s4-dsdb Print clearer error messages when invalid account flags are specified on add
[amitay/samba.git] / source4 / dsdb / common / util_samr.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Helpers to add users and groups to the DB
5
6    Copyright (C) Andrew Tridgell 2004
7    Copyright (C) Volker Lendecke 2004
8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2010
9    Copyright (C) Matthias Dieter Wallnöfer 2009
10
11    This program is free software; you can redistribute it and/or modify
12    it under the terms of the GNU General Public License as published by
13    the Free Software Foundation; either version 3 of the License, or
14    (at your option) any later version.
15
16    This program is distributed in the hope that it will be useful,
17    but WITHOUT ANY WARRANTY; without even the implied warranty of
18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19    GNU General Public License for more details.
20
21    You should have received a copy of the GNU General Public License
22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "dsdb/common/util.h"
28 #include "../libds/common/flags.h"
29 #include "libcli/security/security.h"
30
31 #include "libds/common/flag_mapping.h"
32
33 /* Add a user, SAMR style, including the correct transaction
34  * semantics.  Used by the SAMR server and by pdb_samba4 */
35 NTSTATUS dsdb_add_user(struct ldb_context *ldb,
36                        TALLOC_CTX *mem_ctx,
37                        const char *account_name,
38                        uint32_t acct_flags,
39                        const struct dom_sid *forced_sid,
40                        struct dom_sid **sid,
41                        struct ldb_dn **dn)
42 {
43         const char *name;
44         struct ldb_message *msg;
45         int ret;
46         const char *container, *obj_class=NULL;
47         char *cn_name;
48         size_t cn_name_len;
49
50         const char *attrs[] = {
51                 "objectSid",
52                 "userAccountControl",
53                 NULL
54         };
55
56         uint32_t user_account_control;
57         struct ldb_dn *account_dn;
58         struct dom_sid *account_sid;
59
60         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
61         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
62
63         /*
64          * Start a transaction, so we can query and do a subsequent atomic
65          * modify
66          */
67
68         ret = ldb_transaction_start(ldb);
69         if (ret != LDB_SUCCESS) {
70                 DEBUG(0,("Failed to start a transaction for user creation: %s\n",
71                          ldb_errstring(ldb)));
72                 talloc_free(tmp_ctx);
73                 return NT_STATUS_LOCK_NOT_GRANTED;
74         }
75
76         /* check if the user already exists */
77         name = samdb_search_string(ldb, tmp_ctx, NULL,
78                                    "sAMAccountName",
79                                    "(&(sAMAccountName=%s)(objectclass=user))",
80                                    ldb_binary_encode_string(tmp_ctx, account_name));
81         if (name != NULL) {
82                 ldb_transaction_cancel(ldb);
83                 talloc_free(tmp_ctx);
84                 return NT_STATUS_USER_EXISTS;
85         }
86
87         cn_name = talloc_strdup(tmp_ctx, account_name);
88         if (!cn_name) {
89                 ldb_transaction_cancel(ldb);
90                 talloc_free(tmp_ctx);
91                 return NT_STATUS_NO_MEMORY;
92         }
93
94         cn_name_len = strlen(cn_name);
95         if (cn_name_len < 1) {
96                 ldb_transaction_cancel(ldb);
97                 talloc_free(tmp_ctx);
98                 return NT_STATUS_INVALID_PARAMETER;
99         }
100
101         msg = ldb_msg_new(tmp_ctx);
102         if (msg == NULL) {
103                 ldb_transaction_cancel(ldb);
104                 talloc_free(tmp_ctx);
105                 return NT_STATUS_NO_MEMORY;
106         }
107
108         /* This must be one of these values *only* */
109         if (acct_flags == ACB_NORMAL) {
110                 container = "CN=Users";
111                 obj_class = "user";
112
113         } else if (acct_flags == ACB_WSTRUST) {
114                 if (cn_name[cn_name_len - 1] != '$') {
115                         ldb_transaction_cancel(ldb);
116                         return NT_STATUS_FOOBAR;
117                 }
118                 cn_name[cn_name_len - 1] = '\0';
119                 container = "CN=Computers";
120                 obj_class = "computer";
121
122         } else if (acct_flags == ACB_SVRTRUST) {
123                 if (cn_name[cn_name_len - 1] != '$') {
124                         ldb_transaction_cancel(ldb);
125                         return NT_STATUS_FOOBAR;
126                 }
127                 cn_name[cn_name_len - 1] = '\0';
128                 container = "OU=Domain Controllers";
129                 obj_class = "computer";
130         } else if (acct_flags == ACB_DOMTRUST) {
131                 DEBUG(3, ("Invalid account flags specified:  cannot create domain trusts via this interface (must use LSA CreateTrustedDomain calls\n"));
132                 ldb_transaction_cancel(ldb);
133                 talloc_free(tmp_ctx);
134                 return NT_STATUS_INVALID_PARAMETER;
135         } else {
136                 DEBUG(3, ("Invalid account flags specified 0x%08X, must be exactly one of \n"
137                           "ACB_NORMAL (0x%08X) ACB_WSTRUST (0x%08X) or ACB_SVRTRUST (0x%08X)\n",
138                           acct_flags,
139                           ACB_NORMAL, ACB_WSTRUST, ACB_SVRTRUST));
140                 ldb_transaction_cancel(ldb);
141                 talloc_free(tmp_ctx);
142                 return NT_STATUS_INVALID_PARAMETER;
143         }
144
145         /* add core elements to the ldb_message for the user */
146         msg->dn = ldb_dn_copy(msg, ldb_get_default_basedn(ldb));
147         if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s,%s", cn_name, container)) {
148                 ldb_transaction_cancel(ldb);
149                 talloc_free(tmp_ctx);
150                 return NT_STATUS_FOOBAR;
151         }
152
153         ldb_msg_add_string(msg, "sAMAccountName", account_name);
154         ldb_msg_add_string(msg, "objectClass", obj_class);
155
156         /* This is only here for migrations using pdb_samba4, the
157          * caller and the samldb are responsible for ensuring it makes
158          * sense */
159         if (forced_sid) {
160                 ret = samdb_msg_add_dom_sid(ldb, msg, msg, "objectSID", forced_sid);
161                 if (ret != LDB_SUCCESS) {
162                         ldb_transaction_cancel(ldb);
163                         talloc_free(tmp_ctx);
164                         return NT_STATUS_INTERNAL_ERROR;
165                 }
166         }
167
168         /* create the user */
169         ret = ldb_add(ldb, msg);
170         switch (ret) {
171         case LDB_SUCCESS:
172                 break;
173         case LDB_ERR_ENTRY_ALREADY_EXISTS:
174                 ldb_transaction_cancel(ldb);
175                 DEBUG(0,("Failed to create user record %s: %s\n",
176                          ldb_dn_get_linearized(msg->dn),
177                          ldb_errstring(ldb)));
178                 talloc_free(tmp_ctx);
179                 return NT_STATUS_USER_EXISTS;
180         case LDB_ERR_UNWILLING_TO_PERFORM:
181         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
182                 ldb_transaction_cancel(ldb);
183                 DEBUG(0,("Failed to create user record %s: %s\n",
184                          ldb_dn_get_linearized(msg->dn),
185                          ldb_errstring(ldb)));
186                 talloc_free(tmp_ctx);
187                 return NT_STATUS_ACCESS_DENIED;
188         default:
189                 ldb_transaction_cancel(ldb);
190                 DEBUG(0,("Failed to create user record %s: %s\n",
191                          ldb_dn_get_linearized(msg->dn),
192                          ldb_errstring(ldb)));
193                 talloc_free(tmp_ctx);
194                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
195         }
196
197         account_dn = msg->dn;
198
199         /* retrieve the sid and account control bits for the user just created */
200         ret = dsdb_search_one(ldb, tmp_ctx, &msg,
201                               account_dn, LDB_SCOPE_BASE, attrs, 0, NULL);
202
203         if (ret != LDB_SUCCESS) {
204                 ldb_transaction_cancel(ldb);
205                 DEBUG(0,("Can't locate the account we just created %s: %s\n",
206                          ldb_dn_get_linearized(account_dn), ldb_errstring(ldb)));
207                 talloc_free(tmp_ctx);
208                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
209         }
210         account_sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
211         if (account_sid == NULL) {
212                 ldb_transaction_cancel(ldb);
213                 DEBUG(0,("Apparently we failed to get the objectSid of the just created account record %s\n",
214                          ldb_dn_get_linearized(msg->dn)));
215                 talloc_free(tmp_ctx);
216                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
217         }
218
219         /* Change the account control to be the correct account type.
220          * The default is for a workstation account */
221         user_account_control = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
222         user_account_control = (user_account_control &
223                                 ~(UF_NORMAL_ACCOUNT |
224                                   UF_INTERDOMAIN_TRUST_ACCOUNT |
225                                   UF_WORKSTATION_TRUST_ACCOUNT |
226                                   UF_SERVER_TRUST_ACCOUNT));
227         user_account_control |= ds_acb2uf(acct_flags);
228
229         talloc_free(msg);
230         msg = ldb_msg_new(tmp_ctx);
231         if (msg == NULL) {
232                 ldb_transaction_cancel(ldb);
233                 talloc_free(tmp_ctx);
234                 return NT_STATUS_NO_MEMORY;
235         }
236
237         msg->dn = account_dn;
238
239         if (samdb_msg_add_uint(ldb, tmp_ctx, msg,
240                                "userAccountControl",
241                                user_account_control) != LDB_SUCCESS) {
242                 ldb_transaction_cancel(ldb);
243                 talloc_free(tmp_ctx);
244                 return NT_STATUS_NO_MEMORY;
245         }
246
247         /* modify the samdb record */
248         ret = dsdb_replace(ldb, msg, 0);
249         if (ret != LDB_SUCCESS) {
250                 DEBUG(0,("Failed to modify account record %s to set userAccountControl: %s\n",
251                          ldb_dn_get_linearized(msg->dn),
252                          ldb_errstring(ldb)));
253                 ldb_transaction_cancel(ldb);
254                 talloc_free(tmp_ctx);
255
256                 /* we really need samdb.c to return NTSTATUS */
257                 return NT_STATUS_UNSUCCESSFUL;
258         }
259
260         ret = ldb_transaction_commit(ldb);
261         if (ret != LDB_SUCCESS) {
262                 DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
263                          ldb_dn_get_linearized(msg->dn),
264                          ldb_errstring(ldb)));
265                 talloc_free(tmp_ctx);
266                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
267         }
268         *dn = talloc_steal(mem_ctx, account_dn);
269         if (sid) {
270                 *sid = talloc_steal(mem_ctx, account_sid);
271         }
272         talloc_free(tmp_ctx);
273         return NT_STATUS_OK;
274 }
275
276 /*
277   called by samr_CreateDomainGroup and pdb_samba4
278 */
279 NTSTATUS dsdb_add_domain_group(struct ldb_context *ldb,
280                                TALLOC_CTX *mem_ctx,
281                                const char *groupname,
282                                struct dom_sid **sid,
283                                struct ldb_dn **dn)
284 {
285         const char *name;
286         struct ldb_message *msg;
287         struct dom_sid *group_sid;
288         int ret;
289
290         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
291         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
292
293         /* check if the group already exists */
294         name = samdb_search_string(ldb, tmp_ctx, NULL,
295                                    "sAMAccountName",
296                                    "(&(sAMAccountName=%s)(objectclass=group))",
297                                    ldb_binary_encode_string(tmp_ctx, groupname));
298         if (name != NULL) {
299                 return NT_STATUS_GROUP_EXISTS;
300         }
301
302         msg = ldb_msg_new(tmp_ctx);
303         if (msg == NULL) {
304                 return NT_STATUS_NO_MEMORY;
305         }
306
307         /* add core elements to the ldb_message for the user */
308         msg->dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(ldb));
309         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", groupname);
310         if (!msg->dn) {
311                 talloc_free(tmp_ctx);
312                 return NT_STATUS_NO_MEMORY;
313         }
314         ldb_msg_add_string(msg, "sAMAccountName", groupname);
315         ldb_msg_add_string(msg, "objectClass", "group");
316
317         /* create the group */
318         ret = ldb_add(ldb, msg);
319         switch (ret) {
320         case  LDB_SUCCESS:
321                 break;
322         case  LDB_ERR_ENTRY_ALREADY_EXISTS:
323                 DEBUG(0,("Failed to create group record %s: %s\n",
324                          ldb_dn_get_linearized(msg->dn),
325                          ldb_errstring(ldb)));
326                 talloc_free(tmp_ctx);
327                 return NT_STATUS_GROUP_EXISTS;
328         case  LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
329                 DEBUG(0,("Failed to create group record %s: %s\n",
330                          ldb_dn_get_linearized(msg->dn),
331                          ldb_errstring(ldb)));
332                 talloc_free(tmp_ctx);
333                 return NT_STATUS_ACCESS_DENIED;
334         default:
335                 DEBUG(0,("Failed to create group record %s: %s\n",
336                          ldb_dn_get_linearized(msg->dn),
337                          ldb_errstring(ldb)));
338                 talloc_free(tmp_ctx);
339                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
340         }
341
342         /* retrieve the sid for the group just created */
343         group_sid = samdb_search_dom_sid(ldb, tmp_ctx,
344                                          msg->dn, "objectSid", NULL);
345         if (group_sid == NULL) {
346                 return NT_STATUS_UNSUCCESSFUL;
347         }
348
349         *dn = talloc_steal(mem_ctx, msg->dn);
350         *sid = talloc_steal(mem_ctx, group_sid);
351         talloc_free(tmp_ctx);
352         return NT_STATUS_OK;
353 }
354
355 NTSTATUS dsdb_add_domain_alias(struct ldb_context *ldb,
356                                TALLOC_CTX *mem_ctx,
357                                const char *alias_name,
358                                struct dom_sid **sid,
359                                struct ldb_dn **dn)
360 {
361         const char *name;
362         struct ldb_message *msg;
363         struct dom_sid *alias_sid;
364         int ret;
365
366         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
367         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
368
369         if (ldb_transaction_start(ldb) != LDB_SUCCESS) {
370                 DEBUG(0, ("Failed to start transaction in dsdb_add_domain_alias(): %s\n", ldb_errstring(ldb)));
371                 return NT_STATUS_INTERNAL_ERROR;
372         }
373
374         /* Check if alias already exists */
375         name = samdb_search_string(ldb, tmp_ctx, NULL,
376                                    "sAMAccountName",
377                                    "(sAMAccountName=%s)(objectclass=group))",
378                                    ldb_binary_encode_string(mem_ctx, alias_name));
379
380         if (name != NULL) {
381                 talloc_free(tmp_ctx);
382                 ldb_transaction_cancel(ldb);
383                 return NT_STATUS_ALIAS_EXISTS;
384         }
385
386         msg = ldb_msg_new(tmp_ctx);
387         if (msg == NULL) {
388                 talloc_free(tmp_ctx);
389                 ldb_transaction_cancel(ldb);
390                 return NT_STATUS_NO_MEMORY;
391         }
392
393         /* add core elements to the ldb_message for the alias */
394         msg->dn = ldb_dn_copy(mem_ctx, ldb_get_default_basedn(ldb));
395         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", alias_name);
396         if (!msg->dn) {
397                 talloc_free(tmp_ctx);
398                 ldb_transaction_cancel(ldb);
399                 return NT_STATUS_NO_MEMORY;
400         }
401
402         ldb_msg_add_string(msg, "sAMAccountName", alias_name);
403         ldb_msg_add_string(msg, "objectClass", "group");
404         samdb_msg_add_int(ldb, mem_ctx, msg, "groupType", GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
405
406         /* create the alias */
407         ret = ldb_add(ldb, msg);
408         switch (ret) {
409         case LDB_SUCCESS:
410                 break;
411         case LDB_ERR_ENTRY_ALREADY_EXISTS:
412                 talloc_free(tmp_ctx);
413                 ldb_transaction_cancel(ldb);
414                 return NT_STATUS_ALIAS_EXISTS;
415         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
416                 talloc_free(tmp_ctx);
417                 ldb_transaction_cancel(ldb);
418                 return NT_STATUS_ACCESS_DENIED;
419         default:
420                 DEBUG(0,("Failed to create alias record %s: %s\n",
421                          ldb_dn_get_linearized(msg->dn),
422                          ldb_errstring(ldb)));
423                 talloc_free(tmp_ctx);
424                 ldb_transaction_cancel(ldb);
425                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
426         }
427
428         /* retrieve the sid for the alias just created */
429         alias_sid = samdb_search_dom_sid(ldb, tmp_ctx,
430                                          msg->dn, "objectSid", NULL);
431
432         if (ldb_transaction_commit(ldb) != LDB_SUCCESS) {
433                 DEBUG(0, ("Failed to commit transaction in dsdb_add_domain_alias(): %s\n",
434                           ldb_errstring(ldb)));
435                 return NT_STATUS_INTERNAL_ERROR;
436         }
437
438         *dn = talloc_steal(mem_ctx, msg->dn);
439         *sid = talloc_steal(mem_ctx, alias_sid);
440         talloc_free(tmp_ctx);
441
442
443         return NT_STATUS_OK;
444 }
445
446 /* Return the members of this group (which may be a domain group or an alias) */
447 NTSTATUS dsdb_enum_group_mem(struct ldb_context *ldb,
448                              TALLOC_CTX *mem_ctx,
449                              struct ldb_dn *dn,
450                              struct dom_sid **members_out,
451                              unsigned int *pnum_members)
452 {
453         struct ldb_message *msg;
454         unsigned int i, j;
455         int ret;
456         struct dom_sid *members;
457         struct ldb_message_element *member_el;
458         const char *attrs[] = { "member", NULL };
459         NTSTATUS status;
460         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
461         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
462
463         ret = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs,
464                               DSDB_SEARCH_SHOW_EXTENDED_DN, NULL);
465         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
466                 talloc_free(tmp_ctx);
467                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
468         }
469         if (ret != LDB_SUCCESS) {
470                 DEBUG(1, ("dsdb_enum_group_mem: dsdb_search for %s failed: %s\n",
471                           ldb_dn_get_linearized(dn), ldb_errstring(ldb)));
472                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
473         }
474
475         member_el = ldb_msg_find_element(msg, "member");
476         if (!member_el) {
477                 *members_out = NULL;
478                 *pnum_members = 0;
479                 talloc_free(tmp_ctx);
480                 return NT_STATUS_OK;
481         }
482
483         members = talloc_array(mem_ctx, struct dom_sid, member_el->num_values);
484         if (members == NULL) {
485                 return NT_STATUS_NO_MEMORY;
486         }
487
488         j = 0;
489         for (i=0; i <member_el->num_values; i++) {
490                 struct ldb_dn *member_dn = ldb_dn_from_ldb_val(tmp_ctx, ldb,
491                                                                &member_el->values[i]);
492                 if (!member_dn || !ldb_dn_validate(member_dn)) {
493                         DEBUG(1, ("Could not parse %*.*s as a DN\n",
494                                   (int)member_el->values[i].length,
495                                   (int)member_el->values[i].length,
496                                   (const char *)member_el->values[i].data));
497                         talloc_free(tmp_ctx);
498                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
499                 }
500
501                 status = dsdb_get_extended_dn_sid(member_dn, &members[j],
502                                                   "SID");
503                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
504                         /* If we fail finding a SID then this is no error since
505                          * it could be a non SAM object - e.g. a contact */
506                         continue;
507                 } else if (!NT_STATUS_IS_OK(status)) {
508                         DEBUG(1, ("When parsing DN '%s' we failed to parse it's SID component, so we cannot fetch the membership: %s\n",
509                                   ldb_dn_get_extended_linearized(tmp_ctx, member_dn, 1),
510                                   nt_errstr(status)));
511                         talloc_free(tmp_ctx);
512                         return status;
513                 }
514
515                 ++j;
516         }
517
518         *members_out = talloc_steal(mem_ctx, members);
519         *pnum_members = j;
520         talloc_free(tmp_ctx);
521         return NT_STATUS_OK;
522 }
523
524 NTSTATUS dsdb_lookup_rids(struct ldb_context *ldb,
525                           TALLOC_CTX *mem_ctx,
526                           const struct dom_sid *domain_sid,
527                           unsigned int num_rids,
528                           uint32_t *rids,
529                           const char **names,
530                           enum lsa_SidType *lsa_attrs)
531 {
532         const char *attrs[] = { "sAMAccountType", "sAMAccountName", NULL };
533         unsigned int i, num_mapped;
534
535         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
536         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
537
538         num_mapped = 0;
539
540         for (i=0; i<num_rids; i++) {
541                 struct ldb_message *msg;
542                 struct ldb_dn *dn;
543                 uint32_t attr;
544                 int rc;
545
546                 lsa_attrs[i] = SID_NAME_UNKNOWN;
547
548                 dn = ldb_dn_new_fmt(tmp_ctx, ldb, "<SID=%s>",
549                                     dom_sid_string(tmp_ctx,
550                                                    dom_sid_add_rid(tmp_ctx, domain_sid,
551                                                                    rids[i])));
552                 if (dn == NULL) {
553                         talloc_free(tmp_ctx);
554                         return NT_STATUS_NO_MEMORY;
555                 }
556                 rc = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "samAccountName=*");
557                 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
558                         continue;
559                 } else if (rc != LDB_SUCCESS) {
560                         talloc_free(tmp_ctx);
561                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
562                 }
563
564                 names[i] = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
565                 if (names[i] == NULL) {
566                         DEBUG(10, ("no samAccountName\n"));
567                         continue;
568                 }
569                 talloc_steal(names, names[i]);
570                 attr = ldb_msg_find_attr_as_uint(msg, "samAccountType", 0);
571                 lsa_attrs[i] = ds_atype_map(attr);
572                 if (lsa_attrs[i] == SID_NAME_UNKNOWN) {
573                         continue;
574                 }
575                 num_mapped += 1;
576         }
577         talloc_free(tmp_ctx);
578
579         if (num_mapped == 0) {
580                 return NT_STATUS_NONE_MAPPED;
581         }
582         if (num_mapped < num_rids) {
583                 return STATUS_SOME_UNMAPPED;
584         }
585         return NT_STATUS_OK;
586 }
587