2 Unix SMB/Netbios implementation.
4 Password and authentication handling
5 Copyright (C) Jeremy Allison 1996-2001
6 Copyright (C) Luke Kenneth Casson Leighton 1996-1998
7 Copyright (C) Gerald (Jerry) Carter 2000-2001
8 Copyright (C) Andrew Bartlett 2001-2002
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 * This is set on startup - it defines the SID for this
29 * machine, and therefore the SAM database for which it is
33 extern DOM_SID global_sam_sid
;
35 /************************************************************
36 Fill the SAM_ACCOUNT with default values.
37 ***********************************************************/
39 static void pdb_fill_default_sam(SAM_ACCOUNT
*user
)
41 ZERO_STRUCT(user
->private); /* Don't touch the talloc context */
43 /* Don't change these timestamp settings without a good reason.
44 They are important for NT member server compatibility. */
46 user
->private.init_flag
= FLAG_SAM_UNINIT
;
47 user
->private.uid
= user
->private.gid
= -1;
49 user
->private.logon_time
= (time_t)0;
50 user
->private.pass_last_set_time
= (time_t)0;
51 user
->private.pass_can_change_time
= (time_t)0;
52 user
->private.logoff_time
=
53 user
->private.kickoff_time
=
54 user
->private.pass_must_change_time
= get_time_t_max();
55 user
->private.unknown_3
= 0x00ffffff; /* don't know */
56 user
->private.logon_divs
= 168; /* hours per week */
57 user
->private.hours_len
= 21; /* 21 times 8 bits = 168 */
58 memset(user
->private.hours
, 0xff, user
->private.hours_len
); /* available at all hours */
59 user
->private.unknown_5
= 0x00000000; /* don't know */
60 user
->private.unknown_6
= 0x000004ec; /* don't know */
62 /* Some parts of samba strlen their pdb_get...() returns,
63 so this keeps the interface unchanged for now. */
65 user
->private.username
= "";
66 user
->private.domain
= "";
67 user
->private.nt_username
= "";
68 user
->private.full_name
= "";
69 user
->private.home_dir
= "";
70 user
->private.logon_script
= "";
71 user
->private.profile_path
= "";
72 user
->private.acct_desc
= "";
73 user
->private.workstations
= "";
74 user
->private.unknown_str
= "";
75 user
->private.munged_dial
= "";
78 static void destroy_pdb_talloc(SAM_ACCOUNT
**user
)
81 talloc_destroy((*user
)->mem_ctx
);
87 /**********************************************************************
88 Alloc memory and initialises a struct sam_passwd on supplied mem_ctx.
89 ***********************************************************************/
91 NTSTATUS
pdb_init_sam_talloc(TALLOC_CTX
*mem_ctx
, SAM_ACCOUNT
**user
)
94 DEBUG(0,("pdb_init_sam: SAM_ACCOUNT was non NULL\n"));
96 smb_panic("NULL pointer passed to pdb_init_sam\n");
98 return NT_STATUS_UNSUCCESSFUL
;
102 DEBUG(0,("pdb_init_sam_talloc: mem_ctx was NULL!\n"));
103 return NT_STATUS_UNSUCCESSFUL
;
106 *user
=(SAM_ACCOUNT
*)talloc(mem_ctx
, sizeof(SAM_ACCOUNT
));
109 DEBUG(0,("pdb_init_sam: error while allocating memory\n"));
110 return NT_STATUS_NO_MEMORY
;
113 (*user
)->mem_ctx
= mem_ctx
;
115 (*user
)->free_fn
= NULL
;
117 pdb_fill_default_sam(*user
);
123 /*************************************************************
124 Alloc memory and initialises a struct sam_passwd.
125 ************************************************************/
127 NTSTATUS
pdb_init_sam(SAM_ACCOUNT
**user
)
132 mem_ctx
= talloc_init_named("passdb internal SAM_ACCOUNT allocation");
135 DEBUG(0,("pdb_init_sam: error while doing talloc_init()\n"));
136 return NT_STATUS_NO_MEMORY
;
139 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam_talloc(mem_ctx
, user
))) {
140 talloc_destroy(mem_ctx
);
144 (*user
)->free_fn
= destroy_pdb_talloc
;
150 /*************************************************************
151 Initialises a struct sam_passwd with sane values.
152 ************************************************************/
154 NTSTATUS
pdb_init_sam_pw(SAM_ACCOUNT
**new_sam_acct
, const struct passwd
*pwd
)
163 return NT_STATUS_UNSUCCESSFUL
;
166 if (!NT_STATUS_IS_OK(nt_status
= pdb_init_sam(new_sam_acct
))) {
171 pdb_set_username(*new_sam_acct
, pwd
->pw_name
);
172 pdb_set_fullname(*new_sam_acct
, pwd
->pw_gecos
);
174 pdb_set_uid(*new_sam_acct
, pwd
->pw_uid
);
175 pdb_set_gid(*new_sam_acct
, pwd
->pw_gid
);
177 pdb_set_user_rid(*new_sam_acct
, pdb_uid_to_user_rid(pwd
->pw_uid
));
179 /* call the mapping code here */
180 if(get_group_map_from_gid(pwd
->pw_gid
, &map
, MAPPING_WITHOUT_PRIV
)) {
181 sid_peek_rid(&map
.sid
, &rid
);
184 rid
=pdb_gid_to_group_rid(pwd
->pw_gid
);
187 pdb_set_group_rid(*new_sam_acct
, rid
);
189 pstrcpy(str
, lp_logon_path());
190 standard_sub_advanced(-1, pwd
->pw_name
, "", pwd
->pw_gid
, pwd
->pw_name
, str
);
191 pdb_set_profile_path(*new_sam_acct
, str
, False
);
193 pstrcpy(str
, lp_logon_home());
194 standard_sub_advanced(-1, pwd
->pw_name
, "", pwd
->pw_gid
, pwd
->pw_name
, str
);
195 pdb_set_homedir(*new_sam_acct
, str
, False
);
197 pstrcpy(str
, lp_logon_drive());
198 standard_sub_advanced(-1, pwd
->pw_name
, "", pwd
->pw_gid
, pwd
->pw_name
, str
);
199 pdb_set_dir_drive(*new_sam_acct
, str
, False
);
201 pstrcpy(str
, lp_logon_script());
202 standard_sub_advanced(-1, pwd
->pw_name
, "", pwd
->pw_gid
, pwd
->pw_name
, str
);
203 pdb_set_logon_script(*new_sam_acct
, str
, False
);
210 * Free the contets of the SAM_ACCOUNT, but not the structure.
212 * Also wipes the LM and NT hashes from memory.
214 * @param user SAM_ACCOUNT to free members of.
217 static void pdb_free_sam_contents(SAM_ACCOUNT
*user
)
219 /* As we start mallocing more strings this is where
220 we should free them. */
222 data_blob_clear_free(&(user
->private.lm_pw
));
223 data_blob_clear_free(&(user
->private.nt_pw
));
227 /************************************************************
228 Reset the SAM_ACCOUNT and free the NT/LM hashes.
229 ***********************************************************/
231 NTSTATUS
pdb_reset_sam(SAM_ACCOUNT
*user
)
234 DEBUG(0,("pdb_reset_sam: SAM_ACCOUNT was NULL\n"));
236 smb_panic("NULL pointer passed to pdb_free_sam\n");
238 return NT_STATUS_UNSUCCESSFUL
;
241 pdb_free_sam_contents(user
);
243 pdb_fill_default_sam(user
);
249 /************************************************************
250 Free the SAM_ACCOUNT and the member pointers.
251 ***********************************************************/
253 NTSTATUS
pdb_free_sam(SAM_ACCOUNT
**user
)
256 DEBUG(0,("pdb_free_sam: SAM_ACCOUNT was NULL\n"));
258 smb_panic("NULL pointer passed to pdb_free_sam\n");
260 return NT_STATUS_UNSUCCESSFUL
;
263 pdb_free_sam_contents(*user
);
265 if ((*user
)->free_fn
) {
266 (*user
)->free_fn(user
);
273 /**********************************************************
274 Encode the account control bits into a string.
275 length = length of string to encode into (including terminating
276 null). length *MUST BE MORE THAN 2* !
277 **********************************************************/
279 char *pdb_encode_acct_ctrl(uint16 acct_ctrl
, size_t length
)
281 static fstring acct_str
;
286 if (acct_ctrl
& ACB_PWNOTREQ
) acct_str
[i
++] = 'N';
287 if (acct_ctrl
& ACB_DISABLED
) acct_str
[i
++] = 'D';
288 if (acct_ctrl
& ACB_HOMDIRREQ
) acct_str
[i
++] = 'H';
289 if (acct_ctrl
& ACB_TEMPDUP
) acct_str
[i
++] = 'T';
290 if (acct_ctrl
& ACB_NORMAL
) acct_str
[i
++] = 'U';
291 if (acct_ctrl
& ACB_MNS
) acct_str
[i
++] = 'M';
292 if (acct_ctrl
& ACB_WSTRUST
) acct_str
[i
++] = 'W';
293 if (acct_ctrl
& ACB_SVRTRUST
) acct_str
[i
++] = 'S';
294 if (acct_ctrl
& ACB_AUTOLOCK
) acct_str
[i
++] = 'L';
295 if (acct_ctrl
& ACB_PWNOEXP
) acct_str
[i
++] = 'X';
296 if (acct_ctrl
& ACB_DOMTRUST
) acct_str
[i
++] = 'I';
298 for ( ; i
< length
- 2 ; i
++ )
303 acct_str
[i
++] = '\0';
308 /**********************************************************
309 Decode the account control bits from a string.
310 **********************************************************/
312 uint16
pdb_decode_acct_ctrl(const char *p
)
314 uint16 acct_ctrl
= 0;
315 BOOL finished
= False
;
318 * Check if the account type bits have been encoded after the
319 * NT password (in the form [NDHTUWSLXI]).
325 for (p
++; *p
&& !finished
; p
++) {
327 case 'N': { acct_ctrl
|= ACB_PWNOTREQ
; break; /* 'N'o password. */ }
328 case 'D': { acct_ctrl
|= ACB_DISABLED
; break; /* 'D'isabled. */ }
329 case 'H': { acct_ctrl
|= ACB_HOMDIRREQ
; break; /* 'H'omedir required. */ }
330 case 'T': { acct_ctrl
|= ACB_TEMPDUP
; break; /* 'T'emp account. */ }
331 case 'U': { acct_ctrl
|= ACB_NORMAL
; break; /* 'U'ser account (normal). */ }
332 case 'M': { acct_ctrl
|= ACB_MNS
; break; /* 'M'NS logon user account. What is this ? */ }
333 case 'W': { acct_ctrl
|= ACB_WSTRUST
; break; /* 'W'orkstation account. */ }
334 case 'S': { acct_ctrl
|= ACB_SVRTRUST
; break; /* 'S'erver account. */ }
335 case 'L': { acct_ctrl
|= ACB_AUTOLOCK
; break; /* 'L'ocked account. */ }
336 case 'X': { acct_ctrl
|= ACB_PWNOEXP
; break; /* No 'X'piry on password */ }
337 case 'I': { acct_ctrl
|= ACB_DOMTRUST
; break; /* 'I'nterdomain trust account. */ }
343 default: { finished
= True
; }
350 /*************************************************************
351 Routine to set 32 hex password characters from a 16 byte array.
352 **************************************************************/
354 void pdb_sethexpwd(char *p
, const unsigned char *pwd
, uint16 acct_ctrl
)
358 for (i
= 0; i
< 16; i
++)
359 slprintf(&p
[i
*2], 3, "%02X", pwd
[i
]);
361 if (acct_ctrl
& ACB_PWNOTREQ
)
362 safe_strcpy(p
, "NO PASSWORDXXXXXXXXXXXXXXXXXXXXX", 33);
364 safe_strcpy(p
, "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX", 33);
368 /*************************************************************
369 Routine to get the 32 hex characters and turn them
370 into a 16 byte array.
371 **************************************************************/
373 BOOL
pdb_gethexpwd(const char *p
, unsigned char *pwd
)
376 unsigned char lonybble
, hinybble
;
377 char *hexchars
= "0123456789ABCDEF";
383 for (i
= 0; i
< 32; i
+= 2) {
384 hinybble
= toupper(p
[i
]);
385 lonybble
= toupper(p
[i
+ 1]);
387 p1
= strchr(hexchars
, hinybble
);
388 p2
= strchr(hexchars
, lonybble
);
393 hinybble
= PTR_DIFF(p1
, hexchars
);
394 lonybble
= PTR_DIFF(p2
, hexchars
);
396 pwd
[i
/ 2] = (hinybble
<< 4) | lonybble
;
401 /*******************************************************************
402 Group and User RID username mapping function
403 ********************************************************************/
405 BOOL
pdb_name_to_rid(const char *user_name
, uint32
*u_rid
, uint32
*g_rid
)
408 struct passwd
*pw
= Get_Pwnam(user_name
);
410 if (u_rid
== NULL
|| g_rid
== NULL
|| user_name
== NULL
)
414 DEBUG(1,("Username %s is invalid on this system\n", user_name
));
418 /* turn the unix UID into a Domain RID. this is what the posix
419 sub-system does (adds 1000 to the uid) */
420 *u_rid
= pdb_uid_to_user_rid(pw
->pw_uid
);
422 /* absolutely no idea what to do about the unix GID to Domain RID mapping */
424 if (get_group_map_from_gid(pw
->pw_gid
, &map
, MAPPING_WITHOUT_PRIV
)) {
425 sid_peek_rid(&map
.sid
, g_rid
);
427 *g_rid
= pdb_gid_to_group_rid(pw
->pw_gid
);
432 /*******************************************************************
433 Converts NT user RID to a UNIX uid.
434 ********************************************************************/
436 uid_t
pdb_user_rid_to_uid(uint32 user_rid
)
438 return (uid_t
)(((user_rid
& (~USER_RID_TYPE
))- 1000)/RID_MULTIPLIER
);
442 /*******************************************************************
443 Converts NT group RID to a UNIX gid.
444 ********************************************************************/
446 gid_t
pdb_group_rid_to_gid(uint32 group_rid
)
448 return (gid_t
)(((group_rid
& (~GROUP_RID_TYPE
))- 1000)/RID_MULTIPLIER
);
451 /*******************************************************************
452 converts UNIX uid to an NT User RID.
453 ********************************************************************/
455 uint32
pdb_uid_to_user_rid(uid_t uid
)
457 return (((((uint32
)uid
)*RID_MULTIPLIER
) + 1000) | USER_RID_TYPE
);
460 /*******************************************************************
461 converts NT Group RID to a UNIX uid.
463 warning: you must not call that function only
464 you must do a call to the group mapping first.
465 there is not anymore a direct link between the gid and the rid.
466 ********************************************************************/
468 uint32
pdb_gid_to_group_rid(gid_t gid
)
470 return (((((uint32
)gid
)*RID_MULTIPLIER
) + 1000) | GROUP_RID_TYPE
);
473 /*******************************************************************
474 Decides if a RID is a well known RID.
475 ********************************************************************/
477 static BOOL
pdb_rid_is_well_known(uint32 rid
)
482 /*******************************************************************
483 Decides if a RID is a user or group RID.
484 ********************************************************************/
486 BOOL
pdb_rid_is_user(uint32 rid
)
488 /* lkcl i understand that NT attaches an enumeration to a RID
489 * such that it can be identified as either a user, group etc
490 * type. there are 5 such categories, and they are documented.
492 if(pdb_rid_is_well_known(rid
)) {
494 * The only well known user RIDs are DOMAIN_USER_RID_ADMIN
495 * and DOMAIN_USER_RID_GUEST.
497 if(rid
== DOMAIN_USER_RID_ADMIN
|| rid
== DOMAIN_USER_RID_GUEST
)
499 } else if((rid
& RID_TYPE_MASK
) == USER_RID_TYPE
) {
505 /*******************************************************************
506 Convert a rid into a name. Used in the lookup SID rpc.
507 ********************************************************************/
509 BOOL
local_lookup_sid(DOM_SID
*sid
, char *name
, enum SID_NAME_USE
*psid_name_use
)
513 SAM_ACCOUNT
*sam_account
= NULL
;
516 sid_peek_rid(sid
, &rid
);
517 is_user
= pdb_rid_is_user(rid
);
518 *psid_name_use
= SID_NAME_UNKNOWN
;
520 DEBUG(5,("local_lookup_sid: looking up %s RID %u.\n", is_user
? "user" :
521 "group", (unsigned int)rid
));
524 if(rid
== DOMAIN_USER_RID_ADMIN
) {
526 char *p
= admin_users
;
527 *psid_name_use
= SID_NAME_USER
;
528 if(!next_token(&p
, name
, NULL
, sizeof(fstring
)))
529 fstrcpy(name
, "Administrator");
530 } else if (rid
== DOMAIN_USER_RID_GUEST
) {
532 char *p
= guest_users
;
533 *psid_name_use
= SID_NAME_USER
;
534 if(!next_token(&p
, name
, NULL
, sizeof(fstring
)))
535 fstrcpy(name
, "Guest");
541 * Don't try to convert the rid to a name if
542 * running in appliance mode
544 if (lp_hide_local_users())
547 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account
))) {
551 if (pdb_getsampwrid(sam_account
, rid
)) {
552 fstrcpy(name
, pdb_get_username(sam_account
));
553 *psid_name_use
= SID_NAME_USER
;
557 pdb_free_sam(&sam_account
);
563 uid
= pdb_user_rid_to_uid(rid
);
564 pass
= getpwuid_alloc(uid
);
566 *psid_name_use
= SID_NAME_USER
;
568 DEBUG(5,("local_lookup_sid: looking up uid %u %s\n", (unsigned int)uid
,
569 pass
? "succeeded" : "failed" ));
572 slprintf(name
, sizeof(fstring
)-1, "unix_user.%u", (unsigned int)uid
);
576 fstrcpy(name
, pass
->pw_name
);
578 DEBUG(5,("local_lookup_sid: found user %s for rid %u\n", name
,
579 (unsigned int)rid
));
590 * Don't try to convert the rid to a name if running
594 if (lp_hide_local_users())
597 /* check if it's a mapped group */
598 if (get_group_map_from_sid(*sid
, &map
, MAPPING_WITHOUT_PRIV
)) {
600 DEBUG(5,("local_lookup_sid: mapped group %s to gid %u\n", map
.nt_name
, (unsigned int)map
.gid
));
601 fstrcpy(name
, map
.nt_name
);
602 *psid_name_use
= map
.sid_name_use
;
607 gid
= pdb_group_rid_to_gid(rid
);
610 *psid_name_use
= SID_NAME_ALIAS
;
612 DEBUG(5,("local_lookup_sid: looking up gid %u %s\n", (unsigned int)gid
,
613 gr
? "succeeded" : "failed" ));
616 slprintf(name
, sizeof(fstring
)-1, "unix_group.%u", (unsigned int)gid
);
620 fstrcpy( name
, gr
->gr_name
);
622 DEBUG(5,("local_lookup_sid: found group %s for rid %u\n", name
,
623 (unsigned int)rid
));
629 /*******************************************************************
630 Convert a name into a SID. Used in the lookup name rpc.
631 ********************************************************************/
633 BOOL
local_lookup_name(const char *c_user
, DOM_SID
*psid
, enum SID_NAME_USE
*psid_name_use
)
635 extern DOM_SID global_sid_World_Domain
;
636 struct passwd
*pass
= NULL
;
639 SAM_ACCOUNT
*sam_account
= NULL
;
642 *psid_name_use
= SID_NAME_UNKNOWN
;
645 * user may be quoted a const string, and map_username and
646 * friends can modify it. Make a modifiable copy. JRA.
649 fstrcpy(user
, c_user
);
651 sid_copy(&local_sid
, &global_sam_sid
);
654 * Special case for MACHINE\Everyone. Map to the world_sid.
657 if(strequal(user
, "Everyone")) {
658 sid_copy( psid
, &global_sid_World_Domain
);
659 sid_append_rid(psid
, 0);
660 *psid_name_use
= SID_NAME_ALIAS
;
665 * Don't lookup local unix users if running in appliance mode
667 if (lp_hide_local_users())
670 (void)map_username(user
);
672 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_account
))) {
676 if (pdb_getsampwnam(sam_account
, user
)) {
677 sid_append_rid( &local_sid
, pdb_get_user_rid(sam_account
));
678 *psid_name_use
= SID_NAME_USER
;
680 sid_copy( psid
, &local_sid
);
684 pdb_free_sam(&sam_account
);
686 if (!found
&& (pass
= Get_Pwnam(user
))) {
687 sid_append_rid( &local_sid
, pdb_uid_to_user_rid(pass
->pw_uid
));
688 *psid_name_use
= SID_NAME_USER
;
689 pdb_free_sam(&sam_account
);
693 * Maybe it was a group ?
698 pdb_free_sam(&sam_account
);
700 /* check if it's a mapped group */
701 if (get_group_map_from_ntname(user
, &map
, MAPPING_WITHOUT_PRIV
)) {
703 /* yes it's a mapped group to a valid unix group */
704 sid_copy(&local_sid
, &map
.sid
);
705 *psid_name_use
= map
.sid_name_use
;
708 /* it's a correct name but not mapped so it points to nothing*/
711 /* it's not a mapped group */
712 grp
= getgrnam(user
);
717 *check if it's mapped, if it is reply it doesn't exist
719 * that's to prevent this case:
721 * unix group ug is mapped to nt group ng
722 * someone does a lookup on ug
723 * we must not reply as it doesn't "exist" anymore
724 * for NT. For NT only ng exists.
728 if(get_group_map_from_gid(grp
->gr_gid
, &map
, MAPPING_WITHOUT_PRIV
)){
732 sid_append_rid( &local_sid
, pdb_gid_to_group_rid(grp
->gr_gid
));
733 *psid_name_use
= SID_NAME_ALIAS
;
737 sid_copy( psid
, &local_sid
);
742 /****************************************************************************
743 Convert a uid to SID - locally.
744 ****************************************************************************/
746 DOM_SID
*local_uid_to_sid(DOM_SID
*psid
, uid_t uid
)
748 extern DOM_SID global_sam_sid
;
750 sid_copy(psid
, &global_sam_sid
);
751 sid_append_rid(psid
, pdb_uid_to_user_rid(uid
));
756 /****************************************************************************
757 Convert a SID to uid - locally.
758 ****************************************************************************/
760 BOOL
local_sid_to_uid(uid_t
*puid
, DOM_SID
*psid
, enum SID_NAME_USE
*name_type
)
762 extern DOM_SID global_sam_sid
;
769 *name_type
= SID_NAME_UNKNOWN
;
771 sid_copy(&dom_sid
, psid
);
772 sid_split_rid(&dom_sid
, &rid
);
774 if (!pdb_rid_is_user(rid
))
778 * We can only convert to a uid if this is our local
779 * Domain SID (ie. we are the controling authority).
781 if (!sid_equal(&global_sam_sid
, &dom_sid
))
784 *puid
= pdb_user_rid_to_uid(rid
);
787 * Ensure this uid really does exist.
789 if(!(pass
= getpwuid_alloc(*puid
)))
792 DEBUG(10,("local_sid_to_uid: SID %s -> uid (%u) (%s).\n", sid_to_string( str
, psid
),
793 (unsigned int)*puid
, pass
->pw_name
));
797 *name_type
= SID_NAME_USER
;
802 /****************************************************************************
803 Convert a gid to SID - locally.
804 ****************************************************************************/
806 DOM_SID
*local_gid_to_sid(DOM_SID
*psid
, gid_t gid
)
808 extern DOM_SID global_sam_sid
;
811 sid_copy(psid
, &global_sam_sid
);
813 if (get_group_map_from_gid(gid
, &map
, MAPPING_WITHOUT_PRIV
)) {
814 sid_copy(psid
, &map
.sid
);
817 sid_append_rid(psid
, pdb_gid_to_group_rid(gid
));
823 /****************************************************************************
824 Convert a SID to gid - locally.
825 ****************************************************************************/
827 BOOL
local_sid_to_gid(gid_t
*pgid
, DOM_SID
*psid
, enum SID_NAME_USE
*name_type
)
829 extern DOM_SID global_sam_sid
;
836 *name_type
= SID_NAME_UNKNOWN
;
838 sid_copy(&dom_sid
, psid
);
839 sid_split_rid(&dom_sid
, &rid
);
842 * We can only convert to a gid if this is our local
843 * Domain SID (ie. we are the controling authority).
845 * Or in the Builtin SID too. JFM, 11/30/2001
848 if (!sid_equal(&global_sam_sid
, &dom_sid
))
851 if (pdb_rid_is_user(rid
))
854 if (get_group_map_from_sid(*psid
, &map
, MAPPING_WITHOUT_PRIV
)) {
856 /* the SID is in the mapping table but not mapped */
860 sid_peek_rid(&map
.sid
, &rid
);
862 *name_type
= map
.sid_name_use
;
864 *pgid
= pdb_group_rid_to_gid(rid
);
865 *name_type
= SID_NAME_ALIAS
;
869 * Ensure this gid really does exist.
872 if(!(grp
= getgrgid(*pgid
)))
875 DEBUG(10,("local_sid_to_gid: SID %s -> gid (%u) (%s).\n", sid_to_string( str
, psid
),
876 (unsigned int)*pgid
, grp
->gr_name
));
882 * Quick hack to do an easy ucs2 -> mulitbyte conversion
883 * @return static buffer containing the converted string
886 static char *pdb_convert(const UNISTR2
*from
)
888 static pstring convert_buffer
;
891 return convert_buffer
;
894 unistr2_to_ascii(convert_buffer
, from
, sizeof(pstring
));
895 return convert_buffer
;
898 /*************************************************************
899 Copies a SAM_USER_INFO_23 to a SAM_ACCOUNT
900 **************************************************************/
902 void copy_id23_to_sam_passwd(SAM_ACCOUNT
*to
, SAM_USER_INFO_23
*from
)
905 if (from
== NULL
|| to
== NULL
)
908 pdb_set_logon_time(to
,nt_time_to_unix(&from
->logon_time
));
909 pdb_set_logoff_time(to
,nt_time_to_unix(&from
->logoff_time
));
910 pdb_set_kickoff_time(to
, nt_time_to_unix(&from
->kickoff_time
));
911 pdb_set_pass_last_set_time(to
, nt_time_to_unix(&from
->pass_last_set_time
));
912 pdb_set_pass_can_change_time(to
, nt_time_to_unix(&from
->pass_can_change_time
));
913 pdb_set_pass_must_change_time(to
, nt_time_to_unix(&from
->pass_must_change_time
));
915 if (from
->uni_user_name
.buffer
)
916 pdb_set_username(to
, pdb_convert(&from
->uni_user_name
));
917 if (from
->uni_full_name
.buffer
)
918 pdb_set_fullname(to
, pdb_convert(&from
->uni_full_name
));
919 if (from
->uni_home_dir
.buffer
)
920 pdb_set_homedir(to
, pdb_convert(&from
->uni_home_dir
), True
);
921 if (from
->uni_dir_drive
.buffer
)
922 pdb_set_dir_drive(to
, pdb_convert(&from
->uni_dir_drive
), True
);
923 if (from
->uni_logon_script
.buffer
)
924 pdb_set_logon_script(to
, pdb_convert(&from
->uni_logon_script
), True
);
925 if (from
->uni_profile_path
.buffer
)
926 pdb_set_profile_path(to
, pdb_convert(&from
->uni_profile_path
), True
);
927 if (from
->uni_acct_desc
.buffer
)
928 pdb_set_acct_desc(to
, pdb_convert(&from
->uni_acct_desc
));
929 if (from
->uni_workstations
.buffer
)
930 pdb_set_workstations(to
, pdb_convert(&from
->uni_workstations
));
931 if (from
->uni_unknown_str
.buffer
)
932 pdb_set_unknown_str(to
, pdb_convert(&from
->uni_unknown_str
));
933 if (from
->uni_munged_dial
.buffer
)
934 pdb_set_munged_dial(to
, pdb_convert(&from
->uni_munged_dial
));
937 pdb_set_user_rid(to
, from
->user_rid
);
939 pdb_set_group_rid(to
, from
->group_rid
);
941 pdb_set_acct_ctrl(to
, from
->acb_info
);
942 pdb_set_unknown_3(to
, from
->unknown_3
);
944 pdb_set_logon_divs(to
, from
->logon_divs
);
945 pdb_set_hours_len(to
, from
->logon_hrs
.len
);
946 pdb_set_hours(to
, from
->logon_hrs
.hours
);
948 pdb_set_unknown_5(to
, from
->unknown_5
);
949 pdb_set_unknown_6(to
, from
->unknown_6
);
953 /*************************************************************
955 **************************************************************/
957 void copy_id21_to_sam_passwd(SAM_ACCOUNT
*to
, SAM_USER_INFO_21
*from
)
959 if (from
== NULL
|| to
== NULL
)
962 pdb_set_logon_time(to
,nt_time_to_unix(&from
->logon_time
));
963 pdb_set_logoff_time(to
,nt_time_to_unix(&from
->logoff_time
));
964 pdb_set_kickoff_time(to
, nt_time_to_unix(&from
->kickoff_time
));
965 pdb_set_pass_last_set_time(to
, nt_time_to_unix(&from
->pass_last_set_time
));
966 pdb_set_pass_can_change_time(to
, nt_time_to_unix(&from
->pass_can_change_time
));
967 pdb_set_pass_must_change_time(to
, nt_time_to_unix(&from
->pass_must_change_time
));
969 if (from
->uni_user_name
.buffer
)
970 pdb_set_username(to
, pdb_convert(&from
->uni_user_name
));
971 if (from
->uni_full_name
.buffer
)
972 pdb_set_fullname(to
, pdb_convert(&from
->uni_full_name
));
973 if (from
->uni_home_dir
.buffer
)
974 pdb_set_homedir(to
, pdb_convert(&from
->uni_home_dir
), True
);
975 if (from
->uni_dir_drive
.buffer
)
976 pdb_set_dir_drive(to
, pdb_convert(&from
->uni_dir_drive
), True
);
977 if (from
->uni_logon_script
.buffer
)
978 pdb_set_logon_script(to
, pdb_convert(&from
->uni_logon_script
), True
);
979 if (from
->uni_profile_path
.buffer
)
980 pdb_set_profile_path(to
, pdb_convert(&from
->uni_profile_path
), True
);
981 if (from
->uni_acct_desc
.buffer
)
982 pdb_set_acct_desc(to
, pdb_convert(&from
->uni_acct_desc
));
983 if (from
->uni_workstations
.buffer
)
984 pdb_set_workstations(to
, pdb_convert(&from
->uni_workstations
));
985 if (from
->uni_unknown_str
.buffer
)
986 pdb_set_unknown_str(to
, pdb_convert(&from
->uni_unknown_str
));
987 if (from
->uni_munged_dial
.buffer
)
988 pdb_set_munged_dial(to
, pdb_convert(&from
->uni_munged_dial
));
991 pdb_set_user_rid(to
, from
->user_rid
);
993 pdb_set_group_rid(to
, from
->group_rid
);
995 /* FIXME!! Do we need to copy the passwords here as well?
996 I don't know. Need to figure this out --jerry */
998 /* Passwords dealt with in caller --abartlet */
1000 pdb_set_acct_ctrl(to
, from
->acb_info
);
1001 pdb_set_unknown_3(to
, from
->unknown_3
);
1003 pdb_set_logon_divs(to
, from
->logon_divs
);
1004 pdb_set_hours_len(to
, from
->logon_hrs
.len
);
1005 pdb_set_hours(to
, from
->logon_hrs
.hours
);
1007 pdb_set_unknown_5(to
, from
->unknown_5
);
1008 pdb_set_unknown_6(to
, from
->unknown_6
);
1012 /*************************************************************
1013 Change a password entry in the local smbpasswd file.
1015 FIXME!! The function needs to be abstracted into the
1016 passdb interface or something. It is currently being called
1017 by _api_samr_create_user() in rpc_server/srv_samr.c,
1018 in SWAT and by smbpasswd/pdbedit.
1021 *************************************************************/
1023 BOOL
local_password_change(const char *user_name
, int local_flags
,
1024 const char *new_passwd
,
1025 char *err_str
, size_t err_str_len
,
1026 char *msg_str
, size_t msg_str_len
)
1028 struct passwd
*pwd
= NULL
;
1029 SAM_ACCOUNT
*sam_pass
=NULL
;
1034 /* Get the smb passwd entry for this user */
1035 pdb_init_sam(&sam_pass
);
1036 if (local_flags
& LOCAL_DELETE_USER
) {
1037 if (!pdb_delete_sam_account(sam_pass
)) {
1038 slprintf(err_str
,err_str_len
-1, "Failed to delete entry for user %s.\n", user_name
);
1039 pdb_free_sam(&sam_pass
);
1042 slprintf(msg_str
, msg_str_len
-1, "Deleted user %s.\n", user_name
);
1043 pdb_free_sam(&sam_pass
);
1046 if(!pdb_getsampwnam(sam_pass
, user_name
)) {
1047 pdb_free_sam(&sam_pass
);
1049 if (local_flags
& LOCAL_ADD_USER
) {
1050 pwd
= getpwnam_alloc(user_name
);
1052 slprintf(err_str
, err_str_len
-1,"Failed to find entry for user %s.\n", user_name
);
1057 /* Local user found, so init from this */
1058 if (!NT_STATUS_IS_OK(pdb_init_sam_pw(&sam_pass
, pwd
))){
1059 slprintf(err_str
, err_str_len
-1, "Failed initialise SAM_ACCOUNT for user %s.\n", user_name
);
1066 if (!NT_STATUS_IS_OK(pdb_init_sam(&sam_pass
))){
1067 slprintf(err_str
, err_str_len
-1, "Failed initialise SAM_ACCOUNT for user %s.\n", user_name
);
1071 if (!pdb_set_username(sam_pass
, user_name
)) {
1072 slprintf(err_str
, err_str_len
- 1, "Failed to set username for user %s.\n", user_name
);
1073 pdb_free_sam(&sam_pass
);
1077 if (local_flags
& LOCAL_TRUST_ACCOUNT
) {
1078 if (!pdb_set_acct_ctrl(sam_pass
, ACB_WSTRUST
)) {
1079 slprintf(err_str
, err_str_len
- 1, "Failed to set 'trusted workstation account' flags for user %s.\n", user_name
);
1080 pdb_free_sam(&sam_pass
);
1083 } else if (local_flags
& LOCAL_INTERDOM_ACCOUNT
) {
1084 if (!pdb_set_acct_ctrl(sam_pass
, ACB_DOMTRUST
)) {
1085 slprintf(err_str
, err_str_len
- 1, "Failed to set 'domain trust account' flags for user %s.\n", user_name
);
1086 pdb_free_sam(&sam_pass
);
1090 if (!pdb_set_acct_ctrl(sam_pass
, ACB_NORMAL
)) {
1091 slprintf(err_str
, err_str_len
- 1, "Failed to set 'normal account' flags for user %s.\n", user_name
);
1092 pdb_free_sam(&sam_pass
);
1098 /* the entry already existed */
1099 local_flags
&= ~LOCAL_ADD_USER
;
1103 * We are root - just write the new password
1104 * and the valid last change time.
1107 if (local_flags
& LOCAL_DISABLE_USER
) {
1108 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)|ACB_DISABLED
)) {
1109 slprintf(err_str
, err_str_len
-1, "Failed to set 'disabled' flag for user %s.\n", user_name
);
1110 pdb_free_sam(&sam_pass
);
1113 } else if (local_flags
& LOCAL_ENABLE_USER
) {
1114 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)&(~ACB_DISABLED
))) {
1115 slprintf(err_str
, err_str_len
-1, "Failed to unset 'disabled' flag for user %s.\n", user_name
);
1116 pdb_free_sam(&sam_pass
);
1121 if (local_flags
& LOCAL_SET_NO_PASSWORD
) {
1122 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)|ACB_PWNOTREQ
)) {
1123 slprintf(err_str
, err_str_len
-1, "Failed to set 'no password required' flag for user %s.\n", user_name
);
1124 pdb_free_sam(&sam_pass
);
1127 } else if (local_flags
& LOCAL_SET_PASSWORD
) {
1129 * If we're dealing with setting a completely empty user account
1130 * ie. One with a password of 'XXXX', but not set disabled (like
1131 * an account created from scratch) then if the old password was
1132 * 'XX's then getsmbpwent will have set the ACB_DISABLED flag.
1133 * We remove that as we're giving this user their first password
1134 * and the decision hasn't really been made to disable them (ie.
1135 * don't create them disabled). JRA.
1137 if ((pdb_get_lanman_passwd(sam_pass
)==NULL
) && (pdb_get_acct_ctrl(sam_pass
)&ACB_DISABLED
)) {
1138 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)&(~ACB_DISABLED
))) {
1139 slprintf(err_str
, err_str_len
-1, "Failed to unset 'disabled' flag for user %s.\n", user_name
);
1140 pdb_free_sam(&sam_pass
);
1144 if (!pdb_set_acct_ctrl (sam_pass
, pdb_get_acct_ctrl(sam_pass
)&(~ACB_PWNOTREQ
))) {
1145 slprintf(err_str
, err_str_len
-1, "Failed to unset 'no password required' flag for user %s.\n", user_name
);
1146 pdb_free_sam(&sam_pass
);
1150 if (!pdb_set_plaintext_passwd (sam_pass
, new_passwd
)) {
1151 slprintf(err_str
, err_str_len
-1, "Failed to set password for user %s.\n", user_name
);
1152 pdb_free_sam(&sam_pass
);
1157 if (local_flags
& LOCAL_ADD_USER
) {
1158 if (pdb_add_sam_account(sam_pass
)) {
1159 slprintf(msg_str
, msg_str_len
-1, "Added user %s.\n", user_name
);
1160 pdb_free_sam(&sam_pass
);
1163 slprintf(err_str
, err_str_len
-1, "Failed to add entry for user %s.\n", user_name
);
1164 pdb_free_sam(&sam_pass
);
1168 if(!pdb_update_sam_account(sam_pass
)) {
1169 slprintf(err_str
, err_str_len
-1, "Failed to modify entry for user %s.\n", user_name
);
1170 pdb_free_sam(&sam_pass
);
1173 if(local_flags
& LOCAL_DISABLE_USER
)
1174 slprintf(msg_str
, msg_str_len
-1, "Disabled user %s.\n", user_name
);
1175 else if (local_flags
& LOCAL_ENABLE_USER
)
1176 slprintf(msg_str
, msg_str_len
-1, "Enabled user %s.\n", user_name
);
1177 else if (local_flags
& LOCAL_SET_NO_PASSWORD
)
1178 slprintf(msg_str
, msg_str_len
-1, "User %s password set to none.\n", user_name
);
1181 pdb_free_sam(&sam_pass
);