2 Unix SMB/CIFS implementation.
4 endpoint server for the lsarpc pipe
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "rpc_server/lsa/lsa.h"
34 .rtype = SID_NAME_WKN_GRP,
37 .name = "CREATOR OWNER",
38 .sid = SID_CREATOR_OWNER,
39 .rtype = SID_NAME_WKN_GRP,
42 .name = "CREATOR GROUP",
43 .sid = SID_CREATOR_GROUP,
44 .rtype = SID_NAME_WKN_GRP,
47 .name = "Owner Rights",
48 .sid = SID_OWNER_RIGHTS,
49 .rtype = SID_NAME_WKN_GRP,
52 .domain = "NT AUTHORITY",
55 .rtype = SID_NAME_WKN_GRP,
58 .domain = "NT AUTHORITY",
60 .sid = SID_NT_NETWORK,
61 .rtype = SID_NAME_WKN_GRP,
64 .domain = "NT AUTHORITY",
67 .rtype = SID_NAME_WKN_GRP,
70 .domain = "NT AUTHORITY",
71 .name = "Interactive",
72 .sid = SID_NT_INTERACTIVE,
73 .rtype = SID_NAME_WKN_GRP,
76 .domain = "NT AUTHORITY",
78 .sid = SID_NT_SERVICE,
79 .rtype = SID_NAME_WKN_GRP,
82 .domain = "NT AUTHORITY",
83 .name = "ANONYMOUS LOGON",
84 .sid = SID_NT_ANONYMOUS,
85 .rtype = SID_NAME_WKN_GRP,
88 .domain = "NT AUTHORITY",
91 .rtype = SID_NAME_WKN_GRP,
94 .domain = "NT AUTHORITY",
95 .name = "ServerLogon",
96 .sid = SID_NT_ENTERPRISE_DCS,
97 .rtype = SID_NAME_WKN_GRP,
100 .domain = "NT AUTHORITY",
103 .rtype = SID_NAME_WKN_GRP,
106 .domain = "NT AUTHORITY",
107 .name = "Authenticated Users",
108 .sid = SID_NT_AUTHENTICATED_USERS,
109 .rtype = SID_NAME_WKN_GRP,
112 .domain = "NT AUTHORITY",
113 .name = "Restricted",
114 .sid = SID_NT_RESTRICTED,
115 .rtype = SID_NAME_WKN_GRP,
118 .domain = "NT AUTHORITY",
119 .name = "Terminal Server User",
120 .sid = SID_NT_TERMINAL_SERVER_USERS,
121 .rtype = SID_NAME_WKN_GRP,
124 .domain = "NT AUTHORITY",
125 .name = "Remote Interactive Logon",
126 .sid = SID_NT_REMOTE_INTERACTIVE,
127 .rtype = SID_NAME_WKN_GRP,
130 .domain = "NT AUTHORITY",
131 .name = "This Organization",
132 .sid = SID_NT_THIS_ORGANISATION,
133 .rtype = SID_NAME_WKN_GRP,
136 .domain = "NT AUTHORITY",
138 .sid = SID_NT_SYSTEM,
139 .rtype = SID_NAME_WKN_GRP,
142 .domain = "NT AUTHORITY",
143 .name = "Local Service",
144 .sid = SID_NT_LOCAL_SERVICE,
145 .rtype = SID_NAME_WKN_GRP,
148 .domain = "NT AUTHORITY",
149 .name = "Network Service",
150 .sid = SID_NT_NETWORK_SERVICE,
151 .rtype = SID_NAME_WKN_GRP,
154 .domain = "NT AUTHORITY",
155 .name = "Digest Authentication",
156 .sid = SID_NT_DIGEST_AUTHENTICATION,
157 .rtype = SID_NAME_WKN_GRP,
160 .domain = "NT AUTHORITY",
161 .name = "Enterprise Domain Controllers",
162 .sid = SID_NT_ENTERPRISE_DCS,
163 .rtype = SID_NAME_WKN_GRP,
166 .domain = "NT AUTHORITY",
167 .name = "NTLM Authentication",
168 .sid = SID_NT_NTLM_AUTHENTICATION,
169 .rtype = SID_NAME_WKN_GRP,
172 .domain = "NT AUTHORITY",
173 .name = "Other Organization",
174 .sid = SID_NT_OTHER_ORGANISATION,
175 .rtype = SID_NAME_WKN_GRP,
178 .domain = "NT AUTHORITY",
179 .name = "SChannel Authentication",
180 .sid = SID_NT_SCHANNEL_AUTHENTICATION,
181 .rtype = SID_NAME_WKN_GRP,
184 .domain = "NT AUTHORITY",
187 .rtype = SID_NAME_WKN_GRP,
194 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
195 const char *name, const char **authority_name,
196 struct dom_sid **sid, uint32_t *rtype)
199 for (i=0; well_known[i].sid; i++) {
201 if (strcasecmp_m(domain, well_known[i].domain) == 0
202 && strcasecmp_m(name, well_known[i].name) == 0) {
203 *authority_name = well_known[i].domain;
204 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
205 *rtype = well_known[i].rtype;
209 if (strcasecmp_m(name, well_known[i].name) == 0) {
210 *authority_name = well_known[i].domain;
211 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
212 *rtype = well_known[i].rtype;
217 return NT_STATUS_NOT_FOUND;
220 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx,
221 const char *sid_str, const char **authority_name,
222 const char **name, uint32_t *rtype)
225 for (i=0; well_known[i].sid; i++) {
226 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
227 *authority_name = well_known[i].domain;
228 *name = well_known[i].name;
229 *rtype = well_known[i].rtype;
233 return NT_STATUS_NOT_FOUND;
237 lookup a SID for 1 name
239 static NTSTATUS dcesrv_lsa_lookup_name(struct event_context *ev_ctx,
240 struct loadparm_context *lp_ctx,
241 struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
242 const char *name, const char **authority_name,
243 struct dom_sid **sid, enum lsa_SidType *rtype)
246 struct ldb_message **res;
247 const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
250 const char *username;
251 struct ldb_dn *domain_dn;
252 struct dom_sid *domain_sid;
255 p = strchr_m(name, '\\');
257 domain = talloc_strndup(mem_ctx, name, p-name);
259 return NT_STATUS_NO_MEMORY;
262 } else if (strchr_m(name, '@')) {
263 status = crack_name_to_nt4_name(mem_ctx, ev_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
264 if (!NT_STATUS_IS_OK(status)) {
265 DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
274 /* Look up table of well known names */
275 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
276 if (NT_STATUS_IS_OK(status)) {
280 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) {
281 *authority_name = NAME_NT_AUTHORITY;
282 *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
283 *rtype = SID_NAME_DOMAIN;
286 if (strcasecmp_m(username, NAME_BUILTIN) == 0) {
287 *authority_name = NAME_BUILTIN;
288 *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
289 *rtype = SID_NAME_DOMAIN;
292 if (strcasecmp_m(username, state->domain_dns) == 0) {
293 *authority_name = state->domain_name;
294 *sid = state->domain_sid;
295 *rtype = SID_NAME_DOMAIN;
298 if (strcasecmp_m(username, state->domain_name) == 0) {
299 *authority_name = state->domain_name;
300 *sid = state->domain_sid;
301 *rtype = SID_NAME_DOMAIN;
305 /* Perhaps this is a well known user? */
306 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
308 return NT_STATUS_NO_MEMORY;
310 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
311 if (NT_STATUS_IS_OK(status)) {
315 /* Perhaps this is a BUILTIN user? */
316 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
318 return NT_STATUS_NO_MEMORY;
320 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
321 if (NT_STATUS_IS_OK(status)) {
325 /* OK, I give up - perhaps we need to assume the user is in our domain? */
326 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
328 return NT_STATUS_NO_MEMORY;
330 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
331 if (NT_STATUS_IS_OK(status)) {
335 return STATUS_SOME_UNMAPPED;
336 } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
338 *authority_name = NAME_NT_AUTHORITY;
339 *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
340 *rtype = SID_NAME_DOMAIN;
344 /* Look up table of well known names */
345 return lookup_well_known_names(mem_ctx, domain, username, authority_name,
347 } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
348 *authority_name = NAME_BUILTIN;
349 domain_dn = state->builtin_dn;
350 } else if (strcasecmp_m(domain, state->domain_dns) == 0) {
351 *authority_name = state->domain_name;
352 domain_dn = state->domain_dn;
353 } else if (strcasecmp_m(domain, state->domain_name) == 0) {
354 *authority_name = state->domain_name;
355 domain_dn = state->domain_dn;
357 /* Not local, need to ask winbind in future */
358 return STATUS_SOME_UNMAPPED;
361 ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
363 domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
364 if (domain_sid == NULL) {
365 return NT_STATUS_INVALID_SID;
368 return NT_STATUS_INVALID_SID;
373 *rtype = SID_NAME_DOMAIN;
377 ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
378 "(&(sAMAccountName=%s)(objectSid=*))",
379 ldb_binary_encode_string(mem_ctx, username));
381 return NT_STATUS_INVALID_SID;
384 for (i=0; i < ret; i++) {
385 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
387 return NT_STATUS_INVALID_SID;
390 /* Check that this is in the domain */
391 if (!dom_sid_in_domain(domain_sid, *sid)) {
395 atype = samdb_result_uint(res[i], "sAMAccountType", 0);
397 *rtype = samdb_atype_map(atype);
398 if (*rtype == SID_NAME_UNKNOWN) {
399 return STATUS_SOME_UNMAPPED;
405 /* need to check for an allocated sid */
407 return NT_STATUS_INVALID_SID;
412 add to the lsa_RefDomainList for LookupSids and LookupNames
414 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
415 enum lsa_SidType rtype,
416 const char *authority_name,
418 struct lsa_RefDomainList *domains,
421 struct dom_sid *authority_sid;
424 if (rtype != SID_NAME_DOMAIN) {
425 authority_sid = dom_sid_dup(mem_ctx, sid);
426 if (authority_sid == NULL) {
427 return NT_STATUS_NO_MEMORY;
429 authority_sid->num_auths--;
434 /* see if we've already done this authority name */
435 for (i=0;i<domains->count;i++) {
436 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
442 domains->domains = talloc_realloc(domains,
444 struct lsa_DomainInfo,
446 if (domains->domains == NULL) {
447 return NT_STATUS_NO_MEMORY;
449 domains->domains[i].name.string = authority_name;
450 domains->domains[i].sid = authority_sid;
452 domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
459 lookup a name for 1 SID
461 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
462 struct dom_sid *sid, const char *sid_str,
463 const char **authority_name,
464 const char **name, enum lsa_SidType *rtype)
469 struct ldb_message **res;
470 struct ldb_dn *domain_dn;
471 const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
473 status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
474 if (NT_STATUS_IS_OK(status)) {
478 if (dom_sid_in_domain(state->domain_sid, sid)) {
479 *authority_name = state->domain_name;
480 domain_dn = state->domain_dn;
481 } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
482 *authority_name = NAME_BUILTIN;
483 domain_dn = state->builtin_dn;
485 /* Not well known, our domain or built in */
487 /* In future, we must look at SID histories, and at trusted domains via winbind */
489 return NT_STATUS_NOT_FOUND;
492 ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
493 "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
495 *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
497 *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
499 *name = talloc_strdup(mem_ctx, sid_str);
500 NT_STATUS_HAVE_NO_MEMORY(*name);
504 atype = samdb_result_uint(res[0], "sAMAccountType", 0);
506 *rtype = samdb_atype_map(atype);
511 /* need to re-add a check for an allocated sid */
513 return NT_STATUS_NOT_FOUND;
520 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
522 struct lsa_LookupSids2 *r)
524 struct lsa_policy_state *state;
526 NTSTATUS status = NT_STATUS_OK;
528 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
529 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
530 return NT_STATUS_INVALID_PARAMETER;
533 r->out.domains = NULL;
535 /* NOTE: the WSPP test suite tries SIDs with invalid revision numbers,
536 and expects NT_STATUS_INVALID_PARAMETER back - we just treat it as
537 an unknown SID. We could add a SID validator here. (tridge)
541 status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
542 if (!NT_STATUS_IS_OK(status)) {
546 r->out.domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
547 if (r->out.domains == NULL) {
548 return NT_STATUS_NO_MEMORY;
551 r->out.names = talloc_zero(mem_ctx, struct lsa_TransNameArray2);
552 if (r->out.names == NULL) {
553 return NT_STATUS_NO_MEMORY;
558 r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2,
559 r->in.sids->num_sids);
560 if (r->out.names->names == NULL) {
561 return NT_STATUS_NO_MEMORY;
564 for (i=0;i<r->in.sids->num_sids;i++) {
565 struct dom_sid *sid = r->in.sids->sids[i].sid;
566 char *sid_str = dom_sid_string(mem_ctx, sid);
567 const char *name, *authority_name;
568 enum lsa_SidType rtype;
572 r->out.names->count++;
574 r->out.names->names[i].sid_type = SID_NAME_UNKNOWN;
575 r->out.names->names[i].name.string = sid_str;
576 r->out.names->names[i].sid_index = 0xFFFFFFFF;
577 r->out.names->names[i].unknown = 0;
579 if (sid_str == NULL) {
580 r->out.names->names[i].name.string = "(SIDERROR)";
581 status = STATUS_SOME_UNMAPPED;
585 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str,
586 &authority_name, &name, &rtype);
587 if (!NT_STATUS_IS_OK(status2)) {
588 status = STATUS_SOME_UNMAPPED;
592 /* set up the authority table */
593 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype,
595 r->out.domains, &sid_index);
596 if (!NT_STATUS_IS_OK(status2)) {
600 r->out.names->names[i].sid_type = rtype;
601 r->out.names->names[i].name.string = name;
602 r->out.names->names[i].sid_index = sid_index;
603 r->out.names->names[i].unknown = 0;
608 if (*r->out.count == 0) {
609 return NT_STATUS_NONE_MAPPED;
611 if (*r->out.count != r->in.sids->num_sids) {
612 return STATUS_SOME_UNMAPPED;
622 Identical to LookupSids2, but doesn't take a policy handle
625 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
627 struct lsa_LookupSids3 *r)
629 struct lsa_LookupSids2 r2;
630 struct lsa_OpenPolicy2 pol;
632 struct dcesrv_handle *h;
636 /* No policy handle on the wire, so make one up here */
637 r2.in.handle = talloc(mem_ctx, struct policy_handle);
639 return NT_STATUS_NO_MEMORY;
642 pol.out.handle = r2.in.handle;
643 pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
645 pol.in.system_name = NULL;
646 status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
647 if (!NT_STATUS_IS_OK(status)) {
651 /* ensure this handle goes away at the end of this call */
652 DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
653 talloc_steal(mem_ctx, h);
655 r2.in.sids = r->in.sids;
656 r2.in.names = r->in.names;
657 r2.in.level = r->in.level;
658 r2.in.count = r->in.count;
659 r2.in.unknown1 = r->in.unknown1;
660 r2.in.unknown2 = r->in.unknown2;
661 r2.out.count = r->out.count;
662 r2.out.names = r->out.names;
664 status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
666 r->out.domains = r2.out.domains;
667 r->out.names = r2.out.names;
668 r->out.count = r2.out.count;
677 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
678 struct lsa_LookupSids *r)
680 struct lsa_LookupSids2 r2;
686 r2.in.handle = r->in.handle;
687 r2.in.sids = r->in.sids;
689 r2.in.level = r->in.level;
690 r2.in.count = r->in.count;
693 r2.out.count = r->out.count;
696 status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
697 /* we deliberately don't check for error from the above,
698 as even on error we are supposed to return the names */
700 r->out.domains = r2.out.domains;
706 r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
707 if (r->out.names == NULL) {
708 return NT_STATUS_NO_MEMORY;
710 r->out.names->count = r2.out.names->count;
711 r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName,
712 r->out.names->count);
713 if (r->out.names->names == NULL) {
714 return NT_STATUS_NO_MEMORY;
716 for (i=0;i<r->out.names->count;i++) {
717 r->out.names->names[i].sid_type = r2.out.names->names[i].sid_type;
718 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
719 r->out.names->names[i].sid_index = r2.out.names->names[i].sid_index;
729 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
731 struct lsa_LookupNames3 *r)
733 struct lsa_policy_state *policy_state;
734 struct dcesrv_handle *policy_handle;
736 struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
738 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
740 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
741 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
742 return NT_STATUS_INVALID_PARAMETER;
745 policy_state = policy_handle->data;
747 r->out.domains = NULL;
749 r->out.domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
750 if (r->out.domains == NULL) {
751 return NT_STATUS_NO_MEMORY;
754 r->out.sids = talloc_zero(mem_ctx, struct lsa_TransSidArray3);
755 if (r->out.sids == NULL) {
756 return NT_STATUS_NO_MEMORY;
761 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3,
763 if (r->out.sids->sids == NULL) {
764 return NT_STATUS_NO_MEMORY;
767 for (i=0;i<r->in.num_names;i++) {
768 const char *name = r->in.names[i].string;
769 const char *authority_name;
772 enum lsa_SidType rtype;
775 r->out.sids->count++;
777 r->out.sids->sids[i].sid_type = SID_NAME_UNKNOWN;
778 r->out.sids->sids[i].sid = NULL;
779 r->out.sids->sids[i].sid_index = 0xFFFFFFFF;
780 r->out.sids->sids[i].flags = 0;
782 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name, &authority_name, &sid, &rtype);
783 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
787 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name,
788 sid, r->out.domains, &sid_index);
789 if (!NT_STATUS_IS_OK(status2)) {
793 r->out.sids->sids[i].sid_type = rtype;
794 r->out.sids->sids[i].sid = sid;
795 r->out.sids->sids[i].sid_index = sid_index;
796 r->out.sids->sids[i].flags = 0;
801 if (*r->out.count == 0) {
802 return NT_STATUS_NONE_MAPPED;
804 if (*r->out.count != r->in.num_names) {
805 return STATUS_SOME_UNMAPPED;
814 Identical to LookupNames3, but doesn't take a policy handle
817 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
818 struct lsa_LookupNames4 *r)
820 struct lsa_LookupNames3 r2;
821 struct lsa_OpenPolicy2 pol;
823 struct dcesrv_handle *h;
827 /* No policy handle on the wire, so make one up here */
828 r2.in.handle = talloc(mem_ctx, struct policy_handle);
830 return NT_STATUS_NO_MEMORY;
833 pol.out.handle = r2.in.handle;
834 pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
836 pol.in.system_name = NULL;
837 status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
838 if (!NT_STATUS_IS_OK(status)) {
842 /* ensure this handle goes away at the end of this call */
843 DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
844 talloc_steal(mem_ctx, h);
846 r2.in.num_names = r->in.num_names;
847 r2.in.names = r->in.names;
848 r2.in.level = r->in.level;
849 r2.in.sids = r->in.sids;
850 r2.in.count = r->in.count;
851 r2.in.lookup_options = r->in.lookup_options;
852 r2.in.client_revision = r->in.client_revision;
853 r2.out.domains = r->out.domains;
854 r2.out.sids = r->out.sids;
855 r2.out.count = r->out.count;
857 status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
859 r->out.domains = r2.out.domains;
860 r->out.sids = r2.out.sids;
861 r->out.count = r2.out.count;
868 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
870 struct lsa_LookupNames2 *r)
872 struct lsa_policy_state *state;
873 struct dcesrv_handle *h;
875 struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
877 r->out.domains = NULL;
879 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
881 if (r->in.level < LSA_LOOKUP_NAMES_ALL ||
882 r->in.level > LSA_LOOKUP_NAMES_RODC_REFERRAL_TO_FULL_DC) {
883 return NT_STATUS_INVALID_PARAMETER;
888 r->out.domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
889 if (r->out.domains == NULL) {
890 return NT_STATUS_NO_MEMORY;
893 r->out.sids = talloc_zero(mem_ctx, struct lsa_TransSidArray2);
894 if (r->out.sids == NULL) {
895 return NT_STATUS_NO_MEMORY;
900 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2,
902 if (r->out.sids->sids == NULL) {
903 return NT_STATUS_NO_MEMORY;
906 for (i=0;i<r->in.num_names;i++) {
907 const char *name = r->in.names[i].string;
908 const char *authority_name;
910 uint32_t rtype, sid_index;
913 r->out.sids->count++;
915 r->out.sids->sids[i].sid_type = SID_NAME_UNKNOWN;
916 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
917 to sid NULL - so we should return 0 rid for
919 r->out.sids->sids[i].rid = 0;
920 r->out.sids->sids[i].sid_index = 0xFFFFFFFF;
921 r->out.sids->sids[i].unknown = 0;
923 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name,
924 &authority_name, &sid, &rtype);
925 if (!NT_STATUS_IS_OK(status2)) {
929 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name,
930 sid, r->out.domains, &sid_index);
931 if (!NT_STATUS_IS_OK(status2)) {
935 r->out.sids->sids[i].sid_type = rtype;
936 r->out.sids->sids[i].rid = sid->sub_auths[sid->num_auths-1];
937 r->out.sids->sids[i].sid_index = sid_index;
938 r->out.sids->sids[i].unknown = 0;
943 if (*r->out.count == 0) {
944 return NT_STATUS_NONE_MAPPED;
946 if (*r->out.count != r->in.num_names) {
947 return STATUS_SOME_UNMAPPED;
956 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
957 struct lsa_LookupNames *r)
959 struct lsa_LookupNames2 r2;
965 r2.in.handle = r->in.handle;
966 r2.in.num_names = r->in.num_names;
967 r2.in.names = r->in.names;
969 r2.in.level = r->in.level;
970 r2.in.count = r->in.count;
971 r2.in.lookup_options = 0;
972 r2.in.client_revision = 0;
973 r2.out.count = r->out.count;
975 status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
976 if (r2.out.sids == NULL) {
980 r->out.domains = r2.out.domains;
981 r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
982 if (r->out.sids == NULL) {
983 return NT_STATUS_NO_MEMORY;
985 r->out.sids->count = r2.out.sids->count;
986 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid,
988 if (r->out.sids->sids == NULL) {
989 return NT_STATUS_NO_MEMORY;
991 for (i=0;i<r->out.sids->count;i++) {
992 r->out.sids->sids[i].sid_type = r2.out.sids->sids[i].sid_type;
993 r->out.sids->sids[i].rid = r2.out.sids->sids[i].rid;
994 r->out.sids->sids[i].sid_index = r2.out.sids->sids[i].sid_index;