2 Unix SMB/CIFS implementation.
4 Winbind status program.
6 Copyright (C) Tim Potter 2000-2003
7 Copyright (C) Andrew Bartlett 2002-2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "winbind_client.h"
26 #include "librpc/gen_ndr/ndr_netlogon.h"
27 #include "libcli/auth/libcli_auth.h"
28 #include "libcli/security/security.h"
29 #include "lib/cmdline/popt_common.h"
30 #include "dynconfig.h"
31 #include "param/param.h"
33 extern int winbindd_fd;
35 static char winbind_separator_int(BOOL strict)
37 struct winbindd_response response;
44 ZERO_STRUCT(response);
46 /* Send off request */
48 if (winbindd_request_response(WINBINDD_INFO, NULL, &response) !=
50 d_fprintf(stderr, "could not obtain winbind separator!\n");
54 /* HACK: (this module should not call lp_ funtions) */
55 return *lp_winbind_separator();
58 sep = response.data.info.winbind_separator;
62 d_fprintf(stderr, "winbind separator was NULL!\n");
66 /* HACK: (this module should not call lp_ funtions) */
67 sep = *lp_winbind_separator();
73 static char winbind_separator(void)
75 return winbind_separator_int(False);
78 static const char *get_winbind_domain(void)
80 struct winbindd_response response;
81 static fstring winbind_domain;
83 ZERO_STRUCT(response);
85 /* Send off request */
87 if (winbindd_request_response(WINBINDD_DOMAIN_NAME, NULL, &response) !=
89 d_fprintf(stderr, "could not obtain winbind domain name!\n");
91 /* HACK: (this module should not call lp_ funtions) */
92 return lp_workgroup();
95 fstrcpy(winbind_domain, response.data.domain_name);
97 return winbind_domain;
101 /* Copy of parse_domain_user from winbindd_util.c. Parse a string of the
102 form DOMAIN/user into a domain and a user */
104 static BOOL parse_wbinfo_domain_user(const char *domuser, fstring domain,
108 char *p = strchr(domuser,winbind_separator());
111 fstrcpy(user, domuser);
112 fstrcpy(domain, get_winbind_domain());
117 fstrcpy(domain, domuser);
118 domain[PTR_DIFF(p, domuser)] = 0;
124 /* pull pwent info for a given user */
126 static BOOL wbinfo_get_userinfo(char *user)
128 struct winbindd_request request;
129 struct winbindd_response response;
132 ZERO_STRUCT(request);
133 ZERO_STRUCT(response);
137 fstrcpy(request.data.username, user);
139 result = winbindd_request_response(WINBINDD_GETPWNAM, &request, &response);
141 if (result != NSS_STATUS_SUCCESS)
144 d_printf( "%s:%s:%d:%d:%s:%s:%s\n",
145 response.data.pw.pw_name,
146 response.data.pw.pw_passwd,
147 response.data.pw.pw_uid,
148 response.data.pw.pw_gid,
149 response.data.pw.pw_gecos,
150 response.data.pw.pw_dir,
151 response.data.pw.pw_shell );
156 /* pull pwent info for a given uid */
157 static BOOL wbinfo_get_uidinfo(int uid)
159 struct winbindd_request request;
160 struct winbindd_response response;
163 ZERO_STRUCT(request);
164 ZERO_STRUCT(response);
166 request.data.uid = uid;
168 result = winbindd_request_response(WINBINDD_GETPWUID, &request, &response);
170 if (result != NSS_STATUS_SUCCESS)
173 d_printf( "%s:%s:%d:%d:%s:%s:%s\n",
174 response.data.pw.pw_name,
175 response.data.pw.pw_passwd,
176 response.data.pw.pw_uid,
177 response.data.pw.pw_gid,
178 response.data.pw.pw_gecos,
179 response.data.pw.pw_dir,
180 response.data.pw.pw_shell );
185 /* pull grent for a given group */
186 static BOOL wbinfo_get_groupinfo(char *group)
188 struct winbindd_request request;
189 struct winbindd_response response;
192 ZERO_STRUCT(request);
193 ZERO_STRUCT(response);
197 fstrcpy(request.data.groupname, group);
199 result = winbindd_request_response(WINBINDD_GETGRNAM, &request,
202 if ( result != NSS_STATUS_SUCCESS)
205 d_printf( "%s:%s:%d\n",
206 response.data.gr.gr_name,
207 response.data.gr.gr_passwd,
208 response.data.gr.gr_gid );
213 /* List groups a user is a member of */
215 static BOOL wbinfo_get_usergroups(char *user)
217 struct winbindd_request request;
218 struct winbindd_response response;
222 ZERO_STRUCT(request);
223 ZERO_STRUCT(response);
227 fstrcpy(request.data.username, user);
229 result = winbindd_request_response(WINBINDD_GETGROUPS, &request, &response);
231 if (result != NSS_STATUS_SUCCESS)
234 for (i = 0; i < response.data.num_entries; i++)
235 d_printf("%d\n", (int)((gid_t *)response.extra_data.data)[i]);
237 SAFE_FREE(response.extra_data.data);
243 /* List group SIDs a user SID is a member of */
244 static BOOL wbinfo_get_usersids(char *user_sid)
246 struct winbindd_request request;
247 struct winbindd_response response;
252 ZERO_STRUCT(request);
253 ZERO_STRUCT(response);
256 fstrcpy(request.data.sid, user_sid);
258 result = winbindd_request_response(WINBINDD_GETUSERSIDS, &request, &response);
260 if (result != NSS_STATUS_SUCCESS)
263 s = (const char *)response.extra_data.data;
264 for (i = 0; i < response.data.num_entries; i++) {
269 SAFE_FREE(response.extra_data.data);
274 static BOOL wbinfo_get_userdomgroups(const char *user_sid)
276 struct winbindd_request request;
277 struct winbindd_response response;
280 ZERO_STRUCT(request);
281 ZERO_STRUCT(response);
284 fstrcpy(request.data.sid, user_sid);
286 result = winbindd_request_response(WINBINDD_GETUSERDOMGROUPS, &request,
289 if (result != NSS_STATUS_SUCCESS)
292 if (response.data.num_entries != 0)
293 printf("%s", (char *)response.extra_data.data);
295 SAFE_FREE(response.extra_data.data);
300 /* Convert NetBIOS name to IP */
302 static BOOL wbinfo_wins_byname(char *name)
304 struct winbindd_request request;
305 struct winbindd_response response;
307 ZERO_STRUCT(request);
308 ZERO_STRUCT(response);
312 fstrcpy(request.data.winsreq, name);
314 if (winbindd_request_response(WINBINDD_WINS_BYNAME, &request, &response) !=
315 NSS_STATUS_SUCCESS) {
319 /* Display response */
321 d_printf("%s\n", response.data.winsresp);
326 /* Convert IP to NetBIOS name */
328 static BOOL wbinfo_wins_byip(char *ip)
330 struct winbindd_request request;
331 struct winbindd_response response;
333 ZERO_STRUCT(request);
334 ZERO_STRUCT(response);
338 fstrcpy(request.data.winsreq, ip);
340 if (winbindd_request_response(WINBINDD_WINS_BYIP, &request, &response) !=
341 NSS_STATUS_SUCCESS) {
345 /* Display response */
347 d_printf("%s\n", response.data.winsresp);
352 /* List trusted domains */
354 static BOOL wbinfo_list_domains(BOOL list_all_domains)
356 struct winbindd_request request;
357 struct winbindd_response response;
359 ZERO_STRUCT(request);
360 ZERO_STRUCT(response);
364 request.data.list_all_domains = list_all_domains;
366 if (winbindd_request_response(WINBINDD_LIST_TRUSTDOM, &request, &response) !=
370 /* Display response */
372 if (response.extra_data.data) {
373 const char *extra_data = (char *)response.extra_data.data;
377 while(next_token(&extra_data, name, "\n", sizeof(fstring))) {
378 p = strchr(name, '\\');
380 d_fprintf(stderr, "Got invalid response: %s\n",
385 d_printf("%s\n", name);
388 SAFE_FREE(response.extra_data.data);
394 /* List own domain */
396 static BOOL wbinfo_list_own_domain(void)
398 d_printf("%s\n", get_winbind_domain());
403 /* show sequence numbers */
404 static BOOL wbinfo_show_sequence(const char *domain)
406 struct winbindd_request request;
407 struct winbindd_response response;
409 ZERO_STRUCT(response);
410 ZERO_STRUCT(request);
413 fstrcpy( request.domain_name, domain );
417 if (winbindd_request_response(WINBINDD_SHOW_SEQUENCE, &request, &response) !=
421 /* Display response */
423 if (response.extra_data.data) {
424 char *extra_data = (char *)response.extra_data.data;
425 d_printf("%s", extra_data);
426 SAFE_FREE(response.extra_data.data);
432 /* Show domain info */
434 static BOOL wbinfo_domain_info(const char *domain_name)
436 struct winbindd_request request;
437 struct winbindd_response response;
439 ZERO_STRUCT(request);
440 ZERO_STRUCT(response);
442 if ((strequal(domain_name, ".")) || (domain_name[0] == '\0'))
443 fstrcpy(request.domain_name, get_winbind_domain());
445 fstrcpy(request.domain_name, domain_name);
449 if (winbindd_request_response(WINBINDD_DOMAIN_INFO, &request, &response) !=
453 /* Display response */
455 d_printf("Name : %s\n", response.data.domain_info.name);
456 d_printf("Alt_Name : %s\n", response.data.domain_info.alt_name);
458 d_printf("SID : %s\n", response.data.domain_info.sid);
460 d_printf("Active Directory : %s\n",
461 response.data.domain_info.active_directory ? "Yes" : "No");
462 d_printf("Native : %s\n",
463 response.data.domain_info.native_mode ? "Yes" : "No");
465 d_printf("Primary : %s\n",
466 response.data.domain_info.primary ? "Yes" : "No");
468 d_printf("Sequence : %d\n", response.data.domain_info.sequence_number);
473 /* Get a foreign DC's name */
474 static BOOL wbinfo_getdcname(const char *domain_name)
476 struct winbindd_request request;
477 struct winbindd_response response;
479 ZERO_STRUCT(request);
480 ZERO_STRUCT(response);
482 fstrcpy(request.domain_name, domain_name);
486 if (winbindd_request_response(WINBINDD_GETDCNAME, &request, &response) !=
487 NSS_STATUS_SUCCESS) {
488 d_fprintf(stderr, "Could not get dc name for %s\n", domain_name);
492 /* Display response */
494 d_printf("%s\n", response.data.dc_name);
499 /* Check trust account password */
501 static BOOL wbinfo_check_secret(void)
503 struct winbindd_response response;
506 ZERO_STRUCT(response);
508 result = winbindd_request_response(WINBINDD_CHECK_MACHACC, NULL, &response);
510 d_printf("checking the trust secret via RPC calls %s\n",
511 (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
513 if (result != NSS_STATUS_SUCCESS)
514 d_fprintf(stderr, "error code was %s (0x%x)\n",
515 response.data.auth.nt_status_string,
516 response.data.auth.nt_status);
518 return result == NSS_STATUS_SUCCESS;
521 /* Convert uid to sid */
523 static BOOL wbinfo_uid_to_sid(uid_t uid)
525 struct winbindd_request request;
526 struct winbindd_response response;
528 ZERO_STRUCT(request);
529 ZERO_STRUCT(response);
533 request.data.uid = uid;
535 if (winbindd_request_response(WINBINDD_UID_TO_SID, &request, &response) !=
539 /* Display response */
541 d_printf("%s\n", response.data.sid.sid);
546 /* Convert gid to sid */
548 static BOOL wbinfo_gid_to_sid(gid_t gid)
550 struct winbindd_request request;
551 struct winbindd_response response;
553 ZERO_STRUCT(request);
554 ZERO_STRUCT(response);
558 request.data.gid = gid;
560 if (winbindd_request_response(WINBINDD_GID_TO_SID, &request, &response) !=
564 /* Display response */
566 d_printf("%s\n", response.data.sid.sid);
571 /* Convert sid to uid */
573 static BOOL wbinfo_sid_to_uid(char *sid)
575 struct winbindd_request request;
576 struct winbindd_response response;
578 ZERO_STRUCT(request);
579 ZERO_STRUCT(response);
583 fstrcpy(request.data.sid, sid);
585 if (winbindd_request_response(WINBINDD_SID_TO_UID, &request, &response) !=
589 /* Display response */
591 d_printf("%d\n", (int)response.data.uid);
596 static BOOL wbinfo_sid_to_gid(char *sid)
598 struct winbindd_request request;
599 struct winbindd_response response;
601 ZERO_STRUCT(request);
602 ZERO_STRUCT(response);
606 fstrcpy(request.data.sid, sid);
608 if (winbindd_request_response(WINBINDD_SID_TO_GID, &request, &response) !=
612 /* Display response */
614 d_printf("%d\n", (int)response.data.gid);
619 /* Convert sid to string */
621 static BOOL wbinfo_lookupsid(char *sid)
623 struct winbindd_request request;
624 struct winbindd_response response;
626 ZERO_STRUCT(request);
627 ZERO_STRUCT(response);
629 /* Send off request */
631 fstrcpy(request.data.sid, sid);
633 if (winbindd_request_response(WINBINDD_LOOKUPSID, &request, &response) !=
637 /* Display response */
639 d_printf("%s%c%s %d\n", response.data.name.dom_name,
640 winbind_separator(), response.data.name.name,
641 response.data.name.type);
646 static const char *sid_type_lookup(enum lsa_SidType r)
649 case SID_NAME_USE_NONE: return "SID_NAME_USE_NONE"; break;
650 case SID_NAME_USER: return "SID_NAME_USER"; break;
651 case SID_NAME_DOM_GRP: return "SID_NAME_DOM_GRP"; break;
652 case SID_NAME_DOMAIN: return "SID_NAME_DOMAIN"; break;
653 case SID_NAME_ALIAS: return "SID_NAME_ALIAS"; break;
654 case SID_NAME_WKN_GRP: return "SID_NAME_WKN_GRP"; break;
655 case SID_NAME_DELETED: return "SID_NAME_DELETED"; break;
656 case SID_NAME_INVALID: return "SID_NAME_INVALID"; break;
657 case SID_NAME_UNKNOWN: return "SID_NAME_UNKNOWN"; break;
659 return "Invalid sid type\n";
662 /* Convert string to sid */
664 static BOOL wbinfo_lookupname(char *name)
666 struct winbindd_request request;
667 struct winbindd_response response;
669 /* Send off request */
671 ZERO_STRUCT(request);
672 ZERO_STRUCT(response);
674 parse_wbinfo_domain_user(name, request.data.name.dom_name,
675 request.data.name.name);
677 if (winbindd_request_response(WINBINDD_LOOKUPNAME, &request, &response) !=
681 /* Display response */
683 d_printf("%s %s (%d)\n", response.data.sid.sid, sid_type_lookup(response.data.sid.type), response.data.sid.type);
688 /* Authenticate a user with a plaintext password */
690 static BOOL wbinfo_auth_krb5(char *username, const char *cctype, uint32_t flags)
692 struct winbindd_request request;
693 struct winbindd_response response;
697 /* Send off request */
699 ZERO_STRUCT(request);
700 ZERO_STRUCT(response);
702 p = strchr(username, '%');
706 fstrcpy(request.data.auth.user, username);
707 fstrcpy(request.data.auth.pass, p + 1);
710 fstrcpy(request.data.auth.user, username);
712 request.flags = flags;
714 fstrcpy(request.data.auth.krb5_cc_type, cctype);
716 request.data.auth.uid = geteuid();
718 result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
720 /* Display response */
722 d_printf("plaintext kerberos password authentication for [%s] %s (requesting cctype: %s)\n",
723 username, (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed", cctype);
725 if (response.data.auth.nt_status)
726 d_fprintf(stderr, "error code was %s (0x%x)\nerror messsage was: %s\n",
727 response.data.auth.nt_status_string,
728 response.data.auth.nt_status,
729 response.data.auth.error_string);
731 if (result == NSS_STATUS_SUCCESS) {
733 if (request.flags & WBFLAG_PAM_INFO3_TEXT) {
734 if (response.data.auth.info3.user_flgs & NETLOGON_CACHED_ACCOUNT) {
735 d_printf("user_flgs: NETLOGON_CACHED_ACCOUNT\n");
739 if (response.data.auth.krb5ccname[0] != '\0') {
740 d_printf("credentials were put in: %s\n", response.data.auth.krb5ccname);
742 d_printf("no credentials cached\n");
746 return result == NSS_STATUS_SUCCESS;
749 /* Authenticate a user with a plaintext password */
751 static BOOL wbinfo_auth(char *username)
753 struct winbindd_request request;
754 struct winbindd_response response;
758 /* Send off request */
760 ZERO_STRUCT(request);
761 ZERO_STRUCT(response);
763 p = strchr(username, '%');
767 fstrcpy(request.data.auth.user, username);
768 fstrcpy(request.data.auth.pass, p + 1);
771 fstrcpy(request.data.auth.user, username);
773 result = winbindd_request_response(WINBINDD_PAM_AUTH, &request, &response);
775 /* Display response */
777 d_printf("plaintext password authentication %s\n",
778 (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
780 if (response.data.auth.nt_status)
781 d_fprintf(stderr, "error code was %s (0x%x)\nerror messsage was: %s\n",
782 response.data.auth.nt_status_string,
783 response.data.auth.nt_status,
784 response.data.auth.error_string);
786 return result == NSS_STATUS_SUCCESS;
789 /* Authenticate a user with a challenge/response */
791 static BOOL wbinfo_auth_crap(char *username)
793 struct winbindd_request request;
794 struct winbindd_response response;
801 /* Send off request */
803 ZERO_STRUCT(request);
804 ZERO_STRUCT(response);
806 p = strchr(username, '%');
810 fstrcpy(pass, p + 1);
813 parse_wbinfo_domain_user(username, name_domain, name_user);
815 request.data.auth_crap.logon_parameters = MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT | MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT;
817 fstrcpy(request.data.auth_crap.user, name_user);
819 fstrcpy(request.data.auth_crap.domain,
822 generate_random_buffer(request.data.auth_crap.chal, 8);
824 if (lp_client_ntlmv2_auth()) {
825 DATA_BLOB server_chal;
826 DATA_BLOB names_blob;
828 DATA_BLOB lm_response;
829 DATA_BLOB nt_response;
832 mem_ctx = talloc_new(NULL);
833 if (mem_ctx == NULL) {
834 d_printf("talloc_new failed\n");
838 server_chal = data_blob(request.data.auth_crap.chal, 8);
840 /* Pretend this is a login to 'us', for blob purposes */
841 names_blob = NTLMv2_generate_names_blob(mem_ctx, lp_netbios_name(), lp_workgroup());
843 if (!SMBNTLMv2encrypt(mem_ctx, name_user, name_domain, pass, &server_chal,
845 &lm_response, &nt_response, NULL, NULL)) {
846 data_blob_free(&names_blob);
847 data_blob_free(&server_chal);
850 data_blob_free(&names_blob);
851 data_blob_free(&server_chal);
853 memcpy(request.data.auth_crap.nt_resp, nt_response.data,
854 MIN(nt_response.length,
855 sizeof(request.data.auth_crap.nt_resp)));
856 request.data.auth_crap.nt_resp_len = nt_response.length;
858 memcpy(request.data.auth_crap.lm_resp, lm_response.data,
859 MIN(lm_response.length,
860 sizeof(request.data.auth_crap.lm_resp)));
861 request.data.auth_crap.lm_resp_len = lm_response.length;
863 data_blob_free(&nt_response);
864 data_blob_free(&lm_response);
867 if (lp_client_lanman_auth()
868 && SMBencrypt(pass, request.data.auth_crap.chal,
869 (unsigned char *)request.data.auth_crap.lm_resp)) {
870 request.data.auth_crap.lm_resp_len = 24;
872 request.data.auth_crap.lm_resp_len = 0;
874 SMBNTencrypt(pass, request.data.auth_crap.chal,
875 (unsigned char *)request.data.auth_crap.nt_resp);
877 request.data.auth_crap.nt_resp_len = 24;
880 result = winbindd_request_response(WINBINDD_PAM_AUTH_CRAP, &request, &response);
882 /* Display response */
884 d_printf("challenge/response password authentication %s\n",
885 (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed");
887 if (response.data.auth.nt_status)
888 d_fprintf(stderr, "error code was %s (0x%x)\nerror messsage was: %s\n",
889 response.data.auth.nt_status_string,
890 response.data.auth.nt_status,
891 response.data.auth.error_string);
893 return result == NSS_STATUS_SUCCESS;
896 /* Print domain users */
898 static BOOL print_domain_users(const char *domain)
900 struct winbindd_request request;
901 struct winbindd_response response;
902 const char *extra_data;
905 /* Send request to winbind daemon */
907 ZERO_STRUCT(request);
908 ZERO_STRUCT(response);
911 /* '.' is the special sign for our own domain */
912 if ( strequal(domain, ".") )
913 fstrcpy( request.domain_name, get_winbind_domain() );
915 fstrcpy( request.domain_name, domain );
918 if (winbindd_request_response(WINBINDD_LIST_USERS, &request, &response) !=
922 /* Look through extra data */
924 if (!response.extra_data.data)
927 extra_data = (const char *)response.extra_data.data;
929 while(next_token(&extra_data, name, ",", sizeof(fstring)))
930 d_printf("%s\n", name);
932 SAFE_FREE(response.extra_data.data);
937 /* Print domain groups */
939 static BOOL print_domain_groups(const char *domain)
941 struct winbindd_request request;
942 struct winbindd_response response;
943 const char *extra_data;
946 ZERO_STRUCT(request);
947 ZERO_STRUCT(response);
950 if ( strequal(domain, ".") )
951 fstrcpy( request.domain_name, get_winbind_domain() );
953 fstrcpy( request.domain_name, domain );
956 if (winbindd_request_response(WINBINDD_LIST_GROUPS, &request, &response) !=
960 /* Look through extra data */
962 if (!response.extra_data.data)
965 extra_data = (const char *)response.extra_data.data;
967 while(next_token(&extra_data, name, ",", sizeof(fstring)))
968 d_printf("%s\n", name);
970 SAFE_FREE(response.extra_data.data);
975 static BOOL wbinfo_ping(void)
979 result = winbindd_request_response(WINBINDD_PING, NULL, NULL);
981 /* Display response */
983 d_printf("Ping to winbindd %s on fd %d\n",
984 (result == NSS_STATUS_SUCCESS) ? "succeeded" : "failed", winbindd_fd);
986 return result == NSS_STATUS_SUCCESS;
992 OPT_SET_AUTH_USER = 1000,
1002 OPT_LIST_ALL_DOMAINS,
1003 OPT_LIST_OWN_DOMAIN,
1008 int main(int argc, char **argv, char **envp)
1013 static char *string_arg;
1014 static char *opt_domain_name;
1018 struct poptOption long_options[] = {
1021 /* longName, shortName, argInfo, argPtr, value, descrip,
1024 { "domain-users", 'u', POPT_ARG_NONE, 0, 'u', "Lists all domain users", "domain"},
1025 { "domain-groups", 'g', POPT_ARG_NONE, 0, 'g', "Lists all domain groups", "domain" },
1026 { "WINS-by-name", 'N', POPT_ARG_STRING, &string_arg, 'N', "Converts NetBIOS name to IP", "NETBIOS-NAME" },
1027 { "WINS-by-ip", 'I', POPT_ARG_STRING, &string_arg, 'I', "Converts IP address to NetBIOS name", "IP" },
1028 { "name-to-sid", 'n', POPT_ARG_STRING, &string_arg, 'n', "Converts name to sid", "NAME" },
1029 { "sid-to-name", 's', POPT_ARG_STRING, &string_arg, 's', "Converts sid to name", "SID" },
1030 { "uid-to-sid", 'U', POPT_ARG_INT, &int_arg, 'U', "Converts uid to sid" , "UID" },
1031 { "gid-to-sid", 'G', POPT_ARG_INT, &int_arg, 'G', "Converts gid to sid", "GID" },
1032 { "sid-to-uid", 'S', POPT_ARG_STRING, &string_arg, 'S', "Converts sid to uid", "SID" },
1033 { "sid-to-gid", 'Y', POPT_ARG_STRING, &string_arg, 'Y', "Converts sid to gid", "SID" },
1034 { "check-secret", 't', POPT_ARG_NONE, 0, 't', "Check shared secret" },
1035 { "trusted-domains", 'm', POPT_ARG_NONE, 0, 'm', "List trusted domains" },
1036 { "all-domains", 0, POPT_ARG_NONE, 0, OPT_LIST_ALL_DOMAINS, "List all domains (trusted and own domain)" },
1037 { "own-domain", 0, POPT_ARG_NONE, 0, OPT_LIST_OWN_DOMAIN, "List own domain" },
1038 { "sequence", 0, POPT_ARG_NONE, 0, OPT_SEQUENCE, "Show sequence numbers of all domains" },
1039 { "domain-info", 'D', POPT_ARG_STRING, &string_arg, 'D', "Show most of the info we have about the domain" },
1040 { "user-info", 'i', POPT_ARG_STRING, &string_arg, 'i', "Get user info", "USER" },
1041 { "uid-info", 0, POPT_ARG_INT, &int_arg, OPT_UID_INFO, "Get user info from uid", "UID" },
1042 { "group-info", 0, POPT_ARG_STRING, &string_arg, OPT_GROUP_INFO, "Get group info", "GROUP" },
1043 { "user-groups", 'r', POPT_ARG_STRING, &string_arg, 'r', "Get user groups", "USER" },
1044 { "user-domgroups", 0, POPT_ARG_STRING, &string_arg,
1045 OPT_USERDOMGROUPS, "Get user domain groups", "SID" },
1046 { "user-sids", 0, POPT_ARG_STRING, &string_arg, OPT_USERSIDS, "Get user group sids for user SID", "SID" },
1047 { "authenticate", 'a', POPT_ARG_STRING, &string_arg, 'a', "authenticate user", "user%password" },
1048 { "getdcname", 0, POPT_ARG_STRING, &string_arg, OPT_GETDCNAME,
1049 "Get a DC name for a foreign domain", "domainname" },
1050 { "ping", 'p', POPT_ARG_NONE, 0, 'p', "Ping winbindd to see if it is alive" },
1051 { "domain", 0, POPT_ARG_STRING, &opt_domain_name, OPT_DOMAIN_NAME, "Define to the domain to restrict operation", "domain" },
1053 { "krb5auth", 'K', POPT_ARG_STRING, &string_arg, 'K', "authenticate user using Kerberos", "user%password" },
1054 /* destroys wbinfo --help output */
1055 /* "user%password,DOM\\user%password,user@EXAMPLE.COM,EXAMPLE.COM\\user%password" }, */
1057 { "separator", 0, POPT_ARG_NONE, 0, OPT_SEPARATOR, "Get the active winbind separator", NULL },
1065 pc = poptGetContext("wbinfo", argc, (const char **)argv, long_options, 0);
1067 /* Parse command line options */
1070 poptPrintHelp(pc, stderr, 0);
1074 while((opt = poptGetNextOpt(pc)) != -1) {
1075 /* get the generic configuration parameters like --domain */
1078 poptFreeContext(pc);
1080 pc = poptGetContext(NULL, argc, (const char **)argv, long_options,
1081 POPT_CONTEXT_KEEP_FIRST);
1083 while((opt = poptGetNextOpt(pc)) != -1) {
1086 if (!print_domain_users(opt_domain_name)) {
1087 d_fprintf(stderr, "Error looking up domain users\n");
1092 if (!print_domain_groups(opt_domain_name)) {
1093 d_fprintf(stderr, "Error looking up domain groups\n");
1098 if (!wbinfo_lookupsid(string_arg)) {
1099 d_fprintf(stderr, "Could not lookup sid %s\n", string_arg);
1104 if (!wbinfo_lookupname(string_arg)) {
1105 d_fprintf(stderr, "Could not lookup name %s\n", string_arg);
1110 if (!wbinfo_wins_byname(string_arg)) {
1111 d_fprintf(stderr, "Could not lookup WINS by name %s\n", string_arg);
1116 if (!wbinfo_wins_byip(string_arg)) {
1117 d_fprintf(stderr, "Could not lookup WINS by IP %s\n", string_arg);
1122 if (!wbinfo_uid_to_sid(int_arg)) {
1123 d_fprintf(stderr, "Could not convert uid %d to sid\n", int_arg);
1128 if (!wbinfo_gid_to_sid(int_arg)) {
1129 d_fprintf(stderr, "Could not convert gid %d to sid\n",
1135 if (!wbinfo_sid_to_uid(string_arg)) {
1136 d_fprintf(stderr, "Could not convert sid %s to uid\n",
1142 if (!wbinfo_sid_to_gid(string_arg)) {
1143 d_fprintf(stderr, "Could not convert sid %s to gid\n",
1149 if (!wbinfo_check_secret()) {
1150 d_fprintf(stderr, "Could not check secret\n");
1155 if (!wbinfo_list_domains(False)) {
1156 d_fprintf(stderr, "Could not list trusted domains\n");
1161 if (!wbinfo_show_sequence(opt_domain_name)) {
1162 d_fprintf(stderr, "Could not show sequence numbers\n");
1167 if (!wbinfo_domain_info(string_arg)) {
1168 d_fprintf(stderr, "Could not get domain info\n");
1173 if (!wbinfo_get_userinfo(string_arg)) {
1174 d_fprintf(stderr, "Could not get info for user %s\n",
1180 if ( !wbinfo_get_uidinfo(int_arg)) {
1181 d_fprintf(stderr, "Could not get info for uid "
1186 case OPT_GROUP_INFO:
1187 if ( !wbinfo_get_groupinfo(string_arg)) {
1188 d_fprintf(stderr, "Could not get info for "
1189 "group %s\n", string_arg);
1194 if (!wbinfo_get_usergroups(string_arg)) {
1195 d_fprintf(stderr, "Could not get groups for user %s\n",
1201 if (!wbinfo_get_usersids(string_arg)) {
1202 d_fprintf(stderr, "Could not get group SIDs for user SID %s\n",
1207 case OPT_USERDOMGROUPS:
1208 if (!wbinfo_get_userdomgroups(string_arg)) {
1209 d_fprintf(stderr, "Could not get user's domain groups "
1210 "for user SID %s\n", string_arg);
1215 BOOL got_error = False;
1217 if (!wbinfo_auth(string_arg)) {
1218 d_fprintf(stderr, "Could not authenticate user %s with "
1219 "plaintext password\n", string_arg);
1223 if (!wbinfo_auth_crap(string_arg)) {
1224 d_fprintf(stderr, "Could not authenticate user %s with "
1225 "challenge/response\n", string_arg);
1234 uint32_t flags = WBFLAG_PAM_KRB5 |
1235 WBFLAG_PAM_CACHED_LOGIN |
1236 WBFLAG_PAM_FALLBACK_AFTER_KRB5 |
1237 WBFLAG_PAM_INFO3_TEXT;
1239 if (!wbinfo_auth_krb5(string_arg, "FILE", flags)) {
1240 d_fprintf(stderr, "Could not authenticate user [%s] with "
1241 "Kerberos (ccache: %s)\n", string_arg, "FILE");
1247 if (!wbinfo_ping()) {
1248 d_fprintf(stderr, "could not ping winbindd!\n");
1253 if (!wbinfo_getdcname(string_arg)) {
1257 case OPT_SEPARATOR: {
1258 const char sep = winbind_separator_int(True);
1262 d_printf("%c\n", sep);
1265 case OPT_LIST_ALL_DOMAINS:
1266 if (!wbinfo_list_domains(True)) {
1270 case OPT_LIST_OWN_DOMAIN:
1271 if (!wbinfo_list_own_domain()) {
1275 /* generic configuration options */
1276 case OPT_DOMAIN_NAME:
1279 d_fprintf(stderr, "Invalid option\n");
1280 poptPrintHelp(pc, stderr, 0);
1290 poptFreeContext(pc);