source3/utils/net_sam.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Local SAM access routines
   4  *  Copyright (C) Volker Lendecke 2006
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20
  21 #include "includes.h"
  22 #include "system/passwd.h"
  23 #include "utils/net.h"
  24 #include "../librpc/gen_ndr/samr.h"
  25 #include "smbldap.h"
  26 #include "../libcli/security/security.h"
  27 #include "lib/winbind_util.h"
  28 #include "passdb.h"
  29 #include "passdb/pdb_ldap_util.h"
  30 #include "passdb/pdb_ldap_schema.h"
  31 #include "lib/privileges.h"
  32 #include "secrets.h"
  33 #include "idmap.h"
  34 #include "lib/util/smb_strtox.h"
  35 #include "lib/util/string_wrappers.h"
  36
  37 /*
  38  * Set a user's data
  39  */
  40
  41 static int net_sam_userset(struct net_context *c, int argc, const char **argv,
  42                            const char *field,
  43                            bool (*fn)(struct samu *, const char *,
  44                                       enum pdb_value_state))
  45 {
  46         struct samu *sam_acct = NULL;
  47         struct dom_sid sid;
  48         enum lsa_SidType type;
  49         const char *dom, *name;
  50         NTSTATUS status;
  51
  52         if (argc != 2 || c->display_usage) {
  53                 d_fprintf(stderr, "%s\n", _("Usage:"));
  54                 d_fprintf(stderr, _("net sam set %s <user> <value>\n"),
  55                           field);
  56                 return -1;
  57         }
  58
  59         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
  60                          &dom, &name, &sid, &type)) {
  61                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
  62                 return -1;
  63         }
  64
  65         if (type != SID_NAME_USER) {
  66                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
  67                           sid_type_lookup(type));
  68                 return -1;
  69         }
  70
  71         if ( !(sam_acct = samu_new( NULL )) ) {
  72                 d_fprintf(stderr, _("Internal error\n"));
  73                 return -1;
  74         }
  75
  76         if (!pdb_getsampwsid(sam_acct, &sid)) {
  77                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
  78                 return -1;
  79         }
  80
  81         if (!fn(sam_acct, argv[1], PDB_CHANGED)) {
  82                 d_fprintf(stderr, _("Internal error\n"));
  83                 return -1;
  84         }
  85
  86         status = pdb_update_sam_account(sam_acct);
  87         if (!NT_STATUS_IS_OK(status)) {
  88                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
  89                           argv[0], nt_errstr(status));
  90                 return -1;
  91         }
  92
  93         TALLOC_FREE(sam_acct);
  94
  95         d_printf(_("Updated %s for %s\\%s to %s\n"), field, dom, name, argv[1]);
  96         return 0;
  97 }
  98
  99 static int net_sam_set_fullname(struct net_context *c, int argc,
 100                                 const char **argv)
 101 {
 102         return net_sam_userset(c, argc, argv, "fullname",
 103                                pdb_set_fullname);
 104 }
 105
 106 static int net_sam_set_logonscript(struct net_context *c, int argc,
 107                                    const char **argv)
 108 {
 109         return net_sam_userset(c, argc, argv, "logonscript",
 110                                pdb_set_logon_script);
 111 }
 112
 113 static int net_sam_set_profilepath(struct net_context *c, int argc,
 114                                    const char **argv)
 115 {
 116         return net_sam_userset(c, argc, argv, "profilepath",
 117                                pdb_set_profile_path);
 118 }
 119
 120 static int net_sam_set_homedrive(struct net_context *c, int argc,
 121                                  const char **argv)
 122 {
 123         return net_sam_userset(c, argc, argv, "homedrive",
 124                                pdb_set_dir_drive);
 125 }
 126
 127 static int net_sam_set_homedir(struct net_context *c, int argc,
 128                                const char **argv)
 129 {
 130         return net_sam_userset(c, argc, argv, "homedir",
 131                                pdb_set_homedir);
 132 }
 133
 134 static int net_sam_set_workstations(struct net_context *c, int argc,
 135                                     const char **argv)
 136 {
 137         return net_sam_userset(c, argc, argv, "workstations",
 138                                pdb_set_workstations);
 139 }
 140
 141 /*
 142  * Set account flags
 143  */
 144
 145 static int net_sam_set_userflag(struct net_context *c, int argc,
 146                                 const char **argv, const char *field,
 147                                 uint16_t flag)
 148 {
 149         struct samu *sam_acct = NULL;
 150         struct dom_sid sid;
 151         enum lsa_SidType type;
 152         const char *dom, *name;
 153         NTSTATUS status;
 154         uint32_t acct_flags;
 155
 156         if ((argc != 2) || c->display_usage ||
 157             (!strequal(argv[1], "yes") &&
 158              !strequal(argv[1], "no"))) {
 159                 d_fprintf(stderr, "%s\n", _("Usage:"));
 160                 d_fprintf(stderr, _("net sam set %s <user> [yes|no]\n"),
 161                           field);
 162                 return -1;
 163         }
 164
 165         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 166                          &dom, &name, &sid, &type)) {
 167                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 168                 return -1;
 169         }
 170
 171         if (type != SID_NAME_USER) {
 172                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
 173                           sid_type_lookup(type));
 174                 return -1;
 175         }
 176
 177         if ( !(sam_acct = samu_new( NULL )) ) {
 178                 d_fprintf(stderr, _("Internal error\n"));
 179                 return -1;
 180         }
 181
 182         if (!pdb_getsampwsid(sam_acct, &sid)) {
 183                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
 184                 return -1;
 185         }
 186
 187         acct_flags = pdb_get_acct_ctrl(sam_acct);
 188
 189         if (strequal(argv[1], "yes")) {
 190                 acct_flags |= flag;
 191         } else {
 192                 acct_flags &= ~flag;
 193         }
 194
 195         pdb_set_acct_ctrl(sam_acct, acct_flags, PDB_CHANGED);
 196
 197         status = pdb_update_sam_account(sam_acct);
 198         if (!NT_STATUS_IS_OK(status)) {
 199                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
 200                           argv[0], nt_errstr(status));
 201                 return -1;
 202         }
 203
 204         TALLOC_FREE(sam_acct);
 205
 206         d_fprintf(stderr, _("Updated flag %s for %s\\%s to %s\n"), field, dom,
 207                   name, argv[1]);
 208         return 0;
 209 }
 210
 211 static int net_sam_set_disabled(struct net_context *c, int argc,
 212                                 const char **argv)
 213 {
 214         return net_sam_set_userflag(c, argc, argv, "disabled", ACB_DISABLED);
 215 }
 216
 217 static int net_sam_set_pwnotreq(struct net_context *c, int argc,
 218                                 const char **argv)
 219 {
 220         return net_sam_set_userflag(c, argc, argv, "pwnotreq", ACB_PWNOTREQ);
 221 }
 222
 223 static int net_sam_set_autolock(struct net_context *c, int argc,
 224                                 const char **argv)
 225 {
 226         return net_sam_set_userflag(c, argc, argv, "autolock", ACB_AUTOLOCK);
 227 }
 228
 229 static int net_sam_set_pwnoexp(struct net_context *c, int argc,
 230                                const char **argv)
 231 {
 232         return net_sam_set_userflag(c, argc, argv, "pwnoexp", ACB_PWNOEXP);
 233 }
 234
 235 /*
 236  * Set pass last change time, based on force pass change now
 237  */
 238
 239 static int net_sam_set_pwdmustchangenow(struct net_context *c, int argc,
 240                                         const char **argv)
 241 {
 242         struct samu *sam_acct = NULL;
 243         struct dom_sid sid;
 244         enum lsa_SidType type;
 245         const char *dom, *name;
 246         NTSTATUS status;
 247
 248         if ((argc != 2) || c->display_usage ||
 249             (!strequal(argv[1], "yes") &&
 250              !strequal(argv[1], "no"))) {
 251                 d_fprintf(stderr, "%s\n%s",
 252                           _("Usage:"),
 253                           _("net sam set pwdmustchangenow <user> [yes|no]\n"));
 254                 return -1;
 255         }
 256
 257         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 258                          &dom, &name, &sid, &type)) {
 259                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 260                 return -1;
 261         }
 262
 263         if (type != SID_NAME_USER) {
 264                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
 265                           sid_type_lookup(type));
 266                 return -1;
 267         }
 268
 269         if ( !(sam_acct = samu_new( NULL )) ) {
 270                 d_fprintf(stderr, _("Internal error\n"));
 271                 return -1;
 272         }
 273
 274         if (!pdb_getsampwsid(sam_acct, &sid)) {
 275                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
 276                 return -1;
 277         }
 278
 279         if (strequal(argv[1], "yes")) {
 280                 pdb_set_pass_last_set_time(sam_acct, 0, PDB_CHANGED);
 281         } else {
 282                 pdb_set_pass_last_set_time(sam_acct, time(NULL), PDB_CHANGED);
 283         }
 284
 285         status = pdb_update_sam_account(sam_acct);
 286         if (!NT_STATUS_IS_OK(status)) {
 287                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
 288                           argv[0], nt_errstr(status));
 289                 return -1;
 290         }
 291
 292         TALLOC_FREE(sam_acct);
 293
 294         d_fprintf(stderr, _("Updated 'user must change password at next logon' "
 295                             "for %s\\%s to %s\n"), dom,
 296                   name, argv[1]);
 297         return 0;
 298 }
 299
 300
 301 /*
 302  * Set a user's or a group's comment
 303  */
 304
 305 static int net_sam_set_comment(struct net_context *c, int argc,
 306                                const char **argv)
 307 {
 308         GROUP_MAP *map;
 309         struct dom_sid sid;
 310         enum lsa_SidType type;
 311         const char *dom, *name;
 312         NTSTATUS status;
 313
 314         if (argc != 2 || c->display_usage) {
 315                 d_fprintf(stderr, "%s\n%s",
 316                           _("Usage:"),
 317                           _("net sam set comment <name> <comment>\n"));
 318                 return -1;
 319         }
 320
 321         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 322                          &dom, &name, &sid, &type)) {
 323                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 324                 return -1;
 325         }
 326
 327         if (type == SID_NAME_USER) {
 328                 return net_sam_userset(c, argc, argv, "comment",
 329                                        pdb_set_acct_desc);
 330         }
 331
 332         if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
 333             (type != SID_NAME_WKN_GRP)) {
 334                 d_fprintf(stderr, _("%s is a %s, not a group\n"), argv[0],
 335                           sid_type_lookup(type));
 336                 return -1;
 337         }
 338
 339         map = talloc_zero(talloc_tos(), GROUP_MAP);
 340         if (!map) {
 341                 d_fprintf(stderr, _("Out of memory!\n"));
 342                 return -1;
 343         }
 344
 345         if (!pdb_getgrsid(map, sid)) {
 346                 d_fprintf(stderr, _("Could not load group %s\n"), argv[0]);
 347                 return -1;
 348         }
 349
 350         map->comment = talloc_strdup(map, argv[1]);
 351         if (!map->comment) {
 352                 d_fprintf(stderr, _("Out of memory!\n"));
 353                 return -1;
 354         }
 355
 356         status = pdb_update_group_mapping_entry(map);
 357
 358         if (!NT_STATUS_IS_OK(status)) {
 359                 d_fprintf(stderr, _("Updating group mapping entry failed with "
 360                           "%s\n"), nt_errstr(status));
 361                 return -1;
 362         }
 363
 364         d_printf("Updated comment of group %s\\%s to %s\n", dom, name,
 365                  argv[1]);
 366
 367         TALLOC_FREE(map);
 368         return 0;
 369 }
 370
 371 static int net_sam_set(struct net_context *c, int argc, const char **argv)
 372 {
 373         struct functable func[] = {
 374                 {
 375                         "homedir",
 376                         net_sam_set_homedir,
 377                         NET_TRANSPORT_LOCAL,
 378                         N_("Change a user's home directory"),
 379                         N_("net sam set homedir\n"
 380                            "    Change a user's home directory")
 381                 },
 382                 {
 383                         "profilepath",
 384                         net_sam_set_profilepath,
 385                         NET_TRANSPORT_LOCAL,
 386                         N_("Change a user's profile path"),
 387                         N_("net sam set profilepath\n"
 388                            "    Change a user's profile path")
 389                 },
 390                 {
 391                         "comment",
 392                         net_sam_set_comment,
 393                         NET_TRANSPORT_LOCAL,
 394                         N_("Change a users or groups description"),
 395                         N_("net sam set comment\n"
 396                            "    Change a users or groups description")
 397                 },
 398                 {
 399                         "fullname",
 400                         net_sam_set_fullname,
 401                         NET_TRANSPORT_LOCAL,
 402                         N_("Change a user's full name"),
 403                         N_("net sam set fullname\n"
 404                            "    Change a user's full name")
 405                 },
 406                 {
 407                         "logonscript",
 408                         net_sam_set_logonscript,
 409                         NET_TRANSPORT_LOCAL,
 410                         N_("Change a user's logon script"),
 411                         N_("net sam set logonscript\n"
 412                            "    Change a user's logon script")
 413                 },
 414                 {
 415                         "homedrive",
 416                         net_sam_set_homedrive,
 417                         NET_TRANSPORT_LOCAL,
 418                         N_("Change a user's home drive"),
 419                         N_("net sam set homedrive\n"
 420                            "    Change a user's home drive")
 421                 },
 422                 {
 423                         "workstations",
 424                         net_sam_set_workstations,
 425                         NET_TRANSPORT_LOCAL,
 426                         N_("Change a user's allowed workstations"),
 427                         N_("net sam set workstations\n"
 428                            "    Change a user's allowed workstations")
 429                 },
 430                 {
 431                         "disabled",
 432                         net_sam_set_disabled,
 433                         NET_TRANSPORT_LOCAL,
 434                         N_("Disable/Enable a user"),
 435                         N_("net sam set disable\n"
 436                            "    Disable/Enable a user")
 437                 },
 438                 {
 439                         "pwnotreq",
 440                         net_sam_set_pwnotreq,
 441                         NET_TRANSPORT_LOCAL,
 442                         N_("Disable/Enable the password not required flag"),
 443                         N_("net sam set pwnotreq\n"
 444                            "    Disable/Enable the password not required flag")
 445                 },
 446                 {
 447                         "autolock",
 448                         net_sam_set_autolock,
 449                         NET_TRANSPORT_LOCAL,
 450                         N_("Disable/Enable a user's lockout flag"),
 451                         N_("net sam set autolock\n"
 452                            "    Disable/Enable a user's lockout flag")
 453                 },
 454                 {
 455                         "pwnoexp",
 456                         net_sam_set_pwnoexp,
 457                         NET_TRANSPORT_LOCAL,
 458                         N_("Disable/Enable whether a user's pw does not "
 459                            "expire"),
 460                         N_("net sam set pwnoexp\n"
 461                            "    Disable/Enable whether a user's pw does not "
 462                            "expire")
 463                 },
 464                 {
 465                         "pwdmustchangenow",
 466                         net_sam_set_pwdmustchangenow,
 467                         NET_TRANSPORT_LOCAL,
 468                         N_("Force users password must change at next logon"),
 469                         N_("net sam set pwdmustchangenow\n"
 470                            "    Force users password must change at next logon")
 471                 },
 472                 {NULL, NULL, 0, NULL, NULL}
 473         };
 474
 475         return net_run_function(c, argc, argv, "net sam set", func);
 476 }
 477
 478 /*
 479  * Manage account policies
 480  */
 481
 482 static int net_sam_policy_set(struct net_context *c, int argc, const char **argv)
 483 {
 484         const char *account_policy = NULL;
 485         uint32_t value = 0;
 486         uint32_t old_value = 0;
 487         enum pdb_policy_type field;
 488         int err = 0;
 489
 490         if (argc != 2 || c->display_usage) {
 491                 d_fprintf(stderr, "%s\n%s",
 492                           _("Usage:"),
 493                           _("net sam policy set \"<account policy>\" <value>\n"));
 494                 return -1;
 495         }
 496
 497         account_policy = argv[0];
 498         field = account_policy_name_to_typenum(account_policy);
 499
 500         if (strequal(argv[1], "forever") || strequal(argv[1], "never")
 501             || strequal(argv[1], "off")) {
 502                 value = -1;
 503         }
 504         else {
 505                 value = smb_strtoul(argv[1],
 506                                     NULL,
 507                                     10,
 508                                     &err,
 509                                     SMB_STR_FULL_STR_CONV);
 510
 511                 if (err != 0) {
 512                         d_printf(_("Unable to set policy \"%s\"! Invalid value "
 513                                  "\"%s\".\n"),
 514                                  account_policy, argv[1]);
 515                         return -1;
 516                 }
 517         }
 518
 519         if (field == 0) {
 520                 const char **names;
 521                 int i, count;
 522
 523                 account_policy_names_list(talloc_tos(), &names, &count);
 524                 d_fprintf(stderr, _("No account policy \"%s\"!\n\n"), argv[0]);
 525                 d_fprintf(stderr, _("Valid account policies are:\n"));
 526
 527                 for (i=0; i<count; i++) {
 528                         d_fprintf(stderr, "%s\n", names[i]);
 529                 }
 530
 531                 TALLOC_FREE(names);
 532
 533                 return -1;
 534         }
 535
 536         if (!pdb_get_account_policy(field, &old_value)) {
 537                 d_fprintf(stderr, _("Valid account policy, but unable to fetch "
 538                           "value!\n"));
 539         } else {
 540                 d_printf(_("Account policy \"%s\" value was: %d\n"),
 541                         account_policy, old_value);
 542         }
 543
 544         if (!pdb_set_account_policy(field, value)) {
 545                 d_fprintf(stderr, _("Valid account policy, but unable to "
 546                           "set value!\n"));
 547                 return -1;
 548         } else {
 549                 d_printf(_("Account policy \"%s\" value is now: %d\n"),
 550                         account_policy, value);
 551         }
 552
 553         return 0;
 554 }
 555
 556 static int net_sam_policy_show(struct net_context *c, int argc, const char **argv)
 557 {
 558         const char *account_policy = NULL;
 559         uint32_t old_value;
 560         enum pdb_policy_type field;
 561
 562         if (argc != 1 || c->display_usage) {
 563                 d_fprintf(stderr, "%s\n%s",
 564                           _("Usage:"),
 565                           _("net sam policy show \"<account policy>\"\n"));
 566                 return -1;
 567         }
 568
 569         account_policy = argv[0];
 570         field = account_policy_name_to_typenum(account_policy);
 571
 572         if (field == 0) {
 573                 const char **names;
 574                 int count;
 575                 int i;
 576                 account_policy_names_list(talloc_tos(), &names, &count);
 577                 d_fprintf(stderr, _("No account policy by that name!\n"));
 578                 if (count != 0) {
 579                         d_fprintf(stderr, _("Valid account policies "
 580                                   "are:\n"));
 581                         for (i=0; i<count; i++) {
 582                                 d_fprintf(stderr, "%s\n", names[i]);
 583                         }
 584                 }
 585                 TALLOC_FREE(names);
 586                 return -1;
 587         }
 588
 589         if (!pdb_get_account_policy(field, &old_value)) {
 590                 fprintf(stderr, _("Valid account policy, but unable to "
 591                         "fetch value!\n"));
 592                 return -1;
 593         }
 594
 595         printf(_("Account policy \"%s\" description: %s\n"),
 596                account_policy, account_policy_get_desc(field));
 597         printf(_("Account policy \"%s\" value is: %d\n"), account_policy,
 598                old_value);
 599         return 0;
 600 }
 601
 602 static int net_sam_policy_list(struct net_context *c, int argc, const char **argv)
 603 {
 604         const char **names;
 605         int count;
 606         int i;
 607
 608         if (c->display_usage) {
 609                 d_printf(  "%s\n"
 610                            "net sam policy list\n"
 611                            "    %s\n",
 612                          _("Usage:"),
 613                          _("List account policies"));
 614                 return 0;
 615         }
 616
 617         account_policy_names_list(talloc_tos(), &names, &count);
 618         if (count != 0) {
 619                 d_fprintf(stderr, _("Valid account policies "
 620                           "are:\n"));
 621                 for (i = 0; i < count ; i++) {
 622                         d_fprintf(stderr, "%s\n", names[i]);
 623                 }
 624         }
 625         TALLOC_FREE(names);
 626         return -1;
 627 }
 628
 629 static int net_sam_policy(struct net_context *c, int argc, const char **argv)
 630 {
 631         struct functable func[] = {
 632                 {
 633                         "list",
 634                         net_sam_policy_list,
 635                         NET_TRANSPORT_LOCAL,
 636                         N_("List account policies"),
 637                         N_("net sam policy list\n"
 638                            "    List account policies")
 639                 },
 640                 {
 641                         "show",
 642                         net_sam_policy_show,
 643                         NET_TRANSPORT_LOCAL,
 644                         N_("Show account policies"),
 645                         N_("net sam policy show\n"
 646                            "    Show account policies")
 647                 },
 648                 {
 649                         "set",
 650                         net_sam_policy_set,
 651                         NET_TRANSPORT_LOCAL,
 652                         N_("Change account policies"),
 653                         N_("net sam policy set\n"
 654                            "    Change account policies")
 655                 },
 656                 {NULL, NULL, 0, NULL, NULL}
 657         };
 658
 659         return net_run_function(c, argc, argv, "net sam policy", func);
 660 }
 661
 662 static int net_sam_rights_list(struct net_context *c, int argc,
 663                                const char **argv)
 664 {
 665         enum sec_privilege privilege;
 666
 667         if (argc > 1 || c->display_usage) {
 668                 d_fprintf(stderr, "%s\n%s",
 669                           _("Usage:"),
 670                           _("net sam rights list [privilege name]\n"));
 671                 return -1;
 672         }
 673
 674         if (argc == 0) {
 675                 int i;
 676                 int num = num_privileges_in_short_list();
 677
 678                 for (i=0; i<num; i++) {
 679                         d_printf("%s\n", sec_privilege_name_from_index(i));
 680                 }
 681                 return 0;
 682         }
 683
 684         privilege = sec_privilege_id(argv[0]);
 685
 686         if (privilege != SEC_PRIV_INVALID) {
 687                 struct dom_sid *sids;
 688                 int i, num_sids;
 689                 NTSTATUS status;
 690
 691                 status = privilege_enum_sids(privilege, talloc_tos(),
 692                                              &sids, &num_sids);
 693                 if (!NT_STATUS_IS_OK(status)) {
 694                         d_fprintf(stderr, _("Could not list rights: %s\n"),
 695                                   nt_errstr(status));
 696                         return -1;
 697                 }
 698
 699                 for (i=0; i<num_sids; i++) {
 700                         const char *dom, *name;
 701                         enum lsa_SidType type;
 702                         struct dom_sid_buf buf;
 703
 704                         if (lookup_sid(talloc_tos(), &sids[i], &dom, &name,
 705                                        &type)) {
 706                                 d_printf("%s\\%s\n", dom, name);
 707                         }
 708                         else {
 709                                 d_printf("%s\n",
 710                                          dom_sid_str_buf(&sids[i], &buf));
 711                         }
 712                 }
 713                 return 0;
 714         }
 715
 716         return -1;
 717 }
 718
 719 static int net_sam_rights_grant(struct net_context *c, int argc,
 720                                 const char **argv)
 721 {
 722         struct dom_sid sid;
 723         enum lsa_SidType type;
 724         const char *dom, *name;
 725         int i;
 726
 727         if (argc < 2 || c->display_usage) {
 728                 d_fprintf(stderr, "%s\n%s",
 729                           _("Usage:"),
 730                           _("net sam rights grant <name> <rights> ...\n"));
 731                 return -1;
 732         }
 733
 734         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 735                         &dom, &name, &sid, &type)) {
 736                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 737                 return -1;
 738         }
 739
 740         for (i=1; i < argc; i++) {
 741                 enum sec_privilege privilege = sec_privilege_id(argv[i]);
 742                 if (privilege == SEC_PRIV_INVALID) {
 743                         d_fprintf(stderr, _("%s unknown\n"), argv[i]);
 744                         return -1;
 745                 }
 746
 747                 if (!grant_privilege_by_name(&sid, argv[i])) {
 748                         d_fprintf(stderr, _("Could not grant privilege\n"));
 749                         return -1;
 750                 }
 751
 752                 d_printf(_("Granted %s to %s\\%s\n"), argv[i], dom, name);
 753         }
 754
 755         return 0;
 756 }
 757
 758 static int net_sam_rights_revoke(struct net_context *c, int argc,
 759                                 const char **argv)
 760 {
 761         struct dom_sid sid;
 762         enum lsa_SidType type;
 763         const char *dom, *name;
 764         int i;
 765
 766         if (argc < 2 || c->display_usage) {
 767                 d_fprintf(stderr, "%s\n%s",
 768                           _("Usage:"),
 769                           _("net sam rights revoke <name> <rights>\n"));
 770                 return -1;
 771         }
 772
 773         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 774                         &dom, &name, &sid, &type)) {
 775                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 776                 return -1;
 777         }
 778
 779         for (i=1; i < argc; i++) {
 780                 enum sec_privilege privilege = sec_privilege_id(argv[i]);
 781                 if (privilege == SEC_PRIV_INVALID) {
 782                         d_fprintf(stderr, _("%s unknown\n"), argv[i]);
 783                         return -1;
 784                 }
 785
 786                 if (!revoke_privilege_by_name(&sid, argv[i])) {
 787                         d_fprintf(stderr, _("Could not revoke privilege\n"));
 788                         return -1;
 789                 }
 790
 791                 d_printf(_("Revoked %s from %s\\%s\n"), argv[i], dom, name);
 792         }
 793
 794         return 0;
 795 }
 796
 797 static int net_sam_rights(struct net_context *c, int argc, const char **argv)
 798 {
 799         struct functable func[] = {
 800                 {
 801                         "list",
 802                         net_sam_rights_list,
 803                         NET_TRANSPORT_LOCAL,
 804                         N_("List possible user rights"),
 805                         N_("net sam rights list\n"
 806                            "    List possible user rights")
 807                 },
 808                 {
 809                         "grant",
 810                         net_sam_rights_grant,
 811                         NET_TRANSPORT_LOCAL,
 812                         N_("Grant right(s)"),
 813                         N_("net sam rights grant\n"
 814                            "    Grant right(s)")
 815                 },
 816                 {
 817                         "revoke",
 818                         net_sam_rights_revoke,
 819                         NET_TRANSPORT_LOCAL,
 820                         N_("Revoke right(s)"),
 821                         N_("net sam rights revoke\n"
 822                            "    Revoke right(s)")
 823                 },
 824                 {NULL, NULL, 0, NULL, NULL}
 825         };
 826         return net_run_function(c, argc, argv, "net sam rights", func);
 827 }
 828
 829 /*
 830  * Map a unix group to a domain group
 831  */
 832
 833 static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *map)
 834 {
 835         const char *dom, *name;
 836         uint32_t rid;
 837
 838         if (pdb_getgrgid(map, grp->gr_gid)) {
 839                 return NT_STATUS_GROUP_EXISTS;
 840         }
 841
 842         map->gid = grp->gr_gid;
 843
 844         if (lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 845                         &dom, &name, NULL, NULL)) {
 846
 847                 map->nt_name = talloc_asprintf(map, "Unix Group %s",
 848                                                         grp->gr_name);
 849
 850                 DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
 851                           grp->gr_name, dom, name, map->nt_name));
 852         }
 853
 854         if (lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 855                         NULL, NULL, NULL, NULL)) {
 856                 DEBUG(3, ("\"%s\" exists, can't map it\n", grp->gr_name));
 857                 return NT_STATUS_GROUP_EXISTS;
 858         }
 859
 860         if (pdb_capabilities() & PDB_CAP_STORE_RIDS) {
 861                 if (!pdb_new_rid(&rid)) {
 862                         DEBUG(3, ("Could not get a new RID for %s\n",
 863                                   grp->gr_name));
 864                         return NT_STATUS_ACCESS_DENIED;
 865                 }
 866         } else {
 867                 rid = algorithmic_pdb_gid_to_group_rid( grp->gr_gid );
 868         }
 869
 870         sid_compose(&map->sid, get_global_sam_sid(), rid);
 871         map->sid_name_use = SID_NAME_DOM_GRP;
 872         map->comment = talloc_asprintf(map, "Unix Group %s", grp->gr_name);
 873
 874         return pdb_add_group_mapping_entry(map);
 875 }
 876
 877 static int net_sam_mapunixgroup(struct net_context *c, int argc, const char **argv)
 878 {
 879         NTSTATUS status;
 880         GROUP_MAP *map;
 881         struct group *grp;
 882         struct dom_sid_buf buf;
 883
 884         if (argc != 1 || c->display_usage) {
 885                 d_fprintf(stderr, "%s\n%s",
 886                           _("Usage:"),
 887                           _("net sam mapunixgroup <name>\n"));
 888                 return -1;
 889         }
 890
 891         grp = getgrnam(argv[0]);
 892         if (grp == NULL) {
 893                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
 894                 return -1;
 895         }
 896
 897         map = talloc_zero(talloc_tos(), GROUP_MAP);
 898         if (!map) {
 899                 d_fprintf(stderr, _("Out of memory!\n"));
 900                 return -1;
 901         }
 902
 903         status = map_unix_group(grp, map);
 904
 905         if (!NT_STATUS_IS_OK(status)) {
 906                 d_fprintf(stderr, _("Mapping group %s failed with %s\n"),
 907                           argv[0], nt_errstr(status));
 908                 return -1;
 909         }
 910
 911         d_printf(_("Mapped unix group %s to SID %s\n"), argv[0],
 912                  dom_sid_str_buf(&map->sid, &buf));
 913
 914         TALLOC_FREE(map);
 915         return 0;
 916 }
 917
 918 /*
 919  * Remove a group mapping
 920  */
 921
 922 static NTSTATUS unmap_unix_group(const struct group *grp)
 923 {
 924         struct dom_sid dom_sid;
 925         struct unixid id;
 926
 927         if (!lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 928                         NULL, NULL, NULL, NULL)) {
 929                 DEBUG(3, ("\"%s\" does not exist, can't unmap it\n", grp->gr_name));
 930                 return NT_STATUS_NO_SUCH_GROUP;
 931         }
 932
 933         id.id = grp->gr_gid;
 934         id.type = ID_TYPE_GID;
 935         if (!pdb_id_to_sid(&id, &dom_sid)) {
 936                 return NT_STATUS_UNSUCCESSFUL;
 937         }
 938
 939         return pdb_delete_group_mapping_entry(dom_sid);
 940 }
 941
 942 static int net_sam_unmapunixgroup(struct net_context *c, int argc, const char **argv)
 943 {
 944         NTSTATUS status;
 945         struct group *grp;
 946
 947         if (argc != 1 || c->display_usage) {
 948                 d_fprintf(stderr, "%s\n%s",
 949                           _("Usage:"),
 950                           _("net sam unmapunixgroup <name>\n"));
 951                 return -1;
 952         }
 953
 954         grp = getgrnam(argv[0]);
 955         if (grp == NULL) {
 956                 d_fprintf(stderr, _("Could not find mapping for group %s.\n"),
 957                           argv[0]);
 958                 return -1;
 959         }
 960
 961         status = unmap_unix_group(grp);
 962
 963         if (!NT_STATUS_IS_OK(status)) {
 964                 d_fprintf(stderr, _("Unmapping group %s failed with %s.\n"),
 965                           argv[0], nt_errstr(status));
 966                 return -1;
 967         }
 968
 969         d_printf(_("Unmapped unix group %s.\n"), argv[0]);
 970
 971         return 0;
 972 }
 973
 974 /*
 975  * Create a domain group
 976  */
 977
 978 static int net_sam_createdomaingroup(struct net_context *c, int argc,
 979                                      const char **argv)
 980 {
 981         NTSTATUS status;
 982         uint32_t rid;
 983
 984         if (argc != 1 || c->display_usage) {
 985                 d_fprintf(stderr, "%s\n%s",
 986                           _("Usage:"),
 987                           _("net sam createdomaingroup <name>\n"));
 988                 return -1;
 989         }
 990
 991         status = pdb_create_dom_group(talloc_tos(), argv[0], &rid);
 992
 993         if (!NT_STATUS_IS_OK(status)) {
 994                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
 995                           argv[0], nt_errstr(status));
 996                 return -1;
 997         }
 998
 999         d_printf(_("Created domain group %s with RID %d\n"), argv[0], rid);
1000
1001         return 0;
1002 }
1003
1004 /*
1005  * Delete a domain group
1006  */
1007
1008 static int net_sam_deletedomaingroup(struct net_context *c, int argc,
1009                                      const char **argv)
1010 {
1011         struct dom_sid sid;
1012         uint32_t rid;
1013         enum lsa_SidType type;
1014         const char *dom, *name;
1015         NTSTATUS status;
1016
1017         if (argc != 1 || c->display_usage) {
1018                 d_fprintf(stderr, "%s\n%s",
1019                           _("Usage:"),
1020                           _("net sam deletelocalgroup <name>\n"));
1021                 return -1;
1022         }
1023
1024         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1025                          &dom, &name, &sid, &type)) {
1026                 d_fprintf(stderr, _("Could not find %s.\n"), argv[0]);
1027                 return -1;
1028         }
1029
1030         if (type != SID_NAME_DOM_GRP) {
1031                 d_fprintf(stderr, _("%s is a %s, not a domain group.\n"),
1032                           argv[0], sid_type_lookup(type));
1033                 return -1;
1034         }
1035
1036         sid_peek_rid(&sid, &rid);
1037
1038         status = pdb_delete_dom_group(talloc_tos(), rid);
1039
1040         if (!NT_STATUS_IS_OK(status)) {
1041                 d_fprintf(stderr,_("Deleting domain group %s failed with %s\n"),
1042                           argv[0], nt_errstr(status));
1043                 return -1;
1044         }
1045
1046         d_printf(_("Deleted domain group %s.\n"), argv[0]);
1047
1048         return 0;
1049 }
1050
1051 /*
1052  * Create a local group
1053  */
1054
1055 static int net_sam_createlocalgroup(struct net_context *c, int argc, const char **argv)
1056 {
1057         NTSTATUS status;
1058         uint32_t rid;
1059
1060         if (argc != 1 || c->display_usage) {
1061                 d_fprintf(stderr, "%s\n%s",
1062                           _("Usage:"),
1063                           _("net sam createlocalgroup <name>\n"));
1064                 return -1;
1065         }
1066
1067         if (!winbind_ping()) {
1068                 d_fprintf(stderr, _("winbind seems not to run. "
1069                           "createlocalgroup only works when winbind runs.\n"));
1070                 return -1;
1071         }
1072
1073         status = pdb_create_alias(argv[0], &rid);
1074
1075         if (!NT_STATUS_IS_OK(status)) {
1076                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
1077                           argv[0], nt_errstr(status));
1078                 return -1;
1079         }
1080
1081         d_printf(_("Created local group %s with RID %d\n"), argv[0], rid);
1082
1083         return 0;
1084 }
1085
1086 /*
1087  * Delete a local group
1088  */
1089
1090 static int net_sam_deletelocalgroup(struct net_context *c, int argc, const char **argv)
1091 {
1092         struct dom_sid sid;
1093         enum lsa_SidType type;
1094         const char *dom, *name;
1095         NTSTATUS status;
1096
1097         if (argc != 1 || c->display_usage) {
1098                 d_fprintf(stderr, "%s\n%s",
1099                           _("Usage:"),
1100                           _("net sam deletelocalgroup <name>\n"));
1101                 return -1;
1102         }
1103
1104         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1105                          &dom, &name, &sid, &type)) {
1106                 d_fprintf(stderr,_("Could not find %s.\n"), argv[0]);
1107                 return -1;
1108         }
1109
1110         if (type != SID_NAME_ALIAS) {
1111                 d_fprintf(stderr, _("%s is a %s, not a local group.\n"),argv[0],
1112                           sid_type_lookup(type));
1113                 return -1;
1114         }
1115
1116         status = pdb_delete_alias(&sid);
1117
1118         if (!NT_STATUS_IS_OK(status)) {
1119                 d_fprintf(stderr, _("Deleting local group %s failed with %s\n"),
1120                           argv[0], nt_errstr(status));
1121                 return -1;
1122         }
1123
1124         d_printf(_("Deleted local group %s.\n"), argv[0]);
1125
1126         return 0;
1127 }
1128
1129 /*
1130  * Create a builtin group
1131  */
1132
1133 static int net_sam_createbuiltingroup(struct net_context *c, int argc, const char **argv)
1134 {
1135         NTSTATUS status;
1136         uint32_t rid;
1137         enum lsa_SidType type;
1138         fstring groupname;
1139         struct dom_sid sid;
1140
1141         if (argc != 1 || c->display_usage) {
1142                 d_fprintf(stderr, "%s\n%s",
1143                           _("Usage:"),
1144                           _("net sam createbuiltingroup <name>\n"));
1145                 return -1;
1146         }
1147
1148         if (!winbind_ping()) {
1149                 d_fprintf(stderr, _("winbind seems not to run. "
1150                           "createbuiltingroup only works when winbind "
1151                           "runs.\n"));
1152                 return -1;
1153         }
1154
1155         /* validate the name and get the group */
1156
1157         fstrcpy( groupname, "BUILTIN\\" );
1158         fstrcat( groupname, argv[0] );
1159
1160         if ( !lookup_name(talloc_tos(), groupname, LOOKUP_NAME_ALL, NULL,
1161                           NULL, &sid, &type)) {
1162                 d_fprintf(stderr, _("%s is not a BUILTIN group\n"), argv[0]);
1163                 return -1;
1164         }
1165
1166         if ( !sid_peek_rid( &sid, &rid ) ) {
1167                 d_fprintf(stderr, _("Failed to get RID for %s\n"), argv[0]);
1168                 return -1;
1169         }
1170
1171         status = pdb_create_builtin(rid);
1172
1173         if (!NT_STATUS_IS_OK(status)) {
1174                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
1175                           argv[0], nt_errstr(status));
1176                 return -1;
1177         }
1178
1179         d_printf(_("Created BUILTIN group %s with RID %d\n"), argv[0], rid);
1180
1181         return 0;
1182 }
1183
1184 /*
1185  * Add a group member
1186  */
1187
1188 static int net_sam_addmem(struct net_context *c, int argc, const char **argv)
1189 {
1190         const char *groupdomain, *groupname, *memberdomain, *membername;
1191         struct dom_sid group, member;
1192         enum lsa_SidType grouptype, membertype;
1193         NTSTATUS status;
1194
1195         if (argc != 2 || c->display_usage) {
1196                 d_fprintf(stderr, "%s\n%s",
1197                           _("Usage:"),
1198                           _("net sam addmem <group> <member>\n"));
1199                 return -1;
1200         }
1201
1202         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1203                          &groupdomain, &groupname, &group, &grouptype)) {
1204                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1205                 return -1;
1206         }
1207
1208         /* check to see if the member to be added is a name or a SID */
1209
1210         if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
1211                          &memberdomain, &membername, &member, &membertype))
1212         {
1213                 /* try it as a SID */
1214
1215                 if ( !string_to_sid( &member, argv[1] ) ) {
1216                         d_fprintf(stderr, _("Could not find member %s\n"),
1217                                   argv[1]);
1218                         return -1;
1219                 }
1220
1221                 if ( !lookup_sid(talloc_tos(), &member, &memberdomain,
1222                         &membername, &membertype) )
1223                 {
1224                         d_fprintf(stderr, _("Could not resolve SID %s\n"),
1225                                   argv[1]);
1226                         return -1;
1227                 }
1228         }
1229
1230         if ((grouptype == SID_NAME_ALIAS) || (grouptype == SID_NAME_WKN_GRP)) {
1231                 if ((membertype != SID_NAME_USER) &&
1232                     (membertype != SID_NAME_ALIAS) &&
1233                     (membertype != SID_NAME_DOM_GRP)) {
1234                         d_fprintf(stderr, _("Can't add %s: only users, domain "
1235                                             "groups and domain local groups "
1236                                             "can be added. %s is a %s\n"),
1237                                   argv[0], argv[1],
1238                                   sid_type_lookup(membertype));
1239                         return -1;
1240                 }
1241                 status = pdb_add_aliasmem(&group, &member);
1242
1243                 if (!NT_STATUS_IS_OK(status)) {
1244                         d_fprintf(stderr, _("Adding local group member failed "
1245                                   "with %s\n"), nt_errstr(status));
1246                         return -1;
1247                 }
1248         } else if (grouptype == SID_NAME_DOM_GRP) {
1249                 uint32_t grouprid, memberrid;
1250
1251                 sid_peek_rid(&group, &grouprid);
1252                 sid_peek_rid(&member, &memberrid);
1253
1254                 status = pdb_add_groupmem(talloc_tos(), grouprid, memberrid);
1255                 if (!NT_STATUS_IS_OK(status)) {
1256                         d_fprintf(stderr, _("Adding domain group member failed "
1257                                   "with %s\n"), nt_errstr(status));
1258                         return -1;
1259                 }
1260         } else {
1261                 d_fprintf(stderr, _("Can only add members to local groups so "
1262                           "far, %s is a %s\n"), argv[0],
1263                           sid_type_lookup(grouptype));
1264                 return -1;
1265         }
1266
1267         d_printf(_("Added %s\\%s to %s\\%s\n"), memberdomain, membername,
1268                 groupdomain, groupname);
1269
1270         return 0;
1271 }
1272
1273 /*
1274  * Delete a group member
1275  */
1276
1277 static int net_sam_delmem(struct net_context *c, int argc, const char **argv)
1278 {
1279         const char *groupdomain, *groupname;
1280         const char *memberdomain = NULL;
1281         const char *membername = NULL;
1282         struct dom_sid group, member;
1283         enum lsa_SidType grouptype;
1284         NTSTATUS status;
1285
1286         if (argc != 2 || c->display_usage) {
1287                 d_fprintf(stderr,"%s\n%s",
1288                           _("Usage:"),
1289                           _("net sam delmem <group> <member>\n"));
1290                 return -1;
1291         }
1292
1293         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1294                          &groupdomain, &groupname, &group, &grouptype)) {
1295                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1296                 return -1;
1297         }
1298
1299         if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
1300                          &memberdomain, &membername, &member, NULL)) {
1301                 if (!string_to_sid(&member, argv[1])) {
1302                         d_fprintf(stderr, _("Could not find member %s\n"),
1303                                   argv[1]);
1304                         return -1;
1305                 }
1306         }
1307
1308         if ((grouptype == SID_NAME_ALIAS) ||
1309             (grouptype == SID_NAME_WKN_GRP)) {
1310                 status = pdb_del_aliasmem(&group, &member);
1311
1312                 if (!NT_STATUS_IS_OK(status)) {
1313                         d_fprintf(stderr,_("Deleting local group member failed "
1314                                   "with %s\n"), nt_errstr(status));
1315                         return -1;
1316                 }
1317         } else if (grouptype == SID_NAME_DOM_GRP) {
1318                 uint32_t grouprid, memberrid;
1319
1320                 sid_peek_rid(&group, &grouprid);
1321                 sid_peek_rid(&member, &memberrid);
1322
1323                 status = pdb_del_groupmem(talloc_tos(), grouprid, memberrid);
1324                 if (!NT_STATUS_IS_OK(status)) {
1325                         d_fprintf(stderr, _("Deleting domain group member "
1326                                   "failed with %s\n"), nt_errstr(status));
1327                         return -1;
1328                 }
1329         } else {
1330                 d_fprintf(stderr, _("Can only delete members from local groups "
1331                           "so far, %s is a %s\n"), argv[0],
1332                           sid_type_lookup(grouptype));
1333                 return -1;
1334         }
1335
1336         if (membername != NULL) {
1337                 d_printf(_("Deleted %s\\%s from %s\\%s\n"),
1338                          memberdomain, membername, groupdomain, groupname);
1339         } else {
1340                 struct dom_sid_buf buf;
1341                 d_printf(_("Deleted %s from %s\\%s\n"),
1342                          dom_sid_str_buf(&member, &buf),
1343                          groupdomain,
1344                          groupname);
1345         }
1346
1347         return 0;
1348 }
1349
1350 /*
1351  * List group members
1352  */
1353
1354 static int net_sam_listmem(struct net_context *c, int argc, const char **argv)
1355 {
1356         const char *groupdomain, *groupname;
1357         struct dom_sid group;
1358         struct dom_sid *members = NULL;
1359         size_t i, num_members = 0;
1360         enum lsa_SidType grouptype;
1361         NTSTATUS status;
1362
1363         if (argc != 1 || c->display_usage) {
1364                 d_fprintf(stderr, "%s\n%s",
1365                           _("Usage:"),
1366                           _("net sam listmem <group>\n"));
1367                 return -1;
1368         }
1369
1370         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1371                          &groupdomain, &groupname, &group, &grouptype)) {
1372                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1373                 return -1;
1374         }
1375
1376         if ((grouptype == SID_NAME_ALIAS) ||
1377             (grouptype == SID_NAME_WKN_GRP)) {
1378                 status = pdb_enum_aliasmem(&group, talloc_tos(), &members,
1379                                            &num_members);
1380                 if (!NT_STATUS_IS_OK(status)) {
1381                         d_fprintf(stderr, _("Listing group members failed with "
1382                                   "%s\n"), nt_errstr(status));
1383                         return -1;
1384                 }
1385         } else if (grouptype == SID_NAME_DOM_GRP) {
1386                 uint32_t *rids;
1387
1388                 status = pdb_enum_group_members(talloc_tos(), &group,
1389                                                 &rids, &num_members);
1390                 if (!NT_STATUS_IS_OK(status)) {
1391                         d_fprintf(stderr, _("Listing group members failed with "
1392                                   "%s\n"), nt_errstr(status));
1393                         return -1;
1394                 }
1395
1396                 members = talloc_array(talloc_tos(), struct dom_sid,
1397                                        num_members);
1398                 if (members == NULL) {
1399                         TALLOC_FREE(rids);
1400                         return -1;
1401                 }
1402
1403                 for (i=0; i<num_members; i++) {
1404                         sid_compose(&members[i], get_global_sam_sid(),
1405                                     rids[i]);
1406                 }
1407                 TALLOC_FREE(rids);
1408         } else {
1409                 d_fprintf(stderr,_("Can only list local group members so far.\n"
1410                           "%s is a %s\n"), argv[0], sid_type_lookup(grouptype));
1411                 return -1;
1412         }
1413
1414         d_printf(_("%s\\%s has %u members\n"), groupdomain, groupname,
1415                  (unsigned int)num_members);
1416         for (i=0; i<num_members; i++) {
1417                 const char *dom, *name;
1418                 if (lookup_sid(talloc_tos(), &members[i], &dom, &name, NULL)) {
1419                         d_printf(" %s\\%s\n", dom, name);
1420                 } else {
1421                         struct dom_sid_buf buf;
1422                         d_printf(" %s\n",
1423                                  dom_sid_str_buf(&members[i], &buf));
1424                 }
1425         }
1426
1427                 TALLOC_FREE(members);
1428
1429         return 0;
1430 }
1431
1432 /*
1433  * Do the listing
1434  */
1435 static int net_sam_do_list(struct net_context *c, int argc, const char **argv,
1436                            struct pdb_search *search, const char *what)
1437 {
1438         bool verbose = (argc == 1);
1439
1440         if ((argc > 1) || c->display_usage ||
1441             ((argc == 1) && !strequal(argv[0], "verbose"))) {
1442                 d_fprintf(stderr, "%s\n", _("Usage:"));
1443                 d_fprintf(stderr, _("net sam list %s [verbose]\n"), what);
1444                 return -1;
1445         }
1446
1447         if (search == NULL) {
1448                 d_fprintf(stderr, _("Could not start search\n"));
1449                 return -1;
1450         }
1451
1452         while (true) {
1453                 struct samr_displayentry entry;
1454                 if (!search->next_entry(search, &entry)) {
1455                         break;
1456                 }
1457                 if (verbose) {
1458                         d_printf("%s:%d:%s\n",
1459                                  entry.account_name,
1460                                  entry.rid,
1461                                  entry.description);
1462                 } else {
1463                         d_printf("%s\n", entry.account_name);
1464                 }
1465         }
1466
1467         TALLOC_FREE(search);
1468         return 0;
1469 }
1470
1471 static int net_sam_list_users(struct net_context *c, int argc,
1472                               const char **argv)
1473 {
1474         return net_sam_do_list(c, argc, argv,
1475                                pdb_search_users(talloc_tos(), ACB_NORMAL),
1476                                "users");
1477 }
1478
1479 static int net_sam_list_groups(struct net_context *c, int argc,
1480                                const char **argv)
1481 {
1482         return net_sam_do_list(c, argc, argv, pdb_search_groups(talloc_tos()),
1483                                "groups");
1484 }
1485
1486 static int net_sam_list_localgroups(struct net_context *c, int argc,
1487                                     const char **argv)
1488 {
1489         return net_sam_do_list(c, argc, argv,
1490                                pdb_search_aliases(talloc_tos(),
1491                                                   get_global_sam_sid()),
1492                                "localgroups");
1493 }
1494
1495 static int net_sam_list_builtin(struct net_context *c, int argc,
1496                                 const char **argv)
1497 {
1498         return net_sam_do_list(c, argc, argv,
1499                                pdb_search_aliases(talloc_tos(),
1500                                                   &global_sid_Builtin),
1501                                "builtin");
1502 }
1503
1504 static int net_sam_list_workstations(struct net_context *c, int argc,
1505                                      const char **argv)
1506 {
1507         return net_sam_do_list(c, argc, argv,
1508                                pdb_search_users(talloc_tos(), ACB_WSTRUST),
1509                                "workstations");
1510 }
1511
1512 /*
1513  * List stuff
1514  */
1515
1516 static int net_sam_list(struct net_context *c, int argc, const char **argv)
1517 {
1518         struct functable func[] = {
1519                 {
1520                         "users",
1521                         net_sam_list_users,
1522                         NET_TRANSPORT_LOCAL,
1523                         N_("List SAM users"),
1524                         N_("net sam list users\n"
1525                            "    List SAM users")
1526                 },
1527                 {
1528                         "groups",
1529                         net_sam_list_groups,
1530                         NET_TRANSPORT_LOCAL,
1531                         N_("List SAM groups"),
1532                         N_("net sam list groups\n"
1533                            "    List SAM groups")
1534                 },
1535                 {
1536                         "localgroups",
1537                         net_sam_list_localgroups,
1538                         NET_TRANSPORT_LOCAL,
1539                         N_("List SAM local groups"),
1540                         N_("net sam list localgroups\n"
1541                            "    List SAM local groups")
1542                 },
1543                 {
1544                         "builtin",
1545                         net_sam_list_builtin,
1546                         NET_TRANSPORT_LOCAL,
1547                         N_("List builtin groups"),
1548                         N_("net sam list builtin\n"
1549                            "    List builtin groups")
1550                 },
1551                 {
1552                         "workstations",
1553                         net_sam_list_workstations,
1554                         NET_TRANSPORT_LOCAL,
1555                         N_("List domain member workstations"),
1556                         N_("net sam list workstations\n"
1557                            "    List domain member workstations")
1558                 },
1559                 {NULL, NULL, 0, NULL, NULL}
1560         };
1561
1562         return net_run_function(c, argc, argv, "net sam list", func);
1563 }
1564
1565 /*
1566  * Show details of SAM entries
1567  */
1568
1569 static int net_sam_show(struct net_context *c, int argc, const char **argv)
1570 {
1571         struct dom_sid sid;
1572         struct dom_sid_buf buf;
1573         enum lsa_SidType type;
1574         const char *dom, *name;
1575
1576         if (argc != 1 || c->display_usage) {
1577                 d_fprintf(stderr, "%s\n%s",
1578                           _("Usage:"),
1579                           _("net sam show <name>\n"));
1580                 return -1;
1581         }
1582
1583         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1584                          &dom, &name, &sid, &type)) {
1585                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
1586                 return -1;
1587         }
1588
1589         d_printf(_("%s\\%s is a %s with SID %s\n"), dom, name,
1590                  sid_type_lookup(type), dom_sid_str_buf(&sid, &buf));
1591
1592         return 0;
1593 }
1594
1595 #ifdef HAVE_LDAP
1596
1597 /*
1598  * Init an LDAP tree with default users and Groups
1599  * if ldapsam:editposix is enabled
1600  */
1601
1602 static int net_sam_provision(struct net_context *c, int argc, const char **argv)
1603 {
1604         TALLOC_CTX *tc;
1605         char *ldap_bk;
1606         char *ldap_uri = NULL;
1607         char *p;
1608         struct smbldap_state *state = NULL;
1609         GROUP_MAP *gmap = NULL;
1610         struct dom_sid gsid;
1611         gid_t domusers_gid = -1;
1612         gid_t domadmins_gid = -1;
1613         struct samu *samuser;
1614         struct passwd *pwd;
1615         bool is_ipa = false;
1616         char *bind_dn = NULL;
1617         char *bind_secret = NULL;
1618         NTSTATUS status;
1619
1620         if (c->display_usage) {
1621                 d_printf(  "%s\n"
1622                            "net sam provision\n"
1623                             "    %s\n",
1624                           _("Usage:"),
1625                           _("Init an LDAP tree with default users/groups"));
1626                 return 0;
1627         }
1628
1629         tc = talloc_new(NULL);
1630         if (!tc) {
1631                 d_fprintf(stderr, _("Out of Memory!\n"));
1632                 return -1;
1633         }
1634
1635         if ((ldap_bk = talloc_strdup(tc, lp_passdb_backend())) == NULL) {
1636                 d_fprintf(stderr, _("talloc failed\n"));
1637                 talloc_free(tc);
1638                 return -1;
1639         }
1640         p = strchr(ldap_bk, ':');
1641         if (p) {
1642                 *p = 0;
1643                 ldap_uri = talloc_strdup(tc, p+1);
1644                 trim_char(ldap_uri, ' ', ' ');
1645         }
1646
1647         trim_char(ldap_bk, ' ', ' ');
1648
1649         if (strcmp(ldap_bk, "IPA_ldapsam") == 0 ) {
1650                 is_ipa = true;
1651         }
1652
1653         if (strcmp(ldap_bk, "ldapsam") != 0 && !is_ipa ) {
1654                 d_fprintf(stderr,
1655                           _("Provisioning works only with ldapsam backend\n"));
1656                 goto failed;
1657         }
1658
1659         if (!lp_parm_bool(-1, "ldapsam", "trusted", false) ||
1660             !lp_parm_bool(-1, "ldapsam", "editposix", false)) {
1661
1662                 d_fprintf(stderr, _("Provisioning works only if ldapsam:trusted"
1663                                     " and ldapsam:editposix are enabled.\n"));
1664                 goto failed;
1665         }
1666
1667         if (!is_ipa && !winbind_ping()) {
1668                 d_fprintf(stderr, _("winbind seems not to run. Provisioning "
1669                             "LDAP only works when winbind runs.\n"));
1670                 goto failed;
1671         }
1672
1673         if (!fetch_ldap_pw(&bind_dn, &bind_secret)) {
1674                 d_fprintf(stderr, _("Failed to retrieve LDAP password from secrets.tdb\n"));
1675                 goto failed;
1676         }
1677
1678         status = smbldap_init(tc, NULL, ldap_uri, false, bind_dn, bind_secret, &state);
1679
1680         memset(bind_secret, '\0', strlen(bind_secret));
1681         SAFE_FREE(bind_secret);
1682         SAFE_FREE(bind_dn);
1683
1684         if (!NT_STATUS_IS_OK(status)) {
1685                 d_fprintf(stderr, _("Unable to connect to the LDAP server.\n"));
1686                 goto failed;
1687         }
1688
1689         d_printf(_("Checking for Domain Users group.\n"));
1690
1691         sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_USERS);
1692
1693         gmap = talloc_zero(tc, GROUP_MAP);
1694         if (!gmap) {
1695                 d_printf(_("Out of memory!\n"));
1696                 goto failed;
1697         }
1698
1699         if (!pdb_getgrsid(gmap, gsid)) {
1700                 struct dom_sid_buf gsid_str;
1701                 LDAPMod **mods = NULL;
1702                 char *dn;
1703                 char *uname;
1704                 char *wname;
1705                 char *gidstr;
1706                 char *gtype;
1707                 int rc;
1708
1709                 d_printf(_("Adding the Domain Users group.\n"));
1710
1711                 /* lets allocate a new groupid for this group */
1712                 if (is_ipa) {
1713                         domusers_gid = 999;
1714                 } else {
1715                         if (!winbind_allocate_gid(&domusers_gid)) {
1716                                 d_fprintf(stderr, _("Unable to allocate a new gid to "
1717                                                     "create Domain Users group!\n"));
1718                                 goto domu_done;
1719                         }
1720                 }
1721
1722                 uname = talloc_strdup(tc, "domusers");
1723                 wname = talloc_strdup(tc, "Domain Users");
1724                 dn = talloc_asprintf(tc, "cn=%s,%s", "domusers",
1725                                      lp_ldap_group_suffix(talloc_tos()));
1726                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domusers_gid);
1727                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1728
1729                 if (!uname || !wname || !dn || !gidstr || !gtype) {
1730                         d_fprintf(stderr, "Out of Memory!\n");
1731                         goto failed;
1732                 }
1733
1734                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1735                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1736                 if (is_ipa) {
1737                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
1738                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
1739                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
1740                 }
1741                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1742                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1743                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1744                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1745                                 dom_sid_str_buf(&gsid, &gsid_str));
1746                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1747
1748                 smbldap_talloc_autofree_ldapmod(tc, mods);
1749
1750                 rc = smbldap_add(state, dn, mods);
1751
1752                 if (rc != LDAP_SUCCESS) {
1753                         d_fprintf(stderr, _("Failed to add Domain Users group "
1754                                             "to ldap directory\n"));
1755                 }
1756
1757                 if (is_ipa) {
1758                         if (!pdb_getgrsid(gmap, gsid)) {
1759                                 d_fprintf(stderr, _("Failed to read just "
1760                                                     "created domain group.\n"));
1761                                 goto failed;
1762                         } else {
1763                                 domusers_gid = gmap->gid;
1764                         }
1765                 }
1766         } else {
1767                 domusers_gid = gmap->gid;
1768                 d_printf(_("found!\n"));
1769         }
1770
1771 domu_done:
1772
1773         d_printf(_("Checking for Domain Admins group.\n"));
1774
1775         sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_ADMINS);
1776
1777         if (!pdb_getgrsid(gmap, gsid)) {
1778                 struct dom_sid_buf gsid_str;
1779                 LDAPMod **mods = NULL;
1780                 char *dn;
1781                 char *uname;
1782                 char *wname;
1783                 char *gidstr;
1784                 char *gtype;
1785                 int rc;
1786
1787                 d_printf(_("Adding the Domain Admins group.\n"));
1788
1789                 /* lets allocate a new groupid for this group */
1790                 if (is_ipa) {
1791                         domadmins_gid = 999;
1792                 } else {
1793                         if (!winbind_allocate_gid(&domadmins_gid)) {
1794                                 d_fprintf(stderr, _("Unable to allocate a new gid to "
1795                                                     "create Domain Admins group!\n"));
1796                                 goto doma_done;
1797                         }
1798                 }
1799
1800                 uname = talloc_strdup(tc, "domadmins");
1801                 wname = talloc_strdup(tc, "Domain Admins");
1802                 dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins",
1803                                      lp_ldap_group_suffix(talloc_tos()));
1804                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
1805                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1806
1807                 if (!uname || !wname || !dn || !gidstr || !gtype) {
1808                         d_fprintf(stderr, _("Out of Memory!\n"));
1809                         goto failed;
1810                 }
1811
1812                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1813                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1814                 if (is_ipa) {
1815                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
1816                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
1817                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
1818                 }
1819                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1820                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1821                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1822                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1823                                 dom_sid_str_buf(&gsid, &gsid_str));
1824                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1825
1826                 smbldap_talloc_autofree_ldapmod(tc, mods);
1827
1828                 rc = smbldap_add(state, dn, mods);
1829
1830                 if (rc != LDAP_SUCCESS) {
1831                         d_fprintf(stderr, _("Failed to add Domain Admins group "
1832                                             "to ldap directory\n"));
1833                 }
1834
1835                 if (is_ipa) {
1836                         if (!pdb_getgrsid(gmap, gsid)) {
1837                                 d_fprintf(stderr, _("Failed to read just "
1838                                                     "created domain group.\n"));
1839                                 goto failed;
1840                         } else {
1841                                 domadmins_gid = gmap->gid;
1842                         }
1843                 }
1844         } else {
1845                 domadmins_gid = gmap->gid;
1846                 d_printf(_("found!\n"));
1847         }
1848
1849 doma_done:
1850
1851         d_printf(_("Check for Administrator account.\n"));
1852
1853         samuser = samu_new(tc);
1854         if (!samuser) {
1855                 d_fprintf(stderr, _("Out of Memory!\n"));
1856                 goto failed;
1857         }
1858
1859         if (!pdb_getsampwnam(samuser, "Administrator")) {
1860                 LDAPMod **mods = NULL;
1861                 struct dom_sid sid;
1862                 struct dom_sid_buf sid_str;
1863                 char *dn;
1864                 char *name;
1865                 char *uidstr;
1866                 char *gidstr;
1867                 char *shell;
1868                 char *dir;
1869                 char *princ;
1870                 uid_t uid;
1871                 int rc;
1872
1873                 d_printf(_("Adding the Administrator user.\n"));
1874
1875                 if (domadmins_gid == -1) {
1876                         d_fprintf(stderr,
1877                                   _("Can't create Administrator user, Domain "
1878                                     "Admins group not available!\n"));
1879                         goto done;
1880                 }
1881
1882                 if (is_ipa) {
1883                         uid = 999;
1884                 } else {
1885                         if (!winbind_allocate_uid(&uid)) {
1886                                 d_fprintf(stderr,
1887                                           _("Unable to allocate a new uid to create "
1888                                             "the Administrator user!\n"));
1889                                 goto done;
1890                         }
1891                 }
1892
1893                 name = talloc_strdup(tc, "Administrator");
1894                 dn = talloc_asprintf(tc, "uid=Administrator,%s",
1895                                      lp_ldap_user_suffix(talloc_tos()));
1896                 uidstr = talloc_asprintf(tc, "%u", (unsigned int)uid);
1897                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
1898                 dir = talloc_sub_specified(tc, lp_template_homedir(),
1899                                                 "Administrator",
1900                                                 NULL,
1901                                                 get_global_sam_name(),
1902                                                 uid, domadmins_gid);
1903                 shell = talloc_sub_specified(tc, lp_template_shell(),
1904                                                 "Administrator",
1905                                                 NULL,
1906                                                 get_global_sam_name(),
1907                                                 uid, domadmins_gid);
1908
1909                 if (!name || !dn || !uidstr || !gidstr || !dir || !shell) {
1910                         d_fprintf(stderr, _("Out of Memory!\n"));
1911                         goto failed;
1912                 }
1913
1914                 sid_compose(&sid, get_global_sam_sid(), DOMAIN_RID_ADMINISTRATOR);
1915
1916                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
1917                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
1918                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
1919                 if (is_ipa) {
1920                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "person");
1921                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "organizationalperson");
1922                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetorgperson");
1923                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetuser");
1924                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbprincipalaux");
1925                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbticketpolicyaux");
1926                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "sn", name);
1927                         princ = talloc_asprintf(tc, "%s@%s", name, lp_realm());
1928                         if (!princ) {
1929                                 d_fprintf(stderr, _("Out of Memory!\n"));
1930                                 goto failed;
1931                         }
1932                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "krbPrincipalName", princ);
1933                 }
1934                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uid", name);
1935                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
1936                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
1937                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
1938                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1939                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", dir);
1940                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
1941                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
1942                                 dom_sid_str_buf(&sid, &sid_str));
1943                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
1944                                 pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
1945                                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
1946
1947                 smbldap_talloc_autofree_ldapmod(tc, mods);
1948
1949                 rc = smbldap_add(state, dn, mods);
1950
1951                 if (rc != LDAP_SUCCESS) {
1952                         d_fprintf(stderr, _("Failed to add Administrator user "
1953                                             "to ldap directory\n"));
1954                 }
1955
1956                 if (is_ipa) {
1957                         if (!pdb_getsampwnam(samuser, "Administrator")) {
1958                                 d_fprintf(stderr, _("Failed to read just "
1959                                                     "created user.\n"));
1960                                 goto failed;
1961                         }
1962                 }
1963         } else {
1964                 d_printf(_("found!\n"));
1965         }
1966
1967         d_printf(_("Checking for Guest user.\n"));
1968
1969         samuser = samu_new(tc);
1970         if (!samuser) {
1971                 d_fprintf(stderr, _("Out of Memory!\n"));
1972                 goto failed;
1973         }
1974
1975         if (!pdb_getsampwnam(samuser, lp_guest_account())) {
1976                 LDAPMod **mods = NULL;
1977                 struct dom_sid sid;
1978                 struct dom_sid_buf sid_str;
1979                 char *dn;
1980                 char *uidstr;
1981                 char *gidstr;
1982                 int rc;
1983
1984                 d_printf(_("Adding the Guest user.\n"));
1985
1986                 sid_compose(&sid, get_global_sam_sid(), DOMAIN_RID_GUEST);
1987
1988                 pwd = Get_Pwnam_alloc(tc, lp_guest_account());
1989
1990                 if (!pwd) {
1991                         if (domusers_gid == -1) {
1992                                 d_fprintf(stderr,
1993                                           _("Can't create Guest user, Domain "
1994                                             "Users group not available!\n"));
1995                                 goto done;
1996                         }
1997                         if ((pwd = talloc(tc, struct passwd)) == NULL) {
1998                                 d_fprintf(stderr, _("talloc failed\n"));
1999                                 goto done;
2000                         }
2001                         pwd->pw_name = talloc_strdup(pwd, lp_guest_account());
2002
2003                         if (is_ipa) {
2004                                 pwd->pw_uid = 999;
2005                         } else {
2006                                 if (!winbind_allocate_uid(&(pwd->pw_uid))) {
2007                                         d_fprintf(stderr,
2008                                                   _("Unable to allocate a new uid to "
2009                                                     "create the Guest user!\n"));
2010                                         goto done;
2011                                 }
2012                         }
2013                         pwd->pw_gid = domusers_gid;
2014                         pwd->pw_dir = talloc_strdup(tc, "/");
2015                         pwd->pw_shell = talloc_strdup(tc, "/bin/false");
2016                         if (!pwd->pw_dir || !pwd->pw_shell) {
2017                                 d_fprintf(stderr, _("Out of Memory!\n"));
2018                                 goto failed;
2019                         }
2020                 }
2021
2022                 dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name,
2023                                      lp_ldap_user_suffix (talloc_tos()));
2024                 uidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_uid);
2025                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
2026                 if (!dn || !uidstr || !gidstr) {
2027                         d_fprintf(stderr, _("Out of Memory!\n"));
2028                         goto failed;
2029                 }
2030
2031                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
2032                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
2033                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
2034                 if (is_ipa) {
2035                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "person");
2036                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "organizationalperson");
2037                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetorgperson");
2038                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetuser");
2039                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbprincipalaux");
2040                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbticketpolicyaux");
2041                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "sn", pwd->pw_name);
2042                 }
2043                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uid", pwd->pw_name);
2044                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", pwd->pw_name);
2045                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", pwd->pw_name);
2046                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
2047                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
2048                 if ((pwd->pw_dir != NULL) && (pwd->pw_dir[0] != '\0')) {
2049                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", pwd->pw_dir);
2050                 }
2051                 if ((pwd->pw_shell != NULL) && (pwd->pw_shell[0] != '\0')) {
2052                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", pwd->pw_shell);
2053                 }
2054                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
2055                                 dom_sid_str_buf(&sid, &sid_str));
2056                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
2057                                 pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
2058                                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
2059
2060                 smbldap_talloc_autofree_ldapmod(tc, mods);
2061
2062                 rc = smbldap_add(state, dn, mods);
2063
2064                 if (rc != LDAP_SUCCESS) {
2065                         d_fprintf(stderr, _("Failed to add Guest user to "
2066                                             "ldap directory\n"));
2067                 }
2068
2069                 if (is_ipa) {
2070                         if (!pdb_getsampwnam(samuser, lp_guest_account())) {
2071                                 d_fprintf(stderr, _("Failed to read just "
2072                                                     "created user.\n"));
2073                                 goto failed;
2074                         }
2075                 }
2076         } else {
2077                 d_printf(_("found!\n"));
2078         }
2079
2080         d_printf(_("Checking Guest's group.\n"));
2081
2082         pwd = Get_Pwnam_alloc(tc, lp_guest_account());
2083         if (!pwd) {
2084                 d_fprintf(stderr,
2085                           _("Failed to find just created Guest account!\n"
2086                             "   Is nss properly configured?!\n"));
2087                 goto failed;
2088         }
2089
2090         if (pwd->pw_gid == domusers_gid) {
2091                 d_printf(_("found!\n"));
2092                 goto done;
2093         }
2094
2095         if (!pdb_getgrgid(gmap, pwd->pw_gid)) {
2096                 struct dom_sid_buf gsid_str;
2097                 LDAPMod **mods = NULL;
2098                 char *dn;
2099                 char *uname;
2100                 char *wname;
2101                 char *gidstr;
2102                 char *gtype;
2103                 int rc;
2104
2105                 d_printf(_("Adding the Domain Guests group.\n"));
2106
2107                 uname = talloc_strdup(tc, "domguests");
2108                 wname = talloc_strdup(tc, "Domain Guests");
2109                 dn = talloc_asprintf(tc, "cn=%s,%s", "domguests",
2110                                      lp_ldap_group_suffix(talloc_tos()));
2111                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
2112                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
2113
2114                 if (!uname || !wname || !dn || !gidstr || !gtype) {
2115                         d_fprintf(stderr, _("Out of Memory!\n"));
2116                         goto failed;
2117                 }
2118
2119                 sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_GUESTS);
2120
2121                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
2122                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
2123                 if (is_ipa) {
2124                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
2125                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
2126                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
2127                 }
2128                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
2129                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
2130                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
2131                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
2132                                 dom_sid_str_buf(&gsid, &gsid_str));
2133                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
2134
2135                 smbldap_talloc_autofree_ldapmod(tc, mods);
2136
2137                 rc = smbldap_add(state, dn, mods);
2138
2139                 if (rc != LDAP_SUCCESS) {
2140                         d_fprintf(stderr,
2141                                   _("Failed to add Domain Guests group to ldap "
2142                                     "directory\n"));
2143                 }
2144         } else {
2145                 d_printf(_("found!\n"));
2146         }
2147
2148
2149 done:
2150         talloc_free(state);
2151         return 0;
2152
2153 failed:
2154         talloc_free(state);
2155         return -1;
2156 }
2157
2158 #endif
2159
2160 /***********************************************************
2161  migrated functionality from smbgroupedit
2162  **********************************************************/
2163 int net_sam(struct net_context *c, int argc, const char **argv)
2164 {
2165         struct functable func[] = {
2166                 {
2167                         "createbuiltingroup",
2168                         net_sam_createbuiltingroup,
2169                         NET_TRANSPORT_LOCAL,
2170                         N_("Create a new BUILTIN group"),
2171                         N_("net sam createbuiltingroup\n"
2172                            "    Create a new BUILTIN group")
2173                 },
2174                 {
2175                         "createlocalgroup",
2176                         net_sam_createlocalgroup,
2177                         NET_TRANSPORT_LOCAL,
2178                         N_("Create a new local group"),
2179                         N_("net sam createlocalgroup\n"
2180                            "    Create a new local group")
2181                 },
2182                 {
2183                         "createdomaingroup",
2184                         net_sam_createdomaingroup,
2185                         NET_TRANSPORT_LOCAL,
2186                         N_("Create a new group"),
2187                         N_("net sam createdomaingroup\n"
2188                            "    Create a new group")
2189                 },
2190                 {
2191                         "deletelocalgroup",
2192                         net_sam_deletelocalgroup,
2193                         NET_TRANSPORT_LOCAL,
2194                         N_("Delete an existing local group"),
2195                         N_("net sam deletelocalgroup\n"
2196                            "    Delete an existing local group")
2197                 },
2198                 {
2199                         "deletedomaingroup",
2200                         net_sam_deletedomaingroup,
2201                         NET_TRANSPORT_LOCAL,
2202                         N_("Delete a domain group"),
2203                         N_("net sam deletedomaingroup\n"
2204                            "    Delete a group")
2205                 },
2206                 {
2207                         "mapunixgroup",
2208                         net_sam_mapunixgroup,
2209                         NET_TRANSPORT_LOCAL,
2210                         N_("Map a unix group to a domain group"),
2211                         N_("net sam mapunixgroup\n"
2212                            "    Map a unix group to a domain group")
2213                 },
2214                 {
2215                         "unmapunixgroup",
2216                         net_sam_unmapunixgroup,
2217                         NET_TRANSPORT_LOCAL,
2218                         N_("Remove a group mapping of an unix group to a "
2219                            "domain group"),
2220                         N_("net sam unmapunixgroup\n"
2221                            "    Remove a group mapping of an unix group to a "
2222                            "domain group")
2223                 },
2224                 {
2225                         "addmem",
2226                         net_sam_addmem,
2227                         NET_TRANSPORT_LOCAL,
2228                         N_("Add a member to a group"),
2229                         N_("net sam addmem\n"
2230                         "    Add a member to a group")
2231                 },
2232                 {
2233                         "delmem",
2234                         net_sam_delmem,
2235                         NET_TRANSPORT_LOCAL,
2236                         N_("Delete a member from a group"),
2237                         N_("net sam delmem\n"
2238                            "    Delete a member from a group")
2239                 },
2240                 {
2241                         "listmem",
2242                         net_sam_listmem,
2243                         NET_TRANSPORT_LOCAL,
2244                         N_("List group members"),
2245                         N_("net sam listmem\n"
2246                            "    List group members")
2247                 },
2248                 {
2249                         "list",
2250                         net_sam_list,
2251                         NET_TRANSPORT_LOCAL,
2252                         N_("List users, groups and local groups"),
2253                         N_("net sam list\n"
2254                            "    List users, groups and local groups")
2255                 },
2256                 {
2257                         "show",
2258                         net_sam_show,
2259                         NET_TRANSPORT_LOCAL,
2260                         N_("Show details of a SAM entry"),
2261                         N_("net sam show\n"
2262                            "    Show details of a SAM entry")
2263                 },
2264                 {
2265                         "set",
2266                         net_sam_set,
2267                         NET_TRANSPORT_LOCAL,
2268                         N_("Set details of a SAM account"),
2269                         N_("net sam set\n"
2270                            "    Set details of a SAM account")
2271                 },
2272                 {
2273                         "policy",
2274                         net_sam_policy,
2275                         NET_TRANSPORT_LOCAL,
2276                         N_("Set account policies"),
2277                         N_("net sam policy\n"
2278                            "    Set account policies")
2279                 },
2280                 {
2281                         "rights",
2282                         net_sam_rights,
2283                         NET_TRANSPORT_LOCAL,
2284                         N_("Manipulate user privileges"),
2285                         N_("net sam rights\n"
2286                            "    Manipulate user privileges")
2287                 },
2288 #ifdef HAVE_LDAP
2289                 {
2290                         "provision",
2291                         net_sam_provision,
2292                         NET_TRANSPORT_LOCAL,
2293                         N_("Provision a clean user database"),
2294                         N_("net sam privison\n"
2295                            "    Provision a clear user database")
2296                 },
2297 #endif
2298                 {NULL, NULL, 0, NULL, NULL}
2299         };
2300
2301         if (getuid() != 0) {
2302                 d_fprintf(stderr, _("You are not root, most things won't "
2303                           "work\n"));
2304         }
2305
2306         return net_run_function(c, argc, argv, "net sam", func);
2307 }
2308