?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:configure: search fdatasync also in librt
[Samba/ekacnet.git] / source3 / libnet / libnet_join.c
blob5271c910ddafcf84766ca40f8aba1ee96aacf720
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "libnet/libnet.h"
23 #include "libcli/auth/libcli_auth.h"
24 #include "../librpc/gen_ndr/cli_samr.h"
25 #include "../librpc/gen_ndr/cli_lsa.h"
26 #include "../librpc/gen_ndr/cli_netlogon.h"
27
28 /****************************************************************
29 ****************************************************************/
30
31 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
32 do { \
33 char *str = NULL; \
34 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
35 DEBUG(1,("libnet_Join:\n%s", str)); \
36 TALLOC_FREE(str); \
37 } while (0)
38
39 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
40 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
41 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
42 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
43
44 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
45 do { \
46 char *str = NULL; \
47 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
48 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
49 TALLOC_FREE(str); \
50 } while (0)
51
52 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
53 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
54 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
55 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
56
57 /****************************************************************
58 ****************************************************************/
59
60 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
61 struct libnet_JoinCtx *r,
62 const char *format, ...)
63 {
64 va_list args;
65
66 if (r->out.error_string) {
67 return;
68 }
69
70 va_start(args, format);
71 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
72 va_end(args);
73 }
74
75 /****************************************************************
76 ****************************************************************/
77
78 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
79 struct libnet_UnjoinCtx *r,
80 const char *format, ...)
81 {
82 va_list args;
83
84 if (r->out.error_string) {
85 return;
86 }
87
88 va_start(args, format);
89 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
90 va_end(args);
91 }
92
93 #ifdef WITH_ADS
94
95 /****************************************************************
96 ****************************************************************/
97
98 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
99 const char *netbios_domain_name,
100 const char *dc_name,
101 const char *user_name,
102 const char *password,
103 ADS_STRUCT **ads)
104 {
105 ADS_STATUS status;
106 ADS_STRUCT *my_ads = NULL;
107
108 my_ads = ads_init(dns_domain_name,
109 netbios_domain_name,
110 dc_name);
111 if (!my_ads) {
112 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
113 }
114
115 if (user_name) {
116 SAFE_FREE(my_ads->auth.user_name);
117 my_ads->auth.user_name = SMB_STRDUP(user_name);
118 }
119
120 if (password) {
121 SAFE_FREE(my_ads->auth.password);
122 my_ads->auth.password = SMB_STRDUP(password);
123 }
124
125 status = ads_connect_user_creds(my_ads);
126 if (!ADS_ERR_OK(status)) {
127 ads_destroy(&my_ads);
128 return status;
129 }
130
131 *ads = my_ads;
132 return ADS_SUCCESS;
133 }
134
135 /****************************************************************
136 ****************************************************************/
137
138 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
139 struct libnet_JoinCtx *r)
140 {
141 ADS_STATUS status;
142
143 status = libnet_connect_ads(r->out.dns_domain_name,
144 r->out.netbios_domain_name,
145 r->in.dc_name,
146 r->in.admin_account,
147 r->in.admin_password,
148 &r->in.ads);
149 if (!ADS_ERR_OK(status)) {
150 libnet_join_set_error_string(mem_ctx, r,
151 "failed to connect to AD: %s",
152 ads_errstr(status));
153 return status;
154 }
155
156 if (!r->out.netbios_domain_name) {
157 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
158 r->in.ads->server.workgroup);
159 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
160 }
161
162 if (!r->out.dns_domain_name) {
163 r->out.dns_domain_name = talloc_strdup(mem_ctx,
164 r->in.ads->config.realm);
165 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
166 }
167
168 r->out.domain_is_ad = true;
169
170 return ADS_SUCCESS;
171 }
172
173 /****************************************************************
174 ****************************************************************/
175
176 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
177 struct libnet_UnjoinCtx *r)
178 {
179 ADS_STATUS status;
180
181 status = libnet_connect_ads(r->in.domain_name,
182 r->in.domain_name,
183 r->in.dc_name,
184 r->in.admin_account,
185 r->in.admin_password,
186 &r->in.ads);
187 if (!ADS_ERR_OK(status)) {
188 libnet_unjoin_set_error_string(mem_ctx, r,
189 "failed to connect to AD: %s",
190 ads_errstr(status));
191 }
192
193 return status;
194 }
195
196 /****************************************************************
197 join a domain using ADS (LDAP mods)
198 ****************************************************************/
199
200 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
201 struct libnet_JoinCtx *r)
202 {
203 ADS_STATUS status;
204 LDAPMessage *res = NULL;
205 const char *attrs[] = { "dn", NULL };
206 bool moved = false;
207
208 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
209 if (!ADS_ERR_OK(status)) {
210 return status;
211 }
212
213 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
214 if (!ADS_ERR_OK(status)) {
215 return status;
216 }
217
218 if (ads_count_replies(r->in.ads, res) != 1) {
219 ads_msgfree(r->in.ads, res);
220 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
221 }
222
223 ads_msgfree(r->in.ads, res);
224
225 /* Attempt to create the machine account and bail if this fails.
226 Assume that the admin wants exactly what they requested */
227
228 status = ads_create_machine_acct(r->in.ads,
229 r->in.machine_name,
230 r->in.account_ou);
231
232 if (ADS_ERR_OK(status)) {
233 DEBUG(1,("machine account creation created\n"));
234 return status;
235 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
236 (status.err.rc == LDAP_ALREADY_EXISTS)) {
237 status = ADS_SUCCESS;
238 }
239
240 if (!ADS_ERR_OK(status)) {
241 DEBUG(1,("machine account creation failed\n"));
242 return status;
243 }
244
245 status = ads_move_machine_acct(r->in.ads,
246 r->in.machine_name,
247 r->in.account_ou,
248 &moved);
249 if (!ADS_ERR_OK(status)) {
250 DEBUG(1,("failure to locate/move pre-existing "
251 "machine account\n"));
252 return status;
253 }
254
255 DEBUG(1,("The machine account %s the specified OU.\n",
256 moved ? "was moved into" : "already exists in"));
257
258 return status;
259 }
260
261 /****************************************************************
262 ****************************************************************/
263
264 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
265 struct libnet_UnjoinCtx *r)
266 {
267 ADS_STATUS status;
268
269 if (!r->in.ads) {
270 status = libnet_unjoin_connect_ads(mem_ctx, r);
271 if (!ADS_ERR_OK(status)) {
272 libnet_unjoin_set_error_string(mem_ctx, r,
273 "failed to connect to AD: %s",
274 ads_errstr(status));
275 return status;
276 }
277 }
278
279 status = ads_leave_realm(r->in.ads, r->in.machine_name);
280 if (!ADS_ERR_OK(status)) {
281 libnet_unjoin_set_error_string(mem_ctx, r,
282 "failed to leave realm: %s",
283 ads_errstr(status));
284 return status;
285 }
286
287 return ADS_SUCCESS;
288 }
289
290 /****************************************************************
291 ****************************************************************/
292
293 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
294 struct libnet_JoinCtx *r)
295 {
296 ADS_STATUS status;
297 LDAPMessage *res = NULL;
298 char *dn = NULL;
299
300 if (!r->in.machine_name) {
301 return ADS_ERROR(LDAP_NO_MEMORY);
302 }
303
304 status = ads_find_machine_acct(r->in.ads,
305 &res,
306 r->in.machine_name);
307 if (!ADS_ERR_OK(status)) {
308 return status;
309 }
310
311 if (ads_count_replies(r->in.ads, res) != 1) {
312 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
313 goto done;
314 }
315
316 dn = ads_get_dn(r->in.ads, mem_ctx, res);
317 if (!dn) {
318 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
319 goto done;
320 }
321
322 r->out.dn = talloc_strdup(mem_ctx, dn);
323 if (!r->out.dn) {
324 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
325 goto done;
326 }
327
328 done:
329 ads_msgfree(r->in.ads, res);
330 TALLOC_FREE(dn);
331
332 return status;
333 }
334
335 /****************************************************************
336 Set a machines dNSHostName and servicePrincipalName attributes
337 ****************************************************************/
338
339 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
340 struct libnet_JoinCtx *r)
341 {
342 ADS_STATUS status;
343 ADS_MODLIST mods;
344 fstring my_fqdn;
345 const char *spn_array[3] = {NULL, NULL, NULL};
346 char *spn = NULL;
347
348 /* Find our DN */
349
350 status = libnet_join_find_machine_acct(mem_ctx, r);
351 if (!ADS_ERR_OK(status)) {
352 return status;
353 }
354
355 /* Windows only creates HOST/shortname & HOST/fqdn. */
356
357 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
358 if (!spn) {
359 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
360 }
361 strupper_m(spn);
362 spn_array[0] = spn;
363
364 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
365 || (strchr(my_fqdn, '.') == NULL)) {
366 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
367 r->out.dns_domain_name);
368 }
369
370 strlower_m(my_fqdn);
371
372 if (!strequal(my_fqdn, r->in.machine_name)) {
373 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
374 if (!spn) {
375 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
376 }
377 spn_array[1] = spn;
378 }
379
380 mods = ads_init_mods(mem_ctx);
381 if (!mods) {
382 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
383 }
384
385 /* fields of primary importance */
386
387 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
388 if (!ADS_ERR_OK(status)) {
389 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
390 }
391
392 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
393 spn_array);
394 if (!ADS_ERR_OK(status)) {
395 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
396 }
397
398 return ads_gen_mod(r->in.ads, r->out.dn, mods);
399 }
400
401 /****************************************************************
402 ****************************************************************/
403
404 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
405 struct libnet_JoinCtx *r)
406 {
407 ADS_STATUS status;
408 ADS_MODLIST mods;
409
410 if (!r->in.create_upn) {
411 return ADS_SUCCESS;
412 }
413
414 /* Find our DN */
415
416 status = libnet_join_find_machine_acct(mem_ctx, r);
417 if (!ADS_ERR_OK(status)) {
418 return status;
419 }
420
421 if (!r->in.upn) {
422 r->in.upn = talloc_asprintf(mem_ctx,
423 "host/%s@%s",
424 r->in.machine_name,
425 r->out.dns_domain_name);
426 if (!r->in.upn) {
427 return ADS_ERROR(LDAP_NO_MEMORY);
428 }
429 }
430
431 /* now do the mods */
432
433 mods = ads_init_mods(mem_ctx);
434 if (!mods) {
435 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
436 }
437
438 /* fields of primary importance */
439
440 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
441 if (!ADS_ERR_OK(status)) {
442 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
443 }
444
445 return ads_gen_mod(r->in.ads, r->out.dn, mods);
446 }
447
448
449 /****************************************************************
450 ****************************************************************/
451
452 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
453 struct libnet_JoinCtx *r)
454 {
455 ADS_STATUS status;
456 ADS_MODLIST mods;
457 char *os_sp = NULL;
458
459 if (!r->in.os_name || !r->in.os_version ) {
460 return ADS_SUCCESS;
461 }
462
463 /* Find our DN */
464
465 status = libnet_join_find_machine_acct(mem_ctx, r);
466 if (!ADS_ERR_OK(status)) {
467 return status;
468 }
469
470 /* now do the mods */
471
472 mods = ads_init_mods(mem_ctx);
473 if (!mods) {
474 return ADS_ERROR(LDAP_NO_MEMORY);
475 }
476
477 os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
478 if (!os_sp) {
479 return ADS_ERROR(LDAP_NO_MEMORY);
480 }
481
482 /* fields of primary importance */
483
484 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
485 r->in.os_name);
486 if (!ADS_ERR_OK(status)) {
487 return status;
488 }
489
490 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
491 r->in.os_version);
492 if (!ADS_ERR_OK(status)) {
493 return status;
494 }
495
496 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
497 os_sp);
498 if (!ADS_ERR_OK(status)) {
499 return status;
500 }
501
502 return ads_gen_mod(r->in.ads, r->out.dn, mods);
503 }
504
505 /****************************************************************
506 ****************************************************************/
507
508 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
509 struct libnet_JoinCtx *r)
510 {
511 if (!USE_SYSTEM_KEYTAB) {
512 return true;
513 }
514
515 if (ads_keytab_create_default(r->in.ads) != 0) {
516 return false;
517 }
518
519 return true;
520 }
521
522 /****************************************************************
523 ****************************************************************/
524
525 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
526 struct libnet_JoinCtx *r)
527 {
528 uint32_t domain_func;
529 ADS_STATUS status;
530 const char *salt = NULL;
531 char *std_salt = NULL;
532
533 status = ads_domain_func_level(r->in.ads, &domain_func);
534 if (!ADS_ERR_OK(status)) {
535 libnet_join_set_error_string(mem_ctx, r,
536 "failed to determine domain functional level: %s",
537 ads_errstr(status));
538 return false;
539 }
540
541 /* go ahead and setup the default salt */
542
543 std_salt = kerberos_standard_des_salt();
544 if (!std_salt) {
545 libnet_join_set_error_string(mem_ctx, r,
546 "failed to obtain standard DES salt");
547 return false;
548 }
549
550 salt = talloc_strdup(mem_ctx, std_salt);
551 if (!salt) {
552 return false;
553 }
554
555 SAFE_FREE(std_salt);
556
557 /* if it's a Windows functional domain, we have to look for the UPN */
558
559 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
560 char *upn;
561
562 upn = ads_get_upn(r->in.ads, mem_ctx,
563 r->in.machine_name);
564 if (upn) {
565 salt = talloc_strdup(mem_ctx, upn);
566 if (!salt) {
567 return false;
568 }
569 }
570 }
571
572 return kerberos_secrets_store_des_salt(salt);
573 }
574
575 /****************************************************************
576 ****************************************************************/
577
578 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
579 struct libnet_JoinCtx *r)
580 {
581 ADS_STATUS status;
582
583 if (!r->in.ads) {
584 status = libnet_join_connect_ads(mem_ctx, r);
585 if (!ADS_ERR_OK(status)) {
586 return status;
587 }
588 }
589
590 status = libnet_join_set_machine_spn(mem_ctx, r);
591 if (!ADS_ERR_OK(status)) {
592 libnet_join_set_error_string(mem_ctx, r,
593 "failed to set machine spn: %s",
594 ads_errstr(status));
595 return status;
596 }
597
598 status = libnet_join_set_os_attributes(mem_ctx, r);
599 if (!ADS_ERR_OK(status)) {
600 libnet_join_set_error_string(mem_ctx, r,
601 "failed to set machine os attributes: %s",
602 ads_errstr(status));
603 return status;
604 }
605
606 status = libnet_join_set_machine_upn(mem_ctx, r);
607 if (!ADS_ERR_OK(status)) {
608 libnet_join_set_error_string(mem_ctx, r,
609 "failed to set machine upn: %s",
610 ads_errstr(status));
611 return status;
612 }
613
614 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
615 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
616 }
617
618 if (!libnet_join_create_keytab(mem_ctx, r)) {
619 libnet_join_set_error_string(mem_ctx, r,
620 "failed to create kerberos keytab");
621 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
622 }
623
624 return ADS_SUCCESS;
625 }
626 #endif /* WITH_ADS */
627
628 /****************************************************************
629 Store the machine password and domain SID
630 ****************************************************************/
631
632 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
633 struct libnet_JoinCtx *r)
634 {
635 if (!secrets_store_domain_sid(r->out.netbios_domain_name,
636 r->out.domain_sid))
637 {
638 DEBUG(1,("Failed to save domain sid\n"));
639 return false;
640 }
641
642 if (!secrets_store_machine_password(r->in.machine_password,
643 r->out.netbios_domain_name,
644 r->in.secure_channel_type))
645 {
646 DEBUG(1,("Failed to save machine password\n"));
647 return false;
648 }
649
650 return true;
651 }
652
653 /****************************************************************
654 Connect dc's IPC$ share
655 ****************************************************************/
656
657 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
658 const char *user,
659 const char *pass,
660 bool use_kerberos,
661 struct cli_state **cli)
662 {
663 int flags = 0;
664
665 if (use_kerberos) {
666 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
667 }
668
669 if (use_kerberos && pass) {
670 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
671 }
672
673 return cli_full_connection(cli, NULL,
674 dc,
675 NULL, 0,
676 "IPC$", "IPC",
677 user,
678 NULL,
679 pass,
680 flags,
681 Undefined, NULL);
682 }
683
684 /****************************************************************
685 Lookup domain dc's info
686 ****************************************************************/
687
688 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
689 struct libnet_JoinCtx *r,
690 struct cli_state **cli)
691 {
692 struct rpc_pipe_client *pipe_hnd = NULL;
693 struct policy_handle lsa_pol;
694 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
695 union lsa_PolicyInformation *info = NULL;
696
697 status = libnet_join_connect_dc_ipc(r->in.dc_name,
698 r->in.admin_account,
699 r->in.admin_password,
700 r->in.use_kerberos,
701 cli);
702 if (!NT_STATUS_IS_OK(status)) {
703 goto done;
704 }
705
706 status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
707 &pipe_hnd);
708 if (!NT_STATUS_IS_OK(status)) {
709 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
710 nt_errstr(status)));
711 goto done;
712 }
713
714 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
715 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
716 if (!NT_STATUS_IS_OK(status)) {
717 goto done;
718 }
719
720 status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
721 &lsa_pol,
722 LSA_POLICY_INFO_DNS,
723 &info);
724 if (NT_STATUS_IS_OK(status)) {
725 r->out.domain_is_ad = true;
726 r->out.netbios_domain_name = info->dns.name.string;
727 r->out.dns_domain_name = info->dns.dns_domain.string;
728 r->out.forest_name = info->dns.dns_forest.string;
729 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->dns.sid);
730 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
731 }
732
733 if (!NT_STATUS_IS_OK(status)) {
734 status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
735 &lsa_pol,
736 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
737 &info);
738 if (!NT_STATUS_IS_OK(status)) {
739 goto done;
740 }
741
742 r->out.netbios_domain_name = info->account_domain.name.string;
743 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->account_domain.sid);
744 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
745 }
746
747 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
748 TALLOC_FREE(pipe_hnd);
749
750 done:
751 return status;
752 }
753
754 /****************************************************************
755 Do the domain join unsecure
756 ****************************************************************/
757
758 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
759 struct libnet_JoinCtx *r,
760 struct cli_state *cli)
761 {
762 struct rpc_pipe_client *pipe_hnd = NULL;
763 unsigned char orig_trust_passwd_hash[16];
764 unsigned char new_trust_passwd_hash[16];
765 fstring trust_passwd;
766 NTSTATUS status;
767
768 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
769 &pipe_hnd);
770 if (!NT_STATUS_IS_OK(status)) {
771 return status;
772 }
773
774 if (!r->in.machine_password) {
775 r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
776 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
777 }
778
779 E_md4hash(r->in.machine_password, new_trust_passwd_hash);
780
781 /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
782 fstrcpy(trust_passwd, r->in.admin_password);
783 strlower_m(trust_passwd);
784
785 /*
786 * Machine names can be 15 characters, but the max length on
787 * a password is 14. --jerry
788 */
789
790 trust_passwd[14] = '\0';
791
792 E_md4hash(trust_passwd, orig_trust_passwd_hash);
793
794 status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
795 r->in.machine_name,
796 orig_trust_passwd_hash,
797 r->in.machine_password,
798 new_trust_passwd_hash,
799 r->in.secure_channel_type);
800
801 return status;
802 }
803
804 /****************************************************************
805 Do the domain join
806 ****************************************************************/
807
808 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
809 struct libnet_JoinCtx *r,
810 struct cli_state *cli)
811 {
812 struct rpc_pipe_client *pipe_hnd = NULL;
813 struct policy_handle sam_pol, domain_pol, user_pol;
814 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
815 char *acct_name;
816 struct lsa_String lsa_acct_name;
817 uint32_t user_rid;
818 uint32_t acct_flags = ACB_WSTRUST;
819 struct samr_Ids user_rids;
820 struct samr_Ids name_types;
821 union samr_UserInfo user_info;
822
823 struct samr_CryptPassword crypt_pwd;
824 struct samr_CryptPasswordEx crypt_pwd_ex;
825
826 ZERO_STRUCT(sam_pol);
827 ZERO_STRUCT(domain_pol);
828 ZERO_STRUCT(user_pol);
829
830 switch (r->in.secure_channel_type) {
831 case SEC_CHAN_WKSTA:
832 acct_flags = ACB_WSTRUST;
833 break;
834 case SEC_CHAN_BDC:
835 acct_flags = ACB_SVRTRUST;
836 break;
837 default:
838 return NT_STATUS_INVALID_PARAMETER;
839 }
840
841 if (!r->in.machine_password) {
842 r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
843 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
844 }
845
846 /* Open the domain */
847
848 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
849 &pipe_hnd);
850 if (!NT_STATUS_IS_OK(status)) {
851 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
852 nt_errstr(status)));
853 goto done;
854 }
855
856 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
857 pipe_hnd->desthost,
858 SAMR_ACCESS_ENUM_DOMAINS
859 | SAMR_ACCESS_LOOKUP_DOMAIN,
860 &sam_pol);
861 if (!NT_STATUS_IS_OK(status)) {
862 goto done;
863 }
864
865 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
866 &sam_pol,
867 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
868 | SAMR_DOMAIN_ACCESS_CREATE_USER
869 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
870 r->out.domain_sid,
871 &domain_pol);
872 if (!NT_STATUS_IS_OK(status)) {
873 goto done;
874 }
875
876 /* Create domain user */
877
878 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
879 strlower_m(acct_name);
880
881 init_lsa_String(&lsa_acct_name, acct_name);
882
883 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
884 uint32_t access_desired =
885 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
886 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
887 SAMR_USER_ACCESS_SET_PASSWORD |
888 SAMR_USER_ACCESS_GET_ATTRIBUTES |
889 SAMR_USER_ACCESS_SET_ATTRIBUTES;
890 uint32_t access_granted = 0;
891
892 DEBUG(10,("Creating account with desired access mask: %d\n",
893 access_desired));
894
895 status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
896 &domain_pol,
897 &lsa_acct_name,
898 acct_flags,
899 access_desired,
900 &user_pol,
901 &access_granted,
902 &user_rid);
903 if (!NT_STATUS_IS_OK(status) &&
904 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
905
906 DEBUG(10,("Creation of workstation account failed: %s\n",
907 nt_errstr(status)));
908
909 /* If NT_STATUS_ACCESS_DENIED then we have a valid
910 username/password combo but the user does not have
911 administrator access. */
912
913 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
914 libnet_join_set_error_string(mem_ctx, r,
915 "User specified does not have "
916 "administrator privileges");
917 }
918
919 goto done;
920 }
921
922 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
923 if (!(r->in.join_flags &
924 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
925 goto done;
926 }
927 }
928
929 /* We *must* do this.... don't ask... */
930
931 if (NT_STATUS_IS_OK(status)) {
932 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
933 }
934 }
935
936 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
937 &domain_pol,
938 1,
939 &lsa_acct_name,
940 &user_rids,
941 &name_types);
942 if (!NT_STATUS_IS_OK(status)) {
943 goto done;
944 }
945
946 if (name_types.ids[0] != SID_NAME_USER) {
947 DEBUG(0,("%s is not a user account (type=%d)\n",
948 acct_name, name_types.ids[0]));
949 status = NT_STATUS_INVALID_WORKSTATION;
950 goto done;
951 }
952
953 user_rid = user_rids.ids[0];
954
955 /* Open handle on user */
956
957 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
958 &domain_pol,
959 SEC_FLAG_MAXIMUM_ALLOWED,
960 user_rid,
961 &user_pol);
962 if (!NT_STATUS_IS_OK(status)) {
963 goto done;
964 }
965
966 /* Fill in the additional account flags now */
967
968 acct_flags |= ACB_PWNOEXP;
969 if (r->out.domain_is_ad) {
970 #if !defined(ENCTYPE_ARCFOUR_HMAC)
971 acct_flags |= ACB_USE_DES_KEY_ONLY;
972 #endif
973 ;;
974 }
975
976 /* Set account flags on machine account */
977 ZERO_STRUCT(user_info.info16);
978 user_info.info16.acct_flags = acct_flags;
979
980 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
981 &user_pol,
982 16,
983 &user_info);
984
985 if (!NT_STATUS_IS_OK(status)) {
986
987 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
988 &user_pol);
989
990 libnet_join_set_error_string(mem_ctx, r,
991 "Failed to set account flags for machine account (%s)\n",
992 nt_errstr(status));
993 goto done;
994 }
995
996 /* Set password on machine account - first try level 26 */
997
998 init_samr_CryptPasswordEx(r->in.machine_password,
999 &cli->user_session_key,
1000 &crypt_pwd_ex);
1001
1002 user_info.info26.password = crypt_pwd_ex;
1003 user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1004
1005 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
1006 &user_pol,
1007 26,
1008 &user_info);
1009
1010 if (NT_STATUS_EQUAL(status, NT_STATUS(DCERPC_FAULT_INVALID_TAG))) {
1011
1012 /* retry with level 24 */
1013
1014 init_samr_CryptPassword(r->in.machine_password,
1015 &cli->user_session_key,
1016 &crypt_pwd);
1017
1018 user_info.info24.password = crypt_pwd;
1019 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1020
1021 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
1022 &user_pol,
1023 24,
1024 &user_info);
1025 }
1026
1027 if (!NT_STATUS_IS_OK(status)) {
1028
1029 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
1030 &user_pol);
1031
1032 libnet_join_set_error_string(mem_ctx, r,
1033 "Failed to set password for machine account (%s)\n",
1034 nt_errstr(status));
1035 goto done;
1036 }
1037
1038 status = NT_STATUS_OK;
1039
1040 done:
1041 if (!pipe_hnd) {
1042 return status;
1043 }
1044
1045 if (is_valid_policy_hnd(&sam_pol)) {
1046 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1047 }
1048 if (is_valid_policy_hnd(&domain_pol)) {
1049 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1050 }
1051 if (is_valid_policy_hnd(&user_pol)) {
1052 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1053 }
1054 TALLOC_FREE(pipe_hnd);
1055
1056 return status;
1057 }
1058
1059 /****************************************************************
1060 ****************************************************************/
1061
1062 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1063 const char *machine_name,
1064 const char *dc_name)
1065 {
1066 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1067 struct cli_state *cli = NULL;
1068 struct rpc_pipe_client *pipe_hnd = NULL;
1069 struct rpc_pipe_client *netlogon_pipe = NULL;
1070 NTSTATUS status;
1071 char *machine_password = NULL;
1072 char *machine_account = NULL;
1073
1074 if (!dc_name) {
1075 return NT_STATUS_INVALID_PARAMETER;
1076 }
1077
1078 if (!secrets_init()) {
1079 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1080 }
1081
1082 machine_password = secrets_fetch_machine_password(netbios_domain_name,
1083 NULL, NULL);
1084 if (!machine_password) {
1085 return NT_STATUS_NO_TRUST_LSA_SECRET;
1086 }
1087
1088 if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1089 SAFE_FREE(machine_password);
1090 return NT_STATUS_NO_MEMORY;
1091 }
1092
1093 status = cli_full_connection(&cli, NULL,
1094 dc_name,
1095 NULL, 0,
1096 "IPC$", "IPC",
1097 machine_account,
1098 NULL,
1099 machine_password,
1100 0,
1101 Undefined, NULL);
1102 free(machine_account);
1103 free(machine_password);
1104
1105 if (!NT_STATUS_IS_OK(status)) {
1106 status = cli_full_connection(&cli, NULL,
1107 dc_name,
1108 NULL, 0,
1109 "IPC$", "IPC",
1110 "",
1111 NULL,
1112 "",
1113 0,
1114 Undefined, NULL);
1115 }
1116
1117 if (!NT_STATUS_IS_OK(status)) {
1118 return status;
1119 }
1120
1121 status = get_schannel_session_key(cli, netbios_domain_name,
1122 &neg_flags, &netlogon_pipe);
1123 if (!NT_STATUS_IS_OK(status)) {
1124 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1125 cli_shutdown(cli);
1126 return NT_STATUS_OK;
1127 }
1128
1129 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1130 "key from server %s for domain %s. Error was %s\n",
1131 cli->desthost, netbios_domain_name, nt_errstr(status)));
1132 cli_shutdown(cli);
1133 return status;
1134 }
1135
1136 if (!lp_client_schannel()) {
1137 cli_shutdown(cli);
1138 return NT_STATUS_OK;
1139 }
1140
1141 status = cli_rpc_pipe_open_schannel_with_key(
1142 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1143 DCERPC_AUTH_LEVEL_PRIVACY,
1144 netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
1145
1146 cli_shutdown(cli);
1147
1148 if (!NT_STATUS_IS_OK(status)) {
1149 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1150 "on netlogon pipe to server %s for domain %s. "
1151 "Error was %s\n",
1152 cli->desthost, netbios_domain_name, nt_errstr(status)));
1153 return status;
1154 }
1155
1156 return NT_STATUS_OK;
1157 }
1158
1159 /****************************************************************
1160 ****************************************************************/
1161
1162 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1163 struct libnet_JoinCtx *r)
1164 {
1165 NTSTATUS status;
1166
1167 status = libnet_join_ok(r->out.netbios_domain_name,
1168 r->in.machine_name,
1169 r->in.dc_name);
1170 if (!NT_STATUS_IS_OK(status)) {
1171 libnet_join_set_error_string(mem_ctx, r,
1172 "failed to verify domain membership after joining: %s",
1173 get_friendly_nt_error_msg(status));
1174 return WERR_SETUP_NOT_JOINED;
1175 }
1176
1177 return WERR_OK;
1178 }
1179
1180 /****************************************************************
1181 ****************************************************************/
1182
1183 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1184 struct libnet_UnjoinCtx *r)
1185 {
1186 if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1187 return false;
1188 }
1189
1190 if (!secrets_delete_domain_sid(lp_workgroup())) {
1191 return false;
1192 }
1193
1194 return true;
1195 }
1196
1197 /****************************************************************
1198 ****************************************************************/
1199
1200 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1201 struct libnet_UnjoinCtx *r)
1202 {
1203 struct cli_state *cli = NULL;
1204 struct rpc_pipe_client *pipe_hnd = NULL;
1205 struct policy_handle sam_pol, domain_pol, user_pol;
1206 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1207 char *acct_name;
1208 uint32_t user_rid;
1209 struct lsa_String lsa_acct_name;
1210 struct samr_Ids user_rids;
1211 struct samr_Ids name_types;
1212 union samr_UserInfo *info = NULL;
1213
1214 ZERO_STRUCT(sam_pol);
1215 ZERO_STRUCT(domain_pol);
1216 ZERO_STRUCT(user_pol);
1217
1218 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1219 r->in.admin_account,
1220 r->in.admin_password,
1221 r->in.use_kerberos,
1222 &cli);
1223 if (!NT_STATUS_IS_OK(status)) {
1224 goto done;
1225 }
1226
1227 /* Open the domain */
1228
1229 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1230 &pipe_hnd);
1231 if (!NT_STATUS_IS_OK(status)) {
1232 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1233 nt_errstr(status)));
1234 goto done;
1235 }
1236
1237 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1238 pipe_hnd->desthost,
1239 SEC_FLAG_MAXIMUM_ALLOWED,
1240 &sam_pol);
1241 if (!NT_STATUS_IS_OK(status)) {
1242 goto done;
1243 }
1244
1245 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1246 &sam_pol,
1247 SEC_FLAG_MAXIMUM_ALLOWED,
1248 r->in.domain_sid,
1249 &domain_pol);
1250 if (!NT_STATUS_IS_OK(status)) {
1251 goto done;
1252 }
1253
1254 /* Create domain user */
1255
1256 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1257 strlower_m(acct_name);
1258
1259 init_lsa_String(&lsa_acct_name, acct_name);
1260
1261 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1262 &domain_pol,
1263 1,
1264 &lsa_acct_name,
1265 &user_rids,
1266 &name_types);
1267
1268 if (!NT_STATUS_IS_OK(status)) {
1269 goto done;
1270 }
1271
1272 if (name_types.ids[0] != SID_NAME_USER) {
1273 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1274 name_types.ids[0]));
1275 status = NT_STATUS_INVALID_WORKSTATION;
1276 goto done;
1277 }
1278
1279 user_rid = user_rids.ids[0];
1280
1281 /* Open handle on user */
1282
1283 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1284 &domain_pol,
1285 SEC_FLAG_MAXIMUM_ALLOWED,
1286 user_rid,
1287 &user_pol);
1288 if (!NT_STATUS_IS_OK(status)) {
1289 goto done;
1290 }
1291
1292 /* Get user info */
1293
1294 status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1295 &user_pol,
1296 16,
1297 &info);
1298 if (!NT_STATUS_IS_OK(status)) {
1299 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1300 goto done;
1301 }
1302
1303 /* now disable and setuser info */
1304
1305 info->info16.acct_flags |= ACB_DISABLED;
1306
1307 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1308 &user_pol,
1309 16,
1310 info);
1311
1312 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1313
1314 done:
1315 if (pipe_hnd) {
1316 if (is_valid_policy_hnd(&domain_pol)) {
1317 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1318 }
1319 if (is_valid_policy_hnd(&sam_pol)) {
1320 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1321 }
1322 TALLOC_FREE(pipe_hnd);
1323 }
1324
1325 if (cli) {
1326 cli_shutdown(cli);
1327 }
1328
1329 return status;
1330 }
1331
1332 /****************************************************************
1333 ****************************************************************/
1334
1335 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1336 {
1337 WERROR werr;
1338 struct smbconf_ctx *ctx;
1339
1340 werr = smbconf_init_reg(r, &ctx, NULL);
1341 if (!W_ERROR_IS_OK(werr)) {
1342 goto done;
1343 }
1344
1345 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1346
1347 werr = smbconf_set_global_parameter(ctx, "security", "user");
1348 W_ERROR_NOT_OK_GOTO_DONE(werr);
1349
1350 werr = smbconf_set_global_parameter(ctx, "workgroup",
1351 r->in.domain_name);
1352
1353 smbconf_delete_global_parameter(ctx, "realm");
1354 goto done;
1355 }
1356
1357 werr = smbconf_set_global_parameter(ctx, "security", "domain");
1358 W_ERROR_NOT_OK_GOTO_DONE(werr);
1359
1360 werr = smbconf_set_global_parameter(ctx, "workgroup",
1361 r->out.netbios_domain_name);
1362 W_ERROR_NOT_OK_GOTO_DONE(werr);
1363
1364 if (r->out.domain_is_ad) {
1365 werr = smbconf_set_global_parameter(ctx, "security", "ads");
1366 W_ERROR_NOT_OK_GOTO_DONE(werr);
1367
1368 werr = smbconf_set_global_parameter(ctx, "realm",
1369 r->out.dns_domain_name);
1370 W_ERROR_NOT_OK_GOTO_DONE(werr);
1371 }
1372
1373 done:
1374 smbconf_shutdown(ctx);
1375 return werr;
1376 }
1377
1378 /****************************************************************
1379 ****************************************************************/
1380
1381 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1382 {
1383 WERROR werr = WERR_OK;
1384 struct smbconf_ctx *ctx;
1385
1386 werr = smbconf_init_reg(r, &ctx, NULL);
1387 if (!W_ERROR_IS_OK(werr)) {
1388 goto done;
1389 }
1390
1391 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1392
1393 werr = smbconf_set_global_parameter(ctx, "security", "user");
1394 W_ERROR_NOT_OK_GOTO_DONE(werr);
1395
1396 werr = smbconf_delete_global_parameter(ctx, "workgroup");
1397 W_ERROR_NOT_OK_GOTO_DONE(werr);
1398
1399 smbconf_delete_global_parameter(ctx, "realm");
1400 }
1401
1402 done:
1403 smbconf_shutdown(ctx);
1404 return werr;
1405 }
1406
1407 /****************************************************************
1408 ****************************************************************/
1409
1410 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1411 {
1412 WERROR werr;
1413
1414 if (!W_ERROR_IS_OK(r->out.result)) {
1415 return r->out.result;
1416 }
1417
1418 if (!r->in.modify_config) {
1419 return WERR_OK;
1420 }
1421
1422 werr = do_join_modify_vals_config(r);
1423 if (!W_ERROR_IS_OK(werr)) {
1424 return werr;
1425 }
1426
1427 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1428
1429 r->out.modified_config = true;
1430 r->out.result = werr;
1431
1432 return werr;
1433 }
1434
1435 /****************************************************************
1436 ****************************************************************/
1437
1438 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1439 {
1440 WERROR werr;
1441
1442 if (!W_ERROR_IS_OK(r->out.result)) {
1443 return r->out.result;
1444 }
1445
1446 if (!r->in.modify_config) {
1447 return WERR_OK;
1448 }
1449
1450 werr = do_unjoin_modify_vals_config(r);
1451 if (!W_ERROR_IS_OK(werr)) {
1452 return werr;
1453 }
1454
1455 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1456
1457 r->out.modified_config = true;
1458 r->out.result = werr;
1459
1460 return werr;
1461 }
1462
1463 /****************************************************************
1464 ****************************************************************/
1465
1466 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1467 const char *domain_str,
1468 const char **domain_p,
1469 const char **dc_p)
1470 {
1471 char *domain = NULL;
1472 char *dc = NULL;
1473 const char *p = NULL;
1474
1475 if (!domain_str || !domain_p || !dc_p) {
1476 return false;
1477 }
1478
1479 p = strchr_m(domain_str, '\\');
1480
1481 if (p != NULL) {
1482 domain = talloc_strndup(mem_ctx, domain_str,
1483 PTR_DIFF(p, domain_str));
1484 dc = talloc_strdup(mem_ctx, p+1);
1485 if (!dc) {
1486 return false;
1487 }
1488 } else {
1489 domain = talloc_strdup(mem_ctx, domain_str);
1490 dc = NULL;
1491 }
1492 if (!domain) {
1493 return false;
1494 }
1495
1496 *domain_p = domain;
1497
1498 if (!*dc_p && dc) {
1499 *dc_p = dc;
1500 }
1501
1502 return true;
1503 }
1504
1505 /****************************************************************
1506 ****************************************************************/
1507
1508 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1509 struct libnet_JoinCtx *r)
1510 {
1511 if (!r->in.domain_name) {
1512 libnet_join_set_error_string(mem_ctx, r,
1513 "No domain name defined");
1514 return WERR_INVALID_PARAM;
1515 }
1516
1517 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1518 &r->in.domain_name,
1519 &r->in.dc_name)) {
1520 libnet_join_set_error_string(mem_ctx, r,
1521 "Failed to parse domain name");
1522 return WERR_INVALID_PARAM;
1523 }
1524
1525 if (IS_DC) {
1526 return WERR_SETUP_DOMAIN_CONTROLLER;
1527 }
1528
1529 if (!secrets_init()) {
1530 libnet_join_set_error_string(mem_ctx, r,
1531 "Unable to open secrets database");
1532 return WERR_CAN_NOT_COMPLETE;
1533 }
1534
1535 return WERR_OK;
1536 }
1537
1538 /****************************************************************
1539 ****************************************************************/
1540
1541 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1542 {
1543 NTSTATUS status;
1544
1545 /* Try adding dom admins to builtin\admins. Only log failures. */
1546 status = create_builtin_administrators(domain_sid);
1547 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1548 DEBUG(10,("Unable to auto-add domain administrators to "
1549 "BUILTIN\\Administrators during join because "
1550 "winbindd must be running."));
1551 } else if (!NT_STATUS_IS_OK(status)) {
1552 DEBUG(5, ("Failed to auto-add domain administrators to "
1553 "BUILTIN\\Administrators during join: %s\n",
1554 nt_errstr(status)));
1555 }
1556
1557 /* Try adding dom users to builtin\users. Only log failures. */
1558 status = create_builtin_users(domain_sid);
1559 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1560 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1561 "during join because winbindd must be running."));
1562 } else if (!NT_STATUS_IS_OK(status)) {
1563 DEBUG(5, ("Failed to auto-add domain administrators to "
1564 "BUILTIN\\Administrators during join: %s\n",
1565 nt_errstr(status)));
1566 }
1567 }
1568
1569 /****************************************************************
1570 ****************************************************************/
1571
1572 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1573 struct libnet_JoinCtx *r)
1574 {
1575 WERROR werr;
1576
1577 if (!W_ERROR_IS_OK(r->out.result)) {
1578 return r->out.result;
1579 }
1580
1581 werr = do_JoinConfig(r);
1582 if (!W_ERROR_IS_OK(werr)) {
1583 return werr;
1584 }
1585
1586 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1587 return WERR_OK;
1588 }
1589
1590 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1591 if (r->out.dns_domain_name) {
1592 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1593 }
1594
1595 #ifdef WITH_ADS
1596 if (r->out.domain_is_ad &&
1597 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1598 ADS_STATUS ads_status;
1599
1600 ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1601 if (!ADS_ERR_OK(ads_status)) {
1602 return WERR_GENERAL_FAILURE;
1603 }
1604 }
1605 #endif /* WITH_ADS */
1606
1607 libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1608
1609 return WERR_OK;
1610 }
1611
1612 /****************************************************************
1613 ****************************************************************/
1614
1615 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1616 {
1617 const char *krb5_cc_env = NULL;
1618
1619 if (r->in.ads) {
1620 ads_destroy(&r->in.ads);
1621 }
1622
1623 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1624 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1625 unsetenv(KRB5_ENV_CCNAME);
1626 }
1627
1628 return 0;
1629 }
1630
1631 /****************************************************************
1632 ****************************************************************/
1633
1634 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1635 {
1636 const char *krb5_cc_env = NULL;
1637
1638 if (r->in.ads) {
1639 ads_destroy(&r->in.ads);
1640 }
1641
1642 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1643 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1644 unsetenv(KRB5_ENV_CCNAME);
1645 }
1646
1647 return 0;
1648 }
1649
1650 /****************************************************************
1651 ****************************************************************/
1652
1653 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1654 struct libnet_JoinCtx **r)
1655 {
1656 struct libnet_JoinCtx *ctx;
1657 const char *krb5_cc_env = NULL;
1658
1659 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1660 if (!ctx) {
1661 return WERR_NOMEM;
1662 }
1663
1664 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1665
1666 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1667 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1668
1669 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1670 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1671 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1672 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1673 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1674 }
1675
1676 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1677
1678 *r = ctx;
1679
1680 return WERR_OK;
1681 }
1682
1683 /****************************************************************
1684 ****************************************************************/
1685
1686 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1687 struct libnet_UnjoinCtx **r)
1688 {
1689 struct libnet_UnjoinCtx *ctx;
1690 const char *krb5_cc_env = NULL;
1691
1692 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1693 if (!ctx) {
1694 return WERR_NOMEM;
1695 }
1696
1697 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1698
1699 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1700 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1701
1702 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1703 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1704 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1705 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1706 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1707 }
1708
1709 *r = ctx;
1710
1711 return WERR_OK;
1712 }
1713
1714 /****************************************************************
1715 ****************************************************************/
1716
1717 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1718 struct libnet_JoinCtx *r)
1719 {
1720 bool valid_security = false;
1721 bool valid_workgroup = false;
1722 bool valid_realm = false;
1723
1724 /* check if configuration is already set correctly */
1725
1726 valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1727
1728 switch (r->out.domain_is_ad) {
1729 case false:
1730 valid_security = (lp_security() == SEC_DOMAIN);
1731 if (valid_workgroup && valid_security) {
1732 /* nothing to be done */
1733 return WERR_OK;
1734 }
1735 break;
1736 case true:
1737 valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1738 switch (lp_security()) {
1739 case SEC_DOMAIN:
1740 case SEC_ADS:
1741 valid_security = true;
1742 }
1743
1744 if (valid_workgroup && valid_realm && valid_security) {
1745 /* nothing to be done */
1746 return WERR_OK;
1747 }
1748 break;
1749 }
1750
1751 /* check if we are supposed to manipulate configuration */
1752
1753 if (!r->in.modify_config) {
1754
1755 char *wrong_conf = talloc_strdup(mem_ctx, "");
1756
1757 if (!valid_workgroup) {
1758 wrong_conf = talloc_asprintf_append(wrong_conf,
1759 "\"workgroup\" set to '%s', should be '%s'",
1760 lp_workgroup(), r->out.netbios_domain_name);
1761 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1762 }
1763
1764 if (!valid_realm) {
1765 wrong_conf = talloc_asprintf_append(wrong_conf,
1766 "\"realm\" set to '%s', should be '%s'",
1767 lp_realm(), r->out.dns_domain_name);
1768 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1769 }
1770
1771 if (!valid_security) {
1772 const char *sec = NULL;
1773 switch (lp_security()) {
1774 case SEC_SHARE: sec = "share"; break;
1775 case SEC_USER: sec = "user"; break;
1776 case SEC_DOMAIN: sec = "domain"; break;
1777 case SEC_ADS: sec = "ads"; break;
1778 }
1779 wrong_conf = talloc_asprintf_append(wrong_conf,
1780 "\"security\" set to '%s', should be %s",
1781 sec, r->out.domain_is_ad ?
1782 "either 'domain' or 'ads'" : "'domain'");
1783 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1784 }
1785
1786 libnet_join_set_error_string(mem_ctx, r,
1787 "Invalid configuration (%s) and configuration modification "
1788 "was not requested", wrong_conf);
1789 return WERR_CAN_NOT_COMPLETE;
1790 }
1791
1792 /* check if we are able to manipulate configuration */
1793
1794 if (!lp_config_backend_is_registry()) {
1795 libnet_join_set_error_string(mem_ctx, r,
1796 "Configuration manipulation requested but not "
1797 "supported by backend");
1798 return WERR_NOT_SUPPORTED;
1799 }
1800
1801 return WERR_OK;
1802 }
1803
1804 /****************************************************************
1805 ****************************************************************/
1806
1807 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1808 struct libnet_JoinCtx *r)
1809 {
1810 NTSTATUS status;
1811 WERROR werr;
1812 struct cli_state *cli = NULL;
1813 #ifdef WITH_ADS
1814 ADS_STATUS ads_status;
1815 #endif /* WITH_ADS */
1816
1817 if (!r->in.dc_name) {
1818 struct netr_DsRGetDCNameInfo *info;
1819 const char *dc;
1820 status = dsgetdcname(mem_ctx,
1821 r->in.msg_ctx,
1822 r->in.domain_name,
1823 NULL,
1824 NULL,
1825 DS_FORCE_REDISCOVERY |
1826 DS_DIRECTORY_SERVICE_REQUIRED |
1827 DS_WRITABLE_REQUIRED |
1828 DS_RETURN_DNS_NAME,
1829 &info);
1830 if (!NT_STATUS_IS_OK(status)) {
1831 libnet_join_set_error_string(mem_ctx, r,
1832 "failed to find DC for domain %s",
1833 r->in.domain_name,
1834 get_friendly_nt_error_msg(status));
1835 return WERR_DCNOTFOUND;
1836 }
1837
1838 dc = strip_hostname(info->dc_unc);
1839 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1840 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1841 }
1842
1843 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1844 if (!NT_STATUS_IS_OK(status)) {
1845 libnet_join_set_error_string(mem_ctx, r,
1846 "failed to lookup DC info for domain '%s' over rpc: %s",
1847 r->in.domain_name, get_friendly_nt_error_msg(status));
1848 return ntstatus_to_werror(status);
1849 }
1850
1851 werr = libnet_join_check_config(mem_ctx, r);
1852 if (!W_ERROR_IS_OK(werr)) {
1853 goto done;
1854 }
1855
1856 #ifdef WITH_ADS
1857 if (r->out.domain_is_ad && r->in.account_ou &&
1858 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1859
1860 ads_status = libnet_join_connect_ads(mem_ctx, r);
1861 if (!ADS_ERR_OK(ads_status)) {
1862 return WERR_DEFAULT_JOIN_REQUIRED;
1863 }
1864
1865 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1866 if (!ADS_ERR_OK(ads_status)) {
1867 libnet_join_set_error_string(mem_ctx, r,
1868 "failed to precreate account in ou %s: %s",
1869 r->in.account_ou,
1870 ads_errstr(ads_status));
1871 return WERR_DEFAULT_JOIN_REQUIRED;
1872 }
1873
1874 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1875 }
1876 #endif /* WITH_ADS */
1877
1878 if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
1879 (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
1880 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
1881 } else {
1882 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
1883 }
1884 if (!NT_STATUS_IS_OK(status)) {
1885 libnet_join_set_error_string(mem_ctx, r,
1886 "failed to join domain '%s' over rpc: %s",
1887 r->in.domain_name, get_friendly_nt_error_msg(status));
1888 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1889 return WERR_SETUP_ALREADY_JOINED;
1890 }
1891 werr = ntstatus_to_werror(status);
1892 goto done;
1893 }
1894
1895 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1896 werr = WERR_SETUP_NOT_JOINED;
1897 goto done;
1898 }
1899
1900 werr = WERR_OK;
1901
1902 done:
1903 if (cli) {
1904 cli_shutdown(cli);
1905 }
1906
1907 return werr;
1908 }
1909
1910 /****************************************************************
1911 ****************************************************************/
1912
1913 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
1914 struct libnet_JoinCtx *r)
1915 {
1916 WERROR werr;
1917 struct libnet_UnjoinCtx *u = NULL;
1918
1919 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
1920 if (!W_ERROR_IS_OK(werr)) {
1921 return werr;
1922 }
1923
1924 u->in.debug = r->in.debug;
1925 u->in.dc_name = r->in.dc_name;
1926 u->in.domain_name = r->in.domain_name;
1927 u->in.admin_account = r->in.admin_account;
1928 u->in.admin_password = r->in.admin_password;
1929 u->in.modify_config = r->in.modify_config;
1930 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1931 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
1932
1933 werr = libnet_Unjoin(mem_ctx, u);
1934 TALLOC_FREE(u);
1935
1936 return werr;
1937 }
1938
1939 /****************************************************************
1940 ****************************************************************/
1941
1942 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1943 struct libnet_JoinCtx *r)
1944 {
1945 WERROR werr;
1946
1947 if (r->in.debug) {
1948 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1949 }
1950
1951 werr = libnet_join_pre_processing(mem_ctx, r);
1952 if (!W_ERROR_IS_OK(werr)) {
1953 goto done;
1954 }
1955
1956 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1957 werr = libnet_DomainJoin(mem_ctx, r);
1958 if (!W_ERROR_IS_OK(werr)) {
1959 goto done;
1960 }
1961 }
1962
1963 werr = libnet_join_post_processing(mem_ctx, r);
1964 if (!W_ERROR_IS_OK(werr)) {
1965 goto done;
1966 }
1967
1968 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1969 werr = libnet_join_post_verify(mem_ctx, r);
1970 if (!W_ERROR_IS_OK(werr)) {
1971 libnet_join_rollback(mem_ctx, r);
1972 }
1973 }
1974
1975 done:
1976 r->out.result = werr;
1977
1978 if (r->in.debug) {
1979 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
1980 }
1981 return werr;
1982 }
1983
1984 /****************************************************************
1985 ****************************************************************/
1986
1987 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1988 struct libnet_UnjoinCtx *r)
1989 {
1990 NTSTATUS status;
1991
1992 if (!r->in.domain_sid) {
1993 struct dom_sid sid;
1994 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
1995 libnet_unjoin_set_error_string(mem_ctx, r,
1996 "Unable to fetch domain sid: are we joined?");
1997 return WERR_SETUP_NOT_JOINED;
1998 }
1999 r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
2000 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2001 }
2002
2003 if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2004 !r->in.delete_machine_account) {
2005 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2006 return WERR_OK;
2007 }
2008
2009 if (!r->in.dc_name) {
2010 struct netr_DsRGetDCNameInfo *info;
2011 const char *dc;
2012 status = dsgetdcname(mem_ctx,
2013 r->in.msg_ctx,
2014 r->in.domain_name,
2015 NULL,
2016 NULL,
2017 DS_DIRECTORY_SERVICE_REQUIRED |
2018 DS_WRITABLE_REQUIRED |
2019 DS_RETURN_DNS_NAME,
2020 &info);
2021 if (!NT_STATUS_IS_OK(status)) {
2022 libnet_unjoin_set_error_string(mem_ctx, r,
2023 "failed to find DC for domain %s",
2024 r->in.domain_name,
2025 get_friendly_nt_error_msg(status));
2026 return WERR_DCNOTFOUND;
2027 }
2028
2029 dc = strip_hostname(info->dc_unc);
2030 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2031 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2032 }
2033
2034 #ifdef WITH_ADS
2035 /* for net ads leave, try to delete the account. If it works,
2036 no sense in disabling. If it fails, we can still try to
2037 disable it. jmcd */
2038
2039 if (r->in.delete_machine_account) {
2040 ADS_STATUS ads_status;
2041 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2042 if (ADS_ERR_OK(ads_status)) {
2043 /* dirty hack */
2044 r->out.dns_domain_name =
2045 talloc_strdup(mem_ctx,
2046 r->in.ads->server.realm);
2047 ads_status =
2048 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2049 }
2050 if (!ADS_ERR_OK(ads_status)) {
2051 libnet_unjoin_set_error_string(mem_ctx, r,
2052 "failed to remove machine account from AD: %s",
2053 ads_errstr(ads_status));
2054 } else {
2055 r->out.deleted_machine_account = true;
2056 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2057 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2058 return WERR_OK;
2059 }
2060 }
2061 #endif /* WITH_ADS */
2062
2063 /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2064 "disable". */
2065 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2066 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2067 if (!NT_STATUS_IS_OK(status)) {
2068 libnet_unjoin_set_error_string(mem_ctx, r,
2069 "failed to disable machine account via rpc: %s",
2070 get_friendly_nt_error_msg(status));
2071 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2072 return WERR_SETUP_NOT_JOINED;
2073 }
2074 return ntstatus_to_werror(status);
2075 }
2076
2077 r->out.disabled_machine_account = true;
2078 }
2079
2080 /* If disable succeeded or was not requested at all, we
2081 should be getting rid of our end of things */
2082
2083 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2084
2085 return WERR_OK;
2086 }
2087
2088 /****************************************************************
2089 ****************************************************************/
2090
2091 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2092 struct libnet_UnjoinCtx *r)
2093 {
2094 if (!r->in.domain_name) {
2095 libnet_unjoin_set_error_string(mem_ctx, r,
2096 "No domain name defined");
2097 return WERR_INVALID_PARAM;
2098 }
2099
2100 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2101 &r->in.domain_name,
2102 &r->in.dc_name)) {
2103 libnet_unjoin_set_error_string(mem_ctx, r,
2104 "Failed to parse domain name");
2105 return WERR_INVALID_PARAM;
2106 }
2107
2108 if (IS_DC) {
2109 return WERR_SETUP_DOMAIN_CONTROLLER;
2110 }
2111
2112 if (!secrets_init()) {
2113 libnet_unjoin_set_error_string(mem_ctx, r,
2114 "Unable to open secrets database");
2115 return WERR_CAN_NOT_COMPLETE;
2116 }
2117
2118 return WERR_OK;
2119 }
2120
2121 /****************************************************************
2122 ****************************************************************/
2123
2124 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2125 struct libnet_UnjoinCtx *r)
2126 {
2127 saf_delete(r->out.netbios_domain_name);
2128 saf_delete(r->out.dns_domain_name);
2129
2130 return libnet_unjoin_config(r);
2131 }
2132
2133 /****************************************************************
2134 ****************************************************************/
2135
2136 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2137 struct libnet_UnjoinCtx *r)
2138 {
2139 WERROR werr;
2140
2141 if (r->in.debug) {
2142 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2143 }
2144
2145 werr = libnet_unjoin_pre_processing(mem_ctx, r);
2146 if (!W_ERROR_IS_OK(werr)) {
2147 goto done;
2148 }
2149
2150 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2151 werr = libnet_DomainUnjoin(mem_ctx, r);
2152 if (!W_ERROR_IS_OK(werr)) {
2153 libnet_unjoin_config(r);
2154 goto done;
2155 }
2156 }
2157
2158 werr = libnet_unjoin_post_processing(mem_ctx, r);
2159 if (!W_ERROR_IS_OK(werr)) {
2160 goto done;
2161 }
2162
2163 done:
2164 r->out.result = werr;
2165
2166 if (r->in.debug) {
2167 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2168 }
2169
2170 return werr;
2171 }