?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
r20099: Add some comments, and correct others.
[Samba/ekacnet.git] / source4 / libnet / libnet_join.c
blob3bd1a9783e89a4ccbe4cc610dfc1e969cb6b617b
1 /*
2 Unix SMB/CIFS implementation.
3
4 Copyright (C) Stefan Metzmacher 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
6 Copyright (C) Brad Henry 2005
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21 */
22
23 #include "includes.h"
24 #include "libnet/libnet.h"
25 #include "librpc/gen_ndr/ndr_drsuapi_c.h"
26 #include "lib/ldb/include/ldb.h"
27 #include "lib/ldb/include/ldb_errors.h"
28 #include "param/secrets.h"
29 #include "dsdb/samdb/samdb.h"
30 #include "db_wrap.h"
31 #include "libcli/security/security.h"
32 #include "auth/credentials/credentials.h"
33 #include "auth/credentials/credentials_krb5.h"
34 #include "librpc/gen_ndr/ndr_samr_c.h"
35
36 /*
37 * complete a domain join, when joining to a AD domain:
38 * 1.) connect and bind to the DRSUAPI pipe
39 * 2.) do a DsCrackNames() to find the machine account dn
40 * 3.) connect to LDAP
41 * 4.) do an ldap search to find the "msDS-KeyVersionNumber" of the machine account
42 * 5.) set the servicePrincipalName's of the machine account via LDAP, (maybe we should use DsWriteAccountSpn()...)
43 * 6.) do a DsCrackNames() to find the domain dn
44 * 7.) find out Site specific stuff, look at libnet_JoinSite() for details
45 */
46 static NTSTATUS libnet_JoinADSDomain(struct libnet_context *ctx, struct libnet_JoinDomain *r)
47 {
48 NTSTATUS status;
49
50 TALLOC_CTX *tmp_ctx;
51
52 const char *realm = r->out.realm;
53
54 struct dcerpc_binding *samr_binding = r->out.samr_binding;
55
56 struct dcerpc_pipe *drsuapi_pipe;
57 struct dcerpc_binding *drsuapi_binding;
58 struct drsuapi_DsBind r_drsuapi_bind;
59 struct drsuapi_DsCrackNames r_crack_names;
60 struct drsuapi_DsNameString names[1];
61 struct policy_handle drsuapi_bind_handle;
62 struct GUID drsuapi_bind_guid;
63
64 struct ldb_context *remote_ldb;
65 struct ldb_dn *account_dn;
66 const char *account_dn_str;
67 const char *remote_ldb_url;
68 struct ldb_result *res;
69 struct ldb_message *msg;
70
71 int ret, rtn;
72
73 unsigned int kvno;
74
75 const char * const attrs[] = {
76 "msDS-KeyVersionNumber",
77 "servicePrincipalName",
78 "dNSHostName",
79 NULL,
80 };
81
82 r->out.error_string = NULL;
83
84 /* We need to convert between a samAccountName and domain to a
85 * DN in the directory. The correct way to do this is with
86 * DRSUAPI CrackNames */
87
88 /* Fiddle with the bindings, so get to DRSUAPI on
89 * NCACN_IP_TCP, sealed */
90 tmp_ctx = talloc_named(r, 0, "libnet_JoinADSDomain temp context");
91 if (!tmp_ctx) {
92 r->out.error_string = NULL;
93 return NT_STATUS_NO_MEMORY;
94 }
95
96 drsuapi_binding = talloc(tmp_ctx, struct dcerpc_binding);
97 if (!drsuapi_binding) {
98 r->out.error_string = NULL;
99 talloc_free(tmp_ctx);
100 return NT_STATUS_NO_MEMORY;
101 }
102
103 *drsuapi_binding = *samr_binding;
104
105 /* DRSUAPI is only available on IP_TCP, and locally on NCALRPC */
106 if (drsuapi_binding->transport != NCALRPC) {
107 drsuapi_binding->transport = NCACN_IP_TCP;
108 }
109 drsuapi_binding->endpoint = NULL;
110 drsuapi_binding->flags |= DCERPC_SEAL;
111
112 status = dcerpc_pipe_connect_b(tmp_ctx,
113 &drsuapi_pipe,
114 drsuapi_binding,
115 &dcerpc_table_drsuapi,
116 ctx->cred,
117 ctx->event_ctx);
118 if (!NT_STATUS_IS_OK(status)) {
119 r->out.error_string = talloc_asprintf(r,
120 "Connection to DRSUAPI pipe of PDC of domain '%s' failed: %s",
121 r->in.domain_name,
122 nt_errstr(status));
123 talloc_free(tmp_ctx);
124 return status;
125 }
126
127 /* get a DRSUAPI pipe handle */
128 GUID_from_string(DRSUAPI_DS_BIND_GUID, &drsuapi_bind_guid);
129
130 r_drsuapi_bind.in.bind_guid = &drsuapi_bind_guid;
131 r_drsuapi_bind.in.bind_info = NULL;
132 r_drsuapi_bind.out.bind_handle = &drsuapi_bind_handle;
133
134 status = dcerpc_drsuapi_DsBind(drsuapi_pipe, tmp_ctx, &r_drsuapi_bind);
135 if (!NT_STATUS_IS_OK(status)) {
136 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
137 r->out.error_string
138 = talloc_asprintf(r,
139 "dcerpc_drsuapi_DsBind failed - %s",
140 dcerpc_errstr(tmp_ctx, drsuapi_pipe->last_fault_code));
141 talloc_free(tmp_ctx);
142 return status;
143 } else {
144 r->out.error_string
145 = talloc_asprintf(r,
146 "dcerpc_drsuapi_DsBind failed - %s",
147 nt_errstr(status));
148 talloc_free(tmp_ctx);
149 return status;
150 }
151 } else if (!W_ERROR_IS_OK(r_drsuapi_bind.out.result)) {
152 r->out.error_string
153 = talloc_asprintf(r,
154 "DsBind failed - %s",
155 win_errstr(r_drsuapi_bind.out.result));
156 talloc_free(tmp_ctx);
157 return NT_STATUS_UNSUCCESSFUL;
158 }
159
160 /* Actually 'crack' the names */
161 ZERO_STRUCT(r_crack_names);
162 r_crack_names.in.bind_handle = &drsuapi_bind_handle;
163 r_crack_names.in.level = 1;
164 r_crack_names.in.req.req1.unknown1 = 0x000004e4;
165 r_crack_names.in.req.req1.unknown2 = 0x00000407;
166 r_crack_names.in.req.req1.count = 1;
167 r_crack_names.in.req.req1.names = names;
168 r_crack_names.in.req.req1.format_flags = DRSUAPI_DS_NAME_FLAG_NO_FLAGS;
169 r_crack_names.in.req.req1.format_offered= DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY;
170 r_crack_names.in.req.req1.format_desired= DRSUAPI_DS_NAME_FORMAT_FQDN_1779;
171 names[0].str = dom_sid_string(tmp_ctx, r->out.account_sid);
172 if (!names[0].str) {
173 r->out.error_string = NULL;
174 talloc_free(tmp_ctx);
175 return NT_STATUS_NO_MEMORY;
176 }
177
178 status = dcerpc_drsuapi_DsCrackNames(drsuapi_pipe, tmp_ctx, &r_crack_names);
179 if (!NT_STATUS_IS_OK(status)) {
180 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
181 r->out.error_string
182 = talloc_asprintf(r,
183 "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
184 names[0].str,
185 dcerpc_errstr(tmp_ctx, drsuapi_pipe->last_fault_code));
186 talloc_free(tmp_ctx);
187 return status;
188 } else {
189 r->out.error_string
190 = talloc_asprintf(r,
191 "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
192 names[0].str,
193 nt_errstr(status));
194 talloc_free(tmp_ctx);
195 return status;
196 }
197 } else if (!W_ERROR_IS_OK(r_crack_names.out.result)) {
198 r->out.error_string
199 = talloc_asprintf(r,
200 "DsCrackNames failed - %s", win_errstr(r_crack_names.out.result));
201 talloc_free(tmp_ctx);
202 return NT_STATUS_UNSUCCESSFUL;
203 } else if (r_crack_names.out.level != 1
204 || !r_crack_names.out.ctr.ctr1
205 || r_crack_names.out.ctr.ctr1->count != 1) {
206 r->out.error_string = talloc_asprintf(r, "DsCrackNames failed");
207 talloc_free(tmp_ctx);
208 return NT_STATUS_INVALID_PARAMETER;
209 } else if (r_crack_names.out.ctr.ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) {
210 r->out.error_string = talloc_asprintf(r, "DsCrackNames failed: %d", r_crack_names.out.ctr.ctr1->array[0].status);
211 talloc_free(tmp_ctx);
212 return NT_STATUS_UNSUCCESSFUL;
213 } else if (r_crack_names.out.ctr.ctr1->array[0].result_name == NULL) {
214 r->out.error_string = talloc_asprintf(r, "DsCrackNames failed: no result name");
215 talloc_free(tmp_ctx);
216 return NT_STATUS_INVALID_PARAMETER;
217 }
218
219 /* Store the DN of our machine account. */
220 account_dn_str = r_crack_names.out.ctr.ctr1->array[0].result_name;
221
222 account_dn = ldb_dn_new(tmp_ctx, remote_ldb, account_dn_str);
223 if (! ldb_dn_validate(account_dn)) {
224 r->out.error_string = talloc_asprintf(r, "Invalid account dn: %s",
225 account_dn_str);
226 talloc_free(tmp_ctx);
227 return NT_STATUS_UNSUCCESSFUL;
228 }
229
230 /* Now we know the user's DN, open with LDAP, read and modify a few things */
231
232 remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s",
233 drsuapi_binding->target_hostname);
234 if (!remote_ldb_url) {
235 r->out.error_string = NULL;
236 talloc_free(tmp_ctx);
237 return NT_STATUS_NO_MEMORY;
238 }
239
240 remote_ldb = ldb_wrap_connect(tmp_ctx, remote_ldb_url,
241 NULL, ctx->cred, 0, NULL);
242 if (!remote_ldb) {
243 r->out.error_string = NULL;
244 talloc_free(tmp_ctx);
245 return NT_STATUS_UNSUCCESSFUL;
246 }
247
248 /* search for the user's record */
249 ret = ldb_search(remote_ldb, account_dn, LDB_SCOPE_BASE,
250 NULL, attrs, &res);
251 if (ret != LDB_SUCCESS) {
252 r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - %s",
253 account_dn_str, ldb_errstring(remote_ldb));
254 talloc_free(tmp_ctx);
255 return NT_STATUS_UNSUCCESSFUL;
256 }
257
258 talloc_steal(tmp_ctx, res);
259
260 if (res->count != 1) {
261 r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - found %d entries",
262 account_dn_str, res->count);
263 talloc_free(tmp_ctx);
264 return NT_STATUS_UNSUCCESSFUL;
265 }
266
267 /* If we have a kvno recorded in AD, we need it locally as well */
268 kvno = ldb_msg_find_attr_as_uint(res->msgs[0], "msDS-KeyVersionNumber", 0);
269
270 /* Prepare a new message, for the modify */
271 msg = ldb_msg_new(tmp_ctx);
272 if (!msg) {
273 r->out.error_string = NULL;
274 talloc_free(tmp_ctx);
275 return NT_STATUS_NO_MEMORY;
276 }
277 msg->dn = res->msgs[0]->dn;
278
279 {
280 int i;
281 const char *service_principal_name[6];
282 const char *dns_host_name = strlower_talloc(tmp_ctx,
283 talloc_asprintf(tmp_ctx,
284 "%s.%s",
285 r->in.netbios_name,
286 realm));
287
288 if (!dns_host_name) {
289 r->out.error_string = NULL;
290 talloc_free(tmp_ctx);
291 return NT_STATUS_NO_MEMORY;
292 }
293
294 service_principal_name[0] = talloc_asprintf(tmp_ctx, "host/%s", dns_host_name);
295 service_principal_name[1] = talloc_asprintf(tmp_ctx, "host/%s", strlower_talloc(tmp_ctx, r->in.netbios_name));
296 service_principal_name[2] = talloc_asprintf(tmp_ctx, "host/%s/%s", dns_host_name, realm);
297 service_principal_name[3] = talloc_asprintf(tmp_ctx, "host/%s/%s", strlower_talloc(tmp_ctx, r->in.netbios_name), realm);
298 service_principal_name[4] = talloc_asprintf(tmp_ctx, "host/%s/%s", dns_host_name, r->out.domain_name);
299 service_principal_name[5] = talloc_asprintf(tmp_ctx, "host/%s/%s", strlower_talloc(tmp_ctx, r->in.netbios_name), r->out.domain_name);
300
301 for (i=0; i < ARRAY_SIZE(service_principal_name); i++) {
302 if (!service_principal_name[i]) {
303 r->out.error_string = NULL;
304 talloc_free(tmp_ctx);
305 return NT_STATUS_NO_MEMORY;
306 }
307 rtn = samdb_msg_add_string(remote_ldb, tmp_ctx, msg, "servicePrincipalName", service_principal_name[i]);
308 if (rtn == -1) {
309 r->out.error_string = NULL;
310 talloc_free(tmp_ctx);
311 return NT_STATUS_NO_MEMORY;
312 }
313 }
314
315 rtn = samdb_msg_add_string(remote_ldb, tmp_ctx, msg, "dNSHostName", dns_host_name);
316 if (rtn == -1) {
317 r->out.error_string = NULL;
318 talloc_free(tmp_ctx);
319 return NT_STATUS_NO_MEMORY;
320 }
321
322 rtn = samdb_replace(remote_ldb, tmp_ctx, msg);
323 if (rtn != 0) {
324 r->out.error_string
325 = talloc_asprintf(r,
326 "Failed to replace entries on %s",
327 ldb_dn_get_linearized(msg->dn));
328 talloc_free(tmp_ctx);
329 return NT_STATUS_INTERNAL_DB_CORRUPTION;
330 }
331 }
332
333 /* DsCrackNames to find out the DN of the domain. */
334 r_crack_names.in.req.req1.format_offered = DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT;
335 r_crack_names.in.req.req1.format_desired = DRSUAPI_DS_NAME_FORMAT_FQDN_1779;
336 names[0].str = talloc_asprintf(tmp_ctx, "%s\\", r->out.domain_name);
337 if (!names[0].str) {
338 r->out.error_string = NULL;
339 talloc_free(tmp_ctx);
340 return NT_STATUS_NO_MEMORY;
341 }
342
343 status = dcerpc_drsuapi_DsCrackNames(drsuapi_pipe, tmp_ctx, &r_crack_names);
344 if (!NT_STATUS_IS_OK(status)) {
345 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
346 r->out.error_string
347 = talloc_asprintf(r,
348 "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
349 r->in.domain_name,
350 dcerpc_errstr(tmp_ctx, drsuapi_pipe->last_fault_code));
351 talloc_free(tmp_ctx);
352 return status;
353 } else {
354 r->out.error_string
355 = talloc_asprintf(r,
356 "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
357 r->in.domain_name,
358 nt_errstr(status));
359 talloc_free(tmp_ctx);
360 return status;
361 }
362 } else if (!W_ERROR_IS_OK(r_crack_names.out.result)) {
363 r->out.error_string
364 = talloc_asprintf(r,
365 "DsCrackNames failed - %s", win_errstr(r_crack_names.out.result));
366 talloc_free(tmp_ctx);
367 return NT_STATUS_UNSUCCESSFUL;
368 } else if (r_crack_names.out.level != 1
369 || !r_crack_names.out.ctr.ctr1
370 || r_crack_names.out.ctr.ctr1->count != 1
371 || !r_crack_names.out.ctr.ctr1->array[0].result_name
372 || r_crack_names.out.ctr.ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) {
373 r->out.error_string = talloc_asprintf(r, "DsCrackNames failed");
374 talloc_free(tmp_ctx);
375 return NT_STATUS_UNSUCCESSFUL;
376 }
377
378 /* Store the account DN. */
379 r->out.account_dn_str = account_dn_str;
380 talloc_steal(r, account_dn_str);
381
382 /* Store the domain DN. */
383 r->out.domain_dn_str = r_crack_names.out.ctr.ctr1->array[0].result_name;
384 talloc_steal(r, r_crack_names.out.ctr.ctr1->array[0].result_name);
385
386 r->out.kvno = kvno;
387
388 if (r->in.acct_type == ACB_SVRTRUST) {
389 status = libnet_JoinSite(remote_ldb, r);
390 }
391 talloc_free(tmp_ctx);
392
393 return status;
394 }
395
396 /*
397 * do a domain join using DCERPC/SAMR calls
398 * - connect to the LSA pipe, to try and find out information about the domain
399 * - create a secondary connection to SAMR pipe
400 * - do a samr_Connect to get a policy handle
401 * - do a samr_LookupDomain to get the domain sid
402 * - do a samr_OpenDomain to get a domain handle
403 * - do a samr_CreateAccount to try and get a new account
404 *
405 * If that fails, do:
406 * - do a samr_LookupNames to get the users rid
407 * - do a samr_OpenUser to get a user handle
408 * - potentially delete and recreate the user
409 * - assert the account is of the right type with samrQueryUserInfo
410 *
411 * - call libnet_SetPassword_samr_handle to set the password,
412 * and pass a samr_UserInfo21 struct to set full_name and the account flags
413 *
414 * - do some ADS specific things when we join as Domain Controller,
415 * look at libnet_joinADSDomain() for the details
416 */
417 NTSTATUS libnet_JoinDomain(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *r)
418 {
419 TALLOC_CTX *tmp_ctx;
420
421 NTSTATUS status, cu_status;
422
423 struct libnet_RpcConnect *connect_with_info;
424 struct dcerpc_pipe *samr_pipe;
425
426 struct samr_Connect sc;
427 struct policy_handle p_handle;
428 struct samr_OpenDomain od;
429 struct policy_handle d_handle;
430 struct samr_LookupNames ln;
431 struct samr_OpenUser ou;
432 struct samr_CreateUser2 cu;
433 struct policy_handle *u_handle = NULL;
434 struct samr_QueryUserInfo qui;
435 struct samr_UserInfo21 u_info21;
436 union libnet_SetPassword r2;
437 struct samr_GetUserPwInfo pwp;
438 struct lsa_String samr_account_name;
439
440 uint32_t acct_flags, old_acct_flags;
441 uint32_t rid, access_granted;
442 int policy_min_pw_len = 0;
443
444 struct dom_sid *account_sid = NULL;
445 const char *password_str = NULL;
446
447 r->out.error_string = NULL;
448 r2.samr_handle.out.error_string = NULL;
449
450 tmp_ctx = talloc_named(mem_ctx, 0, "libnet_Join temp context");
451 if (!tmp_ctx) {
452 r->out.error_string = NULL;
453 return NT_STATUS_NO_MEMORY;
454 }
455
456 u_handle = talloc(tmp_ctx, struct policy_handle);
457 if (!u_handle) {
458 r->out.error_string = NULL;
459 talloc_free(tmp_ctx);
460 return NT_STATUS_NO_MEMORY;
461 }
462
463 connect_with_info = talloc(tmp_ctx, struct libnet_RpcConnect);
464 if (!connect_with_info) {
465 r->out.error_string = NULL;
466 talloc_free(tmp_ctx);
467 return NT_STATUS_NO_MEMORY;
468 }
469
470 /* prepare connect to the SAMR pipe of PDC */
471 if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) {
472 connect_with_info->in.binding = NULL;
473 connect_with_info->in.name = r->in.domain_name;
474 } else {
475 connect_with_info->in.binding = r->in.binding;
476 connect_with_info->in.name = NULL;
477 }
478
479 /* This level makes a connection to the LSA pipe on the way,
480 * to get some useful bits of information about the domain */
481 connect_with_info->level = LIBNET_RPC_CONNECT_DC_INFO;
482 connect_with_info->in.dcerpc_iface = &dcerpc_table_samr;
483
484 /*
485 establish the SAMR connection
486 */
487 status = libnet_RpcConnect(ctx, tmp_ctx, connect_with_info);
488 if (!NT_STATUS_IS_OK(status)) {
489 if (r->in.binding) {
490 r->out.error_string = talloc_asprintf(mem_ctx,
491 "Connection to SAMR pipe of DC %s failed: %s",
492 r->in.binding, connect_with_info->out.error_string);
493 } else {
494 r->out.error_string = talloc_asprintf(mem_ctx,
495 "Connection to SAMR pipe of PDC for %s failed: %s",
496 r->in.domain_name, connect_with_info->out.error_string);
497 }
498 talloc_free(tmp_ctx);
499 return status;
500 }
501
502 samr_pipe = connect_with_info->out.dcerpc_pipe;
503
504 status = dcerpc_pipe_auth(tmp_ctx, &samr_pipe,
505 connect_with_info->out.dcerpc_pipe->binding,
506 &dcerpc_table_samr, ctx->cred);
507 if (!NT_STATUS_IS_OK(status)) {
508 r->out.error_string = talloc_asprintf(mem_ctx,
509 "SAMR bind failed: %s",
510 nt_errstr(status));
511 talloc_free(tmp_ctx);
512 return status;
513 }
514
515 /* prepare samr_Connect */
516 ZERO_STRUCT(p_handle);
517 sc.in.system_name = NULL;
518 sc.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
519 sc.out.connect_handle = &p_handle;
520
521 /* 2. do a samr_Connect to get a policy handle */
522 status = dcerpc_samr_Connect(samr_pipe, tmp_ctx, &sc);
523 if (!NT_STATUS_IS_OK(status)) {
524 r->out.error_string = talloc_asprintf(mem_ctx,
525 "samr_Connect failed: %s",
526 nt_errstr(status));
527 talloc_free(tmp_ctx);
528 return status;
529 }
530
531 /* If this is a connection on ncacn_ip_tcp to Win2k3 SP1, we don't get back this useful info */
532 if (!connect_with_info->out.domain_name) {
533 if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) {
534 connect_with_info->out.domain_name = talloc_strdup(tmp_ctx, r->in.domain_name);
535 } else {
536 /* Bugger, we just lost our way to automaticly find the domain name */
537 connect_with_info->out.domain_name = talloc_strdup(tmp_ctx, lp_workgroup());
538 }
539 }
540
541 /* Perhaps we didn't get a SID above, because we are against ncacn_ip_tcp */
542 if (!connect_with_info->out.domain_sid) {
543 struct lsa_String name;
544 struct samr_LookupDomain l;
545 name.string = connect_with_info->out.domain_name;
546 l.in.connect_handle = &p_handle;
547 l.in.domain_name = &name;
548
549 status = dcerpc_samr_LookupDomain(samr_pipe, tmp_ctx, &l);
550 if (!NT_STATUS_IS_OK(status)) {
551 r->out.error_string = talloc_asprintf(mem_ctx,
552 "SAMR LookupDomain failed: %s",
553 nt_errstr(status));
554 talloc_free(tmp_ctx);
555 return status;
556 }
557 connect_with_info->out.domain_sid = l.out.sid;
558 }
559
560 /* prepare samr_OpenDomain */
561 ZERO_STRUCT(d_handle);
562 od.in.connect_handle = &p_handle;
563 od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
564 od.in.sid = connect_with_info->out.domain_sid;
565 od.out.domain_handle = &d_handle;
566
567 /* do a samr_OpenDomain to get a domain handle */
568 status = dcerpc_samr_OpenDomain(samr_pipe, tmp_ctx, &od);
569 if (!NT_STATUS_IS_OK(status)) {
570 r->out.error_string = talloc_asprintf(mem_ctx,
571 "samr_OpenDomain for [%s] failed: %s",
572 dom_sid_string(tmp_ctx, connect_with_info->out.domain_sid),
573 nt_errstr(status));
574 talloc_free(tmp_ctx);
575 return status;
576 }
577
578 /* prepare samr_CreateUser2 */
579 ZERO_STRUCTP(u_handle);
580 cu.in.domain_handle = &d_handle;
581 cu.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
582 samr_account_name.string = r->in.account_name;
583 cu.in.account_name = &samr_account_name;
584 cu.in.acct_flags = r->in.acct_type;
585 cu.out.user_handle = u_handle;
586 cu.out.rid = &rid;
587 cu.out.access_granted = &access_granted;
588
589 /* do a samr_CreateUser2 to get an account handle, or an error */
590 cu_status = dcerpc_samr_CreateUser2(samr_pipe, tmp_ctx, &cu);
591 status = cu_status;
592 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
593 /* prepare samr_LookupNames */
594 ln.in.domain_handle = &d_handle;
595 ln.in.num_names = 1;
596 ln.in.names = talloc_array(tmp_ctx, struct lsa_String, 1);
597 if (!ln.in.names) {
598 r->out.error_string = NULL;
599 talloc_free(tmp_ctx);
600 return NT_STATUS_NO_MEMORY;
601 }
602 ln.in.names[0].string = r->in.account_name;
603
604 /* 5. do a samr_LookupNames to get the users rid */
605 status = dcerpc_samr_LookupNames(samr_pipe, tmp_ctx, &ln);
606 if (!NT_STATUS_IS_OK(status)) {
607 r->out.error_string = talloc_asprintf(mem_ctx,
608 "samr_LookupNames for [%s] failed: %s",
609 r->in.account_name,
610 nt_errstr(status));
611 talloc_free(tmp_ctx);
612 return status;
613 }
614
615 /* check if we got one RID for the user */
616 if (ln.out.rids.count != 1) {
617 r->out.error_string = talloc_asprintf(mem_ctx,
618 "samr_LookupNames for [%s] returns %d RIDs",
619 r->in.account_name, ln.out.rids.count);
620 talloc_free(tmp_ctx);
621 return NT_STATUS_INVALID_PARAMETER;
622 }
623
624 /* prepare samr_OpenUser */
625 ZERO_STRUCTP(u_handle);
626 ou.in.domain_handle = &d_handle;
627 ou.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
628 ou.in.rid = ln.out.rids.ids[0];
629 rid = ou.in.rid;
630 ou.out.user_handle = u_handle;
631
632 /* 6. do a samr_OpenUser to get a user handle */
633 status = dcerpc_samr_OpenUser(samr_pipe, tmp_ctx, &ou);
634 if (!NT_STATUS_IS_OK(status)) {
635 r->out.error_string = talloc_asprintf(mem_ctx,
636 "samr_OpenUser for [%s] failed: %s",
637 r->in.account_name,
638 nt_errstr(status));
639 talloc_free(tmp_ctx);
640 return status;
641 }
642
643 if (r->in.recreate_account) {
644 struct samr_DeleteUser d;
645 d.in.user_handle = u_handle;
646 d.out.user_handle = u_handle;
647 status = dcerpc_samr_DeleteUser(samr_pipe, mem_ctx, &d);
648 if (!NT_STATUS_IS_OK(status)) {
649 r->out.error_string = talloc_asprintf(mem_ctx,
650 "samr_DeleteUser (for recreate) of [%s] failed: %s",
651 r->in.account_name,
652 nt_errstr(status));
653 talloc_free(tmp_ctx);
654 return status;
655 }
656
657 /* We want to recreate, so delete and another samr_CreateUser2 */
658
659 /* &cu filled in above */
660 status = dcerpc_samr_CreateUser2(samr_pipe, tmp_ctx, &cu);
661 if (!NT_STATUS_IS_OK(status)) {
662 r->out.error_string = talloc_asprintf(mem_ctx,
663 "samr_CreateUser2 (recreate) for [%s] failed: %s",
664 r->in.account_name, nt_errstr(status));
665 talloc_free(tmp_ctx);
666 return status;
667 }
668 }
669 } else if (!NT_STATUS_IS_OK(status)) {
670 r->out.error_string = talloc_asprintf(mem_ctx,
671 "samr_CreateUser2 for [%s] failed: %s",
672 r->in.account_name, nt_errstr(status));
673 talloc_free(tmp_ctx);
674 return status;
675 }
676
677 /* prepare samr_QueryUserInfo (get flags) */
678 qui.in.user_handle = u_handle;
679 qui.in.level = 16;
680
681 status = dcerpc_samr_QueryUserInfo(samr_pipe, tmp_ctx, &qui);
682 if (!NT_STATUS_IS_OK(status)) {
683 r->out.error_string = talloc_asprintf(mem_ctx,
684 "samr_QueryUserInfo for [%s] failed: %s",
685 r->in.account_name,
686 nt_errstr(status));
687 talloc_free(tmp_ctx);
688 return status;
689 }
690
691 if (!qui.out.info) {
692 status = NT_STATUS_INVALID_PARAMETER;
693 r->out.error_string
694 = talloc_asprintf(mem_ctx,
695 "samr_QueryUserInfo failed to return qui.out.info for [%s]: %s",
696 r->in.account_name, nt_errstr(status));
697 talloc_free(tmp_ctx);
698 return status;
699 }
700
701 old_acct_flags = (qui.out.info->info16.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST | ACB_DOMTRUST));
702 /* Possibly bail if the account is of the wrong type */
703 if (old_acct_flags
704 != r->in.acct_type) {
705 const char *old_account_type, *new_account_type;
706 switch (old_acct_flags) {
707 case ACB_WSTRUST:
708 old_account_type = "domain member (member)";
709 break;
710 case ACB_SVRTRUST:
711 old_account_type = "domain controller (bdc)";
712 break;
713 case ACB_DOMTRUST:
714 old_account_type = "trusted domain";
715 break;
716 default:
717 return NT_STATUS_INVALID_PARAMETER;
718 }
719 switch (r->in.acct_type) {
720 case ACB_WSTRUST:
721 new_account_type = "domain member (member)";
722 break;
723 case ACB_SVRTRUST:
724 new_account_type = "domain controller (bdc)";
725 break;
726 case ACB_DOMTRUST:
727 new_account_type = "trusted domain";
728 break;
729 default:
730 return NT_STATUS_INVALID_PARAMETER;
731 }
732
733 if (!NT_STATUS_EQUAL(cu_status, NT_STATUS_USER_EXISTS)) {
734 /* We created a new user, but they didn't come out the right type?!? */
735 r->out.error_string
736 = talloc_asprintf(mem_ctx,
737 "We asked to create a new machine account (%s) of type %s, "
738 "but we got an account of type %s. This is unexpected. "
739 "Perhaps delete the account and try again.",
740 r->in.account_name, new_account_type, old_account_type);
741 talloc_free(tmp_ctx);
742 return NT_STATUS_INVALID_PARAMETER;
743 } else {
744 /* The account is of the wrong type, so bail */
745
746 /* TODO: We should allow a --force option to override, and redo this from the top setting r.in.recreate_account */
747 r->out.error_string
748 = talloc_asprintf(mem_ctx,
749 "The machine account (%s) already exists in the domain %s, "
750 "but is a %s. You asked to join as a %s. Please delete "
751 "the account and try again.",
752 r->in.account_name, connect_with_info->out.domain_name, old_account_type, new_account_type);
753 talloc_free(tmp_ctx);
754 return NT_STATUS_USER_EXISTS;
755 }
756 } else {
757 acct_flags = qui.out.info->info16.acct_flags;
758 }
759
760 acct_flags = (acct_flags & ~(ACB_DISABLED|ACB_PWNOTREQ));
761
762 /* Find out what password policy this user has */
763 pwp.in.user_handle = u_handle;
764
765 status = dcerpc_samr_GetUserPwInfo(samr_pipe, tmp_ctx, &pwp);
766 if (NT_STATUS_IS_OK(status)) {
767 policy_min_pw_len = pwp.out.info.min_password_length;
768 }
769
770 /* Grab a password of that minimum length */
771
772 password_str = generate_random_str(tmp_ctx, MAX(8, policy_min_pw_len));
773
774 /* set full_name and reset flags */
775 ZERO_STRUCT(u_info21);
776 u_info21.full_name.string = r->in.account_name;
777 u_info21.acct_flags = acct_flags;
778 u_info21.fields_present = SAMR_FIELD_FULL_NAME | SAMR_FIELD_ACCT_FLAGS;
779
780 r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
781 r2.samr_handle.in.account_name = r->in.account_name;
782 r2.samr_handle.in.newpassword = password_str;
783 r2.samr_handle.in.user_handle = u_handle;
784 r2.samr_handle.in.dcerpc_pipe = samr_pipe;
785 r2.samr_handle.in.info21 = &u_info21;
786
787 status = libnet_SetPassword(ctx, tmp_ctx, &r2);
788 if (!NT_STATUS_IS_OK(status)) {
789 r->out.error_string = talloc_steal(mem_ctx, r2.samr_handle.out.error_string);
790 talloc_free(tmp_ctx);
791 return status;
792 }
793
794 account_sid = dom_sid_add_rid(mem_ctx, connect_with_info->out.domain_sid, rid);
795 if (!account_sid) {
796 r->out.error_string = NULL;
797 talloc_free(tmp_ctx);
798 return NT_STATUS_NO_MEMORY;
799 }
800
801 /* Finish out by pushing various bits of status data out for the caller to use */
802 r->out.join_password = password_str;
803 talloc_steal(mem_ctx, r->out.join_password);
804
805 r->out.domain_sid = connect_with_info->out.domain_sid;
806 talloc_steal(mem_ctx, r->out.domain_sid);
807
808 r->out.account_sid = account_sid;
809 talloc_steal(mem_ctx, r->out.account_sid);
810
811 r->out.domain_name = connect_with_info->out.domain_name;
812 talloc_steal(mem_ctx, r->out.domain_name);
813 r->out.realm = connect_with_info->out.realm;
814 talloc_steal(mem_ctx, r->out.realm);
815 r->out.samr_pipe = samr_pipe;
816 talloc_steal(mem_ctx, samr_pipe);
817 r->out.samr_binding = samr_pipe->binding;
818 talloc_steal(mem_ctx, r->out.samr_binding);
819 r->out.user_handle = u_handle;
820 talloc_steal(mem_ctx, u_handle);
821 r->out.error_string = r2.samr_handle.out.error_string;
822 talloc_steal(mem_ctx, r2.samr_handle.out.error_string);
823 r->out.kvno = 0;
824 r->out.server_dn_str = NULL;
825 talloc_free(tmp_ctx);
826
827 /* Now, if it was AD, then we want to start looking changing a
828 * few more things. Otherwise, we are done. */
829 if (r->out.realm) {
830 status = libnet_JoinADSDomain(ctx, r);
831 return status;
832 }
833
834 return status;
835 }
836
837 static NTSTATUS libnet_Join_primary_domain(struct libnet_context *ctx,
838 TALLOC_CTX *mem_ctx,
839 struct libnet_Join *r)
840 {
841 NTSTATUS status;
842 TALLOC_CTX *tmp_mem;
843 struct libnet_JoinDomain *r2;
844 int ret, rtn;
845 struct ldb_context *ldb;
846 struct ldb_dn *base_dn;
847 struct ldb_message **msgs, *msg;
848 const char *sct;
849 const char * const attrs[] = {
850 "whenChanged",
851 "secret",
852 "priorSecret",
853 "priorChanged",
854 "krb5Keytab",
855 "privateKeytab",
856 NULL
857 };
858 uint32_t acct_type = 0;
859 const char *account_name;
860 const char *netbios_name;
861 char *filter;
862
863 r->out.error_string = NULL;
864
865 tmp_mem = talloc_new(mem_ctx);
866 if (!tmp_mem) {
867 return NT_STATUS_NO_MEMORY;
868 }
869
870 r2 = talloc(tmp_mem, struct libnet_JoinDomain);
871 if (!r2) {
872 r->out.error_string = NULL;
873 talloc_free(tmp_mem);
874 return NT_STATUS_NO_MEMORY;
875 }
876
877 if (r->in.join_type == SEC_CHAN_BDC) {
878 acct_type = ACB_SVRTRUST;
879 } else if (r->in.join_type == SEC_CHAN_WKSTA) {
880 acct_type = ACB_WSTRUST;
881 } else {
882 r->out.error_string = NULL;
883 talloc_free(tmp_mem);
884 return NT_STATUS_INVALID_PARAMETER;
885 }
886
887 if (r->in.netbios_name != NULL) {
888 netbios_name = r->in.netbios_name;
889 } else {
890 netbios_name = talloc_reference(tmp_mem, lp_netbios_name());
891 if (!netbios_name) {
892 r->out.error_string = NULL;
893 talloc_free(tmp_mem);
894 return NT_STATUS_NO_MEMORY;
895 }
896 }
897
898 account_name = talloc_asprintf(tmp_mem, "%s$", netbios_name);
899 if (!account_name) {
900 r->out.error_string = NULL;
901 talloc_free(tmp_mem);
902 return NT_STATUS_NO_MEMORY;
903 }
904
905 /*
906 * Local secrets are stored in secrets.ldb
907 * open it to make sure we can write the info into it after the join
908 */
909 ldb = secrets_db_connect(tmp_mem);
910 if (!ldb) {
911 r->out.error_string
912 = talloc_asprintf(mem_ctx,
913 "Could not open secrets database");
914 talloc_free(tmp_mem);
915 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
916 }
917
918 /*
919 * join the domain
920 */
921 ZERO_STRUCTP(r2);
922 r2->in.domain_name = r->in.domain_name;
923 r2->in.account_name = account_name;
924 r2->in.netbios_name = netbios_name;
925 r2->in.level = LIBNET_JOINDOMAIN_AUTOMATIC;
926 r2->in.acct_type = acct_type;
927 r2->in.recreate_account = False;
928 status = libnet_JoinDomain(ctx, r2, r2);
929 if (!NT_STATUS_IS_OK(status)) {
930 r->out.error_string = talloc_steal(mem_ctx, r2->out.error_string);
931 talloc_free(tmp_mem);
932 return status;
933 }
934
935 /*
936 * now prepare the record for secrets.ldb
937 */
938 sct = talloc_asprintf(tmp_mem, "%d", r->in.join_type);
939 if (!sct) {
940 r->out.error_string = NULL;
941 talloc_free(tmp_mem);
942 return NT_STATUS_NO_MEMORY;
943 }
944
945 msg = ldb_msg_new(tmp_mem);
946 if (!msg) {
947 r->out.error_string = NULL;
948 talloc_free(tmp_mem);
949 return NT_STATUS_NO_MEMORY;
950 }
951
952 base_dn = ldb_dn_new(tmp_mem, ldb, "cn=Primary Domains");
953 if (!base_dn) {
954 r->out.error_string = NULL;
955 talloc_free(tmp_mem);
956 return NT_STATUS_NO_MEMORY;
957 }
958
959 msg->dn = ldb_dn_copy(tmp_mem, base_dn);
960 if ( ! ldb_dn_add_child_fmt(msg->dn, "flatname=%s", r2->out.domain_name)) {
961 r->out.error_string = NULL;
962 talloc_free(tmp_mem);
963 return NT_STATUS_NO_MEMORY;
964 }
965
966 rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "flatname", r2->out.domain_name);
967 if (rtn == -1) {
968 r->out.error_string = NULL;
969 talloc_free(tmp_mem);
970 return NT_STATUS_NO_MEMORY;
971 }
972
973 if (r2->out.realm) {
974 rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "realm", r2->out.realm);
975 if (rtn == -1) {
976 r->out.error_string = NULL;
977 talloc_free(tmp_mem);
978 return NT_STATUS_NO_MEMORY;
979 }
980
981 rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "objectClass", "primaryDomain");
982 if (rtn == -1) {
983 r->out.error_string = NULL;
984 talloc_free(tmp_mem);
985 return NT_STATUS_NO_MEMORY;
986 }
987 }
988
989 rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "objectClass", "primaryDomain");
990 if (rtn == -1) {
991 r->out.error_string = NULL;
992 talloc_free(tmp_mem);
993 return NT_STATUS_NO_MEMORY;
994 }
995
996 rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "secret", r2->out.join_password);
997 if (rtn == -1) {
998 r->out.error_string = NULL;
999 talloc_free(tmp_mem);
1000 return NT_STATUS_NO_MEMORY;
1001 }
1002
1003 rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "samAccountName", r2->in.account_name);
1004 if (rtn == -1) {
1005 r->out.error_string = NULL;
1006 talloc_free(tmp_mem);
1007 return NT_STATUS_NO_MEMORY;
1008 }
1009
1010 rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "secureChannelType", sct);
1011 if (rtn == -1) {
1012 r->out.error_string = NULL;
1013 talloc_free(tmp_mem);
1014 return NT_STATUS_NO_MEMORY;
1015 }
1016
1017 if (r2->out.kvno) {
1018 rtn = samdb_msg_add_uint(ldb, tmp_mem, msg, "msDS-KeyVersionNumber",
1019 r2->out.kvno);
1020 if (rtn == -1) {
1021 r->out.error_string = NULL;
1022 talloc_free(tmp_mem);
1023 return NT_STATUS_NO_MEMORY;
1024 }
1025 }
1026
1027 if (r2->out.domain_sid) {
1028 rtn = samdb_msg_add_dom_sid(ldb, tmp_mem, msg, "objectSid",
1029 r2->out.domain_sid);
1030 if (rtn == -1) {
1031 r->out.error_string = NULL;
1032 talloc_free(tmp_mem);
1033 return NT_STATUS_NO_MEMORY;
1034 }
1035 }
1036
1037 /*
1038 * search for the secret record
1039 * - remove the records we find
1040 * - and fetch the old secret and store it under priorSecret
1041 */
1042 ret = gendb_search(ldb,
1043 tmp_mem, base_dn,
1044 &msgs, attrs,
1045 "(|" SECRETS_PRIMARY_DOMAIN_FILTER "(realm=%s))",
1046 r2->out.domain_name, r2->out.realm);
1047 if (ret == 0) {
1048 rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secretsKeytab", "secrets.keytab");
1049 if (rtn == -1) {
1050 r->out.error_string = NULL;
1051 talloc_free(tmp_mem);
1052 return NT_STATUS_NO_MEMORY;
1053 }
1054 } else if (ret == -1) {
1055 r->out.error_string
1056 = talloc_asprintf(mem_ctx,
1057 "Search for domain: %s and realm: %s failed: %s",
1058 r2->out.domain_name, r2->out.realm, ldb_errstring(ldb));
1059 talloc_free(tmp_mem);
1060 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1061 } else {
1062 const struct ldb_val *private_keytab;
1063 const struct ldb_val *krb5_keytab;
1064 const struct ldb_val *prior_secret;
1065 const struct ldb_val *prior_modified_time;
1066 int i;
1067
1068 for (i = 0; i < ret; i++) {
1069 ldb_delete(ldb, msgs[i]->dn);
1070 }
1071
1072 prior_secret = ldb_msg_find_ldb_val(msgs[0], "secret");
1073 if (prior_secret) {
1074 rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "priorSecret", prior_secret);
1075 if (rtn == -1) {
1076 r->out.error_string = NULL;
1077 talloc_free(tmp_mem);
1078 return NT_STATUS_NO_MEMORY;
1079 }
1080 }
1081 rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secret", r2->out.join_password);
1082 if (rtn == -1) {
1083 r->out.error_string = NULL;
1084 talloc_free(tmp_mem);
1085 return NT_STATUS_NO_MEMORY;
1086 }
1087
1088 prior_modified_time = ldb_msg_find_ldb_val(msgs[0],
1089 "whenChanged");
1090 if (prior_modified_time) {
1091 rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "priorWhenChanged",
1092 prior_modified_time);
1093 if (rtn == -1) {
1094 r->out.error_string = NULL;
1095 talloc_free(tmp_mem);
1096 return NT_STATUS_NO_MEMORY;
1097 }
1098 }
1099
1100 rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "samAccountName", r2->in.account_name);
1101 if (rtn == -1) {
1102 r->out.error_string = NULL;
1103 talloc_free(tmp_mem);
1104 return NT_STATUS_NO_MEMORY;
1105 }
1106
1107 rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secureChannelType", sct);
1108 if (rtn == -1) {
1109 r->out.error_string = NULL;
1110 talloc_free(tmp_mem);
1111 return NT_STATUS_NO_MEMORY;
1112 }
1113
1114 /* We will want to keep the keytab names */
1115 private_keytab = ldb_msg_find_ldb_val(msgs[0], "privateKeytab");
1116 if (private_keytab) {
1117 rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "privateKeytab", private_keytab);
1118 if (rtn == -1) {
1119 r->out.error_string = NULL;
1120 talloc_free(tmp_mem);
1121 return NT_STATUS_NO_MEMORY;
1122 }
1123 }
1124 krb5_keytab = ldb_msg_find_ldb_val(msgs[0], "krb5Keytab");
1125 if (krb5_keytab) {
1126 rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "krb5Keytab", krb5_keytab);
1127 if (rtn == -1) {
1128 r->out.error_string = NULL;
1129 talloc_free(tmp_mem);
1130 return NT_STATUS_NO_MEMORY;
1131 }
1132 }
1133 }
1134
1135 /* create the secret */
1136 ret = samdb_add(ldb, tmp_mem, msg);
1137 if (ret != 0) {
1138 r->out.error_string = talloc_asprintf(mem_ctx, "Failed to create secret record %s",
1139 ldb_dn_get_linearized(msg->dn));
1140 talloc_free(tmp_mem);
1141 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1142 }
1143
1144 if (r2->out.realm) {
1145 struct cli_credentials *creds;
1146 /* Make a credentials structure from it */
1147 creds = cli_credentials_init(mem_ctx);
1148 if (!creds) {
1149 r->out.error_string = NULL;
1150 talloc_free(tmp_mem);
1151 return NT_STATUS_NO_MEMORY;
1152 }
1153 cli_credentials_set_conf(creds);
1154 filter = talloc_asprintf(mem_ctx, "dn=%s", ldb_dn_get_linearized(msg->dn));
1155 status = cli_credentials_set_secrets(creds, NULL, filter);
1156 if (!NT_STATUS_IS_OK(status)) {
1157 r->out.error_string = talloc_asprintf(mem_ctx, "Failed to read secrets for keytab update for %s",
1158 filter);
1159 talloc_free(tmp_mem);
1160 return status;
1161 }
1162 ret = cli_credentials_update_keytab(creds);
1163 if (ret != 0) {
1164 r->out.error_string = talloc_asprintf(mem_ctx, "Failed to update keytab for %s",
1165 filter);
1166 talloc_free(tmp_mem);
1167 return NT_STATUS_UNSUCCESSFUL;
1168 }
1169 }
1170
1171 /* move all out parameter to the callers TALLOC_CTX */
1172 r->out.error_string = NULL;
1173 r->out.join_password = r2->out.join_password;
1174 talloc_steal(mem_ctx, r2->out.join_password);
1175 r->out.domain_sid = r2->out.domain_sid;
1176 talloc_steal(mem_ctx, r2->out.domain_sid);
1177 r->out.domain_name = r2->out.domain_name;
1178 talloc_steal(mem_ctx, r2->out.domain_name);
1179 talloc_free(tmp_mem);
1180 return NT_STATUS_OK;
1181 }
1182
1183 NTSTATUS libnet_Join(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_Join *r)
1184 {
1185 switch (r->in.join_type) {
1186 case SEC_CHAN_WKSTA:
1187 return libnet_Join_primary_domain(ctx, mem_ctx, r);
1188 case SEC_CHAN_BDC:
1189 return libnet_Join_primary_domain(ctx, mem_ctx, r);
1190 case SEC_CHAN_DOMAIN:
1191 break;
1192 }
1193
1194 r->out.error_string = talloc_asprintf(mem_ctx,
1195 "Invalid join type specified (%08X) attempting to join domain %s",
1196 r->in.join_type, r->in.domain_name);
1197 return NT_STATUS_INVALID_PARAMETER;
1198 }