source4/dsdb/common/util_samr.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Helpers to add users and groups to the DB
   5
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Volker Lendecke 2004
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2010
   9    Copyright (C) Matthias Dieter Wallnöfer 2009
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "dsdb/common/util.h"
  28 #include "../libds/common/flags.h"
  29 #include "libcli/security/security.h"
  30
  31 #include "libds/common/flag_mapping.h"
  32
  33 /* Add a user, SAMR style, including the correct transaction
  34  * semantics.  Used by the SAMR server and by pdb_samba4 */
  35 NTSTATUS dsdb_add_user(struct ldb_context *ldb,
  36                        TALLOC_CTX *mem_ctx,
  37                        const char *account_name,
  38                        uint32_t acct_flags,
  39                        const struct dom_sid *forced_sid,
  40                        struct dom_sid **sid,
  41                        struct ldb_dn **dn)
  42 {
  43         const char *name;
  44         struct ldb_message *msg;
  45         int ret;
  46         const char *container, *obj_class=NULL;
  47         char *cn_name;
  48         size_t cn_name_len;
  49
  50         const char *attrs[] = {
  51                 "objectSid",
  52                 "userAccountControl",
  53                 NULL
  54         };
  55
  56         uint32_t user_account_control;
  57         struct ldb_dn *account_dn;
  58         struct dom_sid *account_sid;
  59
  60         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
  61         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
  62
  63         /*
  64          * Start a transaction, so we can query and do a subsequent atomic
  65          * modify
  66          */
  67
  68         ret = ldb_transaction_start(ldb);
  69         if (ret != LDB_SUCCESS) {
  70                 DEBUG(0,("Failed to start a transaction for user creation: %s\n",
  71                          ldb_errstring(ldb)));
  72                 talloc_free(tmp_ctx);
  73                 return NT_STATUS_LOCK_NOT_GRANTED;
  74         }
  75
  76         /* check if the user already exists */
  77         name = samdb_search_string(ldb, tmp_ctx, NULL,
  78                                    "sAMAccountName",
  79                                    "(&(sAMAccountName=%s)(objectclass=user))",
  80                                    ldb_binary_encode_string(tmp_ctx, account_name));
  81         if (name != NULL) {
  82                 ldb_transaction_cancel(ldb);
  83                 talloc_free(tmp_ctx);
  84                 return NT_STATUS_USER_EXISTS;
  85         }
  86
  87         cn_name = talloc_strdup(tmp_ctx, account_name);
  88         if (!cn_name) {
  89                 ldb_transaction_cancel(ldb);
  90                 talloc_free(tmp_ctx);
  91                 return NT_STATUS_NO_MEMORY;
  92         }
  93
  94         cn_name_len = strlen(cn_name);
  95         if (cn_name_len < 1) {
  96                 ldb_transaction_cancel(ldb);
  97                 talloc_free(tmp_ctx);
  98                 return NT_STATUS_INVALID_PARAMETER;
  99         }
 100
 101         msg = ldb_msg_new(tmp_ctx);
 102         if (msg == NULL) {
 103                 ldb_transaction_cancel(ldb);
 104                 talloc_free(tmp_ctx);
 105                 return NT_STATUS_NO_MEMORY;
 106         }
 107
 108         /* This must be one of these values *only* */
 109         if (acct_flags == ACB_NORMAL) {
 110                 container = "CN=Users";
 111                 obj_class = "user";
 112                 user_account_control = UF_NORMAL_ACCOUNT;
 113         } else if (acct_flags == ACB_WSTRUST) {
 114                 if (cn_name[cn_name_len - 1] != '$') {
 115                         ldb_transaction_cancel(ldb);
 116                         return NT_STATUS_FOOBAR;
 117                 }
 118                 cn_name[cn_name_len - 1] = '\0';
 119                 container = "CN=Computers";
 120                 obj_class = "computer";
 121                 user_account_control = UF_WORKSTATION_TRUST_ACCOUNT;
 122
 123         } else if (acct_flags == ACB_SVRTRUST) {
 124                 if (cn_name[cn_name_len - 1] != '$') {
 125                         ldb_transaction_cancel(ldb);
 126                         return NT_STATUS_FOOBAR;
 127                 }
 128                 cn_name[cn_name_len - 1] = '\0';
 129                 container = "OU=Domain Controllers";
 130                 obj_class = "computer";
 131                 user_account_control = UF_SERVER_TRUST_ACCOUNT;
 132         } else if (acct_flags == ACB_DOMTRUST) {
 133                 DEBUG(3, ("Invalid account flags specified:  cannot create domain trusts via this interface (must use LSA CreateTrustedDomain calls\n"));
 134                 ldb_transaction_cancel(ldb);
 135                 talloc_free(tmp_ctx);
 136                 return NT_STATUS_INVALID_PARAMETER;
 137         } else {
 138                 DEBUG(3, ("Invalid account flags specified 0x%08X, must be exactly one of \n"
 139                           "ACB_NORMAL (0x%08X) ACB_WSTRUST (0x%08X) or ACB_SVRTRUST (0x%08X)\n",
 140                           acct_flags,
 141                           ACB_NORMAL, ACB_WSTRUST, ACB_SVRTRUST));
 142                 ldb_transaction_cancel(ldb);
 143                 talloc_free(tmp_ctx);
 144                 return NT_STATUS_INVALID_PARAMETER;
 145         }
 146
 147         user_account_control |= UF_ACCOUNTDISABLE | UF_PASSWD_NOTREQD;
 148
 149         /* add core elements to the ldb_message for the user */
 150         msg->dn = ldb_dn_copy(msg, ldb_get_default_basedn(ldb));
 151         if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s,%s", cn_name, container)) {
 152                 ldb_transaction_cancel(ldb);
 153                 talloc_free(tmp_ctx);
 154                 return NT_STATUS_FOOBAR;
 155         }
 156
 157         ldb_msg_add_string(msg, "sAMAccountName", account_name);
 158         ldb_msg_add_string(msg, "objectClass", obj_class);
 159         samdb_msg_add_uint(ldb, tmp_ctx, msg,
 160                            "userAccountControl",
 161                            user_account_control);
 162
 163         /* This is only here for migrations using pdb_samba4, the
 164          * caller and the samldb are responsible for ensuring it makes
 165          * sense */
 166         if (forced_sid) {
 167                 ret = samdb_msg_add_dom_sid(ldb, msg, msg, "objectSID", forced_sid);
 168                 if (ret != LDB_SUCCESS) {
 169                         ldb_transaction_cancel(ldb);
 170                         talloc_free(tmp_ctx);
 171                         return NT_STATUS_INTERNAL_ERROR;
 172                 }
 173         }
 174
 175         /* create the user */
 176         ret = ldb_add(ldb, msg);
 177         switch (ret) {
 178         case LDB_SUCCESS:
 179                 break;
 180         case LDB_ERR_ENTRY_ALREADY_EXISTS:
 181                 ldb_transaction_cancel(ldb);
 182                 DEBUG(0,("Failed to create user record %s: %s\n",
 183                          ldb_dn_get_linearized(msg->dn),
 184                          ldb_errstring(ldb)));
 185                 talloc_free(tmp_ctx);
 186                 return NT_STATUS_USER_EXISTS;
 187         case LDB_ERR_UNWILLING_TO_PERFORM:
 188         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
 189                 ldb_transaction_cancel(ldb);
 190                 DEBUG(0,("Failed to create user record %s: %s\n",
 191                          ldb_dn_get_linearized(msg->dn),
 192                          ldb_errstring(ldb)));
 193                 talloc_free(tmp_ctx);
 194                 return NT_STATUS_ACCESS_DENIED;
 195         default:
 196                 ldb_transaction_cancel(ldb);
 197                 DEBUG(0,("Failed to create user record %s: %s\n",
 198                          ldb_dn_get_linearized(msg->dn),
 199                          ldb_errstring(ldb)));
 200                 talloc_free(tmp_ctx);
 201                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 202         }
 203
 204         account_dn = msg->dn;
 205
 206         /* retrieve the sid and account control bits for the user just created */
 207         ret = dsdb_search_one(ldb, tmp_ctx, &msg,
 208                               account_dn, LDB_SCOPE_BASE, attrs, 0, NULL);
 209
 210         if (ret != LDB_SUCCESS) {
 211                 ldb_transaction_cancel(ldb);
 212                 DEBUG(0,("Can't locate the account we just created %s: %s\n",
 213                          ldb_dn_get_linearized(account_dn), ldb_errstring(ldb)));
 214                 talloc_free(tmp_ctx);
 215                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 216         }
 217         account_sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
 218         if (account_sid == NULL) {
 219                 ldb_transaction_cancel(ldb);
 220                 DEBUG(0,("Apparently we failed to get the objectSid of the just created account record %s\n",
 221                          ldb_dn_get_linearized(msg->dn)));
 222                 talloc_free(tmp_ctx);
 223                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 224         }
 225
 226         ret = ldb_transaction_commit(ldb);
 227         if (ret != LDB_SUCCESS) {
 228                 DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
 229                          ldb_dn_get_linearized(msg->dn),
 230                          ldb_errstring(ldb)));
 231                 talloc_free(tmp_ctx);
 232                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 233         }
 234         *dn = talloc_steal(mem_ctx, account_dn);
 235         if (sid) {
 236                 *sid = talloc_steal(mem_ctx, account_sid);
 237         }
 238         talloc_free(tmp_ctx);
 239         return NT_STATUS_OK;
 240 }
 241
 242 /*
 243   called by samr_CreateDomainGroup and pdb_samba4
 244 */
 245 NTSTATUS dsdb_add_domain_group(struct ldb_context *ldb,
 246                                TALLOC_CTX *mem_ctx,
 247                                const char *groupname,
 248                                struct dom_sid **sid,
 249                                struct ldb_dn **dn)
 250 {
 251         const char *name;
 252         struct ldb_message *msg;
 253         struct dom_sid *group_sid;
 254         int ret;
 255
 256         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 257         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 258
 259         /* check if the group already exists */
 260         name = samdb_search_string(ldb, tmp_ctx, NULL,
 261                                    "sAMAccountName",
 262                                    "(&(sAMAccountName=%s)(objectclass=group))",
 263                                    ldb_binary_encode_string(tmp_ctx, groupname));
 264         if (name != NULL) {
 265                 return NT_STATUS_GROUP_EXISTS;
 266         }
 267
 268         msg = ldb_msg_new(tmp_ctx);
 269         if (msg == NULL) {
 270                 return NT_STATUS_NO_MEMORY;
 271         }
 272
 273         /* add core elements to the ldb_message for the user */
 274         msg->dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(ldb));
 275         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", groupname);
 276         if (!msg->dn) {
 277                 talloc_free(tmp_ctx);
 278                 return NT_STATUS_NO_MEMORY;
 279         }
 280         ldb_msg_add_string(msg, "sAMAccountName", groupname);
 281         ldb_msg_add_string(msg, "objectClass", "group");
 282
 283         /* create the group */
 284         ret = ldb_add(ldb, msg);
 285         switch (ret) {
 286         case  LDB_SUCCESS:
 287                 break;
 288         case  LDB_ERR_ENTRY_ALREADY_EXISTS:
 289                 DEBUG(0,("Failed to create group record %s: %s\n",
 290                          ldb_dn_get_linearized(msg->dn),
 291                          ldb_errstring(ldb)));
 292                 talloc_free(tmp_ctx);
 293                 return NT_STATUS_GROUP_EXISTS;
 294         case  LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
 295                 DEBUG(0,("Failed to create group record %s: %s\n",
 296                          ldb_dn_get_linearized(msg->dn),
 297                          ldb_errstring(ldb)));
 298                 talloc_free(tmp_ctx);
 299                 return NT_STATUS_ACCESS_DENIED;
 300         default:
 301                 DEBUG(0,("Failed to create group record %s: %s\n",
 302                          ldb_dn_get_linearized(msg->dn),
 303                          ldb_errstring(ldb)));
 304                 talloc_free(tmp_ctx);
 305                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 306         }
 307
 308         /* retrieve the sid for the group just created */
 309         group_sid = samdb_search_dom_sid(ldb, tmp_ctx,
 310                                          msg->dn, "objectSid", NULL);
 311         if (group_sid == NULL) {
 312                 return NT_STATUS_UNSUCCESSFUL;
 313         }
 314
 315         *dn = talloc_steal(mem_ctx, msg->dn);
 316         *sid = talloc_steal(mem_ctx, group_sid);
 317         talloc_free(tmp_ctx);
 318         return NT_STATUS_OK;
 319 }
 320
 321 NTSTATUS dsdb_add_domain_alias(struct ldb_context *ldb,
 322                                TALLOC_CTX *mem_ctx,
 323                                const char *alias_name,
 324                                struct dom_sid **sid,
 325                                struct ldb_dn **dn)
 326 {
 327         const char *name;
 328         struct ldb_message *msg;
 329         struct dom_sid *alias_sid;
 330         int ret;
 331
 332         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 333         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 334
 335         if (ldb_transaction_start(ldb) != LDB_SUCCESS) {
 336                 DEBUG(0, ("Failed to start transaction in dsdb_add_domain_alias(): %s\n", ldb_errstring(ldb)));
 337                 return NT_STATUS_INTERNAL_ERROR;
 338         }
 339
 340         /* Check if alias already exists */
 341         name = samdb_search_string(ldb, tmp_ctx, NULL,
 342                                    "sAMAccountName",
 343                                    "(sAMAccountName=%s)(objectclass=group))",
 344                                    ldb_binary_encode_string(mem_ctx, alias_name));
 345
 346         if (name != NULL) {
 347                 talloc_free(tmp_ctx);
 348                 ldb_transaction_cancel(ldb);
 349                 return NT_STATUS_ALIAS_EXISTS;
 350         }
 351
 352         msg = ldb_msg_new(tmp_ctx);
 353         if (msg == NULL) {
 354                 talloc_free(tmp_ctx);
 355                 ldb_transaction_cancel(ldb);
 356                 return NT_STATUS_NO_MEMORY;
 357         }
 358
 359         /* add core elements to the ldb_message for the alias */
 360         msg->dn = ldb_dn_copy(mem_ctx, ldb_get_default_basedn(ldb));
 361         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", alias_name);
 362         if (!msg->dn) {
 363                 talloc_free(tmp_ctx);
 364                 ldb_transaction_cancel(ldb);
 365                 return NT_STATUS_NO_MEMORY;
 366         }
 367
 368         ldb_msg_add_string(msg, "sAMAccountName", alias_name);
 369         ldb_msg_add_string(msg, "objectClass", "group");
 370         samdb_msg_add_int(ldb, mem_ctx, msg, "groupType", GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
 371
 372         /* create the alias */
 373         ret = ldb_add(ldb, msg);
 374         switch (ret) {
 375         case LDB_SUCCESS:
 376                 break;
 377         case LDB_ERR_ENTRY_ALREADY_EXISTS:
 378                 talloc_free(tmp_ctx);
 379                 ldb_transaction_cancel(ldb);
 380                 return NT_STATUS_ALIAS_EXISTS;
 381         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
 382                 talloc_free(tmp_ctx);
 383                 ldb_transaction_cancel(ldb);
 384                 return NT_STATUS_ACCESS_DENIED;
 385         default:
 386                 DEBUG(0,("Failed to create alias record %s: %s\n",
 387                          ldb_dn_get_linearized(msg->dn),
 388                          ldb_errstring(ldb)));
 389                 talloc_free(tmp_ctx);
 390                 ldb_transaction_cancel(ldb);
 391                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 392         }
 393
 394         /* retrieve the sid for the alias just created */
 395         alias_sid = samdb_search_dom_sid(ldb, tmp_ctx,
 396                                          msg->dn, "objectSid", NULL);
 397
 398         if (ldb_transaction_commit(ldb) != LDB_SUCCESS) {
 399                 DEBUG(0, ("Failed to commit transaction in dsdb_add_domain_alias(): %s\n",
 400                           ldb_errstring(ldb)));
 401                 return NT_STATUS_INTERNAL_ERROR;
 402         }
 403
 404         *dn = talloc_steal(mem_ctx, msg->dn);
 405         *sid = talloc_steal(mem_ctx, alias_sid);
 406         talloc_free(tmp_ctx);
 407
 408
 409         return NT_STATUS_OK;
 410 }
 411
 412 /* Return the members of this group (which may be a domain group or an alias) */
 413 NTSTATUS dsdb_enum_group_mem(struct ldb_context *ldb,
 414                              TALLOC_CTX *mem_ctx,
 415                              struct ldb_dn *dn,
 416                              struct dom_sid **members_out,
 417                              unsigned int *pnum_members)
 418 {
 419         struct ldb_message *msg;
 420         unsigned int i, j;
 421         int ret;
 422         struct dom_sid *members;
 423         struct ldb_message_element *member_el;
 424         const char *attrs[] = { "member", NULL };
 425         NTSTATUS status;
 426         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 427         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 428
 429         ret = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs,
 430                               DSDB_SEARCH_SHOW_EXTENDED_DN, NULL);
 431         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 432                 talloc_free(tmp_ctx);
 433                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 434         }
 435         if (ret != LDB_SUCCESS) {
 436                 DEBUG(1, ("dsdb_enum_group_mem: dsdb_search for %s failed: %s\n",
 437                           ldb_dn_get_linearized(dn), ldb_errstring(ldb)));
 438                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 439         }
 440
 441         member_el = ldb_msg_find_element(msg, "member");
 442         if (!member_el) {
 443                 *members_out = NULL;
 444                 *pnum_members = 0;
 445                 talloc_free(tmp_ctx);
 446                 return NT_STATUS_OK;
 447         }
 448
 449         members = talloc_array(mem_ctx, struct dom_sid, member_el->num_values);
 450         if (members == NULL) {
 451                 return NT_STATUS_NO_MEMORY;
 452         }
 453
 454         j = 0;
 455         for (i=0; i <member_el->num_values; i++) {
 456                 struct ldb_dn *member_dn = ldb_dn_from_ldb_val(tmp_ctx, ldb,
 457                                                                &member_el->values[i]);
 458                 if (!member_dn || !ldb_dn_validate(member_dn)) {
 459                         DEBUG(1, ("Could not parse %*.*s as a DN\n",
 460                                   (int)member_el->values[i].length,
 461                                   (int)member_el->values[i].length,
 462                                   (const char *)member_el->values[i].data));
 463                         talloc_free(tmp_ctx);
 464                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 465                 }
 466
 467                 status = dsdb_get_extended_dn_sid(member_dn, &members[j],
 468                                                   "SID");
 469                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 470                         /* If we fail finding a SID then this is no error since
 471                          * it could be a non SAM object - e.g. a contact */
 472                         continue;
 473                 } else if (!NT_STATUS_IS_OK(status)) {
 474                         DEBUG(1, ("When parsing DN '%s' we failed to parse it's SID component, so we cannot fetch the membership: %s\n",
 475                                   ldb_dn_get_extended_linearized(tmp_ctx, member_dn, 1),
 476                                   nt_errstr(status)));
 477                         talloc_free(tmp_ctx);
 478                         return status;
 479                 }
 480
 481                 ++j;
 482         }
 483
 484         *members_out = talloc_steal(mem_ctx, members);
 485         *pnum_members = j;
 486         talloc_free(tmp_ctx);
 487         return NT_STATUS_OK;
 488 }
 489
 490 NTSTATUS dsdb_lookup_rids(struct ldb_context *ldb,
 491                           TALLOC_CTX *mem_ctx,
 492                           const struct dom_sid *domain_sid,
 493                           unsigned int num_rids,
 494                           uint32_t *rids,
 495                           const char **names,
 496                           enum lsa_SidType *lsa_attrs)
 497 {
 498         const char *attrs[] = { "sAMAccountType", "sAMAccountName", NULL };
 499         unsigned int i, num_mapped;
 500
 501         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 502         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 503
 504         num_mapped = 0;
 505
 506         for (i=0; i<num_rids; i++) {
 507                 struct ldb_message *msg;
 508                 struct ldb_dn *dn;
 509                 uint32_t attr;
 510                 int rc;
 511
 512                 lsa_attrs[i] = SID_NAME_UNKNOWN;
 513
 514                 dn = ldb_dn_new_fmt(tmp_ctx, ldb, "<SID=%s>",
 515                                     dom_sid_string(tmp_ctx,
 516                                                    dom_sid_add_rid(tmp_ctx, domain_sid,
 517                                                                    rids[i])));
 518                 if (dn == NULL) {
 519                         talloc_free(tmp_ctx);
 520                         return NT_STATUS_NO_MEMORY;
 521                 }
 522                 rc = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "samAccountName=*");
 523                 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
 524                         continue;
 525                 } else if (rc != LDB_SUCCESS) {
 526                         talloc_free(tmp_ctx);
 527                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 528                 }
 529
 530                 names[i] = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
 531                 if (names[i] == NULL) {
 532                         DEBUG(10, ("no samAccountName\n"));
 533                         continue;
 534                 }
 535                 talloc_steal(names, names[i]);
 536                 attr = ldb_msg_find_attr_as_uint(msg, "samAccountType", 0);
 537                 lsa_attrs[i] = ds_atype_map(attr);
 538                 if (lsa_attrs[i] == SID_NAME_UNKNOWN) {
 539                         continue;
 540                 }
 541                 num_mapped += 1;
 542         }
 543         talloc_free(tmp_ctx);
 544
 545         if (num_mapped == 0) {
 546                 return NT_STATUS_NONE_MAPPED;
 547         }
 548         if (num_mapped < num_rids) {
 549                 return STATUS_SOME_UNMAPPED;
 550         }
 551         return NT_STATUS_OK;
 552 }
 553