2 Unix SMB/CIFS implementation.
4 Winbind status program.
6 Copyright (C) Tim Potter 2000-2003
7 Copyright (C) Andrew Bartlett 2002-2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "winbind_client.h"
25 #include "librpc/gen_ndr/ndr_netlogon.h"
26 #include "libcli/auth/libcli_auth.h"
27 #include "libcli/security/security.h"
28 #include "lib/cmdline/popt_common.h"
29 #include "dynconfig/dynconfig.h"
30 #include "param/param.h"
33 #define fstrcpy(d,s) safe_strcpy((d),(s),sizeof(fstring)-1)
36 extern int winbindd_fd
;
38 static char winbind_separator_int(bool strict
)
40 struct winbindd_response response
;
47 ZERO_STRUCT(response
);
49 /* Send off request */
51 if (winbindd_request_response(WINBINDD_INFO
, NULL
, &response
) !=
53 d_fprintf(stderr
, "could not obtain winbind separator!\n");
57 /* HACK: (this module should not call lp_ funtions) */
58 return *lp_winbind_separator(cmdline_lp_ctx
);
61 sep
= response
.data
.info
.winbind_separator
;
65 d_fprintf(stderr
, "winbind separator was NULL!\n");
69 /* HACK: (this module should not call lp_ funtions) */
70 sep
= *lp_winbind_separator(cmdline_lp_ctx
);
76 static char winbind_separator(void)
78 return winbind_separator_int(false);
81 static const char *get_winbind_domain(void)
83 struct winbindd_response response
;
84 static fstring winbind_domain
;
86 ZERO_STRUCT(response
);
88 /* Send off request */
90 if (winbindd_request_response(WINBINDD_DOMAIN_NAME
, NULL
, &response
) !=
92 d_fprintf(stderr
, "could not obtain winbind domain name!\n");
94 /* HACK: (this module should not call lp_ funtions) */
95 return lp_workgroup(cmdline_lp_ctx
);
98 fstrcpy(winbind_domain
, response
.data
.domain_name
);
100 return winbind_domain
;
104 /* Copy of parse_domain_user from winbindd_util.c. Parse a string of the
105 form DOMAIN/user into a domain and a user */
107 static bool parse_wbinfo_domain_user(const char *domuser
, fstring domain
,
111 char *p
= strchr(domuser
,winbind_separator());
114 fstrcpy(user
, domuser
);
115 fstrcpy(domain
, get_winbind_domain());
120 fstrcpy(domain
, domuser
);
121 domain
[PTR_DIFF(p
, domuser
)] = 0;
127 /* pull pwent info for a given user */
129 static bool wbinfo_get_userinfo(char *user
)
131 struct winbindd_request request
;
132 struct winbindd_response response
;
135 ZERO_STRUCT(request
);
136 ZERO_STRUCT(response
);
140 fstrcpy(request
.data
.username
, user
);
142 result
= winbindd_request_response(WINBINDD_GETPWNAM
, &request
, &response
);
144 if (result
!= NSS_STATUS_SUCCESS
)
147 d_printf( "%s:%s:%d:%d:%s:%s:%s\n",
148 response
.data
.pw
.pw_name
,
149 response
.data
.pw
.pw_passwd
,
150 response
.data
.pw
.pw_uid
,
151 response
.data
.pw
.pw_gid
,
152 response
.data
.pw
.pw_gecos
,
153 response
.data
.pw
.pw_dir
,
154 response
.data
.pw
.pw_shell
);
159 /* pull pwent info for a given uid */
160 static bool wbinfo_get_uidinfo(int uid
)
162 struct winbindd_request request
;
163 struct winbindd_response response
;
166 ZERO_STRUCT(request
);
167 ZERO_STRUCT(response
);
169 request
.data
.uid
= uid
;
171 result
= winbindd_request_response(WINBINDD_GETPWUID
, &request
, &response
);
173 if (result
!= NSS_STATUS_SUCCESS
)
176 d_printf( "%s:%s:%d:%d:%s:%s:%s\n",
177 response
.data
.pw
.pw_name
,
178 response
.data
.pw
.pw_passwd
,
179 response
.data
.pw
.pw_uid
,
180 response
.data
.pw
.pw_gid
,
181 response
.data
.pw
.pw_gecos
,
182 response
.data
.pw
.pw_dir
,
183 response
.data
.pw
.pw_shell
);
188 /* pull grent for a given group */
189 static bool wbinfo_get_groupinfo(char *group
)
191 struct winbindd_request request
;
192 struct winbindd_response response
;
195 ZERO_STRUCT(request
);
196 ZERO_STRUCT(response
);
200 fstrcpy(request
.data
.groupname
, group
);
202 result
= winbindd_request_response(WINBINDD_GETGRNAM
, &request
,
205 if ( result
!= NSS_STATUS_SUCCESS
)
208 d_printf( "%s:%s:%d\n",
209 response
.data
.gr
.gr_name
,
210 response
.data
.gr
.gr_passwd
,
211 response
.data
.gr
.gr_gid
);
216 /* List groups a user is a member of */
218 static bool wbinfo_get_usergroups(char *user
)
220 struct winbindd_request request
;
221 struct winbindd_response response
;
225 ZERO_STRUCT(request
);
226 ZERO_STRUCT(response
);
230 fstrcpy(request
.data
.username
, user
);
232 result
= winbindd_request_response(WINBINDD_GETGROUPS
, &request
, &response
);
234 if (result
!= NSS_STATUS_SUCCESS
)
237 for (i
= 0; i
< response
.data
.num_entries
; i
++)
238 d_printf("%d\n", (int)((gid_t
*)response
.extra_data
.data
)[i
]);
240 SAFE_FREE(response
.extra_data
.data
);
246 /* List group SIDs a user SID is a member of */
247 static bool wbinfo_get_usersids(char *user_sid
)
249 struct winbindd_request request
;
250 struct winbindd_response response
;
255 ZERO_STRUCT(request
);
256 ZERO_STRUCT(response
);
259 fstrcpy(request
.data
.sid
, user_sid
);
261 result
= winbindd_request_response(WINBINDD_GETUSERSIDS
, &request
, &response
);
263 if (result
!= NSS_STATUS_SUCCESS
)
266 s
= (const char *)response
.extra_data
.data
;
267 for (i
= 0; i
< response
.data
.num_entries
; i
++) {
272 SAFE_FREE(response
.extra_data
.data
);
277 static bool wbinfo_get_userdomgroups(const char *user_sid
)
279 struct winbindd_request request
;
280 struct winbindd_response response
;
283 ZERO_STRUCT(request
);
284 ZERO_STRUCT(response
);
287 fstrcpy(request
.data
.sid
, user_sid
);
289 result
= winbindd_request_response(WINBINDD_GETUSERDOMGROUPS
, &request
,
292 if (result
!= NSS_STATUS_SUCCESS
)
295 if (response
.data
.num_entries
!= 0)
296 printf("%s", (char *)response
.extra_data
.data
);
298 SAFE_FREE(response
.extra_data
.data
);
303 /* Convert NetBIOS name to IP */
305 static bool wbinfo_wins_byname(char *name
)
307 struct winbindd_request request
;
308 struct winbindd_response response
;
310 ZERO_STRUCT(request
);
311 ZERO_STRUCT(response
);
315 fstrcpy(request
.data
.winsreq
, name
);
317 if (winbindd_request_response(WINBINDD_WINS_BYNAME
, &request
, &response
) !=
318 NSS_STATUS_SUCCESS
) {
322 /* Display response */
324 d_printf("%s\n", response
.data
.winsresp
);
329 /* Convert IP to NetBIOS name */
331 static bool wbinfo_wins_byip(char *ip
)
333 struct winbindd_request request
;
334 struct winbindd_response response
;
336 ZERO_STRUCT(request
);
337 ZERO_STRUCT(response
);
341 fstrcpy(request
.data
.winsreq
, ip
);
343 if (winbindd_request_response(WINBINDD_WINS_BYIP
, &request
, &response
) !=
344 NSS_STATUS_SUCCESS
) {
348 /* Display response */
350 d_printf("%s\n", response
.data
.winsresp
);
355 /* List trusted domains */
357 static bool wbinfo_list_domains(bool list_all_domains
)
359 struct winbindd_request request
;
360 struct winbindd_response response
;
362 ZERO_STRUCT(request
);
363 ZERO_STRUCT(response
);
367 request
.data
.list_all_domains
= list_all_domains
;
369 if (winbindd_request_response(WINBINDD_LIST_TRUSTDOM
, &request
, &response
) !=
373 /* Display response */
375 if (response
.extra_data
.data
) {
376 const char *extra_data
= (char *)response
.extra_data
.data
;
380 while(next_token(&extra_data
, name
, "\n", sizeof(fstring
))) {
381 p
= strchr(name
, '\\');
383 d_fprintf(stderr
, "Got invalid response: %s\n",
388 d_printf("%s\n", name
);
391 SAFE_FREE(response
.extra_data
.data
);
397 /* List own domain */
399 static bool wbinfo_list_own_domain(void)
401 d_printf("%s\n", get_winbind_domain());
406 /* show sequence numbers */
407 static bool wbinfo_show_sequence(const char *domain
)
409 struct winbindd_request request
;
410 struct winbindd_response response
;
412 ZERO_STRUCT(response
);
413 ZERO_STRUCT(request
);
416 fstrcpy( request
.domain_name
, domain
);
420 if (winbindd_request_response(WINBINDD_SHOW_SEQUENCE
, &request
, &response
) !=
424 /* Display response */
426 if (response
.extra_data
.data
) {
427 char *extra_data
= (char *)response
.extra_data
.data
;
428 d_printf("%s", extra_data
);
429 SAFE_FREE(response
.extra_data
.data
);
435 /* Show domain info */
437 static bool wbinfo_domain_info(const char *domain_name
)
439 struct winbindd_request request
;
440 struct winbindd_response response
;
442 ZERO_STRUCT(request
);
443 ZERO_STRUCT(response
);
445 if ((strequal(domain_name
, ".")) || (domain_name
[0] == '\0'))
446 fstrcpy(request
.domain_name
, get_winbind_domain());
448 fstrcpy(request
.domain_name
, domain_name
);
452 if (winbindd_request_response(WINBINDD_DOMAIN_INFO
, &request
, &response
) !=
456 /* Display response */
458 d_printf("Name : %s\n", response
.data
.domain_info
.name
);
459 d_printf("Alt_Name : %s\n", response
.data
.domain_info
.alt_name
);
461 d_printf("SID : %s\n", response
.data
.domain_info
.sid
);
463 d_printf("Active Directory : %s\n",
464 response
.data
.domain_info
.active_directory
? "Yes" : "No");
465 d_printf("Native : %s\n",
466 response
.data
.domain_info
.native_mode
? "Yes" : "No");
468 d_printf("Primary : %s\n",
469 response
.data
.domain_info
.primary
? "Yes" : "No");
474 /* Get a foreign DC's name */
475 static bool wbinfo_getdcname(const char *domain_name
)
477 struct winbindd_request request
;
478 struct winbindd_response response
;
480 ZERO_STRUCT(request
);
481 ZERO_STRUCT(response
);
483 fstrcpy(request
.domain_name
, domain_name
);
487 if (winbindd_request_response(WINBINDD_GETDCNAME
, &request
, &response
) !=
488 NSS_STATUS_SUCCESS
) {
489 d_fprintf(stderr
, "Could not get dc name for %s\n", domain_name
);
493 /* Display response */
495 d_printf("%s\n", response
.data
.dc_name
);
500 /* Check trust account password */
502 static bool wbinfo_check_secret(void)
504 struct winbindd_response response
;
507 ZERO_STRUCT(response
);
509 result
= winbindd_request_response(WINBINDD_CHECK_MACHACC
, NULL
, &response
);
511 d_printf("checking the trust secret via RPC calls %s\n",
512 (result
== NSS_STATUS_SUCCESS
) ? "succeeded" : "failed");
514 if (result
!= NSS_STATUS_SUCCESS
)
515 d_fprintf(stderr
, "error code was %s (0x%x)\n",
516 response
.data
.auth
.nt_status_string
,
517 response
.data
.auth
.nt_status
);
519 return result
== NSS_STATUS_SUCCESS
;
522 /* Convert uid to sid */
524 static bool wbinfo_uid_to_sid(uid_t uid
)
526 struct winbindd_request request
;
527 struct winbindd_response response
;
529 ZERO_STRUCT(request
);
530 ZERO_STRUCT(response
);
534 request
.data
.uid
= uid
;
536 if (winbindd_request_response(WINBINDD_UID_TO_SID
, &request
, &response
) !=
540 /* Display response */
542 d_printf("%s\n", response
.data
.sid
.sid
);
547 /* Convert gid to sid */
549 static bool wbinfo_gid_to_sid(gid_t gid
)
551 struct winbindd_request request
;
552 struct winbindd_response response
;
554 ZERO_STRUCT(request
);
555 ZERO_STRUCT(response
);
559 request
.data
.gid
= gid
;
561 if (winbindd_request_response(WINBINDD_GID_TO_SID
, &request
, &response
) !=
565 /* Display response */
567 d_printf("%s\n", response
.data
.sid
.sid
);
572 /* Convert sid to uid */
574 static bool wbinfo_sid_to_uid(char *sid
)
576 struct winbindd_request request
;
577 struct winbindd_response response
;
579 ZERO_STRUCT(request
);
580 ZERO_STRUCT(response
);
584 fstrcpy(request
.data
.sid
, sid
);
586 if (winbindd_request_response(WINBINDD_SID_TO_UID
, &request
, &response
) !=
590 /* Display response */
592 d_printf("%d\n", (int)response
.data
.uid
);
597 static bool wbinfo_sid_to_gid(char *sid
)
599 struct winbindd_request request
;
600 struct winbindd_response response
;
602 ZERO_STRUCT(request
);
603 ZERO_STRUCT(response
);
607 fstrcpy(request
.data
.sid
, sid
);
609 if (winbindd_request_response(WINBINDD_SID_TO_GID
, &request
, &response
) !=
613 /* Display response */
615 d_printf("%d\n", (int)response
.data
.gid
);
620 static const char *sid_type_lookup(enum lsa_SidType r
)
623 case SID_NAME_USE_NONE
: return "SID_NAME_USE_NONE"; break;
624 case SID_NAME_USER
: return "SID_NAME_USER"; break;
625 case SID_NAME_DOM_GRP
: return "SID_NAME_DOM_GRP"; break;
626 case SID_NAME_DOMAIN
: return "SID_NAME_DOMAIN"; break;
627 case SID_NAME_ALIAS
: return "SID_NAME_ALIAS"; break;
628 case SID_NAME_WKN_GRP
: return "SID_NAME_WKN_GRP"; break;
629 case SID_NAME_DELETED
: return "SID_NAME_DELETED"; break;
630 case SID_NAME_INVALID
: return "SID_NAME_INVALID"; break;
631 case SID_NAME_UNKNOWN
: return "SID_NAME_UNKNOWN"; break;
632 case SID_NAME_COMPUTER
: return "SID_NAME_COMPUTER"; break;
634 return "Invalid sid type\n";
637 /* Convert sid to string */
639 static bool wbinfo_lookupsid(char *sid
)
641 struct winbindd_request request
;
642 struct winbindd_response response
;
644 ZERO_STRUCT(request
);
645 ZERO_STRUCT(response
);
647 /* Send off request */
649 fstrcpy(request
.data
.sid
, sid
);
651 if (winbindd_request_response(WINBINDD_LOOKUPSID
, &request
, &response
) !=
655 /* Display response */
657 d_printf("%s%c%s %s\n", response
.data
.name
.dom_name
,
658 winbind_separator(), response
.data
.name
.name
,
659 sid_type_lookup(response
.data
.name
.type
));
664 /* Convert string to sid */
666 static bool wbinfo_lookupname(char *name
)
668 struct winbindd_request request
;
669 struct winbindd_response response
;
671 /* Send off request */
673 ZERO_STRUCT(request
);
674 ZERO_STRUCT(response
);
676 parse_wbinfo_domain_user(name
, request
.data
.name
.dom_name
,
677 request
.data
.name
.name
);
679 if (winbindd_request_response(WINBINDD_LOOKUPNAME
, &request
, &response
) !=
683 /* Display response */
685 d_printf("%s %s (%d)\n", response
.data
.sid
.sid
, sid_type_lookup(response
.data
.sid
.type
), response
.data
.sid
.type
);
690 /* Authenticate a user with a plaintext password */
692 static bool wbinfo_auth_krb5(char *username
, const char *cctype
, uint32_t flags
)
694 struct winbindd_request request
;
695 struct winbindd_response response
;
699 /* Send off request */
701 ZERO_STRUCT(request
);
702 ZERO_STRUCT(response
);
704 p
= strchr(username
, '%');
708 fstrcpy(request
.data
.auth
.user
, username
);
709 fstrcpy(request
.data
.auth
.pass
, p
+ 1);
712 fstrcpy(request
.data
.auth
.user
, username
);
714 request
.flags
= flags
;
716 fstrcpy(request
.data
.auth
.krb5_cc_type
, cctype
);
718 request
.data
.auth
.uid
= geteuid();
720 result
= winbindd_request_response(WINBINDD_PAM_AUTH
, &request
, &response
);
722 /* Display response */
724 d_printf("plaintext kerberos password authentication for [%s] %s (requesting cctype: %s)\n",
725 username
, (result
== NSS_STATUS_SUCCESS
) ? "succeeded" : "failed", cctype
);
727 if (response
.data
.auth
.nt_status
)
728 d_fprintf(stderr
, "error code was %s (0x%x)\nerror messsage was: %s\n",
729 response
.data
.auth
.nt_status_string
,
730 response
.data
.auth
.nt_status
,
731 response
.data
.auth
.error_string
);
733 if (result
== NSS_STATUS_SUCCESS
) {
735 if (request
.flags
& WBFLAG_PAM_INFO3_TEXT
) {
736 if (response
.data
.auth
.info3
.user_flgs
& NETLOGON_CACHED_ACCOUNT
) {
737 d_printf("user_flgs: NETLOGON_CACHED_ACCOUNT\n");
741 if (response
.data
.auth
.krb5ccname
[0] != '\0') {
742 d_printf("credentials were put in: %s\n", response
.data
.auth
.krb5ccname
);
744 d_printf("no credentials cached\n");
748 return result
== NSS_STATUS_SUCCESS
;
751 /* Authenticate a user with a plaintext password */
753 static bool wbinfo_auth(char *username
)
755 struct winbindd_request request
;
756 struct winbindd_response response
;
760 /* Send off request */
762 ZERO_STRUCT(request
);
763 ZERO_STRUCT(response
);
765 p
= strchr(username
, '%');
769 fstrcpy(request
.data
.auth
.user
, username
);
770 fstrcpy(request
.data
.auth
.pass
, p
+ 1);
773 fstrcpy(request
.data
.auth
.user
, username
);
775 result
= winbindd_request_response(WINBINDD_PAM_AUTH
, &request
, &response
);
777 /* Display response */
779 d_printf("plaintext password authentication %s\n",
780 (result
== NSS_STATUS_SUCCESS
) ? "succeeded" : "failed");
782 if (response
.data
.auth
.nt_status
)
783 d_fprintf(stderr
, "error code was %s (0x%x)\nerror messsage was: %s\n",
784 response
.data
.auth
.nt_status_string
,
785 response
.data
.auth
.nt_status
,
786 response
.data
.auth
.error_string
);
788 return result
== NSS_STATUS_SUCCESS
;
791 /* Authenticate a user with a challenge/response */
793 static bool wbinfo_auth_crap(struct loadparm_context
*lp_ctx
, char *username
)
795 struct winbindd_request request
;
796 struct winbindd_response response
;
803 /* Send off request */
805 ZERO_STRUCT(request
);
806 ZERO_STRUCT(response
);
808 p
= strchr(username
, '%');
812 fstrcpy(pass
, p
+ 1);
815 parse_wbinfo_domain_user(username
, name_domain
, name_user
);
817 request
.data
.auth_crap
.logon_parameters
= MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT
| MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT
;
819 fstrcpy(request
.data
.auth_crap
.user
, name_user
);
821 fstrcpy(request
.data
.auth_crap
.domain
,
824 generate_random_buffer(request
.data
.auth_crap
.chal
, 8);
826 if (lp_client_ntlmv2_auth(lp_ctx
)) {
827 DATA_BLOB server_chal
;
828 DATA_BLOB names_blob
;
830 DATA_BLOB lm_response
;
831 DATA_BLOB nt_response
;
834 mem_ctx
= talloc_new(NULL
);
835 if (mem_ctx
== NULL
) {
836 d_printf("talloc_new failed\n");
840 server_chal
= data_blob(request
.data
.auth_crap
.chal
, 8);
842 /* Pretend this is a login to 'us', for blob purposes */
843 names_blob
= NTLMv2_generate_names_blob(mem_ctx
, lp_netbios_name(lp_ctx
), lp_workgroup(lp_ctx
));
845 if (!SMBNTLMv2encrypt(mem_ctx
, name_user
, name_domain
, pass
, &server_chal
,
847 &lm_response
, &nt_response
, NULL
, NULL
)) {
848 data_blob_free(&names_blob
);
849 data_blob_free(&server_chal
);
852 data_blob_free(&names_blob
);
853 data_blob_free(&server_chal
);
855 memcpy(request
.data
.auth_crap
.nt_resp
, nt_response
.data
,
856 MIN(nt_response
.length
,
857 sizeof(request
.data
.auth_crap
.nt_resp
)));
858 request
.data
.auth_crap
.nt_resp_len
= nt_response
.length
;
860 memcpy(request
.data
.auth_crap
.lm_resp
, lm_response
.data
,
861 MIN(lm_response
.length
,
862 sizeof(request
.data
.auth_crap
.lm_resp
)));
863 request
.data
.auth_crap
.lm_resp_len
= lm_response
.length
;
865 data_blob_free(&nt_response
);
866 data_blob_free(&lm_response
);
869 if (lp_client_lanman_auth(lp_ctx
)
870 && SMBencrypt(pass
, request
.data
.auth_crap
.chal
,
871 (unsigned char *)request
.data
.auth_crap
.lm_resp
)) {
872 request
.data
.auth_crap
.lm_resp_len
= 24;
874 request
.data
.auth_crap
.lm_resp_len
= 0;
876 SMBNTencrypt(pass
, request
.data
.auth_crap
.chal
,
877 (unsigned char *)request
.data
.auth_crap
.nt_resp
);
879 request
.data
.auth_crap
.nt_resp_len
= 24;
882 result
= winbindd_request_response(WINBINDD_PAM_AUTH_CRAP
, &request
, &response
);
884 /* Display response */
886 d_printf("challenge/response password authentication %s\n",
887 (result
== NSS_STATUS_SUCCESS
) ? "succeeded" : "failed");
889 if (response
.data
.auth
.nt_status
)
890 d_fprintf(stderr
, "error code was %s (0x%x)\nerror messsage was: %s\n",
891 response
.data
.auth
.nt_status_string
,
892 response
.data
.auth
.nt_status
,
893 response
.data
.auth
.error_string
);
895 return result
== NSS_STATUS_SUCCESS
;
898 /* Print domain users */
900 static bool print_domain_users(const char *domain
)
902 struct winbindd_request request
;
903 struct winbindd_response response
;
904 const char *extra_data
;
907 /* Send request to winbind daemon */
909 ZERO_STRUCT(request
);
910 ZERO_STRUCT(response
);
913 /* '.' is the special sign for our own domain */
914 if ( strequal(domain
, ".") )
915 fstrcpy( request
.domain_name
, get_winbind_domain() );
917 fstrcpy( request
.domain_name
, domain
);
920 if (winbindd_request_response(WINBINDD_LIST_USERS
, &request
, &response
) !=
924 /* Look through extra data */
926 if (!response
.extra_data
.data
)
929 extra_data
= (const char *)response
.extra_data
.data
;
931 while(next_token(&extra_data
, name
, ",", sizeof(fstring
)))
932 d_printf("%s\n", name
);
934 SAFE_FREE(response
.extra_data
.data
);
939 /* Print domain groups */
941 static bool print_domain_groups(const char *domain
)
943 struct winbindd_request request
;
944 struct winbindd_response response
;
945 const char *extra_data
;
948 ZERO_STRUCT(request
);
949 ZERO_STRUCT(response
);
952 if ( strequal(domain
, ".") )
953 fstrcpy( request
.domain_name
, get_winbind_domain() );
955 fstrcpy( request
.domain_name
, domain
);
958 if (winbindd_request_response(WINBINDD_LIST_GROUPS
, &request
, &response
) !=
962 /* Look through extra data */
964 if (!response
.extra_data
.data
)
967 extra_data
= (const char *)response
.extra_data
.data
;
969 while(next_token(&extra_data
, name
, ",", sizeof(fstring
)))
970 d_printf("%s\n", name
);
972 SAFE_FREE(response
.extra_data
.data
);
977 static bool wbinfo_ping(void)
981 result
= winbindd_request_response(WINBINDD_PING
, NULL
, NULL
);
983 /* Display response */
985 d_printf("Ping to winbindd %s on fd %d\n",
986 (result
== NSS_STATUS_SUCCESS
) ? "succeeded" : "failed", winbindd_fd
);
988 return result
== NSS_STATUS_SUCCESS
;
994 OPT_SET_AUTH_USER
= 1000,
1004 OPT_LIST_ALL_DOMAINS
,
1005 OPT_LIST_OWN_DOMAIN
,
1010 int main(int argc
, char **argv
, char **envp
)
1015 static char *string_arg
;
1016 static char *opt_domain_name
;
1020 struct poptOption long_options
[] = {
1023 /* longName, shortName, argInfo, argPtr, value, descrip,
1026 { "domain-users", 'u', POPT_ARG_NONE
, 0, 'u', "Lists all domain users", "domain"},
1027 { "domain-groups", 'g', POPT_ARG_NONE
, 0, 'g', "Lists all domain groups", "domain" },
1028 { "WINS-by-name", 'N', POPT_ARG_STRING
, &string_arg
, 'N', "Converts NetBIOS name to IP", "NETBIOS-NAME" },
1029 { "WINS-by-ip", 'I', POPT_ARG_STRING
, &string_arg
, 'I', "Converts IP address to NetBIOS name", "IP" },
1030 { "name-to-sid", 'n', POPT_ARG_STRING
, &string_arg
, 'n', "Converts name to sid", "NAME" },
1031 { "sid-to-name", 's', POPT_ARG_STRING
, &string_arg
, 's', "Converts sid to name", "SID" },
1032 { "uid-to-sid", 'U', POPT_ARG_INT
, &int_arg
, 'U', "Converts uid to sid" , "UID" },
1033 { "gid-to-sid", 'G', POPT_ARG_INT
, &int_arg
, 'G', "Converts gid to sid", "GID" },
1034 { "sid-to-uid", 'S', POPT_ARG_STRING
, &string_arg
, 'S', "Converts sid to uid", "SID" },
1035 { "sid-to-gid", 'Y', POPT_ARG_STRING
, &string_arg
, 'Y', "Converts sid to gid", "SID" },
1036 { "check-secret", 't', POPT_ARG_NONE
, 0, 't', "Check shared secret" },
1037 { "trusted-domains", 'm', POPT_ARG_NONE
, 0, 'm', "List trusted domains" },
1038 { "all-domains", 0, POPT_ARG_NONE
, 0, OPT_LIST_ALL_DOMAINS
, "List all domains (trusted and own domain)" },
1039 { "own-domain", 0, POPT_ARG_NONE
, 0, OPT_LIST_OWN_DOMAIN
, "List own domain" },
1040 { "sequence", 0, POPT_ARG_NONE
, 0, OPT_SEQUENCE
, "Show sequence numbers of all domains" },
1041 { "domain-info", 'D', POPT_ARG_STRING
, &string_arg
, 'D', "Show most of the info we have about the domain" },
1042 { "user-info", 'i', POPT_ARG_STRING
, &string_arg
, 'i', "Get user info", "USER" },
1043 { "uid-info", 0, POPT_ARG_INT
, &int_arg
, OPT_UID_INFO
, "Get user info from uid", "UID" },
1044 { "group-info", 0, POPT_ARG_STRING
, &string_arg
, OPT_GROUP_INFO
, "Get group info", "GROUP" },
1045 { "user-groups", 'r', POPT_ARG_STRING
, &string_arg
, 'r', "Get user groups", "USER" },
1046 { "user-domgroups", 0, POPT_ARG_STRING
, &string_arg
,
1047 OPT_USERDOMGROUPS
, "Get user domain groups", "SID" },
1048 { "user-sids", 0, POPT_ARG_STRING
, &string_arg
, OPT_USERSIDS
, "Get user group sids for user SID", "SID" },
1049 { "authenticate", 'a', POPT_ARG_STRING
, &string_arg
, 'a', "authenticate user", "user%password" },
1050 { "getdcname", 0, POPT_ARG_STRING
, &string_arg
, OPT_GETDCNAME
,
1051 "Get a DC name for a foreign domain", "domainname" },
1052 { "ping", 'p', POPT_ARG_NONE
, 0, 'p', "Ping winbindd to see if it is alive" },
1053 { "domain", 0, POPT_ARG_STRING
, &opt_domain_name
, OPT_DOMAIN_NAME
, "Define to the domain to restrict operation", "domain" },
1055 { "krb5auth", 'K', POPT_ARG_STRING
, &string_arg
, 'K', "authenticate user using Kerberos", "user%password" },
1056 /* destroys wbinfo --help output */
1057 /* "user%password,DOM\\user%password,user@EXAMPLE.COM,EXAMPLE.COM\\user%password" }, */
1059 { "separator", 0, POPT_ARG_NONE
, 0, OPT_SEPARATOR
, "Get the active winbind separator", NULL
},
1067 pc
= poptGetContext("wbinfo", argc
, (const char **)argv
, long_options
, 0);
1069 /* Parse command line options */
1072 poptPrintHelp(pc
, stderr
, 0);
1076 while((opt
= poptGetNextOpt(pc
)) != -1) {
1077 /* get the generic configuration parameters like --domain */
1080 poptFreeContext(pc
);
1082 pc
= poptGetContext(NULL
, argc
, (const char **)argv
, long_options
,
1083 POPT_CONTEXT_KEEP_FIRST
);
1085 while((opt
= poptGetNextOpt(pc
)) != -1) {
1088 if (!print_domain_users(opt_domain_name
)) {
1089 d_fprintf(stderr
, "Error looking up domain users\n");
1094 if (!print_domain_groups(opt_domain_name
)) {
1095 d_fprintf(stderr
, "Error looking up domain groups\n");
1100 if (!wbinfo_lookupsid(string_arg
)) {
1101 d_fprintf(stderr
, "Could not lookup sid %s\n", string_arg
);
1106 if (!wbinfo_lookupname(string_arg
)) {
1107 d_fprintf(stderr
, "Could not lookup name %s\n", string_arg
);
1112 if (!wbinfo_wins_byname(string_arg
)) {
1113 d_fprintf(stderr
, "Could not lookup WINS by name %s\n", string_arg
);
1118 if (!wbinfo_wins_byip(string_arg
)) {
1119 d_fprintf(stderr
, "Could not lookup WINS by IP %s\n", string_arg
);
1124 if (!wbinfo_uid_to_sid(int_arg
)) {
1125 d_fprintf(stderr
, "Could not convert uid %d to sid\n", int_arg
);
1130 if (!wbinfo_gid_to_sid(int_arg
)) {
1131 d_fprintf(stderr
, "Could not convert gid %d to sid\n",
1137 if (!wbinfo_sid_to_uid(string_arg
)) {
1138 d_fprintf(stderr
, "Could not convert sid %s to uid\n",
1144 if (!wbinfo_sid_to_gid(string_arg
)) {
1145 d_fprintf(stderr
, "Could not convert sid %s to gid\n",
1151 if (!wbinfo_check_secret()) {
1152 d_fprintf(stderr
, "Could not check secret\n");
1157 if (!wbinfo_list_domains(false)) {
1158 d_fprintf(stderr
, "Could not list trusted domains\n");
1163 if (!wbinfo_show_sequence(opt_domain_name
)) {
1164 d_fprintf(stderr
, "Could not show sequence numbers\n");
1169 if (!wbinfo_domain_info(string_arg
)) {
1170 d_fprintf(stderr
, "Could not get domain info\n");
1175 if (!wbinfo_get_userinfo(string_arg
)) {
1176 d_fprintf(stderr
, "Could not get info for user %s\n",
1182 if ( !wbinfo_get_uidinfo(int_arg
)) {
1183 d_fprintf(stderr
, "Could not get info for uid "
1188 case OPT_GROUP_INFO
:
1189 if ( !wbinfo_get_groupinfo(string_arg
)) {
1190 d_fprintf(stderr
, "Could not get info for "
1191 "group %s\n", string_arg
);
1196 if (!wbinfo_get_usergroups(string_arg
)) {
1197 d_fprintf(stderr
, "Could not get groups for user %s\n",
1203 if (!wbinfo_get_usersids(string_arg
)) {
1204 d_fprintf(stderr
, "Could not get group SIDs for user SID %s\n",
1209 case OPT_USERDOMGROUPS
:
1210 if (!wbinfo_get_userdomgroups(string_arg
)) {
1211 d_fprintf(stderr
, "Could not get user's domain groups "
1212 "for user SID %s\n", string_arg
);
1217 bool got_error
= false;
1219 if (!wbinfo_auth(string_arg
)) {
1220 d_fprintf(stderr
, "Could not authenticate user %s with "
1221 "plaintext password\n", string_arg
);
1225 if (!wbinfo_auth_crap(cmdline_lp_ctx
, string_arg
)) {
1226 d_fprintf(stderr
, "Could not authenticate user %s with "
1227 "challenge/response\n", string_arg
);
1236 uint32_t flags
= WBFLAG_PAM_KRB5
|
1237 WBFLAG_PAM_CACHED_LOGIN
|
1238 WBFLAG_PAM_FALLBACK_AFTER_KRB5
|
1239 WBFLAG_PAM_INFO3_TEXT
;
1241 if (!wbinfo_auth_krb5(string_arg
, "FILE", flags
)) {
1242 d_fprintf(stderr
, "Could not authenticate user [%s] with "
1243 "Kerberos (ccache: %s)\n", string_arg
, "FILE");
1249 if (!wbinfo_ping()) {
1250 d_fprintf(stderr
, "could not ping winbindd!\n");
1255 if (!wbinfo_getdcname(string_arg
)) {
1259 case OPT_SEPARATOR
: {
1260 const char sep
= winbind_separator_int(true);
1264 d_printf("%c\n", sep
);
1267 case OPT_LIST_ALL_DOMAINS
:
1268 if (!wbinfo_list_domains(true)) {
1272 case OPT_LIST_OWN_DOMAIN
:
1273 if (!wbinfo_list_own_domain()) {
1277 /* generic configuration options */
1278 case OPT_DOMAIN_NAME
:
1281 d_fprintf(stderr
, "Invalid option\n");
1282 poptPrintHelp(pc
, stderr
, 0);
1292 poptFreeContext(pc
);