2 * idmap_ad: map between Active Directory and RFC 2307 or "Services for Unix" (SFU) Accounts
4 * Unix SMB/CIFS implementation.
6 * Winbind ADS backend functions
8 * Copyright (C) Andrew Tridgell 2001
9 * Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
10 * Copyright (C) Gerald (Jerry) Carter 2004-2007
11 * Copyright (C) Luke Howard 2001-2004
13 * This program is free software; you can redistribute it and/or modify
14 * it under the terms of the GNU General Public License as published by
15 * the Free Software Foundation; either version 3 of the License, or
16 * (at your option) any later version.
18 * This program is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
21 * GNU General Public License for more details.
23 * You should have received a copy of the GNU General Public License
24 * along with this program; if not, see <http://www.gnu.org/licenses/>.
30 #define DBGC_CLASS DBGC_IDMAP
32 #define WINBIND_CCACHE_NAME "MEMORY:winbind_ccache"
34 #define IDMAP_AD_MAX_IDS 30
35 #define CHECK_ALLOC_DONE(mem) do { \
37 DEBUG(0, ("Out of memory!\n")); \
38 ret = NT_STATUS_NO_MEMORY; \
43 struct idmap_ad_context {
44 uint32_t filter_low_id;
45 uint32_t filter_high_id;
48 NTSTATUS init_module(void);
50 static ADS_STRUCT *ad_idmap_ads = NULL;
51 static struct posix_schema *ad_schema = NULL;
52 static enum wb_posix_mapping ad_map_type = WB_POSIX_MAP_UNKNOWN;
54 /************************************************************************
55 ***********************************************************************/
57 static ADS_STRUCT *ad_idmap_cached_connection_internal(void)
63 struct sockaddr_storage dc_ip;
65 if (ad_idmap_ads != NULL) {
68 time_t now = time(NULL);
72 expire = MIN(ads->auth.tgt_expire, ads->auth.tgs_expire);
74 /* check for a valid structure */
75 DEBUG(7, ("Current tickets expire in %d seconds (at %d, time is now %d)\n",
76 (uint32)expire-(uint32)now, (uint32) expire, (uint32) now));
78 if ( ads->config.realm && (expire > time(NULL))) {
81 /* we own this ADS_STRUCT so make sure it goes away */
82 DEBUG(7,("Deleting expired krb5 credential cache\n"));
85 ads_kdestroy(WINBIND_CCACHE_NAME);
87 TALLOC_FREE( ad_schema );
92 /* we don't want this to affect the users ccache */
93 setenv("KRB5CCNAME", WINBIND_CCACHE_NAME, 1);
96 if ( (ads = ads_init(lp_realm(), lp_workgroup(), NULL)) == NULL ) {
97 DEBUG(1,("ads_init failed\n"));
101 /* the machine acct password might have change - fetch it every time */
102 SAFE_FREE(ads->auth.password);
103 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
105 SAFE_FREE(ads->auth.realm);
106 ads->auth.realm = SMB_STRDUP(lp_realm());
108 /* setup server affinity */
110 get_dc_name( NULL, ads->auth.realm, dc_name, &dc_ip );
112 status = ads_connect(ads);
113 if (!ADS_ERR_OK(status)) {
114 DEBUG(1, ("ad_idmap_init: failed to connect to AD\n"));
119 ads->is_mine = False;
126 /************************************************************************
127 ***********************************************************************/
129 static ADS_STRUCT *ad_idmap_cached_connection(void)
131 ADS_STRUCT *ads = ad_idmap_cached_connection_internal();
136 /* if we have a valid ADS_STRUCT and the schema model is
137 defined, then we can return here. */
142 /* Otherwise, set the schema model */
144 if ( (ad_map_type == WB_POSIX_MAP_SFU) ||
145 (ad_map_type == WB_POSIX_MAP_SFU20) ||
146 (ad_map_type == WB_POSIX_MAP_RFC2307) )
148 ADS_STATUS schema_status;
150 schema_status = ads_check_posix_schema_mapping( NULL, ads, ad_map_type, &ad_schema);
151 if ( !ADS_ERR_OK(schema_status) ) {
152 DEBUG(2,("ad_idmap_cached_connection: Failed to obtain schema details!\n"));
160 /************************************************************************
161 ***********************************************************************/
163 static NTSTATUS idmap_ad_initialize(struct idmap_domain *dom)
165 struct idmap_ad_context *ctx;
167 const char *range = NULL;
168 const char *schema_mode = NULL;
170 if ( (ctx = TALLOC_ZERO_P(dom, struct idmap_ad_context)) == NULL ) {
171 DEBUG(0, ("Out of memory!\n"));
172 return NT_STATUS_NO_MEMORY;
175 if ( (config_option = talloc_asprintf(ctx, "idmap config %s", dom->name)) == NULL ) {
176 DEBUG(0, ("Out of memory!\n"));
178 return NT_STATUS_NO_MEMORY;
182 range = lp_parm_const_string(-1, config_option, "range", NULL);
183 if (range && range[0]) {
184 if ((sscanf(range, "%u - %u", &ctx->filter_low_id, &ctx->filter_high_id) != 2) ||
185 (ctx->filter_low_id > ctx->filter_high_id)) {
186 DEBUG(1, ("ERROR: invalid filter range [%s]", range));
187 ctx->filter_low_id = 0;
188 ctx->filter_high_id = 0;
193 if ( ad_map_type == WB_POSIX_MAP_UNKNOWN )
194 ad_map_type = WB_POSIX_MAP_RFC2307;
195 schema_mode = lp_parm_const_string(-1, config_option, "schema_mode", NULL);
196 if ( schema_mode && schema_mode[0] ) {
197 if ( strequal(schema_mode, "sfu") )
198 ad_map_type = WB_POSIX_MAP_SFU;
199 else if ( strequal(schema_mode, "sfu20" ) )
200 ad_map_type = WB_POSIX_MAP_SFU20;
201 else if ( strequal(schema_mode, "rfc2307" ) )
202 ad_map_type = WB_POSIX_MAP_RFC2307;
204 DEBUG(0,("idmap_ad_initialize: Unknown schema_mode (%s)\n",
208 dom->private_data = ctx;
209 dom->initialized = True;
211 talloc_free(config_option);
216 /************************************************************************
217 Search up to IDMAP_AD_MAX_IDS entries in maps for a match.
218 ***********************************************************************/
220 static struct id_map *find_map_by_id(struct id_map **maps, enum id_type type, uint32_t id)
224 for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
225 if ((maps[i]->xid.type == type) && (maps[i]->xid.id == id)) {
233 /************************************************************************
234 Search up to IDMAP_AD_MAX_IDS entries in maps for a match
235 ***********************************************************************/
237 static struct id_map *find_map_by_sid(struct id_map **maps, DOM_SID *sid)
241 for (i = 0; maps[i] && i<IDMAP_AD_MAX_IDS; i++) {
242 if (sid_equal(maps[i]->sid, sid)) {
250 /************************************************************************
251 ***********************************************************************/
253 static NTSTATUS idmap_ad_unixids_to_sids(struct idmap_domain *dom, struct id_map **ids)
257 struct idmap_ad_context *ctx;
260 const char *attrs[] = { "sAMAccountType",
262 NULL, /* uidnumber */
263 NULL, /* gidnumber */
265 LDAPMessage *res = NULL;
266 LDAPMessage *entry = NULL;
272 char *u_filter = NULL;
273 char *g_filter = NULL;
275 /* Only do query if we are online */
276 if (idmap_is_offline()) {
277 return NT_STATUS_FILE_IS_OFFLINE;
280 /* Initilization my have been deferred because we were offline */
281 if ( ! dom->initialized) {
282 ret = idmap_ad_initialize(dom);
283 if ( ! NT_STATUS_IS_OK(ret)) {
288 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
290 if ( (memctx = talloc_new(ctx)) == NULL ) {
291 DEBUG(0, ("Out of memory!\n"));
292 return NT_STATUS_NO_MEMORY;
295 if ( (ads = ad_idmap_cached_connection()) == NULL ) {
296 DEBUG(1, ("ADS uninitialized\n"));
297 ret = NT_STATUS_UNSUCCESSFUL;
301 attrs[2] = ad_schema->posix_uidnumber_attr;
302 attrs[3] = ad_schema->posix_gidnumber_attr;
306 for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
307 switch (ids[idx]->xid.type) {
310 u_filter = talloc_asprintf(memctx, "(&(|"
311 "(sAMAccountType=%d)"
312 "(sAMAccountType=%d)"
313 "(sAMAccountType=%d))(|",
314 ATYPE_NORMAL_ACCOUNT,
315 ATYPE_WORKSTATION_TRUST,
316 ATYPE_INTERDOMAIN_TRUST);
318 u_filter = talloc_asprintf_append_buffer(u_filter, "(%s=%lu)",
319 ad_schema->posix_uidnumber_attr,
320 (unsigned long)ids[idx]->xid.id);
321 CHECK_ALLOC_DONE(u_filter);
326 g_filter = talloc_asprintf(memctx, "(&(|"
327 "(sAMAccountType=%d)"
328 "(sAMAccountType=%d))(|",
329 ATYPE_SECURITY_GLOBAL_GROUP,
330 ATYPE_SECURITY_LOCAL_GROUP);
332 g_filter = talloc_asprintf_append_buffer(g_filter, "(%s=%lu)",
333 ad_schema->posix_gidnumber_attr,
334 (unsigned long)ids[idx]->xid.id);
335 CHECK_ALLOC_DONE(g_filter);
339 DEBUG(3, ("Error: mapping requested but Unknown ID type\n"));
340 ids[idx]->status = ID_UNKNOWN;
344 filter = talloc_asprintf(memctx, "(|");
345 CHECK_ALLOC_DONE(filter);
347 filter = talloc_asprintf_append_buffer(filter, "%s))", u_filter);
348 CHECK_ALLOC_DONE(filter);
349 TALLOC_FREE(u_filter);
352 filter = talloc_asprintf_append_buffer(filter, "%s))", g_filter);
353 CHECK_ALLOC_DONE(filter);
354 TALLOC_FREE(g_filter);
356 filter = talloc_asprintf_append_buffer(filter, ")");
357 CHECK_ALLOC_DONE(filter);
359 rc = ads_search_retry(ads, &res, filter, attrs);
360 if (!ADS_ERR_OK(rc)) {
361 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
362 ret = NT_STATUS_UNSUCCESSFUL;
366 if ( (count = ads_count_replies(ads, res)) == 0 ) {
367 DEBUG(10, ("No IDs found\n"));
371 for (i = 0; (i < count) && entry; i++) {
378 if (i == 0) { /* first entry */
379 entry = ads_first_entry(ads, entry);
380 } else { /* following ones */
381 entry = ads_next_entry(ads, entry);
385 DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
389 /* first check if the SID is present */
390 if (!ads_pull_sid(ads, entry, "objectSid", &sid)) {
391 DEBUG(2, ("Could not retrieve SID from entry\n"));
396 if (!ads_pull_uint32(ads, entry, "sAMAccountType", &atype)) {
397 DEBUG(1, ("could not get SAM account type\n"));
401 switch (atype & 0xF0000000) {
402 case ATYPE_SECURITY_GLOBAL_GROUP:
403 case ATYPE_SECURITY_LOCAL_GROUP:
406 case ATYPE_NORMAL_ACCOUNT:
407 case ATYPE_WORKSTATION_TRUST:
408 case ATYPE_INTERDOMAIN_TRUST:
412 DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
416 if (!ads_pull_uint32(ads, entry, (type==ID_TYPE_UID) ?
417 ad_schema->posix_uidnumber_attr :
418 ad_schema->posix_gidnumber_attr,
421 DEBUG(1, ("Could not get unix ID\n"));
426 (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
427 (ctx->filter_high_id && (id > ctx->filter_high_id))) {
428 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
429 id, ctx->filter_low_id, ctx->filter_high_id));
433 map = find_map_by_id(&ids[bidx], type, id);
435 DEBUG(2, ("WARNING: couldn't match result with requested ID\n"));
439 sid_copy(map->sid, &sid);
442 map->status = ID_MAPPED;
444 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
445 (unsigned long)map->xid.id,
450 ads_msgfree(ads, res);
453 if (ids[idx]) { /* still some values to map */
459 /* mark all unknown/expired ones as unmapped */
460 for (i = 0; ids[i]; i++) {
461 if (ids[i]->status != ID_MAPPED)
462 ids[i]->status = ID_UNMAPPED;
470 /************************************************************************
471 ***********************************************************************/
473 static NTSTATUS idmap_ad_sids_to_unixids(struct idmap_domain *dom, struct id_map **ids)
477 struct idmap_ad_context *ctx;
480 const char *attrs[] = { "sAMAccountType",
482 NULL, /* attr_uidnumber */
483 NULL, /* attr_gidnumber */
485 LDAPMessage *res = NULL;
486 LDAPMessage *entry = NULL;
494 /* Only do query if we are online */
495 if (idmap_is_offline()) {
496 return NT_STATUS_FILE_IS_OFFLINE;
499 /* Initilization my have been deferred because we were offline */
500 if ( ! dom->initialized) {
501 ret = idmap_ad_initialize(dom);
502 if ( ! NT_STATUS_IS_OK(ret)) {
507 ctx = talloc_get_type(dom->private_data, struct idmap_ad_context);
509 if ( (memctx = talloc_new(ctx)) == NULL ) {
510 DEBUG(0, ("Out of memory!\n"));
511 return NT_STATUS_NO_MEMORY;
514 if ( (ads = ad_idmap_cached_connection()) == NULL ) {
515 DEBUG(1, ("ADS uninitialized\n"));
516 ret = NT_STATUS_UNSUCCESSFUL;
520 attrs[2] = ad_schema->posix_uidnumber_attr;
521 attrs[3] = ad_schema->posix_gidnumber_attr;
524 filter = talloc_asprintf(memctx, "(&(|"
525 "(sAMAccountType=%d)(sAMAccountType=%d)(sAMAccountType=%d)" /* user account types */
526 "(sAMAccountType=%d)(sAMAccountType=%d)" /* group account types */
528 ATYPE_NORMAL_ACCOUNT, ATYPE_WORKSTATION_TRUST, ATYPE_INTERDOMAIN_TRUST,
529 ATYPE_SECURITY_GLOBAL_GROUP, ATYPE_SECURITY_LOCAL_GROUP);
531 CHECK_ALLOC_DONE(filter);
534 for (i = 0; (i < IDMAP_AD_MAX_IDS) && ids[idx]; i++, idx++) {
536 sidstr = sid_binstring(ids[idx]->sid);
537 filter = talloc_asprintf_append_buffer(filter, "(objectSid=%s)", sidstr);
540 CHECK_ALLOC_DONE(filter);
542 filter = talloc_asprintf_append_buffer(filter, "))");
543 CHECK_ALLOC_DONE(filter);
544 DEBUG(10, ("Filter: [%s]\n", filter));
546 rc = ads_search_retry(ads, &res, filter, attrs);
547 if (!ADS_ERR_OK(rc)) {
548 DEBUG(1, ("ERROR: ads search returned: %s\n", ads_errstr(rc)));
549 ret = NT_STATUS_UNSUCCESSFUL;
553 if ( (count = ads_count_replies(ads, res)) == 0 ) {
554 DEBUG(10, ("No IDs found\n"));
558 for (i = 0; (i < count) && entry; i++) {
565 if (i == 0) { /* first entry */
566 entry = ads_first_entry(ads, entry);
567 } else { /* following ones */
568 entry = ads_next_entry(ads, entry);
572 DEBUG(2, ("ERROR: Unable to fetch ldap entries from results\n"));
576 /* first check if the SID is present */
577 if (!ads_pull_sid(ads, entry, "objectSid", &sid)) {
578 DEBUG(2, ("Could not retrieve SID from entry\n"));
582 map = find_map_by_sid(&ids[bidx], &sid);
584 DEBUG(2, ("WARNING: couldn't match result with requested SID\n"));
589 if (!ads_pull_uint32(ads, entry, "sAMAccountType", &atype)) {
590 DEBUG(1, ("could not get SAM account type\n"));
594 switch (atype & 0xF0000000) {
595 case ATYPE_SECURITY_GLOBAL_GROUP:
596 case ATYPE_SECURITY_LOCAL_GROUP:
599 case ATYPE_NORMAL_ACCOUNT:
600 case ATYPE_WORKSTATION_TRUST:
601 case ATYPE_INTERDOMAIN_TRUST:
605 DEBUG(1, ("unrecognized SAM account type %08x\n", atype));
609 if (!ads_pull_uint32(ads, entry, (type==ID_TYPE_UID) ?
610 ad_schema->posix_uidnumber_attr :
611 ad_schema->posix_gidnumber_attr,
614 DEBUG(1, ("Could not get unix ID\n"));
618 (ctx->filter_low_id && (id < ctx->filter_low_id)) ||
619 (ctx->filter_high_id && (id > ctx->filter_high_id))) {
620 DEBUG(5, ("Requested id (%u) out of range (%u - %u). Filtered!\n",
621 id, ctx->filter_low_id, ctx->filter_high_id));
626 map->xid.type = type;
628 map->status = ID_MAPPED;
630 DEBUG(10, ("Mapped %s -> %lu (%d)\n", sid_string_dbg(map->sid),
631 (unsigned long)map->xid.id,
636 ads_msgfree(ads, res);
639 if (ids[idx]) { /* still some values to map */
645 /* mark all unknwoni/expired ones as unmapped */
646 for (i = 0; ids[i]; i++) {
647 if (ids[i]->status != ID_MAPPED)
648 ids[i]->status = ID_UNMAPPED;
656 /************************************************************************
657 ***********************************************************************/
659 static NTSTATUS idmap_ad_close(struct idmap_domain *dom)
661 ADS_STRUCT *ads = ad_idmap_ads;
664 /* we own this ADS_STRUCT so make sure it goes away */
670 TALLOC_FREE( ad_schema );
676 * nss_info_{sfu,sfu20,rfc2307}
679 /************************************************************************
680 Initialize the {sfu,sfu20,rfc2307} state
681 ***********************************************************************/
683 static NTSTATUS nss_sfu_init( struct nss_domain_entry *e )
685 /* Sanity check if we have previously been called with a
686 different schema model */
688 if ( (ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
689 (ad_map_type != WB_POSIX_MAP_SFU) )
691 DEBUG(0,("nss_sfu_init: Posix Map type has already been set. "
692 "Mixed schema models not supported!\n"));
693 return NT_STATUS_NOT_SUPPORTED;
696 ad_map_type = WB_POSIX_MAP_SFU;
701 static NTSTATUS nss_sfu20_init( struct nss_domain_entry *e )
703 /* Sanity check if we have previously been called with a
704 different schema model */
706 if ( (ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
707 (ad_map_type != WB_POSIX_MAP_SFU20) )
709 DEBUG(0,("nss_sfu20_init: Posix Map type has already been set. "
710 "Mixed schema models not supported!\n"));
711 return NT_STATUS_NOT_SUPPORTED;
714 ad_map_type = WB_POSIX_MAP_SFU20;
719 static NTSTATUS nss_rfc2307_init( struct nss_domain_entry *e )
721 /* Sanity check if we have previously been called with a
722 different schema model */
724 if ( (ad_map_type != WB_POSIX_MAP_UNKNOWN) &&
725 (ad_map_type != WB_POSIX_MAP_RFC2307) )
727 DEBUG(0,("nss_rfc2307_init: Posix Map type has already been set. "
728 "Mixed schema models not supported!\n"));
729 return NT_STATUS_NOT_SUPPORTED;
732 ad_map_type = WB_POSIX_MAP_RFC2307;
738 /************************************************************************
739 ***********************************************************************/
740 static NTSTATUS nss_ad_get_info( struct nss_domain_entry *e,
750 ADS_STRUCT *ads_internal = NULL;
752 /* Only do query if we are online */
753 if (idmap_is_offline()) {
754 return NT_STATUS_FILE_IS_OFFLINE;
757 /* We are assuming that the internal ADS_STRUCT is for the
758 same forest as the incoming *ads pointer */
760 ads_internal = ad_idmap_cached_connection();
762 if ( !ads_internal || !ad_schema )
763 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
765 if ( !homedir || !shell || !gecos )
766 return NT_STATUS_INVALID_PARAMETER;
768 *homedir = ads_pull_string( ads, ctx, msg, ad_schema->posix_homedir_attr );
769 *shell = ads_pull_string( ads, ctx, msg, ad_schema->posix_shell_attr );
770 *gecos = ads_pull_string( ads, ctx, msg, ad_schema->posix_gecos_attr );
773 if ( !ads_pull_uint32(ads, msg, ad_schema->posix_gidnumber_attr, gid ) )
780 /************************************************************************
781 ***********************************************************************/
783 static NTSTATUS nss_ad_close( void )
785 /* nothing to do. All memory is free()'d by the idmap close_fn() */
790 /************************************************************************
791 Function dispatch tables for the idmap and nss plugins
792 ***********************************************************************/
794 static struct idmap_methods ad_methods = {
795 .init = idmap_ad_initialize,
796 .unixids_to_sids = idmap_ad_unixids_to_sids,
797 .sids_to_unixids = idmap_ad_sids_to_unixids,
798 .close_fn = idmap_ad_close
801 /* The SFU and RFC2307 NSS plugins share everything but the init
802 function which sets the intended schema model to use */
804 static struct nss_info_methods nss_rfc2307_methods = {
805 .init = nss_rfc2307_init,
806 .get_nss_info = nss_ad_get_info,
807 .close_fn = nss_ad_close
810 static struct nss_info_methods nss_sfu_methods = {
811 .init = nss_sfu_init,
812 .get_nss_info = nss_ad_get_info,
813 .close_fn = nss_ad_close
816 static struct nss_info_methods nss_sfu20_methods = {
817 .init = nss_sfu20_init,
818 .get_nss_info = nss_ad_get_info,
819 .close_fn = nss_ad_close
824 /************************************************************************
825 Initialize the plugins
826 ***********************************************************************/
828 NTSTATUS idmap_ad_init(void)
830 static NTSTATUS status_idmap_ad = NT_STATUS_UNSUCCESSFUL;
831 static NTSTATUS status_nss_rfc2307 = NT_STATUS_UNSUCCESSFUL;
832 static NTSTATUS status_nss_sfu = NT_STATUS_UNSUCCESSFUL;
833 static NTSTATUS status_nss_sfu20 = NT_STATUS_UNSUCCESSFUL;
835 /* Always register the AD method first in order to get the
836 idmap_domain interface called */
838 if ( !NT_STATUS_IS_OK(status_idmap_ad) ) {
839 status_idmap_ad = smb_register_idmap(SMB_IDMAP_INTERFACE_VERSION,
841 if ( !NT_STATUS_IS_OK(status_idmap_ad) )
842 return status_idmap_ad;
845 if ( !NT_STATUS_IS_OK( status_nss_rfc2307 ) ) {
846 status_nss_rfc2307 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
847 "rfc2307", &nss_rfc2307_methods );
848 if ( !NT_STATUS_IS_OK(status_nss_rfc2307) )
849 return status_nss_rfc2307;
852 if ( !NT_STATUS_IS_OK( status_nss_sfu ) ) {
853 status_nss_sfu = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
854 "sfu", &nss_sfu_methods );
855 if ( !NT_STATUS_IS_OK(status_nss_sfu) )
856 return status_nss_sfu;
859 if ( !NT_STATUS_IS_OK( status_nss_sfu20 ) ) {
860 status_nss_sfu20 = smb_register_idmap_nss(SMB_NSS_INFO_INTERFACE_VERSION,
861 "sfu20", &nss_sfu20_methods );
862 if ( !NT_STATUS_IS_OK(status_nss_sfu20) )
863 return status_nss_sfu20;