2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2008,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 * Copyright (C) Volker Lendecke 2005.
14 * Copyright (C) Guenther Deschner 2008.
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 3 of the License, or
19 * (at your option) any later version.
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
31 * This is the implementation of the SAMR code.
35 #include "smbd/globals.h"
36 #include "../libcli/auth/libcli_auth.h"
37 #include "../librpc/gen_ndr/srv_samr.h"
38 #include "rpc_server/samr/srv_samr_util.h"
39 #include "../lib/crypto/arcfour.h"
41 #include "rpc_client/init_lsa.h"
42 #include "../libcli/security/security.h"
45 #define DBGC_CLASS DBGC_RPC_SRV
47 #define SAMR_USR_RIGHTS_WRITE_PW \
48 ( READ_CONTROL_ACCESS | \
49 SAMR_USER_ACCESS_CHANGE_PASSWORD | \
50 SAMR_USER_ACCESS_SET_LOC_COM)
51 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
52 ( READ_CONTROL_ACCESS | SAMR_USER_ACCESS_SET_LOC_COM )
54 #define DISP_INFO_CACHE_TIMEOUT 10
56 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
57 #define MAX_SAM_ENTRIES_W95 50
59 struct samr_connect_info
{
63 struct samr_domain_info
{
65 struct disp_info
*disp_info
;
68 struct samr_user_info
{
72 struct samr_group_info
{
76 struct samr_alias_info
{
80 typedef struct disp_info
{
81 struct dom_sid sid
; /* identify which domain this is. */
82 struct pdb_search
*users
; /* querydispinfo 1 and 4 */
83 struct pdb_search
*machines
; /* querydispinfo 2 */
84 struct pdb_search
*groups
; /* querydispinfo 3 and 5, enumgroups */
85 struct pdb_search
*aliases
; /* enumaliases */
87 uint32_t enum_acb_mask
;
88 struct pdb_search
*enum_users
; /* enumusers with a mask */
90 struct timed_event
*cache_timeout_event
; /* cache idle timeout
94 static const struct generic_mapping sam_generic_mapping
= {
95 GENERIC_RIGHTS_SAM_READ
,
96 GENERIC_RIGHTS_SAM_WRITE
,
97 GENERIC_RIGHTS_SAM_EXECUTE
,
98 GENERIC_RIGHTS_SAM_ALL_ACCESS
};
99 static const struct generic_mapping dom_generic_mapping
= {
100 GENERIC_RIGHTS_DOMAIN_READ
,
101 GENERIC_RIGHTS_DOMAIN_WRITE
,
102 GENERIC_RIGHTS_DOMAIN_EXECUTE
,
103 GENERIC_RIGHTS_DOMAIN_ALL_ACCESS
};
104 static const struct generic_mapping usr_generic_mapping
= {
105 GENERIC_RIGHTS_USER_READ
,
106 GENERIC_RIGHTS_USER_WRITE
,
107 GENERIC_RIGHTS_USER_EXECUTE
,
108 GENERIC_RIGHTS_USER_ALL_ACCESS
};
109 static const struct generic_mapping usr_nopwchange_generic_mapping
= {
110 GENERIC_RIGHTS_USER_READ
,
111 GENERIC_RIGHTS_USER_WRITE
,
112 GENERIC_RIGHTS_USER_EXECUTE
& ~SAMR_USER_ACCESS_CHANGE_PASSWORD
,
113 GENERIC_RIGHTS_USER_ALL_ACCESS
};
114 static const struct generic_mapping grp_generic_mapping
= {
115 GENERIC_RIGHTS_GROUP_READ
,
116 GENERIC_RIGHTS_GROUP_WRITE
,
117 GENERIC_RIGHTS_GROUP_EXECUTE
,
118 GENERIC_RIGHTS_GROUP_ALL_ACCESS
};
119 static const struct generic_mapping ali_generic_mapping
= {
120 GENERIC_RIGHTS_ALIAS_READ
,
121 GENERIC_RIGHTS_ALIAS_WRITE
,
122 GENERIC_RIGHTS_ALIAS_EXECUTE
,
123 GENERIC_RIGHTS_ALIAS_ALL_ACCESS
};
125 /*******************************************************************
126 *******************************************************************/
128 static NTSTATUS
make_samr_object_sd( TALLOC_CTX
*ctx
, struct security_descriptor
**psd
, size_t *sd_size
,
129 const struct generic_mapping
*map
,
130 struct dom_sid
*sid
, uint32 sid_access
)
132 struct dom_sid domadmin_sid
;
133 struct security_ace ace
[5]; /* at most 5 entries */
136 struct security_acl
*psa
= NULL
;
138 /* basic access for Everyone */
140 init_sec_ace(&ace
[i
++], &global_sid_World
, SEC_ACE_TYPE_ACCESS_ALLOWED
,
141 map
->generic_execute
| map
->generic_read
, 0);
143 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
145 init_sec_ace(&ace
[i
++], &global_sid_Builtin_Administrators
,
146 SEC_ACE_TYPE_ACCESS_ALLOWED
, map
->generic_all
, 0);
147 init_sec_ace(&ace
[i
++], &global_sid_Builtin_Account_Operators
,
148 SEC_ACE_TYPE_ACCESS_ALLOWED
, map
->generic_all
, 0);
150 /* Add Full Access for Domain Admins if we are a DC */
153 sid_compose(&domadmin_sid
, get_global_sam_sid(),
155 init_sec_ace(&ace
[i
++], &domadmin_sid
,
156 SEC_ACE_TYPE_ACCESS_ALLOWED
, map
->generic_all
, 0);
159 /* if we have a sid, give it some special access */
162 init_sec_ace(&ace
[i
++], sid
, SEC_ACE_TYPE_ACCESS_ALLOWED
, sid_access
, 0);
165 /* create the security descriptor */
167 if ((psa
= make_sec_acl(ctx
, NT4_ACL_REVISION
, i
, ace
)) == NULL
)
168 return NT_STATUS_NO_MEMORY
;
170 if ((*psd
= make_sec_desc(ctx
, SECURITY_DESCRIPTOR_REVISION_1
,
171 SEC_DESC_SELF_RELATIVE
, NULL
, NULL
, NULL
,
172 psa
, sd_size
)) == NULL
)
173 return NT_STATUS_NO_MEMORY
;
178 /*******************************************************************
179 Checks if access to an object should be granted, and returns that
180 level of access for further checks.
182 If the user has either of needed_priv_1 or needed_priv_2 then they
183 get the rights in rights_mask in addition to any calulated rights.
185 This handles the unusual case where we need to allow two different
186 privileges to obtain exactly the same rights, which occours only in
188 ********************************************************************/
190 NTSTATUS
access_check_object( struct security_descriptor
*psd
, struct security_token
*token
,
191 enum sec_privilege needed_priv_1
, enum sec_privilege needed_priv_2
,
193 uint32 des_access
, uint32
*acc_granted
,
196 NTSTATUS status
= NT_STATUS_ACCESS_DENIED
;
197 uint32 saved_mask
= 0;
199 /* check privileges; certain SAM access bits should be overridden
200 by privileges (mostly having to do with creating/modifying/deleting
203 if ((needed_priv_1
!= SEC_PRIV_INVALID
&& security_token_has_privilege(token
, needed_priv_1
)) ||
204 (needed_priv_2
!= SEC_PRIV_INVALID
&& security_token_has_privilege(token
, needed_priv_2
))) {
205 saved_mask
= (des_access
& rights_mask
);
206 des_access
&= ~saved_mask
;
208 DEBUG(4,("access_check_object: user rights access mask [0x%x]\n",
213 /* check the security descriptor first */
215 status
= se_access_check(psd
, token
, des_access
, acc_granted
);
216 if (NT_STATUS_IS_OK(status
)) {
220 /* give root a free pass */
222 if ( geteuid() == sec_initial_uid() ) {
224 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n", debug
, des_access
));
225 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
227 *acc_granted
= des_access
;
229 status
= NT_STATUS_OK
;
235 /* add in any bits saved during the privilege check (only
236 matters is status is ok) */
238 *acc_granted
|= rights_mask
;
240 DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
241 debug
, NT_STATUS_IS_OK(status
) ? "GRANTED" : "DENIED",
242 des_access
, *acc_granted
));
248 /*******************************************************************
249 Map any MAXIMUM_ALLOWED_ACCESS request to a valid access set.
250 ********************************************************************/
252 void map_max_allowed_access(const struct security_token
*nt_token
,
253 const struct unix_user_token
*unix_token
,
254 uint32_t *pacc_requested
)
256 if (!((*pacc_requested
) & MAXIMUM_ALLOWED_ACCESS
)) {
259 *pacc_requested
&= ~MAXIMUM_ALLOWED_ACCESS
;
261 /* At least try for generic read|execute - Everyone gets that. */
262 *pacc_requested
= GENERIC_READ_ACCESS
|GENERIC_EXECUTE_ACCESS
;
264 /* root gets anything. */
265 if (unix_token
->uid
== sec_initial_uid()) {
266 *pacc_requested
|= GENERIC_ALL_ACCESS
;
270 /* Full Access for 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
272 if (security_token_has_sid(nt_token
, &global_sid_Builtin_Administrators
) ||
273 security_token_has_sid(nt_token
, &global_sid_Builtin_Account_Operators
)) {
274 *pacc_requested
|= GENERIC_ALL_ACCESS
;
278 /* Full access for DOMAIN\Domain Admins. */
280 struct dom_sid domadmin_sid
;
281 sid_compose(&domadmin_sid
, get_global_sam_sid(),
283 if (security_token_has_sid(nt_token
, &domadmin_sid
)) {
284 *pacc_requested
|= GENERIC_ALL_ACCESS
;
288 /* TODO ! Check privileges. */
291 /*******************************************************************
292 Fetch or create a dispinfo struct.
293 ********************************************************************/
295 static DISP_INFO
*get_samr_dispinfo_by_sid(const struct dom_sid
*psid
)
298 * We do a static cache for DISP_INFO's here. Explanation can be found
299 * in Jeremy's checkin message to r11793:
301 * Fix the SAMR cache so it works across completely insane
302 * client behaviour (ie.:
303 * open pipe/open SAMR handle/enumerate 0 - 1024
304 * close SAMR handle, close pipe.
305 * open pipe/open SAMR handle/enumerate 1024 - 2048...
306 * close SAMR handle, close pipe.
307 * And on ad-nausium. Amazing.... probably object-oriented
308 * client side programming in action yet again.
309 * This change should *massively* improve performance when
310 * enumerating users from an LDAP database.
313 * "Our" and the builtin domain are the only ones where we ever
314 * enumerate stuff, so just cache 2 entries.
317 static struct disp_info
*builtin_dispinfo
;
318 static struct disp_info
*domain_dispinfo
;
320 /* There are two cases to consider here:
321 1) The SID is a domain SID and we look for an equality match, or
322 2) This is an account SID and so we return the DISP_INFO* for our
329 if (sid_check_is_builtin(psid
) || sid_check_is_in_builtin(psid
)) {
331 * Necessary only once, but it does not really hurt.
333 if (builtin_dispinfo
== NULL
) {
334 builtin_dispinfo
= talloc_zero(NULL
, struct disp_info
);
335 if (builtin_dispinfo
== NULL
) {
339 sid_copy(&builtin_dispinfo
->sid
, &global_sid_Builtin
);
341 return builtin_dispinfo
;
344 if (sid_check_is_domain(psid
) || sid_check_is_in_our_domain(psid
)) {
346 * Necessary only once, but it does not really hurt.
348 if (domain_dispinfo
== NULL
) {
349 domain_dispinfo
= talloc_zero(NULL
, struct disp_info
);
350 if (domain_dispinfo
== NULL
) {
354 sid_copy(&domain_dispinfo
->sid
, get_global_sam_sid());
356 return domain_dispinfo
;
362 /*******************************************************************
363 Function to free the per SID data.
364 ********************************************************************/
366 static void free_samr_cache(DISP_INFO
*disp_info
)
368 DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
369 sid_string_dbg(&disp_info
->sid
)));
371 /* We need to become root here because the paged search might have to
372 * tell the LDAP server we're not interested in the rest anymore. */
376 TALLOC_FREE(disp_info
->users
);
377 TALLOC_FREE(disp_info
->machines
);
378 TALLOC_FREE(disp_info
->groups
);
379 TALLOC_FREE(disp_info
->aliases
);
380 TALLOC_FREE(disp_info
->enum_users
);
385 /*******************************************************************
386 Idle event handler. Throw away the disp info cache.
387 ********************************************************************/
389 static void disp_info_cache_idle_timeout_handler(struct event_context
*ev_ctx
,
390 struct timed_event
*te
,
394 DISP_INFO
*disp_info
= (DISP_INFO
*)private_data
;
396 TALLOC_FREE(disp_info
->cache_timeout_event
);
398 DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
400 free_samr_cache(disp_info
);
403 /*******************************************************************
404 Setup cache removal idle event handler.
405 ********************************************************************/
407 static void set_disp_info_cache_timeout(DISP_INFO
*disp_info
, time_t secs_fromnow
)
409 /* Remove any pending timeout and update. */
411 TALLOC_FREE(disp_info
->cache_timeout_event
);
413 DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
414 "SID %s for %u seconds\n", sid_string_dbg(&disp_info
->sid
),
415 (unsigned int)secs_fromnow
));
417 disp_info
->cache_timeout_event
= event_add_timed(
418 server_event_context(), NULL
,
419 timeval_current_ofs(secs_fromnow
, 0),
420 disp_info_cache_idle_timeout_handler
, (void *)disp_info
);
423 /*******************************************************************
424 Force flush any cache. We do this on any samr_set_xxx call.
425 We must also remove the timeout handler.
426 ********************************************************************/
428 static void force_flush_samr_cache(const struct dom_sid
*sid
)
430 struct disp_info
*disp_info
= get_samr_dispinfo_by_sid(sid
);
432 if ((disp_info
== NULL
) || (disp_info
->cache_timeout_event
== NULL
)) {
436 DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
437 TALLOC_FREE(disp_info
->cache_timeout_event
);
438 free_samr_cache(disp_info
);
441 /*******************************************************************
442 Ensure password info is never given out. Paranioa... JRA.
443 ********************************************************************/
445 static void samr_clear_sam_passwd(struct samu
*sam_pass
)
451 /* These now zero out the old password */
453 pdb_set_lanman_passwd(sam_pass
, NULL
, PDB_DEFAULT
);
454 pdb_set_nt_passwd(sam_pass
, NULL
, PDB_DEFAULT
);
457 static uint32
count_sam_users(struct disp_info
*info
, uint32 acct_flags
)
459 struct samr_displayentry
*entry
;
461 if (sid_check_is_builtin(&info
->sid
)) {
462 /* No users in builtin. */
466 if (info
->users
== NULL
) {
467 info
->users
= pdb_search_users(info
, acct_flags
);
468 if (info
->users
== NULL
) {
472 /* Fetch the last possible entry, thus trigger an enumeration */
473 pdb_search_entries(info
->users
, 0xffffffff, 1, &entry
);
475 /* Ensure we cache this enumeration. */
476 set_disp_info_cache_timeout(info
, DISP_INFO_CACHE_TIMEOUT
);
478 return info
->users
->num_entries
;
481 static uint32
count_sam_groups(struct disp_info
*info
)
483 struct samr_displayentry
*entry
;
485 if (sid_check_is_builtin(&info
->sid
)) {
486 /* No groups in builtin. */
490 if (info
->groups
== NULL
) {
491 info
->groups
= pdb_search_groups(info
);
492 if (info
->groups
== NULL
) {
496 /* Fetch the last possible entry, thus trigger an enumeration */
497 pdb_search_entries(info
->groups
, 0xffffffff, 1, &entry
);
499 /* Ensure we cache this enumeration. */
500 set_disp_info_cache_timeout(info
, DISP_INFO_CACHE_TIMEOUT
);
502 return info
->groups
->num_entries
;
505 static uint32
count_sam_aliases(struct disp_info
*info
)
507 struct samr_displayentry
*entry
;
509 if (info
->aliases
== NULL
) {
510 info
->aliases
= pdb_search_aliases(info
, &info
->sid
);
511 if (info
->aliases
== NULL
) {
515 /* Fetch the last possible entry, thus trigger an enumeration */
516 pdb_search_entries(info
->aliases
, 0xffffffff, 1, &entry
);
518 /* Ensure we cache this enumeration. */
519 set_disp_info_cache_timeout(info
, DISP_INFO_CACHE_TIMEOUT
);
521 return info
->aliases
->num_entries
;
524 /*******************************************************************
526 ********************************************************************/
528 NTSTATUS
_samr_Close(struct pipes_struct
*p
, struct samr_Close
*r
)
530 if (!close_policy_hnd(p
, r
->in
.handle
)) {
531 return NT_STATUS_INVALID_HANDLE
;
534 ZERO_STRUCTP(r
->out
.handle
);
539 /*******************************************************************
541 ********************************************************************/
543 NTSTATUS
_samr_OpenDomain(struct pipes_struct
*p
,
544 struct samr_OpenDomain
*r
)
546 struct samr_connect_info
*cinfo
;
547 struct samr_domain_info
*dinfo
;
548 struct security_descriptor
*psd
= NULL
;
550 uint32 des_access
= r
->in
.access_mask
;
553 uint32_t extra_access
= SAMR_DOMAIN_ACCESS_CREATE_USER
;
555 /* find the connection policy handle. */
557 cinfo
= policy_handle_find(p
, r
->in
.connect_handle
, 0, NULL
,
558 struct samr_connect_info
, &status
);
559 if (!NT_STATUS_IS_OK(status
)) {
563 /*check if access can be granted as requested by client. */
564 map_max_allowed_access(p
->session_info
->security_token
,
565 &p
->session_info
->utok
,
568 make_samr_object_sd( p
->mem_ctx
, &psd
, &sd_size
, &dom_generic_mapping
, NULL
, 0 );
569 se_map_generic( &des_access
, &dom_generic_mapping
);
572 * Users with SeAddUser get the ability to manipulate groups
575 if (security_token_has_privilege(p
->session_info
->security_token
, SEC_PRIV_ADD_USERS
)) {
576 extra_access
|= (SAMR_DOMAIN_ACCESS_CREATE_GROUP
|
577 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
|
578 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
|
579 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
|
580 SAMR_DOMAIN_ACCESS_CREATE_ALIAS
);
584 * Users with SeMachineAccount or SeAddUser get additional
585 * SAMR_DOMAIN_ACCESS_CREATE_USER access.
588 status
= access_check_object( psd
, p
->session_info
->security_token
,
589 SEC_PRIV_MACHINE_ACCOUNT
, SEC_PRIV_ADD_USERS
,
590 extra_access
, des_access
,
591 &acc_granted
, "_samr_OpenDomain" );
593 if ( !NT_STATUS_IS_OK(status
) )
596 if (!sid_check_is_domain(r
->in
.sid
) &&
597 !sid_check_is_builtin(r
->in
.sid
)) {
598 return NT_STATUS_NO_SUCH_DOMAIN
;
601 dinfo
= policy_handle_create(p
, r
->out
.domain_handle
, acc_granted
,
602 struct samr_domain_info
, &status
);
603 if (!NT_STATUS_IS_OK(status
)) {
606 dinfo
->sid
= *r
->in
.sid
;
607 dinfo
->disp_info
= get_samr_dispinfo_by_sid(r
->in
.sid
);
609 DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__
));
614 /*******************************************************************
616 ********************************************************************/
618 NTSTATUS
_samr_GetUserPwInfo(struct pipes_struct
*p
,
619 struct samr_GetUserPwInfo
*r
)
621 struct samr_user_info
*uinfo
;
622 enum lsa_SidType sid_type
;
623 uint32_t min_password_length
= 0;
624 uint32_t password_properties
= 0;
628 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__
));
630 uinfo
= policy_handle_find(p
, r
->in
.user_handle
,
631 SAMR_USER_ACCESS_GET_ATTRIBUTES
, NULL
,
632 struct samr_user_info
, &status
);
633 if (!NT_STATUS_IS_OK(status
)) {
637 if (!sid_check_is_in_our_domain(&uinfo
->sid
)) {
638 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
642 ret
= lookup_sid(p
->mem_ctx
, &uinfo
->sid
, NULL
, NULL
, &sid_type
);
645 return NT_STATUS_NO_SUCH_USER
;
651 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN
,
652 &min_password_length
);
653 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS
,
654 &password_properties
);
657 if (lp_check_password_script() && *lp_check_password_script()) {
658 password_properties
|= DOMAIN_PASSWORD_COMPLEX
;
666 r
->out
.info
->min_password_length
= min_password_length
;
667 r
->out
.info
->password_properties
= password_properties
;
669 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__
));
674 /*******************************************************************
676 ********************************************************************/
678 NTSTATUS
_samr_SetSecurity(struct pipes_struct
*p
,
679 struct samr_SetSecurity
*r
)
681 struct samr_user_info
*uinfo
;
683 struct security_acl
*dacl
;
685 struct samu
*sampass
=NULL
;
688 uinfo
= policy_handle_find(p
, r
->in
.handle
,
689 SAMR_USER_ACCESS_SET_ATTRIBUTES
, NULL
,
690 struct samr_user_info
, &status
);
691 if (!NT_STATUS_IS_OK(status
)) {
695 if (!(sampass
= samu_new( p
->mem_ctx
))) {
696 DEBUG(0,("No memory!\n"));
697 return NT_STATUS_NO_MEMORY
;
700 /* get the user record */
702 ret
= pdb_getsampwsid(sampass
, &uinfo
->sid
);
706 DEBUG(4, ("User %s not found\n",
707 sid_string_dbg(&uinfo
->sid
)));
708 TALLOC_FREE(sampass
);
709 return NT_STATUS_INVALID_HANDLE
;
712 dacl
= r
->in
.sdbuf
->sd
->dacl
;
713 for (i
=0; i
< dacl
->num_aces
; i
++) {
714 if (dom_sid_equal(&uinfo
->sid
, &dacl
->aces
[i
].trustee
)) {
715 ret
= pdb_set_pass_can_change(sampass
,
716 (dacl
->aces
[i
].access_mask
&
717 SAMR_USER_ACCESS_CHANGE_PASSWORD
) ?
724 TALLOC_FREE(sampass
);
725 return NT_STATUS_ACCESS_DENIED
;
729 status
= pdb_update_sam_account(sampass
);
732 TALLOC_FREE(sampass
);
737 /*******************************************************************
738 build correct perms based on policies and password times for _samr_query_sec_obj
739 *******************************************************************/
740 static bool check_change_pw_access(TALLOC_CTX
*mem_ctx
, struct dom_sid
*user_sid
)
742 struct samu
*sampass
=NULL
;
745 if ( !(sampass
= samu_new( mem_ctx
)) ) {
746 DEBUG(0,("No memory!\n"));
751 ret
= pdb_getsampwsid(sampass
, user_sid
);
755 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid
)));
756 TALLOC_FREE(sampass
);
760 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass
) ));
762 if (pdb_get_pass_can_change(sampass
)) {
763 TALLOC_FREE(sampass
);
766 TALLOC_FREE(sampass
);
771 /*******************************************************************
773 ********************************************************************/
775 NTSTATUS
_samr_QuerySecurity(struct pipes_struct
*p
,
776 struct samr_QuerySecurity
*r
)
778 struct samr_connect_info
*cinfo
;
779 struct samr_domain_info
*dinfo
;
780 struct samr_user_info
*uinfo
;
781 struct samr_group_info
*ginfo
;
782 struct samr_alias_info
*ainfo
;
784 struct security_descriptor
* psd
= NULL
;
787 cinfo
= policy_handle_find(p
, r
->in
.handle
,
788 SEC_STD_READ_CONTROL
, NULL
,
789 struct samr_connect_info
, &status
);
790 if (NT_STATUS_IS_OK(status
)) {
791 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
792 status
= make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
,
793 &sam_generic_mapping
, NULL
, 0);
797 dinfo
= policy_handle_find(p
, r
->in
.handle
,
798 SEC_STD_READ_CONTROL
, NULL
,
799 struct samr_domain_info
, &status
);
800 if (NT_STATUS_IS_OK(status
)) {
801 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
802 "with SID: %s\n", sid_string_dbg(&dinfo
->sid
)));
804 * TODO: Builtin probably needs a different SD with restricted
807 status
= make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
,
808 &dom_generic_mapping
, NULL
, 0);
812 uinfo
= policy_handle_find(p
, r
->in
.handle
,
813 SEC_STD_READ_CONTROL
, NULL
,
814 struct samr_user_info
, &status
);
815 if (NT_STATUS_IS_OK(status
)) {
816 DEBUG(10,("_samr_QuerySecurity: querying security on user "
817 "Object with SID: %s\n",
818 sid_string_dbg(&uinfo
->sid
)));
819 if (check_change_pw_access(p
->mem_ctx
, &uinfo
->sid
)) {
820 status
= make_samr_object_sd(
821 p
->mem_ctx
, &psd
, &sd_size
,
822 &usr_generic_mapping
,
823 &uinfo
->sid
, SAMR_USR_RIGHTS_WRITE_PW
);
825 status
= make_samr_object_sd(
826 p
->mem_ctx
, &psd
, &sd_size
,
827 &usr_nopwchange_generic_mapping
,
828 &uinfo
->sid
, SAMR_USR_RIGHTS_CANT_WRITE_PW
);
833 ginfo
= policy_handle_find(p
, r
->in
.handle
,
834 SEC_STD_READ_CONTROL
, NULL
,
835 struct samr_group_info
, &status
);
836 if (NT_STATUS_IS_OK(status
)) {
838 * TODO: different SDs have to be generated for aliases groups
839 * and users. Currently all three get a default user SD
841 DEBUG(10,("_samr_QuerySecurity: querying security on group "
842 "Object with SID: %s\n",
843 sid_string_dbg(&ginfo
->sid
)));
844 status
= make_samr_object_sd(
845 p
->mem_ctx
, &psd
, &sd_size
,
846 &usr_nopwchange_generic_mapping
,
847 &ginfo
->sid
, SAMR_USR_RIGHTS_CANT_WRITE_PW
);
851 ainfo
= policy_handle_find(p
, r
->in
.handle
,
852 SEC_STD_READ_CONTROL
, NULL
,
853 struct samr_alias_info
, &status
);
854 if (NT_STATUS_IS_OK(status
)) {
856 * TODO: different SDs have to be generated for aliases groups
857 * and users. Currently all three get a default user SD
859 DEBUG(10,("_samr_QuerySecurity: querying security on alias "
860 "Object with SID: %s\n",
861 sid_string_dbg(&ainfo
->sid
)));
862 status
= make_samr_object_sd(
863 p
->mem_ctx
, &psd
, &sd_size
,
864 &usr_nopwchange_generic_mapping
,
865 &ainfo
->sid
, SAMR_USR_RIGHTS_CANT_WRITE_PW
);
869 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
871 if ((*r
->out
.sdbuf
= make_sec_desc_buf(p
->mem_ctx
, sd_size
, psd
)) == NULL
)
872 return NT_STATUS_NO_MEMORY
;
877 /*******************************************************************
878 makes a SAM_ENTRY / UNISTR2* structure from a user list.
879 ********************************************************************/
881 static NTSTATUS
make_user_sam_entry_list(TALLOC_CTX
*ctx
,
882 struct samr_SamEntry
**sam_pp
,
883 uint32_t num_entries
,
885 struct samr_displayentry
*entries
)
888 struct samr_SamEntry
*sam
;
892 if (num_entries
== 0) {
896 sam
= TALLOC_ZERO_ARRAY(ctx
, struct samr_SamEntry
, num_entries
);
898 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
899 return NT_STATUS_NO_MEMORY
;
902 for (i
= 0; i
< num_entries
; i
++) {
905 * usrmgr expects a non-NULL terminated string with
906 * trust relationships
908 if (entries
[i
].acct_flags
& ACB_DOMTRUST
) {
909 init_unistr2(&uni_temp_name
, entries
[i
].account_name
,
912 init_unistr2(&uni_temp_name
, entries
[i
].account_name
,
916 init_lsa_String(&sam
[i
].name
, entries
[i
].account_name
);
917 sam
[i
].idx
= entries
[i
].rid
;
925 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
927 /*******************************************************************
928 _samr_EnumDomainUsers
929 ********************************************************************/
931 NTSTATUS
_samr_EnumDomainUsers(struct pipes_struct
*p
,
932 struct samr_EnumDomainUsers
*r
)
935 struct samr_domain_info
*dinfo
;
937 uint32 enum_context
= *r
->in
.resume_handle
;
938 enum remote_arch_types ra_type
= get_remote_arch();
939 int max_sam_entries
= (ra_type
== RA_WIN95
) ? MAX_SAM_ENTRIES_W95
: MAX_SAM_ENTRIES_W2K
;
940 uint32 max_entries
= max_sam_entries
;
941 struct samr_displayentry
*entries
= NULL
;
942 struct samr_SamArray
*samr_array
= NULL
;
943 struct samr_SamEntry
*samr_entries
= NULL
;
945 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__
));
947 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
948 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
, NULL
,
949 struct samr_domain_info
, &status
);
950 if (!NT_STATUS_IS_OK(status
)) {
954 samr_array
= TALLOC_ZERO_P(p
->mem_ctx
, struct samr_SamArray
);
956 return NT_STATUS_NO_MEMORY
;
958 *r
->out
.sam
= samr_array
;
960 if (sid_check_is_builtin(&dinfo
->sid
)) {
961 /* No users in builtin. */
962 *r
->out
.resume_handle
= *r
->in
.resume_handle
;
963 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
971 if ((dinfo
->disp_info
->enum_users
!= NULL
) &&
972 (dinfo
->disp_info
->enum_acb_mask
!= r
->in
.acct_flags
)) {
973 TALLOC_FREE(dinfo
->disp_info
->enum_users
);
976 if (dinfo
->disp_info
->enum_users
== NULL
) {
977 dinfo
->disp_info
->enum_users
= pdb_search_users(
978 dinfo
->disp_info
, r
->in
.acct_flags
);
979 dinfo
->disp_info
->enum_acb_mask
= r
->in
.acct_flags
;
982 if (dinfo
->disp_info
->enum_users
== NULL
) {
983 /* END AS ROOT !!!! */
985 return NT_STATUS_ACCESS_DENIED
;
988 num_account
= pdb_search_entries(dinfo
->disp_info
->enum_users
,
989 enum_context
, max_entries
,
992 /* END AS ROOT !!!! */
996 if (num_account
== 0) {
997 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
999 *r
->out
.resume_handle
= *r
->in
.resume_handle
;
1000 return NT_STATUS_OK
;
1003 status
= make_user_sam_entry_list(p
->mem_ctx
, &samr_entries
,
1004 num_account
, enum_context
,
1006 if (!NT_STATUS_IS_OK(status
)) {
1010 if (max_entries
<= num_account
) {
1011 status
= STATUS_MORE_ENTRIES
;
1013 status
= NT_STATUS_OK
;
1016 /* Ensure we cache this enumeration. */
1017 set_disp_info_cache_timeout(dinfo
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
1019 DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__
));
1021 samr_array
->count
= num_account
;
1022 samr_array
->entries
= samr_entries
;
1024 *r
->out
.resume_handle
= *r
->in
.resume_handle
+ num_account
;
1025 *r
->out
.num_entries
= num_account
;
1027 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__
));
1032 /*******************************************************************
1033 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1034 ********************************************************************/
1036 static void make_group_sam_entry_list(TALLOC_CTX
*ctx
,
1037 struct samr_SamEntry
**sam_pp
,
1038 uint32_t num_sam_entries
,
1039 struct samr_displayentry
*entries
)
1041 struct samr_SamEntry
*sam
;
1046 if (num_sam_entries
== 0) {
1050 sam
= TALLOC_ZERO_ARRAY(ctx
, struct samr_SamEntry
, num_sam_entries
);
1055 for (i
= 0; i
< num_sam_entries
; i
++) {
1057 * JRA. I think this should include the null. TNG does not.
1059 init_lsa_String(&sam
[i
].name
, entries
[i
].account_name
);
1060 sam
[i
].idx
= entries
[i
].rid
;
1066 /*******************************************************************
1067 _samr_EnumDomainGroups
1068 ********************************************************************/
1070 NTSTATUS
_samr_EnumDomainGroups(struct pipes_struct
*p
,
1071 struct samr_EnumDomainGroups
*r
)
1074 struct samr_domain_info
*dinfo
;
1075 struct samr_displayentry
*groups
;
1077 struct samr_SamArray
*samr_array
= NULL
;
1078 struct samr_SamEntry
*samr_entries
= NULL
;
1080 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
1081 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
, NULL
,
1082 struct samr_domain_info
, &status
);
1083 if (!NT_STATUS_IS_OK(status
)) {
1087 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__
));
1089 samr_array
= TALLOC_ZERO_P(p
->mem_ctx
, struct samr_SamArray
);
1091 return NT_STATUS_NO_MEMORY
;
1093 *r
->out
.sam
= samr_array
;
1095 if (sid_check_is_builtin(&dinfo
->sid
)) {
1096 /* No groups in builtin. */
1097 *r
->out
.resume_handle
= *r
->in
.resume_handle
;
1098 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
1102 /* the domain group array is being allocated in the function below */
1106 if (dinfo
->disp_info
->groups
== NULL
) {
1107 dinfo
->disp_info
->groups
= pdb_search_groups(dinfo
->disp_info
);
1109 if (dinfo
->disp_info
->groups
== NULL
) {
1111 return NT_STATUS_ACCESS_DENIED
;
1115 num_groups
= pdb_search_entries(dinfo
->disp_info
->groups
,
1116 *r
->in
.resume_handle
,
1117 MAX_SAM_ENTRIES
, &groups
);
1120 /* Ensure we cache this enumeration. */
1121 set_disp_info_cache_timeout(dinfo
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
1123 make_group_sam_entry_list(p
->mem_ctx
, &samr_entries
,
1124 num_groups
, groups
);
1126 if (MAX_SAM_ENTRIES
<= num_groups
) {
1127 status
= STATUS_MORE_ENTRIES
;
1129 status
= NT_STATUS_OK
;
1132 samr_array
->count
= num_groups
;
1133 samr_array
->entries
= samr_entries
;
1135 *r
->out
.num_entries
= num_groups
;
1136 *r
->out
.resume_handle
= num_groups
+ *r
->in
.resume_handle
;
1138 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__
));
1143 /*******************************************************************
1144 _samr_EnumDomainAliases
1145 ********************************************************************/
1147 NTSTATUS
_samr_EnumDomainAliases(struct pipes_struct
*p
,
1148 struct samr_EnumDomainAliases
*r
)
1151 struct samr_domain_info
*dinfo
;
1152 struct samr_displayentry
*aliases
;
1153 uint32 num_aliases
= 0;
1154 struct samr_SamArray
*samr_array
= NULL
;
1155 struct samr_SamEntry
*samr_entries
= NULL
;
1157 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
1158 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
, NULL
,
1159 struct samr_domain_info
, &status
);
1160 if (!NT_STATUS_IS_OK(status
)) {
1164 DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1165 sid_string_dbg(&dinfo
->sid
)));
1167 samr_array
= TALLOC_ZERO_P(p
->mem_ctx
, struct samr_SamArray
);
1169 return NT_STATUS_NO_MEMORY
;
1174 if (dinfo
->disp_info
->aliases
== NULL
) {
1175 dinfo
->disp_info
->aliases
= pdb_search_aliases(
1176 dinfo
->disp_info
, &dinfo
->sid
);
1177 if (dinfo
->disp_info
->aliases
== NULL
) {
1179 return NT_STATUS_ACCESS_DENIED
;
1183 num_aliases
= pdb_search_entries(dinfo
->disp_info
->aliases
,
1184 *r
->in
.resume_handle
,
1185 MAX_SAM_ENTRIES
, &aliases
);
1188 /* Ensure we cache this enumeration. */
1189 set_disp_info_cache_timeout(dinfo
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
1191 make_group_sam_entry_list(p
->mem_ctx
, &samr_entries
,
1192 num_aliases
, aliases
);
1194 DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__
));
1196 if (MAX_SAM_ENTRIES
<= num_aliases
) {
1197 status
= STATUS_MORE_ENTRIES
;
1199 status
= NT_STATUS_OK
;
1202 samr_array
->count
= num_aliases
;
1203 samr_array
->entries
= samr_entries
;
1205 *r
->out
.sam
= samr_array
;
1206 *r
->out
.num_entries
= num_aliases
;
1207 *r
->out
.resume_handle
= num_aliases
+ *r
->in
.resume_handle
;
1212 /*******************************************************************
1213 inits a samr_DispInfoGeneral structure.
1214 ********************************************************************/
1216 static NTSTATUS
init_samr_dispinfo_1(TALLOC_CTX
*ctx
,
1217 struct samr_DispInfoGeneral
*r
,
1218 uint32_t num_entries
,
1220 struct samr_displayentry
*entries
)
1224 DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries
));
1226 if (num_entries
== 0) {
1227 return NT_STATUS_OK
;
1230 r
->count
= num_entries
;
1232 r
->entries
= TALLOC_ZERO_ARRAY(ctx
, struct samr_DispEntryGeneral
, num_entries
);
1234 return NT_STATUS_NO_MEMORY
;
1237 for (i
= 0; i
< num_entries
; i
++) {
1239 init_lsa_String(&r
->entries
[i
].account_name
,
1240 entries
[i
].account_name
);
1242 init_lsa_String(&r
->entries
[i
].description
,
1243 entries
[i
].description
);
1245 init_lsa_String(&r
->entries
[i
].full_name
,
1246 entries
[i
].fullname
);
1248 r
->entries
[i
].rid
= entries
[i
].rid
;
1249 r
->entries
[i
].acct_flags
= entries
[i
].acct_flags
;
1250 r
->entries
[i
].idx
= start_idx
+i
+1;
1253 return NT_STATUS_OK
;
1256 /*******************************************************************
1257 inits a samr_DispInfoFull structure.
1258 ********************************************************************/
1260 static NTSTATUS
init_samr_dispinfo_2(TALLOC_CTX
*ctx
,
1261 struct samr_DispInfoFull
*r
,
1262 uint32_t num_entries
,
1264 struct samr_displayentry
*entries
)
1268 DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries
));
1270 if (num_entries
== 0) {
1271 return NT_STATUS_OK
;
1274 r
->count
= num_entries
;
1276 r
->entries
= TALLOC_ZERO_ARRAY(ctx
, struct samr_DispEntryFull
, num_entries
);
1278 return NT_STATUS_NO_MEMORY
;
1281 for (i
= 0; i
< num_entries
; i
++) {
1283 init_lsa_String(&r
->entries
[i
].account_name
,
1284 entries
[i
].account_name
);
1286 init_lsa_String(&r
->entries
[i
].description
,
1287 entries
[i
].description
);
1289 r
->entries
[i
].rid
= entries
[i
].rid
;
1290 r
->entries
[i
].acct_flags
= entries
[i
].acct_flags
;
1291 r
->entries
[i
].idx
= start_idx
+i
+1;
1294 return NT_STATUS_OK
;
1297 /*******************************************************************
1298 inits a samr_DispInfoFullGroups structure.
1299 ********************************************************************/
1301 static NTSTATUS
init_samr_dispinfo_3(TALLOC_CTX
*ctx
,
1302 struct samr_DispInfoFullGroups
*r
,
1303 uint32_t num_entries
,
1305 struct samr_displayentry
*entries
)
1309 DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries
));
1311 if (num_entries
== 0) {
1312 return NT_STATUS_OK
;
1315 r
->count
= num_entries
;
1317 r
->entries
= TALLOC_ZERO_ARRAY(ctx
, struct samr_DispEntryFullGroup
, num_entries
);
1319 return NT_STATUS_NO_MEMORY
;
1322 for (i
= 0; i
< num_entries
; i
++) {
1324 init_lsa_String(&r
->entries
[i
].account_name
,
1325 entries
[i
].account_name
);
1327 init_lsa_String(&r
->entries
[i
].description
,
1328 entries
[i
].description
);
1330 r
->entries
[i
].rid
= entries
[i
].rid
;
1331 r
->entries
[i
].acct_flags
= entries
[i
].acct_flags
;
1332 r
->entries
[i
].idx
= start_idx
+i
+1;
1335 return NT_STATUS_OK
;
1338 /*******************************************************************
1339 inits a samr_DispInfoAscii structure.
1340 ********************************************************************/
1342 static NTSTATUS
init_samr_dispinfo_4(TALLOC_CTX
*ctx
,
1343 struct samr_DispInfoAscii
*r
,
1344 uint32_t num_entries
,
1346 struct samr_displayentry
*entries
)
1350 DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries
));
1352 if (num_entries
== 0) {
1353 return NT_STATUS_OK
;
1356 r
->count
= num_entries
;
1358 r
->entries
= TALLOC_ZERO_ARRAY(ctx
, struct samr_DispEntryAscii
, num_entries
);
1360 return NT_STATUS_NO_MEMORY
;
1363 for (i
= 0; i
< num_entries
; i
++) {
1365 init_lsa_AsciiStringLarge(&r
->entries
[i
].account_name
,
1366 entries
[i
].account_name
);
1368 r
->entries
[i
].idx
= start_idx
+i
+1;
1371 return NT_STATUS_OK
;
1374 /*******************************************************************
1375 inits a samr_DispInfoAscii structure.
1376 ********************************************************************/
1378 static NTSTATUS
init_samr_dispinfo_5(TALLOC_CTX
*ctx
,
1379 struct samr_DispInfoAscii
*r
,
1380 uint32_t num_entries
,
1382 struct samr_displayentry
*entries
)
1386 DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries
));
1388 if (num_entries
== 0) {
1389 return NT_STATUS_OK
;
1392 r
->count
= num_entries
;
1394 r
->entries
= TALLOC_ZERO_ARRAY(ctx
, struct samr_DispEntryAscii
, num_entries
);
1396 return NT_STATUS_NO_MEMORY
;
1399 for (i
= 0; i
< num_entries
; i
++) {
1401 init_lsa_AsciiStringLarge(&r
->entries
[i
].account_name
,
1402 entries
[i
].account_name
);
1404 r
->entries
[i
].idx
= start_idx
+i
+1;
1407 return NT_STATUS_OK
;
1410 /*******************************************************************
1411 _samr_QueryDisplayInfo
1412 ********************************************************************/
1414 NTSTATUS
_samr_QueryDisplayInfo(struct pipes_struct
*p
,
1415 struct samr_QueryDisplayInfo
*r
)
1418 struct samr_domain_info
*dinfo
;
1419 uint32 struct_size
=0x20; /* W2K always reply that, client doesn't care */
1421 uint32 max_entries
= r
->in
.max_entries
;
1423 union samr_DispInfo
*disp_info
= r
->out
.info
;
1426 NTSTATUS disp_ret
= NT_STATUS_UNSUCCESSFUL
;
1427 uint32 num_account
= 0;
1428 enum remote_arch_types ra_type
= get_remote_arch();
1429 int max_sam_entries
= (ra_type
== RA_WIN95
) ? MAX_SAM_ENTRIES_W95
: MAX_SAM_ENTRIES_W2K
;
1430 struct samr_displayentry
*entries
= NULL
;
1432 DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__
));
1434 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
1435 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
, NULL
,
1436 struct samr_domain_info
, &status
);
1437 if (!NT_STATUS_IS_OK(status
)) {
1441 if (sid_check_is_builtin(&dinfo
->sid
)) {
1442 DEBUG(5,("_samr_QueryDisplayInfo: no users in BUILTIN\n"));
1443 return NT_STATUS_OK
;
1447 * calculate how many entries we will return.
1449 * - the number of entries the client asked
1450 * - our limit on that
1451 * - the starting point (enumeration context)
1452 * - the buffer size the client will accept
1456 * We are a lot more like W2K. Instead of reading the SAM
1457 * each time to find the records we need to send back,
1458 * we read it once and link that copy to the sam handle.
1459 * For large user list (over the MAX_SAM_ENTRIES)
1460 * it's a definitive win.
1461 * second point to notice: between enumerations
1462 * our sam is now the same as it's a snapshoot.
1463 * third point: got rid of the static SAM_USER_21 struct
1464 * no more intermediate.
1465 * con: it uses much more memory, as a full copy is stored
1468 * If you want to change it, think twice and think
1469 * of the second point , that's really important.
1474 if ((r
->in
.level
< 1) || (r
->in
.level
> 5)) {
1475 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1476 (unsigned int)r
->in
.level
));
1477 return NT_STATUS_INVALID_INFO_CLASS
;
1480 /* first limit the number of entries we will return */
1481 if (r
->in
.max_entries
> max_sam_entries
) {
1482 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1483 "entries, limiting to %d\n", r
->in
.max_entries
,
1485 max_entries
= max_sam_entries
;
1488 /* calculate the size and limit on the number of entries we will
1491 temp_size
=max_entries
*struct_size
;
1493 if (temp_size
> r
->in
.buf_size
) {
1494 max_entries
= MIN((r
->in
.buf_size
/ struct_size
),max_entries
);
1495 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1496 "only %d entries\n", max_entries
));
1501 /* THe following done as ROOT. Don't return without unbecome_root(). */
1503 switch (r
->in
.level
) {
1506 if (dinfo
->disp_info
->users
== NULL
) {
1507 dinfo
->disp_info
->users
= pdb_search_users(
1508 dinfo
->disp_info
, ACB_NORMAL
);
1509 if (dinfo
->disp_info
->users
== NULL
) {
1511 return NT_STATUS_ACCESS_DENIED
;
1513 DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1514 (unsigned int)r
->in
.start_idx
));
1516 DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1517 (unsigned int)r
->in
.start_idx
));
1520 num_account
= pdb_search_entries(dinfo
->disp_info
->users
,
1521 r
->in
.start_idx
, max_entries
,
1525 if (dinfo
->disp_info
->machines
== NULL
) {
1526 dinfo
->disp_info
->machines
= pdb_search_users(
1527 dinfo
->disp_info
, ACB_WSTRUST
|ACB_SVRTRUST
);
1528 if (dinfo
->disp_info
->machines
== NULL
) {
1530 return NT_STATUS_ACCESS_DENIED
;
1532 DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1533 (unsigned int)r
->in
.start_idx
));
1535 DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1536 (unsigned int)r
->in
.start_idx
));
1539 num_account
= pdb_search_entries(dinfo
->disp_info
->machines
,
1540 r
->in
.start_idx
, max_entries
,
1545 if (dinfo
->disp_info
->groups
== NULL
) {
1546 dinfo
->disp_info
->groups
= pdb_search_groups(
1548 if (dinfo
->disp_info
->groups
== NULL
) {
1550 return NT_STATUS_ACCESS_DENIED
;
1552 DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1553 (unsigned int)r
->in
.start_idx
));
1555 DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1556 (unsigned int)r
->in
.start_idx
));
1559 num_account
= pdb_search_entries(dinfo
->disp_info
->groups
,
1560 r
->in
.start_idx
, max_entries
,
1565 smb_panic("info class changed");
1571 /* Now create reply structure */
1572 switch (r
->in
.level
) {
1574 disp_ret
= init_samr_dispinfo_1(p
->mem_ctx
, &disp_info
->info1
,
1575 num_account
, r
->in
.start_idx
,
1579 disp_ret
= init_samr_dispinfo_2(p
->mem_ctx
, &disp_info
->info2
,
1580 num_account
, r
->in
.start_idx
,
1584 disp_ret
= init_samr_dispinfo_3(p
->mem_ctx
, &disp_info
->info3
,
1585 num_account
, r
->in
.start_idx
,
1589 disp_ret
= init_samr_dispinfo_4(p
->mem_ctx
, &disp_info
->info4
,
1590 num_account
, r
->in
.start_idx
,
1594 disp_ret
= init_samr_dispinfo_5(p
->mem_ctx
, &disp_info
->info5
,
1595 num_account
, r
->in
.start_idx
,
1599 smb_panic("info class changed");
1603 if (!NT_STATUS_IS_OK(disp_ret
))
1606 if (max_entries
<= num_account
) {
1607 status
= STATUS_MORE_ENTRIES
;
1609 status
= NT_STATUS_OK
;
1612 /* Ensure we cache this enumeration. */
1613 set_disp_info_cache_timeout(dinfo
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
1615 DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__
));
1617 *r
->out
.total_size
= num_account
* struct_size
;
1618 *r
->out
.returned_size
= num_account
? temp_size
: 0;
1623 /****************************************************************
1624 _samr_QueryDisplayInfo2
1625 ****************************************************************/
1627 NTSTATUS
_samr_QueryDisplayInfo2(struct pipes_struct
*p
,
1628 struct samr_QueryDisplayInfo2
*r
)
1630 struct samr_QueryDisplayInfo q
;
1632 q
.in
.domain_handle
= r
->in
.domain_handle
;
1633 q
.in
.level
= r
->in
.level
;
1634 q
.in
.start_idx
= r
->in
.start_idx
;
1635 q
.in
.max_entries
= r
->in
.max_entries
;
1636 q
.in
.buf_size
= r
->in
.buf_size
;
1638 q
.out
.total_size
= r
->out
.total_size
;
1639 q
.out
.returned_size
= r
->out
.returned_size
;
1640 q
.out
.info
= r
->out
.info
;
1642 return _samr_QueryDisplayInfo(p
, &q
);
1645 /****************************************************************
1646 _samr_QueryDisplayInfo3
1647 ****************************************************************/
1649 NTSTATUS
_samr_QueryDisplayInfo3(struct pipes_struct
*p
,
1650 struct samr_QueryDisplayInfo3
*r
)
1652 struct samr_QueryDisplayInfo q
;
1654 q
.in
.domain_handle
= r
->in
.domain_handle
;
1655 q
.in
.level
= r
->in
.level
;
1656 q
.in
.start_idx
= r
->in
.start_idx
;
1657 q
.in
.max_entries
= r
->in
.max_entries
;
1658 q
.in
.buf_size
= r
->in
.buf_size
;
1660 q
.out
.total_size
= r
->out
.total_size
;
1661 q
.out
.returned_size
= r
->out
.returned_size
;
1662 q
.out
.info
= r
->out
.info
;
1664 return _samr_QueryDisplayInfo(p
, &q
);
1667 /*******************************************************************
1668 _samr_QueryAliasInfo
1669 ********************************************************************/
1671 NTSTATUS
_samr_QueryAliasInfo(struct pipes_struct
*p
,
1672 struct samr_QueryAliasInfo
*r
)
1674 struct samr_alias_info
*ainfo
;
1675 struct acct_info info
;
1677 union samr_AliasInfo
*alias_info
= NULL
;
1678 const char *alias_name
= NULL
;
1679 const char *alias_description
= NULL
;
1681 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__
));
1683 ainfo
= policy_handle_find(p
, r
->in
.alias_handle
,
1684 SAMR_ALIAS_ACCESS_LOOKUP_INFO
, NULL
,
1685 struct samr_alias_info
, &status
);
1686 if (!NT_STATUS_IS_OK(status
)) {
1690 alias_info
= TALLOC_ZERO_P(p
->mem_ctx
, union samr_AliasInfo
);
1692 return NT_STATUS_NO_MEMORY
;
1696 status
= pdb_get_aliasinfo(&ainfo
->sid
, &info
);
1699 if ( !NT_STATUS_IS_OK(status
))
1702 /* FIXME: info contains fstrings */
1703 alias_name
= talloc_strdup(r
, info
.acct_name
);
1704 alias_description
= talloc_strdup(r
, info
.acct_desc
);
1706 switch (r
->in
.level
) {
1708 alias_info
->all
.name
.string
= alias_name
;
1709 alias_info
->all
.num_members
= 1; /* ??? */
1710 alias_info
->all
.description
.string
= alias_description
;
1713 alias_info
->name
.string
= alias_name
;
1715 case ALIASINFODESCRIPTION
:
1716 alias_info
->description
.string
= alias_description
;
1719 return NT_STATUS_INVALID_INFO_CLASS
;
1722 *r
->out
.info
= alias_info
;
1724 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__
));
1726 return NT_STATUS_OK
;
1729 /*******************************************************************
1731 ********************************************************************/
1733 NTSTATUS
_samr_LookupNames(struct pipes_struct
*p
,
1734 struct samr_LookupNames
*r
)
1736 struct samr_domain_info
*dinfo
;
1739 enum lsa_SidType
*type
;
1741 int num_rids
= r
->in
.num_names
;
1742 struct samr_Ids rids
, types
;
1743 uint32_t num_mapped
= 0;
1745 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__
));
1747 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
1748 0 /* Don't know the acc_bits yet */, NULL
,
1749 struct samr_domain_info
, &status
);
1750 if (!NT_STATUS_IS_OK(status
)) {
1754 if (num_rids
> MAX_SAM_ENTRIES
) {
1755 num_rids
= MAX_SAM_ENTRIES
;
1756 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids
));
1759 rid
= talloc_array(p
->mem_ctx
, uint32
, num_rids
);
1760 NT_STATUS_HAVE_NO_MEMORY(rid
);
1762 type
= talloc_array(p
->mem_ctx
, enum lsa_SidType
, num_rids
);
1763 NT_STATUS_HAVE_NO_MEMORY(type
);
1765 DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1766 sid_string_dbg(&dinfo
->sid
)));
1768 for (i
= 0; i
< num_rids
; i
++) {
1770 status
= NT_STATUS_NONE_MAPPED
;
1771 type
[i
] = SID_NAME_UNKNOWN
;
1773 rid
[i
] = 0xffffffff;
1775 if (sid_check_is_builtin(&dinfo
->sid
)) {
1776 if (lookup_builtin_name(r
->in
.names
[i
].string
,
1779 type
[i
] = SID_NAME_ALIAS
;
1782 lookup_global_sam_name(r
->in
.names
[i
].string
, 0,
1786 if (type
[i
] != SID_NAME_UNKNOWN
) {
1791 if (num_mapped
== num_rids
) {
1792 status
= NT_STATUS_OK
;
1793 } else if (num_mapped
== 0) {
1794 status
= NT_STATUS_NONE_MAPPED
;
1796 status
= STATUS_SOME_UNMAPPED
;
1799 rids
.count
= num_rids
;
1802 types
.count
= num_rids
;
1803 types
.ids
= talloc_array(p
->mem_ctx
, uint32_t, num_rids
);
1804 NT_STATUS_HAVE_NO_MEMORY(type
);
1805 for (i
= 0; i
< num_rids
; i
++) {
1806 types
.ids
[i
] = (type
[i
] & 0xffffffff);
1809 *r
->out
.rids
= rids
;
1810 *r
->out
.types
= types
;
1812 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__
));
1817 /****************************************************************
1818 _samr_ChangePasswordUser
1819 ****************************************************************/
1821 NTSTATUS
_samr_ChangePasswordUser(struct pipes_struct
*p
,
1822 struct samr_ChangePasswordUser
*r
)
1826 struct samr_user_info
*uinfo
;
1828 struct samr_Password new_lmPwdHash
, new_ntPwdHash
, checkHash
;
1829 struct samr_Password lm_pwd
, nt_pwd
;
1831 uinfo
= policy_handle_find(p
, r
->in
.user_handle
,
1832 SAMR_USER_ACCESS_SET_PASSWORD
, NULL
,
1833 struct samr_user_info
, &status
);
1834 if (!NT_STATUS_IS_OK(status
)) {
1838 DEBUG(5,("_samr_ChangePasswordUser: sid:%s\n",
1839 sid_string_dbg(&uinfo
->sid
)));
1841 if (!(pwd
= samu_new(NULL
))) {
1842 return NT_STATUS_NO_MEMORY
;
1846 ret
= pdb_getsampwsid(pwd
, &uinfo
->sid
);
1851 return NT_STATUS_WRONG_PASSWORD
;
1855 const uint8_t *lm_pass
, *nt_pass
;
1857 lm_pass
= pdb_get_lanman_passwd(pwd
);
1858 nt_pass
= pdb_get_nt_passwd(pwd
);
1860 if (!lm_pass
|| !nt_pass
) {
1861 status
= NT_STATUS_WRONG_PASSWORD
;
1865 memcpy(&lm_pwd
.hash
, lm_pass
, sizeof(lm_pwd
.hash
));
1866 memcpy(&nt_pwd
.hash
, nt_pass
, sizeof(nt_pwd
.hash
));
1869 /* basic sanity checking on parameters. Do this before any database ops */
1870 if (!r
->in
.lm_present
|| !r
->in
.nt_present
||
1871 !r
->in
.old_lm_crypted
|| !r
->in
.new_lm_crypted
||
1872 !r
->in
.old_nt_crypted
|| !r
->in
.new_nt_crypted
) {
1873 /* we should really handle a change with lm not
1875 status
= NT_STATUS_INVALID_PARAMETER_MIX
;
1879 /* decrypt and check the new lm hash */
1880 D_P16(lm_pwd
.hash
, r
->in
.new_lm_crypted
->hash
, new_lmPwdHash
.hash
);
1881 D_P16(new_lmPwdHash
.hash
, r
->in
.old_lm_crypted
->hash
, checkHash
.hash
);
1882 if (memcmp(checkHash
.hash
, lm_pwd
.hash
, 16) != 0) {
1883 status
= NT_STATUS_WRONG_PASSWORD
;
1887 /* decrypt and check the new nt hash */
1888 D_P16(nt_pwd
.hash
, r
->in
.new_nt_crypted
->hash
, new_ntPwdHash
.hash
);
1889 D_P16(new_ntPwdHash
.hash
, r
->in
.old_nt_crypted
->hash
, checkHash
.hash
);
1890 if (memcmp(checkHash
.hash
, nt_pwd
.hash
, 16) != 0) {
1891 status
= NT_STATUS_WRONG_PASSWORD
;
1895 /* The NT Cross is not required by Win2k3 R2, but if present
1896 check the nt cross hash */
1897 if (r
->in
.cross1_present
&& r
->in
.nt_cross
) {
1898 D_P16(lm_pwd
.hash
, r
->in
.nt_cross
->hash
, checkHash
.hash
);
1899 if (memcmp(checkHash
.hash
, new_ntPwdHash
.hash
, 16) != 0) {
1900 status
= NT_STATUS_WRONG_PASSWORD
;
1905 /* The LM Cross is not required by Win2k3 R2, but if present
1906 check the lm cross hash */
1907 if (r
->in
.cross2_present
&& r
->in
.lm_cross
) {
1908 D_P16(nt_pwd
.hash
, r
->in
.lm_cross
->hash
, checkHash
.hash
);
1909 if (memcmp(checkHash
.hash
, new_lmPwdHash
.hash
, 16) != 0) {
1910 status
= NT_STATUS_WRONG_PASSWORD
;
1915 if (!pdb_set_nt_passwd(pwd
, new_ntPwdHash
.hash
, PDB_CHANGED
) ||
1916 !pdb_set_lanman_passwd(pwd
, new_lmPwdHash
.hash
, PDB_CHANGED
)) {
1917 status
= NT_STATUS_ACCESS_DENIED
;
1921 status
= pdb_update_sam_account(pwd
);
1928 /*******************************************************************
1929 _samr_ChangePasswordUser2
1930 ********************************************************************/
1932 NTSTATUS
_samr_ChangePasswordUser2(struct pipes_struct
*p
,
1933 struct samr_ChangePasswordUser2
*r
)
1936 char *user_name
= NULL
;
1939 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__
));
1941 if (!r
->in
.account
->string
) {
1942 return NT_STATUS_INVALID_PARAMETER
;
1944 fstrcpy(wks
, r
->in
.server
->string
);
1946 DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name
, wks
));
1949 * Pass the user through the NT -> unix user mapping
1953 (void)map_username(talloc_tos(), r
->in
.account
->string
, &user_name
);
1955 return NT_STATUS_NO_MEMORY
;
1959 * UNIX username case mangling not required, pass_oem_change
1960 * is case insensitive.
1963 status
= pass_oem_change(user_name
,
1965 r
->in
.lm_password
->data
,
1966 r
->in
.lm_verifier
->hash
,
1967 r
->in
.nt_password
->data
,
1968 r
->in
.nt_verifier
->hash
,
1971 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__
));
1973 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)) {
1974 return NT_STATUS_WRONG_PASSWORD
;
1980 /****************************************************************
1981 _samr_OemChangePasswordUser2
1982 ****************************************************************/
1984 NTSTATUS
_samr_OemChangePasswordUser2(struct pipes_struct
*p
,
1985 struct samr_OemChangePasswordUser2
*r
)
1988 char *user_name
= NULL
;
1989 const char *wks
= NULL
;
1991 DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__
));
1993 if (!r
->in
.account
->string
) {
1994 return NT_STATUS_INVALID_PARAMETER
;
1996 if (r
->in
.server
&& r
->in
.server
->string
) {
1997 wks
= r
->in
.server
->string
;
2000 DEBUG(5,("_samr_OemChangePasswordUser2: user: %s wks: %s\n", user_name
, wks
));
2003 * Pass the user through the NT -> unix user mapping
2007 (void)map_username(talloc_tos(), r
->in
.account
->string
, &user_name
);
2009 return NT_STATUS_NO_MEMORY
;
2013 * UNIX username case mangling not required, pass_oem_change
2014 * is case insensitive.
2017 if (!r
->in
.hash
|| !r
->in
.password
) {
2018 return NT_STATUS_INVALID_PARAMETER
;
2021 status
= pass_oem_change(user_name
,
2023 r
->in
.password
->data
,
2029 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)) {
2030 return NT_STATUS_WRONG_PASSWORD
;
2033 DEBUG(5,("_samr_OemChangePasswordUser2: %d\n", __LINE__
));
2038 /*******************************************************************
2039 _samr_ChangePasswordUser3
2040 ********************************************************************/
2042 NTSTATUS
_samr_ChangePasswordUser3(struct pipes_struct
*p
,
2043 struct samr_ChangePasswordUser3
*r
)
2046 char *user_name
= NULL
;
2047 const char *wks
= NULL
;
2048 enum samPwdChangeReason reject_reason
;
2049 struct samr_DomInfo1
*dominfo
= NULL
;
2050 struct userPwdChangeFailureInformation
*reject
= NULL
;
2053 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__
));
2055 if (!r
->in
.account
->string
) {
2056 return NT_STATUS_INVALID_PARAMETER
;
2058 if (r
->in
.server
&& r
->in
.server
->string
) {
2059 wks
= r
->in
.server
->string
;
2062 DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name
, wks
));
2065 * Pass the user through the NT -> unix user mapping
2069 (void)map_username(talloc_tos(), r
->in
.account
->string
, &user_name
);
2071 return NT_STATUS_NO_MEMORY
;
2075 * UNIX username case mangling not required, pass_oem_change
2076 * is case insensitive.
2079 status
= pass_oem_change(user_name
,
2081 r
->in
.lm_password
->data
,
2082 r
->in
.lm_verifier
->hash
,
2083 r
->in
.nt_password
->data
,
2084 r
->in
.nt_verifier
->hash
,
2086 if (NT_STATUS_EQUAL(status
, NT_STATUS_NO_SUCH_USER
)) {
2087 return NT_STATUS_WRONG_PASSWORD
;
2090 if (NT_STATUS_EQUAL(status
, NT_STATUS_PASSWORD_RESTRICTION
) ||
2091 NT_STATUS_EQUAL(status
, NT_STATUS_ACCOUNT_RESTRICTION
)) {
2093 time_t u_expire
, u_min_age
;
2094 uint32 account_policy_temp
;
2096 dominfo
= TALLOC_ZERO_P(p
->mem_ctx
, struct samr_DomInfo1
);
2098 return NT_STATUS_NO_MEMORY
;
2101 reject
= TALLOC_ZERO_P(p
->mem_ctx
,
2102 struct userPwdChangeFailureInformation
);
2104 return NT_STATUS_NO_MEMORY
;
2111 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN
, &tmp
);
2112 dominfo
->min_password_length
= tmp
;
2114 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY
, &tmp
);
2115 dominfo
->password_history_length
= tmp
;
2117 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS
,
2118 &dominfo
->password_properties
);
2120 pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE
, &account_policy_temp
);
2121 u_expire
= account_policy_temp
;
2123 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE
, &account_policy_temp
);
2124 u_min_age
= account_policy_temp
;
2130 unix_to_nt_time_abs((NTTIME
*)&dominfo
->max_password_age
, u_expire
);
2131 unix_to_nt_time_abs((NTTIME
*)&dominfo
->min_password_age
, u_min_age
);
2133 if (lp_check_password_script() && *lp_check_password_script()) {
2134 dominfo
->password_properties
|= DOMAIN_PASSWORD_COMPLEX
;
2137 reject
->extendedFailureReason
= reject_reason
;
2139 *r
->out
.dominfo
= dominfo
;
2140 *r
->out
.reject
= reject
;
2143 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__
));
2148 /*******************************************************************
2149 makes a SAMR_R_LOOKUP_RIDS structure.
2150 ********************************************************************/
2152 static bool make_samr_lookup_rids(TALLOC_CTX
*ctx
, uint32 num_names
,
2154 struct lsa_String
**lsa_name_array_p
)
2156 struct lsa_String
*lsa_name_array
= NULL
;
2159 *lsa_name_array_p
= NULL
;
2161 if (num_names
!= 0) {
2162 lsa_name_array
= TALLOC_ZERO_ARRAY(ctx
, struct lsa_String
, num_names
);
2163 if (!lsa_name_array
) {
2168 for (i
= 0; i
< num_names
; i
++) {
2169 DEBUG(10, ("names[%d]:%s\n", i
, names
[i
] && *names
[i
] ? names
[i
] : ""));
2170 init_lsa_String(&lsa_name_array
[i
], names
[i
]);
2173 *lsa_name_array_p
= lsa_name_array
;
2178 /*******************************************************************
2180 ********************************************************************/
2182 NTSTATUS
_samr_LookupRids(struct pipes_struct
*p
,
2183 struct samr_LookupRids
*r
)
2185 struct samr_domain_info
*dinfo
;
2188 enum lsa_SidType
*attrs
= NULL
;
2189 uint32
*wire_attrs
= NULL
;
2190 int num_rids
= (int)r
->in
.num_rids
;
2192 struct lsa_Strings names_array
;
2193 struct samr_Ids types_array
;
2194 struct lsa_String
*lsa_names
= NULL
;
2196 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__
));
2198 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
2199 0 /* Don't know the acc_bits yet */, NULL
,
2200 struct samr_domain_info
, &status
);
2201 if (!NT_STATUS_IS_OK(status
)) {
2205 if (num_rids
> 1000) {
2206 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2207 "to samba4 idl this is not possible\n", num_rids
));
2208 return NT_STATUS_UNSUCCESSFUL
;
2212 names
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, const char *, num_rids
);
2213 attrs
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, enum lsa_SidType
, num_rids
);
2214 wire_attrs
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, num_rids
);
2216 if ((names
== NULL
) || (attrs
== NULL
) || (wire_attrs
==NULL
))
2217 return NT_STATUS_NO_MEMORY
;
2224 become_root(); /* lookup_sid can require root privs */
2225 status
= pdb_lookup_rids(&dinfo
->sid
, num_rids
, r
->in
.rids
,
2229 if (NT_STATUS_EQUAL(status
, NT_STATUS_NONE_MAPPED
) && (num_rids
== 0)) {
2230 status
= NT_STATUS_OK
;
2233 if (!make_samr_lookup_rids(p
->mem_ctx
, num_rids
, names
,
2235 return NT_STATUS_NO_MEMORY
;
2238 /* Convert from enum lsa_SidType to uint32 for wire format. */
2239 for (i
= 0; i
< num_rids
; i
++) {
2240 wire_attrs
[i
] = (uint32
)attrs
[i
];
2243 names_array
.count
= num_rids
;
2244 names_array
.names
= lsa_names
;
2246 types_array
.count
= num_rids
;
2247 types_array
.ids
= wire_attrs
;
2249 *r
->out
.names
= names_array
;
2250 *r
->out
.types
= types_array
;
2252 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__
));
2257 /*******************************************************************
2259 ********************************************************************/
2261 NTSTATUS
_samr_OpenUser(struct pipes_struct
*p
,
2262 struct samr_OpenUser
*r
)
2264 struct samu
*sampass
=NULL
;
2266 struct samr_domain_info
*dinfo
;
2267 struct samr_user_info
*uinfo
;
2268 struct security_descriptor
*psd
= NULL
;
2270 uint32 des_access
= r
->in
.access_mask
;
2271 uint32_t extra_access
= 0;
2276 /* These two privileges, if != SEC_PRIV_INVALID, indicate
2277 * privileges that the user must have to complete this
2278 * operation in defience of the fixed ACL */
2279 enum sec_privilege needed_priv_1
, needed_priv_2
;
2282 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
2283 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
, NULL
,
2284 struct samr_domain_info
, &status
);
2285 if (!NT_STATUS_IS_OK(status
)) {
2289 if ( !(sampass
= samu_new( p
->mem_ctx
)) ) {
2290 return NT_STATUS_NO_MEMORY
;
2293 /* append the user's RID to it */
2295 if (!sid_compose(&sid
, &dinfo
->sid
, r
->in
.rid
))
2296 return NT_STATUS_NO_SUCH_USER
;
2298 /* check if access can be granted as requested by client. */
2299 map_max_allowed_access(p
->session_info
->security_token
,
2300 &p
->session_info
->utok
,
2303 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &usr_generic_mapping
, &sid
, SAMR_USR_RIGHTS_WRITE_PW
);
2304 se_map_generic(&des_access
, &usr_generic_mapping
);
2307 * Get the sampass first as we need to check privileges
2308 * based on what kind of user object this is.
2309 * But don't reveal info too early if it didn't exist.
2313 ret
=pdb_getsampwsid(sampass
, &sid
);
2316 needed_priv_1
= SEC_PRIV_INVALID
;
2317 needed_priv_2
= SEC_PRIV_INVALID
;
2319 * We do the override access checks on *open*, not at
2323 uint32_t acb_info
= pdb_get_acct_ctrl(sampass
);
2325 if (acb_info
& ACB_WSTRUST
) {
2327 * SeMachineAccount is needed to add
2328 * GENERIC_RIGHTS_USER_WRITE to a machine
2331 needed_priv_1
= SEC_PRIV_MACHINE_ACCOUNT
;
2333 if (acb_info
& ACB_NORMAL
) {
2335 * SeAddUsers is needed to add
2336 * GENERIC_RIGHTS_USER_WRITE to a normal
2339 needed_priv_1
= SEC_PRIV_ADD_USERS
;
2342 * Cheat - we have not set a specific privilege for
2343 * server (BDC) or domain trust account, so allow
2344 * GENERIC_RIGHTS_USER_WRITE if pipe user is in
2345 * DOMAIN_RID_ADMINS.
2347 if (acb_info
& (ACB_SVRTRUST
|ACB_DOMTRUST
)) {
2348 if (lp_enable_privileges() && nt_token_check_domain_rid(p
->session_info
->security_token
,
2349 DOMAIN_RID_ADMINS
)) {
2350 des_access
&= ~GENERIC_RIGHTS_USER_WRITE
;
2351 extra_access
= GENERIC_RIGHTS_USER_WRITE
;
2352 DEBUG(4,("_samr_OpenUser: Allowing "
2353 "GENERIC_RIGHTS_USER_WRITE for "
2359 TALLOC_FREE(sampass
);
2361 nt_status
= access_check_object(psd
, p
->session_info
->security_token
,
2362 needed_priv_1
, needed_priv_2
,
2363 GENERIC_RIGHTS_USER_WRITE
, des_access
,
2364 &acc_granted
, "_samr_OpenUser");
2366 if ( !NT_STATUS_IS_OK(nt_status
) )
2369 /* check that the SID exists in our domain. */
2371 return NT_STATUS_NO_SUCH_USER
;
2374 /* If we did the rid admins hack above, allow access. */
2375 acc_granted
|= extra_access
;
2377 uinfo
= policy_handle_create(p
, r
->out
.user_handle
, acc_granted
,
2378 struct samr_user_info
, &nt_status
);
2379 if (!NT_STATUS_IS_OK(nt_status
)) {
2384 return NT_STATUS_OK
;
2387 /*************************************************************************
2388 *************************************************************************/
2390 static NTSTATUS
init_samr_parameters_string(TALLOC_CTX
*mem_ctx
,
2392 struct lsa_BinaryString
**_r
)
2394 struct lsa_BinaryString
*r
;
2397 return NT_STATUS_INVALID_PARAMETER
;
2400 r
= TALLOC_ZERO_P(mem_ctx
, struct lsa_BinaryString
);
2402 return NT_STATUS_NO_MEMORY
;
2405 r
->array
= TALLOC_ZERO_ARRAY(mem_ctx
, uint16_t, blob
->length
/2);
2407 return NT_STATUS_NO_MEMORY
;
2409 memcpy(r
->array
, blob
->data
, blob
->length
);
2410 r
->size
= blob
->length
;
2411 r
->length
= blob
->length
;
2414 return NT_STATUS_NO_MEMORY
;
2419 return NT_STATUS_OK
;
2422 /*************************************************************************
2423 *************************************************************************/
2425 static struct samr_LogonHours
get_logon_hours_from_pdb(TALLOC_CTX
*mem_ctx
,
2428 struct samr_LogonHours hours
;
2429 const int units_per_week
= 168;
2432 hours
.bits
= talloc_array(mem_ctx
, uint8_t, units_per_week
);
2437 hours
.units_per_week
= units_per_week
;
2438 memset(hours
.bits
, 0xFF, units_per_week
);
2440 if (pdb_get_hours(pw
)) {
2441 memcpy(hours
.bits
, pdb_get_hours(pw
),
2442 MIN(pdb_get_hours_len(pw
), units_per_week
));
2448 /*************************************************************************
2450 *************************************************************************/
2452 static NTSTATUS
get_user_info_1(TALLOC_CTX
*mem_ctx
,
2453 struct samr_UserInfo1
*r
,
2455 struct dom_sid
*domain_sid
)
2457 const struct dom_sid
*sid_group
;
2458 uint32_t primary_gid
;
2461 sid_group
= pdb_get_group_sid(pw
);
2464 if (!sid_peek_check_rid(domain_sid
, sid_group
, &primary_gid
)) {
2465 DEBUG(0, ("get_user_info_1: User %s has Primary Group SID %s, \n"
2466 "which conflicts with the domain sid %s. Failing operation.\n",
2467 pdb_get_username(pw
), sid_string_dbg(sid_group
),
2468 sid_string_dbg(domain_sid
)));
2469 return NT_STATUS_UNSUCCESSFUL
;
2472 r
->account_name
.string
= talloc_strdup(mem_ctx
, pdb_get_username(pw
));
2473 r
->full_name
.string
= talloc_strdup(mem_ctx
, pdb_get_fullname(pw
));
2474 r
->primary_gid
= primary_gid
;
2475 r
->description
.string
= talloc_strdup(mem_ctx
, pdb_get_acct_desc(pw
));
2476 r
->comment
.string
= talloc_strdup(mem_ctx
, pdb_get_comment(pw
));
2478 return NT_STATUS_OK
;
2481 /*************************************************************************
2483 *************************************************************************/
2485 static NTSTATUS
get_user_info_2(TALLOC_CTX
*mem_ctx
,
2486 struct samr_UserInfo2
*r
,
2489 r
->comment
.string
= talloc_strdup(mem_ctx
, pdb_get_comment(pw
));
2490 r
->reserved
.string
= NULL
;
2491 r
->country_code
= pdb_get_country_code(pw
);
2492 r
->code_page
= pdb_get_code_page(pw
);
2494 return NT_STATUS_OK
;
2497 /*************************************************************************
2499 *************************************************************************/
2501 static NTSTATUS
get_user_info_3(TALLOC_CTX
*mem_ctx
,
2502 struct samr_UserInfo3
*r
,
2504 struct dom_sid
*domain_sid
)
2506 const struct dom_sid
*sid_user
, *sid_group
;
2507 uint32_t rid
, primary_gid
;
2509 sid_user
= pdb_get_user_sid(pw
);
2511 if (!sid_peek_check_rid(domain_sid
, sid_user
, &rid
)) {
2512 DEBUG(0, ("get_user_info_3: User %s has SID %s, \nwhich conflicts with "
2513 "the domain sid %s. Failing operation.\n",
2514 pdb_get_username(pw
), sid_string_dbg(sid_user
),
2515 sid_string_dbg(domain_sid
)));
2516 return NT_STATUS_UNSUCCESSFUL
;
2520 sid_group
= pdb_get_group_sid(pw
);
2523 if (!sid_peek_check_rid(domain_sid
, sid_group
, &primary_gid
)) {
2524 DEBUG(0, ("get_user_info_3: User %s has Primary Group SID %s, \n"
2525 "which conflicts with the domain sid %s. Failing operation.\n",
2526 pdb_get_username(pw
), sid_string_dbg(sid_group
),
2527 sid_string_dbg(domain_sid
)));
2528 return NT_STATUS_UNSUCCESSFUL
;
2531 unix_to_nt_time(&r
->last_logon
, pdb_get_logon_time(pw
));
2532 unix_to_nt_time(&r
->last_logoff
, pdb_get_logoff_time(pw
));
2533 unix_to_nt_time(&r
->last_password_change
, pdb_get_pass_last_set_time(pw
));
2534 unix_to_nt_time(&r
->allow_password_change
, pdb_get_pass_can_change_time(pw
));
2535 unix_to_nt_time(&r
->force_password_change
, pdb_get_pass_must_change_time(pw
));
2537 r
->account_name
.string
= talloc_strdup(mem_ctx
, pdb_get_username(pw
));
2538 r
->full_name
.string
= talloc_strdup(mem_ctx
, pdb_get_fullname(pw
));
2539 r
->home_directory
.string
= talloc_strdup(mem_ctx
, pdb_get_homedir(pw
));
2540 r
->home_drive
.string
= talloc_strdup(mem_ctx
, pdb_get_dir_drive(pw
));
2541 r
->logon_script
.string
= talloc_strdup(mem_ctx
, pdb_get_logon_script(pw
));
2542 r
->profile_path
.string
= talloc_strdup(mem_ctx
, pdb_get_profile_path(pw
));
2543 r
->workstations
.string
= talloc_strdup(mem_ctx
, pdb_get_workstations(pw
));
2545 r
->logon_hours
= get_logon_hours_from_pdb(mem_ctx
, pw
);
2547 r
->primary_gid
= primary_gid
;
2548 r
->acct_flags
= pdb_get_acct_ctrl(pw
);
2549 r
->bad_password_count
= pdb_get_bad_password_count(pw
);
2550 r
->logon_count
= pdb_get_logon_count(pw
);
2552 return NT_STATUS_OK
;
2555 /*************************************************************************
2557 *************************************************************************/
2559 static NTSTATUS
get_user_info_4(TALLOC_CTX
*mem_ctx
,
2560 struct samr_UserInfo4
*r
,
2563 r
->logon_hours
= get_logon_hours_from_pdb(mem_ctx
, pw
);
2565 return NT_STATUS_OK
;
2568 /*************************************************************************
2570 *************************************************************************/
2572 static NTSTATUS
get_user_info_5(TALLOC_CTX
*mem_ctx
,
2573 struct samr_UserInfo5
*r
,
2575 struct dom_sid
*domain_sid
)
2577 const struct dom_sid
*sid_user
, *sid_group
;
2578 uint32_t rid
, primary_gid
;
2580 sid_user
= pdb_get_user_sid(pw
);
2582 if (!sid_peek_check_rid(domain_sid
, sid_user
, &rid
)) {
2583 DEBUG(0, ("get_user_info_5: User %s has SID %s, \nwhich conflicts with "
2584 "the domain sid %s. Failing operation.\n",
2585 pdb_get_username(pw
), sid_string_dbg(sid_user
),
2586 sid_string_dbg(domain_sid
)));
2587 return NT_STATUS_UNSUCCESSFUL
;
2591 sid_group
= pdb_get_group_sid(pw
);
2594 if (!sid_peek_check_rid(domain_sid
, sid_group
, &primary_gid
)) {
2595 DEBUG(0, ("get_user_info_5: User %s has Primary Group SID %s, \n"
2596 "which conflicts with the domain sid %s. Failing operation.\n",
2597 pdb_get_username(pw
), sid_string_dbg(sid_group
),
2598 sid_string_dbg(domain_sid
)));
2599 return NT_STATUS_UNSUCCESSFUL
;
2602 unix_to_nt_time(&r
->last_logon
, pdb_get_logon_time(pw
));
2603 unix_to_nt_time(&r
->last_logoff
, pdb_get_logoff_time(pw
));
2604 unix_to_nt_time(&r
->acct_expiry
, pdb_get_kickoff_time(pw
));
2605 unix_to_nt_time(&r
->last_password_change
, pdb_get_pass_last_set_time(pw
));
2607 r
->account_name
.string
= talloc_strdup(mem_ctx
, pdb_get_username(pw
));
2608 r
->full_name
.string
= talloc_strdup(mem_ctx
, pdb_get_fullname(pw
));
2609 r
->home_directory
.string
= talloc_strdup(mem_ctx
, pdb_get_homedir(pw
));
2610 r
->home_drive
.string
= talloc_strdup(mem_ctx
, pdb_get_dir_drive(pw
));
2611 r
->logon_script
.string
= talloc_strdup(mem_ctx
, pdb_get_logon_script(pw
));
2612 r
->profile_path
.string
= talloc_strdup(mem_ctx
, pdb_get_profile_path(pw
));
2613 r
->description
.string
= talloc_strdup(mem_ctx
, pdb_get_acct_desc(pw
));
2614 r
->workstations
.string
= talloc_strdup(mem_ctx
, pdb_get_workstations(pw
));
2616 r
->logon_hours
= get_logon_hours_from_pdb(mem_ctx
, pw
);
2618 r
->primary_gid
= primary_gid
;
2619 r
->acct_flags
= pdb_get_acct_ctrl(pw
);
2620 r
->bad_password_count
= pdb_get_bad_password_count(pw
);
2621 r
->logon_count
= pdb_get_logon_count(pw
);
2623 return NT_STATUS_OK
;
2626 /*************************************************************************
2628 *************************************************************************/
2630 static NTSTATUS
get_user_info_6(TALLOC_CTX
*mem_ctx
,
2631 struct samr_UserInfo6
*r
,
2634 r
->account_name
.string
= talloc_strdup(mem_ctx
, pdb_get_username(pw
));
2635 r
->full_name
.string
= talloc_strdup(mem_ctx
, pdb_get_fullname(pw
));
2637 return NT_STATUS_OK
;
2640 /*************************************************************************
2641 get_user_info_7. Safe. Only gives out account_name.
2642 *************************************************************************/
2644 static NTSTATUS
get_user_info_7(TALLOC_CTX
*mem_ctx
,
2645 struct samr_UserInfo7
*r
,
2646 struct samu
*smbpass
)
2648 r
->account_name
.string
= talloc_strdup(mem_ctx
, pdb_get_username(smbpass
));
2649 if (!r
->account_name
.string
) {
2650 return NT_STATUS_NO_MEMORY
;
2653 return NT_STATUS_OK
;
2656 /*************************************************************************
2658 *************************************************************************/
2660 static NTSTATUS
get_user_info_8(TALLOC_CTX
*mem_ctx
,
2661 struct samr_UserInfo8
*r
,
2664 r
->full_name
.string
= talloc_strdup(mem_ctx
, pdb_get_fullname(pw
));
2666 return NT_STATUS_OK
;
2669 /*************************************************************************
2670 get_user_info_9. Only gives out primary group SID.
2671 *************************************************************************/
2673 static NTSTATUS
get_user_info_9(TALLOC_CTX
*mem_ctx
,
2674 struct samr_UserInfo9
*r
,
2675 struct samu
*smbpass
)
2677 r
->primary_gid
= pdb_get_group_rid(smbpass
);
2679 return NT_STATUS_OK
;
2682 /*************************************************************************
2684 *************************************************************************/
2686 static NTSTATUS
get_user_info_10(TALLOC_CTX
*mem_ctx
,
2687 struct samr_UserInfo10
*r
,
2690 r
->home_directory
.string
= talloc_strdup(mem_ctx
, pdb_get_homedir(pw
));
2691 r
->home_drive
.string
= talloc_strdup(mem_ctx
, pdb_get_dir_drive(pw
));
2693 return NT_STATUS_OK
;
2696 /*************************************************************************
2698 *************************************************************************/
2700 static NTSTATUS
get_user_info_11(TALLOC_CTX
*mem_ctx
,
2701 struct samr_UserInfo11
*r
,
2704 r
->logon_script
.string
= talloc_strdup(mem_ctx
, pdb_get_logon_script(pw
));
2706 return NT_STATUS_OK
;
2709 /*************************************************************************
2711 *************************************************************************/
2713 static NTSTATUS
get_user_info_12(TALLOC_CTX
*mem_ctx
,
2714 struct samr_UserInfo12
*r
,
2717 r
->profile_path
.string
= talloc_strdup(mem_ctx
, pdb_get_profile_path(pw
));
2719 return NT_STATUS_OK
;
2722 /*************************************************************************
2724 *************************************************************************/
2726 static NTSTATUS
get_user_info_13(TALLOC_CTX
*mem_ctx
,
2727 struct samr_UserInfo13
*r
,
2730 r
->description
.string
= talloc_strdup(mem_ctx
, pdb_get_acct_desc(pw
));
2732 return NT_STATUS_OK
;
2735 /*************************************************************************
2737 *************************************************************************/
2739 static NTSTATUS
get_user_info_14(TALLOC_CTX
*mem_ctx
,
2740 struct samr_UserInfo14
*r
,
2743 r
->workstations
.string
= talloc_strdup(mem_ctx
, pdb_get_workstations(pw
));
2745 return NT_STATUS_OK
;
2748 /*************************************************************************
2749 get_user_info_16. Safe. Only gives out acb bits.
2750 *************************************************************************/
2752 static NTSTATUS
get_user_info_16(TALLOC_CTX
*mem_ctx
,
2753 struct samr_UserInfo16
*r
,
2754 struct samu
*smbpass
)
2756 r
->acct_flags
= pdb_get_acct_ctrl(smbpass
);
2758 return NT_STATUS_OK
;
2761 /*************************************************************************
2763 *************************************************************************/
2765 static NTSTATUS
get_user_info_17(TALLOC_CTX
*mem_ctx
,
2766 struct samr_UserInfo17
*r
,
2769 unix_to_nt_time(&r
->acct_expiry
, pdb_get_kickoff_time(pw
));
2771 return NT_STATUS_OK
;
2774 /*************************************************************************
2775 get_user_info_18. OK - this is the killer as it gives out password info.
2776 Ensure that this is only allowed on an encrypted connection with a root
2778 *************************************************************************/
2780 static NTSTATUS
get_user_info_18(struct pipes_struct
*p
,
2781 TALLOC_CTX
*mem_ctx
,
2782 struct samr_UserInfo18
*r
,
2783 struct dom_sid
*user_sid
)
2785 struct samu
*smbpass
=NULL
;
2787 const uint8_t *nt_pass
= NULL
;
2788 const uint8_t *lm_pass
= NULL
;
2792 if (p
->session_info
->system
) {
2796 if ((p
->auth
.auth_type
!= DCERPC_AUTH_TYPE_NTLMSSP
) ||
2797 (p
->auth
.auth_type
!= DCERPC_AUTH_TYPE_KRB5
) ||
2798 (p
->auth
.auth_type
!= DCERPC_AUTH_TYPE_SPNEGO
)) {
2799 return NT_STATUS_ACCESS_DENIED
;
2802 if (p
->auth
.auth_level
!= DCERPC_AUTH_LEVEL_PRIVACY
) {
2803 return NT_STATUS_ACCESS_DENIED
;
2808 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2811 if ( !(smbpass
= samu_new( mem_ctx
)) ) {
2812 return NT_STATUS_NO_MEMORY
;
2815 ret
= pdb_getsampwsid(smbpass
, user_sid
);
2818 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid
)));
2819 TALLOC_FREE(smbpass
);
2820 return (geteuid() == sec_initial_uid()) ? NT_STATUS_NO_SUCH_USER
: NT_STATUS_ACCESS_DENIED
;
2823 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass
), pdb_get_acct_ctrl(smbpass
) ));
2825 if ( pdb_get_acct_ctrl(smbpass
) & ACB_DISABLED
) {
2826 TALLOC_FREE(smbpass
);
2827 return NT_STATUS_ACCOUNT_DISABLED
;
2830 lm_pass
= pdb_get_lanman_passwd(smbpass
);
2831 if (lm_pass
!= NULL
) {
2832 memcpy(r
->lm_pwd
.hash
, lm_pass
, 16);
2833 r
->lm_pwd_active
= true;
2836 nt_pass
= pdb_get_nt_passwd(smbpass
);
2837 if (nt_pass
!= NULL
) {
2838 memcpy(r
->nt_pwd
.hash
, nt_pass
, 16);
2839 r
->nt_pwd_active
= true;
2841 r
->password_expired
= 0; /* FIXME */
2843 TALLOC_FREE(smbpass
);
2845 return NT_STATUS_OK
;
2848 /*************************************************************************
2850 *************************************************************************/
2852 static NTSTATUS
get_user_info_20(TALLOC_CTX
*mem_ctx
,
2853 struct samr_UserInfo20
*r
,
2854 struct samu
*sampass
)
2856 const char *munged_dial
= NULL
;
2859 struct lsa_BinaryString
*parameters
= NULL
;
2863 munged_dial
= pdb_get_munged_dial(sampass
);
2865 DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass
),
2866 munged_dial
, (int)strlen(munged_dial
)));
2869 blob
= base64_decode_data_blob(munged_dial
);
2871 blob
= data_blob_string_const_null("");
2874 status
= init_samr_parameters_string(mem_ctx
, &blob
, ¶meters
);
2875 data_blob_free(&blob
);
2876 if (!NT_STATUS_IS_OK(status
)) {
2880 r
->parameters
= *parameters
;
2882 return NT_STATUS_OK
;
2886 /*************************************************************************
2888 *************************************************************************/
2890 static NTSTATUS
get_user_info_21(TALLOC_CTX
*mem_ctx
,
2891 struct samr_UserInfo21
*r
,
2893 struct dom_sid
*domain_sid
,
2894 uint32_t acc_granted
)
2897 const struct dom_sid
*sid_user
, *sid_group
;
2898 uint32_t rid
, primary_gid
;
2899 NTTIME force_password_change
;
2900 time_t must_change_time
;
2901 struct lsa_BinaryString
*parameters
= NULL
;
2902 const char *munged_dial
= NULL
;
2907 sid_user
= pdb_get_user_sid(pw
);
2909 if (!sid_peek_check_rid(domain_sid
, sid_user
, &rid
)) {
2910 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2911 "the domain sid %s. Failing operation.\n",
2912 pdb_get_username(pw
), sid_string_dbg(sid_user
),
2913 sid_string_dbg(domain_sid
)));
2914 return NT_STATUS_UNSUCCESSFUL
;
2918 sid_group
= pdb_get_group_sid(pw
);
2921 if (!sid_peek_check_rid(domain_sid
, sid_group
, &primary_gid
)) {
2922 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2923 "which conflicts with the domain sid %s. Failing operation.\n",
2924 pdb_get_username(pw
), sid_string_dbg(sid_group
),
2925 sid_string_dbg(domain_sid
)));
2926 return NT_STATUS_UNSUCCESSFUL
;
2929 unix_to_nt_time(&r
->last_logon
, pdb_get_logon_time(pw
));
2930 unix_to_nt_time(&r
->last_logoff
, pdb_get_logoff_time(pw
));
2931 unix_to_nt_time(&r
->acct_expiry
, pdb_get_kickoff_time(pw
));
2932 unix_to_nt_time(&r
->last_password_change
, pdb_get_pass_last_set_time(pw
));
2933 unix_to_nt_time(&r
->allow_password_change
, pdb_get_pass_can_change_time(pw
));
2935 must_change_time
= pdb_get_pass_must_change_time(pw
);
2936 if (must_change_time
== get_time_t_max()) {
2937 unix_to_nt_time_abs(&force_password_change
, must_change_time
);
2939 unix_to_nt_time(&force_password_change
, must_change_time
);
2942 munged_dial
= pdb_get_munged_dial(pw
);
2944 blob
= base64_decode_data_blob(munged_dial
);
2946 blob
= data_blob_string_const_null("");
2949 status
= init_samr_parameters_string(mem_ctx
, &blob
, ¶meters
);
2950 data_blob_free(&blob
);
2951 if (!NT_STATUS_IS_OK(status
)) {
2955 r
->force_password_change
= force_password_change
;
2957 r
->account_name
.string
= talloc_strdup(mem_ctx
, pdb_get_username(pw
));
2958 r
->full_name
.string
= talloc_strdup(mem_ctx
, pdb_get_fullname(pw
));
2959 r
->home_directory
.string
= talloc_strdup(mem_ctx
, pdb_get_homedir(pw
));
2960 r
->home_drive
.string
= talloc_strdup(mem_ctx
, pdb_get_dir_drive(pw
));
2961 r
->logon_script
.string
= talloc_strdup(mem_ctx
, pdb_get_logon_script(pw
));
2962 r
->profile_path
.string
= talloc_strdup(mem_ctx
, pdb_get_profile_path(pw
));
2963 r
->description
.string
= talloc_strdup(mem_ctx
, pdb_get_acct_desc(pw
));
2964 r
->workstations
.string
= talloc_strdup(mem_ctx
, pdb_get_workstations(pw
));
2965 r
->comment
.string
= talloc_strdup(mem_ctx
, pdb_get_comment(pw
));
2967 r
->logon_hours
= get_logon_hours_from_pdb(mem_ctx
, pw
);
2968 r
->parameters
= *parameters
;
2970 r
->primary_gid
= primary_gid
;
2971 r
->acct_flags
= pdb_get_acct_ctrl(pw
);
2972 r
->bad_password_count
= pdb_get_bad_password_count(pw
);
2973 r
->logon_count
= pdb_get_logon_count(pw
);
2974 r
->fields_present
= pdb_build_fields_present(pw
);
2975 r
->password_expired
= (pdb_get_pass_must_change_time(pw
) == 0) ?
2976 PASS_MUST_CHANGE_AT_NEXT_LOGON
: 0;
2977 r
->country_code
= pdb_get_country_code(pw
);
2978 r
->code_page
= pdb_get_code_page(pw
);
2979 r
->lm_password_set
= 0;
2980 r
->nt_password_set
= 0;
2985 Look at a user on a real NT4 PDC with usrmgr, press
2986 'ok'. Then you will see that fields_present is set to
2987 0x08f827fa. Look at the user immediately after that again,
2988 and you will see that 0x00fffff is returned. This solves
2989 the problem that you get access denied after having looked
2997 return NT_STATUS_OK
;
3000 /*******************************************************************
3002 ********************************************************************/
3004 NTSTATUS
_samr_QueryUserInfo(struct pipes_struct
*p
,
3005 struct samr_QueryUserInfo
*r
)
3008 union samr_UserInfo
*user_info
= NULL
;
3009 struct samr_user_info
*uinfo
;
3010 struct dom_sid domain_sid
;
3013 struct samu
*pwd
= NULL
;
3014 uint32_t acc_required
, acc_granted
;
3016 switch (r
->in
.level
) {
3017 case 1: /* UserGeneralInformation */
3018 /* USER_READ_GENERAL */
3019 acc_required
= SAMR_USER_ACCESS_GET_NAME_ETC
;
3021 case 2: /* UserPreferencesInformation */
3022 /* USER_READ_PREFERENCES | USER_READ_GENERAL */
3023 acc_required
= SAMR_USER_ACCESS_GET_LOCALE
|
3024 SAMR_USER_ACCESS_GET_NAME_ETC
;
3026 case 3: /* UserLogonInformation */
3027 /* USER_READ_GENERAL | USER_READ_PREFERENCES | USER_READ_LOGON | USER_READ_ACCOUNT */
3028 acc_required
= SAMR_USER_ACCESS_GET_NAME_ETC
|
3029 SAMR_USER_ACCESS_GET_LOCALE
|
3030 SAMR_USER_ACCESS_GET_LOGONINFO
|
3031 SAMR_USER_ACCESS_GET_ATTRIBUTES
;
3033 case 4: /* UserLogonHoursInformation */
3034 /* USER_READ_LOGON */
3035 acc_required
= SAMR_USER_ACCESS_GET_LOGONINFO
;
3037 case 5: /* UserAccountInformation */
3038 /* USER_READ_GENERAL | USER_READ_PREFERENCES | USER_READ_LOGON | USER_READ_ACCOUNT */
3039 acc_required
= SAMR_USER_ACCESS_GET_NAME_ETC
|
3040 SAMR_USER_ACCESS_GET_LOCALE
|
3041 SAMR_USER_ACCESS_GET_LOGONINFO
|
3042 SAMR_USER_ACCESS_GET_ATTRIBUTES
;
3044 case 6: /* UserNameInformation */
3045 case 7: /* UserAccountNameInformation */
3046 case 8: /* UserFullNameInformation */
3047 case 9: /* UserPrimaryGroupInformation */
3048 case 13: /* UserAdminCommentInformation */
3049 /* USER_READ_GENERAL */
3050 acc_required
= SAMR_USER_ACCESS_GET_NAME_ETC
;
3052 case 10: /* UserHomeInformation */
3053 case 11: /* UserScriptInformation */
3054 case 12: /* UserProfileInformation */
3055 case 14: /* UserWorkStationsInformation */
3056 /* USER_READ_LOGON */
3057 acc_required
= SAMR_USER_ACCESS_GET_LOGONINFO
;
3059 case 16: /* UserControlInformation */
3060 case 17: /* UserExpiresInformation */
3061 case 20: /* UserParametersInformation */
3062 /* USER_READ_ACCOUNT */
3063 acc_required
= SAMR_USER_ACCESS_GET_ATTRIBUTES
;
3065 case 21: /* UserAllInformation */
3067 acc_required
= SAMR_USER_ACCESS_GET_ATTRIBUTES
;
3069 case 18: /* UserInternal1Information */
3071 acc_required
= SAMR_USER_ACCESS_GET_ATTRIBUTES
;
3073 case 23: /* UserInternal4Information */
3074 case 24: /* UserInternal4InformationNew */
3075 case 25: /* UserInternal4InformationNew */
3076 case 26: /* UserInternal5InformationNew */
3078 return NT_STATUS_INVALID_INFO_CLASS
;
3082 uinfo
= policy_handle_find(p
, r
->in
.user_handle
,
3083 acc_required
, &acc_granted
,
3084 struct samr_user_info
, &status
);
3085 if (!NT_STATUS_IS_OK(status
)) {
3089 domain_sid
= uinfo
->sid
;
3091 sid_split_rid(&domain_sid
, &rid
);
3093 if (!sid_check_is_in_our_domain(&uinfo
->sid
))
3094 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
3096 DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
3097 sid_string_dbg(&uinfo
->sid
)));
3099 user_info
= TALLOC_ZERO_P(p
->mem_ctx
, union samr_UserInfo
);
3101 return NT_STATUS_NO_MEMORY
;
3104 DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r
->in
.level
));
3106 if (!(pwd
= samu_new(p
->mem_ctx
))) {
3107 return NT_STATUS_NO_MEMORY
;
3111 ret
= pdb_getsampwsid(pwd
, &uinfo
->sid
);
3115 DEBUG(4,("User %s not found\n", sid_string_dbg(&uinfo
->sid
)));
3117 return NT_STATUS_NO_SUCH_USER
;
3120 DEBUG(3,("User:[%s]\n", pdb_get_username(pwd
)));
3122 samr_clear_sam_passwd(pwd
);
3124 switch (r
->in
.level
) {
3126 status
= get_user_info_1(p
->mem_ctx
, &user_info
->info1
, pwd
, &domain_sid
);
3129 status
= get_user_info_2(p
->mem_ctx
, &user_info
->info2
, pwd
);
3132 status
= get_user_info_3(p
->mem_ctx
, &user_info
->info3
, pwd
, &domain_sid
);
3135 status
= get_user_info_4(p
->mem_ctx
, &user_info
->info4
, pwd
);
3138 status
= get_user_info_5(p
->mem_ctx
, &user_info
->info5
, pwd
, &domain_sid
);
3141 status
= get_user_info_6(p
->mem_ctx
, &user_info
->info6
, pwd
);
3144 status
= get_user_info_7(p
->mem_ctx
, &user_info
->info7
, pwd
);
3147 status
= get_user_info_8(p
->mem_ctx
, &user_info
->info8
, pwd
);
3150 status
= get_user_info_9(p
->mem_ctx
, &user_info
->info9
, pwd
);
3153 status
= get_user_info_10(p
->mem_ctx
, &user_info
->info10
, pwd
);
3156 status
= get_user_info_11(p
->mem_ctx
, &user_info
->info11
, pwd
);
3159 status
= get_user_info_12(p
->mem_ctx
, &user_info
->info12
, pwd
);
3162 status
= get_user_info_13(p
->mem_ctx
, &user_info
->info13
, pwd
);
3165 status
= get_user_info_14(p
->mem_ctx
, &user_info
->info14
, pwd
);
3168 status
= get_user_info_16(p
->mem_ctx
, &user_info
->info16
, pwd
);
3171 status
= get_user_info_17(p
->mem_ctx
, &user_info
->info17
, pwd
);
3174 /* level 18 is special */
3175 status
= get_user_info_18(p
, p
->mem_ctx
, &user_info
->info18
,
3179 status
= get_user_info_20(p
->mem_ctx
, &user_info
->info20
, pwd
);
3182 status
= get_user_info_21(p
->mem_ctx
, &user_info
->info21
, pwd
, &domain_sid
, acc_granted
);
3185 status
= NT_STATUS_INVALID_INFO_CLASS
;
3189 if (!NT_STATUS_IS_OK(status
)) {
3193 *r
->out
.info
= user_info
;
3198 DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__
));
3203 /****************************************************************
3204 ****************************************************************/
3206 NTSTATUS
_samr_QueryUserInfo2(struct pipes_struct
*p
,
3207 struct samr_QueryUserInfo2
*r
)
3209 struct samr_QueryUserInfo u
;
3211 u
.in
.user_handle
= r
->in
.user_handle
;
3212 u
.in
.level
= r
->in
.level
;
3213 u
.out
.info
= r
->out
.info
;
3215 return _samr_QueryUserInfo(p
, &u
);
3218 /*******************************************************************
3219 _samr_GetGroupsForUser
3220 ********************************************************************/
3222 NTSTATUS
_samr_GetGroupsForUser(struct pipes_struct
*p
,
3223 struct samr_GetGroupsForUser
*r
)
3225 struct samr_user_info
*uinfo
;
3226 struct samu
*sam_pass
=NULL
;
3227 struct dom_sid
*sids
;
3228 struct samr_RidWithAttribute dom_gid
;
3229 struct samr_RidWithAttribute
*gids
= NULL
;
3230 uint32 primary_group_rid
;
3231 uint32_t num_groups
= 0;
3233 uint32_t i
, num_gids
;
3236 bool success
= False
;
3238 struct samr_RidWithAttributeArray
*rids
= NULL
;
3241 * from the SID in the request:
3242 * we should send back the list of DOMAIN GROUPS
3243 * the user is a member of
3245 * and only the DOMAIN GROUPS
3246 * no ALIASES !!! neither aliases of the domain
3247 * nor aliases of the builtin SID
3252 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__
));
3254 uinfo
= policy_handle_find(p
, r
->in
.user_handle
,
3255 SAMR_USER_ACCESS_GET_GROUPS
, NULL
,
3256 struct samr_user_info
, &result
);
3257 if (!NT_STATUS_IS_OK(result
)) {
3261 rids
= TALLOC_ZERO_P(p
->mem_ctx
, struct samr_RidWithAttributeArray
);
3263 return NT_STATUS_NO_MEMORY
;
3266 if (!sid_check_is_in_our_domain(&uinfo
->sid
))
3267 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
3269 if ( !(sam_pass
= samu_new( p
->mem_ctx
)) ) {
3270 return NT_STATUS_NO_MEMORY
;
3274 ret
= pdb_getsampwsid(sam_pass
, &uinfo
->sid
);
3278 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
3279 sid_string_dbg(&uinfo
->sid
)));
3280 return NT_STATUS_NO_SUCH_USER
;
3285 /* make both calls inside the root block */
3287 result
= pdb_enum_group_memberships(p
->mem_ctx
, sam_pass
,
3288 &sids
, &unix_gids
, &num_groups
);
3289 if ( NT_STATUS_IS_OK(result
) ) {
3290 success
= sid_peek_check_rid(get_global_sam_sid(),
3291 pdb_get_group_sid(sam_pass
),
3292 &primary_group_rid
);
3296 if (!NT_STATUS_IS_OK(result
)) {
3297 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
3298 sid_string_dbg(&uinfo
->sid
)));
3303 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
3304 sid_string_dbg(pdb_get_group_sid(sam_pass
)),
3305 pdb_get_username(sam_pass
)));
3306 TALLOC_FREE(sam_pass
);
3307 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
3313 dom_gid
.attributes
= (SE_GROUP_MANDATORY
|SE_GROUP_ENABLED_BY_DEFAULT
|
3315 dom_gid
.rid
= primary_group_rid
;
3316 ADD_TO_ARRAY(p
->mem_ctx
, struct samr_RidWithAttribute
, dom_gid
, &gids
, &num_gids
);
3318 for (i
=0; i
<num_groups
; i
++) {
3320 if (!sid_peek_check_rid(get_global_sam_sid(),
3321 &(sids
[i
]), &dom_gid
.rid
)) {
3322 DEBUG(10, ("Found sid %s not in our domain\n",
3323 sid_string_dbg(&sids
[i
])));
3327 if (dom_gid
.rid
== primary_group_rid
) {
3328 /* We added the primary group directly from the
3329 * sam_account. The other SIDs are unique from
3330 * enum_group_memberships */
3334 ADD_TO_ARRAY(p
->mem_ctx
, struct samr_RidWithAttribute
, dom_gid
, &gids
, &num_gids
);
3337 rids
->count
= num_gids
;
3340 *r
->out
.rids
= rids
;
3342 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__
));
3347 /*******************************************************************
3348 ********************************************************************/
3350 static uint32_t samr_get_server_role(void)
3352 uint32_t role
= ROLE_DOMAIN_PDC
;
3354 if (lp_server_role() == ROLE_DOMAIN_BDC
) {
3355 role
= ROLE_DOMAIN_BDC
;
3361 /*******************************************************************
3362 ********************************************************************/
3364 static NTSTATUS
query_dom_info_1(TALLOC_CTX
*mem_ctx
,
3365 struct samr_DomInfo1
*r
)
3367 uint32_t account_policy_temp
;
3368 time_t u_expire
, u_min_age
;
3374 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN
, &account_policy_temp
);
3375 r
->min_password_length
= account_policy_temp
;
3377 pdb_get_account_policy(PDB_POLICY_PASSWORD_HISTORY
, &account_policy_temp
);
3378 r
->password_history_length
= account_policy_temp
;
3380 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS
,
3381 &r
->password_properties
);
3383 pdb_get_account_policy(PDB_POLICY_MAX_PASSWORD_AGE
, &account_policy_temp
);
3384 u_expire
= account_policy_temp
;
3386 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_AGE
, &account_policy_temp
);
3387 u_min_age
= account_policy_temp
;
3393 unix_to_nt_time_abs((NTTIME
*)&r
->max_password_age
, u_expire
);
3394 unix_to_nt_time_abs((NTTIME
*)&r
->min_password_age
, u_min_age
);
3396 if (lp_check_password_script() && *lp_check_password_script()) {
3397 r
->password_properties
|= DOMAIN_PASSWORD_COMPLEX
;
3400 return NT_STATUS_OK
;
3403 /*******************************************************************
3404 ********************************************************************/
3406 static NTSTATUS
query_dom_info_2(TALLOC_CTX
*mem_ctx
,
3407 struct samr_DomGeneralInformation
*r
,
3408 struct samr_domain_info
*dinfo
)
3417 r
->num_users
= count_sam_users(dinfo
->disp_info
, ACB_NORMAL
);
3418 r
->num_groups
= count_sam_groups(dinfo
->disp_info
);
3419 r
->num_aliases
= count_sam_aliases(dinfo
->disp_info
);
3421 pdb_get_account_policy(PDB_POLICY_TIME_TO_LOGOUT
, &u_logout
);
3423 unix_to_nt_time_abs(&r
->force_logoff_time
, u_logout
);
3425 if (!pdb_get_seq_num(&seq_num
)) {
3426 seq_num
= time(NULL
);
3433 r
->oem_information
.string
= lp_serverstring();
3434 r
->domain_name
.string
= lp_workgroup();
3435 r
->primary
.string
= global_myname();
3436 r
->sequence_num
= seq_num
;
3437 r
->domain_server_state
= DOMAIN_SERVER_ENABLED
;
3438 r
->role
= (enum samr_Role
) samr_get_server_role();
3441 return NT_STATUS_OK
;
3444 /*******************************************************************
3445 ********************************************************************/
3447 static NTSTATUS
query_dom_info_3(TALLOC_CTX
*mem_ctx
,
3448 struct samr_DomInfo3
*r
)
3458 pdb_get_account_policy(PDB_POLICY_TIME_TO_LOGOUT
, &ul
);
3459 u_logout
= (time_t)ul
;
3466 unix_to_nt_time_abs(&r
->force_logoff_time
, u_logout
);
3468 return NT_STATUS_OK
;
3471 /*******************************************************************
3472 ********************************************************************/
3474 static NTSTATUS
query_dom_info_4(TALLOC_CTX
*mem_ctx
,
3475 struct samr_DomOEMInformation
*r
)
3477 r
->oem_information
.string
= lp_serverstring();
3479 return NT_STATUS_OK
;
3482 /*******************************************************************
3483 ********************************************************************/
3485 static NTSTATUS
query_dom_info_5(TALLOC_CTX
*mem_ctx
,
3486 struct samr_DomInfo5
*r
)
3488 r
->domain_name
.string
= get_global_sam_name();
3490 return NT_STATUS_OK
;
3493 /*******************************************************************
3494 ********************************************************************/
3496 static NTSTATUS
query_dom_info_6(TALLOC_CTX
*mem_ctx
,
3497 struct samr_DomInfo6
*r
)
3499 /* NT returns its own name when a PDC. win2k and later
3500 * only the name of the PDC if itself is a BDC (samba4
3502 r
->primary
.string
= global_myname();
3504 return NT_STATUS_OK
;
3507 /*******************************************************************
3508 ********************************************************************/
3510 static NTSTATUS
query_dom_info_7(TALLOC_CTX
*mem_ctx
,
3511 struct samr_DomInfo7
*r
)
3513 r
->role
= (enum samr_Role
) samr_get_server_role();
3515 return NT_STATUS_OK
;
3518 /*******************************************************************
3519 ********************************************************************/
3521 static NTSTATUS
query_dom_info_8(TALLOC_CTX
*mem_ctx
,
3522 struct samr_DomInfo8
*r
)
3530 if (!pdb_get_seq_num(&seq_num
)) {
3531 seq_num
= time(NULL
);
3538 r
->sequence_num
= seq_num
;
3539 r
->domain_create_time
= 0;
3541 return NT_STATUS_OK
;
3544 /*******************************************************************
3545 ********************************************************************/
3547 static NTSTATUS
query_dom_info_9(TALLOC_CTX
*mem_ctx
,
3548 struct samr_DomInfo9
*r
)
3550 r
->domain_server_state
= DOMAIN_SERVER_ENABLED
;
3552 return NT_STATUS_OK
;
3555 /*******************************************************************
3556 ********************************************************************/
3558 static NTSTATUS
query_dom_info_11(TALLOC_CTX
*mem_ctx
,
3559 struct samr_DomGeneralInformation2
*r
,
3560 struct samr_domain_info
*dinfo
)
3563 uint32_t account_policy_temp
;
3564 time_t u_lock_duration
, u_reset_time
;
3566 status
= query_dom_info_2(mem_ctx
, &r
->general
, dinfo
);
3567 if (!NT_STATUS_IS_OK(status
)) {
3575 pdb_get_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION
, &account_policy_temp
);
3576 u_lock_duration
= account_policy_temp
;
3577 if (u_lock_duration
!= -1) {
3578 u_lock_duration
*= 60;
3581 pdb_get_account_policy(PDB_POLICY_RESET_COUNT_TIME
, &account_policy_temp
);
3582 u_reset_time
= account_policy_temp
* 60;
3584 pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT
, &account_policy_temp
);
3585 r
->lockout_threshold
= account_policy_temp
;
3591 unix_to_nt_time_abs(&r
->lockout_duration
, u_lock_duration
);
3592 unix_to_nt_time_abs(&r
->lockout_window
, u_reset_time
);
3594 return NT_STATUS_OK
;
3597 /*******************************************************************
3598 ********************************************************************/
3600 static NTSTATUS
query_dom_info_12(TALLOC_CTX
*mem_ctx
,
3601 struct samr_DomInfo12
*r
)
3603 uint32_t account_policy_temp
;
3604 time_t u_lock_duration
, u_reset_time
;
3610 pdb_get_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION
, &account_policy_temp
);
3611 u_lock_duration
= account_policy_temp
;
3612 if (u_lock_duration
!= -1) {
3613 u_lock_duration
*= 60;
3616 pdb_get_account_policy(PDB_POLICY_RESET_COUNT_TIME
, &account_policy_temp
);
3617 u_reset_time
= account_policy_temp
* 60;
3619 pdb_get_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT
, &account_policy_temp
);
3620 r
->lockout_threshold
= account_policy_temp
;
3626 unix_to_nt_time_abs(&r
->lockout_duration
, u_lock_duration
);
3627 unix_to_nt_time_abs(&r
->lockout_window
, u_reset_time
);
3629 return NT_STATUS_OK
;
3632 /*******************************************************************
3633 ********************************************************************/
3635 static NTSTATUS
query_dom_info_13(TALLOC_CTX
*mem_ctx
,
3636 struct samr_DomInfo13
*r
)
3644 if (!pdb_get_seq_num(&seq_num
)) {
3645 seq_num
= time(NULL
);
3652 r
->sequence_num
= seq_num
;
3653 r
->domain_create_time
= 0;
3654 r
->modified_count_at_last_promotion
= 0;
3656 return NT_STATUS_OK
;
3659 /*******************************************************************
3660 _samr_QueryDomainInfo
3661 ********************************************************************/
3663 NTSTATUS
_samr_QueryDomainInfo(struct pipes_struct
*p
,
3664 struct samr_QueryDomainInfo
*r
)
3666 NTSTATUS status
= NT_STATUS_OK
;
3667 struct samr_domain_info
*dinfo
;
3668 union samr_DomainInfo
*dom_info
;
3670 uint32_t acc_required
;
3672 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__
));
3674 switch (r
->in
.level
) {
3675 case 1: /* DomainPasswordInformation */
3676 case 12: /* DomainLockoutInformation */
3677 /* DOMAIN_READ_PASSWORD_PARAMETERS */
3678 acc_required
= SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
;
3680 case 11: /* DomainGeneralInformation2 */
3681 /* DOMAIN_READ_PASSWORD_PARAMETERS |
3682 * DOMAIN_READ_OTHER_PARAMETERS */
3683 acc_required
= SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
|
3684 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2
;
3686 case 2: /* DomainGeneralInformation */
3687 case 3: /* DomainLogoffInformation */
3688 case 4: /* DomainOemInformation */
3689 case 5: /* DomainReplicationInformation */
3690 case 6: /* DomainReplicationInformation */
3691 case 7: /* DomainServerRoleInformation */
3692 case 8: /* DomainModifiedInformation */
3693 case 9: /* DomainStateInformation */
3694 case 10: /* DomainUasInformation */
3695 case 13: /* DomainModifiedInformation2 */
3696 /* DOMAIN_READ_OTHER_PARAMETERS */
3697 acc_required
= SAMR_DOMAIN_ACCESS_LOOKUP_INFO_2
;
3700 return NT_STATUS_INVALID_INFO_CLASS
;
3703 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
3705 struct samr_domain_info
, &status
);
3706 if (!NT_STATUS_IS_OK(status
)) {
3710 dom_info
= TALLOC_ZERO_P(p
->mem_ctx
, union samr_DomainInfo
);
3712 return NT_STATUS_NO_MEMORY
;
3715 switch (r
->in
.level
) {
3717 status
= query_dom_info_1(p
->mem_ctx
, &dom_info
->info1
);
3720 status
= query_dom_info_2(p
->mem_ctx
, &dom_info
->general
, dinfo
);
3723 status
= query_dom_info_3(p
->mem_ctx
, &dom_info
->info3
);
3726 status
= query_dom_info_4(p
->mem_ctx
, &dom_info
->oem
);
3729 status
= query_dom_info_5(p
->mem_ctx
, &dom_info
->info5
);
3732 status
= query_dom_info_6(p
->mem_ctx
, &dom_info
->info6
);
3735 status
= query_dom_info_7(p
->mem_ctx
, &dom_info
->info7
);
3738 status
= query_dom_info_8(p
->mem_ctx
, &dom_info
->info8
);
3741 status
= query_dom_info_9(p
->mem_ctx
, &dom_info
->info9
);
3744 status
= query_dom_info_11(p
->mem_ctx
, &dom_info
->general2
, dinfo
);
3747 status
= query_dom_info_12(p
->mem_ctx
, &dom_info
->info12
);
3750 status
= query_dom_info_13(p
->mem_ctx
, &dom_info
->info13
);
3753 return NT_STATUS_INVALID_INFO_CLASS
;
3756 if (!NT_STATUS_IS_OK(status
)) {
3760 *r
->out
.info
= dom_info
;
3762 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__
));
3767 /* W2k3 seems to use the same check for all 3 objects that can be created via
3768 * SAMR, if you try to create for example "Dialup" as an alias it says
3769 * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
3772 static NTSTATUS
can_create(TALLOC_CTX
*mem_ctx
, const char *new_name
)
3774 enum lsa_SidType type
;
3777 DEBUG(10, ("Checking whether [%s] can be created\n", new_name
));
3780 /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
3781 * whether the name already exists */
3782 result
= lookup_name(mem_ctx
, new_name
, LOOKUP_NAME_LOCAL
,
3783 NULL
, NULL
, NULL
, &type
);
3787 DEBUG(10, ("%s does not exist, can create it\n", new_name
));
3788 return NT_STATUS_OK
;
3791 DEBUG(5, ("trying to create %s, exists as %s\n",
3792 new_name
, sid_type_lookup(type
)));
3794 if (type
== SID_NAME_DOM_GRP
) {
3795 return NT_STATUS_GROUP_EXISTS
;
3797 if (type
== SID_NAME_ALIAS
) {
3798 return NT_STATUS_ALIAS_EXISTS
;
3801 /* Yes, the default is NT_STATUS_USER_EXISTS */
3802 return NT_STATUS_USER_EXISTS
;
3805 /*******************************************************************
3807 ********************************************************************/
3809 NTSTATUS
_samr_CreateUser2(struct pipes_struct
*p
,
3810 struct samr_CreateUser2
*r
)
3812 const char *account
= NULL
;
3814 uint32_t acb_info
= r
->in
.acct_flags
;
3815 struct samr_domain_info
*dinfo
;
3816 struct samr_user_info
*uinfo
;
3819 struct security_descriptor
*psd
;
3821 /* check this, when giving away 'add computer to domain' privs */
3822 uint32 des_access
= GENERIC_RIGHTS_USER_ALL_ACCESS
;
3823 bool can_add_account
= False
;
3825 /* Which privilege is needed to override the ACL? */
3826 enum sec_privilege needed_priv
= SEC_PRIV_INVALID
;
3828 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
3829 SAMR_DOMAIN_ACCESS_CREATE_USER
, NULL
,
3830 struct samr_domain_info
, &nt_status
);
3831 if (!NT_STATUS_IS_OK(nt_status
)) {
3835 if (sid_check_is_builtin(&dinfo
->sid
)) {
3836 DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
3837 return NT_STATUS_ACCESS_DENIED
;
3840 if (!(acb_info
== ACB_NORMAL
|| acb_info
== ACB_DOMTRUST
||
3841 acb_info
== ACB_WSTRUST
|| acb_info
== ACB_SVRTRUST
)) {
3842 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3843 this parameter is not an account type */
3844 return NT_STATUS_INVALID_PARAMETER
;
3847 account
= r
->in
.account_name
->string
;
3848 if (account
== NULL
) {
3849 return NT_STATUS_NO_MEMORY
;
3852 nt_status
= can_create(p
->mem_ctx
, account
);
3853 if (!NT_STATUS_IS_OK(nt_status
)) {
3857 /* determine which user right we need to check based on the acb_info */
3859 if (geteuid() == sec_initial_uid()) {
3860 can_add_account
= true;
3861 } else if (acb_info
& ACB_WSTRUST
) {
3862 needed_priv
= SEC_PRIV_MACHINE_ACCOUNT
;
3863 can_add_account
= security_token_has_privilege(p
->session_info
->security_token
, SEC_PRIV_MACHINE_ACCOUNT
);
3864 } else if (acb_info
& ACB_NORMAL
&&
3865 (account
[strlen(account
)-1] != '$')) {
3866 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3867 account for domain trusts and changes the ACB flags later */
3868 needed_priv
= SEC_PRIV_ADD_USERS
;
3869 can_add_account
= security_token_has_privilege(p
->session_info
->security_token
, SEC_PRIV_ADD_USERS
);
3870 } else if (lp_enable_privileges()) {
3871 /* implicit assumption of a BDC or domain trust account here
3872 * (we already check the flags earlier) */
3873 /* only Domain Admins can add a BDC or domain trust */
3874 can_add_account
= nt_token_check_domain_rid(
3875 p
->session_info
->security_token
,
3876 DOMAIN_RID_ADMINS
);
3879 DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3880 uidtoname(p
->session_info
->utok
.uid
),
3881 can_add_account
? "True":"False" ));
3883 if (!can_add_account
) {
3884 return NT_STATUS_ACCESS_DENIED
;
3887 /********** BEGIN Admin BLOCK **********/
3890 nt_status
= pdb_create_user(p
->mem_ctx
, account
, acb_info
,
3894 /********** END Admin BLOCK **********/
3896 /* now check for failure */
3898 if ( !NT_STATUS_IS_OK(nt_status
) )
3901 /* Get the user's SID */
3903 sid_compose(&sid
, get_global_sam_sid(), *r
->out
.rid
);
3905 map_max_allowed_access(p
->session_info
->security_token
,
3906 &p
->session_info
->utok
,
3909 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &usr_generic_mapping
,
3910 &sid
, SAMR_USR_RIGHTS_WRITE_PW
);
3911 se_map_generic(&des_access
, &usr_generic_mapping
);
3914 * JRA - TESTME. We just created this user so we
3915 * had rights to create them. Do we need to check
3916 * any further access on this object ? Can't we
3917 * just assume we have all the rights we need ?
3920 nt_status
= access_check_object(psd
, p
->session_info
->security_token
,
3921 needed_priv
, SEC_PRIV_INVALID
,
3922 GENERIC_RIGHTS_USER_WRITE
, des_access
,
3923 &acc_granted
, "_samr_CreateUser2");
3925 if ( !NT_STATUS_IS_OK(nt_status
) ) {
3929 uinfo
= policy_handle_create(p
, r
->out
.user_handle
, acc_granted
,
3930 struct samr_user_info
, &nt_status
);
3931 if (!NT_STATUS_IS_OK(nt_status
)) {
3936 /* After a "set" ensure we have no cached display info. */
3937 force_flush_samr_cache(&sid
);
3939 *r
->out
.access_granted
= acc_granted
;
3941 return NT_STATUS_OK
;
3944 /****************************************************************
3945 ****************************************************************/
3947 NTSTATUS
_samr_CreateUser(struct pipes_struct
*p
,
3948 struct samr_CreateUser
*r
)
3950 struct samr_CreateUser2 c
;
3951 uint32_t access_granted
;
3953 c
.in
.domain_handle
= r
->in
.domain_handle
;
3954 c
.in
.account_name
= r
->in
.account_name
;
3955 c
.in
.acct_flags
= ACB_NORMAL
;
3956 c
.in
.access_mask
= r
->in
.access_mask
;
3957 c
.out
.user_handle
= r
->out
.user_handle
;
3958 c
.out
.access_granted
= &access_granted
;
3959 c
.out
.rid
= r
->out
.rid
;
3961 return _samr_CreateUser2(p
, &c
);
3964 /*******************************************************************
3966 ********************************************************************/
3968 NTSTATUS
_samr_Connect(struct pipes_struct
*p
,
3969 struct samr_Connect
*r
)
3971 struct samr_connect_info
*info
;
3972 uint32_t acc_granted
;
3973 struct policy_handle hnd
;
3974 uint32 des_access
= r
->in
.access_mask
;
3979 if (!pipe_access_check(p
)) {
3980 DEBUG(3, ("access denied to _samr_Connect\n"));
3981 return NT_STATUS_ACCESS_DENIED
;
3984 /* don't give away the farm but this is probably ok. The SAMR_ACCESS_ENUM_DOMAINS
3985 was observed from a win98 client trying to enumerate users (when configured
3986 user level access control on shares) --jerry */
3988 map_max_allowed_access(p
->session_info
->security_token
,
3989 &p
->session_info
->utok
,
3992 se_map_generic( &des_access
, &sam_generic_mapping
);
3994 acc_granted
= des_access
& (SAMR_ACCESS_ENUM_DOMAINS
3995 |SAMR_ACCESS_LOOKUP_DOMAIN
);
3997 /* set up the SAMR connect_anon response */
3999 info
= policy_handle_create(p
, &hnd
, acc_granted
,
4000 struct samr_connect_info
,
4002 if (!NT_STATUS_IS_OK(status
)) {
4006 *r
->out
.connect_handle
= hnd
;
4007 return NT_STATUS_OK
;
4010 /*******************************************************************
4012 ********************************************************************/
4014 NTSTATUS
_samr_Connect2(struct pipes_struct
*p
,
4015 struct samr_Connect2
*r
)
4017 struct samr_connect_info
*info
= NULL
;
4018 struct policy_handle hnd
;
4019 struct security_descriptor
*psd
= NULL
;
4021 uint32 des_access
= r
->in
.access_mask
;
4024 const char *fn
= "_samr_Connect2";
4027 case NDR_SAMR_CONNECT2
:
4028 fn
= "_samr_Connect2";
4030 case NDR_SAMR_CONNECT3
:
4031 fn
= "_samr_Connect3";
4033 case NDR_SAMR_CONNECT4
:
4034 fn
= "_samr_Connect4";
4036 case NDR_SAMR_CONNECT5
:
4037 fn
= "_samr_Connect5";
4041 DEBUG(5,("%s: %d\n", fn
, __LINE__
));
4045 if (!pipe_access_check(p
)) {
4046 DEBUG(3, ("access denied to %s\n", fn
));
4047 return NT_STATUS_ACCESS_DENIED
;
4050 map_max_allowed_access(p
->session_info
->security_token
,
4051 &p
->session_info
->utok
,
4054 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &sam_generic_mapping
, NULL
, 0);
4055 se_map_generic(&des_access
, &sam_generic_mapping
);
4057 nt_status
= access_check_object(psd
, p
->session_info
->security_token
,
4058 SEC_PRIV_INVALID
, SEC_PRIV_INVALID
,
4059 0, des_access
, &acc_granted
, fn
);
4061 if ( !NT_STATUS_IS_OK(nt_status
) )
4064 info
= policy_handle_create(p
, &hnd
, acc_granted
,
4065 struct samr_connect_info
, &nt_status
);
4066 if (!NT_STATUS_IS_OK(nt_status
)) {
4070 DEBUG(5,("%s: %d\n", fn
, __LINE__
));
4072 *r
->out
.connect_handle
= hnd
;
4073 return NT_STATUS_OK
;
4076 /****************************************************************
4078 ****************************************************************/
4080 NTSTATUS
_samr_Connect3(struct pipes_struct
*p
,
4081 struct samr_Connect3
*r
)
4083 struct samr_Connect2 c
;
4085 c
.in
.system_name
= r
->in
.system_name
;
4086 c
.in
.access_mask
= r
->in
.access_mask
;
4087 c
.out
.connect_handle
= r
->out
.connect_handle
;
4089 return _samr_Connect2(p
, &c
);
4092 /*******************************************************************
4094 ********************************************************************/
4096 NTSTATUS
_samr_Connect4(struct pipes_struct
*p
,
4097 struct samr_Connect4
*r
)
4099 struct samr_Connect2 c
;
4101 c
.in
.system_name
= r
->in
.system_name
;
4102 c
.in
.access_mask
= r
->in
.access_mask
;
4103 c
.out
.connect_handle
= r
->out
.connect_handle
;
4105 return _samr_Connect2(p
, &c
);
4108 /*******************************************************************
4110 ********************************************************************/
4112 NTSTATUS
_samr_Connect5(struct pipes_struct
*p
,
4113 struct samr_Connect5
*r
)
4116 struct samr_Connect2 c
;
4117 struct samr_ConnectInfo1 info1
;
4119 info1
.client_version
= SAMR_CONNECT_AFTER_W2K
;
4122 c
.in
.system_name
= r
->in
.system_name
;
4123 c
.in
.access_mask
= r
->in
.access_mask
;
4124 c
.out
.connect_handle
= r
->out
.connect_handle
;
4126 *r
->out
.level_out
= 1;
4128 status
= _samr_Connect2(p
, &c
);
4129 if (!NT_STATUS_IS_OK(status
)) {
4133 r
->out
.info_out
->info1
= info1
;
4135 return NT_STATUS_OK
;
4138 /**********************************************************************
4140 **********************************************************************/
4142 NTSTATUS
_samr_LookupDomain(struct pipes_struct
*p
,
4143 struct samr_LookupDomain
*r
)
4146 struct samr_connect_info
*info
;
4147 const char *domain_name
;
4148 struct dom_sid
*sid
= NULL
;
4150 /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
4151 Reverted that change so we will work with RAS servers again */
4153 info
= policy_handle_find(p
, r
->in
.connect_handle
,
4154 SAMR_ACCESS_LOOKUP_DOMAIN
, NULL
,
4155 struct samr_connect_info
,
4157 if (!NT_STATUS_IS_OK(status
)) {
4161 domain_name
= r
->in
.domain_name
->string
;
4163 return NT_STATUS_INVALID_PARAMETER
;
4166 sid
= TALLOC_ZERO_P(p
->mem_ctx
, struct dom_sid2
);
4168 return NT_STATUS_NO_MEMORY
;
4171 if (strequal(domain_name
, builtin_domain_name())) {
4172 sid_copy(sid
, &global_sid_Builtin
);
4174 if (!secrets_fetch_domain_sid(domain_name
, sid
)) {
4175 status
= NT_STATUS_NO_SUCH_DOMAIN
;
4179 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name
,
4180 sid_string_dbg(sid
)));
4187 /**********************************************************************
4189 **********************************************************************/
4191 NTSTATUS
_samr_EnumDomains(struct pipes_struct
*p
,
4192 struct samr_EnumDomains
*r
)
4195 struct samr_connect_info
*info
;
4196 uint32_t num_entries
= 2;
4197 struct samr_SamEntry
*entry_array
= NULL
;
4198 struct samr_SamArray
*sam
;
4200 info
= policy_handle_find(p
, r
->in
.connect_handle
,
4201 SAMR_ACCESS_ENUM_DOMAINS
, NULL
,
4202 struct samr_connect_info
, &status
);
4203 if (!NT_STATUS_IS_OK(status
)) {
4207 sam
= TALLOC_ZERO_P(p
->mem_ctx
, struct samr_SamArray
);
4209 return NT_STATUS_NO_MEMORY
;
4212 entry_array
= TALLOC_ZERO_ARRAY(p
->mem_ctx
,
4213 struct samr_SamEntry
,
4216 return NT_STATUS_NO_MEMORY
;
4219 entry_array
[0].idx
= 0;
4220 init_lsa_String(&entry_array
[0].name
, get_global_sam_name());
4222 entry_array
[1].idx
= 1;
4223 init_lsa_String(&entry_array
[1].name
, "Builtin");
4225 sam
->count
= num_entries
;
4226 sam
->entries
= entry_array
;
4229 *r
->out
.num_entries
= num_entries
;
4234 /*******************************************************************
4236 ********************************************************************/
4238 NTSTATUS
_samr_OpenAlias(struct pipes_struct
*p
,
4239 struct samr_OpenAlias
*r
)
4242 uint32 alias_rid
= r
->in
.rid
;
4243 struct samr_alias_info
*ainfo
;
4244 struct samr_domain_info
*dinfo
;
4245 struct security_descriptor
*psd
= NULL
;
4247 uint32 des_access
= r
->in
.access_mask
;
4251 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
4252 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
, NULL
,
4253 struct samr_domain_info
, &status
);
4254 if (!NT_STATUS_IS_OK(status
)) {
4258 /* append the alias' RID to it */
4260 if (!sid_compose(&sid
, &dinfo
->sid
, alias_rid
))
4261 return NT_STATUS_NO_SUCH_ALIAS
;
4263 /*check if access can be granted as requested by client. */
4265 map_max_allowed_access(p
->session_info
->security_token
,
4266 &p
->session_info
->utok
,
4269 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &ali_generic_mapping
, NULL
, 0);
4270 se_map_generic(&des_access
,&ali_generic_mapping
);
4272 status
= access_check_object(psd
, p
->session_info
->security_token
,
4273 SEC_PRIV_ADD_USERS
, SEC_PRIV_INVALID
,
4274 GENERIC_RIGHTS_ALIAS_ALL_ACCESS
,
4275 des_access
, &acc_granted
, "_samr_OpenAlias");
4277 if ( !NT_STATUS_IS_OK(status
) )
4281 /* Check we actually have the requested alias */
4282 enum lsa_SidType type
;
4287 result
= lookup_sid(NULL
, &sid
, NULL
, NULL
, &type
);
4290 if (!result
|| (type
!= SID_NAME_ALIAS
)) {
4291 return NT_STATUS_NO_SUCH_ALIAS
;
4294 /* make sure there is a mapping */
4296 if ( !sid_to_gid( &sid
, &gid
) ) {
4297 return NT_STATUS_NO_SUCH_ALIAS
;
4302 ainfo
= policy_handle_create(p
, r
->out
.alias_handle
, acc_granted
,
4303 struct samr_alias_info
, &status
);
4304 if (!NT_STATUS_IS_OK(status
)) {
4309 return NT_STATUS_OK
;
4312 /*******************************************************************
4314 ********************************************************************/
4316 static NTSTATUS
set_user_info_2(TALLOC_CTX
*mem_ctx
,
4317 struct samr_UserInfo2
*id2
,
4321 DEBUG(5,("set_user_info_2: NULL id2\n"));
4322 return NT_STATUS_ACCESS_DENIED
;
4325 copy_id2_to_sam_passwd(pwd
, id2
);
4327 return pdb_update_sam_account(pwd
);
4330 /*******************************************************************
4332 ********************************************************************/
4334 static NTSTATUS
set_user_info_4(TALLOC_CTX
*mem_ctx
,
4335 struct samr_UserInfo4
*id4
,
4339 DEBUG(5,("set_user_info_2: NULL id4\n"));
4340 return NT_STATUS_ACCESS_DENIED
;
4343 copy_id4_to_sam_passwd(pwd
, id4
);
4345 return pdb_update_sam_account(pwd
);
4348 /*******************************************************************
4350 ********************************************************************/
4352 static NTSTATUS
set_user_info_6(TALLOC_CTX
*mem_ctx
,
4353 struct samr_UserInfo6
*id6
,
4357 DEBUG(5,("set_user_info_6: NULL id6\n"));
4358 return NT_STATUS_ACCESS_DENIED
;
4361 copy_id6_to_sam_passwd(pwd
, id6
);
4363 return pdb_update_sam_account(pwd
);
4366 /*******************************************************************
4368 ********************************************************************/
4370 static NTSTATUS
set_user_info_7(TALLOC_CTX
*mem_ctx
,
4371 struct samr_UserInfo7
*id7
,
4377 DEBUG(5, ("set_user_info_7: NULL id7\n"));
4378 return NT_STATUS_ACCESS_DENIED
;
4381 if (!id7
->account_name
.string
) {
4382 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
4383 return NT_STATUS_ACCESS_DENIED
;
4386 /* check to see if the new username already exists. Note: we can't
4387 reliably lock all backends, so there is potentially the
4388 possibility that a user can be created in between this check and
4389 the rename. The rename should fail, but may not get the
4390 exact same failure status code. I think this is small enough
4391 of a window for this type of operation and the results are
4392 simply that the rename fails with a slightly different status
4393 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
4395 rc
= can_create(mem_ctx
, id7
->account_name
.string
);
4397 /* when there is nothing to change, we're done here */
4398 if (NT_STATUS_EQUAL(rc
, NT_STATUS_USER_EXISTS
) &&
4399 strequal(id7
->account_name
.string
, pdb_get_username(pwd
))) {
4400 return NT_STATUS_OK
;
4402 if (!NT_STATUS_IS_OK(rc
)) {
4406 rc
= pdb_rename_sam_account(pwd
, id7
->account_name
.string
);
4411 /*******************************************************************
4413 ********************************************************************/
4415 static NTSTATUS
set_user_info_8(TALLOC_CTX
*mem_ctx
,
4416 struct samr_UserInfo8
*id8
,
4420 DEBUG(5,("set_user_info_8: NULL id8\n"));
4421 return NT_STATUS_ACCESS_DENIED
;
4424 copy_id8_to_sam_passwd(pwd
, id8
);
4426 return pdb_update_sam_account(pwd
);
4429 /*******************************************************************
4431 ********************************************************************/
4433 static NTSTATUS
set_user_info_10(TALLOC_CTX
*mem_ctx
,
4434 struct samr_UserInfo10
*id10
,
4438 DEBUG(5,("set_user_info_8: NULL id10\n"));
4439 return NT_STATUS_ACCESS_DENIED
;
4442 copy_id10_to_sam_passwd(pwd
, id10
);
4444 return pdb_update_sam_account(pwd
);
4447 /*******************************************************************
4449 ********************************************************************/
4451 static NTSTATUS
set_user_info_11(TALLOC_CTX
*mem_ctx
,
4452 struct samr_UserInfo11
*id11
,
4456 DEBUG(5,("set_user_info_11: NULL id11\n"));
4457 return NT_STATUS_ACCESS_DENIED
;
4460 copy_id11_to_sam_passwd(pwd
, id11
);
4462 return pdb_update_sam_account(pwd
);
4465 /*******************************************************************
4467 ********************************************************************/
4469 static NTSTATUS
set_user_info_12(TALLOC_CTX
*mem_ctx
,
4470 struct samr_UserInfo12
*id12
,
4474 DEBUG(5,("set_user_info_12: NULL id12\n"));
4475 return NT_STATUS_ACCESS_DENIED
;
4478 copy_id12_to_sam_passwd(pwd
, id12
);
4480 return pdb_update_sam_account(pwd
);
4483 /*******************************************************************
4485 ********************************************************************/
4487 static NTSTATUS
set_user_info_13(TALLOC_CTX
*mem_ctx
,
4488 struct samr_UserInfo13
*id13
,
4492 DEBUG(5,("set_user_info_13: NULL id13\n"));
4493 return NT_STATUS_ACCESS_DENIED
;
4496 copy_id13_to_sam_passwd(pwd
, id13
);
4498 return pdb_update_sam_account(pwd
);
4501 /*******************************************************************
4503 ********************************************************************/
4505 static NTSTATUS
set_user_info_14(TALLOC_CTX
*mem_ctx
,
4506 struct samr_UserInfo14
*id14
,
4510 DEBUG(5,("set_user_info_14: NULL id14\n"));
4511 return NT_STATUS_ACCESS_DENIED
;
4514 copy_id14_to_sam_passwd(pwd
, id14
);
4516 return pdb_update_sam_account(pwd
);
4519 /*******************************************************************
4521 ********************************************************************/
4523 static NTSTATUS
set_user_info_16(TALLOC_CTX
*mem_ctx
,
4524 struct samr_UserInfo16
*id16
,
4528 DEBUG(5,("set_user_info_16: NULL id16\n"));
4529 return NT_STATUS_ACCESS_DENIED
;
4532 copy_id16_to_sam_passwd(pwd
, id16
);
4534 return pdb_update_sam_account(pwd
);
4537 /*******************************************************************
4539 ********************************************************************/
4541 static NTSTATUS
set_user_info_17(TALLOC_CTX
*mem_ctx
,
4542 struct samr_UserInfo17
*id17
,
4546 DEBUG(5,("set_user_info_17: NULL id17\n"));
4547 return NT_STATUS_ACCESS_DENIED
;
4550 copy_id17_to_sam_passwd(pwd
, id17
);
4552 return pdb_update_sam_account(pwd
);
4555 /*******************************************************************
4557 ********************************************************************/
4559 static NTSTATUS
set_user_info_18(struct samr_UserInfo18
*id18
,
4560 TALLOC_CTX
*mem_ctx
,
4561 DATA_BLOB
*session_key
,
4565 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
4566 return NT_STATUS_INVALID_PARAMETER
;
4569 if (id18
->nt_pwd_active
|| id18
->lm_pwd_active
) {
4570 if (!session_key
->length
) {
4571 return NT_STATUS_NO_USER_SESSION_KEY
;
4575 if (id18
->nt_pwd_active
) {
4579 in
= data_blob_const(id18
->nt_pwd
.hash
, 16);
4580 out
= data_blob_talloc_zero(mem_ctx
, 16);
4582 sess_crypt_blob(&out
, &in
, session_key
, false);
4584 if (!pdb_set_nt_passwd(pwd
, out
.data
, PDB_CHANGED
)) {
4585 return NT_STATUS_ACCESS_DENIED
;
4588 pdb_set_pass_last_set_time(pwd
, time(NULL
), PDB_CHANGED
);
4591 if (id18
->lm_pwd_active
) {
4595 in
= data_blob_const(id18
->lm_pwd
.hash
, 16);
4596 out
= data_blob_talloc_zero(mem_ctx
, 16);
4598 sess_crypt_blob(&out
, &in
, session_key
, false);
4600 if (!pdb_set_lanman_passwd(pwd
, out
.data
, PDB_CHANGED
)) {
4601 return NT_STATUS_ACCESS_DENIED
;
4604 pdb_set_pass_last_set_time(pwd
, time(NULL
), PDB_CHANGED
);
4607 copy_id18_to_sam_passwd(pwd
, id18
);
4609 return pdb_update_sam_account(pwd
);
4612 /*******************************************************************
4614 ********************************************************************/
4616 static NTSTATUS
set_user_info_20(TALLOC_CTX
*mem_ctx
,
4617 struct samr_UserInfo20
*id20
,
4621 DEBUG(5,("set_user_info_20: NULL id20\n"));
4622 return NT_STATUS_ACCESS_DENIED
;
4625 copy_id20_to_sam_passwd(pwd
, id20
);
4627 return pdb_update_sam_account(pwd
);
4630 /*******************************************************************
4632 ********************************************************************/
4634 static NTSTATUS
set_user_info_21(struct samr_UserInfo21
*id21
,
4635 TALLOC_CTX
*mem_ctx
,
4636 DATA_BLOB
*session_key
,
4642 DEBUG(5, ("set_user_info_21: NULL id21\n"));
4643 return NT_STATUS_INVALID_PARAMETER
;
4646 if (id21
->fields_present
== 0) {
4647 return NT_STATUS_INVALID_PARAMETER
;
4650 if (id21
->fields_present
& SAMR_FIELD_LAST_PWD_CHANGE
) {
4651 return NT_STATUS_ACCESS_DENIED
;
4654 if (id21
->fields_present
& SAMR_FIELD_NT_PASSWORD_PRESENT
) {
4655 if (id21
->nt_password_set
) {
4658 if ((id21
->nt_owf_password
.length
!= 16) ||
4659 (id21
->nt_owf_password
.size
!= 16)) {
4660 return NT_STATUS_INVALID_PARAMETER
;
4663 if (!session_key
->length
) {
4664 return NT_STATUS_NO_USER_SESSION_KEY
;
4667 in
= data_blob_const(id21
->nt_owf_password
.array
, 16);
4668 out
= data_blob_talloc_zero(mem_ctx
, 16);
4670 sess_crypt_blob(&out
, &in
, session_key
, false);
4672 pdb_set_nt_passwd(pwd
, out
.data
, PDB_CHANGED
);
4673 pdb_set_pass_last_set_time(pwd
, time(NULL
), PDB_CHANGED
);
4677 if (id21
->fields_present
& SAMR_FIELD_LM_PASSWORD_PRESENT
) {
4678 if (id21
->lm_password_set
) {
4681 if ((id21
->lm_owf_password
.length
!= 16) ||
4682 (id21
->lm_owf_password
.size
!= 16)) {
4683 return NT_STATUS_INVALID_PARAMETER
;
4686 if (!session_key
->length
) {
4687 return NT_STATUS_NO_USER_SESSION_KEY
;
4690 in
= data_blob_const(id21
->lm_owf_password
.array
, 16);
4691 out
= data_blob_talloc_zero(mem_ctx
, 16);
4693 sess_crypt_blob(&out
, &in
, session_key
, false);
4695 pdb_set_lanman_passwd(pwd
, out
.data
, PDB_CHANGED
);
4696 pdb_set_pass_last_set_time(pwd
, time(NULL
), PDB_CHANGED
);
4700 /* we need to separately check for an account rename first */
4702 if (id21
->account_name
.string
&&
4703 (!strequal(id21
->account_name
.string
, pdb_get_username(pwd
))))
4706 /* check to see if the new username already exists. Note: we can't
4707 reliably lock all backends, so there is potentially the
4708 possibility that a user can be created in between this check and
4709 the rename. The rename should fail, but may not get the
4710 exact same failure status code. I think this is small enough
4711 of a window for this type of operation and the results are
4712 simply that the rename fails with a slightly different status
4713 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
4715 status
= can_create(mem_ctx
, id21
->account_name
.string
);
4716 if (!NT_STATUS_IS_OK(status
)) {
4720 status
= pdb_rename_sam_account(pwd
, id21
->account_name
.string
);
4722 if (!NT_STATUS_IS_OK(status
)) {
4723 DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
4724 nt_errstr(status
)));
4728 /* set the new username so that later
4729 functions can work on the new account */
4730 pdb_set_username(pwd
, id21
->account_name
.string
, PDB_SET
);
4733 copy_id21_to_sam_passwd("INFO_21", pwd
, id21
);
4736 * The funny part about the previous two calls is
4737 * that pwd still has the password hashes from the
4738 * passdb entry. These have not been updated from
4739 * id21. I don't know if they need to be set. --jerry
4742 if ( IS_SAM_CHANGED(pwd
, PDB_GROUPSID
) ) {
4743 status
= pdb_set_unix_primary_group(mem_ctx
, pwd
);
4744 if ( !NT_STATUS_IS_OK(status
) ) {
4749 /* Don't worry about writing out the user account since the
4750 primary group SID is generated solely from the user's Unix
4753 /* write the change out */
4754 if(!NT_STATUS_IS_OK(status
= pdb_update_sam_account(pwd
))) {
4758 return NT_STATUS_OK
;
4761 /*******************************************************************
4763 ********************************************************************/
4765 static NTSTATUS
set_user_info_23(TALLOC_CTX
*mem_ctx
,
4766 struct samr_UserInfo23
*id23
,
4770 char *plaintext_buf
= NULL
;
4776 DEBUG(5, ("set_user_info_23: NULL id23\n"));
4777 return NT_STATUS_INVALID_PARAMETER
;
4780 if (id23
->info
.fields_present
== 0) {
4781 return NT_STATUS_INVALID_PARAMETER
;
4784 if (id23
->info
.fields_present
& SAMR_FIELD_LAST_PWD_CHANGE
) {
4785 return NT_STATUS_ACCESS_DENIED
;
4788 if ((id23
->info
.fields_present
& SAMR_FIELD_NT_PASSWORD_PRESENT
) ||
4789 (id23
->info
.fields_present
& SAMR_FIELD_LM_PASSWORD_PRESENT
)) {
4791 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
4792 pdb_get_username(pwd
)));
4794 if (!decode_pw_buffer(mem_ctx
,
4795 id23
->password
.data
,
4799 return NT_STATUS_WRONG_PASSWORD
;
4802 if (!pdb_set_plaintext_passwd (pwd
, plaintext_buf
)) {
4803 return NT_STATUS_ACCESS_DENIED
;
4807 copy_id23_to_sam_passwd(pwd
, id23
);
4809 acct_ctrl
= pdb_get_acct_ctrl(pwd
);
4811 /* if it's a trust account, don't update /etc/passwd */
4812 if ( ( (acct_ctrl
& ACB_DOMTRUST
) == ACB_DOMTRUST
) ||
4813 ( (acct_ctrl
& ACB_WSTRUST
) == ACB_WSTRUST
) ||
4814 ( (acct_ctrl
& ACB_SVRTRUST
) == ACB_SVRTRUST
) ) {
4815 DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n"));
4816 } else if (plaintext_buf
) {
4817 /* update the UNIX password */
4818 if (lp_unix_password_sync() ) {
4819 struct passwd
*passwd
;
4820 if (pdb_get_username(pwd
) == NULL
) {
4821 DEBUG(1, ("chgpasswd: User without name???\n"));
4822 return NT_STATUS_ACCESS_DENIED
;
4825 passwd
= Get_Pwnam_alloc(pwd
, pdb_get_username(pwd
));
4826 if (passwd
== NULL
) {
4827 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4830 if(!chgpasswd(pdb_get_username(pwd
), rhost
,
4831 passwd
, "", plaintext_buf
, True
)) {
4832 return NT_STATUS_ACCESS_DENIED
;
4834 TALLOC_FREE(passwd
);
4838 if (plaintext_buf
) {
4839 memset(plaintext_buf
, '\0', strlen(plaintext_buf
));
4842 if (IS_SAM_CHANGED(pwd
, PDB_GROUPSID
) &&
4843 (!NT_STATUS_IS_OK(status
= pdb_set_unix_primary_group(mem_ctx
,
4848 if(!NT_STATUS_IS_OK(status
= pdb_update_sam_account(pwd
))) {
4852 return NT_STATUS_OK
;
4855 /*******************************************************************
4857 ********************************************************************/
4859 static bool set_user_info_pw(uint8
*pass
, const char *rhost
, struct samu
*pwd
)
4862 char *plaintext_buf
= NULL
;
4865 DEBUG(5, ("Attempting administrator password change for user %s\n",
4866 pdb_get_username(pwd
)));
4868 acct_ctrl
= pdb_get_acct_ctrl(pwd
);
4870 if (!decode_pw_buffer(talloc_tos(),
4878 if (!pdb_set_plaintext_passwd (pwd
, plaintext_buf
)) {
4882 /* if it's a trust account, don't update /etc/passwd */
4883 if ( ( (acct_ctrl
& ACB_DOMTRUST
) == ACB_DOMTRUST
) ||
4884 ( (acct_ctrl
& ACB_WSTRUST
) == ACB_WSTRUST
) ||
4885 ( (acct_ctrl
& ACB_SVRTRUST
) == ACB_SVRTRUST
) ) {
4886 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
4888 /* update the UNIX password */
4889 if (lp_unix_password_sync()) {
4890 struct passwd
*passwd
;
4892 if (pdb_get_username(pwd
) == NULL
) {
4893 DEBUG(1, ("chgpasswd: User without name???\n"));
4897 passwd
= Get_Pwnam_alloc(pwd
, pdb_get_username(pwd
));
4898 if (passwd
== NULL
) {
4899 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4902 if(!chgpasswd(pdb_get_username(pwd
), rhost
, passwd
,
4903 "", plaintext_buf
, True
)) {
4906 TALLOC_FREE(passwd
);
4910 memset(plaintext_buf
, '\0', strlen(plaintext_buf
));
4912 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4917 /*******************************************************************
4919 ********************************************************************/
4921 static NTSTATUS
set_user_info_24(TALLOC_CTX
*mem_ctx
,
4923 struct samr_UserInfo24
*id24
,
4929 DEBUG(5, ("set_user_info_24: NULL id24\n"));
4930 return NT_STATUS_INVALID_PARAMETER
;
4933 if (!set_user_info_pw(id24
->password
.data
, rhost
, pwd
)) {
4934 return NT_STATUS_WRONG_PASSWORD
;
4937 copy_id24_to_sam_passwd(pwd
, id24
);
4939 status
= pdb_update_sam_account(pwd
);
4940 if (!NT_STATUS_IS_OK(status
)) {
4944 return NT_STATUS_OK
;
4947 /*******************************************************************
4949 ********************************************************************/
4951 static NTSTATUS
set_user_info_25(TALLOC_CTX
*mem_ctx
,
4953 struct samr_UserInfo25
*id25
,
4959 DEBUG(5, ("set_user_info_25: NULL id25\n"));
4960 return NT_STATUS_INVALID_PARAMETER
;
4963 if (id25
->info
.fields_present
== 0) {
4964 return NT_STATUS_INVALID_PARAMETER
;
4967 if (id25
->info
.fields_present
& SAMR_FIELD_LAST_PWD_CHANGE
) {
4968 return NT_STATUS_ACCESS_DENIED
;
4971 if ((id25
->info
.fields_present
& SAMR_FIELD_NT_PASSWORD_PRESENT
) ||
4972 (id25
->info
.fields_present
& SAMR_FIELD_LM_PASSWORD_PRESENT
)) {
4974 if (!set_user_info_pw(id25
->password
.data
, rhost
, pwd
)) {
4975 return NT_STATUS_WRONG_PASSWORD
;
4979 copy_id25_to_sam_passwd(pwd
, id25
);
4981 /* write the change out */
4982 if(!NT_STATUS_IS_OK(status
= pdb_update_sam_account(pwd
))) {
4987 * We need to "pdb_update_sam_account" before the unix primary group
4988 * is set, because the idealx scripts would also change the
4989 * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4990 * the delete explicit / add explicit, which would then fail to find
4991 * the previous primaryGroupSid value.
4994 if ( IS_SAM_CHANGED(pwd
, PDB_GROUPSID
) ) {
4995 status
= pdb_set_unix_primary_group(mem_ctx
, pwd
);
4996 if ( !NT_STATUS_IS_OK(status
) ) {
5001 return NT_STATUS_OK
;
5004 /*******************************************************************
5006 ********************************************************************/
5008 static NTSTATUS
set_user_info_26(TALLOC_CTX
*mem_ctx
,
5010 struct samr_UserInfo26
*id26
,
5016 DEBUG(5, ("set_user_info_26: NULL id26\n"));
5017 return NT_STATUS_INVALID_PARAMETER
;
5020 if (!set_user_info_pw(id26
->password
.data
, rhost
, pwd
)) {
5021 return NT_STATUS_WRONG_PASSWORD
;
5024 copy_id26_to_sam_passwd(pwd
, id26
);
5026 status
= pdb_update_sam_account(pwd
);
5027 if (!NT_STATUS_IS_OK(status
)) {
5031 return NT_STATUS_OK
;
5034 /*************************************************************
5035 **************************************************************/
5037 static uint32_t samr_set_user_info_map_fields_to_access_mask(uint32_t fields
)
5039 uint32_t acc_required
= 0;
5041 /* USER_ALL_USERNAME */
5042 if (fields
& SAMR_FIELD_ACCOUNT_NAME
)
5043 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5044 /* USER_ALL_FULLNAME */
5045 if (fields
& SAMR_FIELD_FULL_NAME
)
5046 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5047 /* USER_ALL_PRIMARYGROUPID */
5048 if (fields
& SAMR_FIELD_PRIMARY_GID
)
5049 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5050 /* USER_ALL_HOMEDIRECTORY */
5051 if (fields
& SAMR_FIELD_HOME_DIRECTORY
)
5052 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5053 /* USER_ALL_HOMEDIRECTORYDRIVE */
5054 if (fields
& SAMR_FIELD_HOME_DRIVE
)
5055 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5056 /* USER_ALL_SCRIPTPATH */
5057 if (fields
& SAMR_FIELD_LOGON_SCRIPT
)
5058 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5059 /* USER_ALL_PROFILEPATH */
5060 if (fields
& SAMR_FIELD_PROFILE_PATH
)
5061 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5062 /* USER_ALL_ADMINCOMMENT */
5063 if (fields
& SAMR_FIELD_COMMENT
)
5064 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5065 /* USER_ALL_WORKSTATIONS */
5066 if (fields
& SAMR_FIELD_WORKSTATIONS
)
5067 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5068 /* USER_ALL_LOGONHOURS */
5069 if (fields
& SAMR_FIELD_LOGON_HOURS
)
5070 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5071 /* USER_ALL_ACCOUNTEXPIRES */
5072 if (fields
& SAMR_FIELD_ACCT_EXPIRY
)
5073 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5074 /* USER_ALL_USERACCOUNTCONTROL */
5075 if (fields
& SAMR_FIELD_ACCT_FLAGS
)
5076 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5077 /* USER_ALL_PARAMETERS */
5078 if (fields
& SAMR_FIELD_PARAMETERS
)
5079 acc_required
|= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5080 /* USER_ALL_USERCOMMENT */
5081 if (fields
& SAMR_FIELD_COMMENT
)
5082 acc_required
|= SAMR_USER_ACCESS_SET_LOC_COM
;
5083 /* USER_ALL_COUNTRYCODE */
5084 if (fields
& SAMR_FIELD_COUNTRY_CODE
)
5085 acc_required
|= SAMR_USER_ACCESS_SET_LOC_COM
;
5086 /* USER_ALL_CODEPAGE */
5087 if (fields
& SAMR_FIELD_CODE_PAGE
)
5088 acc_required
|= SAMR_USER_ACCESS_SET_LOC_COM
;
5089 /* USER_ALL_NTPASSWORDPRESENT */
5090 if (fields
& SAMR_FIELD_NT_PASSWORD_PRESENT
)
5091 acc_required
|= SAMR_USER_ACCESS_SET_PASSWORD
;
5092 /* USER_ALL_LMPASSWORDPRESENT */
5093 if (fields
& SAMR_FIELD_LM_PASSWORD_PRESENT
)
5094 acc_required
|= SAMR_USER_ACCESS_SET_PASSWORD
;
5095 /* USER_ALL_PASSWORDEXPIRED */
5096 if (fields
& SAMR_FIELD_EXPIRED_FLAG
)
5097 acc_required
|= SAMR_USER_ACCESS_SET_PASSWORD
;
5099 return acc_required
;
5102 /*******************************************************************
5104 ********************************************************************/
5106 NTSTATUS
_samr_SetUserInfo(struct pipes_struct
*p
,
5107 struct samr_SetUserInfo
*r
)
5109 struct samr_user_info
*uinfo
;
5111 struct samu
*pwd
= NULL
;
5112 union samr_UserInfo
*info
= r
->in
.info
;
5113 uint32_t acc_required
= 0;
5114 uint32_t fields
= 0;
5117 DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__
));
5119 /* This is tricky. A WinXP domain join sets
5120 (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
5121 The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
5122 standard Win32 API calls just ask for SAMR_USER_ACCESS_SET_PASSWORD in the SamrOpenUser().
5123 This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
5124 we'll use the set from the WinXP join as the basis. */
5126 switch (r
->in
.level
) {
5127 case 2: /* UserPreferencesInformation */
5128 /* USER_WRITE_ACCOUNT | USER_WRITE_PREFERENCES */
5129 acc_required
= SAMR_USER_ACCESS_SET_ATTRIBUTES
| SAMR_USER_ACCESS_SET_LOC_COM
;
5131 case 4: /* UserLogonHoursInformation */
5132 case 6: /* UserNameInformation */
5133 case 7: /* UserAccountNameInformation */
5134 case 8: /* UserFullNameInformation */
5135 case 9: /* UserPrimaryGroupInformation */
5136 case 10: /* UserHomeInformation */
5137 case 11: /* UserScriptInformation */
5138 case 12: /* UserProfileInformation */
5139 case 13: /* UserAdminCommentInformation */
5140 case 14: /* UserWorkStationsInformation */
5141 case 16: /* UserControlInformation */
5142 case 17: /* UserExpiresInformation */
5143 case 20: /* UserParametersInformation */
5144 /* USER_WRITE_ACCOUNT */
5145 acc_required
= SAMR_USER_ACCESS_SET_ATTRIBUTES
;
5147 case 18: /* UserInternal1Information */
5148 /* FIXME: gd, this is a guess */
5149 acc_required
= SAMR_USER_ACCESS_SET_PASSWORD
;
5151 case 21: /* UserAllInformation */
5152 fields
= info
->info21
.fields_present
;
5153 acc_required
= samr_set_user_info_map_fields_to_access_mask(fields
);
5155 case 23: /* UserInternal4Information */
5156 fields
= info
->info23
.info
.fields_present
;
5157 acc_required
= samr_set_user_info_map_fields_to_access_mask(fields
);
5159 case 25: /* UserInternal4InformationNew */
5160 fields
= info
->info25
.info
.fields_present
;
5161 acc_required
= samr_set_user_info_map_fields_to_access_mask(fields
);
5163 case 24: /* UserInternal5Information */
5164 case 26: /* UserInternal5InformationNew */
5165 acc_required
= SAMR_USER_ACCESS_SET_PASSWORD
;
5168 return NT_STATUS_INVALID_INFO_CLASS
;
5171 uinfo
= policy_handle_find(p
, r
->in
.user_handle
, acc_required
, NULL
,
5172 struct samr_user_info
, &status
);
5173 if (!NT_STATUS_IS_OK(status
)) {
5177 DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
5178 sid_string_dbg(&uinfo
->sid
), r
->in
.level
));
5181 DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
5182 return NT_STATUS_INVALID_INFO_CLASS
;
5185 if (!(pwd
= samu_new(NULL
))) {
5186 return NT_STATUS_NO_MEMORY
;
5190 ret
= pdb_getsampwsid(pwd
, &uinfo
->sid
);
5195 return NT_STATUS_NO_SUCH_USER
;
5198 /* ================ BEGIN Privilege BLOCK ================ */
5202 /* ok! user info levels (lots: see MSDEV help), off we go... */
5204 switch (r
->in
.level
) {
5207 status
= set_user_info_2(p
->mem_ctx
,
5212 status
= set_user_info_4(p
->mem_ctx
,
5217 status
= set_user_info_6(p
->mem_ctx
,
5222 status
= set_user_info_7(p
->mem_ctx
,
5227 status
= set_user_info_8(p
->mem_ctx
,
5232 status
= set_user_info_10(p
->mem_ctx
,
5233 &info
->info10
, pwd
);
5237 status
= set_user_info_11(p
->mem_ctx
,
5238 &info
->info11
, pwd
);
5242 status
= set_user_info_12(p
->mem_ctx
,
5243 &info
->info12
, pwd
);
5247 status
= set_user_info_13(p
->mem_ctx
,
5248 &info
->info13
, pwd
);
5252 status
= set_user_info_14(p
->mem_ctx
,
5253 &info
->info14
, pwd
);
5257 status
= set_user_info_16(p
->mem_ctx
,
5258 &info
->info16
, pwd
);
5262 status
= set_user_info_17(p
->mem_ctx
,
5263 &info
->info17
, pwd
);
5267 /* Used by AS/U JRA. */
5268 status
= set_user_info_18(&info
->info18
,
5270 &p
->session_info
->user_session_key
,
5275 status
= set_user_info_20(p
->mem_ctx
,
5276 &info
->info20
, pwd
);
5280 status
= set_user_info_21(&info
->info21
,
5282 &p
->session_info
->user_session_key
,
5287 if (!p
->session_info
->user_session_key
.length
) {
5288 status
= NT_STATUS_NO_USER_SESSION_KEY
;
5290 arcfour_crypt_blob(info
->info23
.password
.data
, 516,
5291 &p
->session_info
->user_session_key
);
5293 dump_data(100, info
->info23
.password
.data
, 516);
5295 status
= set_user_info_23(p
->mem_ctx
,
5302 if (!p
->session_info
->user_session_key
.length
) {
5303 status
= NT_STATUS_NO_USER_SESSION_KEY
;
5305 arcfour_crypt_blob(info
->info24
.password
.data
,
5307 &p
->session_info
->user_session_key
);
5309 dump_data(100, info
->info24
.password
.data
, 516);
5311 status
= set_user_info_24(p
->mem_ctx
,
5313 &info
->info24
, pwd
);
5317 if (!p
->session_info
->user_session_key
.length
) {
5318 status
= NT_STATUS_NO_USER_SESSION_KEY
;
5320 encode_or_decode_arc4_passwd_buffer(
5321 info
->info25
.password
.data
,
5322 &p
->session_info
->user_session_key
);
5324 dump_data(100, info
->info25
.password
.data
, 532);
5326 status
= set_user_info_25(p
->mem_ctx
,
5328 &info
->info25
, pwd
);
5332 if (!p
->session_info
->user_session_key
.length
) {
5333 status
= NT_STATUS_NO_USER_SESSION_KEY
;
5335 encode_or_decode_arc4_passwd_buffer(
5336 info
->info26
.password
.data
,
5337 &p
->session_info
->user_session_key
);
5339 dump_data(100, info
->info26
.password
.data
, 516);
5341 status
= set_user_info_26(p
->mem_ctx
,
5343 &info
->info26
, pwd
);
5347 status
= NT_STATUS_INVALID_INFO_CLASS
;
5354 /* ================ END Privilege BLOCK ================ */
5356 if (NT_STATUS_IS_OK(status
)) {
5357 force_flush_samr_cache(&uinfo
->sid
);
5363 /*******************************************************************
5365 ********************************************************************/
5367 NTSTATUS
_samr_SetUserInfo2(struct pipes_struct
*p
,
5368 struct samr_SetUserInfo2
*r
)
5370 struct samr_SetUserInfo q
;
5372 q
.in
.user_handle
= r
->in
.user_handle
;
5373 q
.in
.level
= r
->in
.level
;
5374 q
.in
.info
= r
->in
.info
;
5376 return _samr_SetUserInfo(p
, &q
);
5379 /*********************************************************************
5380 _samr_GetAliasMembership
5381 *********************************************************************/
5383 NTSTATUS
_samr_GetAliasMembership(struct pipes_struct
*p
,
5384 struct samr_GetAliasMembership
*r
)
5386 size_t num_alias_rids
;
5388 struct samr_domain_info
*dinfo
;
5393 struct dom_sid
*members
;
5395 DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__
));
5397 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
5398 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS
5399 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
, NULL
,
5400 struct samr_domain_info
, &status
);
5401 if (!NT_STATUS_IS_OK(status
)) {
5405 if (!sid_check_is_domain(&dinfo
->sid
) &&
5406 !sid_check_is_builtin(&dinfo
->sid
))
5407 return NT_STATUS_OBJECT_TYPE_MISMATCH
;
5409 if (r
->in
.sids
->num_sids
) {
5410 members
= TALLOC_ARRAY(p
->mem_ctx
, struct dom_sid
, r
->in
.sids
->num_sids
);
5412 if (members
== NULL
)
5413 return NT_STATUS_NO_MEMORY
;
5418 for (i
=0; i
<r
->in
.sids
->num_sids
; i
++)
5419 sid_copy(&members
[i
], r
->in
.sids
->sids
[i
].sid
);
5425 status
= pdb_enum_alias_memberships(p
->mem_ctx
, &dinfo
->sid
, members
,
5426 r
->in
.sids
->num_sids
,
5427 &alias_rids
, &num_alias_rids
);
5430 if (!NT_STATUS_IS_OK(status
)) {
5434 r
->out
.rids
->count
= num_alias_rids
;
5435 r
->out
.rids
->ids
= alias_rids
;
5437 if (r
->out
.rids
->ids
== NULL
) {
5438 /* Windows domain clients don't accept a NULL ptr here */
5439 r
->out
.rids
->ids
= talloc_zero(p
->mem_ctx
, uint32_t);
5441 if (r
->out
.rids
->ids
== NULL
) {
5442 return NT_STATUS_NO_MEMORY
;
5445 return NT_STATUS_OK
;
5448 /*********************************************************************
5449 _samr_GetMembersInAlias
5450 *********************************************************************/
5452 NTSTATUS
_samr_GetMembersInAlias(struct pipes_struct
*p
,
5453 struct samr_GetMembersInAlias
*r
)
5455 struct samr_alias_info
*ainfo
;
5458 size_t num_sids
= 0;
5459 struct lsa_SidPtr
*sids
= NULL
;
5460 struct dom_sid
*pdb_sids
= NULL
;
5462 ainfo
= policy_handle_find(p
, r
->in
.alias_handle
,
5463 SAMR_ALIAS_ACCESS_GET_MEMBERS
, NULL
,
5464 struct samr_alias_info
, &status
);
5465 if (!NT_STATUS_IS_OK(status
)) {
5469 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo
->sid
)));
5472 status
= pdb_enum_aliasmem(&ainfo
->sid
, talloc_tos(), &pdb_sids
,
5476 if (!NT_STATUS_IS_OK(status
)) {
5481 sids
= TALLOC_ZERO_ARRAY(p
->mem_ctx
, struct lsa_SidPtr
, num_sids
);
5483 TALLOC_FREE(pdb_sids
);
5484 return NT_STATUS_NO_MEMORY
;
5488 for (i
= 0; i
< num_sids
; i
++) {
5489 sids
[i
].sid
= dom_sid_dup(p
->mem_ctx
, &pdb_sids
[i
]);
5491 TALLOC_FREE(pdb_sids
);
5492 return NT_STATUS_NO_MEMORY
;
5496 r
->out
.sids
->num_sids
= num_sids
;
5497 r
->out
.sids
->sids
= sids
;
5499 TALLOC_FREE(pdb_sids
);
5501 return NT_STATUS_OK
;
5504 /*********************************************************************
5505 _samr_QueryGroupMember
5506 *********************************************************************/
5508 NTSTATUS
_samr_QueryGroupMember(struct pipes_struct
*p
,
5509 struct samr_QueryGroupMember
*r
)
5511 struct samr_group_info
*ginfo
;
5512 size_t i
, num_members
;
5518 struct samr_RidAttrArray
*rids
= NULL
;
5520 ginfo
= policy_handle_find(p
, r
->in
.group_handle
,
5521 SAMR_GROUP_ACCESS_GET_MEMBERS
, NULL
,
5522 struct samr_group_info
, &status
);
5523 if (!NT_STATUS_IS_OK(status
)) {
5527 rids
= TALLOC_ZERO_P(p
->mem_ctx
, struct samr_RidAttrArray
);
5529 return NT_STATUS_NO_MEMORY
;
5532 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo
->sid
)));
5534 if (!sid_check_is_in_our_domain(&ginfo
->sid
)) {
5535 DEBUG(3, ("sid %s is not in our domain\n",
5536 sid_string_dbg(&ginfo
->sid
)));
5537 return NT_STATUS_NO_SUCH_GROUP
;
5540 DEBUG(10, ("lookup on Domain SID\n"));
5543 status
= pdb_enum_group_members(p
->mem_ctx
, &ginfo
->sid
,
5544 &rid
, &num_members
);
5547 if (!NT_STATUS_IS_OK(status
))
5551 attr
=TALLOC_ZERO_ARRAY(p
->mem_ctx
, uint32
, num_members
);
5553 return NT_STATUS_NO_MEMORY
;
5559 for (i
=0; i
<num_members
; i
++) {
5560 attr
[i
] = SE_GROUP_MANDATORY
|
5561 SE_GROUP_ENABLED_BY_DEFAULT
|
5565 rids
->count
= num_members
;
5566 rids
->attributes
= attr
;
5569 *r
->out
.rids
= rids
;
5571 return NT_STATUS_OK
;
5574 /*********************************************************************
5575 _samr_AddAliasMember
5576 *********************************************************************/
5578 NTSTATUS
_samr_AddAliasMember(struct pipes_struct
*p
,
5579 struct samr_AddAliasMember
*r
)
5581 struct samr_alias_info
*ainfo
;
5584 ainfo
= policy_handle_find(p
, r
->in
.alias_handle
,
5585 SAMR_ALIAS_ACCESS_ADD_MEMBER
, NULL
,
5586 struct samr_alias_info
, &status
);
5587 if (!NT_STATUS_IS_OK(status
)) {
5591 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo
->sid
)));
5593 /******** BEGIN SeAddUsers BLOCK *********/
5596 status
= pdb_add_aliasmem(&ainfo
->sid
, r
->in
.sid
);
5599 /******** END SeAddUsers BLOCK *********/
5601 if (NT_STATUS_IS_OK(status
)) {
5602 force_flush_samr_cache(&ainfo
->sid
);
5608 /*********************************************************************
5609 _samr_DeleteAliasMember
5610 *********************************************************************/
5612 NTSTATUS
_samr_DeleteAliasMember(struct pipes_struct
*p
,
5613 struct samr_DeleteAliasMember
*r
)
5615 struct samr_alias_info
*ainfo
;
5618 ainfo
= policy_handle_find(p
, r
->in
.alias_handle
,
5619 SAMR_ALIAS_ACCESS_REMOVE_MEMBER
, NULL
,
5620 struct samr_alias_info
, &status
);
5621 if (!NT_STATUS_IS_OK(status
)) {
5625 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
5626 sid_string_dbg(&ainfo
->sid
)));
5628 /******** BEGIN SeAddUsers BLOCK *********/
5631 status
= pdb_del_aliasmem(&ainfo
->sid
, r
->in
.sid
);
5634 /******** END SeAddUsers BLOCK *********/
5636 if (NT_STATUS_IS_OK(status
)) {
5637 force_flush_samr_cache(&ainfo
->sid
);
5643 /*********************************************************************
5644 _samr_AddGroupMember
5645 *********************************************************************/
5647 NTSTATUS
_samr_AddGroupMember(struct pipes_struct
*p
,
5648 struct samr_AddGroupMember
*r
)
5650 struct samr_group_info
*ginfo
;
5654 ginfo
= policy_handle_find(p
, r
->in
.group_handle
,
5655 SAMR_GROUP_ACCESS_ADD_MEMBER
, NULL
,
5656 struct samr_group_info
, &status
);
5657 if (!NT_STATUS_IS_OK(status
)) {
5661 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo
->sid
)));
5663 if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo
->sid
,
5665 return NT_STATUS_INVALID_HANDLE
;
5668 /******** BEGIN SeAddUsers BLOCK *********/
5671 status
= pdb_add_groupmem(p
->mem_ctx
, group_rid
, r
->in
.rid
);
5674 /******** END SeAddUsers BLOCK *********/
5676 force_flush_samr_cache(&ginfo
->sid
);
5681 /*********************************************************************
5682 _samr_DeleteGroupMember
5683 *********************************************************************/
5685 NTSTATUS
_samr_DeleteGroupMember(struct pipes_struct
*p
,
5686 struct samr_DeleteGroupMember
*r
)
5689 struct samr_group_info
*ginfo
;
5694 * delete the group member named r->in.rid
5695 * who is a member of the sid associated with the handle
5696 * the rid is a user's rid as the group is a domain group.
5699 ginfo
= policy_handle_find(p
, r
->in
.group_handle
,
5700 SAMR_GROUP_ACCESS_REMOVE_MEMBER
, NULL
,
5701 struct samr_group_info
, &status
);
5702 if (!NT_STATUS_IS_OK(status
)) {
5706 if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo
->sid
,
5708 return NT_STATUS_INVALID_HANDLE
;
5711 /******** BEGIN SeAddUsers BLOCK *********/
5714 status
= pdb_del_groupmem(p
->mem_ctx
, group_rid
, r
->in
.rid
);
5717 /******** END SeAddUsers BLOCK *********/
5719 force_flush_samr_cache(&ginfo
->sid
);
5724 /*********************************************************************
5726 *********************************************************************/
5728 NTSTATUS
_samr_DeleteUser(struct pipes_struct
*p
,
5729 struct samr_DeleteUser
*r
)
5731 struct samr_user_info
*uinfo
;
5733 struct samu
*sam_pass
=NULL
;
5736 DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__
));
5738 uinfo
= policy_handle_find(p
, r
->in
.user_handle
,
5739 SEC_STD_DELETE
, NULL
,
5740 struct samr_user_info
, &status
);
5741 if (!NT_STATUS_IS_OK(status
)) {
5745 if (!sid_check_is_in_our_domain(&uinfo
->sid
))
5746 return NT_STATUS_CANNOT_DELETE
;
5748 /* check if the user exists before trying to delete */
5749 if ( !(sam_pass
= samu_new( NULL
)) ) {
5750 return NT_STATUS_NO_MEMORY
;
5754 ret
= pdb_getsampwsid(sam_pass
, &uinfo
->sid
);
5758 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
5759 sid_string_dbg(&uinfo
->sid
)));
5760 TALLOC_FREE(sam_pass
);
5761 return NT_STATUS_NO_SUCH_USER
;
5764 /******** BEGIN SeAddUsers BLOCK *********/
5767 status
= pdb_delete_user(p
->mem_ctx
, sam_pass
);
5770 /******** END SeAddUsers BLOCK *********/
5772 if ( !NT_STATUS_IS_OK(status
) ) {
5773 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
5774 "user %s: %s.\n", pdb_get_username(sam_pass
),
5775 nt_errstr(status
)));
5776 TALLOC_FREE(sam_pass
);
5781 TALLOC_FREE(sam_pass
);
5783 force_flush_samr_cache(&uinfo
->sid
);
5785 if (!close_policy_hnd(p
, r
->in
.user_handle
))
5786 return NT_STATUS_OBJECT_NAME_INVALID
;
5788 ZERO_STRUCTP(r
->out
.user_handle
);
5790 return NT_STATUS_OK
;
5793 /*********************************************************************
5794 _samr_DeleteDomainGroup
5795 *********************************************************************/
5797 NTSTATUS
_samr_DeleteDomainGroup(struct pipes_struct
*p
,
5798 struct samr_DeleteDomainGroup
*r
)
5800 struct samr_group_info
*ginfo
;
5804 DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__
));
5806 ginfo
= policy_handle_find(p
, r
->in
.group_handle
,
5807 SEC_STD_DELETE
, NULL
,
5808 struct samr_group_info
, &status
);
5809 if (!NT_STATUS_IS_OK(status
)) {
5813 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ginfo
->sid
)));
5815 if (!sid_peek_check_rid(get_global_sam_sid(), &ginfo
->sid
,
5817 return NT_STATUS_NO_SUCH_GROUP
;
5820 /******** BEGIN SeAddUsers BLOCK *********/
5823 status
= pdb_delete_dom_group(p
->mem_ctx
, group_rid
);
5826 /******** END SeAddUsers BLOCK *********/
5828 if ( !NT_STATUS_IS_OK(status
) ) {
5829 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
5830 "entry for group %s: %s\n",
5831 sid_string_dbg(&ginfo
->sid
),
5832 nt_errstr(status
)));
5836 force_flush_samr_cache(&ginfo
->sid
);
5838 if (!close_policy_hnd(p
, r
->in
.group_handle
))
5839 return NT_STATUS_OBJECT_NAME_INVALID
;
5841 return NT_STATUS_OK
;
5844 /*********************************************************************
5845 _samr_DeleteDomAlias
5846 *********************************************************************/
5848 NTSTATUS
_samr_DeleteDomAlias(struct pipes_struct
*p
,
5849 struct samr_DeleteDomAlias
*r
)
5851 struct samr_alias_info
*ainfo
;
5854 DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__
));
5856 ainfo
= policy_handle_find(p
, r
->in
.alias_handle
,
5857 SEC_STD_DELETE
, NULL
,
5858 struct samr_alias_info
, &status
);
5859 if (!NT_STATUS_IS_OK(status
)) {
5863 DEBUG(10, ("sid is %s\n", sid_string_dbg(&ainfo
->sid
)));
5865 /* Don't let Windows delete builtin groups */
5867 if ( sid_check_is_in_builtin( &ainfo
->sid
) ) {
5868 return NT_STATUS_SPECIAL_ACCOUNT
;
5871 if (!sid_check_is_in_our_domain(&ainfo
->sid
))
5872 return NT_STATUS_NO_SUCH_ALIAS
;
5874 DEBUG(10, ("lookup on Local SID\n"));
5876 /******** BEGIN SeAddUsers BLOCK *********/
5879 /* Have passdb delete the alias */
5880 status
= pdb_delete_alias(&ainfo
->sid
);
5883 /******** END SeAddUsers BLOCK *********/
5885 if ( !NT_STATUS_IS_OK(status
))
5888 force_flush_samr_cache(&ainfo
->sid
);
5890 if (!close_policy_hnd(p
, r
->in
.alias_handle
))
5891 return NT_STATUS_OBJECT_NAME_INVALID
;
5893 return NT_STATUS_OK
;
5896 /*********************************************************************
5897 _samr_CreateDomainGroup
5898 *********************************************************************/
5900 NTSTATUS
_samr_CreateDomainGroup(struct pipes_struct
*p
,
5901 struct samr_CreateDomainGroup
*r
)
5906 struct samr_domain_info
*dinfo
;
5907 struct samr_group_info
*ginfo
;
5909 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
5910 SAMR_DOMAIN_ACCESS_CREATE_GROUP
, NULL
,
5911 struct samr_domain_info
, &status
);
5912 if (!NT_STATUS_IS_OK(status
)) {
5916 if (!sid_check_is_domain(&dinfo
->sid
)) {
5917 return NT_STATUS_ACCESS_DENIED
;
5920 name
= r
->in
.name
->string
;
5922 return NT_STATUS_NO_MEMORY
;
5925 status
= can_create(p
->mem_ctx
, name
);
5926 if (!NT_STATUS_IS_OK(status
)) {
5930 /******** BEGIN SeAddUsers BLOCK *********/
5933 /* check that we successfully create the UNIX group */
5934 status
= pdb_create_dom_group(p
->mem_ctx
, name
, r
->out
.rid
);
5937 /******** END SeAddUsers BLOCK *********/
5939 /* check if we should bail out here */
5941 if ( !NT_STATUS_IS_OK(status
) )
5944 ginfo
= policy_handle_create(p
, r
->out
.group_handle
,
5945 GENERIC_RIGHTS_GROUP_ALL_ACCESS
,
5946 struct samr_group_info
, &status
);
5947 if (!NT_STATUS_IS_OK(status
)) {
5950 sid_compose(&ginfo
->sid
, &dinfo
->sid
, *r
->out
.rid
);
5952 force_flush_samr_cache(&dinfo
->sid
);
5954 return NT_STATUS_OK
;
5957 /*********************************************************************
5958 _samr_CreateDomAlias
5959 *********************************************************************/
5961 NTSTATUS
_samr_CreateDomAlias(struct pipes_struct
*p
,
5962 struct samr_CreateDomAlias
*r
)
5964 struct dom_sid info_sid
;
5965 const char *name
= NULL
;
5966 struct samr_domain_info
*dinfo
;
5967 struct samr_alias_info
*ainfo
;
5971 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
5972 SAMR_DOMAIN_ACCESS_CREATE_ALIAS
, NULL
,
5973 struct samr_domain_info
, &result
);
5974 if (!NT_STATUS_IS_OK(result
)) {
5978 if (!sid_check_is_domain(&dinfo
->sid
)) {
5979 return NT_STATUS_ACCESS_DENIED
;
5982 name
= r
->in
.alias_name
->string
;
5984 result
= can_create(p
->mem_ctx
, name
);
5985 if (!NT_STATUS_IS_OK(result
)) {
5989 /******** BEGIN SeAddUsers BLOCK *********/
5992 /* Have passdb create the alias */
5993 result
= pdb_create_alias(name
, r
->out
.rid
);
5996 /******** END SeAddUsers BLOCK *********/
5998 if (!NT_STATUS_IS_OK(result
)) {
5999 DEBUG(10, ("pdb_create_alias failed: %s\n",
6000 nt_errstr(result
)));
6004 sid_compose(&info_sid
, &dinfo
->sid
, *r
->out
.rid
);
6006 if (!sid_to_gid(&info_sid
, &gid
)) {
6007 DEBUG(10, ("Could not find alias just created\n"));
6008 return NT_STATUS_ACCESS_DENIED
;
6011 /* check if the group has been successfully created */
6012 if ( getgrgid(gid
) == NULL
) {
6013 DEBUG(10, ("getgrgid(%u) of just created alias failed\n",
6014 (unsigned int)gid
));
6015 return NT_STATUS_ACCESS_DENIED
;
6018 ainfo
= policy_handle_create(p
, r
->out
.alias_handle
,
6019 GENERIC_RIGHTS_ALIAS_ALL_ACCESS
,
6020 struct samr_alias_info
, &result
);
6021 if (!NT_STATUS_IS_OK(result
)) {
6024 ainfo
->sid
= info_sid
;
6026 force_flush_samr_cache(&info_sid
);
6028 return NT_STATUS_OK
;
6031 /*********************************************************************
6032 _samr_QueryGroupInfo
6033 *********************************************************************/
6035 NTSTATUS
_samr_QueryGroupInfo(struct pipes_struct
*p
,
6036 struct samr_QueryGroupInfo
*r
)
6038 struct samr_group_info
*ginfo
;
6041 union samr_GroupInfo
*info
= NULL
;
6043 uint32_t attributes
= SE_GROUP_MANDATORY
|
6044 SE_GROUP_ENABLED_BY_DEFAULT
|
6046 const char *group_name
= NULL
;
6047 const char *group_description
= NULL
;
6049 ginfo
= policy_handle_find(p
, r
->in
.group_handle
,
6050 SAMR_GROUP_ACCESS_LOOKUP_INFO
, NULL
,
6051 struct samr_group_info
, &status
);
6052 if (!NT_STATUS_IS_OK(status
)) {
6057 ret
= get_domain_group_from_sid(ginfo
->sid
, &map
);
6060 return NT_STATUS_INVALID_HANDLE
;
6062 /* FIXME: map contains fstrings */
6063 group_name
= talloc_strdup(r
, map
.nt_name
);
6064 group_description
= talloc_strdup(r
, map
.comment
);
6066 info
= TALLOC_ZERO_P(p
->mem_ctx
, union samr_GroupInfo
);
6068 return NT_STATUS_NO_MEMORY
;
6071 switch (r
->in
.level
) {
6077 status
= pdb_enum_group_members(
6078 p
->mem_ctx
, &ginfo
->sid
, &members
,
6082 if (!NT_STATUS_IS_OK(status
)) {
6086 info
->all
.name
.string
= group_name
;
6087 info
->all
.attributes
= attributes
;
6088 info
->all
.num_members
= num_members
;
6089 info
->all
.description
.string
= group_description
;
6093 info
->name
.string
= group_name
;
6096 info
->attributes
.attributes
= attributes
;
6099 info
->description
.string
= group_description
;
6109 status = pdb_enum_group_members(
6110 p->mem_ctx, &ginfo->sid, &members,
6114 if (!NT_STATUS_IS_OK(status)) {
6118 info
->all2
.name
.string
= group_name
;
6119 info
->all2
.attributes
= attributes
;
6120 info
->all2
.num_members
= 0; /* num_members - in w2k3 this is always 0 */
6121 info
->all2
.description
.string
= group_description
;
6126 return NT_STATUS_INVALID_INFO_CLASS
;
6129 *r
->out
.info
= info
;
6131 return NT_STATUS_OK
;
6134 /*********************************************************************
6136 *********************************************************************/
6138 NTSTATUS
_samr_SetGroupInfo(struct pipes_struct
*p
,
6139 struct samr_SetGroupInfo
*r
)
6141 struct samr_group_info
*ginfo
;
6146 ginfo
= policy_handle_find(p
, r
->in
.group_handle
,
6147 SAMR_GROUP_ACCESS_SET_INFO
, NULL
,
6148 struct samr_group_info
, &status
);
6149 if (!NT_STATUS_IS_OK(status
)) {
6154 ret
= get_domain_group_from_sid(ginfo
->sid
, &map
);
6157 return NT_STATUS_NO_SUCH_GROUP
;
6159 switch (r
->in
.level
) {
6161 fstrcpy(map
.nt_name
, r
->in
.info
->name
.string
);
6166 fstrcpy(map
.comment
, r
->in
.info
->description
.string
);
6169 return NT_STATUS_INVALID_INFO_CLASS
;
6172 /******** BEGIN SeAddUsers BLOCK *********/
6175 status
= pdb_update_group_mapping_entry(&map
);
6178 /******** End SeAddUsers BLOCK *********/
6180 if (NT_STATUS_IS_OK(status
)) {
6181 force_flush_samr_cache(&ginfo
->sid
);
6187 /*********************************************************************
6189 *********************************************************************/
6191 NTSTATUS
_samr_SetAliasInfo(struct pipes_struct
*p
,
6192 struct samr_SetAliasInfo
*r
)
6194 struct samr_alias_info
*ainfo
;
6195 struct acct_info info
;
6198 ainfo
= policy_handle_find(p
, r
->in
.alias_handle
,
6199 SAMR_ALIAS_ACCESS_SET_INFO
, NULL
,
6200 struct samr_alias_info
, &status
);
6201 if (!NT_STATUS_IS_OK(status
)) {
6205 /* get the current group information */
6208 status
= pdb_get_aliasinfo( &ainfo
->sid
, &info
);
6211 if ( !NT_STATUS_IS_OK(status
))
6214 switch (r
->in
.level
) {
6219 /* We currently do not support renaming groups in the
6220 the BUILTIN domain. Refer to util_builtin.c to understand
6221 why. The eventually needs to be fixed to be like Windows
6222 where you can rename builtin groups, just not delete them */
6224 if ( sid_check_is_in_builtin( &ainfo
->sid
) ) {
6225 return NT_STATUS_SPECIAL_ACCOUNT
;
6228 /* There has to be a valid name (and it has to be different) */
6230 if ( !r
->in
.info
->name
.string
)
6231 return NT_STATUS_INVALID_PARAMETER
;
6233 /* If the name is the same just reply "ok". Yes this
6234 doesn't allow you to change the case of a group name. */
6236 if ( strequal( r
->in
.info
->name
.string
, info
.acct_name
) )
6237 return NT_STATUS_OK
;
6239 fstrcpy( info
.acct_name
, r
->in
.info
->name
.string
);
6241 /* make sure the name doesn't already exist as a user
6244 fstr_sprintf( group_name
, "%s\\%s", global_myname(), info
.acct_name
);
6245 status
= can_create( p
->mem_ctx
, group_name
);
6246 if ( !NT_STATUS_IS_OK( status
) )
6250 case ALIASINFODESCRIPTION
:
6251 if (r
->in
.info
->description
.string
) {
6252 fstrcpy(info
.acct_desc
,
6253 r
->in
.info
->description
.string
);
6255 fstrcpy( info
.acct_desc
, "" );
6259 return NT_STATUS_INVALID_INFO_CLASS
;
6262 /******** BEGIN SeAddUsers BLOCK *********/
6265 status
= pdb_set_aliasinfo( &ainfo
->sid
, &info
);
6268 /******** End SeAddUsers BLOCK *********/
6270 if (NT_STATUS_IS_OK(status
))
6271 force_flush_samr_cache(&ainfo
->sid
);
6276 /****************************************************************
6278 ****************************************************************/
6280 NTSTATUS
_samr_GetDomPwInfo(struct pipes_struct
*p
,
6281 struct samr_GetDomPwInfo
*r
)
6283 uint32_t min_password_length
= 0;
6284 uint32_t password_properties
= 0;
6286 /* Perform access check. Since this rpc does not require a
6287 policy handle it will not be caught by the access checks on
6288 SAMR_CONNECT or SAMR_CONNECT_ANON. */
6290 if (!pipe_access_check(p
)) {
6291 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
6292 return NT_STATUS_ACCESS_DENIED
;
6296 pdb_get_account_policy(PDB_POLICY_MIN_PASSWORD_LEN
,
6297 &min_password_length
);
6298 pdb_get_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS
,
6299 &password_properties
);
6302 if (lp_check_password_script() && *lp_check_password_script()) {
6303 password_properties
|= DOMAIN_PASSWORD_COMPLEX
;
6306 r
->out
.info
->min_password_length
= min_password_length
;
6307 r
->out
.info
->password_properties
= password_properties
;
6309 return NT_STATUS_OK
;
6312 /*********************************************************************
6314 *********************************************************************/
6316 NTSTATUS
_samr_OpenGroup(struct pipes_struct
*p
,
6317 struct samr_OpenGroup
*r
)
6320 struct dom_sid info_sid
;
6322 struct samr_domain_info
*dinfo
;
6323 struct samr_group_info
*ginfo
;
6324 struct security_descriptor
*psd
= NULL
;
6326 uint32 des_access
= r
->in
.access_mask
;
6331 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
6332 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
, NULL
,
6333 struct samr_domain_info
, &status
);
6334 if (!NT_STATUS_IS_OK(status
)) {
6338 /*check if access can be granted as requested by client. */
6339 map_max_allowed_access(p
->session_info
->security_token
,
6340 &p
->session_info
->utok
,
6343 make_samr_object_sd(p
->mem_ctx
, &psd
, &sd_size
, &grp_generic_mapping
, NULL
, 0);
6344 se_map_generic(&des_access
,&grp_generic_mapping
);
6346 status
= access_check_object(psd
, p
->session_info
->security_token
,
6347 SEC_PRIV_ADD_USERS
, SEC_PRIV_INVALID
, GENERIC_RIGHTS_GROUP_ALL_ACCESS
,
6348 des_access
, &acc_granted
, "_samr_OpenGroup");
6350 if ( !NT_STATUS_IS_OK(status
) )
6353 /* this should not be hard-coded like this */
6355 if (!sid_check_is_domain(&dinfo
->sid
)) {
6356 return NT_STATUS_ACCESS_DENIED
;
6359 sid_compose(&info_sid
, &dinfo
->sid
, r
->in
.rid
);
6361 DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n",
6362 sid_string_dbg(&info_sid
)));
6364 /* check if that group really exists */
6366 ret
= get_domain_group_from_sid(info_sid
, &map
);
6369 return NT_STATUS_NO_SUCH_GROUP
;
6371 ginfo
= policy_handle_create(p
, r
->out
.group_handle
,
6373 struct samr_group_info
, &status
);
6374 if (!NT_STATUS_IS_OK(status
)) {
6377 ginfo
->sid
= info_sid
;
6379 return NT_STATUS_OK
;
6382 /*********************************************************************
6383 _samr_RemoveMemberFromForeignDomain
6384 *********************************************************************/
6386 NTSTATUS
_samr_RemoveMemberFromForeignDomain(struct pipes_struct
*p
,
6387 struct samr_RemoveMemberFromForeignDomain
*r
)
6389 struct samr_domain_info
*dinfo
;
6392 DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
6393 sid_string_dbg(r
->in
.sid
)));
6395 /* Find the policy handle. Open a policy on it. */
6397 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
6398 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT
, NULL
,
6399 struct samr_domain_info
, &result
);
6400 if (!NT_STATUS_IS_OK(result
)) {
6404 DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
6405 sid_string_dbg(&dinfo
->sid
)));
6407 /* we can only delete a user from a group since we don't have
6408 nested groups anyways. So in the latter case, just say OK */
6410 /* TODO: The above comment nowadays is bogus. Since we have nested
6411 * groups now, and aliases members are never reported out of the unix
6412 * group membership, the "just say OK" makes this call a no-op. For
6413 * us. This needs fixing however. */
6415 /* I've only ever seen this in the wild when deleting a user from
6416 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
6417 * is the user about to be deleted. I very much suspect this is the
6418 * only application of this call. To verify this, let people report
6421 if (!sid_check_is_builtin(&dinfo
->sid
)) {
6422 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
6423 "global_sam_sid() = %s\n",
6424 sid_string_dbg(&dinfo
->sid
),
6425 sid_string_dbg(get_global_sam_sid())));
6426 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
6427 return NT_STATUS_OK
;
6430 force_flush_samr_cache(&dinfo
->sid
);
6432 result
= NT_STATUS_OK
;
6437 /*******************************************************************
6438 _samr_QueryDomainInfo2
6439 ********************************************************************/
6441 NTSTATUS
_samr_QueryDomainInfo2(struct pipes_struct
*p
,
6442 struct samr_QueryDomainInfo2
*r
)
6444 struct samr_QueryDomainInfo q
;
6446 q
.in
.domain_handle
= r
->in
.domain_handle
;
6447 q
.in
.level
= r
->in
.level
;
6449 q
.out
.info
= r
->out
.info
;
6451 return _samr_QueryDomainInfo(p
, &q
);
6454 /*******************************************************************
6455 ********************************************************************/
6457 static NTSTATUS
set_dom_info_1(TALLOC_CTX
*mem_ctx
,
6458 struct samr_DomInfo1
*r
)
6460 time_t u_expire
, u_min_age
;
6462 u_expire
= nt_time_to_unix_abs((NTTIME
*)&r
->max_password_age
);
6463 u_min_age
= nt_time_to_unix_abs((NTTIME
*)&r
->min_password_age
);
6465 pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_LEN
,
6466 (uint32_t)r
->min_password_length
);
6467 pdb_set_account_policy(PDB_POLICY_PASSWORD_HISTORY
,
6468 (uint32_t)r
->password_history_length
);
6469 pdb_set_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS
,
6470 (uint32_t)r
->password_properties
);
6471 pdb_set_account_policy(PDB_POLICY_MAX_PASSWORD_AGE
, (int)u_expire
);
6472 pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_AGE
, (int)u_min_age
);
6474 return NT_STATUS_OK
;
6477 /*******************************************************************
6478 ********************************************************************/
6480 static NTSTATUS
set_dom_info_3(TALLOC_CTX
*mem_ctx
,
6481 struct samr_DomInfo3
*r
)
6485 u_logout
= nt_time_to_unix_abs((NTTIME
*)&r
->force_logoff_time
);
6487 pdb_set_account_policy(PDB_POLICY_TIME_TO_LOGOUT
, (int)u_logout
);
6489 return NT_STATUS_OK
;
6492 /*******************************************************************
6493 ********************************************************************/
6495 static NTSTATUS
set_dom_info_12(TALLOC_CTX
*mem_ctx
,
6496 struct samr_DomInfo12
*r
)
6498 time_t u_lock_duration
, u_reset_time
;
6500 u_lock_duration
= nt_time_to_unix_abs((NTTIME
*)&r
->lockout_duration
);
6501 if (u_lock_duration
!= -1) {
6502 u_lock_duration
/= 60;
6505 u_reset_time
= nt_time_to_unix_abs((NTTIME
*)&r
->lockout_window
)/60;
6507 pdb_set_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION
, (int)u_lock_duration
);
6508 pdb_set_account_policy(PDB_POLICY_RESET_COUNT_TIME
, (int)u_reset_time
);
6509 pdb_set_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT
,
6510 (uint32_t)r
->lockout_threshold
);
6512 return NT_STATUS_OK
;
6515 /*******************************************************************
6517 ********************************************************************/
6519 NTSTATUS
_samr_SetDomainInfo(struct pipes_struct
*p
,
6520 struct samr_SetDomainInfo
*r
)
6522 struct samr_domain_info
*dinfo
;
6524 uint32_t acc_required
= 0;
6526 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__
));
6528 switch (r
->in
.level
) {
6529 case 1: /* DomainPasswordInformation */
6530 case 12: /* DomainLockoutInformation */
6531 /* DOMAIN_WRITE_PASSWORD_PARAMETERS */
6532 acc_required
= SAMR_DOMAIN_ACCESS_SET_INFO_1
;
6534 case 3: /* DomainLogoffInformation */
6535 case 4: /* DomainOemInformation */
6536 /* DOMAIN_WRITE_OTHER_PARAMETERS */
6537 acc_required
= SAMR_DOMAIN_ACCESS_SET_INFO_2
;
6539 case 6: /* DomainReplicationInformation */
6540 case 9: /* DomainStateInformation */
6541 case 7: /* DomainServerRoleInformation */
6542 /* DOMAIN_ADMINISTER_SERVER */
6543 acc_required
= SAMR_DOMAIN_ACCESS_SET_INFO_3
;
6546 return NT_STATUS_INVALID_INFO_CLASS
;
6549 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
6551 struct samr_domain_info
, &status
);
6552 if (!NT_STATUS_IS_OK(status
)) {
6556 DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r
->in
.level
));
6558 switch (r
->in
.level
) {
6560 status
= set_dom_info_1(p
->mem_ctx
, &r
->in
.info
->info1
);
6563 status
= set_dom_info_3(p
->mem_ctx
, &r
->in
.info
->info3
);
6574 status
= set_dom_info_12(p
->mem_ctx
, &r
->in
.info
->info12
);
6577 return NT_STATUS_INVALID_INFO_CLASS
;
6580 if (!NT_STATUS_IS_OK(status
)) {
6584 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__
));
6586 return NT_STATUS_OK
;
6589 /****************************************************************
6590 _samr_GetDisplayEnumerationIndex
6591 ****************************************************************/
6593 NTSTATUS
_samr_GetDisplayEnumerationIndex(struct pipes_struct
*p
,
6594 struct samr_GetDisplayEnumerationIndex
*r
)
6596 struct samr_domain_info
*dinfo
;
6597 uint32_t max_entries
= (uint32_t) -1;
6598 uint32_t enum_context
= 0;
6600 uint32_t num_account
= 0;
6601 struct samr_displayentry
*entries
= NULL
;
6604 DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__
));
6606 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
6607 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS
, NULL
,
6608 struct samr_domain_info
, &status
);
6609 if (!NT_STATUS_IS_OK(status
)) {
6613 if ((r
->in
.level
< 1) || (r
->in
.level
> 3)) {
6614 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
6615 "Unknown info level (%u)\n",
6617 return NT_STATUS_INVALID_INFO_CLASS
;
6622 /* The following done as ROOT. Don't return without unbecome_root(). */
6624 switch (r
->in
.level
) {
6626 if (dinfo
->disp_info
->users
== NULL
) {
6627 dinfo
->disp_info
->users
= pdb_search_users(
6628 dinfo
->disp_info
, ACB_NORMAL
);
6629 if (dinfo
->disp_info
->users
== NULL
) {
6631 return NT_STATUS_ACCESS_DENIED
;
6633 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6634 "starting user enumeration at index %u\n",
6635 (unsigned int)enum_context
));
6637 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6638 "using cached user enumeration at index %u\n",
6639 (unsigned int)enum_context
));
6641 num_account
= pdb_search_entries(dinfo
->disp_info
->users
,
6642 enum_context
, max_entries
,
6646 if (dinfo
->disp_info
->machines
== NULL
) {
6647 dinfo
->disp_info
->machines
= pdb_search_users(
6648 dinfo
->disp_info
, ACB_WSTRUST
|ACB_SVRTRUST
);
6649 if (dinfo
->disp_info
->machines
== NULL
) {
6651 return NT_STATUS_ACCESS_DENIED
;
6653 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6654 "starting machine enumeration at index %u\n",
6655 (unsigned int)enum_context
));
6657 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6658 "using cached machine enumeration at index %u\n",
6659 (unsigned int)enum_context
));
6661 num_account
= pdb_search_entries(dinfo
->disp_info
->machines
,
6662 enum_context
, max_entries
,
6666 if (dinfo
->disp_info
->groups
== NULL
) {
6667 dinfo
->disp_info
->groups
= pdb_search_groups(
6669 if (dinfo
->disp_info
->groups
== NULL
) {
6671 return NT_STATUS_ACCESS_DENIED
;
6673 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6674 "starting group enumeration at index %u\n",
6675 (unsigned int)enum_context
));
6677 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6678 "using cached group enumeration at index %u\n",
6679 (unsigned int)enum_context
));
6681 num_account
= pdb_search_entries(dinfo
->disp_info
->groups
,
6682 enum_context
, max_entries
,
6687 smb_panic("info class changed");
6693 /* Ensure we cache this enumeration. */
6694 set_disp_info_cache_timeout(dinfo
->disp_info
, DISP_INFO_CACHE_TIMEOUT
);
6696 DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
6697 r
->in
.name
->string
));
6699 for (i
=0; i
<num_account
; i
++) {
6700 if (strequal(entries
[i
].account_name
, r
->in
.name
->string
)) {
6701 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
6702 "found %s at idx %d\n",
6703 r
->in
.name
->string
, i
));
6705 return NT_STATUS_OK
;
6709 /* assuming account_name lives at the very end */
6710 *r
->out
.idx
= num_account
;
6712 return NT_STATUS_NO_MORE_ENTRIES
;
6715 /****************************************************************
6716 _samr_GetDisplayEnumerationIndex2
6717 ****************************************************************/
6719 NTSTATUS
_samr_GetDisplayEnumerationIndex2(struct pipes_struct
*p
,
6720 struct samr_GetDisplayEnumerationIndex2
*r
)
6722 struct samr_GetDisplayEnumerationIndex q
;
6724 q
.in
.domain_handle
= r
->in
.domain_handle
;
6725 q
.in
.level
= r
->in
.level
;
6726 q
.in
.name
= r
->in
.name
;
6728 q
.out
.idx
= r
->out
.idx
;
6730 return _samr_GetDisplayEnumerationIndex(p
, &q
);
6733 /****************************************************************
6735 ****************************************************************/
6737 NTSTATUS
_samr_RidToSid(struct pipes_struct
*p
,
6738 struct samr_RidToSid
*r
)
6740 struct samr_domain_info
*dinfo
;
6744 dinfo
= policy_handle_find(p
, r
->in
.domain_handle
,
6746 struct samr_domain_info
, &status
);
6747 if (!NT_STATUS_IS_OK(status
)) {
6751 if (!sid_compose(&sid
, &dinfo
->sid
, r
->in
.rid
)) {
6752 return NT_STATUS_NO_MEMORY
;
6755 *r
->out
.sid
= dom_sid_dup(p
->mem_ctx
, &sid
);
6757 return NT_STATUS_NO_MEMORY
;
6760 return NT_STATUS_OK
;
6763 /****************************************************************
6764 ****************************************************************/
6766 static enum samr_ValidationStatus
samr_ValidatePassword_Change(TALLOC_CTX
*mem_ctx
,
6767 const struct samr_PwInfo
*dom_pw_info
,
6768 const struct samr_ValidatePasswordReq2
*req
,
6769 struct samr_ValidatePasswordRepCtr
*rep
)
6773 if (req
->password
.string
== NULL
) {
6774 return SAMR_VALIDATION_STATUS_SUCCESS
;
6776 if (strlen(req
->password
.string
) < dom_pw_info
->min_password_length
) {
6777 ZERO_STRUCT(rep
->info
);
6778 return SAMR_VALIDATION_STATUS_PWD_TOO_SHORT
;
6780 if (dom_pw_info
->password_properties
& DOMAIN_PASSWORD_COMPLEX
) {
6781 status
= check_password_complexity(req
->account
.string
,
6782 req
->password
.string
,
6784 if (!NT_STATUS_IS_OK(status
)) {
6785 ZERO_STRUCT(rep
->info
);
6786 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH
;
6790 return SAMR_VALIDATION_STATUS_SUCCESS
;
6793 /****************************************************************
6794 ****************************************************************/
6796 static enum samr_ValidationStatus
samr_ValidatePassword_Reset(TALLOC_CTX
*mem_ctx
,
6797 const struct samr_PwInfo
*dom_pw_info
,
6798 const struct samr_ValidatePasswordReq3
*req
,
6799 struct samr_ValidatePasswordRepCtr
*rep
)
6803 if (req
->password
.string
== NULL
) {
6804 return SAMR_VALIDATION_STATUS_SUCCESS
;
6806 if (strlen(req
->password
.string
) < dom_pw_info
->min_password_length
) {
6807 ZERO_STRUCT(rep
->info
);
6808 return SAMR_VALIDATION_STATUS_PWD_TOO_SHORT
;
6810 if (dom_pw_info
->password_properties
& DOMAIN_PASSWORD_COMPLEX
) {
6811 status
= check_password_complexity(req
->account
.string
,
6812 req
->password
.string
,
6814 if (!NT_STATUS_IS_OK(status
)) {
6815 ZERO_STRUCT(rep
->info
);
6816 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH
;
6820 return SAMR_VALIDATION_STATUS_SUCCESS
;
6823 /****************************************************************
6824 _samr_ValidatePassword
6825 ****************************************************************/
6827 NTSTATUS
_samr_ValidatePassword(struct pipes_struct
*p
,
6828 struct samr_ValidatePassword
*r
)
6830 union samr_ValidatePasswordRep
*rep
;
6832 struct samr_GetDomPwInfo pw
;
6833 struct samr_PwInfo dom_pw_info
;
6835 if (r
->in
.level
< 1 || r
->in
.level
> 3) {
6836 return NT_STATUS_INVALID_INFO_CLASS
;
6839 pw
.in
.domain_name
= NULL
;
6840 pw
.out
.info
= &dom_pw_info
;
6842 status
= _samr_GetDomPwInfo(p
, &pw
);
6843 if (!NT_STATUS_IS_OK(status
)) {
6847 rep
= talloc_zero(p
->mem_ctx
, union samr_ValidatePasswordRep
);
6849 return NT_STATUS_NO_MEMORY
;
6852 switch (r
->in
.level
) {
6854 status
= NT_STATUS_NOT_SUPPORTED
;
6857 rep
->ctr2
.status
= samr_ValidatePassword_Change(p
->mem_ctx
,
6863 rep
->ctr3
.status
= samr_ValidatePassword_Reset(p
->mem_ctx
,
6869 status
= NT_STATUS_INVALID_INFO_CLASS
;
6873 if (!NT_STATUS_IS_OK(status
)) {
6880 return NT_STATUS_OK
;
6883 /****************************************************************
6884 ****************************************************************/
6886 NTSTATUS
_samr_Shutdown(struct pipes_struct
*p
,
6887 struct samr_Shutdown
*r
)
6889 p
->rng_fault_state
= true;
6890 return NT_STATUS_NOT_IMPLEMENTED
;
6893 /****************************************************************
6894 ****************************************************************/
6896 NTSTATUS
_samr_SetMemberAttributesOfGroup(struct pipes_struct
*p
,
6897 struct samr_SetMemberAttributesOfGroup
*r
)
6899 p
->rng_fault_state
= true;
6900 return NT_STATUS_NOT_IMPLEMENTED
;
6903 /****************************************************************
6904 ****************************************************************/
6906 NTSTATUS
_samr_TestPrivateFunctionsDomain(struct pipes_struct
*p
,
6907 struct samr_TestPrivateFunctionsDomain
*r
)
6909 return NT_STATUS_NOT_IMPLEMENTED
;
6912 /****************************************************************
6913 ****************************************************************/
6915 NTSTATUS
_samr_TestPrivateFunctionsUser(struct pipes_struct
*p
,
6916 struct samr_TestPrivateFunctionsUser
*r
)
6918 return NT_STATUS_NOT_IMPLEMENTED
;
6921 /****************************************************************
6922 ****************************************************************/
6924 NTSTATUS
_samr_AddMultipleMembersToAlias(struct pipes_struct
*p
,
6925 struct samr_AddMultipleMembersToAlias
*r
)
6927 p
->rng_fault_state
= true;
6928 return NT_STATUS_NOT_IMPLEMENTED
;
6931 /****************************************************************
6932 ****************************************************************/
6934 NTSTATUS
_samr_RemoveMultipleMembersFromAlias(struct pipes_struct
*p
,
6935 struct samr_RemoveMultipleMembersFromAlias
*r
)
6937 p
->rng_fault_state
= true;
6938 return NT_STATUS_NOT_IMPLEMENTED
;
6941 /****************************************************************
6942 ****************************************************************/
6944 NTSTATUS
_samr_SetBootKeyInformation(struct pipes_struct
*p
,
6945 struct samr_SetBootKeyInformation
*r
)
6947 p
->rng_fault_state
= true;
6948 return NT_STATUS_NOT_IMPLEMENTED
;
6951 /****************************************************************
6952 ****************************************************************/
6954 NTSTATUS
_samr_GetBootKeyInformation(struct pipes_struct
*p
,
6955 struct samr_GetBootKeyInformation
*r
)
6957 p
->rng_fault_state
= true;
6958 return NT_STATUS_NOT_IMPLEMENTED
;
6961 /****************************************************************
6962 ****************************************************************/
6964 NTSTATUS
_samr_SetDsrmPassword(struct pipes_struct
*p
,
6965 struct samr_SetDsrmPassword
*r
)
6967 p
->rng_fault_state
= true;
6968 return NT_STATUS_NOT_IMPLEMENTED
;