Make sure that domain joins work correctly when the DC disallows NTLM auth.
[Samba/gebeck_regimport.git] / source3 / libnet / libnet_join.c
blob2b4ab0bf9e84f8f77a3def98b7ffe409d596bcd9
1 /*
2 * Unix SMB/CIFS implementation.
3 * libnet Join Support
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
21 #include "includes.h"
22 #include "ads.h"
23 #include "librpc/gen_ndr/ndr_libnet_join.h"
24 #include "libnet/libnet_join.h"
25 #include "libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/ndr_samr_c.h"
27 #include "rpc_client/init_samr.h"
28 #include "../librpc/gen_ndr/ndr_lsa_c.h"
29 #include "rpc_client/cli_lsarpc.h"
30 #include "../librpc/gen_ndr/ndr_netlogon.h"
31 #include "rpc_client/cli_netlogon.h"
32 #include "lib/smbconf/smbconf.h"
33 #include "lib/smbconf/smbconf_reg.h"
34 #include "../libds/common/flags.h"
35 #include "secrets.h"
36 #include "rpc_client/init_lsa.h"
37 #include "rpc_client/cli_pipe.h"
38 #include "../libcli/security/security.h"
39 #include "passdb.h"
40 #include "libsmb/libsmb.h"
41 #include "../libcli/smb/smbXcli_base.h"
42 #include "lib/param/loadparm.h"
44 /****************************************************************
45 ****************************************************************/
47 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
48 do { \
49 char *str = NULL; \
50 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
51 DEBUG(1,("libnet_Join:\n%s", str)); \
52 TALLOC_FREE(str); \
53 } while (0)
55 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
56 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
57 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
58 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
60 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
61 do { \
62 char *str = NULL; \
63 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
64 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
65 TALLOC_FREE(str); \
66 } while (0)
68 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
69 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
70 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
71 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
73 /****************************************************************
74 ****************************************************************/
76 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
77 struct libnet_JoinCtx *r,
78 const char *format, ...)
80 va_list args;
82 if (r->out.error_string) {
83 return;
86 va_start(args, format);
87 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
88 va_end(args);
91 /****************************************************************
92 ****************************************************************/
94 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
95 struct libnet_UnjoinCtx *r,
96 const char *format, ...)
98 va_list args;
100 if (r->out.error_string) {
101 return;
104 va_start(args, format);
105 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
106 va_end(args);
109 #ifdef HAVE_ADS
111 /****************************************************************
112 ****************************************************************/
114 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
115 const char *netbios_domain_name,
116 const char *dc_name,
117 const char *user_name,
118 const char *password,
119 ADS_STRUCT **ads)
121 ADS_STATUS status;
122 ADS_STRUCT *my_ads = NULL;
123 char *cp;
125 my_ads = ads_init(dns_domain_name,
126 netbios_domain_name,
127 dc_name);
128 if (!my_ads) {
129 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
132 if (user_name) {
133 SAFE_FREE(my_ads->auth.user_name);
134 my_ads->auth.user_name = SMB_STRDUP(user_name);
135 if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
136 *cp++ = '\0';
137 SAFE_FREE(my_ads->auth.realm);
138 my_ads->auth.realm = smb_xstrdup(cp);
139 if (!strupper_m(my_ads->auth.realm)) {
140 ads_destroy(&my_ads);
141 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
146 if (password) {
147 SAFE_FREE(my_ads->auth.password);
148 my_ads->auth.password = SMB_STRDUP(password);
151 status = ads_connect_user_creds(my_ads);
152 if (!ADS_ERR_OK(status)) {
153 ads_destroy(&my_ads);
154 return status;
157 *ads = my_ads;
158 return ADS_SUCCESS;
161 /****************************************************************
162 ****************************************************************/
164 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
165 struct libnet_JoinCtx *r)
167 ADS_STATUS status;
169 status = libnet_connect_ads(r->out.dns_domain_name,
170 r->out.netbios_domain_name,
171 r->in.dc_name,
172 r->in.admin_account,
173 r->in.admin_password,
174 &r->in.ads);
175 if (!ADS_ERR_OK(status)) {
176 libnet_join_set_error_string(mem_ctx, r,
177 "failed to connect to AD: %s",
178 ads_errstr(status));
179 return status;
182 if (!r->out.netbios_domain_name) {
183 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
184 r->in.ads->server.workgroup);
185 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
188 if (!r->out.dns_domain_name) {
189 r->out.dns_domain_name = talloc_strdup(mem_ctx,
190 r->in.ads->config.realm);
191 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
194 r->out.domain_is_ad = true;
196 return ADS_SUCCESS;
199 /****************************************************************
200 ****************************************************************/
202 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
203 struct libnet_UnjoinCtx *r)
205 ADS_STATUS status;
207 status = libnet_connect_ads(r->in.domain_name,
208 r->in.domain_name,
209 r->in.dc_name,
210 r->in.admin_account,
211 r->in.admin_password,
212 &r->in.ads);
213 if (!ADS_ERR_OK(status)) {
214 libnet_unjoin_set_error_string(mem_ctx, r,
215 "failed to connect to AD: %s",
216 ads_errstr(status));
219 return status;
222 /****************************************************************
223 join a domain using ADS (LDAP mods)
224 ****************************************************************/
226 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
227 struct libnet_JoinCtx *r)
229 ADS_STATUS status;
230 LDAPMessage *res = NULL;
231 const char *attrs[] = { "dn", NULL };
232 bool moved = false;
234 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
235 if (!ADS_ERR_OK(status)) {
236 return status;
239 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
240 if (!ADS_ERR_OK(status)) {
241 return status;
244 if (ads_count_replies(r->in.ads, res) != 1) {
245 ads_msgfree(r->in.ads, res);
246 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
249 ads_msgfree(r->in.ads, res);
251 /* Attempt to create the machine account and bail if this fails.
252 Assume that the admin wants exactly what they requested */
254 status = ads_create_machine_acct(r->in.ads,
255 r->in.machine_name,
256 r->in.account_ou);
258 if (ADS_ERR_OK(status)) {
259 DEBUG(1,("machine account creation created\n"));
260 return status;
261 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
262 (status.err.rc == LDAP_ALREADY_EXISTS)) {
263 status = ADS_SUCCESS;
266 if (!ADS_ERR_OK(status)) {
267 DEBUG(1,("machine account creation failed\n"));
268 return status;
271 status = ads_move_machine_acct(r->in.ads,
272 r->in.machine_name,
273 r->in.account_ou,
274 &moved);
275 if (!ADS_ERR_OK(status)) {
276 DEBUG(1,("failure to locate/move pre-existing "
277 "machine account\n"));
278 return status;
281 DEBUG(1,("The machine account %s the specified OU.\n",
282 moved ? "was moved into" : "already exists in"));
284 return status;
287 /****************************************************************
288 ****************************************************************/
290 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
291 struct libnet_UnjoinCtx *r)
293 ADS_STATUS status;
295 if (!r->in.ads) {
296 status = libnet_unjoin_connect_ads(mem_ctx, r);
297 if (!ADS_ERR_OK(status)) {
298 libnet_unjoin_set_error_string(mem_ctx, r,
299 "failed to connect to AD: %s",
300 ads_errstr(status));
301 return status;
305 status = ads_leave_realm(r->in.ads, r->in.machine_name);
306 if (!ADS_ERR_OK(status)) {
307 libnet_unjoin_set_error_string(mem_ctx, r,
308 "failed to leave realm: %s",
309 ads_errstr(status));
310 return status;
313 return ADS_SUCCESS;
316 /****************************************************************
317 ****************************************************************/
319 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
320 struct libnet_JoinCtx *r)
322 ADS_STATUS status;
323 LDAPMessage *res = NULL;
324 char *dn = NULL;
326 if (!r->in.machine_name) {
327 return ADS_ERROR(LDAP_NO_MEMORY);
330 status = ads_find_machine_acct(r->in.ads,
331 &res,
332 r->in.machine_name);
333 if (!ADS_ERR_OK(status)) {
334 return status;
337 if (ads_count_replies(r->in.ads, res) != 1) {
338 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
339 goto done;
342 dn = ads_get_dn(r->in.ads, mem_ctx, res);
343 if (!dn) {
344 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
345 goto done;
348 r->out.dn = talloc_strdup(mem_ctx, dn);
349 if (!r->out.dn) {
350 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
351 goto done;
354 done:
355 ads_msgfree(r->in.ads, res);
356 TALLOC_FREE(dn);
358 return status;
361 /****************************************************************
362 Set a machines dNSHostName and servicePrincipalName attributes
363 ****************************************************************/
365 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
366 struct libnet_JoinCtx *r)
368 ADS_STATUS status;
369 ADS_MODLIST mods;
370 fstring my_fqdn;
371 const char *spn_array[3] = {NULL, NULL, NULL};
372 char *spn = NULL;
374 /* Find our DN */
376 status = libnet_join_find_machine_acct(mem_ctx, r);
377 if (!ADS_ERR_OK(status)) {
378 return status;
381 /* Windows only creates HOST/shortname & HOST/fqdn. */
383 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
384 if (!spn) {
385 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
387 if (!strupper_m(spn)) {
388 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
390 spn_array[0] = spn;
392 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
393 || (strchr(my_fqdn, '.') == NULL)) {
394 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
395 r->out.dns_domain_name);
398 if (!strlower_m(my_fqdn)) {
399 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
402 if (!strequal(my_fqdn, r->in.machine_name)) {
403 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
404 if (!spn) {
405 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
407 spn_array[1] = spn;
410 mods = ads_init_mods(mem_ctx);
411 if (!mods) {
412 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
415 /* fields of primary importance */
417 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
418 if (!ADS_ERR_OK(status)) {
419 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
422 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
423 spn_array);
424 if (!ADS_ERR_OK(status)) {
425 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
428 return ads_gen_mod(r->in.ads, r->out.dn, mods);
431 /****************************************************************
432 ****************************************************************/
434 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
435 struct libnet_JoinCtx *r)
437 ADS_STATUS status;
438 ADS_MODLIST mods;
440 if (!r->in.create_upn) {
441 return ADS_SUCCESS;
444 /* Find our DN */
446 status = libnet_join_find_machine_acct(mem_ctx, r);
447 if (!ADS_ERR_OK(status)) {
448 return status;
451 if (!r->in.upn) {
452 r->in.upn = talloc_asprintf(mem_ctx,
453 "host/%s@%s",
454 r->in.machine_name,
455 r->out.dns_domain_name);
456 if (!r->in.upn) {
457 return ADS_ERROR(LDAP_NO_MEMORY);
461 /* now do the mods */
463 mods = ads_init_mods(mem_ctx);
464 if (!mods) {
465 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
468 /* fields of primary importance */
470 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
471 if (!ADS_ERR_OK(status)) {
472 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
475 return ads_gen_mod(r->in.ads, r->out.dn, mods);
479 /****************************************************************
480 ****************************************************************/
482 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
483 struct libnet_JoinCtx *r)
485 ADS_STATUS status;
486 ADS_MODLIST mods;
487 char *os_sp = NULL;
489 if (!r->in.os_name || !r->in.os_version ) {
490 return ADS_SUCCESS;
493 /* Find our DN */
495 status = libnet_join_find_machine_acct(mem_ctx, r);
496 if (!ADS_ERR_OK(status)) {
497 return status;
500 /* now do the mods */
502 mods = ads_init_mods(mem_ctx);
503 if (!mods) {
504 return ADS_ERROR(LDAP_NO_MEMORY);
507 os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
508 if (!os_sp) {
509 return ADS_ERROR(LDAP_NO_MEMORY);
512 /* fields of primary importance */
514 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
515 r->in.os_name);
516 if (!ADS_ERR_OK(status)) {
517 return status;
520 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
521 r->in.os_version);
522 if (!ADS_ERR_OK(status)) {
523 return status;
526 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
527 os_sp);
528 if (!ADS_ERR_OK(status)) {
529 return status;
532 return ads_gen_mod(r->in.ads, r->out.dn, mods);
535 /****************************************************************
536 ****************************************************************/
538 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
539 struct libnet_JoinCtx *r)
541 if (!USE_SYSTEM_KEYTAB) {
542 return true;
545 if (ads_keytab_create_default(r->in.ads) != 0) {
546 return false;
549 return true;
552 /****************************************************************
553 ****************************************************************/
555 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
556 struct libnet_JoinCtx *r)
558 uint32_t domain_func;
559 ADS_STATUS status;
560 const char *salt = NULL;
561 char *std_salt = NULL;
563 status = ads_domain_func_level(r->in.ads, &domain_func);
564 if (!ADS_ERR_OK(status)) {
565 libnet_join_set_error_string(mem_ctx, r,
566 "failed to determine domain functional level: %s",
567 ads_errstr(status));
568 return false;
571 /* go ahead and setup the default salt */
573 std_salt = kerberos_standard_des_salt();
574 if (!std_salt) {
575 libnet_join_set_error_string(mem_ctx, r,
576 "failed to obtain standard DES salt");
577 return false;
580 salt = talloc_strdup(mem_ctx, std_salt);
581 if (!salt) {
582 return false;
585 SAFE_FREE(std_salt);
587 /* if it's a Windows functional domain, we have to look for the UPN */
589 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
590 char *upn;
592 upn = ads_get_upn(r->in.ads, mem_ctx,
593 r->in.machine_name);
594 if (upn) {
595 salt = talloc_strdup(mem_ctx, upn);
596 if (!salt) {
597 return false;
602 return kerberos_secrets_store_des_salt(salt);
605 /****************************************************************
606 ****************************************************************/
608 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
609 struct libnet_JoinCtx *r)
611 ADS_STATUS status;
613 if (!r->in.ads) {
614 status = libnet_join_connect_ads(mem_ctx, r);
615 if (!ADS_ERR_OK(status)) {
616 return status;
620 status = libnet_join_set_machine_spn(mem_ctx, r);
621 if (!ADS_ERR_OK(status)) {
622 libnet_join_set_error_string(mem_ctx, r,
623 "failed to set machine spn: %s",
624 ads_errstr(status));
625 return status;
628 status = libnet_join_set_os_attributes(mem_ctx, r);
629 if (!ADS_ERR_OK(status)) {
630 libnet_join_set_error_string(mem_ctx, r,
631 "failed to set machine os attributes: %s",
632 ads_errstr(status));
633 return status;
636 status = libnet_join_set_machine_upn(mem_ctx, r);
637 if (!ADS_ERR_OK(status)) {
638 libnet_join_set_error_string(mem_ctx, r,
639 "failed to set machine upn: %s",
640 ads_errstr(status));
641 return status;
644 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
645 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
648 if (!libnet_join_create_keytab(mem_ctx, r)) {
649 libnet_join_set_error_string(mem_ctx, r,
650 "failed to create kerberos keytab");
651 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
654 return ADS_SUCCESS;
656 #endif /* HAVE_ADS */
658 /****************************************************************
659 Store the machine password and domain SID
660 ****************************************************************/
662 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
663 struct libnet_JoinCtx *r)
665 if (!secrets_store_domain_sid(r->out.netbios_domain_name,
666 r->out.domain_sid))
668 DEBUG(1,("Failed to save domain sid\n"));
669 return false;
672 if (!secrets_store_machine_password(r->in.machine_password,
673 r->out.netbios_domain_name,
674 r->in.secure_channel_type))
676 DEBUG(1,("Failed to save machine password\n"));
677 return false;
680 return true;
683 /****************************************************************
684 Connect dc's IPC$ share
685 ****************************************************************/
687 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
688 const char *user,
689 const char *pass,
690 bool use_kerberos,
691 struct cli_state **cli)
693 int flags = 0;
695 if (use_kerberos) {
696 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
699 if (use_kerberos && pass) {
700 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
703 return cli_full_connection(cli, NULL,
705 NULL, 0,
706 "IPC$", "IPC",
707 user,
708 NULL,
709 pass,
710 flags,
711 SMB_SIGNING_DEFAULT);
714 /****************************************************************
715 Lookup domain dc's info
716 ****************************************************************/
718 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
719 struct libnet_JoinCtx *r,
720 struct cli_state **cli)
722 struct rpc_pipe_client *pipe_hnd = NULL;
723 struct policy_handle lsa_pol;
724 NTSTATUS status, result;
725 union lsa_PolicyInformation *info = NULL;
726 struct dcerpc_binding_handle *b;
728 status = libnet_join_connect_dc_ipc(r->in.dc_name,
729 r->in.admin_account,
730 r->in.admin_password,
731 r->in.use_kerberos,
732 cli);
733 if (!NT_STATUS_IS_OK(status)) {
734 goto done;
737 status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
738 &pipe_hnd);
739 if (!NT_STATUS_IS_OK(status)) {
740 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
741 nt_errstr(status)));
742 goto done;
745 b = pipe_hnd->binding_handle;
747 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
748 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
749 if (!NT_STATUS_IS_OK(status)) {
750 goto done;
753 status = dcerpc_lsa_QueryInfoPolicy2(b, mem_ctx,
754 &lsa_pol,
755 LSA_POLICY_INFO_DNS,
756 &info,
757 &result);
758 if (NT_STATUS_IS_OK(status) && NT_STATUS_IS_OK(result)) {
759 r->out.domain_is_ad = true;
760 r->out.netbios_domain_name = info->dns.name.string;
761 r->out.dns_domain_name = info->dns.dns_domain.string;
762 r->out.forest_name = info->dns.dns_forest.string;
763 r->out.domain_sid = dom_sid_dup(mem_ctx, info->dns.sid);
764 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
767 if (!NT_STATUS_IS_OK(status)) {
768 status = dcerpc_lsa_QueryInfoPolicy(b, mem_ctx,
769 &lsa_pol,
770 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
771 &info,
772 &result);
773 if (!NT_STATUS_IS_OK(status)) {
774 goto done;
776 if (!NT_STATUS_IS_OK(result)) {
777 status = result;
778 goto done;
781 r->out.netbios_domain_name = info->account_domain.name.string;
782 r->out.domain_sid = dom_sid_dup(mem_ctx, info->account_domain.sid);
783 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
786 dcerpc_lsa_Close(b, mem_ctx, &lsa_pol, &result);
787 TALLOC_FREE(pipe_hnd);
789 done:
790 return status;
793 /****************************************************************
794 Do the domain join unsecure
795 ****************************************************************/
797 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
798 struct libnet_JoinCtx *r,
799 struct cli_state *cli)
801 struct rpc_pipe_client *pipe_hnd = NULL;
802 unsigned char orig_trust_passwd_hash[16];
803 unsigned char new_trust_passwd_hash[16];
804 fstring trust_passwd;
805 NTSTATUS status;
807 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
808 &pipe_hnd);
809 if (!NT_STATUS_IS_OK(status)) {
810 return status;
813 if (!r->in.machine_password) {
814 r->in.machine_password = generate_random_password(mem_ctx,
815 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
816 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
817 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
820 E_md4hash(r->in.machine_password, new_trust_passwd_hash);
822 /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
823 fstrcpy(trust_passwd, r->in.admin_password);
824 if (!strlower_m(trust_passwd)) {
825 return NT_STATUS_INVALID_PARAMETER;
829 * Machine names can be 15 characters, but the max length on
830 * a password is 14. --jerry
833 trust_passwd[14] = '\0';
835 E_md4hash(trust_passwd, orig_trust_passwd_hash);
837 status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
838 r->in.machine_name,
839 orig_trust_passwd_hash,
840 r->in.machine_password,
841 new_trust_passwd_hash,
842 r->in.secure_channel_type);
844 return status;
847 /****************************************************************
848 Do the domain join
849 ****************************************************************/
851 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
852 struct libnet_JoinCtx *r,
853 struct cli_state *cli)
855 struct rpc_pipe_client *pipe_hnd = NULL;
856 struct policy_handle sam_pol, domain_pol, user_pol;
857 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
858 char *acct_name;
859 struct lsa_String lsa_acct_name;
860 uint32_t user_rid;
861 uint32_t acct_flags = ACB_WSTRUST;
862 struct samr_Ids user_rids;
863 struct samr_Ids name_types;
864 union samr_UserInfo user_info;
865 struct dcerpc_binding_handle *b = NULL;
867 DATA_BLOB session_key = data_blob_null;
868 struct samr_CryptPassword crypt_pwd;
869 struct samr_CryptPasswordEx crypt_pwd_ex;
871 ZERO_STRUCT(sam_pol);
872 ZERO_STRUCT(domain_pol);
873 ZERO_STRUCT(user_pol);
875 switch (r->in.secure_channel_type) {
876 case SEC_CHAN_WKSTA:
877 acct_flags = ACB_WSTRUST;
878 break;
879 case SEC_CHAN_BDC:
880 acct_flags = ACB_SVRTRUST;
881 break;
882 default:
883 return NT_STATUS_INVALID_PARAMETER;
886 if (!r->in.machine_password) {
887 r->in.machine_password = generate_random_password(mem_ctx,
888 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH,
889 DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
890 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
893 /* Open the domain */
895 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
896 &pipe_hnd);
897 if (!NT_STATUS_IS_OK(status)) {
898 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
899 nt_errstr(status)));
900 goto done;
903 b = pipe_hnd->binding_handle;
905 status = cli_get_session_key(mem_ctx, pipe_hnd, &session_key);
906 if (!NT_STATUS_IS_OK(status)) {
907 DEBUG(0,("Error getting session_key of SAM pipe. Error was %s\n",
908 nt_errstr(status)));
909 goto done;
912 status = dcerpc_samr_Connect2(b, mem_ctx,
913 pipe_hnd->desthost,
914 SAMR_ACCESS_ENUM_DOMAINS
915 | SAMR_ACCESS_LOOKUP_DOMAIN,
916 &sam_pol,
917 &result);
918 if (!NT_STATUS_IS_OK(status)) {
919 goto done;
921 if (!NT_STATUS_IS_OK(result)) {
922 status = result;
923 goto done;
926 status = dcerpc_samr_OpenDomain(b, mem_ctx,
927 &sam_pol,
928 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
929 | SAMR_DOMAIN_ACCESS_CREATE_USER
930 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
931 r->out.domain_sid,
932 &domain_pol,
933 &result);
934 if (!NT_STATUS_IS_OK(status)) {
935 goto done;
937 if (!NT_STATUS_IS_OK(result)) {
938 status = result;
939 goto done;
942 /* Create domain user */
944 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
945 if (!strlower_m(acct_name)) {
946 status = NT_STATUS_INVALID_PARAMETER;
947 goto done;
950 init_lsa_String(&lsa_acct_name, acct_name);
952 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
953 uint32_t access_desired =
954 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
955 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
956 SAMR_USER_ACCESS_SET_PASSWORD |
957 SAMR_USER_ACCESS_GET_ATTRIBUTES |
958 SAMR_USER_ACCESS_SET_ATTRIBUTES;
959 uint32_t access_granted = 0;
961 DEBUG(10,("Creating account with desired access mask: %d\n",
962 access_desired));
964 status = dcerpc_samr_CreateUser2(b, mem_ctx,
965 &domain_pol,
966 &lsa_acct_name,
967 acct_flags,
968 access_desired,
969 &user_pol,
970 &access_granted,
971 &user_rid,
972 &result);
973 if (!NT_STATUS_IS_OK(status)) {
974 goto done;
977 status = result;
978 if (!NT_STATUS_IS_OK(status) &&
979 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
981 DEBUG(10,("Creation of workstation account failed: %s\n",
982 nt_errstr(status)));
984 /* If NT_STATUS_ACCESS_DENIED then we have a valid
985 username/password combo but the user does not have
986 administrator access. */
988 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
989 libnet_join_set_error_string(mem_ctx, r,
990 "User specified does not have "
991 "administrator privileges");
994 goto done;
997 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
998 if (!(r->in.join_flags &
999 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
1000 goto done;
1004 /* We *must* do this.... don't ask... */
1006 if (NT_STATUS_IS_OK(status)) {
1007 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1011 status = dcerpc_samr_LookupNames(b, mem_ctx,
1012 &domain_pol,
1014 &lsa_acct_name,
1015 &user_rids,
1016 &name_types,
1017 &result);
1018 if (!NT_STATUS_IS_OK(status)) {
1019 goto done;
1021 if (!NT_STATUS_IS_OK(result)) {
1022 status = result;
1023 goto done;
1026 if (name_types.ids[0] != SID_NAME_USER) {
1027 DEBUG(0,("%s is not a user account (type=%d)\n",
1028 acct_name, name_types.ids[0]));
1029 status = NT_STATUS_INVALID_WORKSTATION;
1030 goto done;
1033 user_rid = user_rids.ids[0];
1035 /* Open handle on user */
1037 status = dcerpc_samr_OpenUser(b, mem_ctx,
1038 &domain_pol,
1039 SEC_FLAG_MAXIMUM_ALLOWED,
1040 user_rid,
1041 &user_pol,
1042 &result);
1043 if (!NT_STATUS_IS_OK(status)) {
1044 goto done;
1046 if (!NT_STATUS_IS_OK(result)) {
1047 status = result;
1048 goto done;
1051 /* Fill in the additional account flags now */
1053 acct_flags |= ACB_PWNOEXP;
1055 /* Set account flags on machine account */
1056 ZERO_STRUCT(user_info.info16);
1057 user_info.info16.acct_flags = acct_flags;
1059 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1060 &user_pol,
1062 &user_info,
1063 &result);
1064 if (!NT_STATUS_IS_OK(status)) {
1065 dcerpc_samr_DeleteUser(b, mem_ctx,
1066 &user_pol,
1067 &result);
1069 libnet_join_set_error_string(mem_ctx, r,
1070 "Failed to set account flags for machine account (%s)\n",
1071 nt_errstr(status));
1072 goto done;
1075 if (!NT_STATUS_IS_OK(result)) {
1076 status = result;
1078 dcerpc_samr_DeleteUser(b, mem_ctx,
1079 &user_pol,
1080 &result);
1082 libnet_join_set_error_string(mem_ctx, r,
1083 "Failed to set account flags for machine account (%s)\n",
1084 nt_errstr(status));
1085 goto done;
1088 /* Set password on machine account - first try level 26 */
1090 init_samr_CryptPasswordEx(r->in.machine_password,
1091 &session_key,
1092 &crypt_pwd_ex);
1094 user_info.info26.password = crypt_pwd_ex;
1095 user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1097 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1098 &user_pol,
1100 &user_info,
1101 &result);
1103 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_ENUM_VALUE_OUT_OF_RANGE)) {
1105 /* retry with level 24 */
1107 init_samr_CryptPassword(r->in.machine_password,
1108 &session_key,
1109 &crypt_pwd);
1111 user_info.info24.password = crypt_pwd;
1112 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1114 status = dcerpc_samr_SetUserInfo2(b, mem_ctx,
1115 &user_pol,
1117 &user_info,
1118 &result);
1121 if (!NT_STATUS_IS_OK(status)) {
1123 dcerpc_samr_DeleteUser(b, mem_ctx,
1124 &user_pol,
1125 &result);
1127 libnet_join_set_error_string(mem_ctx, r,
1128 "Failed to set password for machine account (%s)\n",
1129 nt_errstr(status));
1130 goto done;
1132 if (!NT_STATUS_IS_OK(result)) {
1133 status = result;
1135 dcerpc_samr_DeleteUser(b, mem_ctx,
1136 &user_pol,
1137 &result);
1139 libnet_join_set_error_string(mem_ctx, r,
1140 "Failed to set password for machine account (%s)\n",
1141 nt_errstr(status));
1142 goto done;
1145 status = NT_STATUS_OK;
1147 done:
1148 if (!pipe_hnd) {
1149 return status;
1152 data_blob_clear_free(&session_key);
1154 if (is_valid_policy_hnd(&sam_pol)) {
1155 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1157 if (is_valid_policy_hnd(&domain_pol)) {
1158 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1160 if (is_valid_policy_hnd(&user_pol)) {
1161 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1163 TALLOC_FREE(pipe_hnd);
1165 return status;
1168 /****************************************************************
1169 ****************************************************************/
1171 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1172 const char *machine_name,
1173 const char *dc_name,
1174 const bool use_kerberos)
1176 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1177 struct cli_state *cli = NULL;
1178 struct rpc_pipe_client *pipe_hnd = NULL;
1179 struct rpc_pipe_client *netlogon_pipe = NULL;
1180 NTSTATUS status;
1181 char *machine_password = NULL;
1182 char *machine_account = NULL;
1183 int flags = 0;
1185 if (!dc_name) {
1186 return NT_STATUS_INVALID_PARAMETER;
1189 if (!secrets_init()) {
1190 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1193 machine_password = secrets_fetch_machine_password(netbios_domain_name,
1194 NULL, NULL);
1195 if (!machine_password) {
1196 return NT_STATUS_NO_TRUST_LSA_SECRET;
1199 if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1200 SAFE_FREE(machine_password);
1201 return NT_STATUS_NO_MEMORY;
1204 if (use_kerberos) {
1205 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
1208 status = cli_full_connection(&cli, NULL,
1209 dc_name,
1210 NULL, 0,
1211 "IPC$", "IPC",
1212 machine_account,
1213 NULL,
1214 machine_password,
1215 flags,
1216 SMB_SIGNING_DEFAULT);
1217 free(machine_account);
1218 free(machine_password);
1220 if (!NT_STATUS_IS_OK(status)) {
1221 status = cli_full_connection(&cli, NULL,
1222 dc_name,
1223 NULL, 0,
1224 "IPC$", "IPC",
1226 NULL,
1229 SMB_SIGNING_DEFAULT);
1232 if (!NT_STATUS_IS_OK(status)) {
1233 return status;
1236 status = get_schannel_session_key(cli, netbios_domain_name,
1237 &neg_flags, &netlogon_pipe);
1238 if (!NT_STATUS_IS_OK(status)) {
1239 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1240 cli_shutdown(cli);
1241 return NT_STATUS_OK;
1244 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1245 "key from server %s for domain %s. Error was %s\n",
1246 smbXcli_conn_remote_name(cli->conn),
1247 netbios_domain_name, nt_errstr(status)));
1248 cli_shutdown(cli);
1249 return status;
1252 if (!lp_client_schannel()) {
1253 cli_shutdown(cli);
1254 return NT_STATUS_OK;
1257 status = cli_rpc_pipe_open_schannel_with_key(
1258 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1259 DCERPC_AUTH_LEVEL_PRIVACY,
1260 netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
1262 cli_shutdown(cli);
1264 if (!NT_STATUS_IS_OK(status)) {
1265 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1266 "on netlogon pipe to server %s for domain %s. "
1267 "Error was %s\n",
1268 smbXcli_conn_remote_name(cli->conn),
1269 netbios_domain_name, nt_errstr(status)));
1270 return status;
1273 return NT_STATUS_OK;
1276 /****************************************************************
1277 ****************************************************************/
1279 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1280 struct libnet_JoinCtx *r)
1282 NTSTATUS status;
1284 status = libnet_join_ok(r->out.netbios_domain_name,
1285 r->in.machine_name,
1286 r->in.dc_name,
1287 r->in.use_kerberos);
1288 if (!NT_STATUS_IS_OK(status)) {
1289 libnet_join_set_error_string(mem_ctx, r,
1290 "failed to verify domain membership after joining: %s",
1291 get_friendly_nt_error_msg(status));
1292 return WERR_SETUP_NOT_JOINED;
1295 return WERR_OK;
1298 /****************************************************************
1299 ****************************************************************/
1301 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1302 struct libnet_UnjoinCtx *r)
1304 if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1305 return false;
1308 if (!secrets_delete_domain_sid(lp_workgroup())) {
1309 return false;
1312 return true;
1315 /****************************************************************
1316 ****************************************************************/
1318 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1319 struct libnet_UnjoinCtx *r)
1321 struct cli_state *cli = NULL;
1322 struct rpc_pipe_client *pipe_hnd = NULL;
1323 struct policy_handle sam_pol, domain_pol, user_pol;
1324 NTSTATUS status = NT_STATUS_UNSUCCESSFUL, result;
1325 char *acct_name;
1326 uint32_t user_rid;
1327 struct lsa_String lsa_acct_name;
1328 struct samr_Ids user_rids;
1329 struct samr_Ids name_types;
1330 union samr_UserInfo *info = NULL;
1331 struct dcerpc_binding_handle *b = NULL;
1333 ZERO_STRUCT(sam_pol);
1334 ZERO_STRUCT(domain_pol);
1335 ZERO_STRUCT(user_pol);
1337 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1338 r->in.admin_account,
1339 r->in.admin_password,
1340 r->in.use_kerberos,
1341 &cli);
1342 if (!NT_STATUS_IS_OK(status)) {
1343 goto done;
1346 /* Open the domain */
1348 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1349 &pipe_hnd);
1350 if (!NT_STATUS_IS_OK(status)) {
1351 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1352 nt_errstr(status)));
1353 goto done;
1356 b = pipe_hnd->binding_handle;
1358 status = dcerpc_samr_Connect2(b, mem_ctx,
1359 pipe_hnd->desthost,
1360 SEC_FLAG_MAXIMUM_ALLOWED,
1361 &sam_pol,
1362 &result);
1363 if (!NT_STATUS_IS_OK(status)) {
1364 goto done;
1366 if (!NT_STATUS_IS_OK(result)) {
1367 status = result;
1368 goto done;
1371 status = dcerpc_samr_OpenDomain(b, mem_ctx,
1372 &sam_pol,
1373 SEC_FLAG_MAXIMUM_ALLOWED,
1374 r->in.domain_sid,
1375 &domain_pol,
1376 &result);
1377 if (!NT_STATUS_IS_OK(status)) {
1378 goto done;
1380 if (!NT_STATUS_IS_OK(result)) {
1381 status = result;
1382 goto done;
1385 /* Create domain user */
1387 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1388 if (!strlower_m(acct_name)) {
1389 status = NT_STATUS_INVALID_PARAMETER;
1390 goto done;
1393 init_lsa_String(&lsa_acct_name, acct_name);
1395 status = dcerpc_samr_LookupNames(b, mem_ctx,
1396 &domain_pol,
1398 &lsa_acct_name,
1399 &user_rids,
1400 &name_types,
1401 &result);
1403 if (!NT_STATUS_IS_OK(status)) {
1404 goto done;
1406 if (!NT_STATUS_IS_OK(result)) {
1407 status = result;
1408 goto done;
1411 if (name_types.ids[0] != SID_NAME_USER) {
1412 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1413 name_types.ids[0]));
1414 status = NT_STATUS_INVALID_WORKSTATION;
1415 goto done;
1418 user_rid = user_rids.ids[0];
1420 /* Open handle on user */
1422 status = dcerpc_samr_OpenUser(b, mem_ctx,
1423 &domain_pol,
1424 SEC_FLAG_MAXIMUM_ALLOWED,
1425 user_rid,
1426 &user_pol,
1427 &result);
1428 if (!NT_STATUS_IS_OK(status)) {
1429 goto done;
1431 if (!NT_STATUS_IS_OK(result)) {
1432 status = result;
1433 goto done;
1436 /* Get user info */
1438 status = dcerpc_samr_QueryUserInfo(b, mem_ctx,
1439 &user_pol,
1441 &info,
1442 &result);
1443 if (!NT_STATUS_IS_OK(status)) {
1444 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1445 goto done;
1447 if (!NT_STATUS_IS_OK(result)) {
1448 status = result;
1449 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1450 goto done;
1453 /* now disable and setuser info */
1455 info->info16.acct_flags |= ACB_DISABLED;
1457 status = dcerpc_samr_SetUserInfo(b, mem_ctx,
1458 &user_pol,
1460 info,
1461 &result);
1462 if (!NT_STATUS_IS_OK(status)) {
1463 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1464 goto done;
1466 if (!NT_STATUS_IS_OK(result)) {
1467 status = result;
1468 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1469 goto done;
1471 status = result;
1472 dcerpc_samr_Close(b, mem_ctx, &user_pol, &result);
1474 done:
1475 if (pipe_hnd && b) {
1476 if (is_valid_policy_hnd(&domain_pol)) {
1477 dcerpc_samr_Close(b, mem_ctx, &domain_pol, &result);
1479 if (is_valid_policy_hnd(&sam_pol)) {
1480 dcerpc_samr_Close(b, mem_ctx, &sam_pol, &result);
1482 TALLOC_FREE(pipe_hnd);
1485 if (cli) {
1486 cli_shutdown(cli);
1489 return status;
1492 /****************************************************************
1493 ****************************************************************/
1495 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1497 WERROR werr = WERR_OK;
1498 sbcErr err;
1499 struct smbconf_ctx *ctx;
1501 err = smbconf_init_reg(r, &ctx, NULL);
1502 if (!SBC_ERROR_IS_OK(err)) {
1503 werr = WERR_NO_SUCH_SERVICE;
1504 goto done;
1507 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1509 err = smbconf_set_global_parameter(ctx, "security", "user");
1510 if (!SBC_ERROR_IS_OK(err)) {
1511 werr = WERR_NO_SUCH_SERVICE;
1512 goto done;
1515 err = smbconf_set_global_parameter(ctx, "workgroup",
1516 r->in.domain_name);
1517 if (!SBC_ERROR_IS_OK(err)) {
1518 werr = WERR_NO_SUCH_SERVICE;
1519 goto done;
1522 smbconf_delete_global_parameter(ctx, "realm");
1523 goto done;
1526 err = smbconf_set_global_parameter(ctx, "security", "domain");
1527 if (!SBC_ERROR_IS_OK(err)) {
1528 werr = WERR_NO_SUCH_SERVICE;
1529 goto done;
1532 err = smbconf_set_global_parameter(ctx, "workgroup",
1533 r->out.netbios_domain_name);
1534 if (!SBC_ERROR_IS_OK(err)) {
1535 werr = WERR_NO_SUCH_SERVICE;
1536 goto done;
1539 if (r->out.domain_is_ad) {
1540 err = smbconf_set_global_parameter(ctx, "security", "ads");
1541 if (!SBC_ERROR_IS_OK(err)) {
1542 werr = WERR_NO_SUCH_SERVICE;
1543 goto done;
1546 err = smbconf_set_global_parameter(ctx, "realm",
1547 r->out.dns_domain_name);
1548 if (!SBC_ERROR_IS_OK(err)) {
1549 werr = WERR_NO_SUCH_SERVICE;
1550 goto done;
1554 done:
1555 smbconf_shutdown(ctx);
1556 return werr;
1559 /****************************************************************
1560 ****************************************************************/
1562 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1564 WERROR werr = WERR_OK;
1565 sbcErr err;
1566 struct smbconf_ctx *ctx;
1568 err = smbconf_init_reg(r, &ctx, NULL);
1569 if (!SBC_ERROR_IS_OK(err)) {
1570 werr = WERR_NO_SUCH_SERVICE;
1571 goto done;
1574 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1576 err = smbconf_set_global_parameter(ctx, "security", "user");
1577 if (!SBC_ERROR_IS_OK(err)) {
1578 werr = WERR_NO_SUCH_SERVICE;
1579 goto done;
1582 err = smbconf_delete_global_parameter(ctx, "workgroup");
1583 if (!SBC_ERROR_IS_OK(err)) {
1584 werr = WERR_NO_SUCH_SERVICE;
1585 goto done;
1588 smbconf_delete_global_parameter(ctx, "realm");
1591 done:
1592 smbconf_shutdown(ctx);
1593 return werr;
1596 /****************************************************************
1597 ****************************************************************/
1599 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1601 WERROR werr;
1603 if (!W_ERROR_IS_OK(r->out.result)) {
1604 return r->out.result;
1607 if (!r->in.modify_config) {
1608 return WERR_OK;
1611 werr = do_join_modify_vals_config(r);
1612 if (!W_ERROR_IS_OK(werr)) {
1613 return werr;
1616 lp_load_global(get_dyn_CONFIGFILE());
1618 r->out.modified_config = true;
1619 r->out.result = werr;
1621 return werr;
1624 /****************************************************************
1625 ****************************************************************/
1627 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1629 WERROR werr;
1631 if (!W_ERROR_IS_OK(r->out.result)) {
1632 return r->out.result;
1635 if (!r->in.modify_config) {
1636 return WERR_OK;
1639 werr = do_unjoin_modify_vals_config(r);
1640 if (!W_ERROR_IS_OK(werr)) {
1641 return werr;
1644 lp_load_global(get_dyn_CONFIGFILE());
1646 r->out.modified_config = true;
1647 r->out.result = werr;
1649 return werr;
1652 /****************************************************************
1653 ****************************************************************/
1655 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1656 const char *domain_str,
1657 const char **domain_p,
1658 const char **dc_p)
1660 char *domain = NULL;
1661 char *dc = NULL;
1662 const char *p = NULL;
1664 if (!domain_str || !domain_p || !dc_p) {
1665 return false;
1668 p = strchr_m(domain_str, '\\');
1670 if (p != NULL) {
1671 domain = talloc_strndup(mem_ctx, domain_str,
1672 PTR_DIFF(p, domain_str));
1673 dc = talloc_strdup(mem_ctx, p+1);
1674 if (!dc) {
1675 return false;
1677 } else {
1678 domain = talloc_strdup(mem_ctx, domain_str);
1679 dc = NULL;
1681 if (!domain) {
1682 return false;
1685 *domain_p = domain;
1687 if (!*dc_p && dc) {
1688 *dc_p = dc;
1691 return true;
1694 /****************************************************************
1695 ****************************************************************/
1697 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1698 struct libnet_JoinCtx *r)
1700 if (!r->in.domain_name) {
1701 libnet_join_set_error_string(mem_ctx, r,
1702 "No domain name defined");
1703 return WERR_INVALID_PARAM;
1706 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1707 &r->in.domain_name,
1708 &r->in.dc_name)) {
1709 libnet_join_set_error_string(mem_ctx, r,
1710 "Failed to parse domain name");
1711 return WERR_INVALID_PARAM;
1714 if (IS_DC) {
1715 return WERR_SETUP_DOMAIN_CONTROLLER;
1718 if (!secrets_init()) {
1719 libnet_join_set_error_string(mem_ctx, r,
1720 "Unable to open secrets database");
1721 return WERR_CAN_NOT_COMPLETE;
1724 return WERR_OK;
1727 /****************************************************************
1728 ****************************************************************/
1730 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1732 NTSTATUS status;
1734 /* Try adding dom admins to builtin\admins. Only log failures. */
1735 status = create_builtin_administrators(domain_sid);
1736 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1737 DEBUG(10,("Unable to auto-add domain administrators to "
1738 "BUILTIN\\Administrators during join because "
1739 "winbindd must be running.\n"));
1740 } else if (!NT_STATUS_IS_OK(status)) {
1741 DEBUG(5, ("Failed to auto-add domain administrators to "
1742 "BUILTIN\\Administrators during join: %s\n",
1743 nt_errstr(status)));
1746 /* Try adding dom users to builtin\users. Only log failures. */
1747 status = create_builtin_users(domain_sid);
1748 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1749 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1750 "during join because winbindd must be running.\n"));
1751 } else if (!NT_STATUS_IS_OK(status)) {
1752 DEBUG(5, ("Failed to auto-add domain administrators to "
1753 "BUILTIN\\Administrators during join: %s\n",
1754 nt_errstr(status)));
1758 /****************************************************************
1759 ****************************************************************/
1761 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1762 struct libnet_JoinCtx *r)
1764 WERROR werr;
1766 if (!W_ERROR_IS_OK(r->out.result)) {
1767 return r->out.result;
1770 werr = do_JoinConfig(r);
1771 if (!W_ERROR_IS_OK(werr)) {
1772 return werr;
1775 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1776 return WERR_OK;
1779 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1780 if (r->out.dns_domain_name) {
1781 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1784 #ifdef HAVE_ADS
1785 if (r->out.domain_is_ad &&
1786 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1787 ADS_STATUS ads_status;
1789 ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1790 if (!ADS_ERR_OK(ads_status)) {
1791 return WERR_GENERAL_FAILURE;
1794 #endif /* HAVE_ADS */
1796 libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1798 return WERR_OK;
1801 /****************************************************************
1802 ****************************************************************/
1804 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1806 if (r->in.ads) {
1807 ads_destroy(&r->in.ads);
1810 return 0;
1813 /****************************************************************
1814 ****************************************************************/
1816 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1818 if (r->in.ads) {
1819 ads_destroy(&r->in.ads);
1822 return 0;
1825 /****************************************************************
1826 ****************************************************************/
1828 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1829 struct libnet_JoinCtx **r)
1831 struct libnet_JoinCtx *ctx;
1833 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1834 if (!ctx) {
1835 return WERR_NOMEM;
1838 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1840 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
1841 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1843 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1845 *r = ctx;
1847 return WERR_OK;
1850 /****************************************************************
1851 ****************************************************************/
1853 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1854 struct libnet_UnjoinCtx **r)
1856 struct libnet_UnjoinCtx *ctx;
1858 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1859 if (!ctx) {
1860 return WERR_NOMEM;
1863 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1865 ctx->in.machine_name = talloc_strdup(mem_ctx, lp_netbios_name());
1866 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1868 *r = ctx;
1870 return WERR_OK;
1873 /****************************************************************
1874 ****************************************************************/
1876 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1877 struct libnet_JoinCtx *r)
1879 bool valid_security = false;
1880 bool valid_workgroup = false;
1881 bool valid_realm = false;
1883 /* check if configuration is already set correctly */
1885 valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1887 switch (r->out.domain_is_ad) {
1888 case false:
1889 valid_security = (lp_security() == SEC_DOMAIN);
1890 if (valid_workgroup && valid_security) {
1891 /* nothing to be done */
1892 return WERR_OK;
1894 break;
1895 case true:
1896 valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1897 switch (lp_security()) {
1898 case SEC_DOMAIN:
1899 case SEC_ADS:
1900 valid_security = true;
1903 if (valid_workgroup && valid_realm && valid_security) {
1904 /* nothing to be done */
1905 return WERR_OK;
1907 break;
1910 /* check if we are supposed to manipulate configuration */
1912 if (!r->in.modify_config) {
1914 char *wrong_conf = talloc_strdup(mem_ctx, "");
1916 if (!valid_workgroup) {
1917 wrong_conf = talloc_asprintf_append(wrong_conf,
1918 "\"workgroup\" set to '%s', should be '%s'",
1919 lp_workgroup(), r->out.netbios_domain_name);
1920 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1923 if (!valid_realm) {
1924 wrong_conf = talloc_asprintf_append(wrong_conf,
1925 "\"realm\" set to '%s', should be '%s'",
1926 lp_realm(), r->out.dns_domain_name);
1927 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1930 if (!valid_security) {
1931 const char *sec = NULL;
1932 switch (lp_security()) {
1933 case SEC_USER: sec = "user"; break;
1934 case SEC_DOMAIN: sec = "domain"; break;
1935 case SEC_ADS: sec = "ads"; break;
1937 wrong_conf = talloc_asprintf_append(wrong_conf,
1938 "\"security\" set to '%s', should be %s",
1939 sec, r->out.domain_is_ad ?
1940 "either 'domain' or 'ads'" : "'domain'");
1941 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1944 libnet_join_set_error_string(mem_ctx, r,
1945 "Invalid configuration (%s) and configuration modification "
1946 "was not requested", wrong_conf);
1947 return WERR_CAN_NOT_COMPLETE;
1950 /* check if we are able to manipulate configuration */
1952 if (!lp_config_backend_is_registry()) {
1953 libnet_join_set_error_string(mem_ctx, r,
1954 "Configuration manipulation requested but not "
1955 "supported by backend");
1956 return WERR_NOT_SUPPORTED;
1959 return WERR_OK;
1962 /****************************************************************
1963 ****************************************************************/
1965 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1966 struct libnet_JoinCtx *r)
1968 NTSTATUS status;
1969 WERROR werr;
1970 struct cli_state *cli = NULL;
1971 #ifdef HAVE_ADS
1972 ADS_STATUS ads_status;
1973 #endif /* HAVE_ADS */
1975 if (!r->in.dc_name) {
1976 struct netr_DsRGetDCNameInfo *info;
1977 const char *dc;
1978 status = dsgetdcname(mem_ctx,
1979 r->in.msg_ctx,
1980 r->in.domain_name,
1981 NULL,
1982 NULL,
1983 DS_FORCE_REDISCOVERY |
1984 DS_DIRECTORY_SERVICE_REQUIRED |
1985 DS_WRITABLE_REQUIRED |
1986 DS_RETURN_DNS_NAME,
1987 &info);
1988 if (!NT_STATUS_IS_OK(status)) {
1989 libnet_join_set_error_string(mem_ctx, r,
1990 "failed to find DC for domain %s",
1991 r->in.domain_name,
1992 get_friendly_nt_error_msg(status));
1993 return WERR_DCNOTFOUND;
1996 dc = strip_hostname(info->dc_unc);
1997 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1998 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2001 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
2002 if (!NT_STATUS_IS_OK(status)) {
2003 libnet_join_set_error_string(mem_ctx, r,
2004 "failed to lookup DC info for domain '%s' over rpc: %s",
2005 r->in.domain_name, get_friendly_nt_error_msg(status));
2006 return ntstatus_to_werror(status);
2009 werr = libnet_join_check_config(mem_ctx, r);
2010 if (!W_ERROR_IS_OK(werr)) {
2011 goto done;
2014 #ifdef HAVE_ADS
2016 create_local_private_krb5_conf_for_domain(
2017 r->out.dns_domain_name, r->out.netbios_domain_name,
2018 NULL, smbXcli_conn_remote_sockaddr(cli->conn),
2019 smbXcli_conn_remote_name(cli->conn));
2021 if (r->out.domain_is_ad && r->in.account_ou &&
2022 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
2024 ads_status = libnet_join_connect_ads(mem_ctx, r);
2025 if (!ADS_ERR_OK(ads_status)) {
2026 return WERR_DEFAULT_JOIN_REQUIRED;
2029 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
2030 if (!ADS_ERR_OK(ads_status)) {
2031 libnet_join_set_error_string(mem_ctx, r,
2032 "failed to precreate account in ou %s: %s",
2033 r->in.account_ou,
2034 ads_errstr(ads_status));
2035 return WERR_DEFAULT_JOIN_REQUIRED;
2038 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
2040 #endif /* HAVE_ADS */
2042 if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
2043 (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
2044 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
2045 } else {
2046 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
2048 if (!NT_STATUS_IS_OK(status)) {
2049 libnet_join_set_error_string(mem_ctx, r,
2050 "failed to join domain '%s' over rpc: %s",
2051 r->in.domain_name, get_friendly_nt_error_msg(status));
2052 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
2053 return WERR_SETUP_ALREADY_JOINED;
2055 werr = ntstatus_to_werror(status);
2056 goto done;
2059 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
2060 werr = WERR_SETUP_NOT_JOINED;
2061 goto done;
2064 werr = WERR_OK;
2066 done:
2067 if (cli) {
2068 cli_shutdown(cli);
2071 return werr;
2074 /****************************************************************
2075 ****************************************************************/
2077 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
2078 struct libnet_JoinCtx *r)
2080 WERROR werr;
2081 struct libnet_UnjoinCtx *u = NULL;
2083 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
2084 if (!W_ERROR_IS_OK(werr)) {
2085 return werr;
2088 u->in.debug = r->in.debug;
2089 u->in.dc_name = r->in.dc_name;
2090 u->in.domain_name = r->in.domain_name;
2091 u->in.admin_account = r->in.admin_account;
2092 u->in.admin_password = r->in.admin_password;
2093 u->in.modify_config = r->in.modify_config;
2094 u->in.use_kerberos = r->in.use_kerberos;
2095 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
2096 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
2098 werr = libnet_Unjoin(mem_ctx, u);
2099 TALLOC_FREE(u);
2101 return werr;
2104 /****************************************************************
2105 ****************************************************************/
2107 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
2108 struct libnet_JoinCtx *r)
2110 WERROR werr;
2112 if (r->in.debug) {
2113 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
2116 ZERO_STRUCT(r->out);
2118 werr = libnet_join_pre_processing(mem_ctx, r);
2119 if (!W_ERROR_IS_OK(werr)) {
2120 goto done;
2123 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2124 werr = libnet_DomainJoin(mem_ctx, r);
2125 if (!W_ERROR_IS_OK(werr)) {
2126 goto done;
2130 werr = libnet_join_post_processing(mem_ctx, r);
2131 if (!W_ERROR_IS_OK(werr)) {
2132 goto done;
2135 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2136 werr = libnet_join_post_verify(mem_ctx, r);
2137 if (!W_ERROR_IS_OK(werr)) {
2138 libnet_join_rollback(mem_ctx, r);
2142 done:
2143 r->out.result = werr;
2145 if (r->in.debug) {
2146 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2148 return werr;
2151 /****************************************************************
2152 ****************************************************************/
2154 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2155 struct libnet_UnjoinCtx *r)
2157 NTSTATUS status;
2159 if (!r->in.domain_sid) {
2160 struct dom_sid sid;
2161 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2162 libnet_unjoin_set_error_string(mem_ctx, r,
2163 "Unable to fetch domain sid: are we joined?");
2164 return WERR_SETUP_NOT_JOINED;
2166 r->in.domain_sid = dom_sid_dup(mem_ctx, &sid);
2167 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2170 if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2171 !r->in.delete_machine_account) {
2172 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2173 return WERR_OK;
2176 if (!r->in.dc_name) {
2177 struct netr_DsRGetDCNameInfo *info;
2178 const char *dc;
2179 status = dsgetdcname(mem_ctx,
2180 r->in.msg_ctx,
2181 r->in.domain_name,
2182 NULL,
2183 NULL,
2184 DS_DIRECTORY_SERVICE_REQUIRED |
2185 DS_WRITABLE_REQUIRED |
2186 DS_RETURN_DNS_NAME,
2187 &info);
2188 if (!NT_STATUS_IS_OK(status)) {
2189 libnet_unjoin_set_error_string(mem_ctx, r,
2190 "failed to find DC for domain %s",
2191 r->in.domain_name,
2192 get_friendly_nt_error_msg(status));
2193 return WERR_DCNOTFOUND;
2196 dc = strip_hostname(info->dc_unc);
2197 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2198 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2201 #ifdef HAVE_ADS
2202 /* for net ads leave, try to delete the account. If it works,
2203 no sense in disabling. If it fails, we can still try to
2204 disable it. jmcd */
2206 if (r->in.delete_machine_account) {
2207 ADS_STATUS ads_status;
2208 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2209 if (ADS_ERR_OK(ads_status)) {
2210 /* dirty hack */
2211 r->out.dns_domain_name =
2212 talloc_strdup(mem_ctx,
2213 r->in.ads->server.realm);
2214 ads_status =
2215 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2217 if (!ADS_ERR_OK(ads_status)) {
2218 libnet_unjoin_set_error_string(mem_ctx, r,
2219 "failed to remove machine account from AD: %s",
2220 ads_errstr(ads_status));
2221 } else {
2222 r->out.deleted_machine_account = true;
2223 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2224 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2225 return WERR_OK;
2228 #endif /* HAVE_ADS */
2230 /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2231 "disable". */
2232 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2233 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2234 if (!NT_STATUS_IS_OK(status)) {
2235 libnet_unjoin_set_error_string(mem_ctx, r,
2236 "failed to disable machine account via rpc: %s",
2237 get_friendly_nt_error_msg(status));
2238 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2239 return WERR_SETUP_NOT_JOINED;
2241 return ntstatus_to_werror(status);
2244 r->out.disabled_machine_account = true;
2247 /* If disable succeeded or was not requested at all, we
2248 should be getting rid of our end of things */
2250 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2252 return WERR_OK;
2255 /****************************************************************
2256 ****************************************************************/
2258 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2259 struct libnet_UnjoinCtx *r)
2261 if (!r->in.domain_name) {
2262 libnet_unjoin_set_error_string(mem_ctx, r,
2263 "No domain name defined");
2264 return WERR_INVALID_PARAM;
2267 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2268 &r->in.domain_name,
2269 &r->in.dc_name)) {
2270 libnet_unjoin_set_error_string(mem_ctx, r,
2271 "Failed to parse domain name");
2272 return WERR_INVALID_PARAM;
2275 if (IS_DC) {
2276 return WERR_SETUP_DOMAIN_CONTROLLER;
2279 if (!secrets_init()) {
2280 libnet_unjoin_set_error_string(mem_ctx, r,
2281 "Unable to open secrets database");
2282 return WERR_CAN_NOT_COMPLETE;
2285 return WERR_OK;
2288 /****************************************************************
2289 ****************************************************************/
2291 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2292 struct libnet_UnjoinCtx *r)
2294 saf_delete(r->out.netbios_domain_name);
2295 saf_delete(r->out.dns_domain_name);
2297 return libnet_unjoin_config(r);
2300 /****************************************************************
2301 ****************************************************************/
2303 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2304 struct libnet_UnjoinCtx *r)
2306 WERROR werr;
2308 if (r->in.debug) {
2309 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2312 werr = libnet_unjoin_pre_processing(mem_ctx, r);
2313 if (!W_ERROR_IS_OK(werr)) {
2314 goto done;
2317 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2318 werr = libnet_DomainUnjoin(mem_ctx, r);
2319 if (!W_ERROR_IS_OK(werr)) {
2320 libnet_unjoin_config(r);
2321 goto done;
2325 werr = libnet_unjoin_post_processing(mem_ctx, r);
2326 if (!W_ERROR_IS_OK(werr)) {
2327 goto done;
2330 done:
2331 r->out.result = werr;
2333 if (r->in.debug) {
2334 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
2337 return werr;