source3/winbindd/wb_lookupsids.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    async lookupsids
   4    Copyright (C) Volker Lendecke 2011
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "winbindd.h"
  22 #include "lib/util_unixsids.h"
  23 #include "librpc/gen_ndr/ndr_winbind_c.h"
  24 #include "../libcli/security/security.h"
  25 #include "passdb/machine_sid.h"
  26
  27 struct wb_lookupsids_domain {
  28         struct dom_sid sid;
  29         struct winbindd_domain *domain;
  30
  31         /*
  32          * Array of sids to be passed into wbint_LookupSids. Preallocated with
  33          * num_sids.
  34          */
  35         struct lsa_SidArray sids;
  36
  37         /*
  38          * Indexes into wb_lookupsids_state->sids and thus
  39          * wb_lookupsids_state->res_names. Preallocated with num_sids.
  40          */
  41         uint32_t *sid_indexes;
  42 };
  43
  44 struct wb_translated_name {
  45         const char *domain_name;
  46         const char *name;
  47         enum lsa_SidType type;
  48 };
  49
  50 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
  51         const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
  52         struct wb_lookupsids_domain **domains, uint32_t num_sids);
  53
  54 struct wb_lookupsids_state {
  55         struct tevent_context *ev;
  56
  57         /*
  58          * SIDs passed in
  59          */
  60         struct dom_sid *sids;
  61         uint32_t num_sids;
  62
  63         /*
  64          * The domains we're using for bulk lookup via wbint_LookupRids or
  65          * wbint_LookupSids. We expect very few domains, so we do a
  66          * talloc_realloc and rely on talloc_array_length.
  67          */
  68         struct wb_lookupsids_domain *domains;
  69         uint32_t domains_done;
  70
  71         /*
  72          * These SIDs are looked up individually via
  73          * wbint_LookupSid. Preallocated with num_sids.
  74          */
  75         uint32_t *single_sids;
  76         /* Pointer into the "domains" array above*/
  77         struct wb_lookupsids_domain **single_domains;
  78         uint32_t num_single_sids;
  79         uint32_t single_sids_done;
  80
  81         /*
  82          * Intermediate store for wbint_LookupRids to passdb. These are
  83          * spliced into res_domains/res_names in wb_lookupsids_move_name.
  84          */
  85         struct wbint_RidArray rids;
  86         const char *domain_name;
  87         struct wbint_Principals rid_names;
  88
  89         /*
  90          * Intermediate results for wbint_LookupSids. These results are
  91          * spliced into res_domains/res_names in wb_lookupsids_move_name.
  92          */
  93         struct lsa_RefDomainList tmp_domains;
  94         struct lsa_TransNameArray tmp_names;
  95
  96         /*
  97          * Results
  98          */
  99         struct lsa_RefDomainList *res_domains;
 100         /*
 101          * Indexed as "sids" in this structure
 102          */
 103         struct lsa_TransNameArray *res_names;
 104 };
 105
 106 static bool wb_lookupsids_next(struct tevent_req *req,
 107                                struct wb_lookupsids_state *state);
 108 static void wb_lookupsids_single_done(struct tevent_req *subreq);
 109 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq);
 110 static void wb_lookupsids_done(struct tevent_req *subreq);
 111
 112 struct tevent_req *wb_lookupsids_send(TALLOC_CTX *mem_ctx,
 113                                       struct tevent_context *ev,
 114                                       struct dom_sid *sids,
 115                                       uint32_t num_sids)
 116 {
 117         struct tevent_req *req;
 118         struct wb_lookupsids_state *state;
 119         uint32_t i;
 120
 121         req = tevent_req_create(mem_ctx, &state, struct wb_lookupsids_state);
 122         if (req == NULL) {
 123                 return NULL;
 124         }
 125         state->ev = ev;
 126         state->sids = sids;
 127         state->num_sids = num_sids;
 128
 129         state->single_sids = talloc_array(state, uint32_t, num_sids);
 130         if (tevent_req_nomem(state->single_sids, req)) {
 131                 return tevent_req_post(req, ev);
 132         }
 133         state->single_domains = talloc_zero_array(state,
 134                                                   struct wb_lookupsids_domain *,
 135                                                   num_sids);
 136         if (tevent_req_nomem(state->single_domains, req)) {
 137                 return tevent_req_post(req, ev);
 138         }
 139
 140         state->res_domains = talloc_zero(state, struct lsa_RefDomainList);
 141         if (tevent_req_nomem(state->res_domains, req)) {
 142                 return tevent_req_post(req, ev);
 143         }
 144         state->res_domains->domains = talloc_array(
 145                 state->res_domains, struct lsa_DomainInfo, num_sids);
 146         if (tevent_req_nomem(state->res_domains->domains, req)) {
 147                 return tevent_req_post(req, ev);
 148         }
 149
 150         state->res_names = talloc_zero(state, struct lsa_TransNameArray);
 151         if (tevent_req_nomem(state->res_names, req)) {
 152                 return tevent_req_post(req, ev);
 153         }
 154         state->res_names->names = talloc_array(
 155                 state->res_names, struct lsa_TranslatedName, num_sids);
 156         if (tevent_req_nomem(state->res_names->names, req)) {
 157                 return tevent_req_post(req, ev);
 158         }
 159
 160         if (num_sids == 0) {
 161                 tevent_req_done(req);
 162                 return tevent_req_post(req, ev);
 163         }
 164
 165         for (i=0; i<num_sids; i++) {
 166                 struct wb_lookupsids_domain *d;
 167
 168                 d = wb_lookupsids_get_domain(&sids[i], state, &state->domains,
 169                                              num_sids);
 170                 if (d != NULL) {
 171                         d->sids.sids[d->sids.num_sids].sid = &sids[i];
 172                         d->sid_indexes[d->sids.num_sids] = i;
 173                         d->sids.num_sids += 1;
 174                 } else {
 175                         state->single_sids[state->num_single_sids] = i;
 176                         state->num_single_sids += 1;
 177                 }
 178         }
 179
 180         if (!wb_lookupsids_next(req, state)) {
 181                 return tevent_req_post(req, ev);
 182         }
 183         return req;
 184 }
 185
 186 static bool wb_lookupsids_next(struct tevent_req *req,
 187                                struct wb_lookupsids_state *state)
 188 {
 189         struct tevent_req *subreq;
 190
 191         if (state->domains_done < talloc_array_length(state->domains)) {
 192                 struct wb_lookupsids_domain *d;
 193                 uint32_t i;
 194
 195                 d = &state->domains[state->domains_done];
 196
 197                 if (sid_check_is_our_sam(&d->sid)) {
 198                         state->rids.num_rids = d->sids.num_sids;
 199                         state->rids.rids = talloc_array(state, uint32_t,
 200                                                         state->rids.num_rids);
 201                         if (tevent_req_nomem(state->rids.rids, req)) {
 202                                 return false;
 203                         }
 204                         for (i=0; i<state->rids.num_rids; i++) {
 205                                 sid_peek_rid(d->sids.sids[i].sid,
 206                                              &state->rids.rids[i]);
 207                         }
 208                         subreq = dcerpc_wbint_LookupRids_send(
 209                                 state, state->ev, dom_child_handle(d->domain),
 210                                 &d->sid, &state->rids, &state->domain_name,
 211                                 &state->rid_names);
 212                         if (tevent_req_nomem(subreq, req)) {
 213                                 return false;
 214                         }
 215                         tevent_req_set_callback(
 216                                 subreq, wb_lookupsids_lookuprids_done, req);
 217                         return true;
 218                 }
 219
 220                 subreq = dcerpc_wbint_LookupSids_send(
 221                         state, state->ev, dom_child_handle(d->domain),
 222                         &d->sids, &state->tmp_domains,  &state->tmp_names);
 223                 if (tevent_req_nomem(subreq, req)) {
 224                         return false;
 225                 }
 226                 tevent_req_set_callback(subreq, wb_lookupsids_done, req);
 227                 return true;
 228         }
 229
 230         if (state->single_sids_done < state->num_single_sids) {
 231                 uint32_t sid_idx;
 232                 const struct dom_sid *sid;
 233
 234                 sid_idx = state->single_sids[state->single_sids_done];
 235                 sid = &state->sids[sid_idx];
 236
 237                 subreq = wb_lookupsid_send(state, state->ev, sid);
 238                 if (tevent_req_nomem(subreq, req)) {
 239                         return false;
 240                 }
 241                 tevent_req_set_callback(subreq, wb_lookupsids_single_done,
 242                                         req);
 243                 return true;
 244         }
 245
 246         tevent_req_done(req);
 247         return false;
 248 }
 249
 250 /*
 251  * Decide whether to do bulk lookupsids. We have optimizations for
 252  * passdb via lookuprids and to remote DCs via lookupsids.
 253  */
 254
 255 static bool wb_lookupsids_bulk(const struct dom_sid *sid)
 256 {
 257         if (sid->num_auths != 5) {
 258                 /*
 259                  * Only do "S-1-5-21-x-y-z-rid" domains via bulk
 260                  * lookup
 261                  */
 262                 DEBUG(10, ("No bulk setup for SID %s with %d subauths\n",
 263                            sid_string_dbg(sid), sid->num_auths));
 264                 return false;
 265         }
 266
 267         if (sid_check_is_in_our_sam(sid)) {
 268                 /*
 269                  * Passdb lookup via lookuprids
 270                  */
 271                 DEBUG(10, ("%s is in our domain\n", sid_string_tos(sid)));
 272                 return true;
 273         }
 274
 275         if (IS_DC) {
 276                 /*
 277                  * Bulk lookups to trusted DCs
 278                  */
 279                 return (find_domain_from_sid_noinit(sid) != NULL);
 280         }
 281
 282         if (lp_server_role() != ROLE_DOMAIN_MEMBER) {
 283                 /*
 284                  * Don't do bulk lookups as standalone, the only bulk
 285                  * lookup left is for domain members.
 286                  */
 287                 return false;
 288         }
 289
 290         if (sid_check_is_in_unix_groups(sid) ||
 291             sid_check_is_unix_groups(sid) ||
 292             sid_check_is_in_unix_users(sid) ||
 293             sid_check_is_unix_users(sid) ||
 294             sid_check_is_in_builtin(sid) ||
 295             sid_check_is_builtin(sid)) {
 296                 /*
 297                  * These are locally done piece by piece anyway, no
 298                  * need for bulk optimizations.
 299                  */
 300                 return false;
 301         }
 302
 303         /*
 304          * All other SIDs are sent to the DC we're connected to as
 305          * member via a single lsa_lookupsids call.
 306          */
 307         return true;
 308 }
 309
 310 static struct wb_lookupsids_domain *wb_lookupsids_get_domain(
 311         const struct dom_sid *sid, TALLOC_CTX *mem_ctx,
 312         struct wb_lookupsids_domain **pdomains, uint32_t num_sids)
 313 {
 314         struct wb_lookupsids_domain *domains, *domain;
 315         struct winbindd_domain *wb_domain;
 316         uint32_t i, num_domains;
 317
 318         if (!wb_lookupsids_bulk(sid)) {
 319                 return NULL;
 320         }
 321
 322         domains = *pdomains;
 323         num_domains = talloc_array_length(domains);
 324
 325         for (i=0; i<num_domains; i++) {
 326                 if (dom_sid_compare_domain(sid, &domains[i].sid) == 0) {
 327                         return &domains[i];
 328                 }
 329         }
 330
 331         wb_domain = find_lookup_domain_from_sid(sid);
 332         if (wb_domain == NULL) {
 333                 return NULL;
 334         }
 335
 336         domains = talloc_realloc(
 337                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains+1);
 338         if (domains == NULL) {
 339                 return NULL;
 340         }
 341         *pdomains = domains;
 342
 343         domain = &domains[num_domains];
 344         sid_copy(&domain->sid, sid);
 345         sid_split_rid(&domain->sid, NULL);
 346         domain->domain = wb_domain;
 347
 348         domain->sids.sids = talloc_array(domains, struct lsa_SidPtr, num_sids);
 349         if (domains->sids.sids == NULL) {
 350                 goto fail;
 351         }
 352         domain->sids.num_sids = 0;
 353
 354         domain->sid_indexes = talloc_array(domains, uint32_t, num_sids);
 355         if (domain->sid_indexes == NULL) {
 356                 TALLOC_FREE(domain->sids.sids);
 357                 goto fail;
 358         }
 359         return domain;
 360
 361 fail:
 362         /*
 363          * Realloc to the state it was in before
 364          */
 365         *pdomains = talloc_realloc(
 366                 mem_ctx, domains, struct wb_lookupsids_domain, num_domains);
 367         return NULL;
 368 }
 369
 370 static bool wb_lookupsids_find_dom_idx(struct lsa_DomainInfo *domain,
 371                                        struct lsa_RefDomainList *list,
 372                                        uint32_t *idx)
 373 {
 374         uint32_t i;
 375         struct lsa_DomainInfo *new_domain;
 376
 377         for (i=0; i<list->count; i++) {
 378                 if (dom_sid_equal(domain->sid, list->domains[i].sid)) {
 379                         *idx = i;
 380                         return true;
 381                 }
 382         }
 383
 384         new_domain = &list->domains[list->count];
 385
 386         new_domain->name.string = talloc_strdup(
 387                 list->domains, domain->name.string);
 388         if (new_domain->name.string == NULL) {
 389                 return false;
 390         }
 391
 392         new_domain->sid = dom_sid_dup(list->domains, domain->sid);
 393         if (new_domain->sid == NULL) {
 394                 return false;
 395         }
 396
 397         *idx = list->count;
 398         list->count += 1;
 399         return true;
 400 }
 401
 402 static bool wb_lookupsids_move_name(struct lsa_RefDomainList *src_domains,
 403                                     struct lsa_TranslatedName *src_name,
 404                                     struct lsa_RefDomainList *dst_domains,
 405                                     struct lsa_TransNameArray *dst_names,
 406                                     uint32_t dst_name_index)
 407 {
 408         struct lsa_TranslatedName *dst_name;
 409         struct lsa_DomainInfo *src_domain;
 410         uint32_t src_domain_index, dst_domain_index;
 411
 412         src_domain_index = src_name->sid_index;
 413         if (src_domain_index >= src_domains->count) {
 414                 return false;
 415         }
 416         src_domain = &src_domains->domains[src_domain_index];
 417
 418         if (!wb_lookupsids_find_dom_idx(
 419                     src_domain, dst_domains, &dst_domain_index)) {
 420                 return false;
 421         }
 422
 423         dst_name = &dst_names->names[dst_name_index];
 424
 425         dst_name->sid_type = src_name->sid_type;
 426         dst_name->name.string = talloc_move(dst_names->names,
 427                                             &src_name->name.string);
 428         dst_name->sid_index = dst_domain_index;
 429         dst_names->count += 1;
 430
 431         return true;
 432 }
 433
 434 static void wb_lookupsids_done(struct tevent_req *subreq)
 435 {
 436         struct tevent_req *req = tevent_req_callback_data(
 437                 subreq, struct tevent_req);
 438         struct wb_lookupsids_state *state = tevent_req_data(
 439                 req, struct wb_lookupsids_state);
 440         struct wb_lookupsids_domain *d;
 441         uint32_t i;
 442         bool fallback = false;
 443
 444         NTSTATUS status, result;
 445
 446         status = dcerpc_wbint_LookupSids_recv(subreq, state, &result);
 447         TALLOC_FREE(subreq);
 448         if (tevent_req_nterror(req, status)) {
 449                 return;
 450         }
 451
 452         d = &state->domains[state->domains_done];
 453
 454         if (NT_STATUS_IS_ERR(result)) {
 455                 fallback = true;
 456         } else if (state->tmp_names.count != d->sids.num_sids) {
 457                 fallback = true;
 458         }
 459
 460         if (fallback) {
 461                 for (i=0; i < d->sids.num_sids; i++) {
 462                         uint32_t res_sid_index = d->sid_indexes[i];
 463
 464                         state->single_sids[state->num_single_sids] =
 465                                 res_sid_index;
 466                         state->single_domains[state->num_single_sids] = d;
 467                         state->num_single_sids += 1;
 468                 }
 469                 state->domains_done += 1;
 470                 wb_lookupsids_next(req, state);
 471                 return;
 472         }
 473
 474         /*
 475          * Look at the individual states in the translated names.
 476          */
 477
 478         for (i=0; i<state->tmp_names.count; i++) {
 479
 480                 uint32_t res_sid_index = d->sid_indexes[i];
 481
 482                 if (state->tmp_names.names[i].sid_type == SID_NAME_UNKNOWN) {
 483                         /*
 484                          * Make unknown SIDs go through
 485                          * wb_lookupsid. This retries the forest root.
 486                          */
 487                         state->single_sids[state->num_single_sids] =
 488                                 res_sid_index;
 489                         state->num_single_sids += 1;
 490                         continue;
 491                 }
 492                 if (!wb_lookupsids_move_name(
 493                             &state->tmp_domains, &state->tmp_names.names[i],
 494                             state->res_domains, state->res_names,
 495                             res_sid_index)) {
 496                         tevent_req_oom(req);
 497                         return;
 498                 }
 499         }
 500         state->domains_done += 1;
 501         wb_lookupsids_next(req, state);
 502 }
 503
 504 static void wb_lookupsids_single_done(struct tevent_req *subreq)
 505 {
 506         struct tevent_req *req = tevent_req_callback_data(
 507                 subreq, struct tevent_req);
 508         struct wb_lookupsids_state *state = tevent_req_data(
 509                 req, struct wb_lookupsids_state);
 510         const char *domain_name, *name;
 511         enum lsa_SidType type;
 512         uint32_t res_sid_index;
 513         uint32_t src_rid;
 514
 515         struct dom_sid src_domain_sid;
 516         struct lsa_DomainInfo src_domain;
 517         struct lsa_RefDomainList src_domains;
 518         struct lsa_TranslatedName src_name;
 519
 520         NTSTATUS status;
 521
 522         status = wb_lookupsid_recv(subreq, talloc_tos(), &type,
 523                                    &domain_name, &name);
 524         TALLOC_FREE(subreq);
 525         if (!NT_STATUS_IS_OK(status)) {
 526                 struct wb_lookupsids_domain *wb_domain;
 527                 const char *tmpname;
 528
 529                 type = SID_NAME_UNKNOWN;
 530
 531                 wb_domain = state->single_domains[state->single_sids_done];
 532                 if (wb_domain != NULL) {
 533                         /*
 534                          * If the lookupsid failed because the rid not
 535                          * found in a domain and we have a reference
 536                          * to the lookup domain, use the name from
 537                          * there.
 538                          *
 539                          * Callers like sid2xid will use the domain
 540                          * name in the idmap backend to figure out
 541                          * which domain to use in processing.
 542                          */
 543                         tmpname = wb_domain->domain->name;
 544                 } else {
 545                         tmpname = "";
 546                 }
 547                 domain_name = talloc_strdup(talloc_tos(), tmpname);
 548                 if (tevent_req_nomem(domain_name, req)) {
 549                         return;
 550                 }
 551                 name = talloc_strdup(talloc_tos(), "");
 552                 if (tevent_req_nomem(name, req)) {
 553                         return;
 554                 }
 555         }
 556
 557         /*
 558          * Fake up structs for wb_lookupsids_move_name
 559          */
 560         res_sid_index = state->single_sids[state->single_sids_done];
 561
 562         sid_copy(&src_domain_sid, &state->sids[res_sid_index]);
 563         sid_split_rid(&src_domain_sid, &src_rid);
 564         src_domain.name.string = domain_name;
 565         src_domain.sid = &src_domain_sid;
 566
 567         src_domains.count = 1;
 568         src_domains.domains = &src_domain;
 569
 570         src_name.sid_type = type;
 571         src_name.name.string = name;
 572         src_name.sid_index = 0;
 573
 574         if (!wb_lookupsids_move_name(
 575                     &src_domains, &src_name,
 576                     state->res_domains, state->res_names,
 577                     res_sid_index)) {
 578                 tevent_req_oom(req);
 579                 return;
 580         }
 581         state->single_sids_done += 1;
 582         wb_lookupsids_next(req, state);
 583 }
 584
 585 static void wb_lookupsids_lookuprids_done(struct tevent_req *subreq)
 586 {
 587         struct tevent_req *req = tevent_req_callback_data(
 588                 subreq, struct tevent_req);
 589         struct wb_lookupsids_state *state = tevent_req_data(
 590                 req, struct wb_lookupsids_state);
 591         struct dom_sid src_domain_sid;
 592         struct lsa_DomainInfo src_domain;
 593         struct lsa_RefDomainList src_domains;
 594         NTSTATUS status, result;
 595         struct wb_lookupsids_domain *d;
 596         uint32_t i;
 597         bool fallback = false;
 598
 599         status = dcerpc_wbint_LookupRids_recv(subreq, state, &result);
 600         TALLOC_FREE(subreq);
 601         if (tevent_req_nterror(req, status)) {
 602                 return;
 603         }
 604
 605         d = &state->domains[state->domains_done];
 606
 607         if (NT_STATUS_IS_ERR(result)) {
 608                 fallback = true;
 609         } else if (state->rid_names.num_principals != d->sids.num_sids) {
 610                 fallback = true;
 611         }
 612
 613         if (fallback) {
 614                 for (i=0; i < d->sids.num_sids; i++) {
 615                         uint32_t res_sid_index = d->sid_indexes[i];
 616
 617                         state->single_sids[state->num_single_sids] =
 618                                 res_sid_index;
 619                         state->num_single_sids += 1;
 620                 }
 621                 state->domains_done += 1;
 622                 wb_lookupsids_next(req, state);
 623                 return;
 624         }
 625
 626         /*
 627          * Look at the individual states in the translated names.
 628          */
 629
 630         sid_copy(&src_domain_sid, get_global_sam_sid());
 631         src_domain.name.string = get_global_sam_name();
 632         src_domain.sid = &src_domain_sid;
 633         src_domains.count = 1;
 634         src_domains.domains = &src_domain;
 635
 636         for (i=0; i<state->rid_names.num_principals; i++) {
 637                 struct lsa_TranslatedName src_name;
 638                 uint32_t res_sid_index;
 639
 640                 /*
 641                  * Fake up structs for wb_lookupsids_move_name
 642                  */
 643                 res_sid_index = d->sid_indexes[i];
 644
 645                 src_name.sid_type = state->rid_names.principals[i].type;
 646                 src_name.name.string = state->rid_names.principals[i].name;
 647                 src_name.sid_index = 0;
 648
 649                 if (!wb_lookupsids_move_name(
 650                             &src_domains, &src_name,
 651                             state->res_domains, state->res_names,
 652                             res_sid_index)) {
 653                         tevent_req_oom(req);
 654                         return;
 655                 }
 656         }
 657
 658         state->domains_done += 1;
 659         wb_lookupsids_next(req, state);
 660 }
 661
 662 NTSTATUS wb_lookupsids_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
 663                             struct lsa_RefDomainList **domains,
 664                             struct lsa_TransNameArray **names)
 665 {
 666         struct wb_lookupsids_state *state = tevent_req_data(
 667                 req, struct wb_lookupsids_state);
 668         NTSTATUS status;
 669
 670         if (tevent_req_is_nterror(req, &status)) {
 671                 return status;
 672         }
 673
 674         /*
 675          * The returned names need to match the given sids,
 676          * if not we have a bug in the code!
 677          *
 678          */
 679         if (state->res_names->count != state->num_sids) {
 680                 DEBUG(0, ("res_names->count = %d, expected %d\n",
 681                           state->res_names->count, state->num_sids));
 682                 return NT_STATUS_INTERNAL_ERROR;
 683         }
 684
 685         /*
 686          * Not strictly needed, but it might make debugging in the callers
 687          * easier in future, if the talloc_array_length() returns the
 688          * expected result...
 689          */
 690         state->res_domains->domains = talloc_realloc(state->res_domains,
 691                                                      state->res_domains->domains,
 692                                                      struct lsa_DomainInfo,
 693                                                      state->res_domains->count);
 694
 695         *domains = talloc_move(mem_ctx, &state->res_domains);
 696         *names = talloc_move(mem_ctx, &state->res_names);
 697         return NT_STATUS_OK;
 698 }