source4/dsdb/common/util_samr.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Helpers to add users and groups to the DB
   5
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Volker Lendecke 2004
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2010
   9    Copyright (C) Matthias Dieter Wallnöfer 2009
  10
  11    This program is free software; you can redistribute it and/or modify
  12    it under the terms of the GNU General Public License as published by
  13    the Free Software Foundation; either version 3 of the License, or
  14    (at your option) any later version.
  15
  16    This program is distributed in the hope that it will be useful,
  17    but WITHOUT ANY WARRANTY; without even the implied warranty of
  18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19    GNU General Public License for more details.
  20
  21    You should have received a copy of the GNU General Public License
  22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  23 */
  24
  25 #include "includes.h"
  26 #include "dsdb/samdb/samdb.h"
  27 #include "dsdb/common/util.h"
  28 #include "../libds/common/flags.h"
  29 #include "libcli/security/security.h"
  30
  31 #include "libds/common/flag_mapping.h"
  32
  33 /* Add a user, SAMR style, including the correct transaction
  34  * semantics.  Used by the SAMR server and by pdb_samba4 */
  35 NTSTATUS dsdb_add_user(struct ldb_context *ldb,
  36                        TALLOC_CTX *mem_ctx,
  37                        const char *account_name,
  38                        uint32_t acct_flags,
  39                        const struct dom_sid *forced_sid,
  40                        struct dom_sid **sid,
  41                        struct ldb_dn **dn)
  42 {
  43         const char *name;
  44         struct ldb_message *msg;
  45         int ret;
  46         const char *container, *obj_class=NULL;
  47         char *cn_name;
  48         size_t cn_name_len;
  49
  50         const char *attrs[] = {
  51                 "objectSid",
  52                 "userAccountControl",
  53                 NULL
  54         };
  55
  56         uint32_t user_account_control;
  57         struct ldb_dn *account_dn;
  58         struct dom_sid *account_sid;
  59
  60         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
  61         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
  62
  63         /*
  64          * Start a transaction, so we can query and do a subsequent atomic
  65          * modify
  66          */
  67
  68         ret = ldb_transaction_start(ldb);
  69         if (ret != LDB_SUCCESS) {
  70                 DEBUG(0,("Failed to start a transaction for user creation: %s\n",
  71                          ldb_errstring(ldb)));
  72                 talloc_free(tmp_ctx);
  73                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
  74         }
  75
  76         /* check if the user already exists */
  77         name = samdb_search_string(ldb, tmp_ctx, NULL,
  78                                    "sAMAccountName",
  79                                    "(&(sAMAccountName=%s)(objectclass=user))",
  80                                    ldb_binary_encode_string(tmp_ctx, account_name));
  81         if (name != NULL) {
  82                 ldb_transaction_cancel(ldb);
  83                 talloc_free(tmp_ctx);
  84                 return NT_STATUS_USER_EXISTS;
  85         }
  86
  87         cn_name = talloc_strdup(tmp_ctx, account_name);
  88         if (!cn_name) {
  89                 ldb_transaction_cancel(ldb);
  90                 talloc_free(tmp_ctx);
  91                 return NT_STATUS_NO_MEMORY;
  92         }
  93
  94         cn_name_len = strlen(cn_name);
  95         if (cn_name_len < 1) {
  96                 ldb_transaction_cancel(ldb);
  97                 talloc_free(tmp_ctx);
  98                 return NT_STATUS_INVALID_PARAMETER;
  99         }
 100
 101         msg = ldb_msg_new(tmp_ctx);
 102         if (msg == NULL) {
 103                 ldb_transaction_cancel(ldb);
 104                 talloc_free(tmp_ctx);
 105                 return NT_STATUS_NO_MEMORY;
 106         }
 107
 108         /* This must be one of these values *only* */
 109         if (acct_flags == ACB_NORMAL) {
 110                 container = "CN=Users";
 111                 obj_class = "user";
 112
 113         } else if (acct_flags == ACB_WSTRUST) {
 114                 if (cn_name[cn_name_len - 1] != '$') {
 115                         ldb_transaction_cancel(ldb);
 116                         return NT_STATUS_FOOBAR;
 117                 }
 118                 cn_name[cn_name_len - 1] = '\0';
 119                 container = "CN=Computers";
 120                 obj_class = "computer";
 121
 122         } else if (acct_flags == ACB_SVRTRUST) {
 123                 if (cn_name[cn_name_len - 1] != '$') {
 124                         ldb_transaction_cancel(ldb);
 125                         return NT_STATUS_FOOBAR;
 126                 }
 127                 cn_name[cn_name_len - 1] = '\0';
 128                 container = "OU=Domain Controllers";
 129                 obj_class = "computer";
 130         } else {
 131                 ldb_transaction_cancel(ldb);
 132                 talloc_free(tmp_ctx);
 133                 return NT_STATUS_INVALID_PARAMETER;
 134         }
 135
 136         /* add core elements to the ldb_message for the user */
 137         msg->dn = ldb_dn_copy(msg, ldb_get_default_basedn(ldb));
 138         if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s,%s", cn_name, container)) {
 139                 ldb_transaction_cancel(ldb);
 140                 talloc_free(tmp_ctx);
 141                 return NT_STATUS_FOOBAR;
 142         }
 143
 144         ldb_msg_add_string(msg, "sAMAccountName", account_name);
 145         ldb_msg_add_string(msg, "objectClass", obj_class);
 146
 147         /* This is only here for migrations using pdb_samba4, the
 148          * caller and the samldb are responsible for ensuring it makes
 149          * sense */
 150         if (forced_sid) {
 151                 ret = samdb_msg_add_dom_sid(ldb, msg, msg, "objectSID", forced_sid);
 152                 if (ret != LDB_SUCCESS) {
 153                         ldb_transaction_cancel(ldb);
 154                         talloc_free(tmp_ctx);
 155                         return NT_STATUS_INTERNAL_ERROR;
 156                 }
 157         }
 158
 159         /* create the user */
 160         ret = ldb_add(ldb, msg);
 161         switch (ret) {
 162         case LDB_SUCCESS:
 163                 break;
 164         case LDB_ERR_ENTRY_ALREADY_EXISTS:
 165                 ldb_transaction_cancel(ldb);
 166                 DEBUG(0,("Failed to create user record %s: %s\n",
 167                          ldb_dn_get_linearized(msg->dn),
 168                          ldb_errstring(ldb)));
 169                 talloc_free(tmp_ctx);
 170                 return NT_STATUS_USER_EXISTS;
 171         case LDB_ERR_UNWILLING_TO_PERFORM:
 172         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
 173                 ldb_transaction_cancel(ldb);
 174                 DEBUG(0,("Failed to create user record %s: %s\n",
 175                          ldb_dn_get_linearized(msg->dn),
 176                          ldb_errstring(ldb)));
 177                 talloc_free(tmp_ctx);
 178                 return NT_STATUS_ACCESS_DENIED;
 179         default:
 180                 ldb_transaction_cancel(ldb);
 181                 DEBUG(0,("Failed to create user record %s: %s\n",
 182                          ldb_dn_get_linearized(msg->dn),
 183                          ldb_errstring(ldb)));
 184                 talloc_free(tmp_ctx);
 185                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 186         }
 187
 188         account_dn = msg->dn;
 189
 190         /* retrieve the sid and account control bits for the user just created */
 191         ret = dsdb_search_one(ldb, tmp_ctx, &msg,
 192                               account_dn, LDB_SCOPE_BASE, attrs, 0, NULL);
 193
 194         if (ret != LDB_SUCCESS) {
 195                 ldb_transaction_cancel(ldb);
 196                 DEBUG(0,("Can't locate the account we just created %s: %s\n",
 197                          ldb_dn_get_linearized(account_dn), ldb_errstring(ldb)));
 198                 talloc_free(tmp_ctx);
 199                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 200         }
 201         account_sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
 202         if (account_sid == NULL) {
 203                 ldb_transaction_cancel(ldb);
 204                 DEBUG(0,("Apparently we failed to get the objectSid of the just created account record %s\n",
 205                          ldb_dn_get_linearized(msg->dn)));
 206                 talloc_free(tmp_ctx);
 207                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 208         }
 209
 210         /* Change the account control to be the correct account type.
 211          * The default is for a workstation account */
 212         user_account_control = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
 213         user_account_control = (user_account_control &
 214                                 ~(UF_NORMAL_ACCOUNT |
 215                                   UF_INTERDOMAIN_TRUST_ACCOUNT |
 216                                   UF_WORKSTATION_TRUST_ACCOUNT |
 217                                   UF_SERVER_TRUST_ACCOUNT));
 218         user_account_control |= ds_acb2uf(acct_flags);
 219
 220         talloc_free(msg);
 221         msg = ldb_msg_new(tmp_ctx);
 222         if (msg == NULL) {
 223                 ldb_transaction_cancel(ldb);
 224                 talloc_free(tmp_ctx);
 225                 return NT_STATUS_NO_MEMORY;
 226         }
 227
 228         msg->dn = account_dn;
 229
 230         if (samdb_msg_add_uint(ldb, tmp_ctx, msg,
 231                                "userAccountControl",
 232                                user_account_control) != LDB_SUCCESS) {
 233                 ldb_transaction_cancel(ldb);
 234                 talloc_free(tmp_ctx);
 235                 return NT_STATUS_NO_MEMORY;
 236         }
 237
 238         /* modify the samdb record */
 239         ret = dsdb_replace(ldb, msg, 0);
 240         if (ret != LDB_SUCCESS) {
 241                 DEBUG(0,("Failed to modify account record %s to set userAccountControl: %s\n",
 242                          ldb_dn_get_linearized(msg->dn),
 243                          ldb_errstring(ldb)));
 244                 ldb_transaction_cancel(ldb);
 245                 talloc_free(tmp_ctx);
 246
 247                 /* we really need samdb.c to return NTSTATUS */
 248                 return NT_STATUS_UNSUCCESSFUL;
 249         }
 250
 251         ret = ldb_transaction_commit(ldb);
 252         if (ret != LDB_SUCCESS) {
 253                 DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
 254                          ldb_dn_get_linearized(msg->dn),
 255                          ldb_errstring(ldb)));
 256                 talloc_free(tmp_ctx);
 257                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 258         }
 259         *dn = talloc_steal(mem_ctx, account_dn);
 260         if (sid) {
 261                 *sid = talloc_steal(mem_ctx, account_sid);
 262         }
 263         talloc_free(tmp_ctx);
 264         return NT_STATUS_OK;
 265 }
 266
 267 /*
 268   called by samr_CreateDomainGroup and pdb_samba4
 269 */
 270 NTSTATUS dsdb_add_domain_group(struct ldb_context *ldb,
 271                                TALLOC_CTX *mem_ctx,
 272                                const char *groupname,
 273                                struct dom_sid **sid,
 274                                struct ldb_dn **dn)
 275 {
 276         const char *name;
 277         struct ldb_message *msg;
 278         struct dom_sid *group_sid;
 279         int ret;
 280
 281         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 282         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 283
 284         /* check if the group already exists */
 285         name = samdb_search_string(ldb, tmp_ctx, NULL,
 286                                    "sAMAccountName",
 287                                    "(&(sAMAccountName=%s)(objectclass=group))",
 288                                    ldb_binary_encode_string(tmp_ctx, groupname));
 289         if (name != NULL) {
 290                 return NT_STATUS_GROUP_EXISTS;
 291         }
 292
 293         msg = ldb_msg_new(tmp_ctx);
 294         if (msg == NULL) {
 295                 return NT_STATUS_NO_MEMORY;
 296         }
 297
 298         /* add core elements to the ldb_message for the user */
 299         msg->dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(ldb));
 300         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", groupname);
 301         if (!msg->dn) {
 302                 talloc_free(tmp_ctx);
 303                 return NT_STATUS_NO_MEMORY;
 304         }
 305         ldb_msg_add_string(msg, "sAMAccountName", groupname);
 306         ldb_msg_add_string(msg, "objectClass", "group");
 307
 308         /* create the group */
 309         ret = ldb_add(ldb, msg);
 310         switch (ret) {
 311         case  LDB_SUCCESS:
 312                 break;
 313         case  LDB_ERR_ENTRY_ALREADY_EXISTS:
 314                 DEBUG(0,("Failed to create group record %s: %s\n",
 315                          ldb_dn_get_linearized(msg->dn),
 316                          ldb_errstring(ldb)));
 317                 talloc_free(tmp_ctx);
 318                 return NT_STATUS_GROUP_EXISTS;
 319         case  LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
 320                 DEBUG(0,("Failed to create group record %s: %s\n",
 321                          ldb_dn_get_linearized(msg->dn),
 322                          ldb_errstring(ldb)));
 323                 talloc_free(tmp_ctx);
 324                 return NT_STATUS_ACCESS_DENIED;
 325         default:
 326                 DEBUG(0,("Failed to create group record %s: %s\n",
 327                          ldb_dn_get_linearized(msg->dn),
 328                          ldb_errstring(ldb)));
 329                 talloc_free(tmp_ctx);
 330                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 331         }
 332
 333         /* retrieve the sid for the group just created */
 334         group_sid = samdb_search_dom_sid(ldb, tmp_ctx,
 335                                          msg->dn, "objectSid", NULL);
 336         if (group_sid == NULL) {
 337                 return NT_STATUS_UNSUCCESSFUL;
 338         }
 339
 340         *dn = talloc_steal(mem_ctx, msg->dn);
 341         *sid = talloc_steal(mem_ctx, group_sid);
 342         talloc_free(tmp_ctx);
 343         return NT_STATUS_OK;
 344 }
 345
 346 NTSTATUS dsdb_add_domain_alias(struct ldb_context *ldb,
 347                                TALLOC_CTX *mem_ctx,
 348                                const char *alias_name,
 349                                struct dom_sid **sid,
 350                                struct ldb_dn **dn)
 351 {
 352         const char *name;
 353         struct ldb_message *msg;
 354         struct dom_sid *alias_sid;
 355         int ret;
 356
 357         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 358         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 359
 360         if (ldb_transaction_start(ldb) != LDB_SUCCESS) {
 361                 DEBUG(0, ("Failed to start transaction in dsdb_add_domain_alias(): %s\n", ldb_errstring(ldb)));
 362                 return NT_STATUS_INTERNAL_ERROR;
 363         }
 364
 365         /* Check if alias already exists */
 366         name = samdb_search_string(ldb, tmp_ctx, NULL,
 367                                    "sAMAccountName",
 368                                    "(sAMAccountName=%s)(objectclass=group))",
 369                                    ldb_binary_encode_string(mem_ctx, alias_name));
 370
 371         if (name != NULL) {
 372                 talloc_free(tmp_ctx);
 373                 ldb_transaction_cancel(ldb);
 374                 return NT_STATUS_ALIAS_EXISTS;
 375         }
 376
 377         msg = ldb_msg_new(tmp_ctx);
 378         if (msg == NULL) {
 379                 talloc_free(tmp_ctx);
 380                 ldb_transaction_cancel(ldb);
 381                 return NT_STATUS_NO_MEMORY;
 382         }
 383
 384         /* add core elements to the ldb_message for the alias */
 385         msg->dn = ldb_dn_copy(mem_ctx, ldb_get_default_basedn(ldb));
 386         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", alias_name);
 387         if (!msg->dn) {
 388                 talloc_free(tmp_ctx);
 389                 ldb_transaction_cancel(ldb);
 390                 return NT_STATUS_NO_MEMORY;
 391         }
 392
 393         ldb_msg_add_string(msg, "sAMAccountName", alias_name);
 394         ldb_msg_add_string(msg, "objectClass", "group");
 395         samdb_msg_add_int(ldb, mem_ctx, msg, "groupType", GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
 396
 397         /* create the alias */
 398         ret = ldb_add(ldb, msg);
 399         switch (ret) {
 400         case LDB_SUCCESS:
 401                 break;
 402         case LDB_ERR_ENTRY_ALREADY_EXISTS:
 403                 talloc_free(tmp_ctx);
 404                 ldb_transaction_cancel(ldb);
 405                 return NT_STATUS_ALIAS_EXISTS;
 406         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
 407                 talloc_free(tmp_ctx);
 408                 ldb_transaction_cancel(ldb);
 409                 return NT_STATUS_ACCESS_DENIED;
 410         default:
 411                 DEBUG(0,("Failed to create alias record %s: %s\n",
 412                          ldb_dn_get_linearized(msg->dn),
 413                          ldb_errstring(ldb)));
 414                 talloc_free(tmp_ctx);
 415                 ldb_transaction_cancel(ldb);
 416                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 417         }
 418
 419         /* retrieve the sid for the alias just created */
 420         alias_sid = samdb_search_dom_sid(ldb, tmp_ctx,
 421                                          msg->dn, "objectSid", NULL);
 422
 423         if (ldb_transaction_commit(ldb) != LDB_SUCCESS) {
 424                 DEBUG(0, ("Failed to commit transaction in dsdb_add_domain_alias(): %s\n",
 425                           ldb_errstring(ldb)));
 426                 return NT_STATUS_INTERNAL_ERROR;
 427         }
 428
 429         *dn = talloc_steal(mem_ctx, msg->dn);
 430         *sid = talloc_steal(mem_ctx, alias_sid);
 431         talloc_free(tmp_ctx);
 432
 433
 434         return NT_STATUS_OK;
 435 }
 436
 437 /* Return the members of this group (which may be a domain group or an alias) */
 438 NTSTATUS dsdb_enum_group_mem(struct ldb_context *ldb,
 439                              TALLOC_CTX *mem_ctx,
 440                              struct ldb_dn *dn,
 441                              struct dom_sid **members_out,
 442                              unsigned int *pnum_members)
 443 {
 444         struct ldb_message *msg;
 445         unsigned int i, j;
 446         int ret;
 447         struct dom_sid *members;
 448         struct ldb_message_element *member_el;
 449         const char *attrs[] = { "member", NULL };
 450         NTSTATUS status;
 451         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 452         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 453
 454         ret = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs,
 455                               DSDB_SEARCH_SHOW_EXTENDED_DN, NULL);
 456         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 457                 talloc_free(tmp_ctx);
 458                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
 459         }
 460         if (ret != LDB_SUCCESS) {
 461                 DEBUG(1, ("dsdb_enum_group_mem: dsdb_search for %s failed: %s\n",
 462                           ldb_dn_get_linearized(dn), ldb_errstring(ldb)));
 463                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 464         }
 465
 466         member_el = ldb_msg_find_element(msg, "member");
 467         if (!member_el) {
 468                 *members_out = NULL;
 469                 *pnum_members = 0;
 470                 talloc_free(tmp_ctx);
 471                 return NT_STATUS_OK;
 472         }
 473
 474         members = talloc_array(mem_ctx, struct dom_sid, member_el->num_values);
 475         if (members == NULL) {
 476                 return NT_STATUS_NO_MEMORY;
 477         }
 478
 479         j = 0;
 480         for (i=0; i <member_el->num_values; i++) {
 481                 struct ldb_dn *member_dn = ldb_dn_from_ldb_val(tmp_ctx, ldb,
 482                                                                &member_el->values[i]);
 483                 if (!member_dn || !ldb_dn_validate(member_dn)) {
 484                         DEBUG(1, ("Could not parse %*.*s as a DN\n",
 485                                   (int)member_el->values[i].length,
 486                                   (int)member_el->values[i].length,
 487                                   (const char *)member_el->values[i].data));
 488                         talloc_free(tmp_ctx);
 489                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 490                 }
 491
 492                 status = dsdb_get_extended_dn_sid(member_dn, &members[j],
 493                                                   "SID");
 494                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
 495                         /* If we fail finding a SID then this is no error since
 496                          * it could be a non SAM object - e.g. a contact */
 497                         continue;
 498                 } else if (!NT_STATUS_IS_OK(status)) {
 499                         DEBUG(1, ("When parsing DN '%s' we failed to parse it's SID component, so we cannot fetch the membership: %s\n",
 500                                   ldb_dn_get_extended_linearized(tmp_ctx, member_dn, 1),
 501                                   nt_errstr(status)));
 502                         talloc_free(tmp_ctx);
 503                         return status;
 504                 }
 505
 506                 ++j;
 507         }
 508
 509         *members_out = talloc_steal(mem_ctx, members);
 510         *pnum_members = j;
 511         talloc_free(tmp_ctx);
 512         return NT_STATUS_OK;
 513 }
 514
 515 NTSTATUS dsdb_lookup_rids(struct ldb_context *ldb,
 516                           TALLOC_CTX *mem_ctx,
 517                           const struct dom_sid *domain_sid,
 518                           unsigned int num_rids,
 519                           uint32_t *rids,
 520                           const char **names,
 521                           enum lsa_SidType *lsa_attrs)
 522 {
 523         const char *attrs[] = { "sAMAccountType", "sAMAccountName", NULL };
 524         unsigned int i, num_mapped;
 525
 526         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 527         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 528
 529         num_mapped = 0;
 530
 531         for (i=0; i<num_rids; i++) {
 532                 struct ldb_message *msg;
 533                 struct ldb_dn *dn;
 534                 uint32_t attr;
 535                 int rc;
 536
 537                 lsa_attrs[i] = SID_NAME_UNKNOWN;
 538
 539                 dn = ldb_dn_new_fmt(tmp_ctx, ldb, "<SID=%s>",
 540                                     dom_sid_string(tmp_ctx,
 541                                                    dom_sid_add_rid(tmp_ctx, domain_sid,
 542                                                                    rids[i])));
 543                 if (dn == NULL) {
 544                         talloc_free(tmp_ctx);
 545                         return NT_STATUS_NO_MEMORY;
 546                 }
 547                 rc = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "samAccountName=*");
 548                 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
 549                         continue;
 550                 } else if (rc != LDB_SUCCESS) {
 551                         talloc_free(tmp_ctx);
 552                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 553                 }
 554
 555                 names[i] = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
 556                 if (names[i] == NULL) {
 557                         DEBUG(10, ("no samAccountName\n"));
 558                         continue;
 559                 }
 560                 talloc_steal(names, names[i]);
 561                 attr = ldb_msg_find_attr_as_uint(msg, "samAccountType", 0);
 562                 lsa_attrs[i] = ds_atype_map(attr);
 563                 if (lsa_attrs[i] == SID_NAME_UNKNOWN) {
 564                         continue;
 565                 }
 566                 num_mapped += 1;
 567         }
 568         talloc_free(tmp_ctx);
 569
 570         if (num_mapped == 0) {
 571                 return NT_STATUS_NONE_MAPPED;
 572         }
 573         if (num_mapped < num_rids) {
 574                 return STATUS_SOME_UNMAPPED;
 575         }
 576         return NT_STATUS_OK;
 577 }
 578