source3/auth/server_info.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Volker Lendecke 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "../lib/crypto/arcfour.h"
  22 #include "../librpc/gen_ndr/netlogon.h"
  23 #include "../libcli/security/security.h"
  24 #include "rpc_client/util_netlogon.h"
  25
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_AUTH
  28
  29 /* FIXME: do we really still need this ? */
  30 static int server_info_dtor(struct auth_serversupplied_info *server_info)
  31 {
  32         TALLOC_FREE(server_info->info3);
  33         ZERO_STRUCTP(server_info);
  34         return 0;
  35 }
  36
  37 /***************************************************************************
  38  Make a server_info struct. Free with TALLOC_FREE().
  39 ***************************************************************************/
  40
  41 struct auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
  42 {
  43         struct auth_serversupplied_info *result;
  44
  45         result = TALLOC_ZERO_P(mem_ctx, struct auth_serversupplied_info);
  46         if (result == NULL) {
  47                 DEBUG(0, ("talloc failed\n"));
  48                 return NULL;
  49         }
  50
  51         talloc_set_destructor(result, server_info_dtor);
  52
  53         /* Initialise the uid and gid values to something non-zero
  54            which may save us from giving away root access if there
  55            is a bug in allocating these fields. */
  56
  57         result->utok.uid = -1;
  58         result->utok.gid = -1;
  59
  60         return result;
  61 }
  62
  63 /****************************************************************************
  64  inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
  65  already be initialized and is used as the talloc parent for its members.
  66 *****************************************************************************/
  67
  68 NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
  69                                 uint8_t *pipe_session_key,
  70                                 size_t pipe_session_key_len,
  71                                 struct netr_SamInfo2 *sam2)
  72 {
  73         struct netr_SamInfo3 *info3;
  74
  75         info3 = copy_netr_SamInfo3(sam2, server_info->info3);
  76         if (!info3) {
  77                 return NT_STATUS_NO_MEMORY;
  78         }
  79
  80         if (server_info->user_session_key.length) {
  81                 memcpy(info3->base.key.key,
  82                        server_info->user_session_key.data,
  83                        MIN(sizeof(info3->base.key.key),
  84                            server_info->user_session_key.length));
  85                 if (pipe_session_key) {
  86                         arcfour_crypt(info3->base.key.key,
  87                                       pipe_session_key, 16);
  88                 }
  89         }
  90         if (server_info->lm_session_key.length) {
  91                 memcpy(info3->base.LMSessKey.key,
  92                        server_info->lm_session_key.data,
  93                        MIN(sizeof(info3->base.LMSessKey.key),
  94                            server_info->lm_session_key.length));
  95                 if (pipe_session_key) {
  96                         arcfour_crypt(info3->base.LMSessKey.key,
  97                                       pipe_session_key, 8);
  98                 }
  99         }
 100
 101         sam2->base = info3->base;
 102
 103         return NT_STATUS_OK;
 104 }
 105
 106 /****************************************************************************
 107  inits a netr_SamInfo3 structure from an auth_serversupplied_info. sam3 must
 108  already be initialized and is used as the talloc parent for its members.
 109 *****************************************************************************/
 110
 111 NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_info,
 112                                 uint8_t *pipe_session_key,
 113                                 size_t pipe_session_key_len,
 114                                 struct netr_SamInfo3 *sam3)
 115 {
 116         struct netr_SamInfo3 *info3;
 117
 118         info3 = copy_netr_SamInfo3(sam3, server_info->info3);
 119         if (!info3) {
 120                 return NT_STATUS_NO_MEMORY;
 121         }
 122
 123         if (server_info->user_session_key.length) {
 124                 memcpy(info3->base.key.key,
 125                        server_info->user_session_key.data,
 126                        MIN(sizeof(info3->base.key.key),
 127                            server_info->user_session_key.length));
 128                 if (pipe_session_key) {
 129                         arcfour_crypt(info3->base.key.key,
 130                                       pipe_session_key, 16);
 131                 }
 132         }
 133         if (server_info->lm_session_key.length) {
 134                 memcpy(info3->base.LMSessKey.key,
 135                        server_info->lm_session_key.data,
 136                        MIN(sizeof(info3->base.LMSessKey.key),
 137                            server_info->lm_session_key.length));
 138                 if (pipe_session_key) {
 139                         arcfour_crypt(info3->base.LMSessKey.key,
 140                                       pipe_session_key, 8);
 141                 }
 142         }
 143
 144         sam3->base = info3->base;
 145
 146         sam3->sidcount          = 0;
 147         sam3->sids              = NULL;
 148
 149         return NT_STATUS_OK;
 150 }
 151
 152 /****************************************************************************
 153  inits a netr_SamInfo6 structure from an auth_serversupplied_info. sam6 must
 154  already be initialized and is used as the talloc parent for its members.
 155 *****************************************************************************/
 156
 157 NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
 158                                 uint8_t *pipe_session_key,
 159                                 size_t pipe_session_key_len,
 160                                 struct netr_SamInfo6 *sam6)
 161 {
 162         struct pdb_domain_info *dominfo;
 163         struct netr_SamInfo3 *info3;
 164
 165         if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
 166                 DEBUG(10,("Not adding validation info level 6 "
 167                            "without ADS passdb backend\n"));
 168                 return NT_STATUS_INVALID_INFO_CLASS;
 169         }
 170
 171         dominfo = pdb_get_domain_info(sam6);
 172         if (dominfo == NULL) {
 173                 return NT_STATUS_NO_MEMORY;
 174         }
 175
 176         info3 = copy_netr_SamInfo3(sam6, server_info->info3);
 177         if (!info3) {
 178                 return NT_STATUS_NO_MEMORY;
 179         }
 180
 181         if (server_info->user_session_key.length) {
 182                 memcpy(info3->base.key.key,
 183                        server_info->user_session_key.data,
 184                        MIN(sizeof(info3->base.key.key),
 185                            server_info->user_session_key.length));
 186                 if (pipe_session_key) {
 187                         arcfour_crypt(info3->base.key.key,
 188                                       pipe_session_key, 16);
 189                 }
 190         }
 191         if (server_info->lm_session_key.length) {
 192                 memcpy(info3->base.LMSessKey.key,
 193                        server_info->lm_session_key.data,
 194                        MIN(sizeof(info3->base.LMSessKey.key),
 195                            server_info->lm_session_key.length));
 196                 if (pipe_session_key) {
 197                         arcfour_crypt(info3->base.LMSessKey.key,
 198                                       pipe_session_key, 8);
 199                 }
 200         }
 201
 202         sam6->base = info3->base;
 203
 204         sam6->sidcount          = 0;
 205         sam6->sids              = NULL;
 206
 207         sam6->dns_domainname.string = talloc_strdup(sam6, dominfo->dns_domain);
 208         if (sam6->dns_domainname.string == NULL) {
 209                 return NT_STATUS_NO_MEMORY;
 210         }
 211
 212         sam6->principle.string  = talloc_asprintf(sam6, "%s@%s",
 213                                                   sam6->base.account_name.string,
 214                                                   sam6->dns_domainname.string);
 215         if (sam6->principle.string == NULL) {
 216                 return NT_STATUS_NO_MEMORY;
 217         }
 218
 219         return NT_STATUS_OK;
 220 }
 221
 222 static NTSTATUS append_netr_SidAttr(TALLOC_CTX *mem_ctx,
 223                                     struct netr_SidAttr **sids,
 224                                     uint32_t *count,
 225                                     const struct dom_sid2 *asid,
 226                                     uint32_t attributes)
 227 {
 228         uint32_t t = *count;
 229
 230         *sids = talloc_realloc(mem_ctx, *sids, struct netr_SidAttr, t + 1);
 231         if (*sids == NULL) {
 232                 return NT_STATUS_NO_MEMORY;
 233         }
 234         (*sids)[t].sid = dom_sid_dup(*sids, asid);
 235         if ((*sids)[t].sid == NULL) {
 236                 return NT_STATUS_NO_MEMORY;
 237         }
 238         (*sids)[t].attributes = attributes;
 239         *count = t + 1;
 240
 241         return NT_STATUS_OK;
 242 }
 243
 244 /* Fills the samr_RidWithAttributeArray with the provided sids.
 245  * If it happens that we have additional groups that do not belong
 246  * to the domain, add their sids as extra sids */
 247 static NTSTATUS group_sids_to_info3(struct netr_SamInfo3 *info3,
 248                                     const struct dom_sid *sids,
 249                                     size_t num_sids)
 250 {
 251         uint32_t attributes = SE_GROUP_MANDATORY |
 252                                 SE_GROUP_ENABLED_BY_DEFAULT |
 253                                 SE_GROUP_ENABLED;
 254         struct samr_RidWithAttributeArray *groups;
 255         struct dom_sid *domain_sid;
 256         unsigned int i;
 257         NTSTATUS status;
 258         uint32_t rid;
 259         bool ok;
 260
 261         domain_sid = info3->base.domain_sid;
 262         groups = &info3->base.groups;
 263
 264         groups->rids = talloc_array(info3,
 265                                     struct samr_RidWithAttribute, num_sids);
 266         if (!groups->rids) {
 267                 return NT_STATUS_NO_MEMORY;
 268         }
 269
 270         for (i = 0; i < num_sids; i++) {
 271                 ok = sid_peek_check_rid(domain_sid, &sids[i], &rid);
 272                 if (ok) {
 273
 274                         /* if it is the primary gid, skip it, we
 275                          * obviously already have it */
 276                         if (info3->base.primary_gid == rid) continue;
 277
 278                         /* store domain group rid */
 279                         groups->rids[i].rid = rid;
 280                         groups->rids[i].attributes = attributes;
 281                         groups->count++;
 282                         continue;
 283                 }
 284
 285                 /* if this wasn't a domain sid, add it as extra sid */
 286                 status = append_netr_SidAttr(info3, &info3->sids,
 287                                              &info3->sidcount,
 288                                              &sids[i], attributes);
 289                 if (!NT_STATUS_IS_OK(status)) {
 290                         return status;
 291                 }
 292         }
 293
 294         return NT_STATUS_OK;
 295 }
 296
 297 #define RET_NOMEM(ptr) do { \
 298         if (!ptr) { \
 299                 TALLOC_FREE(info3); \
 300                 return NT_STATUS_NO_MEMORY; \
 301         } } while(0)
 302
 303 NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
 304                           struct samu *samu,
 305                           const char *login_server,
 306                           struct netr_SamInfo3 **_info3,
 307                           struct extra_auth_info *extra)
 308 {
 309         struct netr_SamInfo3 *info3;
 310         const struct dom_sid *user_sid;
 311         const struct dom_sid *group_sid;
 312         struct dom_sid domain_sid;
 313         struct dom_sid *group_sids;
 314         uint32_t num_group_sids = 0;
 315         const char *tmp;
 316         gid_t *gids;
 317         NTSTATUS status;
 318         bool ok;
 319
 320         user_sid = pdb_get_user_sid(samu);
 321         group_sid = pdb_get_group_sid(samu);
 322
 323         if (!user_sid || !group_sid) {
 324                 DEBUG(1, ("Sam account is missing sids!\n"));
 325                 return NT_STATUS_UNSUCCESSFUL;
 326         }
 327
 328         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 329         if (!info3) {
 330                 return NT_STATUS_NO_MEMORY;
 331         }
 332
 333         ZERO_STRUCT(domain_sid);
 334
 335         /* check if this is a "Unix Users" domain user,
 336          * we need to handle it in a special way if that's the case */
 337         if (sid_check_is_in_unix_users(user_sid)) {
 338                 /* in info3 you can only set rids for the user and the
 339                  * primary group, and the domain sid must be that of
 340                  * the sam domain.
 341                  *
 342                  * Store a completely bogus value here.
 343                  * The real SID is stored in the extra sids.
 344                  * Other code will know to look there if (-1) is found
 345                  */
 346                 info3->base.rid = (uint32_t)(-1);
 347                 sid_copy(&extra->user_sid, user_sid);
 348
 349                 DEBUG(10, ("Unix User found in struct samu. Rid marked as "
 350                            "special and sid (%s) saved as extra sid\n",
 351                            sid_string_dbg(user_sid)));
 352         } else {
 353                 sid_copy(&domain_sid, user_sid);
 354                 sid_split_rid(&domain_sid, &info3->base.rid);
 355         }
 356
 357         if (is_null_sid(&domain_sid)) {
 358                 sid_copy(&domain_sid, get_global_sam_sid());
 359         }
 360
 361         /* check if this is a "Unix Groups" domain group,
 362          * if so we need special handling */
 363         if (sid_check_is_in_unix_groups(group_sid)) {
 364                 /* in info3 you can only set rids for the user and the
 365                  * primary group, and the domain sid must be that of
 366                  * the sam domain.
 367                  *
 368                  * Store a completely bogus value here.
 369                  * The real SID is stored in the extra sids.
 370                  * Other code will know to look there if (-1) is found
 371                  */
 372                 info3->base.primary_gid = (uint32_t)(-1);
 373                 sid_copy(&extra->pgid_sid, group_sid);
 374
 375                 DEBUG(10, ("Unix Group found in struct samu. Rid marked as "
 376                            "special and sid (%s) saved as extra sid\n",
 377                            sid_string_dbg(group_sid)));
 378
 379         } else {
 380                 ok = sid_peek_check_rid(&domain_sid, group_sid,
 381                                         &info3->base.primary_gid);
 382                 if (!ok) {
 383                         DEBUG(1, ("The primary group domain sid(%s) does not "
 384                                   "match the domain sid(%s) for %s(%s)\n",
 385                                   sid_string_dbg(group_sid),
 386                                   sid_string_dbg(&domain_sid),
 387                                   pdb_get_username(samu),
 388                                   sid_string_dbg(user_sid)));
 389                         TALLOC_FREE(info3);
 390                         return NT_STATUS_UNSUCCESSFUL;
 391                 }
 392         }
 393
 394         unix_to_nt_time(&info3->base.last_logon, pdb_get_logon_time(samu));
 395         unix_to_nt_time(&info3->base.last_logoff, get_time_t_max());
 396         unix_to_nt_time(&info3->base.acct_expiry, get_time_t_max());
 397         unix_to_nt_time(&info3->base.last_password_change,
 398                         pdb_get_pass_last_set_time(samu));
 399         unix_to_nt_time(&info3->base.allow_password_change,
 400                         pdb_get_pass_can_change_time(samu));
 401         unix_to_nt_time(&info3->base.force_password_change,
 402                         pdb_get_pass_must_change_time(samu));
 403
 404         tmp = pdb_get_username(samu);
 405         if (tmp) {
 406                 info3->base.account_name.string = talloc_strdup(info3, tmp);
 407                 RET_NOMEM(info3->base.account_name.string);
 408         }
 409         tmp = pdb_get_fullname(samu);
 410         if (tmp) {
 411                 info3->base.full_name.string = talloc_strdup(info3, tmp);
 412                 RET_NOMEM(info3->base.full_name.string);
 413         }
 414         tmp = pdb_get_logon_script(samu);
 415         if (tmp) {
 416                 info3->base.logon_script.string = talloc_strdup(info3, tmp);
 417                 RET_NOMEM(info3->base.logon_script.string);
 418         }
 419         tmp = pdb_get_profile_path(samu);
 420         if (tmp) {
 421                 info3->base.profile_path.string = talloc_strdup(info3, tmp);
 422                 RET_NOMEM(info3->base.profile_path.string);
 423         }
 424         tmp = pdb_get_homedir(samu);
 425         if (tmp) {
 426                 info3->base.home_directory.string = talloc_strdup(info3, tmp);
 427                 RET_NOMEM(info3->base.home_directory.string);
 428         }
 429         tmp = pdb_get_dir_drive(samu);
 430         if (tmp) {
 431                 info3->base.home_drive.string = talloc_strdup(info3, tmp);
 432                 RET_NOMEM(info3->base.home_drive.string);
 433         }
 434
 435         info3->base.logon_count = pdb_get_logon_count(samu);
 436         info3->base.bad_password_count = pdb_get_bad_password_count(samu);
 437
 438         status = pdb_enum_group_memberships(mem_ctx, samu,
 439                                             &group_sids, &gids,
 440                                             &num_group_sids);
 441         if (!NT_STATUS_IS_OK(status)) {
 442                 DEBUG(1, ("Failed to get groups from sam account.\n"));
 443                 TALLOC_FREE(info3);
 444                 return status;
 445         }
 446
 447         if (num_group_sids) {
 448                 status = group_sids_to_info3(info3, group_sids, num_group_sids);
 449                 if (!NT_STATUS_IS_OK(status)) {
 450                         TALLOC_FREE(info3);
 451                         return status;
 452                 }
 453         }
 454
 455         /* We don't need sids and gids after the conversion */
 456         TALLOC_FREE(group_sids);
 457         TALLOC_FREE(gids);
 458         num_group_sids = 0;
 459
 460         /* FIXME: should we add other flags ? */
 461         info3->base.user_flags = NETLOGON_EXTRA_SIDS;
 462
 463         if (login_server) {
 464                 info3->base.logon_server.string = talloc_strdup(info3, login_server);
 465                 RET_NOMEM(info3->base.logon_server.string);
 466         }
 467
 468         info3->base.domain.string = talloc_strdup(info3,
 469                                                   pdb_get_domain(samu));
 470         RET_NOMEM(info3->base.domain.string);
 471
 472         info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
 473         RET_NOMEM(info3->base.domain_sid);
 474
 475         info3->base.acct_flags = pdb_get_acct_ctrl(samu);
 476
 477         *_info3 = info3;
 478         return NT_STATUS_OK;
 479 }
 480
 481 #undef RET_NOMEM
 482
 483 #define RET_NOMEM(ptr) do { \
 484         if (!ptr) { \
 485                 TALLOC_FREE(info3); \
 486                 return NULL; \
 487         } } while(0)
 488
 489 struct netr_SamInfo3 *copy_netr_SamInfo3(TALLOC_CTX *mem_ctx,
 490                                          struct netr_SamInfo3 *orig)
 491 {
 492         struct netr_SamInfo3 *info3;
 493         unsigned int i;
 494         NTSTATUS status;
 495
 496         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 497         if (!info3) return NULL;
 498
 499         status = copy_netr_SamBaseInfo(info3, &orig->base, &info3->base);
 500         if (!NT_STATUS_IS_OK(status)) {
 501                 TALLOC_FREE(info3);
 502                 return NULL;
 503         }
 504
 505         if (orig->sidcount) {
 506                 info3->sidcount = orig->sidcount;
 507                 info3->sids = talloc_array(info3, struct netr_SidAttr,
 508                                            orig->sidcount);
 509                 RET_NOMEM(info3->sids);
 510                 for (i = 0; i < orig->sidcount; i++) {
 511                         info3->sids[i].sid = dom_sid_dup(info3->sids,
 512                                                             orig->sids[i].sid);
 513                         RET_NOMEM(info3->sids[i].sid);
 514                         info3->sids[i].attributes =
 515                                 orig->sids[i].attributes;
 516                 }
 517         }
 518
 519         return info3;
 520 }
 521
 522 static NTSTATUS wbcsids_to_samr_RidWithAttributeArray(
 523                                 TALLOC_CTX *mem_ctx,
 524                                 struct samr_RidWithAttributeArray *groups,
 525                                 const struct dom_sid *domain_sid,
 526                                 const struct wbcSidWithAttr *sids,
 527                                 size_t num_sids)
 528 {
 529         unsigned int i;
 530         bool ok;
 531
 532         groups->rids = talloc_array(mem_ctx,
 533                                     struct samr_RidWithAttribute, num_sids);
 534         if (!groups->rids) {
 535                 return NT_STATUS_NO_MEMORY;
 536         }
 537
 538         /* a wbcDomainSid is the same as a dom_sid */
 539         for (i = 0; i < num_sids; i++) {
 540                 ok = sid_peek_check_rid(domain_sid,
 541                                         (const struct dom_sid *)&sids[i].sid,
 542                                         &groups->rids[i].rid);
 543                 if (!ok) continue;
 544
 545                 groups->rids[i].attributes = SE_GROUP_MANDATORY |
 546                                              SE_GROUP_ENABLED_BY_DEFAULT |
 547                                              SE_GROUP_ENABLED;
 548                 groups->count++;
 549         }
 550
 551         return NT_STATUS_OK;
 552 }
 553
 554 struct netr_SamInfo3 *wbcAuthUserInfo_to_netr_SamInfo3(TALLOC_CTX *mem_ctx,
 555                                         const struct wbcAuthUserInfo *info)
 556 {
 557         struct netr_SamInfo3 *info3;
 558         struct dom_sid user_sid;
 559         struct dom_sid group_sid;
 560         struct dom_sid domain_sid;
 561         NTSTATUS status;
 562         bool ok;
 563
 564         memcpy(&user_sid, &info->sids[0].sid, sizeof(user_sid));
 565         memcpy(&group_sid, &info->sids[1].sid, sizeof(group_sid));
 566
 567         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 568         if (!info3) return NULL;
 569
 570         info3->base.last_logon = info->logon_time;
 571         info3->base.last_logoff = info->logoff_time;
 572         info3->base.acct_expiry = info->kickoff_time;
 573         unix_to_nt_time(&info3->base.last_password_change, info->pass_last_set_time);
 574         unix_to_nt_time(&info3->base.allow_password_change,
 575                         info->pass_can_change_time);
 576         unix_to_nt_time(&info3->base.force_password_change,
 577                         info->pass_must_change_time);
 578
 579         if (info->account_name) {
 580                 info3->base.account_name.string =
 581                                 talloc_strdup(info3, info->account_name);
 582                 RET_NOMEM(info3->base.account_name.string);
 583         }
 584         if (info->full_name) {
 585                 info3->base.full_name.string =
 586                                 talloc_strdup(info3, info->full_name);
 587                 RET_NOMEM(info3->base.full_name.string);
 588         }
 589         if (info->logon_script) {
 590                 info3->base.logon_script.string =
 591                                 talloc_strdup(info3, info->logon_script);
 592                 RET_NOMEM(info3->base.logon_script.string);
 593         }
 594         if (info->profile_path) {
 595                 info3->base.profile_path.string =
 596                                 talloc_strdup(info3, info->profile_path);
 597                 RET_NOMEM(info3->base.profile_path.string);
 598         }
 599         if (info->home_directory) {
 600                 info3->base.home_directory.string =
 601                                 talloc_strdup(info3, info->home_directory);
 602                 RET_NOMEM(info3->base.home_directory.string);
 603         }
 604         if (info->home_drive) {
 605                 info3->base.home_drive.string =
 606                                 talloc_strdup(info3, info->home_drive);
 607                 RET_NOMEM(info3->base.home_drive.string);
 608         }
 609
 610         info3->base.logon_count = info->logon_count;
 611         info3->base.bad_password_count = info->bad_password_count;
 612
 613         sid_copy(&domain_sid, &user_sid);
 614         sid_split_rid(&domain_sid, &info3->base.rid);
 615
 616         ok = sid_peek_check_rid(&domain_sid, &group_sid,
 617                                 &info3->base.primary_gid);
 618         if (!ok) {
 619                 DEBUG(1, ("The primary group sid domain does not"
 620                           "match user sid domain for user: %s\n",
 621                           info->account_name));
 622                 TALLOC_FREE(info3);
 623                 return NULL;
 624         }
 625
 626         status = wbcsids_to_samr_RidWithAttributeArray(info3,
 627                                                        &info3->base.groups,
 628                                                        &domain_sid,
 629                                                        &info->sids[1],
 630                                                        info->num_sids - 1);
 631         if (!NT_STATUS_IS_OK(status)) {
 632                 TALLOC_FREE(info3);
 633                 return NULL;
 634         }
 635
 636         info3->base.user_flags = info->user_flags;
 637         memcpy(info3->base.key.key, info->user_session_key, 16);
 638
 639         if (info->logon_server) {
 640                 info3->base.logon_server.string =
 641                                 talloc_strdup(info3, info->logon_server);
 642                 RET_NOMEM(info3->base.logon_server.string);
 643         }
 644         if (info->domain_name) {
 645                 info3->base.domain.string =
 646                                 talloc_strdup(info3, info->domain_name);
 647                 RET_NOMEM(info3->base.domain.string);
 648         }
 649
 650         info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
 651         RET_NOMEM(info3->base.domain_sid);
 652
 653         memcpy(info3->base.LMSessKey.key, info->lm_session_key, 8);
 654         info3->base.acct_flags = info->acct_flags;
 655
 656         return info3;
 657 }