s3: fix typo in net ads join output
[Samba/vl.git] / source3 / utils / net_ads.c
blob43dda0663dc3007e6d652142f7cd78ce6a2e8eeb
1 /*
2 Samba Unix/Linux SMB client library
3 net ads commands
4 Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
5 Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
6 Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
7 Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "includes.h"
24 #include "utils/net.h"
25 #include "rpc_client/cli_pipe.h"
26 #include "librpc/gen_ndr/ndr_krb5pac.h"
27 #include "../librpc/gen_ndr/ndr_spoolss.h"
28 #include "nsswitch/libwbclient/wbclient.h"
29 #include "ads.h"
30 #include "libads/cldap.h"
31 #include "libads/dns.h"
32 #include "../libds/common/flags.h"
33 #include "librpc/gen_ndr/libnet_join.h"
34 #include "libnet/libnet_join.h"
35 #include "smb_krb5.h"
36 #include "secrets.h"
37 #include "krb5_env.h"
38 #include "../libcli/security/security.h"
39 #include "libsmb/libsmb.h"
41 #ifdef HAVE_ADS
43 /* when we do not have sufficient input parameters to contact a remote domain
44 * we always fall back to our own realm - Guenther*/
46 static const char *assume_own_realm(struct net_context *c)
48 if (!c->opt_host && strequal(lp_workgroup(), c->opt_target_workgroup)) {
49 return lp_realm();
52 return NULL;
56 do a cldap netlogon query
58 static int net_ads_cldap_netlogon(struct net_context *c, ADS_STRUCT *ads)
60 char addr[INET6_ADDRSTRLEN];
61 struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
63 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
65 if ( !ads_cldap_netlogon_5(talloc_tos(), &ads->ldap.ss, ads->server.realm, &reply ) ) {
66 d_fprintf(stderr, _("CLDAP query failed!\n"));
67 return -1;
70 d_printf(_("Information for Domain Controller: %s\n\n"),
71 addr);
73 d_printf(_("Response Type: "));
74 switch (reply.command) {
75 case LOGON_SAM_LOGON_USER_UNKNOWN_EX:
76 d_printf("LOGON_SAM_LOGON_USER_UNKNOWN_EX\n");
77 break;
78 case LOGON_SAM_LOGON_RESPONSE_EX:
79 d_printf("LOGON_SAM_LOGON_RESPONSE_EX\n");
80 break;
81 default:
82 d_printf("0x%x\n", reply.command);
83 break;
86 d_printf(_("GUID: %s\n"), GUID_string(talloc_tos(),&reply.domain_uuid));
88 d_printf(_("Flags:\n"
89 "\tIs a PDC: %s\n"
90 "\tIs a GC of the forest: %s\n"
91 "\tIs an LDAP server: %s\n"
92 "\tSupports DS: %s\n"
93 "\tIs running a KDC: %s\n"
94 "\tIs running time services: %s\n"
95 "\tIs the closest DC: %s\n"
96 "\tIs writable: %s\n"
97 "\tHas a hardware clock: %s\n"
98 "\tIs a non-domain NC serviced by LDAP server: %s\n"
99 "\tIs NT6 DC that has some secrets: %s\n"
100 "\tIs NT6 DC that has all secrets: %s\n"),
101 (reply.server_type & NBT_SERVER_PDC) ? _("yes") : _("no"),
102 (reply.server_type & NBT_SERVER_GC) ? _("yes") : _("no"),
103 (reply.server_type & NBT_SERVER_LDAP) ? _("yes") : _("no"),
104 (reply.server_type & NBT_SERVER_DS) ? _("yes") : _("no"),
105 (reply.server_type & NBT_SERVER_KDC) ? _("yes") : _("no"),
106 (reply.server_type & NBT_SERVER_TIMESERV) ? _("yes") : _("no"),
107 (reply.server_type & NBT_SERVER_CLOSEST) ? _("yes") : _("no"),
108 (reply.server_type & NBT_SERVER_WRITABLE) ? _("yes") : _("no"),
109 (reply.server_type & NBT_SERVER_GOOD_TIMESERV) ? _("yes") : _("no"),
110 (reply.server_type & NBT_SERVER_NDNC) ? _("yes") : _("no"),
111 (reply.server_type & NBT_SERVER_SELECT_SECRET_DOMAIN_6) ? _("yes") : _("no"),
112 (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? _("yes") : _("no"));
115 printf(_("Forest:\t\t\t%s\n"), reply.forest);
116 printf(_("Domain:\t\t\t%s\n"), reply.dns_domain);
117 printf(_("Domain Controller:\t%s\n"), reply.pdc_dns_name);
119 printf(_("Pre-Win2k Domain:\t%s\n"), reply.domain_name);
120 printf(_("Pre-Win2k Hostname:\t%s\n"), reply.pdc_name);
122 if (*reply.user_name) printf(_("User name:\t%s\n"), reply.user_name);
124 printf(_("Server Site Name :\t\t%s\n"), reply.server_site);
125 printf(_("Client Site Name :\t\t%s\n"), reply.client_site);
127 d_printf(_("NT Version: %d\n"), reply.nt_version);
128 d_printf(_("LMNT Token: %.2x\n"), reply.lmnt_token);
129 d_printf(_("LM20 Token: %.2x\n"), reply.lm20_token);
131 return 0;
135 this implements the CLDAP based netlogon lookup requests
136 for finding the domain controller of a ADS domain
138 static int net_ads_lookup(struct net_context *c, int argc, const char **argv)
140 ADS_STRUCT *ads;
141 int ret;
143 if (c->display_usage) {
144 d_printf("%s\n"
145 "net ads lookup\n"
146 " %s",
147 _("Usage:"),
148 _("Find the ADS DC using CLDAP lookup.\n"));
149 return 0;
152 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
153 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
154 ads_destroy(&ads);
155 return -1;
158 if (!ads->config.realm) {
159 ads->config.realm = discard_const_p(char, c->opt_target_workgroup);
160 ads->ldap.port = 389;
163 ret = net_ads_cldap_netlogon(c, ads);
164 ads_destroy(&ads);
165 return ret;
170 static int net_ads_info(struct net_context *c, int argc, const char **argv)
172 ADS_STRUCT *ads;
173 char addr[INET6_ADDRSTRLEN];
175 if (c->display_usage) {
176 d_printf("%s\n"
177 "net ads info\n"
178 " %s",
179 _("Usage:"),
180 _("Display information about an Active Directory "
181 "server.\n"));
182 return 0;
185 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
186 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
187 return -1;
190 if (!ads || !ads->config.realm) {
191 d_fprintf(stderr, _("Didn't find the ldap server!\n"));
192 ads_destroy(&ads);
193 return -1;
196 /* Try to set the server's current time since we didn't do a full
197 TCP LDAP session initially */
199 if ( !ADS_ERR_OK(ads_current_time( ads )) ) {
200 d_fprintf( stderr, _("Failed to get server's current time!\n"));
203 print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
205 d_printf(_("LDAP server: %s\n"), addr);
206 d_printf(_("LDAP server name: %s\n"), ads->config.ldap_server_name);
207 d_printf(_("Realm: %s\n"), ads->config.realm);
208 d_printf(_("Bind Path: %s\n"), ads->config.bind_path);
209 d_printf(_("LDAP port: %d\n"), ads->ldap.port);
210 d_printf(_("Server time: %s\n"),
211 http_timestring(talloc_tos(), ads->config.current_time));
213 d_printf(_("KDC server: %s\n"), ads->auth.kdc_server );
214 d_printf(_("Server time offset: %d\n"), ads->auth.time_offset );
216 ads_destroy(&ads);
217 return 0;
220 static void use_in_memory_ccache(void) {
221 /* Use in-memory credentials cache so we do not interfere with
222 * existing credentials */
223 setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
226 static ADS_STATUS ads_startup_int(struct net_context *c, bool only_own_domain,
227 uint32 auth_flags, ADS_STRUCT **ads_ret)
229 ADS_STRUCT *ads = NULL;
230 ADS_STATUS status;
231 bool need_password = false;
232 bool second_time = false;
233 char *cp;
234 const char *realm = NULL;
235 bool tried_closest_dc = false;
237 /* lp_realm() should be handled by a command line param,
238 However, the join requires that realm be set in smb.conf
239 and compares our realm with the remote server's so this is
240 ok until someone needs more flexibility */
242 *ads_ret = NULL;
244 retry_connect:
245 if (only_own_domain) {
246 realm = lp_realm();
247 } else {
248 realm = assume_own_realm(c);
251 ads = ads_init(realm, c->opt_target_workgroup, c->opt_host);
253 if (!c->opt_user_name) {
254 c->opt_user_name = "administrator";
257 if (c->opt_user_specified) {
258 need_password = true;
261 retry:
262 if (!c->opt_password && need_password && !c->opt_machine_pass) {
263 c->opt_password = net_prompt_pass(c, c->opt_user_name);
264 if (!c->opt_password) {
265 ads_destroy(&ads);
266 return ADS_ERROR(LDAP_NO_MEMORY);
270 if (c->opt_password) {
271 use_in_memory_ccache();
272 SAFE_FREE(ads->auth.password);
273 ads->auth.password = smb_xstrdup(c->opt_password);
276 ads->auth.flags |= auth_flags;
277 SAFE_FREE(ads->auth.user_name);
278 ads->auth.user_name = smb_xstrdup(c->opt_user_name);
281 * If the username is of the form "name@realm",
282 * extract the realm and convert to upper case.
283 * This is only used to establish the connection.
285 if ((cp = strchr_m(ads->auth.user_name, '@'))!=0) {
286 *cp++ = '\0';
287 SAFE_FREE(ads->auth.realm);
288 ads->auth.realm = smb_xstrdup(cp);
289 strupper_m(ads->auth.realm);
292 status = ads_connect(ads);
294 if (!ADS_ERR_OK(status)) {
296 if (NT_STATUS_EQUAL(ads_ntstatus(status),
297 NT_STATUS_NO_LOGON_SERVERS)) {
298 DEBUG(0,("ads_connect: %s\n", ads_errstr(status)));
299 ads_destroy(&ads);
300 return status;
303 if (!need_password && !second_time && !(auth_flags & ADS_AUTH_NO_BIND)) {
304 need_password = true;
305 second_time = true;
306 goto retry;
307 } else {
308 ads_destroy(&ads);
309 return status;
313 /* when contacting our own domain, make sure we use the closest DC.
314 * This is done by reconnecting to ADS because only the first call to
315 * ads_connect will give us our own sitename */
317 if ((only_own_domain || !c->opt_host) && !tried_closest_dc) {
319 tried_closest_dc = true; /* avoid loop */
321 if (!ads_closest_dc(ads)) {
323 namecache_delete(ads->server.realm, 0x1C);
324 namecache_delete(ads->server.workgroup, 0x1C);
326 ads_destroy(&ads);
327 ads = NULL;
329 goto retry_connect;
333 *ads_ret = ads;
334 return status;
337 ADS_STATUS ads_startup(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
339 return ads_startup_int(c, only_own_domain, 0, ads);
342 ADS_STATUS ads_startup_nobind(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
344 return ads_startup_int(c, only_own_domain, ADS_AUTH_NO_BIND, ads);
348 Check to see if connection can be made via ads.
349 ads_startup() stores the password in opt_password if it needs to so
350 that rpc or rap can use it without re-prompting.
352 static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
354 ADS_STRUCT *ads;
355 ADS_STATUS status;
357 if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
358 return -1;
361 ads->auth.flags |= ADS_AUTH_NO_BIND;
363 status = ads_connect(ads);
364 if ( !ADS_ERR_OK(status) ) {
365 return -1;
368 ads_destroy(&ads);
369 return 0;
372 int net_ads_check_our_domain(struct net_context *c)
374 return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
377 int net_ads_check(struct net_context *c)
379 return net_ads_check_int(NULL, c->opt_workgroup, c->opt_host);
383 determine the netbios workgroup name for a domain
385 static int net_ads_workgroup(struct net_context *c, int argc, const char **argv)
387 ADS_STRUCT *ads;
388 struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
390 if (c->display_usage) {
391 d_printf ("%s\n"
392 "net ads workgroup\n"
393 " %s\n",
394 _("Usage:"),
395 _("Print the workgroup name"));
396 return 0;
399 if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
400 d_fprintf(stderr, _("Didn't find the cldap server!\n"));
401 return -1;
404 if (!ads->config.realm) {
405 ads->config.realm = discard_const_p(char, c->opt_target_workgroup);
406 ads->ldap.port = 389;
409 if ( !ads_cldap_netlogon_5(talloc_tos(), &ads->ldap.ss, ads->server.realm, &reply ) ) {
410 d_fprintf(stderr, _("CLDAP query failed!\n"));
411 ads_destroy(&ads);
412 return -1;
415 d_printf(_("Workgroup: %s\n"), reply.domain_name);
417 ads_destroy(&ads);
419 return 0;
424 static bool usergrp_display(ADS_STRUCT *ads, char *field, void **values, void *data_area)
426 char **disp_fields = (char **) data_area;
428 if (!field) { /* must be end of record */
429 if (disp_fields[0]) {
430 if (!strchr_m(disp_fields[0], '$')) {
431 if (disp_fields[1])
432 d_printf("%-21.21s %s\n",
433 disp_fields[0], disp_fields[1]);
434 else
435 d_printf("%s\n", disp_fields[0]);
438 SAFE_FREE(disp_fields[0]);
439 SAFE_FREE(disp_fields[1]);
440 return true;
442 if (!values) /* must be new field, indicate string field */
443 return true;
444 if (strcasecmp_m(field, "sAMAccountName") == 0) {
445 disp_fields[0] = SMB_STRDUP((char *) values[0]);
447 if (strcasecmp_m(field, "description") == 0)
448 disp_fields[1] = SMB_STRDUP((char *) values[0]);
449 return true;
452 static int net_ads_user_usage(struct net_context *c, int argc, const char **argv)
454 return net_user_usage(c, argc, argv);
457 static int ads_user_add(struct net_context *c, int argc, const char **argv)
459 ADS_STRUCT *ads;
460 ADS_STATUS status;
461 char *upn, *userdn;
462 LDAPMessage *res=NULL;
463 int rc = -1;
464 char *ou_str = NULL;
466 if (argc < 1 || c->display_usage)
467 return net_ads_user_usage(c, argc, argv);
469 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
470 return -1;
473 status = ads_find_user_acct(ads, &res, argv[0]);
475 if (!ADS_ERR_OK(status)) {
476 d_fprintf(stderr, _("ads_user_add: %s\n"), ads_errstr(status));
477 goto done;
480 if (ads_count_replies(ads, res)) {
481 d_fprintf(stderr, _("ads_user_add: User %s already exists\n"),
482 argv[0]);
483 goto done;
486 if (c->opt_container) {
487 ou_str = SMB_STRDUP(c->opt_container);
488 } else {
489 ou_str = ads_default_ou_string(ads, DS_GUID_USERS_CONTAINER);
492 status = ads_add_user_acct(ads, argv[0], ou_str, c->opt_comment);
494 if (!ADS_ERR_OK(status)) {
495 d_fprintf(stderr, _("Could not add user %s: %s\n"), argv[0],
496 ads_errstr(status));
497 goto done;
500 /* if no password is to be set, we're done */
501 if (argc == 1) {
502 d_printf(_("User %s added\n"), argv[0]);
503 rc = 0;
504 goto done;
507 /* try setting the password */
508 if (asprintf(&upn, "%s@%s", argv[0], ads->config.realm) == -1) {
509 goto done;
511 status = ads_krb5_set_password(ads->auth.kdc_server, upn, argv[1],
512 ads->auth.time_offset);
513 SAFE_FREE(upn);
514 if (ADS_ERR_OK(status)) {
515 d_printf(_("User %s added\n"), argv[0]);
516 rc = 0;
517 goto done;
520 /* password didn't set, delete account */
521 d_fprintf(stderr, _("Could not add user %s. "
522 "Error setting password %s\n"),
523 argv[0], ads_errstr(status));
524 ads_msgfree(ads, res);
525 status=ads_find_user_acct(ads, &res, argv[0]);
526 if (ADS_ERR_OK(status)) {
527 userdn = ads_get_dn(ads, talloc_tos(), res);
528 ads_del_dn(ads, userdn);
529 TALLOC_FREE(userdn);
532 done:
533 if (res)
534 ads_msgfree(ads, res);
535 ads_destroy(&ads);
536 SAFE_FREE(ou_str);
537 return rc;
540 static int ads_user_info(struct net_context *c, int argc, const char **argv)
542 ADS_STRUCT *ads = NULL;
543 ADS_STATUS rc;
544 LDAPMessage *res = NULL;
545 TALLOC_CTX *frame;
546 int ret = 0;
547 wbcErr wbc_status;
548 const char *attrs[] = {"memberOf", "primaryGroupID", NULL};
549 char *searchstring=NULL;
550 char **grouplist;
551 char *primary_group;
552 char *escaped_user;
553 struct dom_sid primary_group_sid;
554 uint32_t group_rid;
555 enum wbcSidType type;
557 if (argc < 1 || c->display_usage) {
558 return net_ads_user_usage(c, argc, argv);
561 frame = talloc_new(talloc_tos());
562 if (frame == NULL) {
563 return -1;
566 escaped_user = escape_ldap_string(frame, argv[0]);
567 if (!escaped_user) {
568 d_fprintf(stderr,
569 _("ads_user_info: failed to escape user %s\n"),
570 argv[0]);
571 return -1;
574 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
575 ret = -1;
576 goto error;
579 if (asprintf(&searchstring, "(sAMAccountName=%s)", escaped_user) == -1) {
580 ret =-1;
581 goto error;
583 rc = ads_search(ads, &res, searchstring, attrs);
584 SAFE_FREE(searchstring);
586 if (!ADS_ERR_OK(rc)) {
587 d_fprintf(stderr, _("ads_search: %s\n"), ads_errstr(rc));
588 ret = -1;
589 goto error;
592 if (!ads_pull_uint32(ads, res, "primaryGroupID", &group_rid)) {
593 d_fprintf(stderr, _("ads_pull_uint32 failed\n"));
594 ret = -1;
595 goto error;
598 rc = ads_domain_sid(ads, &primary_group_sid);
599 if (!ADS_ERR_OK(rc)) {
600 d_fprintf(stderr, _("ads_domain_sid: %s\n"), ads_errstr(rc));
601 ret = -1;
602 goto error;
605 sid_append_rid(&primary_group_sid, group_rid);
607 wbc_status = wbcLookupSid((struct wbcDomainSid *)&primary_group_sid,
608 NULL, /* don't look up domain */
609 &primary_group,
610 &type);
611 if (!WBC_ERROR_IS_OK(wbc_status)) {
612 d_fprintf(stderr, "wbcLookupSid: %s\n",
613 wbcErrorString(wbc_status));
614 ret = -1;
615 goto error;
618 d_printf("%s\n", primary_group);
620 wbcFreeMemory(primary_group);
622 grouplist = ldap_get_values((LDAP *)ads->ldap.ld,
623 (LDAPMessage *)res, "memberOf");
625 if (grouplist) {
626 int i;
627 char **groupname;
628 for (i=0;grouplist[i];i++) {
629 groupname = ldap_explode_dn(grouplist[i], 1);
630 d_printf("%s\n", groupname[0]);
631 ldap_value_free(groupname);
633 ldap_value_free(grouplist);
636 error:
637 if (res) ads_msgfree(ads, res);
638 if (ads) ads_destroy(&ads);
639 TALLOC_FREE(frame);
640 return ret;
643 static int ads_user_delete(struct net_context *c, int argc, const char **argv)
645 ADS_STRUCT *ads;
646 ADS_STATUS rc;
647 LDAPMessage *res = NULL;
648 char *userdn;
650 if (argc < 1) {
651 return net_ads_user_usage(c, argc, argv);
654 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
655 return -1;
658 rc = ads_find_user_acct(ads, &res, argv[0]);
659 if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
660 d_printf(_("User %s does not exist.\n"), argv[0]);
661 ads_msgfree(ads, res);
662 ads_destroy(&ads);
663 return -1;
665 userdn = ads_get_dn(ads, talloc_tos(), res);
666 ads_msgfree(ads, res);
667 rc = ads_del_dn(ads, userdn);
668 TALLOC_FREE(userdn);
669 if (ADS_ERR_OK(rc)) {
670 d_printf(_("User %s deleted\n"), argv[0]);
671 ads_destroy(&ads);
672 return 0;
674 d_fprintf(stderr, _("Error deleting user %s: %s\n"), argv[0],
675 ads_errstr(rc));
676 ads_destroy(&ads);
677 return -1;
680 int net_ads_user(struct net_context *c, int argc, const char **argv)
682 struct functable func[] = {
684 "add",
685 ads_user_add,
686 NET_TRANSPORT_ADS,
687 N_("Add an AD user"),
688 N_("net ads user add\n"
689 " Add an AD user")
692 "info",
693 ads_user_info,
694 NET_TRANSPORT_ADS,
695 N_("Display information about an AD user"),
696 N_("net ads user info\n"
697 " Display information about an AD user")
700 "delete",
701 ads_user_delete,
702 NET_TRANSPORT_ADS,
703 N_("Delete an AD user"),
704 N_("net ads user delete\n"
705 " Delete an AD user")
707 {NULL, NULL, 0, NULL, NULL}
709 ADS_STRUCT *ads;
710 ADS_STATUS rc;
711 const char *shortattrs[] = {"sAMAccountName", NULL};
712 const char *longattrs[] = {"sAMAccountName", "description", NULL};
713 char *disp_fields[2] = {NULL, NULL};
715 if (argc == 0) {
716 if (c->display_usage) {
717 d_printf( "%s\n"
718 "net ads user\n"
719 " %s\n",
720 _("Usage:"),
721 _("List AD users"));
722 net_display_usage_from_functable(func);
723 return 0;
726 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
727 return -1;
730 if (c->opt_long_list_entries)
731 d_printf(_("\nUser name Comment"
732 "\n-----------------------------\n"));
734 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
735 LDAP_SCOPE_SUBTREE,
736 "(objectCategory=user)",
737 c->opt_long_list_entries ? longattrs :
738 shortattrs, usergrp_display,
739 disp_fields);
740 ads_destroy(&ads);
741 return ADS_ERR_OK(rc) ? 0 : -1;
744 return net_run_function(c, argc, argv, "net ads user", func);
747 static int net_ads_group_usage(struct net_context *c, int argc, const char **argv)
749 return net_group_usage(c, argc, argv);
752 static int ads_group_add(struct net_context *c, int argc, const char **argv)
754 ADS_STRUCT *ads;
755 ADS_STATUS status;
756 LDAPMessage *res=NULL;
757 int rc = -1;
758 char *ou_str = NULL;
760 if (argc < 1 || c->display_usage) {
761 return net_ads_group_usage(c, argc, argv);
764 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
765 return -1;
768 status = ads_find_user_acct(ads, &res, argv[0]);
770 if (!ADS_ERR_OK(status)) {
771 d_fprintf(stderr, _("ads_group_add: %s\n"), ads_errstr(status));
772 goto done;
775 if (ads_count_replies(ads, res)) {
776 d_fprintf(stderr, _("ads_group_add: Group %s already exists\n"), argv[0]);
777 goto done;
780 if (c->opt_container) {
781 ou_str = SMB_STRDUP(c->opt_container);
782 } else {
783 ou_str = ads_default_ou_string(ads, DS_GUID_USERS_CONTAINER);
786 status = ads_add_group_acct(ads, argv[0], ou_str, c->opt_comment);
788 if (ADS_ERR_OK(status)) {
789 d_printf(_("Group %s added\n"), argv[0]);
790 rc = 0;
791 } else {
792 d_fprintf(stderr, _("Could not add group %s: %s\n"), argv[0],
793 ads_errstr(status));
796 done:
797 if (res)
798 ads_msgfree(ads, res);
799 ads_destroy(&ads);
800 SAFE_FREE(ou_str);
801 return rc;
804 static int ads_group_delete(struct net_context *c, int argc, const char **argv)
806 ADS_STRUCT *ads;
807 ADS_STATUS rc;
808 LDAPMessage *res = NULL;
809 char *groupdn;
811 if (argc < 1 || c->display_usage) {
812 return net_ads_group_usage(c, argc, argv);
815 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
816 return -1;
819 rc = ads_find_user_acct(ads, &res, argv[0]);
820 if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
821 d_printf(_("Group %s does not exist.\n"), argv[0]);
822 ads_msgfree(ads, res);
823 ads_destroy(&ads);
824 return -1;
826 groupdn = ads_get_dn(ads, talloc_tos(), res);
827 ads_msgfree(ads, res);
828 rc = ads_del_dn(ads, groupdn);
829 TALLOC_FREE(groupdn);
830 if (ADS_ERR_OK(rc)) {
831 d_printf(_("Group %s deleted\n"), argv[0]);
832 ads_destroy(&ads);
833 return 0;
835 d_fprintf(stderr, _("Error deleting group %s: %s\n"), argv[0],
836 ads_errstr(rc));
837 ads_destroy(&ads);
838 return -1;
841 int net_ads_group(struct net_context *c, int argc, const char **argv)
843 struct functable func[] = {
845 "add",
846 ads_group_add,
847 NET_TRANSPORT_ADS,
848 N_("Add an AD group"),
849 N_("net ads group add\n"
850 " Add an AD group")
853 "delete",
854 ads_group_delete,
855 NET_TRANSPORT_ADS,
856 N_("Delete an AD group"),
857 N_("net ads group delete\n"
858 " Delete an AD group")
860 {NULL, NULL, 0, NULL, NULL}
862 ADS_STRUCT *ads;
863 ADS_STATUS rc;
864 const char *shortattrs[] = {"sAMAccountName", NULL};
865 const char *longattrs[] = {"sAMAccountName", "description", NULL};
866 char *disp_fields[2] = {NULL, NULL};
868 if (argc == 0) {
869 if (c->display_usage) {
870 d_printf( "%s\n"
871 "net ads group\n"
872 " %s\n",
873 _("Usage:"),
874 _("List AD groups"));
875 net_display_usage_from_functable(func);
876 return 0;
879 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
880 return -1;
883 if (c->opt_long_list_entries)
884 d_printf(_("\nGroup name Comment"
885 "\n-----------------------------\n"));
886 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
887 LDAP_SCOPE_SUBTREE,
888 "(objectCategory=group)",
889 c->opt_long_list_entries ? longattrs :
890 shortattrs, usergrp_display,
891 disp_fields);
893 ads_destroy(&ads);
894 return ADS_ERR_OK(rc) ? 0 : -1;
896 return net_run_function(c, argc, argv, "net ads group", func);
899 static int net_ads_status(struct net_context *c, int argc, const char **argv)
901 ADS_STRUCT *ads;
902 ADS_STATUS rc;
903 LDAPMessage *res;
905 if (c->display_usage) {
906 d_printf( "%s\n"
907 "net ads status\n"
908 " %s\n",
909 _("Usage:"),
910 _("Display machine account details"));
911 return 0;
914 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
915 return -1;
918 rc = ads_find_machine_acct(ads, &res, lp_netbios_name());
919 if (!ADS_ERR_OK(rc)) {
920 d_fprintf(stderr, _("ads_find_machine_acct: %s\n"), ads_errstr(rc));
921 ads_destroy(&ads);
922 return -1;
925 if (ads_count_replies(ads, res) == 0) {
926 d_fprintf(stderr, _("No machine account for '%s' found\n"), lp_netbios_name());
927 ads_destroy(&ads);
928 return -1;
931 ads_dump(ads, res);
932 ads_destroy(&ads);
933 return 0;
936 /*******************************************************************
937 Leave an AD domain. Windows XP disables the machine account.
938 We'll try the same. The old code would do an LDAP delete.
939 That only worked using the machine creds because added the machine
940 with full control to the computer object's ACL.
941 *******************************************************************/
943 static int net_ads_leave(struct net_context *c, int argc, const char **argv)
945 TALLOC_CTX *ctx;
946 struct libnet_UnjoinCtx *r = NULL;
947 WERROR werr;
949 if (c->display_usage) {
950 d_printf( "%s\n"
951 "net ads leave\n"
952 " %s\n",
953 _("Usage:"),
954 _("Leave an AD domain"));
955 return 0;
958 if (!*lp_realm()) {
959 d_fprintf(stderr, _("No realm set, are we joined ?\n"));
960 return -1;
963 if (!(ctx = talloc_init("net_ads_leave"))) {
964 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
965 return -1;
968 if (!c->opt_kerberos) {
969 use_in_memory_ccache();
972 if (!c->msg_ctx) {
973 d_fprintf(stderr, _("Could not initialise message context. "
974 "Try running as root\n"));
975 return -1;
978 werr = libnet_init_UnjoinCtx(ctx, &r);
979 if (!W_ERROR_IS_OK(werr)) {
980 d_fprintf(stderr, _("Could not initialise unjoin context.\n"));
981 return -1;
984 r->in.debug = true;
985 r->in.use_kerberos = c->opt_kerberos;
986 r->in.dc_name = c->opt_host;
987 r->in.domain_name = lp_realm();
988 r->in.admin_account = c->opt_user_name;
989 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
990 r->in.modify_config = lp_config_backend_is_registry();
992 /* Try to delete it, but if that fails, disable it. The
993 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE really means "disable */
994 r->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
995 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
996 r->in.delete_machine_account = true;
997 r->in.msg_ctx = c->msg_ctx;
999 werr = libnet_Unjoin(ctx, r);
1000 if (!W_ERROR_IS_OK(werr)) {
1001 d_printf(_("Failed to leave domain: %s\n"),
1002 r->out.error_string ? r->out.error_string :
1003 get_friendly_werror_msg(werr));
1004 goto done;
1007 if (r->out.deleted_machine_account) {
1008 d_printf(_("Deleted account for '%s' in realm '%s'\n"),
1009 r->in.machine_name, r->out.dns_domain_name);
1010 goto done;
1013 /* We couldn't delete it - see if the disable succeeded. */
1014 if (r->out.disabled_machine_account) {
1015 d_printf(_("Disabled account for '%s' in realm '%s'\n"),
1016 r->in.machine_name, r->out.dns_domain_name);
1017 werr = WERR_OK;
1018 goto done;
1021 /* Based on what we requseted, we shouldn't get here, but if
1022 we did, it means the secrets were removed, and therefore
1023 we have left the domain */
1024 d_fprintf(stderr, _("Machine '%s' Left domain '%s'\n"),
1025 r->in.machine_name, r->out.dns_domain_name);
1027 done:
1028 TALLOC_FREE(r);
1029 TALLOC_FREE(ctx);
1031 if (W_ERROR_IS_OK(werr)) {
1032 return 0;
1035 return -1;
1038 static NTSTATUS net_ads_join_ok(struct net_context *c)
1040 ADS_STRUCT *ads = NULL;
1041 ADS_STATUS status;
1042 fstring dc_name;
1043 struct sockaddr_storage dcip;
1045 if (!secrets_init()) {
1046 DEBUG(1,("Failed to initialise secrets database\n"));
1047 return NT_STATUS_ACCESS_DENIED;
1050 net_use_krb_machine_account(c);
1052 get_dc_name(lp_workgroup(), lp_realm(), dc_name, &dcip);
1054 status = ads_startup(c, true, &ads);
1055 if (!ADS_ERR_OK(status)) {
1056 return ads_ntstatus(status);
1059 ads_destroy(&ads);
1060 return NT_STATUS_OK;
1064 check that an existing join is OK
1066 int net_ads_testjoin(struct net_context *c, int argc, const char **argv)
1068 NTSTATUS status;
1069 use_in_memory_ccache();
1071 if (c->display_usage) {
1072 d_printf( "%s\n"
1073 "net ads testjoin\n"
1074 " %s\n",
1075 _("Usage:"),
1076 _("Test if the existing join is ok"));
1077 return 0;
1080 /* Display success or failure */
1081 status = net_ads_join_ok(c);
1082 if (!NT_STATUS_IS_OK(status)) {
1083 fprintf(stderr, _("Join to domain is not valid: %s\n"),
1084 get_friendly_nt_error_msg(status));
1085 return -1;
1088 printf(_("Join is OK\n"));
1089 return 0;
1092 /*******************************************************************
1093 Simple configu checks before beginning the join
1094 ********************************************************************/
1096 static WERROR check_ads_config( void )
1098 if (lp_server_role() != ROLE_DOMAIN_MEMBER ) {
1099 d_printf(_("Host is not configured as a member server.\n"));
1100 return WERR_INVALID_DOMAIN_ROLE;
1103 if (strlen(lp_netbios_name()) > 15) {
1104 d_printf(_("Our netbios name can be at most 15 chars long, "
1105 "\"%s\" is %u chars long\n"), lp_netbios_name(),
1106 (unsigned int)strlen(lp_netbios_name()));
1107 return WERR_INVALID_COMPUTERNAME;
1110 if ( lp_security() == SEC_ADS && !*lp_realm()) {
1111 d_fprintf(stderr, _("realm must be set in in %s for ADS "
1112 "join to succeed.\n"), get_dyn_CONFIGFILE());
1113 return WERR_INVALID_PARAM;
1116 return WERR_OK;
1119 /*******************************************************************
1120 Send a DNS update request
1121 *******************************************************************/
1123 #if defined(WITH_DNS_UPDATES)
1124 #include "../lib/addns/dns.h"
1125 DNS_ERROR DoDNSUpdate(char *pszServerName,
1126 const char *pszDomainName, const char *pszHostName,
1127 const struct sockaddr_storage *sslist,
1128 size_t num_addrs );
1130 static NTSTATUS net_update_dns_internal(TALLOC_CTX *ctx, ADS_STRUCT *ads,
1131 const char *machine_name,
1132 const struct sockaddr_storage *addrs,
1133 int num_addrs)
1135 struct dns_rr_ns *nameservers = NULL;
1136 int ns_count = 0, i;
1137 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1138 DNS_ERROR dns_err;
1139 fstring dns_server;
1140 const char *dnsdomain = NULL;
1141 char *root_domain = NULL;
1143 if ( (dnsdomain = strchr_m( machine_name, '.')) == NULL ) {
1144 d_printf(_("No DNS domain configured for %s. "
1145 "Unable to perform DNS Update.\n"), machine_name);
1146 status = NT_STATUS_INVALID_PARAMETER;
1147 goto done;
1149 dnsdomain++;
1151 status = ads_dns_lookup_ns( ctx, dnsdomain, &nameservers, &ns_count );
1152 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1153 /* Child domains often do not have NS records. Look
1154 for the NS record for the forest root domain
1155 (rootDomainNamingContext in therootDSE) */
1157 const char *rootname_attrs[] = { "rootDomainNamingContext", NULL };
1158 LDAPMessage *msg = NULL;
1159 char *root_dn;
1160 ADS_STATUS ads_status;
1162 if ( !ads->ldap.ld ) {
1163 ads_status = ads_connect( ads );
1164 if ( !ADS_ERR_OK(ads_status) ) {
1165 DEBUG(0,("net_update_dns_internal: Failed to connect to our DC!\n"));
1166 goto done;
1170 ads_status = ads_do_search(ads, "", LDAP_SCOPE_BASE,
1171 "(objectclass=*)", rootname_attrs, &msg);
1172 if (!ADS_ERR_OK(ads_status)) {
1173 goto done;
1176 root_dn = ads_pull_string(ads, ctx, msg, "rootDomainNamingContext");
1177 if ( !root_dn ) {
1178 ads_msgfree( ads, msg );
1179 goto done;
1182 root_domain = ads_build_domain( root_dn );
1184 /* cleanup */
1185 ads_msgfree( ads, msg );
1187 /* try again for NS servers */
1189 status = ads_dns_lookup_ns( ctx, root_domain, &nameservers, &ns_count );
1191 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1192 DEBUG(3,("net_ads_join: Failed to find name server for the %s "
1193 "realm\n", ads->config.realm));
1194 goto done;
1197 dnsdomain = root_domain;
1201 for (i=0; i < ns_count; i++) {
1203 status = NT_STATUS_UNSUCCESSFUL;
1205 /* Now perform the dns update - we'll try non-secure and if we fail,
1206 we'll follow it up with a secure update */
1208 fstrcpy( dns_server, nameservers[i].hostname );
1210 dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs);
1211 if (ERR_DNS_IS_OK(dns_err)) {
1212 status = NT_STATUS_OK;
1213 goto done;
1216 if (ERR_DNS_EQUAL(dns_err, ERROR_DNS_INVALID_NAME_SERVER) ||
1217 ERR_DNS_EQUAL(dns_err, ERROR_DNS_CONNECTION_FAILED) ||
1218 ERR_DNS_EQUAL(dns_err, ERROR_DNS_SOCKET_ERROR)) {
1219 DEBUG(1,("retrying DNS update with next nameserver after receiving %s\n",
1220 dns_errstr(dns_err)));
1221 continue;
1224 d_printf(_("DNS Update for %s failed: %s\n"),
1225 machine_name, dns_errstr(dns_err));
1226 status = NT_STATUS_UNSUCCESSFUL;
1227 goto done;
1230 done:
1232 SAFE_FREE( root_domain );
1234 return status;
1237 static NTSTATUS net_update_dns_ext(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads,
1238 const char *hostname,
1239 struct sockaddr_storage *iplist,
1240 int num_addrs)
1242 struct sockaddr_storage *iplist_alloc = NULL;
1243 fstring machine_name;
1244 NTSTATUS status;
1246 if (hostname) {
1247 fstrcpy(machine_name, hostname);
1248 } else {
1249 name_to_fqdn( machine_name, lp_netbios_name() );
1251 strlower_m( machine_name );
1253 if (num_addrs == 0 || iplist == NULL) {
1255 * Get our ip address
1256 * (not the 127.0.0.x address but a real ip address)
1258 num_addrs = get_my_ip_address(&iplist_alloc);
1259 if ( num_addrs <= 0 ) {
1260 DEBUG(4, ("net_update_dns_ext: Failed to find my "
1261 "non-loopback IP addresses!\n"));
1262 return NT_STATUS_INVALID_PARAMETER;
1264 iplist = iplist_alloc;
1267 status = net_update_dns_internal(mem_ctx, ads, machine_name,
1268 iplist, num_addrs);
1270 SAFE_FREE(iplist_alloc);
1271 return status;
1274 static NTSTATUS net_update_dns(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads, const char *hostname)
1276 NTSTATUS status;
1278 status = net_update_dns_ext(mem_ctx, ads, hostname, NULL, 0);
1279 return status;
1281 #endif
1284 /*******************************************************************
1285 ********************************************************************/
1287 static int net_ads_join_usage(struct net_context *c, int argc, const char **argv)
1289 d_printf(_("net ads join [options]\n"
1290 "Valid options:\n"));
1291 d_printf(_(" createupn[=UPN] Set the userPrincipalName attribute during the join.\n"
1292 " The deault UPN is in the form host/netbiosname@REALM.\n"));
1293 d_printf(_(" createcomputer=OU Precreate the computer account in a specific OU.\n"
1294 " The OU string read from top to bottom without RDNs and delimited by a '/'.\n"
1295 " E.g. \"createcomputer=Computers/Servers/Unix\"\n"
1296 " NB: A backslash '\\' is used as escape at multiple levels and may\n"
1297 " need to be doubled or even quadrupled. It is not used as a separator.\n"));
1298 d_printf(_(" osName=string Set the operatingSystem attribute during the join.\n"));
1299 d_printf(_(" osVer=string Set the operatingSystemVersion attribute during the join.\n"
1300 " NB: osName and osVer must be specified together for either to take effect.\n"
1301 " Also, the operatingSystemService attribute is also set when along with\n"
1302 " the two other attributes.\n"));
1304 return -1;
1307 /*******************************************************************
1308 ********************************************************************/
1310 int net_ads_join(struct net_context *c, int argc, const char **argv)
1312 TALLOC_CTX *ctx = NULL;
1313 struct libnet_JoinCtx *r = NULL;
1314 const char *domain = lp_realm();
1315 WERROR werr = WERR_SETUP_NOT_JOINED;
1316 bool createupn = false;
1317 const char *machineupn = NULL;
1318 const char *create_in_ou = NULL;
1319 int i;
1320 const char *os_name = NULL;
1321 const char *os_version = NULL;
1322 bool modify_config = lp_config_backend_is_registry();
1324 if (c->display_usage)
1325 return net_ads_join_usage(c, argc, argv);
1327 if (!modify_config) {
1329 werr = check_ads_config();
1330 if (!W_ERROR_IS_OK(werr)) {
1331 d_fprintf(stderr, _("Invalid configuration. Exiting....\n"));
1332 goto fail;
1336 if (!(ctx = talloc_init("net_ads_join"))) {
1337 d_fprintf(stderr, _("Could not initialise talloc context.\n"));
1338 werr = WERR_NOMEM;
1339 goto fail;
1342 if (!c->opt_kerberos) {
1343 use_in_memory_ccache();
1346 werr = libnet_init_JoinCtx(ctx, &r);
1347 if (!W_ERROR_IS_OK(werr)) {
1348 goto fail;
1351 /* process additional command line args */
1353 for ( i=0; i<argc; i++ ) {
1354 if ( !strncasecmp_m(argv[i], "createupn", strlen("createupn")) ) {
1355 createupn = true;
1356 machineupn = get_string_param(argv[i]);
1358 else if ( !strncasecmp_m(argv[i], "createcomputer", strlen("createcomputer")) ) {
1359 if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
1360 d_fprintf(stderr, _("Please supply a valid OU path.\n"));
1361 werr = WERR_INVALID_PARAM;
1362 goto fail;
1365 else if ( !strncasecmp_m(argv[i], "osName", strlen("osName")) ) {
1366 if ( (os_name = get_string_param(argv[i])) == NULL ) {
1367 d_fprintf(stderr, _("Please supply a operating system name.\n"));
1368 werr = WERR_INVALID_PARAM;
1369 goto fail;
1372 else if ( !strncasecmp_m(argv[i], "osVer", strlen("osVer")) ) {
1373 if ( (os_version = get_string_param(argv[i])) == NULL ) {
1374 d_fprintf(stderr, _("Please supply a valid operating system version.\n"));
1375 werr = WERR_INVALID_PARAM;
1376 goto fail;
1379 else {
1380 domain = argv[i];
1384 if (!*domain) {
1385 d_fprintf(stderr, _("Please supply a valid domain name\n"));
1386 werr = WERR_INVALID_PARAM;
1387 goto fail;
1390 if (!c->msg_ctx) {
1391 d_fprintf(stderr, _("Could not initialise message context. "
1392 "Try running as root\n"));
1393 werr = WERR_ACCESS_DENIED;
1394 goto fail;
1397 /* Do the domain join here */
1399 r->in.domain_name = domain;
1400 r->in.create_upn = createupn;
1401 r->in.upn = machineupn;
1402 r->in.account_ou = create_in_ou;
1403 r->in.os_name = os_name;
1404 r->in.os_version = os_version;
1405 r->in.dc_name = c->opt_host;
1406 r->in.admin_account = c->opt_user_name;
1407 r->in.admin_password = net_prompt_pass(c, c->opt_user_name);
1408 r->in.debug = true;
1409 r->in.use_kerberos = c->opt_kerberos;
1410 r->in.modify_config = modify_config;
1411 r->in.join_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1412 WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
1413 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
1414 r->in.msg_ctx = c->msg_ctx;
1416 werr = libnet_Join(ctx, r);
1417 if (W_ERROR_EQUAL(werr, WERR_DCNOTFOUND) &&
1418 strequal(domain, lp_realm())) {
1419 r->in.domain_name = lp_workgroup();
1420 werr = libnet_Join(ctx, r);
1422 if (!W_ERROR_IS_OK(werr)) {
1423 goto fail;
1426 /* Check the short name of the domain */
1428 if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
1429 d_printf(_("The workgroup in %s does not match the short\n"
1430 "domain name obtained from the server.\n"
1431 "Using the name [%s] from the server.\n"
1432 "You should set \"workgroup = %s\" in %s.\n"),
1433 get_dyn_CONFIGFILE(), r->out.netbios_domain_name,
1434 r->out.netbios_domain_name, get_dyn_CONFIGFILE());
1437 d_printf(_("Using short domain name -- %s\n"), r->out.netbios_domain_name);
1439 if (r->out.dns_domain_name) {
1440 d_printf(_("Joined '%s' to realm '%s'\n"), r->in.machine_name,
1441 r->out.dns_domain_name);
1442 } else {
1443 d_printf(_("Joined '%s' to domain '%s'\n"), r->in.machine_name,
1444 r->out.netbios_domain_name);
1447 #if defined(WITH_DNS_UPDATES)
1449 * In a clustered environment, don't do dynamic dns updates:
1450 * Registering the set of ip addresses that are assigned to
1451 * the interfaces of the node that performs the join does usually
1452 * not have the desired effect, since the local interfaces do not
1453 * carry the complete set of the cluster's public IP addresses.
1454 * And it can also contain internal addresses that should not
1455 * be visible to the outside at all.
1456 * In order to do dns updates in a clustererd setup, use
1457 * net ads dns register.
1459 if (lp_clustering()) {
1460 d_fprintf(stderr, _("Not doing automatic DNS update in a "
1461 "clustered setup.\n"));
1462 goto done;
1465 if (r->out.domain_is_ad) {
1466 /* We enter this block with user creds */
1467 ADS_STRUCT *ads_dns = NULL;
1469 if ( (ads_dns = ads_init( lp_realm(), NULL, r->in.dc_name )) != NULL ) {
1470 /* kinit with the machine password */
1472 use_in_memory_ccache();
1473 if (asprintf( &ads_dns->auth.user_name, "%s$", lp_netbios_name()) == -1) {
1474 goto fail;
1476 ads_dns->auth.password = secrets_fetch_machine_password(
1477 r->out.netbios_domain_name, NULL, NULL );
1478 ads_dns->auth.realm = SMB_STRDUP( r->out.dns_domain_name );
1479 strupper_m(ads_dns->auth.realm );
1480 ads_kinit_password( ads_dns );
1483 if ( !ads_dns || !NT_STATUS_IS_OK(net_update_dns( ctx, ads_dns, NULL)) ) {
1484 d_fprintf( stderr, _("DNS update failed!\n") );
1487 /* exit from this block using machine creds */
1488 ads_destroy(&ads_dns);
1491 done:
1492 #endif
1494 TALLOC_FREE(r);
1495 TALLOC_FREE( ctx );
1497 return 0;
1499 fail:
1500 /* issue an overall failure message at the end. */
1501 d_printf(_("Failed to join domain: %s\n"),
1502 r && r->out.error_string ? r->out.error_string :
1503 get_friendly_werror_msg(werr));
1504 TALLOC_FREE( ctx );
1506 return -1;
1509 /*******************************************************************
1510 ********************************************************************/
1512 static int net_ads_dns_register(struct net_context *c, int argc, const char **argv)
1514 #if defined(WITH_DNS_UPDATES)
1515 ADS_STRUCT *ads;
1516 ADS_STATUS status;
1517 NTSTATUS ntstatus;
1518 TALLOC_CTX *ctx;
1519 const char *hostname = NULL;
1520 const char **addrs_list = NULL;
1521 struct sockaddr_storage *addrs = NULL;
1522 int num_addrs = 0;
1523 int count;
1525 #ifdef DEVELOPER
1526 talloc_enable_leak_report();
1527 #endif
1529 if (argc <= 1 && lp_clustering() && lp_cluster_addresses() == NULL) {
1530 d_fprintf(stderr, _("Refusing DNS updates with automatic "
1531 "detection of addresses in a clustered "
1532 "setup.\n"));
1533 c->display_usage = true;
1536 if (c->display_usage) {
1537 d_printf( "%s\n"
1538 "net ads dns register [hostname [IP [IP...]]]\n"
1539 " %s\n",
1540 _("Usage:"),
1541 _("Register hostname with DNS\n"));
1542 return -1;
1545 if (!(ctx = talloc_init("net_ads_dns"))) {
1546 d_fprintf(stderr, _("Could not initialise talloc context\n"));
1547 return -1;
1550 if (argc >= 1) {
1551 hostname = argv[0];
1554 if (argc > 1) {
1555 num_addrs = argc - 1;
1556 addrs_list = &argv[1];
1557 } else if (lp_clustering()) {
1558 addrs_list = lp_cluster_addresses();
1559 num_addrs = str_list_length(addrs_list);
1562 if (num_addrs > 0) {
1563 addrs = talloc_zero_array(ctx, struct sockaddr_storage, num_addrs);
1564 if (addrs == NULL) {
1565 d_fprintf(stderr, _("Error allocating memory!\n"));
1566 talloc_free(ctx);
1567 return -1;
1571 for (count = 0; count < num_addrs; count++) {
1572 if (!interpret_string_addr(&addrs[count], addrs_list[count], 0)) {
1573 d_fprintf(stderr, "%s '%s'.\n",
1574 _("Cannot interpret address"),
1575 addrs_list[count]);
1576 talloc_free(ctx);
1577 return -1;
1581 status = ads_startup(c, true, &ads);
1582 if ( !ADS_ERR_OK(status) ) {
1583 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status)));
1584 TALLOC_FREE(ctx);
1585 return -1;
1588 ntstatus = net_update_dns_ext(ctx, ads, hostname, addrs, num_addrs);
1589 if (!NT_STATUS_IS_OK(ntstatus)) {
1590 d_fprintf( stderr, _("DNS update failed!\n") );
1591 ads_destroy( &ads );
1592 TALLOC_FREE( ctx );
1593 return -1;
1596 d_fprintf( stderr, _("Successfully registered hostname with DNS\n") );
1598 ads_destroy(&ads);
1599 TALLOC_FREE( ctx );
1601 return 0;
1602 #else
1603 d_fprintf(stderr,
1604 _("DNS update support not enabled at compile time!\n"));
1605 return -1;
1606 #endif
1609 #if defined(WITH_DNS_UPDATES)
1610 DNS_ERROR do_gethostbyname(const char *server, const char *host);
1611 #endif
1613 static int net_ads_dns_gethostbyname(struct net_context *c, int argc, const char **argv)
1615 #if defined(WITH_DNS_UPDATES)
1616 DNS_ERROR err;
1618 #ifdef DEVELOPER
1619 talloc_enable_leak_report();
1620 #endif
1622 if (argc != 2 || c->display_usage) {
1623 d_printf( "%s\n"
1624 " %s\n"
1625 " %s\n",
1626 _("Usage:"),
1627 _("net ads dns gethostbyname <server> <name>\n"),
1628 _(" Look up hostname from the AD\n"
1629 " server\tName server to use\n"
1630 " name\tName to look up\n"));
1631 return -1;
1634 err = do_gethostbyname(argv[0], argv[1]);
1636 d_printf(_("do_gethostbyname returned %s (%d)\n"),
1637 dns_errstr(err), ERROR_DNS_V(err));
1638 #endif
1639 return 0;
1642 static int net_ads_dns(struct net_context *c, int argc, const char *argv[])
1644 struct functable func[] = {
1646 "register",
1647 net_ads_dns_register,
1648 NET_TRANSPORT_ADS,
1649 N_("Add host dns entry to AD"),
1650 N_("net ads dns register\n"
1651 " Add host dns entry to AD")
1654 "gethostbyname",
1655 net_ads_dns_gethostbyname,
1656 NET_TRANSPORT_ADS,
1657 N_("Look up host"),
1658 N_("net ads dns gethostbyname\n"
1659 " Look up host")
1661 {NULL, NULL, 0, NULL, NULL}
1664 return net_run_function(c, argc, argv, "net ads dns", func);
1667 /*******************************************************************
1668 ********************************************************************/
1670 int net_ads_printer_usage(struct net_context *c, int argc, const char **argv)
1672 d_printf(_(
1673 "\nnet ads printer search <printer>"
1674 "\n\tsearch for a printer in the directory\n"
1675 "\nnet ads printer info <printer> <server>"
1676 "\n\tlookup info in directory for printer on server"
1677 "\n\t(note: printer defaults to \"*\", server defaults to local)\n"
1678 "\nnet ads printer publish <printername>"
1679 "\n\tpublish printer in directory"
1680 "\n\t(note: printer name is required)\n"
1681 "\nnet ads printer remove <printername>"
1682 "\n\tremove printer from directory"
1683 "\n\t(note: printer name is required)\n"));
1684 return -1;
1687 /*******************************************************************
1688 ********************************************************************/
1690 static int net_ads_printer_search(struct net_context *c, int argc, const char **argv)
1692 ADS_STRUCT *ads;
1693 ADS_STATUS rc;
1694 LDAPMessage *res = NULL;
1696 if (c->display_usage) {
1697 d_printf( "%s\n"
1698 "net ads printer search\n"
1699 " %s\n",
1700 _("Usage:"),
1701 _("List printers in the AD"));
1702 return 0;
1705 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1706 return -1;
1709 rc = ads_find_printers(ads, &res);
1711 if (!ADS_ERR_OK(rc)) {
1712 d_fprintf(stderr, _("ads_find_printer: %s\n"), ads_errstr(rc));
1713 ads_msgfree(ads, res);
1714 ads_destroy(&ads);
1715 return -1;
1718 if (ads_count_replies(ads, res) == 0) {
1719 d_fprintf(stderr, _("No results found\n"));
1720 ads_msgfree(ads, res);
1721 ads_destroy(&ads);
1722 return -1;
1725 ads_dump(ads, res);
1726 ads_msgfree(ads, res);
1727 ads_destroy(&ads);
1728 return 0;
1731 static int net_ads_printer_info(struct net_context *c, int argc, const char **argv)
1733 ADS_STRUCT *ads;
1734 ADS_STATUS rc;
1735 const char *servername, *printername;
1736 LDAPMessage *res = NULL;
1738 if (c->display_usage) {
1739 d_printf("%s\n%s",
1740 _("Usage:"),
1741 _("net ads printer info [printername [servername]]\n"
1742 " Display printer info from AD\n"
1743 " printername\tPrinter name or wildcard\n"
1744 " servername\tName of the print server\n"));
1745 return 0;
1748 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1749 return -1;
1752 if (argc > 0) {
1753 printername = argv[0];
1754 } else {
1755 printername = "*";
1758 if (argc > 1) {
1759 servername = argv[1];
1760 } else {
1761 servername = lp_netbios_name();
1764 rc = ads_find_printer_on_server(ads, &res, printername, servername);
1766 if (!ADS_ERR_OK(rc)) {
1767 d_fprintf(stderr, _("Server '%s' not found: %s\n"),
1768 servername, ads_errstr(rc));
1769 ads_msgfree(ads, res);
1770 ads_destroy(&ads);
1771 return -1;
1774 if (ads_count_replies(ads, res) == 0) {
1775 d_fprintf(stderr, _("Printer '%s' not found\n"), printername);
1776 ads_msgfree(ads, res);
1777 ads_destroy(&ads);
1778 return -1;
1781 ads_dump(ads, res);
1782 ads_msgfree(ads, res);
1783 ads_destroy(&ads);
1785 return 0;
1788 static int net_ads_printer_publish(struct net_context *c, int argc, const char **argv)
1790 ADS_STRUCT *ads;
1791 ADS_STATUS rc;
1792 const char *servername, *printername;
1793 struct cli_state *cli = NULL;
1794 struct rpc_pipe_client *pipe_hnd = NULL;
1795 struct sockaddr_storage server_ss;
1796 NTSTATUS nt_status;
1797 TALLOC_CTX *mem_ctx = talloc_init("net_ads_printer_publish");
1798 ADS_MODLIST mods = ads_init_mods(mem_ctx);
1799 char *prt_dn, *srv_dn, **srv_cn;
1800 char *srv_cn_escaped = NULL, *printername_escaped = NULL;
1801 LDAPMessage *res = NULL;
1803 if (argc < 1 || c->display_usage) {
1804 d_printf("%s\n%s",
1805 _("Usage:"),
1806 _("net ads printer publish <printername> [servername]\n"
1807 " Publish printer in AD\n"
1808 " printername\tName of the printer\n"
1809 " servername\tName of the print server\n"));
1810 talloc_destroy(mem_ctx);
1811 return -1;
1814 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1815 talloc_destroy(mem_ctx);
1816 return -1;
1819 printername = argv[0];
1821 if (argc == 2) {
1822 servername = argv[1];
1823 } else {
1824 servername = lp_netbios_name();
1827 /* Get printer data from SPOOLSS */
1829 resolve_name(servername, &server_ss, 0x20, false);
1831 nt_status = cli_full_connection(&cli, lp_netbios_name(), servername,
1832 &server_ss, 0,
1833 "IPC$", "IPC",
1834 c->opt_user_name, c->opt_workgroup,
1835 c->opt_password ? c->opt_password : "",
1836 CLI_FULL_CONNECTION_USE_KERBEROS,
1837 Undefined);
1839 if (NT_STATUS_IS_ERR(nt_status)) {
1840 d_fprintf(stderr, _("Unable to open a connection to %s to "
1841 "obtain data for %s\n"),
1842 servername, printername);
1843 ads_destroy(&ads);
1844 talloc_destroy(mem_ctx);
1845 return -1;
1848 /* Publish on AD server */
1850 ads_find_machine_acct(ads, &res, servername);
1852 if (ads_count_replies(ads, res) == 0) {
1853 d_fprintf(stderr, _("Could not find machine account for server "
1854 "%s\n"),
1855 servername);
1856 ads_destroy(&ads);
1857 talloc_destroy(mem_ctx);
1858 return -1;
1861 srv_dn = ldap_get_dn((LDAP *)ads->ldap.ld, (LDAPMessage *)res);
1862 srv_cn = ldap_explode_dn(srv_dn, 1);
1864 srv_cn_escaped = escape_rdn_val_string_alloc(srv_cn[0]);
1865 printername_escaped = escape_rdn_val_string_alloc(printername);
1866 if (!srv_cn_escaped || !printername_escaped) {
1867 SAFE_FREE(srv_cn_escaped);
1868 SAFE_FREE(printername_escaped);
1869 d_fprintf(stderr, _("Internal error, out of memory!"));
1870 ads_destroy(&ads);
1871 talloc_destroy(mem_ctx);
1872 return -1;
1875 if (asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn_escaped, printername_escaped, srv_dn) == -1) {
1876 SAFE_FREE(srv_cn_escaped);
1877 SAFE_FREE(printername_escaped);
1878 d_fprintf(stderr, _("Internal error, out of memory!"));
1879 ads_destroy(&ads);
1880 talloc_destroy(mem_ctx);
1881 return -1;
1884 SAFE_FREE(srv_cn_escaped);
1885 SAFE_FREE(printername_escaped);
1887 nt_status = cli_rpc_pipe_open_noauth(cli, &ndr_table_spoolss.syntax_id, &pipe_hnd);
1888 if (!NT_STATUS_IS_OK(nt_status)) {
1889 d_fprintf(stderr, _("Unable to open a connection to the spoolss pipe on %s\n"),
1890 servername);
1891 SAFE_FREE(prt_dn);
1892 ads_destroy(&ads);
1893 talloc_destroy(mem_ctx);
1894 return -1;
1897 if (!W_ERROR_IS_OK(get_remote_printer_publishing_data(pipe_hnd, mem_ctx, &mods,
1898 printername))) {
1899 SAFE_FREE(prt_dn);
1900 ads_destroy(&ads);
1901 talloc_destroy(mem_ctx);
1902 return -1;
1905 rc = ads_add_printer_entry(ads, prt_dn, mem_ctx, &mods);
1906 if (!ADS_ERR_OK(rc)) {
1907 d_fprintf(stderr, "ads_publish_printer: %s\n", ads_errstr(rc));
1908 SAFE_FREE(prt_dn);
1909 ads_destroy(&ads);
1910 talloc_destroy(mem_ctx);
1911 return -1;
1914 d_printf("published printer\n");
1915 SAFE_FREE(prt_dn);
1916 ads_destroy(&ads);
1917 talloc_destroy(mem_ctx);
1919 return 0;
1922 static int net_ads_printer_remove(struct net_context *c, int argc, const char **argv)
1924 ADS_STRUCT *ads;
1925 ADS_STATUS rc;
1926 const char *servername;
1927 char *prt_dn;
1928 LDAPMessage *res = NULL;
1930 if (argc < 1 || c->display_usage) {
1931 d_printf("%s\n%s",
1932 _("Usage:"),
1933 _("net ads printer remove <printername> [servername]\n"
1934 " Remove a printer from the AD\n"
1935 " printername\tName of the printer\n"
1936 " servername\tName of the print server\n"));
1937 return -1;
1940 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1941 return -1;
1944 if (argc > 1) {
1945 servername = argv[1];
1946 } else {
1947 servername = lp_netbios_name();
1950 rc = ads_find_printer_on_server(ads, &res, argv[0], servername);
1952 if (!ADS_ERR_OK(rc)) {
1953 d_fprintf(stderr, _("ads_find_printer_on_server: %s\n"), ads_errstr(rc));
1954 ads_msgfree(ads, res);
1955 ads_destroy(&ads);
1956 return -1;
1959 if (ads_count_replies(ads, res) == 0) {
1960 d_fprintf(stderr, _("Printer '%s' not found\n"), argv[1]);
1961 ads_msgfree(ads, res);
1962 ads_destroy(&ads);
1963 return -1;
1966 prt_dn = ads_get_dn(ads, talloc_tos(), res);
1967 ads_msgfree(ads, res);
1968 rc = ads_del_dn(ads, prt_dn);
1969 TALLOC_FREE(prt_dn);
1971 if (!ADS_ERR_OK(rc)) {
1972 d_fprintf(stderr, _("ads_del_dn: %s\n"), ads_errstr(rc));
1973 ads_destroy(&ads);
1974 return -1;
1977 ads_destroy(&ads);
1978 return 0;
1981 static int net_ads_printer(struct net_context *c, int argc, const char **argv)
1983 struct functable func[] = {
1985 "search",
1986 net_ads_printer_search,
1987 NET_TRANSPORT_ADS,
1988 N_("Search for a printer"),
1989 N_("net ads printer search\n"
1990 " Search for a printer")
1993 "info",
1994 net_ads_printer_info,
1995 NET_TRANSPORT_ADS,
1996 N_("Display printer information"),
1997 N_("net ads printer info\n"
1998 " Display printer information")
2001 "publish",
2002 net_ads_printer_publish,
2003 NET_TRANSPORT_ADS,
2004 N_("Publish a printer"),
2005 N_("net ads printer publish\n"
2006 " Publish a printer")
2009 "remove",
2010 net_ads_printer_remove,
2011 NET_TRANSPORT_ADS,
2012 N_("Delete a printer"),
2013 N_("net ads printer remove\n"
2014 " Delete a printer")
2016 {NULL, NULL, 0, NULL, NULL}
2019 return net_run_function(c, argc, argv, "net ads printer", func);
2023 static int net_ads_password(struct net_context *c, int argc, const char **argv)
2025 ADS_STRUCT *ads;
2026 const char *auth_principal = c->opt_user_name;
2027 const char *auth_password = c->opt_password;
2028 const char *realm = NULL;
2029 const char *new_password = NULL;
2030 char *chr, *prompt;
2031 const char *user;
2032 ADS_STATUS ret;
2034 if (c->display_usage) {
2035 d_printf("%s\n%s",
2036 _("Usage:"),
2037 _("net ads password <username>\n"
2038 " Change password for user\n"
2039 " username\tName of user to change password for\n"));
2040 return 0;
2043 if (c->opt_user_name == NULL || c->opt_password == NULL) {
2044 d_fprintf(stderr, _("You must supply an administrator "
2045 "username/password\n"));
2046 return -1;
2049 if (argc < 1) {
2050 d_fprintf(stderr, _("ERROR: You must say which username to "
2051 "change password for\n"));
2052 return -1;
2055 user = argv[0];
2056 if (!strchr_m(user, '@')) {
2057 if (asprintf(&chr, "%s@%s", argv[0], lp_realm()) == -1) {
2058 return -1;
2060 user = chr;
2063 use_in_memory_ccache();
2064 chr = strchr_m(auth_principal, '@');
2065 if (chr) {
2066 realm = ++chr;
2067 } else {
2068 realm = lp_realm();
2071 /* use the realm so we can eventually change passwords for users
2072 in realms other than default */
2073 if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) {
2074 return -1;
2077 /* we don't actually need a full connect, but it's the easy way to
2078 fill in the KDC's addresss */
2079 ads_connect(ads);
2081 if (!ads->config.realm) {
2082 d_fprintf(stderr, _("Didn't find the kerberos server!\n"));
2083 ads_destroy(&ads);
2084 return -1;
2087 if (argv[1]) {
2088 new_password = (const char *)argv[1];
2089 } else {
2090 if (asprintf(&prompt, _("Enter new password for %s:"), user) == -1) {
2091 return -1;
2093 new_password = getpass(prompt);
2094 free(prompt);
2097 ret = kerberos_set_password(ads->auth.kdc_server, auth_principal,
2098 auth_password, user, new_password, ads->auth.time_offset);
2099 if (!ADS_ERR_OK(ret)) {
2100 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2101 ads_destroy(&ads);
2102 return -1;
2105 d_printf(_("Password change for %s completed.\n"), user);
2106 ads_destroy(&ads);
2108 return 0;
2111 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2113 ADS_STRUCT *ads;
2114 char *host_principal;
2115 fstring my_name;
2116 ADS_STATUS ret;
2118 if (c->display_usage) {
2119 d_printf( "%s\n"
2120 "net ads changetrustpw\n"
2121 " %s\n",
2122 _("Usage:"),
2123 _("Change the machine account's trust password"));
2124 return 0;
2127 if (!secrets_init()) {
2128 DEBUG(1,("Failed to initialise secrets database\n"));
2129 return -1;
2132 net_use_krb_machine_account(c);
2134 use_in_memory_ccache();
2136 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2137 return -1;
2140 fstrcpy(my_name, lp_netbios_name());
2141 strlower_m(my_name);
2142 if (asprintf(&host_principal, "%s$@%s", my_name, ads->config.realm) == -1) {
2143 ads_destroy(&ads);
2144 return -1;
2146 d_printf(_("Changing password for principal: %s\n"), host_principal);
2148 ret = ads_change_trust_account_password(ads, host_principal);
2150 if (!ADS_ERR_OK(ret)) {
2151 d_fprintf(stderr, _("Password change failed: %s\n"), ads_errstr(ret));
2152 ads_destroy(&ads);
2153 SAFE_FREE(host_principal);
2154 return -1;
2157 d_printf(_("Password change for principal %s succeeded.\n"), host_principal);
2159 if (USE_SYSTEM_KEYTAB) {
2160 d_printf(_("Attempting to update system keytab with new password.\n"));
2161 if (ads_keytab_create_default(ads)) {
2162 d_printf(_("Failed to update system keytab.\n"));
2166 ads_destroy(&ads);
2167 SAFE_FREE(host_principal);
2169 return 0;
2173 help for net ads search
2175 static int net_ads_search_usage(struct net_context *c, int argc, const char **argv)
2177 d_printf(_(
2178 "\nnet ads search <expression> <attributes...>\n"
2179 "\nPerform a raw LDAP search on a ADS server and dump the results.\n"
2180 "The expression is a standard LDAP search expression, and the\n"
2181 "attributes are a list of LDAP fields to show in the results.\n\n"
2182 "Example: net ads search '(objectCategory=group)' sAMAccountName\n\n"
2184 net_common_flags_usage(c, argc, argv);
2185 return -1;
2190 general ADS search function. Useful in diagnosing problems in ADS
2192 static int net_ads_search(struct net_context *c, int argc, const char **argv)
2194 ADS_STRUCT *ads;
2195 ADS_STATUS rc;
2196 const char *ldap_exp;
2197 const char **attrs;
2198 LDAPMessage *res = NULL;
2200 if (argc < 1 || c->display_usage) {
2201 return net_ads_search_usage(c, argc, argv);
2204 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2205 return -1;
2208 ldap_exp = argv[0];
2209 attrs = (argv + 1);
2211 rc = ads_do_search_all(ads, ads->config.bind_path,
2212 LDAP_SCOPE_SUBTREE,
2213 ldap_exp, attrs, &res);
2214 if (!ADS_ERR_OK(rc)) {
2215 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2216 ads_destroy(&ads);
2217 return -1;
2220 d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2222 /* dump the results */
2223 ads_dump(ads, res);
2225 ads_msgfree(ads, res);
2226 ads_destroy(&ads);
2228 return 0;
2233 help for net ads search
2235 static int net_ads_dn_usage(struct net_context *c, int argc, const char **argv)
2237 d_printf(_(
2238 "\nnet ads dn <dn> <attributes...>\n"
2239 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2240 "The DN standard LDAP DN, and the attributes are a list of LDAP fields \n"
2241 "to show in the results\n\n"
2242 "Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' sAMAccountName\n\n"
2243 "Note: the DN must be provided properly escaped. See RFC 4514 for details\n\n"
2245 net_common_flags_usage(c, argc, argv);
2246 return -1;
2251 general ADS search function. Useful in diagnosing problems in ADS
2253 static int net_ads_dn(struct net_context *c, int argc, const char **argv)
2255 ADS_STRUCT *ads;
2256 ADS_STATUS rc;
2257 const char *dn;
2258 const char **attrs;
2259 LDAPMessage *res = NULL;
2261 if (argc < 1 || c->display_usage) {
2262 return net_ads_dn_usage(c, argc, argv);
2265 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2266 return -1;
2269 dn = argv[0];
2270 attrs = (argv + 1);
2272 rc = ads_do_search_all(ads, dn,
2273 LDAP_SCOPE_BASE,
2274 "(objectclass=*)", attrs, &res);
2275 if (!ADS_ERR_OK(rc)) {
2276 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2277 ads_destroy(&ads);
2278 return -1;
2281 d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2283 /* dump the results */
2284 ads_dump(ads, res);
2286 ads_msgfree(ads, res);
2287 ads_destroy(&ads);
2289 return 0;
2293 help for net ads sid search
2295 static int net_ads_sid_usage(struct net_context *c, int argc, const char **argv)
2297 d_printf(_(
2298 "\nnet ads sid <sid> <attributes...>\n"
2299 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2300 "The SID is in string format, and the attributes are a list of LDAP fields \n"
2301 "to show in the results\n\n"
2302 "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
2304 net_common_flags_usage(c, argc, argv);
2305 return -1;
2310 general ADS search function. Useful in diagnosing problems in ADS
2312 static int net_ads_sid(struct net_context *c, int argc, const char **argv)
2314 ADS_STRUCT *ads;
2315 ADS_STATUS rc;
2316 const char *sid_string;
2317 const char **attrs;
2318 LDAPMessage *res = NULL;
2319 struct dom_sid sid;
2321 if (argc < 1 || c->display_usage) {
2322 return net_ads_sid_usage(c, argc, argv);
2325 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2326 return -1;
2329 sid_string = argv[0];
2330 attrs = (argv + 1);
2332 if (!string_to_sid(&sid, sid_string)) {
2333 d_fprintf(stderr, _("could not convert sid\n"));
2334 ads_destroy(&ads);
2335 return -1;
2338 rc = ads_search_retry_sid(ads, &res, &sid, attrs);
2339 if (!ADS_ERR_OK(rc)) {
2340 d_fprintf(stderr, _("search failed: %s\n"), ads_errstr(rc));
2341 ads_destroy(&ads);
2342 return -1;
2345 d_printf(_("Got %d replies\n\n"), ads_count_replies(ads, res));
2347 /* dump the results */
2348 ads_dump(ads, res);
2350 ads_msgfree(ads, res);
2351 ads_destroy(&ads);
2353 return 0;
2356 static int net_ads_keytab_flush(struct net_context *c, int argc, const char **argv)
2358 int ret;
2359 ADS_STRUCT *ads;
2361 if (c->display_usage) {
2362 d_printf( "%s\n"
2363 "net ads keytab flush\n"
2364 " %s\n",
2365 _("Usage:"),
2366 _("Delete the whole keytab"));
2367 return 0;
2370 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2371 return -1;
2373 ret = ads_keytab_flush(ads);
2374 ads_destroy(&ads);
2375 return ret;
2378 static int net_ads_keytab_add(struct net_context *c, int argc, const char **argv)
2380 int i;
2381 int ret = 0;
2382 ADS_STRUCT *ads;
2384 if (c->display_usage) {
2385 d_printf("%s\n%s",
2386 _("Usage:"),
2387 _("net ads keytab add <principal> [principal ...]\n"
2388 " Add principals to local keytab\n"
2389 " principal\tKerberos principal to add to "
2390 "keytab\n"));
2391 return 0;
2394 d_printf(_("Processing principals to add...\n"));
2395 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2396 return -1;
2398 for (i = 0; i < argc; i++) {
2399 ret |= ads_keytab_add_entry(ads, argv[i]);
2401 ads_destroy(&ads);
2402 return ret;
2405 static int net_ads_keytab_create(struct net_context *c, int argc, const char **argv)
2407 ADS_STRUCT *ads;
2408 int ret;
2410 if (c->display_usage) {
2411 d_printf( "%s\n"
2412 "net ads keytab create\n"
2413 " %s\n",
2414 _("Usage:"),
2415 _("Create new default keytab"));
2416 return 0;
2419 if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2420 return -1;
2422 ret = ads_keytab_create_default(ads);
2423 ads_destroy(&ads);
2424 return ret;
2427 static int net_ads_keytab_list(struct net_context *c, int argc, const char **argv)
2429 const char *keytab = NULL;
2431 if (c->display_usage) {
2432 d_printf("%s\n%s",
2433 _("Usage:"),
2434 _("net ads keytab list [keytab]\n"
2435 " List a local keytab\n"
2436 " keytab\tKeytab to list\n"));
2437 return 0;
2440 if (argc >= 1) {
2441 keytab = argv[0];
2444 return ads_keytab_list(keytab);
2448 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2450 struct functable func[] = {
2452 "add",
2453 net_ads_keytab_add,
2454 NET_TRANSPORT_ADS,
2455 N_("Add a service principal"),
2456 N_("net ads keytab add\n"
2457 " Add a service principal")
2460 "create",
2461 net_ads_keytab_create,
2462 NET_TRANSPORT_ADS,
2463 N_("Create a fresh keytab"),
2464 N_("net ads keytab create\n"
2465 " Create a fresh keytab")
2468 "flush",
2469 net_ads_keytab_flush,
2470 NET_TRANSPORT_ADS,
2471 N_("Remove all keytab entries"),
2472 N_("net ads keytab flush\n"
2473 " Remove all keytab entries")
2476 "list",
2477 net_ads_keytab_list,
2478 NET_TRANSPORT_ADS,
2479 N_("List a keytab"),
2480 N_("net ads keytab list\n"
2481 " List a keytab")
2483 {NULL, NULL, 0, NULL, NULL}
2486 if (!USE_KERBEROS_KEYTAB) {
2487 d_printf(_("\nWarning: \"kerberos method\" must be set to a "
2488 "keytab method to use keytab functions.\n"));
2491 return net_run_function(c, argc, argv, "net ads keytab", func);
2494 static int net_ads_kerberos_renew(struct net_context *c, int argc, const char **argv)
2496 int ret = -1;
2498 if (c->display_usage) {
2499 d_printf( "%s\n"
2500 "net ads kerberos renew\n"
2501 " %s\n",
2502 _("Usage:"),
2503 _("Renew TGT from existing credential cache"));
2504 return 0;
2507 ret = smb_krb5_renew_ticket(NULL, NULL, NULL, NULL);
2508 if (ret) {
2509 d_printf(_("failed to renew kerberos ticket: %s\n"),
2510 error_message(ret));
2512 return ret;
2515 static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
2517 struct PAC_LOGON_INFO *info = NULL;
2518 TALLOC_CTX *mem_ctx = NULL;
2519 NTSTATUS status;
2520 int ret = -1;
2521 const char *impersonate_princ_s = NULL;
2523 if (c->display_usage) {
2524 d_printf( "%s\n"
2525 "net ads kerberos pac\n"
2526 " %s\n",
2527 _("Usage:"),
2528 _("Dump the Kerberos PAC"));
2529 return 0;
2532 mem_ctx = talloc_init("net_ads_kerberos_pac");
2533 if (!mem_ctx) {
2534 goto out;
2537 if (argc > 0) {
2538 impersonate_princ_s = argv[0];
2541 c->opt_password = net_prompt_pass(c, c->opt_user_name);
2543 status = kerberos_return_pac(mem_ctx,
2544 c->opt_user_name,
2545 c->opt_password,
2547 NULL,
2548 NULL,
2549 NULL,
2550 true,
2551 true,
2552 2592000, /* one month */
2553 impersonate_princ_s,
2554 &info);
2555 if (!NT_STATUS_IS_OK(status)) {
2556 d_printf(_("failed to query kerberos PAC: %s\n"),
2557 nt_errstr(status));
2558 goto out;
2561 if (info) {
2562 const char *s;
2563 s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_LOGON_INFO, info);
2564 d_printf(_("The Pac: %s\n"), s);
2567 ret = 0;
2568 out:
2569 TALLOC_FREE(mem_ctx);
2570 return ret;
2573 static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char **argv)
2575 TALLOC_CTX *mem_ctx = NULL;
2576 int ret = -1;
2577 NTSTATUS status;
2579 if (c->display_usage) {
2580 d_printf( "%s\n"
2581 "net ads kerberos kinit\n"
2582 " %s\n",
2583 _("Usage:"),
2584 _("Get Ticket Granting Ticket (TGT) for the user"));
2585 return 0;
2588 mem_ctx = talloc_init("net_ads_kerberos_kinit");
2589 if (!mem_ctx) {
2590 goto out;
2593 c->opt_password = net_prompt_pass(c, c->opt_user_name);
2595 ret = kerberos_kinit_password_ext(c->opt_user_name,
2596 c->opt_password,
2598 NULL,
2599 NULL,
2600 NULL,
2601 true,
2602 true,
2603 2592000, /* one month */
2604 &status);
2605 if (ret) {
2606 d_printf(_("failed to kinit password: %s\n"),
2607 nt_errstr(status));
2609 out:
2610 return ret;
2613 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2615 struct functable func[] = {
2617 "kinit",
2618 net_ads_kerberos_kinit,
2619 NET_TRANSPORT_ADS,
2620 N_("Retrieve Ticket Granting Ticket (TGT)"),
2621 N_("net ads kerberos kinit\n"
2622 " Receive Ticket Granting Ticket (TGT)")
2625 "renew",
2626 net_ads_kerberos_renew,
2627 NET_TRANSPORT_ADS,
2628 N_("Renew Ticket Granting Ticket from credential cache"),
2629 N_("net ads kerberos renew\n"
2630 " Renew Ticket Granting Ticket (TGT) from "
2631 "credential cache")
2634 "pac",
2635 net_ads_kerberos_pac,
2636 NET_TRANSPORT_ADS,
2637 N_("Dump Kerberos PAC"),
2638 N_("net ads kerberos pac\n"
2639 " Dump Kerberos PAC")
2641 {NULL, NULL, 0, NULL, NULL}
2644 return net_run_function(c, argc, argv, "net ads kerberos", func);
2647 int net_ads(struct net_context *c, int argc, const char **argv)
2649 struct functable func[] = {
2651 "info",
2652 net_ads_info,
2653 NET_TRANSPORT_ADS,
2654 N_("Display details on remote ADS server"),
2655 N_("net ads info\n"
2656 " Display details on remote ADS server")
2659 "join",
2660 net_ads_join,
2661 NET_TRANSPORT_ADS,
2662 N_("Join the local machine to ADS realm"),
2663 N_("net ads join\n"
2664 " Join the local machine to ADS realm")
2667 "testjoin",
2668 net_ads_testjoin,
2669 NET_TRANSPORT_ADS,
2670 N_("Validate machine account"),
2671 N_("net ads testjoin\n"
2672 " Validate machine account")
2675 "leave",
2676 net_ads_leave,
2677 NET_TRANSPORT_ADS,
2678 N_("Remove the local machine from ADS"),
2679 N_("net ads leave\n"
2680 " Remove the local machine from ADS")
2683 "status",
2684 net_ads_status,
2685 NET_TRANSPORT_ADS,
2686 N_("Display machine account details"),
2687 N_("net ads status\n"
2688 " Display machine account details")
2691 "user",
2692 net_ads_user,
2693 NET_TRANSPORT_ADS,
2694 N_("List/modify users"),
2695 N_("net ads user\n"
2696 " List/modify users")
2699 "group",
2700 net_ads_group,
2701 NET_TRANSPORT_ADS,
2702 N_("List/modify groups"),
2703 N_("net ads group\n"
2704 " List/modify groups")
2707 "dns",
2708 net_ads_dns,
2709 NET_TRANSPORT_ADS,
2710 N_("Issue dynamic DNS update"),
2711 N_("net ads dns\n"
2712 " Issue dynamic DNS update")
2715 "password",
2716 net_ads_password,
2717 NET_TRANSPORT_ADS,
2718 N_("Change user passwords"),
2719 N_("net ads password\n"
2720 " Change user passwords")
2723 "changetrustpw",
2724 net_ads_changetrustpw,
2725 NET_TRANSPORT_ADS,
2726 N_("Change trust account password"),
2727 N_("net ads changetrustpw\n"
2728 " Change trust account password")
2731 "printer",
2732 net_ads_printer,
2733 NET_TRANSPORT_ADS,
2734 N_("List/modify printer entries"),
2735 N_("net ads printer\n"
2736 " List/modify printer entries")
2739 "search",
2740 net_ads_search,
2741 NET_TRANSPORT_ADS,
2742 N_("Issue LDAP search using filter"),
2743 N_("net ads search\n"
2744 " Issue LDAP search using filter")
2747 "dn",
2748 net_ads_dn,
2749 NET_TRANSPORT_ADS,
2750 N_("Issue LDAP search by DN"),
2751 N_("net ads dn\n"
2752 " Issue LDAP search by DN")
2755 "sid",
2756 net_ads_sid,
2757 NET_TRANSPORT_ADS,
2758 N_("Issue LDAP search by SID"),
2759 N_("net ads sid\n"
2760 " Issue LDAP search by SID")
2763 "workgroup",
2764 net_ads_workgroup,
2765 NET_TRANSPORT_ADS,
2766 N_("Display workgroup name"),
2767 N_("net ads workgroup\n"
2768 " Display the workgroup name")
2771 "lookup",
2772 net_ads_lookup,
2773 NET_TRANSPORT_ADS,
2774 N_("Perfom CLDAP query on DC"),
2775 N_("net ads lookup\n"
2776 " Find the ADS DC using CLDAP lookups")
2779 "keytab",
2780 net_ads_keytab,
2781 NET_TRANSPORT_ADS,
2782 N_("Manage local keytab file"),
2783 N_("net ads keytab\n"
2784 " Manage local keytab file")
2787 "gpo",
2788 net_ads_gpo,
2789 NET_TRANSPORT_ADS,
2790 N_("Manage group policy objects"),
2791 N_("net ads gpo\n"
2792 " Manage group policy objects")
2795 "kerberos",
2796 net_ads_kerberos,
2797 NET_TRANSPORT_ADS,
2798 N_("Manage kerberos keytab"),
2799 N_("net ads kerberos\n"
2800 " Manage kerberos keytab")
2802 {NULL, NULL, 0, NULL, NULL}
2805 return net_run_function(c, argc, argv, "net ads", func);
2808 #else
2810 static int net_ads_noads(void)
2812 d_fprintf(stderr, _("ADS support not compiled in\n"));
2813 return -1;
2816 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2818 return net_ads_noads();
2821 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2823 return net_ads_noads();
2826 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2828 return net_ads_noads();
2831 int net_ads_join(struct net_context *c, int argc, const char **argv)
2833 return net_ads_noads();
2836 int net_ads_user(struct net_context *c, int argc, const char **argv)
2838 return net_ads_noads();
2841 int net_ads_group(struct net_context *c, int argc, const char **argv)
2843 return net_ads_noads();
2846 int net_ads_gpo(struct net_context *c, int argc, const char **argv)
2848 return net_ads_noads();
2851 /* this one shouldn't display a message */
2852 int net_ads_check(struct net_context *c)
2854 return -1;
2857 int net_ads_check_our_domain(struct net_context *c)
2859 return -1;
2862 int net_ads(struct net_context *c, int argc, const char **argv)
2864 return net_ads_noads();
2867 #endif /* HAVE_ADS */