source3/auth/server_info.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Volker Lendecke 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "auth.h"
  22 #include "../lib/crypto/arcfour.h"
  23 #include "../librpc/gen_ndr/netlogon.h"
  24 #include "../libcli/security/security.h"
  25 #include "rpc_client/util_netlogon.h"
  26 #include "nsswitch/libwbclient/wbclient.h"
  27 #include "passdb.h"
  28
  29 #undef DBGC_CLASS
  30 #define DBGC_CLASS DBGC_AUTH
  31
  32 /* FIXME: do we really still need this ? */
  33 static int server_info_dtor(struct auth_serversupplied_info *server_info)
  34 {
  35         TALLOC_FREE(server_info->info3);
  36         ZERO_STRUCTP(server_info);
  37         return 0;
  38 }
  39
  40 /***************************************************************************
  41  Make a server_info struct. Free with TALLOC_FREE().
  42 ***************************************************************************/
  43
  44 struct auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
  45 {
  46         struct auth_serversupplied_info *result;
  47
  48         result = talloc_zero(mem_ctx, struct auth_serversupplied_info);
  49         if (result == NULL) {
  50                 DEBUG(0, ("talloc failed\n"));
  51                 return NULL;
  52         }
  53
  54         talloc_set_destructor(result, server_info_dtor);
  55
  56         /* Initialise the uid and gid values to something non-zero
  57            which may save us from giving away root access if there
  58            is a bug in allocating these fields. */
  59
  60         result->utok.uid = -1;
  61         result->utok.gid = -1;
  62
  63         return result;
  64 }
  65
  66 /* FIXME: do we really still need this ? */
  67 static int auth3_session_info_dtor(struct auth3_session_info *session_info)
  68 {
  69         TALLOC_FREE(session_info->info3);
  70         ZERO_STRUCTP(session_info);
  71         return 0;
  72 }
  73
  74 /***************************************************************************
  75  Make a server_info struct. Free with TALLOC_FREE().
  76 ***************************************************************************/
  77
  78 struct auth3_session_info *make_auth3_session_info(TALLOC_CTX *mem_ctx)
  79 {
  80         struct auth3_session_info *result;
  81
  82         result = talloc_zero(mem_ctx, struct auth3_session_info);
  83         if (result == NULL) {
  84                 DEBUG(0, ("talloc failed\n"));
  85                 return NULL;
  86         }
  87
  88         talloc_set_destructor(result, auth3_session_info_dtor);
  89
  90         /* Initialise the unix_token to NULL which may save us from
  91            giving away root access if there is a bug in allocating
  92            these fields. */
  93
  94         result->unix_token = NULL;
  95
  96         return result;
  97 }
  98
  99 /****************************************************************************
 100  inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
 101  already be initialized and is used as the talloc parent for its members.
 102 *****************************************************************************/
 103
 104 NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
 105                                 uint8_t *pipe_session_key,
 106                                 size_t pipe_session_key_len,
 107                                 struct netr_SamInfo2 *sam2)
 108 {
 109         struct netr_SamInfo3 *info3;
 110
 111         info3 = copy_netr_SamInfo3(sam2, server_info->info3);
 112         if (!info3) {
 113                 return NT_STATUS_NO_MEMORY;
 114         }
 115
 116         if (server_info->session_key.length) {
 117                 memcpy(info3->base.key.key,
 118                        server_info->session_key.data,
 119                        MIN(sizeof(info3->base.key.key),
 120                            server_info->session_key.length));
 121                 if (pipe_session_key) {
 122                         arcfour_crypt(info3->base.key.key,
 123                                       pipe_session_key, 16);
 124                 }
 125         }
 126         if (server_info->lm_session_key.length) {
 127                 memcpy(info3->base.LMSessKey.key,
 128                        server_info->lm_session_key.data,
 129                        MIN(sizeof(info3->base.LMSessKey.key),
 130                            server_info->lm_session_key.length));
 131                 if (pipe_session_key) {
 132                         arcfour_crypt(info3->base.LMSessKey.key,
 133                                       pipe_session_key, 8);
 134                 }
 135         }
 136
 137         sam2->base = info3->base;
 138
 139         return NT_STATUS_OK;
 140 }
 141
 142 /****************************************************************************
 143  inits a netr_SamInfo3 structure from an auth_serversupplied_info. sam3 must
 144  already be initialized and is used as the talloc parent for its members.
 145 *****************************************************************************/
 146
 147 NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_info,
 148                                 uint8_t *pipe_session_key,
 149                                 size_t pipe_session_key_len,
 150                                 struct netr_SamInfo3 *sam3)
 151 {
 152         struct netr_SamInfo3 *info3;
 153
 154         info3 = copy_netr_SamInfo3(sam3, server_info->info3);
 155         if (!info3) {
 156                 return NT_STATUS_NO_MEMORY;
 157         }
 158
 159         if (server_info->session_key.length) {
 160                 memcpy(info3->base.key.key,
 161                        server_info->session_key.data,
 162                        MIN(sizeof(info3->base.key.key),
 163                            server_info->session_key.length));
 164                 if (pipe_session_key) {
 165                         arcfour_crypt(info3->base.key.key,
 166                                       pipe_session_key, 16);
 167                 }
 168         }
 169         if (server_info->lm_session_key.length) {
 170                 memcpy(info3->base.LMSessKey.key,
 171                        server_info->lm_session_key.data,
 172                        MIN(sizeof(info3->base.LMSessKey.key),
 173                            server_info->lm_session_key.length));
 174                 if (pipe_session_key) {
 175                         arcfour_crypt(info3->base.LMSessKey.key,
 176                                       pipe_session_key, 8);
 177                 }
 178         }
 179
 180         sam3->base = info3->base;
 181
 182         sam3->sidcount          = 0;
 183         sam3->sids              = NULL;
 184
 185         return NT_STATUS_OK;
 186 }
 187
 188 /****************************************************************************
 189  inits a netr_SamInfo6 structure from an auth_serversupplied_info. sam6 must
 190  already be initialized and is used as the talloc parent for its members.
 191 *****************************************************************************/
 192
 193 NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
 194                                 uint8_t *pipe_session_key,
 195                                 size_t pipe_session_key_len,
 196                                 struct netr_SamInfo6 *sam6)
 197 {
 198         struct pdb_domain_info *dominfo;
 199         struct netr_SamInfo3 *info3;
 200
 201         if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
 202                 DEBUG(10,("Not adding validation info level 6 "
 203                            "without ADS passdb backend\n"));
 204                 return NT_STATUS_INVALID_INFO_CLASS;
 205         }
 206
 207         dominfo = pdb_get_domain_info(sam6);
 208         if (dominfo == NULL) {
 209                 return NT_STATUS_NO_MEMORY;
 210         }
 211
 212         info3 = copy_netr_SamInfo3(sam6, server_info->info3);
 213         if (!info3) {
 214                 return NT_STATUS_NO_MEMORY;
 215         }
 216
 217         if (server_info->session_key.length) {
 218                 memcpy(info3->base.key.key,
 219                        server_info->session_key.data,
 220                        MIN(sizeof(info3->base.key.key),
 221                            server_info->session_key.length));
 222                 if (pipe_session_key) {
 223                         arcfour_crypt(info3->base.key.key,
 224                                       pipe_session_key, 16);
 225                 }
 226         }
 227         if (server_info->lm_session_key.length) {
 228                 memcpy(info3->base.LMSessKey.key,
 229                        server_info->lm_session_key.data,
 230                        MIN(sizeof(info3->base.LMSessKey.key),
 231                            server_info->lm_session_key.length));
 232                 if (pipe_session_key) {
 233                         arcfour_crypt(info3->base.LMSessKey.key,
 234                                       pipe_session_key, 8);
 235                 }
 236         }
 237
 238         sam6->base = info3->base;
 239
 240         sam6->sidcount          = 0;
 241         sam6->sids              = NULL;
 242
 243         sam6->dns_domainname.string = talloc_strdup(sam6, dominfo->dns_domain);
 244         if (sam6->dns_domainname.string == NULL) {
 245                 return NT_STATUS_NO_MEMORY;
 246         }
 247
 248         sam6->principle.string  = talloc_asprintf(sam6, "%s@%s",
 249                                                   sam6->base.account_name.string,
 250                                                   sam6->dns_domainname.string);
 251         if (sam6->principle.string == NULL) {
 252                 return NT_STATUS_NO_MEMORY;
 253         }
 254
 255         return NT_STATUS_OK;
 256 }
 257
 258 static NTSTATUS append_netr_SidAttr(TALLOC_CTX *mem_ctx,
 259                                     struct netr_SidAttr **sids,
 260                                     uint32_t *count,
 261                                     const struct dom_sid2 *asid,
 262                                     uint32_t attributes)
 263 {
 264         uint32_t t = *count;
 265
 266         *sids = talloc_realloc(mem_ctx, *sids, struct netr_SidAttr, t + 1);
 267         if (*sids == NULL) {
 268                 return NT_STATUS_NO_MEMORY;
 269         }
 270         (*sids)[t].sid = dom_sid_dup(*sids, asid);
 271         if ((*sids)[t].sid == NULL) {
 272                 return NT_STATUS_NO_MEMORY;
 273         }
 274         (*sids)[t].attributes = attributes;
 275         *count = t + 1;
 276
 277         return NT_STATUS_OK;
 278 }
 279
 280 /* Fills the samr_RidWithAttributeArray with the provided sids.
 281  * If it happens that we have additional groups that do not belong
 282  * to the domain, add their sids as extra sids */
 283 static NTSTATUS group_sids_to_info3(struct netr_SamInfo3 *info3,
 284                                     const struct dom_sid *sids,
 285                                     size_t num_sids)
 286 {
 287         uint32_t attributes = SE_GROUP_MANDATORY |
 288                                 SE_GROUP_ENABLED_BY_DEFAULT |
 289                                 SE_GROUP_ENABLED;
 290         struct samr_RidWithAttributeArray *groups;
 291         struct dom_sid *domain_sid;
 292         unsigned int i;
 293         NTSTATUS status;
 294         uint32_t rid;
 295         bool ok;
 296
 297         domain_sid = info3->base.domain_sid;
 298         groups = &info3->base.groups;
 299
 300         groups->rids = talloc_array(info3,
 301                                     struct samr_RidWithAttribute, num_sids);
 302         if (!groups->rids) {
 303                 return NT_STATUS_NO_MEMORY;
 304         }
 305
 306         for (i = 0; i < num_sids; i++) {
 307                 ok = sid_peek_check_rid(domain_sid, &sids[i], &rid);
 308                 if (ok) {
 309
 310                         /* if it is the primary gid, skip it, we
 311                          * obviously already have it */
 312                         if (info3->base.primary_gid == rid) continue;
 313
 314                         /* store domain group rid */
 315                         groups->rids[i].rid = rid;
 316                         groups->rids[i].attributes = attributes;
 317                         groups->count++;
 318                         continue;
 319                 }
 320
 321                 /* if this wasn't a domain sid, add it as extra sid */
 322                 status = append_netr_SidAttr(info3, &info3->sids,
 323                                              &info3->sidcount,
 324                                              &sids[i], attributes);
 325                 if (!NT_STATUS_IS_OK(status)) {
 326                         return status;
 327                 }
 328         }
 329
 330         return NT_STATUS_OK;
 331 }
 332
 333 #define RET_NOMEM(ptr) do { \
 334         if (!ptr) { \
 335                 TALLOC_FREE(info3); \
 336                 return NT_STATUS_NO_MEMORY; \
 337         } } while(0)
 338
 339 NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
 340                           struct samu *samu,
 341                           const char *login_server,
 342                           struct netr_SamInfo3 **_info3,
 343                           struct extra_auth_info *extra)
 344 {
 345         struct netr_SamInfo3 *info3;
 346         const struct dom_sid *user_sid;
 347         const struct dom_sid *group_sid;
 348         struct dom_sid domain_sid;
 349         struct dom_sid *group_sids;
 350         uint32_t num_group_sids = 0;
 351         const char *tmp;
 352         gid_t *gids;
 353         NTSTATUS status;
 354         bool ok;
 355
 356         user_sid = pdb_get_user_sid(samu);
 357         group_sid = pdb_get_group_sid(samu);
 358
 359         if (!user_sid || !group_sid) {
 360                 DEBUG(1, ("Sam account is missing sids!\n"));
 361                 return NT_STATUS_UNSUCCESSFUL;
 362         }
 363
 364         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 365         if (!info3) {
 366                 return NT_STATUS_NO_MEMORY;
 367         }
 368
 369         ZERO_STRUCT(domain_sid);
 370
 371         /* check if this is a "Unix Users" domain user,
 372          * we need to handle it in a special way if that's the case */
 373         if (sid_check_is_in_unix_users(user_sid)) {
 374                 /* in info3 you can only set rids for the user and the
 375                  * primary group, and the domain sid must be that of
 376                  * the sam domain.
 377                  *
 378                  * Store a completely bogus value here.
 379                  * The real SID is stored in the extra sids.
 380                  * Other code will know to look there if (-1) is found
 381                  */
 382                 info3->base.rid = (uint32_t)(-1);
 383                 sid_copy(&extra->user_sid, user_sid);
 384
 385                 DEBUG(10, ("Unix User found in struct samu. Rid marked as "
 386                            "special and sid (%s) saved as extra sid\n",
 387                            sid_string_dbg(user_sid)));
 388         } else {
 389                 sid_copy(&domain_sid, user_sid);
 390                 sid_split_rid(&domain_sid, &info3->base.rid);
 391         }
 392
 393         if (is_null_sid(&domain_sid)) {
 394                 sid_copy(&domain_sid, get_global_sam_sid());
 395         }
 396
 397         /* check if this is a "Unix Groups" domain group,
 398          * if so we need special handling */
 399         if (sid_check_is_in_unix_groups(group_sid)) {
 400                 /* in info3 you can only set rids for the user and the
 401                  * primary group, and the domain sid must be that of
 402                  * the sam domain.
 403                  *
 404                  * Store a completely bogus value here.
 405                  * The real SID is stored in the extra sids.
 406                  * Other code will know to look there if (-1) is found
 407                  */
 408                 info3->base.primary_gid = (uint32_t)(-1);
 409                 sid_copy(&extra->pgid_sid, group_sid);
 410
 411                 DEBUG(10, ("Unix Group found in struct samu. Rid marked as "
 412                            "special and sid (%s) saved as extra sid\n",
 413                            sid_string_dbg(group_sid)));
 414
 415         } else {
 416                 ok = sid_peek_check_rid(&domain_sid, group_sid,
 417                                         &info3->base.primary_gid);
 418                 if (!ok) {
 419                         DEBUG(1, ("The primary group domain sid(%s) does not "
 420                                   "match the domain sid(%s) for %s(%s)\n",
 421                                   sid_string_dbg(group_sid),
 422                                   sid_string_dbg(&domain_sid),
 423                                   pdb_get_username(samu),
 424                                   sid_string_dbg(user_sid)));
 425                         TALLOC_FREE(info3);
 426                         return NT_STATUS_UNSUCCESSFUL;
 427                 }
 428         }
 429
 430         unix_to_nt_time(&info3->base.last_logon, pdb_get_logon_time(samu));
 431         unix_to_nt_time(&info3->base.last_logoff, get_time_t_max());
 432         unix_to_nt_time(&info3->base.acct_expiry, get_time_t_max());
 433         unix_to_nt_time(&info3->base.last_password_change,
 434                         pdb_get_pass_last_set_time(samu));
 435         unix_to_nt_time(&info3->base.allow_password_change,
 436                         pdb_get_pass_can_change_time(samu));
 437         unix_to_nt_time(&info3->base.force_password_change,
 438                         pdb_get_pass_must_change_time(samu));
 439
 440         tmp = pdb_get_username(samu);
 441         if (tmp) {
 442                 info3->base.account_name.string = talloc_strdup(info3, tmp);
 443                 RET_NOMEM(info3->base.account_name.string);
 444         }
 445         tmp = pdb_get_fullname(samu);
 446         if (tmp) {
 447                 info3->base.full_name.string = talloc_strdup(info3, tmp);
 448                 RET_NOMEM(info3->base.full_name.string);
 449         }
 450         tmp = pdb_get_logon_script(samu);
 451         if (tmp) {
 452                 info3->base.logon_script.string = talloc_strdup(info3, tmp);
 453                 RET_NOMEM(info3->base.logon_script.string);
 454         }
 455         tmp = pdb_get_profile_path(samu);
 456         if (tmp) {
 457                 info3->base.profile_path.string = talloc_strdup(info3, tmp);
 458                 RET_NOMEM(info3->base.profile_path.string);
 459         }
 460         tmp = pdb_get_homedir(samu);
 461         if (tmp) {
 462                 info3->base.home_directory.string = talloc_strdup(info3, tmp);
 463                 RET_NOMEM(info3->base.home_directory.string);
 464         }
 465         tmp = pdb_get_dir_drive(samu);
 466         if (tmp) {
 467                 info3->base.home_drive.string = talloc_strdup(info3, tmp);
 468                 RET_NOMEM(info3->base.home_drive.string);
 469         }
 470
 471         info3->base.logon_count = pdb_get_logon_count(samu);
 472         info3->base.bad_password_count = pdb_get_bad_password_count(samu);
 473
 474         status = pdb_enum_group_memberships(mem_ctx, samu,
 475                                             &group_sids, &gids,
 476                                             &num_group_sids);
 477         if (!NT_STATUS_IS_OK(status)) {
 478                 DEBUG(1, ("Failed to get groups from sam account.\n"));
 479                 TALLOC_FREE(info3);
 480                 return status;
 481         }
 482
 483         if (num_group_sids) {
 484                 status = group_sids_to_info3(info3, group_sids, num_group_sids);
 485                 if (!NT_STATUS_IS_OK(status)) {
 486                         TALLOC_FREE(info3);
 487                         return status;
 488                 }
 489         }
 490
 491         /* We don't need sids and gids after the conversion */
 492         TALLOC_FREE(group_sids);
 493         TALLOC_FREE(gids);
 494         num_group_sids = 0;
 495
 496         /* FIXME: should we add other flags ? */
 497         info3->base.user_flags = NETLOGON_EXTRA_SIDS;
 498
 499         if (login_server) {
 500                 info3->base.logon_server.string = talloc_strdup(info3, login_server);
 501                 RET_NOMEM(info3->base.logon_server.string);
 502         }
 503
 504         info3->base.domain.string = talloc_strdup(info3,
 505                                                   pdb_get_domain(samu));
 506         RET_NOMEM(info3->base.domain.string);
 507
 508         info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
 509         RET_NOMEM(info3->base.domain_sid);
 510
 511         info3->base.acct_flags = pdb_get_acct_ctrl(samu);
 512
 513         *_info3 = info3;
 514         return NT_STATUS_OK;
 515 }
 516
 517 #undef RET_NOMEM
 518
 519 #define RET_NOMEM(ptr) do { \
 520         if (!ptr) { \
 521                 TALLOC_FREE(info3); \
 522                 return NULL; \
 523         } } while(0)
 524
 525 struct netr_SamInfo3 *copy_netr_SamInfo3(TALLOC_CTX *mem_ctx,
 526                                          struct netr_SamInfo3 *orig)
 527 {
 528         struct netr_SamInfo3 *info3;
 529         unsigned int i;
 530         NTSTATUS status;
 531
 532         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 533         if (!info3) return NULL;
 534
 535         status = copy_netr_SamBaseInfo(info3, &orig->base, &info3->base);
 536         if (!NT_STATUS_IS_OK(status)) {
 537                 TALLOC_FREE(info3);
 538                 return NULL;
 539         }
 540
 541         if (orig->sidcount) {
 542                 info3->sidcount = orig->sidcount;
 543                 info3->sids = talloc_array(info3, struct netr_SidAttr,
 544                                            orig->sidcount);
 545                 RET_NOMEM(info3->sids);
 546                 for (i = 0; i < orig->sidcount; i++) {
 547                         info3->sids[i].sid = dom_sid_dup(info3->sids,
 548                                                             orig->sids[i].sid);
 549                         RET_NOMEM(info3->sids[i].sid);
 550                         info3->sids[i].attributes =
 551                                 orig->sids[i].attributes;
 552                 }
 553         }
 554
 555         return info3;
 556 }
 557
 558 static NTSTATUS wbcsids_to_samr_RidWithAttributeArray(
 559                                 TALLOC_CTX *mem_ctx,
 560                                 struct samr_RidWithAttributeArray *groups,
 561                                 const struct dom_sid *domain_sid,
 562                                 const struct wbcSidWithAttr *sids,
 563                                 size_t num_sids)
 564 {
 565         unsigned int i;
 566         bool ok;
 567
 568         groups->rids = talloc_array(mem_ctx,
 569                                     struct samr_RidWithAttribute, num_sids);
 570         if (!groups->rids) {
 571                 return NT_STATUS_NO_MEMORY;
 572         }
 573
 574         /* a wbcDomainSid is the same as a dom_sid */
 575         for (i = 0; i < num_sids; i++) {
 576                 ok = sid_peek_check_rid(domain_sid,
 577                                         (const struct dom_sid *)&sids[i].sid,
 578                                         &groups->rids[i].rid);
 579                 if (!ok) continue;
 580
 581                 groups->rids[i].attributes = SE_GROUP_MANDATORY |
 582                                              SE_GROUP_ENABLED_BY_DEFAULT |
 583                                              SE_GROUP_ENABLED;
 584                 groups->count++;
 585         }
 586
 587         return NT_STATUS_OK;
 588 }
 589
 590 struct netr_SamInfo3 *wbcAuthUserInfo_to_netr_SamInfo3(TALLOC_CTX *mem_ctx,
 591                                         const struct wbcAuthUserInfo *info)
 592 {
 593         struct netr_SamInfo3 *info3;
 594         struct dom_sid user_sid;
 595         struct dom_sid group_sid;
 596         struct dom_sid domain_sid;
 597         NTSTATUS status;
 598         bool ok;
 599
 600         memcpy(&user_sid, &info->sids[0].sid, sizeof(user_sid));
 601         memcpy(&group_sid, &info->sids[1].sid, sizeof(group_sid));
 602
 603         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 604         if (!info3) return NULL;
 605
 606         info3->base.last_logon = info->logon_time;
 607         info3->base.last_logoff = info->logoff_time;
 608         info3->base.acct_expiry = info->kickoff_time;
 609         unix_to_nt_time(&info3->base.last_password_change, info->pass_last_set_time);
 610         unix_to_nt_time(&info3->base.allow_password_change,
 611                         info->pass_can_change_time);
 612         unix_to_nt_time(&info3->base.force_password_change,
 613                         info->pass_must_change_time);
 614
 615         if (info->account_name) {
 616                 info3->base.account_name.string =
 617                                 talloc_strdup(info3, info->account_name);
 618                 RET_NOMEM(info3->base.account_name.string);
 619         }
 620         if (info->full_name) {
 621                 info3->base.full_name.string =
 622                                 talloc_strdup(info3, info->full_name);
 623                 RET_NOMEM(info3->base.full_name.string);
 624         }
 625         if (info->logon_script) {
 626                 info3->base.logon_script.string =
 627                                 talloc_strdup(info3, info->logon_script);
 628                 RET_NOMEM(info3->base.logon_script.string);
 629         }
 630         if (info->profile_path) {
 631                 info3->base.profile_path.string =
 632                                 talloc_strdup(info3, info->profile_path);
 633                 RET_NOMEM(info3->base.profile_path.string);
 634         }
 635         if (info->home_directory) {
 636                 info3->base.home_directory.string =
 637                                 talloc_strdup(info3, info->home_directory);
 638                 RET_NOMEM(info3->base.home_directory.string);
 639         }
 640         if (info->home_drive) {
 641                 info3->base.home_drive.string =
 642                                 talloc_strdup(info3, info->home_drive);
 643                 RET_NOMEM(info3->base.home_drive.string);
 644         }
 645
 646         info3->base.logon_count = info->logon_count;
 647         info3->base.bad_password_count = info->bad_password_count;
 648
 649         sid_copy(&domain_sid, &user_sid);
 650         sid_split_rid(&domain_sid, &info3->base.rid);
 651
 652         ok = sid_peek_check_rid(&domain_sid, &group_sid,
 653                                 &info3->base.primary_gid);
 654         if (!ok) {
 655                 DEBUG(1, ("The primary group sid domain does not"
 656                           "match user sid domain for user: %s\n",
 657                           info->account_name));
 658                 TALLOC_FREE(info3);
 659                 return NULL;
 660         }
 661
 662         status = wbcsids_to_samr_RidWithAttributeArray(info3,
 663                                                        &info3->base.groups,
 664                                                        &domain_sid,
 665                                                        &info->sids[1],
 666                                                        info->num_sids - 1);
 667         if (!NT_STATUS_IS_OK(status)) {
 668                 TALLOC_FREE(info3);
 669                 return NULL;
 670         }
 671
 672         info3->base.user_flags = info->user_flags;
 673         memcpy(info3->base.key.key, info->user_session_key, 16);
 674
 675         if (info->logon_server) {
 676                 info3->base.logon_server.string =
 677                                 talloc_strdup(info3, info->logon_server);
 678                 RET_NOMEM(info3->base.logon_server.string);
 679         }
 680         if (info->domain_name) {
 681                 info3->base.domain.string =
 682                                 talloc_strdup(info3, info->domain_name);
 683                 RET_NOMEM(info3->base.domain.string);
 684         }
 685
 686         info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
 687         RET_NOMEM(info3->base.domain_sid);
 688
 689         memcpy(info3->base.LMSessKey.key, info->lm_session_key, 8);
 690         info3->base.acct_flags = info->acct_flags;
 691
 692         return info3;
 693 }