,
287 const struct dom_sid
*sid
,
290 enum lsa_SidType
*type
)
294 enum lsa_SidType
*types
= NULL
;
296 NTSTATUS name_map_status
= NT_STATUS_UNSUCCESSFUL
;
297 char *mapped_name
= NULL
;
299 DEBUG(3, ("msrpc_sid_to_name: %s for domain %s\n", sid_string_dbg(sid
),
302 result
= winbindd_lookup_sids(mem_ctx
,
309 if (!NT_STATUS_IS_OK(result
)) {
310 DEBUG(2,("msrpc_sid_to_name: failed to lookup sids: %s\n",
316 *type
= (enum lsa_SidType
)types
[0];
317 *domain_name
= domains
[0];
320 DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains
[0], *name
));
322 name_map_status
= normalize_name_map(mem_ctx
, domain
, *name
,
324 if (NT_STATUS_IS_OK(name_map_status
) ||
325 NT_STATUS_EQUAL(name_map_status
, NT_STATUS_FILE_RENAMED
))
328 DEBUG(5,("returning mapped name -- %s\n", *name
));
334 static NTSTATUS
msrpc_rids_to_names(struct winbindd_domain
*domain
,
336 const struct dom_sid
*sid
,
341 enum lsa_SidType
**types
)
345 struct dom_sid
*sids
;
349 DEBUG(3, ("msrpc_rids_to_names: domain %s\n", domain
->name
));
352 sids
= talloc_array(mem_ctx
, struct dom_sid
, num_rids
);
354 return NT_STATUS_NO_MEMORY
;
360 for (i
=0; i
<num_rids
; i
++) {
361 if (!sid_compose(&sids
[i
], sid
, rids
[i
])) {
362 return NT_STATUS_INTERNAL_ERROR
;
366 result
= winbindd_lookup_sids(mem_ctx
,
374 if (!NT_STATUS_IS_OK(result
) &&
375 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
)) {
380 for (i
=0; i
<num_rids
; i
++) {
381 NTSTATUS name_map_status
= NT_STATUS_UNSUCCESSFUL
;
382 char *mapped_name
= NULL
;
384 if ((*types
)[i
] != SID_NAME_UNKNOWN
) {
385 name_map_status
= normalize_name_map(mem_ctx
,
389 if (NT_STATUS_IS_OK(name_map_status
) ||
390 NT_STATUS_EQUAL(name_map_status
, NT_STATUS_FILE_RENAMED
))
392 ret_names
[i
] = mapped_name
;
395 *domain_name
= domains
[i
];
402 /* Lookup user information from a rid or username. */
403 static NTSTATUS
msrpc_query_user(struct winbindd_domain
*domain
,
405 const struct dom_sid
*user_sid
,
406 struct wbint_userinfo
*user_info
)
408 struct rpc_pipe_client
*samr_pipe
;
409 struct policy_handle dom_pol
;
410 struct netr_SamInfo3
*user
;
414 DEBUG(3,("msrpc_query_user sid=%s\n", sid_string_dbg(user_sid
)));
416 tmp_ctx
= talloc_stackframe();
417 if (tmp_ctx
== NULL
) {
418 return NT_STATUS_NO_MEMORY
;
422 user_info
->homedir
= NULL
;
423 user_info
->shell
= NULL
;
424 user_info
->primary_gid
= (gid_t
)-1;
427 /* try netsamlogon cache first */
428 user
= netsamlogon_cache_get(tmp_ctx
, user_sid
);
430 DEBUG(5,("msrpc_query_user: Cache lookup succeeded for %s\n",
431 sid_string_dbg(user_sid
)));
433 sid_compose(&user_info
->user_sid
, &domain
->sid
, user
->base
.rid
);
434 sid_compose(&user_info
->group_sid
, &domain
->sid
,
435 user
->base
.primary_gid
);
437 user_info
->acct_name
= talloc_strdup(user_info
,
438 user
->base
.account_name
.string
);
439 user_info
->full_name
= talloc_strdup(user_info
,
440 user
->base
.full_name
.string
);
442 status
= NT_STATUS_OK
;
446 if ( !winbindd_can_contact_domain( domain
) ) {
447 DEBUG(10,("query_user: No incoming trust for domain %s\n",
449 /* Tell the cache manager not to remember this one */
450 status
= NT_STATUS_SYNCHRONIZATION_REQUIRED
;
454 /* no cache; hit the wire */
455 status
= cm_connect_sam(domain
, tmp_ctx
, &samr_pipe
, &dom_pol
);
456 if (!NT_STATUS_IS_OK(status
)) {
460 status
= rpc_query_user(tmp_ctx
,
468 TALLOC_FREE(tmp_ctx
);
472 /* Lookup groups a user is a member of. I wish Unix had a call like this! */
473 static NTSTATUS
msrpc_lookup_usergroups(struct winbindd_domain
*domain
,
475 const struct dom_sid
*user_sid
,
476 uint32_t *pnum_groups
,
477 struct dom_sid
**puser_grpsids
)
479 struct rpc_pipe_client
*samr_pipe
;
480 struct policy_handle dom_pol
;
481 struct dom_sid
*user_grpsids
= NULL
;
482 uint32_t num_groups
= 0;
486 DEBUG(3,("msrpc_lookup_usergroups sid=%s\n", sid_string_dbg(user_sid
)));
490 tmp_ctx
= talloc_stackframe();
491 if (tmp_ctx
== NULL
) {
492 return NT_STATUS_NO_MEMORY
;
495 /* Check if we have a cached user_info_3 */
496 status
= lookup_usergroups_cached(domain
,
501 if (NT_STATUS_IS_OK(status
)) {
505 if ( !winbindd_can_contact_domain( domain
) ) {
506 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
509 /* Tell the cache manager not to remember this one */
510 status
= NT_STATUS_SYNCHRONIZATION_REQUIRED
;
514 /* no cache; hit the wire */
515 status
= cm_connect_sam(domain
, tmp_ctx
, &samr_pipe
, &dom_pol
);
516 if (!NT_STATUS_IS_OK(status
)) {
520 status
= rpc_lookup_usergroups(tmp_ctx
,
527 if (!NT_STATUS_IS_OK(status
)) {
532 *pnum_groups
= num_groups
;
535 *puser_grpsids
= talloc_move(mem_ctx
, &user_grpsids
);
539 TALLOC_FREE(tmp_ctx
);
544 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
546 static NTSTATUS
msrpc_lookup_useraliases(struct winbindd_domain
*domain
,
548 uint32 num_sids
, const struct dom_sid
*sids
,
549 uint32
*pnum_aliases
,
550 uint32
**palias_rids
)
552 struct rpc_pipe_client
*samr_pipe
;
553 struct policy_handle dom_pol
;
554 uint32_t num_aliases
= 0;
555 uint32_t *alias_rids
= NULL
;
559 DEBUG(3,("msrpc_lookup_useraliases\n"));
565 tmp_ctx
= talloc_stackframe();
566 if (tmp_ctx
== NULL
) {
567 return NT_STATUS_NO_MEMORY
;
570 if (!winbindd_can_contact_domain(domain
)) {
571 DEBUG(10,("msrpc_lookup_useraliases: No incoming trust for domain %s\n",
573 /* Tell the cache manager not to remember this one */
574 status
= NT_STATUS_SYNCHRONIZATION_REQUIRED
;
578 status
= cm_connect_sam(domain
, tmp_ctx
, &samr_pipe
, &dom_pol
);
579 if (!NT_STATUS_IS_OK(status
)) {
583 status
= rpc_lookup_useraliases(tmp_ctx
,
590 if (!NT_STATUS_IS_OK(status
)) {
595 *pnum_aliases
= num_aliases
;
599 *palias_rids
= talloc_move(mem_ctx
, &alias_rids
);
603 TALLOC_FREE(tmp_ctx
);
608 /* Lookup group membership given a rid. */
609 static NTSTATUS
msrpc_lookup_groupmem(struct winbindd_domain
*domain
,
611 const struct dom_sid
*group_sid
,
612 enum lsa_SidType type
,
614 struct dom_sid
**sid_mem
,
616 uint32_t **name_types
)
618 NTSTATUS status
, result
;
619 uint32 i
, total_names
= 0;
620 struct policy_handle dom_pol
, group_pol
;
621 uint32 des_access
= SEC_FLAG_MAXIMUM_ALLOWED
;
622 uint32
*rid_mem
= NULL
;
625 struct rpc_pipe_client
*cli
;
626 unsigned int orig_timeout
;
627 struct samr_RidAttrArray
*rids
= NULL
;
628 struct dcerpc_binding_handle
*b
;
630 DEBUG(3,("msrpc_lookup_groupmem: %s sid=%s\n", domain
->name
,
631 sid_string_dbg(group_sid
)));
633 if ( !winbindd_can_contact_domain( domain
) ) {
634 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
639 if (!sid_peek_check_rid(&domain
->sid
, group_sid
, &group_rid
))
640 return NT_STATUS_UNSUCCESSFUL
;
644 result
= cm_connect_sam(domain
, mem_ctx
, &cli
, &dom_pol
);
645 if (!NT_STATUS_IS_OK(result
))
648 b
= cli
->binding_handle
;
650 status
= dcerpc_samr_OpenGroup(b
, mem_ctx
,
656 if (!NT_STATUS_IS_OK(status
)) {
659 if (!NT_STATUS_IS_OK(result
)) {
663 /* Step #1: Get a list of user rids that are the members of the
666 /* This call can take a long time - allow the server to time out.
667 35 seconds should do it. */
669 orig_timeout
= rpccli_set_timeout(cli
, 35000);
671 status
= dcerpc_samr_QueryGroupMember(b
, mem_ctx
,
676 /* And restore our original timeout. */
677 rpccli_set_timeout(cli
, orig_timeout
);
681 dcerpc_samr_Close(b
, mem_ctx
, &group_pol
, &_result
);
684 if (!NT_STATUS_IS_OK(status
)) {
688 if (!NT_STATUS_IS_OK(result
)) {
692 if (!rids
|| !rids
->count
) {
699 *num_names
= rids
->count
;
700 rid_mem
= rids
->rids
;
702 /* Step #2: Convert list of rids into list of usernames. Do this
703 in bunches of ~1000 to avoid crashing NT4. It looks like there
704 is a buffer overflow or something like that lurking around
707 #define MAX_LOOKUP_RIDS 900
709 *names
= talloc_zero_array(mem_ctx
, char *, *num_names
);
710 *name_types
= talloc_zero_array(mem_ctx
, uint32
, *num_names
);
711 *sid_mem
= talloc_zero_array(mem_ctx
, struct dom_sid
, *num_names
);
713 for (j
=0;j
<(*num_names
);j
++)
714 sid_compose(&(*sid_mem
)[j
], &domain
->sid
, rid_mem
[j
]);
716 if (*num_names
>0 && (!*names
|| !*name_types
))
717 return NT_STATUS_NO_MEMORY
;
719 for (i
= 0; i
< *num_names
; i
+= MAX_LOOKUP_RIDS
) {
720 int num_lookup_rids
= MIN(*num_names
- i
, MAX_LOOKUP_RIDS
);
721 struct lsa_Strings tmp_names
;
722 struct samr_Ids tmp_types
;
724 /* Lookup a chunk of rids */
726 status
= dcerpc_samr_LookupRids(b
, mem_ctx
,
733 if (!NT_STATUS_IS_OK(status
)) {
737 /* see if we have a real error (and yes the
738 STATUS_SOME_UNMAPPED is the one returned from 2k) */
740 if (!NT_STATUS_IS_OK(result
) &&
741 !NT_STATUS_EQUAL(result
, STATUS_SOME_UNMAPPED
))
744 /* Copy result into array. The talloc system will take
745 care of freeing the temporary arrays later on. */
747 if (tmp_names
.count
!= tmp_types
.count
) {
748 return NT_STATUS_UNSUCCESSFUL
;
751 for (r
=0; r
<tmp_names
.count
; r
++) {
752 if (tmp_types
.ids
[r
] == SID_NAME_UNKNOWN
) {
755 (*names
)[total_names
] = fill_domain_username_talloc(
756 mem_ctx
, domain
->name
,
757 tmp_names
.names
[r
].string
, true);
758 (*name_types
)[total_names
] = tmp_types
.ids
[r
];
763 *num_names
= total_names
;
772 static int get_ldap_seq(const char *server
, struct sockaddr_storage
*ss
, int port
, uint32
*seq
)
776 const char *attrs
[] = {"highestCommittedUSN", NULL
};
777 LDAPMessage
*res
= NULL
;
778 char **values
= NULL
;
781 *seq
= DOM_SEQUENCE_NONE
;
784 * Parameterised (5) second timeout on open. This is needed as the
785 * search timeout doesn't seem to apply to doing an open as well. JRA.
788 ldp
= ldap_open_with_timeout(server
, ss
, port
, lp_ldap_timeout());
792 /* Timeout if no response within 20 seconds. */
796 if (ldap_search_st(ldp
, "", LDAP_SCOPE_BASE
, "(objectclass=*)",
797 discard_const_p(char *, attrs
), 0, &to
, &res
))
800 if (ldap_count_entries(ldp
, res
) != 1)
803 values
= ldap_get_values(ldp
, res
, "highestCommittedUSN");
804 if (!values
|| !values
[0])
807 *seq
= atoi(values
[0]);
813 ldap_value_free(values
);
821 /**********************************************************************
822 Get the sequence number for a Windows AD native mode domain using
824 **********************************************************************/
826 static int get_ldap_sequence_number(struct winbindd_domain
*domain
, uint32
*seq
)
829 char addr
[INET6_ADDRSTRLEN
];
831 print_sockaddr(addr
, sizeof(addr
), &domain
->dcaddr
);
832 if ((ret
= get_ldap_seq(addr
, &domain
->dcaddr
, LDAP_PORT
, seq
)) == 0) {
833 DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
834 "number for Domain (%s) from DC (%s)\n",
835 domain
->name
, addr
));
840 #endif /* HAVE_LDAP */
842 /* find the sequence number for a domain */
843 static NTSTATUS
msrpc_sequence_number(struct winbindd_domain
*domain
,
846 struct rpc_pipe_client
*samr_pipe
;
847 struct policy_handle dom_pol
;
852 DEBUG(3, ("msrpc_sequence_number: fetch sequence_number for %s\n", domain
->name
));
855 *pseq
= DOM_SEQUENCE_NONE
;
858 tmp_ctx
= talloc_stackframe();
859 if (tmp_ctx
== NULL
) {
860 return NT_STATUS_NO_MEMORY
;
863 if ( !winbindd_can_contact_domain( domain
) ) {
864 DEBUG(10,("sequence_number: No incoming trust for domain %s\n",
869 status
= NT_STATUS_OK
;
874 if (domain
->active_directory
) {
877 DEBUG(8,("using get_ldap_seq() to retrieve the "
878 "sequence number\n"));
880 rc
= get_ldap_sequence_number(domain
, &seq
);
882 DEBUG(10,("domain_sequence_number: LDAP for "
890 status
= NT_STATUS_OK
;
894 DEBUG(10,("domain_sequence_number: failed to get LDAP "
895 "sequence number for domain %s\n",
898 #endif /* HAVE_LDAP */
900 status
= cm_connect_sam(domain
, tmp_ctx
, &samr_pipe
, &dom_pol
);
901 if (!NT_STATUS_IS_OK(status
)) {
905 status
= rpc_sequence_number(tmp_ctx
,
910 if (!NT_STATUS_IS_OK(status
)) {
919 TALLOC_FREE(tmp_ctx
);
923 /* get a list of trusted domains */
924 static NTSTATUS
msrpc_trusted_domains(struct winbindd_domain
*domain
,
926 struct netr_DomainTrustList
*ptrust_list
)
928 struct rpc_pipe_client
*lsa_pipe
;
929 struct policy_handle lsa_policy
;
930 struct netr_DomainTrust
*trusts
= NULL
;
931 uint32_t num_trusts
= 0;
935 DEBUG(3,("msrpc_trusted_domains\n"));
938 ZERO_STRUCTP(ptrust_list
);
941 tmp_ctx
= talloc_stackframe();
942 if (tmp_ctx
== NULL
) {
943 return NT_STATUS_NO_MEMORY
;
946 status
= cm_connect_lsa(domain
, tmp_ctx
, &lsa_pipe
, &lsa_policy
);
947 if (!NT_STATUS_IS_OK(status
))
950 status
= rpc_trusted_domains(tmp_ctx
,
955 if (!NT_STATUS_IS_OK(status
)) {
960 ptrust_list
->count
= num_trusts
;
961 ptrust_list
->array
= talloc_move(mem_ctx
, &trusts
);
965 TALLOC_FREE(tmp_ctx
);
969 /* find the lockout policy for a domain */
970 static NTSTATUS
msrpc_lockout_policy(struct winbindd_domain
*domain
,
972 struct samr_DomInfo12
*lockout_policy
)
974 NTSTATUS status
, result
;
975 struct rpc_pipe_client
*cli
;
976 struct policy_handle dom_pol
;
977 union samr_DomainInfo
*info
= NULL
;
978 struct dcerpc_binding_handle
*b
;
980 DEBUG(3, ("msrpc_lockout_policy: fetch lockout policy for %s\n", domain
->name
));
982 if ( !winbindd_can_contact_domain( domain
) ) {
983 DEBUG(10,("msrpc_lockout_policy: No incoming trust for domain %s\n",
985 return NT_STATUS_NOT_SUPPORTED
;
988 status
= cm_connect_sam(domain
, mem_ctx
, &cli
, &dom_pol
);
989 if (!NT_STATUS_IS_OK(status
)) {
993 b
= cli
->binding_handle
;
995 status
= dcerpc_samr_QueryDomainInfo(b
, mem_ctx
,
997 DomainLockoutInformation
,
1000 if (!NT_STATUS_IS_OK(status
)) {
1003 if (!NT_STATUS_IS_OK(result
)) {
1008 *lockout_policy
= info
->info12
;
1010 DEBUG(10,("msrpc_lockout_policy: lockout_threshold %d\n",
1011 info
->info12
.lockout_threshold
));
1018 /* find the password policy for a domain */
1019 static NTSTATUS
msrpc_password_policy(struct winbindd_domain
*domain
,
1020 TALLOC_CTX
*mem_ctx
,
1021 struct samr_DomInfo1
*password_policy
)
1023 NTSTATUS status
, result
;
1024 struct rpc_pipe_client
*cli
;
1025 struct policy_handle dom_pol
;
1026 union samr_DomainInfo
*info
= NULL
;
1027 struct dcerpc_binding_handle
*b
;
1029 DEBUG(3, ("msrpc_password_policy: fetch password policy for %s\n",
1032 if ( !winbindd_can_contact_domain( domain
) ) {
1033 DEBUG(10,("msrpc_password_policy: No incoming trust for domain %s\n",
1035 return NT_STATUS_NOT_SUPPORTED
;
1038 status
= cm_connect_sam(domain
, mem_ctx
, &cli
, &dom_pol
);
1039 if (!NT_STATUS_IS_OK(status
)) {
1043 b
= cli
->binding_handle
;
1045 status
= dcerpc_samr_QueryDomainInfo(b
, mem_ctx
,
1047 DomainPasswordInformation
,
1050 if (!NT_STATUS_IS_OK(status
)) {
1053 if (!NT_STATUS_IS_OK(result
)) {
1057 *password_policy
= info
->info1
;
1059 DEBUG(10,("msrpc_password_policy: min_length_password %d\n",
1060 info
->info1
.min_password_length
));
1067 typedef NTSTATUS (*lookup_sids_fn_t
)(struct dcerpc_binding_handle
*h
,
1068 TALLOC_CTX
*mem_ctx
,
1069 struct policy_handle
*pol
,
1071 const struct dom_sid
*sids
,
1074 enum lsa_SidType
**ptypes
,
1077 NTSTATUS
winbindd_lookup_sids(TALLOC_CTX
*mem_ctx
,
1078 struct winbindd_domain
*domain
,
1080 const struct dom_sid
*sids
,
1083 enum lsa_SidType
**types
)
1087 struct rpc_pipe_client
*cli
= NULL
;
1088 struct dcerpc_binding_handle
*b
= NULL
;
1089 struct policy_handle lsa_policy
;
1090 unsigned int orig_timeout
;
1091 lookup_sids_fn_t lookup_sids_fn
= dcerpc_lsa_lookup_sids
;
1093 if (domain
->can_do_ncacn_ip_tcp
) {
1094 status
= cm_connect_lsa_tcp(domain
, mem_ctx
, &cli
);
1095 if (NT_STATUS_IS_OK(status
)) {
1096 lookup_sids_fn
= dcerpc_lsa_lookup_sids3
;
1099 domain
->can_do_ncacn_ip_tcp
= false;
1101 status
= cm_connect_lsa(domain
, mem_ctx
, &cli
, &lsa_policy
);
1103 if (!NT_STATUS_IS_OK(status
)) {
1108 b
= cli
->binding_handle
;
1111 * This call can take a long time
1112 * allow the server to time out.
1113 * 35 seconds should do it.
1115 orig_timeout
= dcerpc_binding_handle_set_timeout(b
, 35000);
1117 status
= lookup_sids_fn(b
,
1127 /* And restore our original timeout. */
1128 dcerpc_binding_handle_set_timeout(b
, orig_timeout
);
1130 if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
) ||
1131 NT_STATUS_EQUAL(status
, NT_STATUS_RPC_SEC_PKG_ERROR
)) {
1133 * This can happen if the schannel key is not
1134 * valid anymore, we need to invalidate the
1135 * all connections to the dc and reestablish
1136 * a netlogon connection first.
1138 invalidate_cm_connection(&domain
->conn
);
1139 status
= NT_STATUS_ACCESS_DENIED
;
1142 if (!NT_STATUS_IS_OK(status
)) {
1146 if (!NT_STATUS_IS_OK(result
)) {
1150 return NT_STATUS_OK
;
1153 typedef NTSTATUS (*lookup_names_fn_t
)(struct dcerpc_binding_handle
*h
,
1154 TALLOC_CTX
*mem_ctx
,
1155 struct policy_handle
*pol
,
1158 const char ***dom_names
,
1159 enum lsa_LookupNamesLevel level
,
1160 struct dom_sid
**sids
,
1161 enum lsa_SidType
**types
,
1164 static NTSTATUS
winbindd_lookup_names(TALLOC_CTX
*mem_ctx
,
1165 struct winbindd_domain
*domain
,
1168 const char ***domains
,
1169 struct dom_sid
**sids
,
1170 enum lsa_SidType
**types
)
1174 struct rpc_pipe_client
*cli
= NULL
;
1175 struct dcerpc_binding_handle
*b
= NULL
;
1176 struct policy_handle lsa_policy
;
1177 unsigned int orig_timeout
= 0;
1178 lookup_names_fn_t lookup_names_fn
= dcerpc_lsa_lookup_names
;
1180 if (domain
->can_do_ncacn_ip_tcp
) {
1181 status
= cm_connect_lsa_tcp(domain
, mem_ctx
, &cli
);
1182 if (NT_STATUS_IS_OK(status
)) {
1183 lookup_names_fn
= dcerpc_lsa_lookup_names4
;
1186 domain
->can_do_ncacn_ip_tcp
= false;
1188 status
= cm_connect_lsa(domain
, mem_ctx
, &cli
, &lsa_policy
);
1190 if (!NT_STATUS_IS_OK(status
)) {
1195 b
= cli
->binding_handle
;
1198 * This call can take a long time
1199 * allow the server to time out.
1200 * 35 seconds should do it.
1202 orig_timeout
= dcerpc_binding_handle_set_timeout(b
, 35000);
1204 status
= lookup_names_fn(b
,
1208 (const char **) names
,
1215 /* And restore our original timeout. */
1216 dcerpc_binding_handle_set_timeout(b
, orig_timeout
);
1218 if (NT_STATUS_EQUAL(status
, NT_STATUS_ACCESS_DENIED
) ||
1219 NT_STATUS_EQUAL(status
, NT_STATUS_RPC_SEC_PKG_ERROR
)) {
1221 * This can happen if the schannel key is not
1222 * valid anymore, we need to invalidate the
1223 * all connections to the dc and reestablish
1224 * a netlogon connection first.
1226 invalidate_cm_connection(&domain
->conn
);
1227 status
= NT_STATUS_ACCESS_DENIED
;
1230 if (!NT_STATUS_IS_OK(status
)) {
1234 if (!NT_STATUS_IS_OK(result
)) {
1238 return NT_STATUS_OK
;
1241 /* the rpc backend methods are exposed via this structure */
1242 struct winbindd_methods msrpc_methods
= {
1244 msrpc_query_user_list
,
1245 msrpc_enum_dom_groups
,
1246 msrpc_enum_local_groups
,
1249 msrpc_rids_to_names
,
1251 msrpc_lookup_usergroups
,
1252 msrpc_lookup_useraliases
,
1253 msrpc_lookup_groupmem
,
1254 msrpc_sequence_number
,
1255 msrpc_lockout_policy
,
1256 msrpc_password_policy
,
1257 msrpc_trusted_domains
,