source3/passdb/pdb_samba_dsdb.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    pdb glue module for direct access to the dsdb via LDB APIs
   4    Copyright (C) Volker Lendecke 2009-2011
   5    Copyright (C) Andrew Bartlett 2010-2012
   6    Copyright (C) Matthias Dieter Wallnöfer                 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /* This module, is a port of Volker's pdb_ads to ldb and DSDB APIs */
  23
  24 #include "includes.h"
  25 #include "source3/include/passdb.h"
  26 #include "source4/dsdb/samdb/samdb.h"
  27 #include "ldb_errors.h"
  28 #include "libcli/security/dom_sid.h"
  29 #include "source4/winbind/idmap.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "librpc/gen_ndr/ndr_drsblobs.h"
  32 #include "librpc/gen_ndr/ndr_lsa.h"
  33 #include "libds/common/flag_mapping.h"
  34 #include "source4/lib/events/events.h"
  35 #include "source4/auth/session.h"
  36 #include "source4/auth/system_session_proto.h"
  37 #include "lib/param/param.h"
  38 #include "source4/dsdb/common/util.h"
  39 #include "source3/include/secrets.h"
  40 #include "source4/auth/auth_sam.h"
  41 #include "auth/credentials/credentials.h"
  42
  43 struct pdb_samba_dsdb_state {
  44         struct tevent_context *ev;
  45         struct ldb_context *ldb;
  46         struct idmap_context *idmap_ctx;
  47         struct loadparm_context *lp_ctx;
  48 };
  49
  50 static NTSTATUS pdb_samba_dsdb_getsampwsid(struct pdb_methods *m,
  51                                     struct samu *sam_acct,
  52                                     const struct dom_sid *sid);
  53 static NTSTATUS pdb_samba_dsdb_getsamupriv(struct pdb_samba_dsdb_state *state,
  54                                     const char *filter,
  55                                     TALLOC_CTX *mem_ctx,
  56                                     struct ldb_message **pmsg);
  57 static bool pdb_samba_dsdb_sid_to_id(struct pdb_methods *m, const struct dom_sid *sid,
  58                                  struct unixid *id);
  59
  60 static bool pdb_samba_dsdb_pull_time(struct ldb_message *msg, const char *attr,
  61                               time_t *ptime)
  62 {
  63         uint64_t tmp;
  64         if (! ldb_msg_find_element(msg, attr)) {
  65                 return false;
  66         }
  67         tmp = ldb_msg_find_attr_as_uint64(msg, attr, 0);
  68         *ptime = nt_time_to_unix(tmp);
  69         return true;
  70 }
  71
  72 static struct pdb_domain_info *pdb_samba_dsdb_get_domain_info(
  73         struct pdb_methods *m, TALLOC_CTX *mem_ctx)
  74 {
  75         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
  76                 m->private_data, struct pdb_samba_dsdb_state);
  77         struct pdb_domain_info *info;
  78         struct dom_sid *domain_sid;
  79         struct ldb_dn *forest_dn, *domain_dn;
  80         struct ldb_result *dom_res = NULL;
  81         const char *dom_attrs[] = {
  82                 "objectSid",
  83                 "objectGUID",
  84                 "fSMORoleOwner",
  85                 NULL
  86         };
  87         char *p;
  88         int ret;
  89
  90         info = talloc(mem_ctx, struct pdb_domain_info);
  91         if (info == NULL) {
  92                 return NULL;
  93         }
  94
  95         domain_dn = ldb_get_default_basedn(state->ldb);
  96
  97         ret = ldb_search(state->ldb, info, &dom_res,
  98                          domain_dn, LDB_SCOPE_BASE, dom_attrs, NULL);
  99         if (ret != LDB_SUCCESS) {
 100                 goto fail;
 101         }
 102         if (dom_res->count != 1) {
 103                 goto fail;
 104         }
 105
 106         info->guid = samdb_result_guid(dom_res->msgs[0], "objectGUID");
 107
 108         domain_sid = samdb_result_dom_sid(state, dom_res->msgs[0], "objectSid");
 109         if (!domain_sid) {
 110                 goto fail;
 111         }
 112         info->sid = *domain_sid;
 113
 114         TALLOC_FREE(dom_res);
 115
 116         info->name = talloc_strdup(info, lpcfg_sam_name(state->lp_ctx));
 117         info->dns_domain = ldb_dn_canonical_string(info, domain_dn);
 118
 119         if (!info->dns_domain) {
 120                 goto fail;
 121         }
 122         p = strchr(info->dns_domain, '/');
 123         if (p) {
 124                 *p = '\0';
 125         }
 126
 127         forest_dn = ldb_get_root_basedn(state->ldb);
 128         if (!forest_dn) {
 129                 goto fail;
 130         }
 131
 132         info->dns_forest = ldb_dn_canonical_string(info, forest_dn);
 133         if (!info->dns_forest) {
 134                 goto fail;
 135         }
 136         p = strchr(info->dns_forest, '/');
 137         if (p) {
 138                 *p = '\0';
 139         }
 140
 141         return info;
 142
 143 fail:
 144         TALLOC_FREE(dom_res);
 145         TALLOC_FREE(info);
 146         return NULL;
 147 }
 148
 149 static struct ldb_message *pdb_samba_dsdb_get_samu_private(
 150         struct pdb_methods *m, struct samu *sam)
 151 {
 152         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 153                 m->private_data, struct pdb_samba_dsdb_state);
 154         struct ldb_message *msg;
 155         char *sidstr, *filter;
 156         NTSTATUS status;
 157
 158         msg = (struct ldb_message *)
 159                 pdb_get_backend_private_data(sam, m);
 160
 161         if (msg != NULL) {
 162                 return talloc_get_type_abort(msg, struct ldb_message);
 163         }
 164
 165         sidstr = dom_sid_string(talloc_tos(), pdb_get_user_sid(sam));
 166         if (sidstr == NULL) {
 167                 return NULL;
 168         }
 169
 170         filter = talloc_asprintf(
 171                 talloc_tos(), "(&(objectsid=%s)(objectclass=user))", sidstr);
 172         TALLOC_FREE(sidstr);
 173         if (filter == NULL) {
 174                 return NULL;
 175         }
 176
 177         status = pdb_samba_dsdb_getsamupriv(state, filter, sam, &msg);
 178         TALLOC_FREE(filter);
 179         if (!NT_STATUS_IS_OK(status)) {
 180                 return NULL;
 181         }
 182
 183         return msg;
 184 }
 185
 186 static NTSTATUS pdb_samba_dsdb_init_sam_from_priv(struct pdb_methods *m,
 187                                            struct samu *sam,
 188                                            struct ldb_message *msg)
 189 {
 190         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 191                 m->private_data, struct pdb_samba_dsdb_state);
 192         TALLOC_CTX *frame = talloc_stackframe();
 193         NTSTATUS status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 194         const char *str;
 195         time_t tmp_time;
 196         struct dom_sid *sid, group_sid;
 197         uint64_t n;
 198         const DATA_BLOB *blob;
 199
 200         str = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
 201         if (str == NULL) {
 202                 DEBUG(10, ("no samAccountName\n"));
 203                 goto fail;
 204         }
 205         pdb_set_username(sam, str, PDB_SET);
 206
 207         if (pdb_samba_dsdb_pull_time(msg, "lastLogon", &tmp_time)) {
 208                 pdb_set_logon_time(sam, tmp_time, PDB_SET);
 209         }
 210         if (pdb_samba_dsdb_pull_time(msg, "lastLogoff", &tmp_time)) {
 211                 pdb_set_logoff_time(sam, tmp_time, PDB_SET);
 212         }
 213         if (pdb_samba_dsdb_pull_time(msg, "pwdLastSet", &tmp_time)) {
 214                 pdb_set_pass_last_set_time(sam, tmp_time, PDB_SET);
 215         }
 216         if (pdb_samba_dsdb_pull_time(msg, "accountExpires", &tmp_time)) {
 217                 pdb_set_kickoff_time(sam, tmp_time, PDB_SET);
 218         }
 219
 220         str = ldb_msg_find_attr_as_string(msg, "displayName",
 221                                             NULL);
 222         if (str != NULL) {
 223                 pdb_set_fullname(sam, str, PDB_SET);
 224         }
 225
 226         str = ldb_msg_find_attr_as_string(msg, "homeDirectory",
 227                                             NULL);
 228         if (str != NULL) {
 229                 pdb_set_homedir(sam, str, PDB_SET);
 230         }
 231
 232         str = ldb_msg_find_attr_as_string(msg, "homeDrive", NULL);
 233         if (str != NULL) {
 234                 pdb_set_dir_drive(sam, str, PDB_SET);
 235         }
 236
 237         str = ldb_msg_find_attr_as_string(msg, "scriptPath", NULL);
 238         if (str != NULL) {
 239                 pdb_set_logon_script(sam, str, PDB_SET);
 240         }
 241
 242         str = ldb_msg_find_attr_as_string(msg, "profilePath",
 243                                             NULL);
 244         if (str != NULL) {
 245                 pdb_set_profile_path(sam, str, PDB_SET);
 246         }
 247
 248         str = ldb_msg_find_attr_as_string(msg, "comment",
 249                                             NULL);
 250         if (str != NULL) {
 251                 pdb_set_comment(sam, str, PDB_SET);
 252         }
 253
 254         str = ldb_msg_find_attr_as_string(msg, "description",
 255                                             NULL);
 256         if (str != NULL) {
 257                 pdb_set_acct_desc(sam, str, PDB_SET);
 258         }
 259
 260         str = ldb_msg_find_attr_as_string(msg, "userWorkstations",
 261                                             NULL);
 262         if (str != NULL) {
 263                 pdb_set_workstations(sam, str, PDB_SET);
 264         }
 265
 266         blob = ldb_msg_find_ldb_val(msg, "userParameters");
 267         if (blob != NULL) {
 268                 str = base64_encode_data_blob(frame, *blob);
 269                 if (str == NULL) {
 270                         DEBUG(0, ("base64_encode_data_blob() failed\n"));
 271                         goto fail;
 272                 }
 273                 pdb_set_munged_dial(sam, str, PDB_SET);
 274         }
 275
 276         sid = samdb_result_dom_sid(talloc_tos(), msg, "objectSid");
 277         if (!sid) {
 278                 DEBUG(10, ("Could not pull SID\n"));
 279                 goto fail;
 280         }
 281         pdb_set_user_sid(sam, sid, PDB_SET);
 282
 283         n = samdb_result_acct_flags(msg, "msDS-User-Account-Control-Computed");
 284         if (n == 0) {
 285                 DEBUG(10, ("Could not pull userAccountControl\n"));
 286                 goto fail;
 287         }
 288         pdb_set_acct_ctrl(sam, n, PDB_SET);
 289
 290         blob = ldb_msg_find_ldb_val(msg, "unicodePwd");
 291         if (blob) {
 292                 if (blob->length != NT_HASH_LEN) {
 293                         DEBUG(0, ("Got NT hash of length %d, expected %d\n",
 294                                   (int)blob->length, NT_HASH_LEN));
 295                         goto fail;
 296                 }
 297                 pdb_set_nt_passwd(sam, blob->data, PDB_SET);
 298         }
 299
 300         blob = ldb_msg_find_ldb_val(msg, "dBCSPwd");
 301         if (blob) {
 302                 if (blob->length != LM_HASH_LEN) {
 303                         DEBUG(0, ("Got LM hash of length %d, expected %d\n",
 304                                   (int)blob->length, LM_HASH_LEN));
 305                         goto fail;
 306                 }
 307                 pdb_set_lanman_passwd(sam, blob->data, PDB_SET);
 308         }
 309
 310         n = ldb_msg_find_attr_as_uint(msg, "primaryGroupID", 0);
 311         if (n == 0) {
 312                 DEBUG(10, ("Could not pull primaryGroupID\n"));
 313                 goto fail;
 314         }
 315         sid_compose(&group_sid, samdb_domain_sid(state->ldb), n);
 316         pdb_set_group_sid(sam, &group_sid, PDB_SET);
 317
 318         status = NT_STATUS_OK;
 319 fail:
 320         TALLOC_FREE(frame);
 321         return status;
 322 }
 323
 324 static bool pdb_samba_dsdb_add_time(struct ldb_message *msg,
 325                                 const char *attrib, time_t t)
 326 {
 327         uint64_t nt_time;
 328
 329         unix_to_nt_time(&nt_time, t);
 330
 331         return ldb_msg_add_fmt(msg, attrib, "%llu", (unsigned long long) nt_time);
 332 }
 333
 334 static int pdb_samba_dsdb_replace_by_sam(struct pdb_samba_dsdb_state *state,
 335                                      bool (*need_update)(const struct samu *,
 336                                                          enum pdb_elements),
 337                                      struct ldb_dn *dn,
 338                                      struct samu *sam)
 339 {
 340         TALLOC_CTX *frame = talloc_stackframe();
 341         int ret = LDB_SUCCESS;
 342         const char *pw;
 343         struct ldb_message *msg;
 344         struct ldb_request *req;
 345         uint32_t dsdb_flags = 0;
 346         /* TODO: All fields :-) */
 347
 348         msg = ldb_msg_new(frame);
 349         if (!msg) {
 350                 talloc_free(frame);
 351                 return false;
 352         }
 353
 354         msg->dn = dn;
 355
 356         /* build modify request */
 357         ret = ldb_build_mod_req(&req, state->ldb, frame, msg, NULL, NULL,
 358                                 ldb_op_default_callback,
 359                                 NULL);
 360         if (ret != LDB_SUCCESS) {
 361                 talloc_free(frame);
 362                 return ret;
 363         }
 364
 365         /* If we set a plaintext password, the system will
 366          * force the pwdLastSet to now() */
 367         if (need_update(sam, PDB_PASSLASTSET)) {
 368                 dsdb_flags = DSDB_PASSWORD_BYPASS_LAST_SET;
 369
 370                 ret |= pdb_samba_dsdb_add_time(msg, "pwdLastSet",
 371                                            pdb_get_pass_last_set_time(sam));
 372         }
 373
 374         pw = pdb_get_plaintext_passwd(sam);
 375         if (need_update(sam, PDB_PLAINTEXT_PW)) {
 376                 struct ldb_val pw_utf16;
 377                 if (pw == NULL) {
 378                         talloc_free(frame);
 379                         return LDB_ERR_OPERATIONS_ERROR;
 380                 }
 381
 382                 if (!convert_string_talloc(msg,
 383                                            CH_UNIX, CH_UTF16,
 384                                            pw, strlen(pw),
 385                                            (void *)&pw_utf16.data,
 386                                            &pw_utf16.length)) {
 387                         talloc_free(frame);
 388                         return LDB_ERR_OPERATIONS_ERROR;
 389                 }
 390                 ret |= ldb_msg_add_value(msg, "clearTextPassword", &pw_utf16, NULL);
 391         } else {
 392                 bool changed_lm_pw = false;
 393                 bool changed_nt_pw = false;
 394                 bool changed_history = false;
 395                 if (need_update(sam, PDB_LMPASSWD)) {
 396                         struct ldb_val val;
 397                         val.data = discard_const_p(uint8_t, pdb_get_lanman_passwd(sam));
 398                         if (!val.data) {
 399                                 samdb_msg_add_delete(state->ldb, msg, msg,
 400                                                      "dBCSPwd");
 401                         } else {
 402                                 val.length = LM_HASH_LEN;
 403                                 ret |= ldb_msg_add_value(msg, "dBCSPwd", &val, NULL);
 404                         }
 405                         changed_lm_pw = true;
 406                 }
 407                 if (need_update(sam, PDB_NTPASSWD)) {
 408                         struct ldb_val val;
 409                         val.data = discard_const_p(uint8_t, pdb_get_nt_passwd(sam));
 410                         if (!val.data) {
 411                                 samdb_msg_add_delete(state->ldb, msg, msg,
 412                                                      "unicodePwd");
 413                         } else {
 414                                 val.length = NT_HASH_LEN;
 415                                 ret |= ldb_msg_add_value(msg, "unicodePwd", &val, NULL);
 416                         }
 417                         changed_nt_pw = true;
 418                 }
 419
 420                 /* Try to ensure we don't get out of sync */
 421                 if (changed_lm_pw && !changed_nt_pw) {
 422                         samdb_msg_add_delete(state->ldb, msg, msg,
 423                                              "unicodePwd");
 424                 } else if (changed_nt_pw && !changed_lm_pw) {
 425                         samdb_msg_add_delete(state->ldb, msg, msg,
 426                                              "dBCSPwd");
 427                 }
 428                 if (changed_lm_pw || changed_nt_pw) {
 429                         samdb_msg_add_delete(state->ldb, msg, msg,
 430                                              "supplementalCredentials");
 431
 432                 }
 433
 434                 if (need_update(sam, PDB_PWHISTORY)) {
 435                         uint32_t current_hist_len;
 436                         const uint8_t *history = pdb_get_pw_history(sam, &current_hist_len);
 437
 438                         bool invalid_history = false;
 439                         struct samr_Password *history_hashes = talloc_array(talloc_tos(), struct samr_Password,
 440                                                                             current_hist_len);
 441                         if (!history) {
 442                                 invalid_history = true;
 443                         } else {
 444                                 unsigned int i;
 445                                 static const uint8_t zeros[16];
 446                                 /* Parse the history into the correct format */
 447                                 for (i = 0; i < current_hist_len; i++) {
 448                                         if (memcmp(&history[i*PW_HISTORY_ENTRY_LEN], zeros, 16) != 0) {
 449                                                 /* If the history is in the old format, with a salted hash, then we can't migrate it to AD format */
 450                                                 invalid_history = true;
 451                                                 break;
 452                                         }
 453                                         /* Copy out the 2nd 16 bytes of the 32 byte password history, containing the NT hash */
 454                                         memcpy(history_hashes[i].hash,
 455                                                &history[(i*PW_HISTORY_ENTRY_LEN) + PW_HISTORY_SALT_LEN],
 456                                                sizeof(history_hashes[i].hash));
 457                                 }
 458                         }
 459                         if (invalid_history) {
 460                                 ret |= samdb_msg_add_delete(state->ldb, msg, msg,
 461                                                      "ntPwdHistory");
 462
 463                                 ret |= samdb_msg_add_delete(state->ldb, msg, msg,
 464                                                      "lmPwdHistory");
 465                         } else {
 466                                 ret |= samdb_msg_add_hashes(state->ldb, msg, msg,
 467                                                             "ntPwdHistory",
 468                                                             history_hashes,
 469                                                             current_hist_len);
 470                         }
 471                         changed_history = true;
 472                 }
 473                 if (changed_lm_pw || changed_nt_pw || changed_history) {
 474                         /* These attributes can only be modified directly by using a special control */
 475                         dsdb_flags = DSDB_BYPASS_PASSWORD_HASH;
 476                 }
 477         }
 478
 479         /* PDB_USERSID is only allowed on ADD, handled in caller */
 480         if (need_update(sam, PDB_GROUPSID)) {
 481                 const struct dom_sid *sid = pdb_get_group_sid(sam);
 482                 uint32_t rid;
 483                 NTSTATUS status = dom_sid_split_rid(NULL, sid, NULL, &rid);
 484                 if (!NT_STATUS_IS_OK(status)) {
 485                         talloc_free(frame);
 486                         return LDB_ERR_OPERATIONS_ERROR;
 487                 }
 488                 if (!dom_sid_in_domain(samdb_domain_sid(state->ldb), sid)) {
 489                         talloc_free(frame);
 490                         return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
 491                 }
 492                 ret |= samdb_msg_add_uint(state->ldb, msg, msg, "primaryGroupID", rid);
 493         }
 494         if (need_update(sam, PDB_FULLNAME)) {
 495                 ret |= ldb_msg_add_string(msg, "displayName", pdb_get_fullname(sam));
 496         }
 497
 498         if (need_update(sam, PDB_SMBHOME)) {
 499                 ret |= ldb_msg_add_string(msg, "homeDirectory",
 500                                           pdb_get_homedir(sam));
 501         }
 502
 503         if (need_update(sam, PDB_PROFILE)) {
 504                 ret |= ldb_msg_add_string(msg, "profilePath",
 505                                           pdb_get_profile_path(sam));
 506         }
 507
 508         if (need_update(sam, PDB_DRIVE)) {
 509                 ret |= ldb_msg_add_string(msg, "homeDrive",
 510                                           pdb_get_dir_drive(sam));
 511         }
 512
 513         if (need_update(sam, PDB_LOGONSCRIPT)) {
 514                 ret |= ldb_msg_add_string(msg, "scriptPath",
 515                                           pdb_get_logon_script(sam));
 516         }
 517
 518         if (need_update(sam, PDB_KICKOFFTIME)) {
 519                 ret |= pdb_samba_dsdb_add_time(msg, "accountExpires",
 520                                         pdb_get_kickoff_time(sam));
 521         }
 522
 523         if (need_update(sam, PDB_LOGONTIME)) {
 524                 ret |= pdb_samba_dsdb_add_time(msg, "lastLogon",
 525                                         pdb_get_logon_time(sam));
 526         }
 527
 528         if (need_update(sam, PDB_LOGOFFTIME)) {
 529                 ret |= pdb_samba_dsdb_add_time(msg, "lastLogoff",
 530                                         pdb_get_logoff_time(sam));
 531         }
 532
 533         if (need_update(sam, PDB_USERNAME)) {
 534                 ret |= ldb_msg_add_string(msg, "samAccountName",
 535                                           pdb_get_username(sam));
 536         }
 537
 538         if (need_update(sam, PDB_HOURSLEN) || need_update(sam, PDB_HOURS)) {
 539                 struct ldb_val hours = data_blob_const(pdb_get_hours(sam), pdb_get_hours_len(sam));
 540                 ret |= ldb_msg_add_value(msg, "logonHours",
 541                                          &hours, NULL);
 542         }
 543
 544         if (need_update(sam, PDB_ACCTCTRL)) {
 545                 ret |= samdb_msg_add_acct_flags(state->ldb, msg, msg,
 546                                                 "userAccountControl", pdb_get_acct_ctrl(sam));
 547         }
 548
 549         if (need_update(sam, PDB_COMMENT)) {
 550                 ret |= ldb_msg_add_string(msg, "comment",
 551                                           pdb_get_comment(sam));
 552         }
 553
 554         if (need_update(sam, PDB_ACCTDESC)) {
 555                 ret |= ldb_msg_add_string(msg, "description",
 556                                           pdb_get_acct_desc(sam));
 557         }
 558
 559         if (need_update(sam, PDB_WORKSTATIONS)) {
 560                 ret |= ldb_msg_add_string(msg, "userWorkstations",
 561                                           pdb_get_workstations(sam));
 562         }
 563
 564         /* This will need work, it is actually a UTF8 'string' with internal NULLs, to handle TS parameters */
 565         if (need_update(sam, PDB_MUNGEDDIAL)) {
 566                 const char *base64_munged_dial = NULL;
 567
 568                 base64_munged_dial = pdb_get_munged_dial(sam);
 569                 if (base64_munged_dial != NULL && strlen(base64_munged_dial) > 0) {
 570                         struct ldb_val blob;
 571
 572                         blob = base64_decode_data_blob_talloc(msg,
 573                                                         base64_munged_dial);
 574                         if (blob.data == NULL) {
 575                                 DEBUG(0, ("Failed to decode userParameters from "
 576                                           "munged dialback string[%s] for %s\n",
 577                                           base64_munged_dial,
 578                                           ldb_dn_get_linearized(msg->dn)));
 579                                 talloc_free(frame);
 580                                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
 581                         }
 582                         ret |= ldb_msg_add_steal_value(msg, "userParameters",
 583                                                        &blob);
 584                 }
 585         }
 586
 587         if (need_update(sam, PDB_COUNTRY_CODE)) {
 588                 ret |= ldb_msg_add_fmt(msg, "countryCode",
 589                                        "%i", (int)pdb_get_country_code(sam));
 590         }
 591
 592         if (need_update(sam, PDB_CODE_PAGE)) {
 593                 ret |= ldb_msg_add_fmt(msg, "codePage",
 594                                        "%i", (int)pdb_get_code_page(sam));
 595         }
 596
 597         /* Not yet handled here or not meaningful for modifies on a Samba_Dsdb backend:
 598         PDB_BAD_PASSWORD_TIME,
 599         PDB_CANCHANGETIME, - these are calculated per policy, not stored
 600         PDB_DOMAIN,
 601         PDB_NTUSERNAME, - this makes no sense, and never really did
 602         PDB_LOGONDIVS,
 603         PDB_USERSID, - Handled in pdb_samba_dsdb_add_sam_account()
 604         PDB_FIELDS_PRESENT,
 605         PDB_BAD_PASSWORD_COUNT,
 606         PDB_LOGON_COUNT,
 607         PDB_UNKNOWN6,
 608         PDB_BACKEND_PRIVATE_DATA,
 609
 610  */
 611         if (ret != LDB_SUCCESS) {
 612                 talloc_free(frame);
 613                 return LDB_ERR_OPERATIONS_ERROR;
 614         }
 615
 616         if (msg->num_elements == 0) {
 617                 talloc_free(frame);
 618                 /* Nothing to do, just return success */
 619                 return LDB_SUCCESS;
 620         }
 621
 622         ret = dsdb_replace(state->ldb, msg, dsdb_flags);
 623
 624         if (ret != LDB_SUCCESS) {
 625                 DEBUG(0,("Failed to modify account record %s to set user attributes: %s\n",
 626                          ldb_dn_get_linearized(msg->dn),
 627                          ldb_errstring(state->ldb)));
 628         }
 629
 630         talloc_free(frame);
 631         return ret;
 632 }
 633
 634 static NTSTATUS pdb_samba_dsdb_getsamupriv(struct pdb_samba_dsdb_state *state,
 635                                     const char *filter,
 636                                     TALLOC_CTX *mem_ctx,
 637                                     struct ldb_message **msg)
 638 {
 639         const char * attrs[] = {
 640                 "lastLogon", "lastLogoff", "pwdLastSet", "accountExpires",
 641                 "sAMAccountName", "displayName", "homeDirectory",
 642                 "homeDrive", "scriptPath", "profilePath", "description",
 643                 "userWorkstations", "comment", "userParameters", "objectSid",
 644                 "primaryGroupID", "userAccountControl",
 645                 "msDS-User-Account-Control-Computed", "logonHours",
 646                 "badPwdCount", "logonCount", "countryCode", "codePage",
 647                 "unicodePwd", "dBCSPwd", NULL };
 648
 649         int rc = dsdb_search_one(state->ldb, mem_ctx, msg, ldb_get_default_basedn(state->ldb), LDB_SCOPE_SUBTREE, attrs, 0, "%s", filter);
 650         if (rc != LDB_SUCCESS) {
 651                 DEBUG(10, ("ldap_search failed %s\n",
 652                            ldb_errstring(state->ldb)));
 653                 return NT_STATUS_LDAP(rc);
 654         }
 655
 656         return NT_STATUS_OK;
 657 }
 658
 659 static NTSTATUS pdb_samba_dsdb_getsampwfilter(struct pdb_methods *m,
 660                                           struct pdb_samba_dsdb_state *state,
 661                                           struct samu *sam_acct,
 662                                           const char *exp_fmt, ...) _PRINTF_ATTRIBUTE(4, 5)
 663 {
 664         struct ldb_message *priv;
 665         NTSTATUS status;
 666         va_list ap;
 667         char *expression = NULL;
 668         TALLOC_CTX *tmp_ctx = talloc_new(state);
 669         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 670
 671         va_start(ap, exp_fmt);
 672         expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
 673         va_end(ap);
 674
 675         if (!expression) {
 676                 talloc_free(tmp_ctx);
 677                 return NT_STATUS_NO_MEMORY;
 678         }
 679
 680         status = pdb_samba_dsdb_getsamupriv(state, expression, sam_acct, &priv);
 681         talloc_free(tmp_ctx);
 682         if (!NT_STATUS_IS_OK(status)) {
 683                 DEBUG(10, ("pdb_samba_dsdb_getsamupriv failed: %s\n",
 684                            nt_errstr(status)));
 685                 return status;
 686         }
 687
 688         status = pdb_samba_dsdb_init_sam_from_priv(m, sam_acct, priv);
 689         if (!NT_STATUS_IS_OK(status)) {
 690                 DEBUG(10, ("pdb_samba_dsdb_init_sam_from_priv failed: %s\n",
 691                            nt_errstr(status)));
 692                 TALLOC_FREE(priv);
 693                 return status;
 694         }
 695
 696         pdb_set_backend_private_data(sam_acct, priv, NULL, m, PDB_SET);
 697         return NT_STATUS_OK;
 698 }
 699
 700 static NTSTATUS pdb_samba_dsdb_getsampwnam(struct pdb_methods *m,
 701                                     struct samu *sam_acct,
 702                                     const char *username)
 703 {
 704         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 705                 m->private_data, struct pdb_samba_dsdb_state);
 706
 707         return pdb_samba_dsdb_getsampwfilter(m, state, sam_acct,
 708                                          "(&(samaccountname=%s)(objectclass=user))",
 709                                          username);
 710 }
 711
 712 static NTSTATUS pdb_samba_dsdb_getsampwsid(struct pdb_methods *m,
 713                                     struct samu *sam_acct,
 714                                     const struct dom_sid *sid)
 715 {
 716         NTSTATUS status;
 717         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 718                 m->private_data, struct pdb_samba_dsdb_state);
 719         char *sidstr;
 720
 721         sidstr = dom_sid_string(talloc_tos(), sid);
 722         NT_STATUS_HAVE_NO_MEMORY(sidstr);
 723
 724         status = pdb_samba_dsdb_getsampwfilter(m, state, sam_acct,
 725                                            "(&(objectsid=%s)(objectclass=user))",
 726                                            sidstr);
 727         talloc_free(sidstr);
 728         return status;
 729 }
 730
 731 static NTSTATUS pdb_samba_dsdb_create_user(struct pdb_methods *m,
 732                                     TALLOC_CTX *mem_ctx,
 733                                     const char *name, uint32_t acct_flags,
 734                                     uint32_t *rid)
 735 {
 736         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 737                 m->private_data, struct pdb_samba_dsdb_state);
 738         struct dom_sid *sid;
 739         struct ldb_dn *dn;
 740         NTSTATUS status;
 741         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 742         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 743
 744         /* Internally this uses transactions to ensure all the steps
 745          * happen or fail as one */
 746         status = dsdb_add_user(state->ldb, tmp_ctx, name, acct_flags, NULL,
 747                                &sid, &dn);
 748         if (!NT_STATUS_IS_OK(status)) {
 749                 talloc_free(tmp_ctx);
 750                 return status;
 751         }
 752         sid_peek_rid(sid, rid);
 753         talloc_free(tmp_ctx);
 754         return NT_STATUS_OK;
 755 }
 756
 757 static NTSTATUS pdb_samba_dsdb_delete_user(struct pdb_methods *m,
 758                                        TALLOC_CTX *mem_ctx,
 759                                        struct samu *sam)
 760 {
 761         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 762                 m->private_data, struct pdb_samba_dsdb_state);
 763         struct ldb_dn *dn;
 764         int rc;
 765         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 766         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 767
 768         dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, pdb_get_user_sid(sam)));
 769         if (!dn || !ldb_dn_validate(dn)) {
 770                 talloc_free(tmp_ctx);
 771                 return NT_STATUS_NO_MEMORY;
 772         }
 773         rc = ldb_delete(state->ldb, dn);
 774
 775         if (rc != LDB_SUCCESS) {
 776                 DEBUG(10, ("ldb_delete for %s failed: %s\n", ldb_dn_get_linearized(dn),
 777                            ldb_errstring(state->ldb)));
 778                 talloc_free(tmp_ctx);
 779                 return NT_STATUS_LDAP(rc);
 780         }
 781         talloc_free(tmp_ctx);
 782         return NT_STATUS_OK;
 783 }
 784
 785 /* This interface takes a fully populated struct samu and places it in
 786  * the database.  This is not implemented at this time as we need to
 787  * be careful around the creation of arbitary SIDs (ie, we must ensrue
 788  * they are not left in a RID pool */
 789 static NTSTATUS pdb_samba_dsdb_add_sam_account(struct pdb_methods *m,
 790                                         struct samu *sampass)
 791 {
 792         int ret;
 793         NTSTATUS status;
 794         struct ldb_dn *dn;
 795         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 796                 m->private_data, struct pdb_samba_dsdb_state);
 797         uint32_t acb_flags = pdb_get_acct_ctrl(sampass);
 798         const char *username = pdb_get_username(sampass);
 799         const struct dom_sid *user_sid = pdb_get_user_sid(sampass);
 800         TALLOC_CTX *tframe = talloc_stackframe();
 801
 802         acb_flags &= (ACB_NORMAL|ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST);
 803
 804         ret = ldb_transaction_start(state->ldb);
 805         if (ret != LDB_SUCCESS) {
 806                 talloc_free(tframe);
 807                 return NT_STATUS_LOCK_NOT_GRANTED;
 808         }
 809
 810         status = dsdb_add_user(state->ldb, talloc_tos(), username,
 811                                acb_flags, user_sid, NULL, &dn);
 812         if (!NT_STATUS_IS_OK(status)) {
 813                 ldb_transaction_cancel(state->ldb);
 814                 talloc_free(tframe);
 815                 return status;
 816         }
 817
 818         ret = pdb_samba_dsdb_replace_by_sam(state, pdb_element_is_set_or_changed,
 819                                         dn, sampass);
 820         if (ret != LDB_SUCCESS) {
 821                 ldb_transaction_cancel(state->ldb);
 822                 talloc_free(tframe);
 823                 return dsdb_ldb_err_to_ntstatus(ret);
 824         }
 825
 826         ret = ldb_transaction_commit(state->ldb);
 827         if (ret != LDB_SUCCESS) {
 828                 DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
 829                          ldb_dn_get_linearized(dn),
 830                          ldb_errstring(state->ldb)));
 831                 talloc_free(tframe);
 832                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 833         }
 834         talloc_free(tframe);
 835         return NT_STATUS_OK;
 836 }
 837
 838 /*
 839  * Update the Samba_Dsdb LDB with the changes from a struct samu.
 840  *
 841  * This takes care not to update elements that have not been changed
 842  * by the caller
 843  */
 844 static NTSTATUS pdb_samba_dsdb_update_sam_account(struct pdb_methods *m,
 845                                            struct samu *sam)
 846 {
 847         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 848                 m->private_data, struct pdb_samba_dsdb_state);
 849         struct ldb_message *msg = pdb_samba_dsdb_get_samu_private(
 850                 m, sam);
 851         int ret;
 852
 853         ret = pdb_samba_dsdb_replace_by_sam(state, pdb_element_is_changed, msg->dn,
 854                                         sam);
 855         return dsdb_ldb_err_to_ntstatus(ret);
 856 }
 857
 858 static NTSTATUS pdb_samba_dsdb_delete_sam_account(struct pdb_methods *m,
 859                                            struct samu *username)
 860 {
 861         NTSTATUS status;
 862         TALLOC_CTX *tmp_ctx = talloc_new(NULL);
 863         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 864         status = pdb_samba_dsdb_delete_user(m, tmp_ctx, username);
 865         talloc_free(tmp_ctx);
 866         return status;
 867 }
 868
 869 static NTSTATUS pdb_samba_dsdb_rename_sam_account(struct pdb_methods *m,
 870                                            struct samu *oldname,
 871                                            const char *newname)
 872 {
 873         return NT_STATUS_NOT_IMPLEMENTED;
 874 }
 875
 876 /* This is not implemented, as this module is exptected to be used
 877  * with auth_samba_dsdb, and this is responible for login counters etc
 878  *
 879  */
 880 static NTSTATUS pdb_samba_dsdb_update_login_attempts(struct pdb_methods *m,
 881                                               struct samu *sam_acct,
 882                                               bool success)
 883 {
 884         return NT_STATUS_NOT_IMPLEMENTED;
 885 }
 886
 887 static NTSTATUS pdb_samba_dsdb_getgrfilter(struct pdb_methods *m, GROUP_MAP *map,
 888                                     const char *exp_fmt, ...) _PRINTF_ATTRIBUTE(4, 5)
 889 {
 890         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 891                 m->private_data, struct pdb_samba_dsdb_state);
 892         const char *attrs[] = { "objectClass", "objectSid", "description", "samAccountName", "groupType",
 893                                 NULL };
 894         struct ldb_message *msg;
 895         va_list ap;
 896         char *expression = NULL;
 897         struct dom_sid *sid;
 898         const char *str;
 899         int rc;
 900         struct id_map id_map;
 901         struct id_map *id_maps[2];
 902         TALLOC_CTX *tmp_ctx = talloc_stackframe();
 903         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 904
 905         va_start(ap, exp_fmt);
 906         expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
 907         va_end(ap);
 908
 909         if (!expression) {
 910                 talloc_free(tmp_ctx);
 911                 return NT_STATUS_NO_MEMORY;
 912         }
 913
 914         rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, ldb_get_default_basedn(state->ldb), LDB_SCOPE_SUBTREE, attrs, 0, "%s", expression);
 915         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
 916                 talloc_free(tmp_ctx);
 917                 return NT_STATUS_NO_SUCH_GROUP;
 918         } else if (rc != LDB_SUCCESS) {
 919                 talloc_free(tmp_ctx);
 920                 DEBUG(10, ("dsdb_search_one failed %s\n",
 921                            ldb_errstring(state->ldb)));
 922                 return NT_STATUS_LDAP(rc);
 923         }
 924
 925         sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
 926         if (!sid) {
 927                 talloc_free(tmp_ctx);
 928                 DEBUG(10, ("Could not pull SID\n"));
 929                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 930         }
 931
 932         map->sid = *sid;
 933
 934         if (samdb_find_attribute(state->ldb, msg, "objectClass", "group")) {
 935                 NTSTATUS status;
 936                 uint32_t grouptype = ldb_msg_find_attr_as_uint(msg, "groupType", 0);
 937                 switch (grouptype) {
 938                 case GTYPE_SECURITY_BUILTIN_LOCAL_GROUP:
 939                 case GTYPE_SECURITY_DOMAIN_LOCAL_GROUP:
 940                         map->sid_name_use = SID_NAME_ALIAS;
 941                         break;
 942                 case GTYPE_SECURITY_GLOBAL_GROUP:
 943                         map->sid_name_use = SID_NAME_DOM_GRP;
 944                         break;
 945                 default:
 946                         talloc_free(tmp_ctx);
 947                         DEBUG(10, ("Could not pull groupType\n"));
 948                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 949                 }
 950
 951                 ZERO_STRUCT(id_map);
 952                 id_map.sid = sid;
 953                 id_maps[0] = &id_map;
 954                 id_maps[1] = NULL;
 955
 956                 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
 957
 958                 if (!NT_STATUS_IS_OK(status)) {
 959                         talloc_free(tmp_ctx);
 960                         return status;
 961                 }
 962                 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
 963                         map->gid = id_map.xid.id;
 964                 } else {
 965                         DEBUG(1, (__location__ "Did not get GUID when mapping SID for %s", expression));
 966                         talloc_free(tmp_ctx);
 967                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 968                 }
 969         } else if (samdb_find_attribute(state->ldb, msg, "objectClass", "user")) {
 970                 DEBUG(1, (__location__ "Got SID_NAME_USER when searching for a group with %s", expression));
 971                 talloc_free(tmp_ctx);
 972                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 973         }
 974
 975         str = ldb_msg_find_attr_as_string(msg, "samAccountName",
 976                                           NULL);
 977         if (str == NULL) {
 978                 talloc_free(tmp_ctx);
 979                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 980         }
 981         map->nt_name = talloc_strdup(map, str);
 982         if (!map->nt_name) {
 983                 talloc_free(tmp_ctx);
 984                 return NT_STATUS_NO_MEMORY;
 985         }
 986
 987         str = ldb_msg_find_attr_as_string(msg, "description",
 988                                             NULL);
 989         if (str != NULL) {
 990                 map->comment = talloc_strdup(map, str);
 991         } else {
 992                 map->comment = talloc_strdup(map, "");
 993         }
 994         if (!map->comment) {
 995                 talloc_free(tmp_ctx);
 996                 return NT_STATUS_NO_MEMORY;
 997         }
 998
 999         talloc_free(tmp_ctx);
1000         return NT_STATUS_OK;
1001 }
1002
1003 static NTSTATUS pdb_samba_dsdb_getgrsid(struct pdb_methods *m, GROUP_MAP *map,
1004                                  struct dom_sid sid)
1005 {
1006         char *filter;
1007         NTSTATUS status;
1008
1009         filter = talloc_asprintf(talloc_tos(),
1010                                  "(&(objectsid=%s)(objectclass=group))",
1011                                  sid_string_talloc(talloc_tos(), &sid));
1012         if (filter == NULL) {
1013                 return NT_STATUS_NO_MEMORY;
1014         }
1015
1016         status = pdb_samba_dsdb_getgrfilter(m, map, filter);
1017         TALLOC_FREE(filter);
1018         return status;
1019 }
1020
1021 static NTSTATUS pdb_samba_dsdb_getgrgid(struct pdb_methods *m, GROUP_MAP *map,
1022                                  gid_t gid)
1023 {
1024         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1025                 m->private_data, struct pdb_samba_dsdb_state);
1026         NTSTATUS status;
1027         struct id_map id_map;
1028         struct id_map *id_maps[2];
1029         TALLOC_CTX *tmp_ctx = talloc_stackframe();
1030         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1031
1032         id_map.xid.id = gid;
1033         id_map.xid.type = ID_TYPE_GID;
1034         id_maps[0] = &id_map;
1035         id_maps[1] = NULL;
1036
1037         status = idmap_xids_to_sids(state->idmap_ctx, tmp_ctx, id_maps);
1038         if (!NT_STATUS_IS_OK(status)) {
1039                 talloc_free(tmp_ctx);
1040                 return status;
1041         }
1042         status = pdb_samba_dsdb_getgrsid(m, map, *id_map.sid);
1043         talloc_free(tmp_ctx);
1044         return status;
1045 }
1046
1047 static NTSTATUS pdb_samba_dsdb_getgrnam(struct pdb_methods *m, GROUP_MAP *map,
1048                                  const char *name)
1049 {
1050         char *filter;
1051         NTSTATUS status;
1052
1053         filter = talloc_asprintf(talloc_tos(),
1054                                  "(&(samaccountname=%s)(objectclass=group))",
1055                                  name);
1056         if (filter == NULL) {
1057                 return NT_STATUS_NO_MEMORY;
1058         }
1059
1060         status = pdb_samba_dsdb_getgrfilter(m, map, filter);
1061         TALLOC_FREE(filter);
1062         return status;
1063 }
1064
1065 static NTSTATUS pdb_samba_dsdb_create_dom_group(struct pdb_methods *m,
1066                                          TALLOC_CTX *mem_ctx, const char *name,
1067                                          uint32_t *rid)
1068 {
1069         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1070                 m->private_data, struct pdb_samba_dsdb_state);
1071         NTSTATUS status;
1072         struct dom_sid *sid;
1073         struct ldb_dn *dn;
1074         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1075         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1076
1077         status = dsdb_add_domain_group(state->ldb, tmp_ctx, name, &sid, &dn);
1078         if (!NT_STATUS_IS_OK(status)) {
1079                 talloc_free(tmp_ctx);
1080                 return status;
1081         }
1082
1083         sid_peek_rid(sid, rid);
1084         talloc_free(tmp_ctx);
1085         return NT_STATUS_OK;
1086 }
1087
1088 static NTSTATUS pdb_samba_dsdb_delete_dom_group(struct pdb_methods *m,
1089                                          TALLOC_CTX *mem_ctx, uint32_t rid)
1090 {
1091         const char *attrs[] = { NULL };
1092         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1093                 m->private_data, struct pdb_samba_dsdb_state);
1094         struct dom_sid sid;
1095         struct ldb_message *msg;
1096         struct ldb_dn *dn;
1097         int rc;
1098         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1099         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1100
1101         sid_compose(&sid, samdb_domain_sid(state->ldb), rid);
1102
1103         if (ldb_transaction_start(state->ldb) != LDB_SUCCESS) {
1104                 DEBUG(0, ("Unable to start transaction in pdb_samba_dsdb_delete_dom_group()\n"));
1105                 return NT_STATUS_INTERNAL_ERROR;
1106         }
1107
1108         dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, &sid));
1109         if (!dn || !ldb_dn_validate(dn)) {
1110                 talloc_free(tmp_ctx);
1111                 ldb_transaction_cancel(state->ldb);
1112                 return NT_STATUS_NO_MEMORY;
1113         }
1114         rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "objectclass=group");
1115         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1116                 talloc_free(tmp_ctx);
1117                 ldb_transaction_cancel(state->ldb);
1118                 return NT_STATUS_NO_SUCH_GROUP;
1119         }
1120         rc = ldb_delete(state->ldb, dn);
1121         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1122                 talloc_free(tmp_ctx);
1123                 ldb_transaction_cancel(state->ldb);
1124                 return NT_STATUS_NO_SUCH_GROUP;
1125         } else if (rc != LDB_SUCCESS) {
1126                 DEBUG(10, ("ldb_delete failed %s\n",
1127                            ldb_errstring(state->ldb)));
1128                 ldb_transaction_cancel(state->ldb);
1129                 return NT_STATUS_LDAP(rc);
1130         }
1131
1132         if (ldb_transaction_commit(state->ldb) != LDB_SUCCESS) {
1133                 DEBUG(0, ("Unable to commit transaction in pdb_samba_dsdb_delete_dom_group()\n"));
1134                 return NT_STATUS_INTERNAL_ERROR;
1135         }
1136         return NT_STATUS_OK;
1137 }
1138
1139 static NTSTATUS pdb_samba_dsdb_add_group_mapping_entry(struct pdb_methods *m,
1140                                                 GROUP_MAP *map)
1141 {
1142         return NT_STATUS_NOT_IMPLEMENTED;
1143 }
1144
1145 static NTSTATUS pdb_samba_dsdb_update_group_mapping_entry(struct pdb_methods *m,
1146                                                    GROUP_MAP *map)
1147 {
1148         return NT_STATUS_NOT_IMPLEMENTED;
1149 }
1150
1151 static NTSTATUS pdb_samba_dsdb_delete_group_mapping_entry(struct pdb_methods *m,
1152                                                    struct dom_sid sid)
1153 {
1154         return NT_STATUS_NOT_IMPLEMENTED;
1155 }
1156
1157 static NTSTATUS pdb_samba_dsdb_enum_group_mapping(struct pdb_methods *m,
1158                                            const struct dom_sid *sid,
1159                                            enum lsa_SidType sid_name_use,
1160                                            GROUP_MAP ***pp_rmap,
1161                                            size_t *p_num_entries,
1162                                            bool unix_only)
1163 {
1164         return NT_STATUS_NOT_IMPLEMENTED;
1165 }
1166
1167 static NTSTATUS pdb_samba_dsdb_enum_group_members(struct pdb_methods *m,
1168                                            TALLOC_CTX *mem_ctx,
1169                                            const struct dom_sid *group,
1170                                            uint32_t **pmembers,
1171                                            size_t *pnum_members)
1172 {
1173         unsigned int i, num_sids, num_members;
1174         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1175                 m->private_data, struct pdb_samba_dsdb_state);
1176         struct dom_sid *members_as_sids;
1177         struct dom_sid *dom_sid;
1178         uint32_t *members;
1179         struct ldb_dn *dn;
1180         NTSTATUS status;
1181
1182         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1183         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1184
1185         dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, group));
1186         if (!dn || !ldb_dn_validate(dn)) {
1187                 return NT_STATUS_NO_MEMORY;
1188         }
1189
1190         status = dsdb_enum_group_mem(state->ldb, tmp_ctx, dn, &members_as_sids, &num_sids);
1191         if (!NT_STATUS_IS_OK(status)) {
1192                 talloc_free(tmp_ctx);
1193                 return status;
1194         }
1195         status = dom_sid_split_rid(tmp_ctx, group, &dom_sid, NULL);
1196         if (!NT_STATUS_IS_OK(status)) {
1197                 talloc_free(tmp_ctx);
1198                 return status;
1199         }
1200
1201         *pmembers = members = talloc_array(mem_ctx, uint32_t, num_sids);
1202         if (*pmembers == NULL) {
1203                 TALLOC_FREE(tmp_ctx);
1204                 return NT_STATUS_NO_MEMORY;
1205         }
1206         num_members = 0;
1207
1208         for (i = 0; i < num_sids; i++) {
1209                 if (!dom_sid_in_domain(dom_sid, &members_as_sids[i])) {
1210                         continue;
1211                 }
1212                 status = dom_sid_split_rid(NULL, &members_as_sids[i],
1213                                            NULL, &members[num_members]);
1214                 if (!NT_STATUS_IS_OK(status)) {
1215                         talloc_free(tmp_ctx);
1216                         return status;
1217                 }
1218                 num_members++;
1219         }
1220         *pnum_members = num_members;
1221         return NT_STATUS_OK;
1222 }
1223
1224 /* Just convert the primary group SID into a group */
1225 static NTSTATUS fake_enum_group_memberships(struct pdb_samba_dsdb_state *state,
1226                                             TALLOC_CTX *mem_ctx,
1227                                             struct samu *user,
1228                                             struct dom_sid **pp_sids,
1229                                             gid_t **pp_gids,
1230                                             uint32_t *p_num_groups)
1231 {
1232         NTSTATUS status;
1233         size_t num_groups = 0;
1234         struct dom_sid *group_sids = NULL;
1235         gid_t *gids = NULL;
1236         TALLOC_CTX *tmp_ctx;
1237
1238         tmp_ctx = talloc_new(mem_ctx);
1239         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1240
1241         if (user->group_sid) {
1242                 struct id_map *id_maps[2];
1243                 struct id_map id_map;
1244
1245                 num_groups = 1;
1246
1247                 group_sids = talloc_array(tmp_ctx, struct dom_sid, num_groups);
1248                 if (group_sids == NULL) {
1249                         talloc_free(tmp_ctx);
1250                         return NT_STATUS_NO_MEMORY;
1251                 }
1252                 gids = talloc_array(tmp_ctx, gid_t, num_groups);
1253                 if (gids == NULL) {
1254                         talloc_free(tmp_ctx);
1255                         return NT_STATUS_NO_MEMORY;
1256                 }
1257
1258                 group_sids[0] = *user->group_sid;
1259
1260                 ZERO_STRUCT(id_map);
1261                 id_map.sid = &group_sids[0];
1262                 id_maps[0] = &id_map;
1263                 id_maps[1] = NULL;
1264
1265                 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
1266                 if (!NT_STATUS_IS_OK(status)) {
1267                         talloc_free(tmp_ctx);
1268                         return status;
1269                 }
1270                 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
1271                         gids[0] = id_map.xid.id;
1272                 } else {
1273                         DEBUG(1, (__location__
1274                                   "Group %s, of which %s is a member, could not be converted to a GID\n",
1275                                   dom_sid_string(tmp_ctx, &group_sids[0]),
1276                                   dom_sid_string(tmp_ctx, &user->user_sid)));
1277                         talloc_free(tmp_ctx);
1278                         /* We must error out, otherwise a user might
1279                          * avoid a DENY acl based on a group they
1280                          * missed out on */
1281                         return NT_STATUS_NO_SUCH_GROUP;
1282                 }
1283         }
1284
1285         *pp_sids = talloc_steal(mem_ctx, group_sids);
1286         *pp_gids = talloc_steal(mem_ctx, gids);
1287         *p_num_groups = num_groups;
1288         talloc_free(tmp_ctx);
1289         return NT_STATUS_OK;
1290 }
1291
1292 static NTSTATUS pdb_samba_dsdb_enum_group_memberships(struct pdb_methods *m,
1293                                                TALLOC_CTX *mem_ctx,
1294                                                struct samu *user,
1295                                                struct dom_sid **pp_sids,
1296                                                gid_t **pp_gids,
1297                                                uint32_t *p_num_groups)
1298 {
1299         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1300                 m->private_data, struct pdb_samba_dsdb_state);
1301         struct ldb_message *msg = pdb_samba_dsdb_get_samu_private(
1302                 m, user);
1303         const char *attrs[] = { "tokenGroups", NULL};
1304         struct ldb_message *tokengroups_msg;
1305         struct ldb_message_element *tokengroups;
1306         int i, rc;
1307         NTSTATUS status;
1308         unsigned int count = 0;
1309         size_t num_groups;
1310         struct dom_sid *group_sids;
1311         gid_t *gids;
1312         TALLOC_CTX *tmp_ctx;
1313
1314         if (msg == NULL) {
1315                 /* Fake up some things here */
1316                 return fake_enum_group_memberships(state,
1317                                                    mem_ctx,
1318                                                    user, pp_sids,
1319                                                    pp_gids, p_num_groups);
1320         }
1321
1322         tmp_ctx = talloc_new(mem_ctx);
1323         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1324
1325         rc = dsdb_search_one(state->ldb, tmp_ctx, &tokengroups_msg, msg->dn, LDB_SCOPE_BASE, attrs, 0, NULL);
1326
1327         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1328                 talloc_free(tmp_ctx);
1329                 return NT_STATUS_NO_SUCH_USER;
1330         } else if (rc != LDB_SUCCESS) {
1331                 DEBUG(10, ("dsdb_search_one failed %s\n",
1332                            ldb_errstring(state->ldb)));
1333                 talloc_free(tmp_ctx);
1334                 return NT_STATUS_LDAP(rc);
1335         }
1336
1337         tokengroups = ldb_msg_find_element(tokengroups_msg, "tokenGroups");
1338
1339         if (tokengroups) {
1340                 count = tokengroups->num_values;
1341         }
1342
1343         group_sids = talloc_array(tmp_ctx, struct dom_sid, count);
1344         if (group_sids == NULL) {
1345                 talloc_free(tmp_ctx);
1346                 return NT_STATUS_NO_MEMORY;
1347         }
1348         gids = talloc_array(tmp_ctx, gid_t, count);
1349         if (gids == NULL) {
1350                 talloc_free(tmp_ctx);
1351                 return NT_STATUS_NO_MEMORY;
1352         }
1353         num_groups = 0;
1354
1355         for (i=0; i<count; i++) {
1356                 struct id_map *id_maps[2];
1357                 struct id_map id_map;
1358                 struct ldb_val *v = &tokengroups->values[i];
1359                 enum ndr_err_code ndr_err
1360                         = ndr_pull_struct_blob(v, group_sids, &group_sids[num_groups],
1361                                                (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
1362                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1363                         talloc_free(tmp_ctx);
1364                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1365                 }
1366
1367                 ZERO_STRUCT(id_map);
1368                 id_map.sid = &group_sids[num_groups];
1369                 id_maps[0] = &id_map;
1370                 id_maps[1] = NULL;
1371
1372                 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
1373                 if (!NT_STATUS_IS_OK(status)) {
1374                         talloc_free(tmp_ctx);
1375                         return status;
1376                 }
1377                 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
1378                         gids[num_groups] = id_map.xid.id;
1379                 } else {
1380                         DEBUG(1, (__location__
1381                                   "Group %s, of which %s is a member, could not be converted to a GID\n",
1382                                   dom_sid_string(tmp_ctx, &group_sids[num_groups]),
1383                                   ldb_dn_get_linearized(msg->dn)));
1384                         talloc_free(tmp_ctx);
1385                         /* We must error out, otherwise a user might
1386                          * avoid a DENY acl based on a group they
1387                          * missed out on */
1388                         return NT_STATUS_NO_SUCH_GROUP;
1389                 }
1390
1391                 num_groups += 1;
1392                 if (num_groups == count) {
1393                         break;
1394                 }
1395         }
1396
1397         *pp_sids = talloc_steal(mem_ctx, group_sids);
1398         *pp_gids = talloc_steal(mem_ctx, gids);
1399         *p_num_groups = num_groups;
1400         talloc_free(tmp_ctx);
1401         return NT_STATUS_OK;
1402 }
1403
1404 static NTSTATUS pdb_samba_dsdb_set_unix_primary_group(struct pdb_methods *m,
1405                                                TALLOC_CTX *mem_ctx,
1406                                                struct samu *user)
1407 {
1408         return NT_STATUS_NOT_IMPLEMENTED;
1409 }
1410
1411 static NTSTATUS pdb_samba_dsdb_mod_groupmem_by_sid(struct pdb_methods *m,
1412                                                TALLOC_CTX *mem_ctx,
1413                                                const struct dom_sid *groupsid,
1414                                                const struct dom_sid *membersid,
1415                                                int mod_op)
1416 {
1417         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1418                 m->private_data, struct pdb_samba_dsdb_state);
1419         struct ldb_message *msg;
1420         int ret;
1421         struct ldb_message_element *el;
1422         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1423         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1424         msg = ldb_msg_new(tmp_ctx);
1425         if (msg == NULL) {
1426                 TALLOC_FREE(tmp_ctx);
1427                 return NT_STATUS_NO_MEMORY;
1428         }
1429
1430         msg->dn = ldb_dn_new_fmt(msg, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, groupsid));
1431         if (!msg->dn || !ldb_dn_validate(msg->dn)) {
1432                 talloc_free(tmp_ctx);
1433                 return NT_STATUS_NO_MEMORY;
1434         }
1435         ret = ldb_msg_add_fmt(msg, "member", "<SID=%s>", dom_sid_string(tmp_ctx, membersid));
1436         if (ret != LDB_SUCCESS) {
1437                 talloc_free(tmp_ctx);
1438                 return NT_STATUS_NO_MEMORY;
1439         }
1440         el = ldb_msg_find_element(msg, "member");
1441         el->flags = mod_op;
1442
1443         /* No need for transactions here, the ldb auto-transaction
1444          * code will handle things for the single operation */
1445         ret = ldb_modify(state->ldb, msg);
1446         talloc_free(tmp_ctx);
1447         if (ret != LDB_SUCCESS) {
1448                 DEBUG(10, ("ldb_modify failed: %s\n",
1449                            ldb_errstring(state->ldb)));
1450                 if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1451                         return NT_STATUS_MEMBER_IN_GROUP;
1452                 }
1453                 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
1454                         return NT_STATUS_MEMBER_NOT_IN_GROUP;
1455                 }
1456                 return NT_STATUS_LDAP(ret);
1457         }
1458
1459         return NT_STATUS_OK;
1460 }
1461
1462 static NTSTATUS pdb_samba_dsdb_mod_groupmem(struct pdb_methods *m,
1463                                      TALLOC_CTX *mem_ctx,
1464                                      uint32_t grouprid, uint32_t memberrid,
1465                                      int mod_op)
1466 {
1467         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1468                 m->private_data, struct pdb_samba_dsdb_state);
1469         const struct dom_sid *dom_sid, *groupsid, *membersid;
1470         NTSTATUS status;
1471         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1472         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1473
1474         dom_sid = samdb_domain_sid(state->ldb);
1475
1476         groupsid = dom_sid_add_rid(tmp_ctx, dom_sid, grouprid);
1477         if (groupsid == NULL) {
1478                 TALLOC_FREE(tmp_ctx);
1479                 return NT_STATUS_NO_MEMORY;
1480         }
1481         membersid = dom_sid_add_rid(tmp_ctx, dom_sid, memberrid);
1482         if (membersid == NULL) {
1483                 TALLOC_FREE(tmp_ctx);
1484                 return NT_STATUS_NO_MEMORY;
1485         }
1486         status = pdb_samba_dsdb_mod_groupmem_by_sid(m, tmp_ctx, groupsid, membersid, mod_op);
1487         talloc_free(tmp_ctx);
1488         return status;
1489 }
1490
1491 static NTSTATUS pdb_samba_dsdb_add_groupmem(struct pdb_methods *m,
1492                                      TALLOC_CTX *mem_ctx,
1493                                      uint32_t group_rid, uint32_t member_rid)
1494 {
1495         return pdb_samba_dsdb_mod_groupmem(m, mem_ctx, group_rid, member_rid,
1496                                     LDB_FLAG_MOD_ADD);
1497 }
1498
1499 static NTSTATUS pdb_samba_dsdb_del_groupmem(struct pdb_methods *m,
1500                                      TALLOC_CTX *mem_ctx,
1501                                      uint32_t group_rid, uint32_t member_rid)
1502 {
1503         return pdb_samba_dsdb_mod_groupmem(m, mem_ctx, group_rid, member_rid,
1504                                        LDB_FLAG_MOD_DELETE);
1505 }
1506
1507 static NTSTATUS pdb_samba_dsdb_create_alias(struct pdb_methods *m,
1508                                      const char *name, uint32_t *rid)
1509 {
1510         TALLOC_CTX *frame = talloc_stackframe();
1511         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1512                 m->private_data, struct pdb_samba_dsdb_state);
1513         struct dom_sid *sid;
1514
1515         struct ldb_dn *dn;
1516         NTSTATUS status;
1517
1518         /* Internally this uses transactions to ensure all the steps
1519          * happen or fail as one */
1520         status = dsdb_add_domain_alias(state->ldb, frame, name, &sid, &dn);
1521         if (!NT_STATUS_IS_OK(status)) {
1522                 TALLOC_FREE(frame);
1523         }
1524
1525         sid_peek_rid(sid, rid);
1526         TALLOC_FREE(frame);
1527         return NT_STATUS_OK;
1528 }
1529
1530 static NTSTATUS pdb_samba_dsdb_delete_alias(struct pdb_methods *m,
1531                                      const struct dom_sid *sid)
1532 {
1533         const char *attrs[] = { NULL };
1534         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1535                 m->private_data, struct pdb_samba_dsdb_state);
1536         struct ldb_message *msg;
1537         struct ldb_dn *dn;
1538         int rc;
1539         TALLOC_CTX *tmp_ctx = talloc_stackframe();
1540         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1541
1542         dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, sid));
1543         if (!dn || !ldb_dn_validate(dn)) {
1544                 talloc_free(tmp_ctx);
1545                 return NT_STATUS_NO_MEMORY;
1546         }
1547
1548         if (ldb_transaction_start(state->ldb) != LDB_SUCCESS) {
1549                 DEBUG(0, ("Failed to start transaction in dsdb_add_domain_alias(): %s\n", ldb_errstring(state->ldb)));
1550                 talloc_free(tmp_ctx);
1551                 return NT_STATUS_INTERNAL_ERROR;
1552         }
1553
1554         rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "(objectclass=group)"
1555                              "(|(grouptype=%d)(grouptype=%d)))",
1556                              GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
1557                              GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1558         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1559                 talloc_free(tmp_ctx);
1560                 ldb_transaction_cancel(state->ldb);
1561                 return NT_STATUS_NO_SUCH_ALIAS;
1562         }
1563         rc = ldb_delete(state->ldb, dn);
1564         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1565                 talloc_free(tmp_ctx);
1566                 ldb_transaction_cancel(state->ldb);
1567                 return NT_STATUS_NO_SUCH_ALIAS;
1568         } else if (rc != LDB_SUCCESS) {
1569                 DEBUG(10, ("ldb_delete failed %s\n",
1570                            ldb_errstring(state->ldb)));
1571                 ldb_transaction_cancel(state->ldb);
1572                 talloc_free(tmp_ctx);
1573                 return NT_STATUS_LDAP(rc);
1574         }
1575
1576         if (ldb_transaction_commit(state->ldb) != LDB_SUCCESS) {
1577                 DEBUG(0, ("Failed to commit transaction in pdb_samba_dsdb_delete_alias(): %s\n",
1578                           ldb_errstring(state->ldb)));
1579                 talloc_free(tmp_ctx);
1580                 return NT_STATUS_INTERNAL_ERROR;
1581         }
1582
1583         talloc_free(tmp_ctx);
1584         return NT_STATUS_OK;
1585 }
1586
1587 #if 0
1588 static NTSTATUS pdb_samba_dsdb_set_aliasinfo(struct pdb_methods *m,
1589                                       const struct dom_sid *sid,
1590                                       struct acct_info *info)
1591 {
1592         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1593                 m->private_data, struct pdb_samba_dsdb_state);
1594         struct tldap_context *ld;
1595         const char *attrs[3] = { "objectSid", "description",
1596                                  "samAccountName" };
1597         struct ldb_message **msg;
1598         char *sidstr, *dn;
1599         int rc;
1600         struct tldap_mod *mods;
1601         int num_mods;
1602         bool ok;
1603
1604         ld = pdb_samba_dsdb_ld(state);
1605         if (ld == NULL) {
1606                 return NT_STATUS_LDAP(TLDAP_SERVER_DOWN);
1607         }
1608
1609         sidstr = sid_binstring(talloc_tos(), sid);
1610         NT_STATUS_HAVE_NO_MEMORY(sidstr);
1611
1612         rc = pdb_samba_dsdb_search_fmt(state, state->domaindn, TLDAP_SCOPE_SUB,
1613                                 attrs, ARRAY_SIZE(attrs), 0, talloc_tos(),
1614                                 &msg, "(&(objectSid=%s)(objectclass=group)"
1615                                 "(|(grouptype=%d)(grouptype=%d)))",
1616                                 sidstr, GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
1617                                 GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1618         TALLOC_FREE(sidstr)
1619         if (rc != LDB_SUCCESS) {
1620                 DEBUG(10, ("ldap_search failed %s\n",
1621                            ldb_errstring(state->ldb)));
1622                 return NT_STATUS_LDAP(rc);
1623         }
1624         switch talloc_array_length(msg) {
1625         case 0:
1626                 return NT_STATUS_NO_SUCH_ALIAS;
1627         case 1:
1628                 break;
1629         default:
1630                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1631         }
1632
1633         if (!tldap_entry_dn(msg[0], &dn)) {
1634                 TALLOC_FREE(msg);
1635                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1636         }
1637
1638         mods = NULL;
1639         num_mods = 0;
1640         ok = true;
1641
1642         ok &= tldap_make_mod_fmt(
1643                 msg[0], msg, &num_mods, &mods, "description",
1644                 "%s", info->acct_desc);
1645         ok &= tldap_make_mod_fmt(
1646                 msg[0], msg, &num_mods, &mods, "samAccountName",
1647                 "%s", info->acct_name);
1648         if (!ok) {
1649                 TALLOC_FREE(msg);
1650                 return NT_STATUS_NO_MEMORY;
1651         }
1652         if (num_mods == 0) {
1653                 /* no change */
1654                 TALLOC_FREE(msg);
1655                 return NT_STATUS_OK;
1656         }
1657
1658         rc = tldap_modify(ld, dn, num_mods, mods, NULL, 0, NULL, 0);
1659         TALLOC_FREE(msg);
1660         if (rc != LDB_SUCCESS) {
1661                 DEBUG(10, ("ldap_modify failed: %s\n",
1662                            ldb_errstring(state->ldb)));
1663                 return NT_STATUS_LDAP(rc);
1664         }
1665         return NT_STATUS_OK;
1666 }
1667 #endif
1668 static NTSTATUS pdb_samba_dsdb_add_aliasmem(struct pdb_methods *m,
1669                                      const struct dom_sid *alias,
1670                                      const struct dom_sid *member)
1671 {
1672         NTSTATUS status;
1673         TALLOC_CTX *frame = talloc_stackframe();
1674         status = pdb_samba_dsdb_mod_groupmem_by_sid(m, frame, alias, member, LDB_FLAG_MOD_ADD);
1675         talloc_free(frame);
1676         return status;
1677 }
1678
1679 static NTSTATUS pdb_samba_dsdb_del_aliasmem(struct pdb_methods *m,
1680                                      const struct dom_sid *alias,
1681                                      const struct dom_sid *member)
1682 {
1683         NTSTATUS status;
1684         TALLOC_CTX *frame = talloc_stackframe();
1685         status = pdb_samba_dsdb_mod_groupmem_by_sid(m, frame, alias, member, LDB_FLAG_MOD_DELETE);
1686         talloc_free(frame);
1687         return status;
1688 }
1689
1690 static NTSTATUS pdb_samba_dsdb_enum_aliasmem(struct pdb_methods *m,
1691                                       const struct dom_sid *alias,
1692                                       TALLOC_CTX *mem_ctx,
1693                                       struct dom_sid **pmembers,
1694                                       size_t *pnum_members)
1695 {
1696         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1697                 m->private_data, struct pdb_samba_dsdb_state);
1698         struct ldb_dn *dn;
1699         unsigned int num_members;
1700         NTSTATUS status;
1701         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1702         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1703
1704         dn = ldb_dn_new_fmt(tmp_ctx, state->ldb, "<SID=%s>", dom_sid_string(tmp_ctx, alias));
1705         if (!dn || !ldb_dn_validate(dn)) {
1706                 return NT_STATUS_NO_MEMORY;
1707         }
1708
1709         status = dsdb_enum_group_mem(state->ldb, mem_ctx, dn, pmembers, &num_members);
1710         *pnum_members = num_members;
1711         if (NT_STATUS_IS_OK(status)) {
1712                 talloc_steal(mem_ctx, pmembers);
1713         }
1714         talloc_free(tmp_ctx);
1715         return status;
1716 }
1717
1718 static NTSTATUS pdb_samba_dsdb_enum_alias_memberships(struct pdb_methods *m,
1719                                                TALLOC_CTX *mem_ctx,
1720                                                const struct dom_sid *domain_sid,
1721                                                const struct dom_sid *members,
1722                                                size_t num_members,
1723                                                uint32_t **palias_rids,
1724                                                size_t *pnum_alias_rids)
1725 {
1726         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1727                 m->private_data, struct pdb_samba_dsdb_state);
1728         uint32_t *alias_rids = NULL;
1729         size_t num_alias_rids = 0;
1730         int i;
1731         struct dom_sid *groupSIDs = NULL;
1732         unsigned int num_groupSIDs = 0;
1733         char *filter;
1734         NTSTATUS status;
1735         const char *sid_string;
1736         const char *sid_dn;
1737         DATA_BLOB sid_blob;
1738
1739         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1740         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1741         /*
1742          * TODO: Get the filter right so that we only get the aliases from
1743          * either the SAM or BUILTIN
1744          */
1745
1746         filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:1.2.840.113556.1.4.803:=%u))",
1747                                  GROUP_TYPE_BUILTIN_LOCAL_GROUP);
1748         if (filter == NULL) {
1749                 return NT_STATUS_NO_MEMORY;
1750         }
1751
1752         for (i = 0; i < num_members; i++) {
1753                 sid_string = dom_sid_string(tmp_ctx, &members[i]);
1754                 if (sid_string == NULL) {
1755                         TALLOC_FREE(tmp_ctx);
1756                         return NT_STATUS_NO_MEMORY;
1757                 }
1758
1759                 sid_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", sid_string);
1760                 if (sid_dn == NULL) {
1761                         TALLOC_FREE(tmp_ctx);
1762                         return NT_STATUS_NO_MEMORY;
1763                 }
1764
1765                 sid_blob = data_blob_string_const(sid_dn);
1766
1767                 status = dsdb_expand_nested_groups(state->ldb, &sid_blob, true, filter,
1768                                                    tmp_ctx, &groupSIDs, &num_groupSIDs);
1769                 if (!NT_STATUS_IS_OK(status)) {
1770                         talloc_free(tmp_ctx);
1771                         return status;
1772                 }
1773         }
1774
1775         alias_rids = talloc_array(mem_ctx, uint32_t, num_groupSIDs);
1776         if (alias_rids == NULL) {
1777                 talloc_free(tmp_ctx);
1778                 return NT_STATUS_NO_MEMORY;
1779         }
1780
1781         for (i=0; i<num_groupSIDs; i++) {
1782                 if (sid_peek_check_rid(domain_sid, &groupSIDs[i],
1783                                        &alias_rids[num_alias_rids])) {
1784                         num_alias_rids++;;
1785                 }
1786         }
1787
1788         *palias_rids = alias_rids;
1789         *pnum_alias_rids = num_alias_rids;
1790         return NT_STATUS_OK;
1791 }
1792
1793 static NTSTATUS pdb_samba_dsdb_lookup_rids(struct pdb_methods *m,
1794                                     const struct dom_sid *domain_sid,
1795                                     int num_rids,
1796                                     uint32_t *rids,
1797                                     const char **names,
1798                                     enum lsa_SidType *lsa_attrs)
1799 {
1800         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1801                 m->private_data, struct pdb_samba_dsdb_state);
1802         NTSTATUS status;
1803
1804         TALLOC_CTX *tmp_ctx;
1805
1806         if (num_rids == 0) {
1807                 return NT_STATUS_NONE_MAPPED;
1808         }
1809
1810         tmp_ctx = talloc_stackframe();
1811         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1812
1813         status = dsdb_lookup_rids(state->ldb, tmp_ctx, domain_sid, num_rids, rids, names, lsa_attrs);
1814         talloc_free(tmp_ctx);
1815         return status;
1816 }
1817
1818 static NTSTATUS pdb_samba_dsdb_lookup_names(struct pdb_methods *m,
1819                                      const struct dom_sid *domain_sid,
1820                                      int num_names,
1821                                      const char **pp_names,
1822                                      uint32_t *rids,
1823                                      enum lsa_SidType *attrs)
1824 {
1825         return NT_STATUS_NOT_IMPLEMENTED;
1826 }
1827
1828 static NTSTATUS pdb_samba_dsdb_get_account_policy(struct pdb_methods *m,
1829                                            enum pdb_policy_type type,
1830                                            uint32_t *value)
1831 {
1832         return account_policy_get(type, value)
1833                 ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1834 }
1835
1836 static NTSTATUS pdb_samba_dsdb_set_account_policy(struct pdb_methods *m,
1837                                            enum pdb_policy_type type,
1838                                            uint32_t value)
1839 {
1840         return account_policy_set(type, value)
1841                 ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1842 }
1843
1844 static NTSTATUS pdb_samba_dsdb_get_seq_num(struct pdb_methods *m,
1845                                     time_t *seq_num_out)
1846 {
1847         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1848                 m->private_data, struct pdb_samba_dsdb_state);
1849         uint64_t seq_num;
1850         int ret = ldb_sequence_number(state->ldb, LDB_SEQ_HIGHEST_SEQ, &seq_num);
1851         if (ret == LDB_SUCCESS) {
1852                 *seq_num_out = seq_num;
1853                 return NT_STATUS_OK;
1854         } else {
1855                 return NT_STATUS_UNSUCCESSFUL;
1856         }
1857 }
1858
1859 struct pdb_samba_dsdb_search_state {
1860         uint32_t acct_flags;
1861         struct samr_displayentry *entries;
1862         uint32_t num_entries;
1863         ssize_t array_size;
1864         uint32_t current;
1865 };
1866
1867 static bool pdb_samba_dsdb_next_entry(struct pdb_search *search,
1868                                struct samr_displayentry *entry)
1869 {
1870         struct pdb_samba_dsdb_search_state *state = talloc_get_type_abort(
1871                 search->private_data, struct pdb_samba_dsdb_search_state);
1872
1873         if (state->current == state->num_entries) {
1874                 return false;
1875         }
1876
1877         entry->idx = state->entries[state->current].idx;
1878         entry->rid = state->entries[state->current].rid;
1879         entry->acct_flags = state->entries[state->current].acct_flags;
1880
1881         entry->account_name = talloc_strdup(
1882                 search, state->entries[state->current].account_name);
1883         entry->fullname = talloc_strdup(
1884                 search, state->entries[state->current].fullname);
1885         entry->description = talloc_strdup(
1886                 search, state->entries[state->current].description);
1887
1888         state->current += 1;
1889         return true;
1890 }
1891
1892 static void pdb_samba_dsdb_search_end(struct pdb_search *search)
1893 {
1894         struct pdb_samba_dsdb_search_state *state = talloc_get_type_abort(
1895                 search->private_data, struct pdb_samba_dsdb_search_state);
1896         talloc_free(state);
1897 }
1898
1899 static bool pdb_samba_dsdb_search_filter(struct pdb_methods *m,
1900                                      struct pdb_search *search,
1901                                      struct pdb_samba_dsdb_search_state **pstate,
1902                                      const char *exp_fmt, ...) _PRINTF_ATTRIBUTE(4, 5)
1903 {
1904         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1905                 m->private_data, struct pdb_samba_dsdb_state);
1906         struct pdb_samba_dsdb_search_state *sstate;
1907         const char * attrs[] = { "objectSid", "sAMAccountName", "displayName",
1908                                  "userAccountControl", "description", NULL };
1909         struct ldb_result *res;
1910         int i, rc, num_users;
1911
1912         va_list ap;
1913         char *expression = NULL;
1914
1915         TALLOC_CTX *tmp_ctx = talloc_stackframe();
1916         if (!tmp_ctx) {
1917                 return false;
1918         }
1919
1920         va_start(ap, exp_fmt);
1921         expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
1922         va_end(ap);
1923
1924         if (!expression) {
1925                 talloc_free(tmp_ctx);
1926                 return LDB_ERR_OPERATIONS_ERROR;
1927         }
1928
1929         sstate = talloc_zero(tmp_ctx, struct pdb_samba_dsdb_search_state);
1930         if (sstate == NULL) {
1931                 talloc_free(tmp_ctx);
1932                 return false;
1933         }
1934
1935         rc = dsdb_search(state->ldb, tmp_ctx, &res, ldb_get_default_basedn(state->ldb), LDB_SCOPE_SUBTREE, attrs, 0, "%s", expression);
1936         if (rc != LDB_SUCCESS) {
1937                 talloc_free(tmp_ctx);
1938                 DEBUG(10, ("dsdb_search failed: %s\n",
1939                            ldb_errstring(state->ldb)));
1940                 return false;
1941         }
1942
1943         num_users = res->count;
1944
1945         sstate->entries = talloc_array(sstate, struct samr_displayentry,
1946                                        num_users);
1947         if (sstate->entries == NULL) {
1948                 talloc_free(tmp_ctx);
1949                 DEBUG(10, ("talloc failed\n"));
1950                 return false;
1951         }
1952
1953         sstate->num_entries = 0;
1954
1955         for (i=0; i<num_users; i++) {
1956                 struct samr_displayentry *e;
1957                 struct dom_sid *sid;
1958
1959                 e = &sstate->entries[sstate->num_entries];
1960
1961                 e->idx = sstate->num_entries;
1962                 sid = samdb_result_dom_sid(tmp_ctx, res->msgs[i], "objectSid");
1963                 if (!sid) {
1964                         talloc_free(tmp_ctx);
1965                         DEBUG(10, ("Could not pull SID\n"));
1966                         return false;
1967                 }
1968                 sid_peek_rid(sid, &e->rid);
1969
1970                 e->acct_flags = samdb_result_acct_flags(res->msgs[i], "userAccountControl");
1971                 e->account_name = ldb_msg_find_attr_as_string(
1972                         res->msgs[i], "samAccountName", NULL);
1973                 if (e->account_name == NULL) {
1974                         talloc_free(tmp_ctx);
1975                         return false;
1976                 }
1977                 e->fullname = ldb_msg_find_attr_as_string(
1978                         res->msgs[i], "displayName", "");
1979                 e->description = ldb_msg_find_attr_as_string(
1980                         res->msgs[i], "description", "");
1981
1982                 sstate->num_entries += 1;
1983                 if (sstate->num_entries >= num_users) {
1984                         break;
1985                 }
1986         }
1987         talloc_steal(sstate->entries, res->msgs);
1988         search->private_data = talloc_steal(search, sstate);
1989         search->next_entry = pdb_samba_dsdb_next_entry;
1990         search->search_end = pdb_samba_dsdb_search_end;
1991         *pstate = sstate;
1992         talloc_free(tmp_ctx);
1993         return true;
1994 }
1995
1996 static bool pdb_samba_dsdb_search_users(struct pdb_methods *m,
1997                                  struct pdb_search *search,
1998                                  uint32_t acct_flags)
1999 {
2000         struct pdb_samba_dsdb_search_state *sstate;
2001         bool ret;
2002
2003         ret = pdb_samba_dsdb_search_filter(m, search, &sstate, "(objectclass=user)");
2004         if (!ret) {
2005                 return false;
2006         }
2007         sstate->acct_flags = acct_flags;
2008         return true;
2009 }
2010
2011 static bool pdb_samba_dsdb_search_groups(struct pdb_methods *m,
2012                                   struct pdb_search *search)
2013 {
2014         struct pdb_samba_dsdb_search_state *sstate;
2015         bool ret;
2016
2017         ret = pdb_samba_dsdb_search_filter(m, search, &sstate,
2018                                        "(&(grouptype=%d)(objectclass=group))",
2019                                        GTYPE_SECURITY_GLOBAL_GROUP);
2020         if (!ret) {
2021                 return false;
2022         }
2023         sstate->acct_flags = 0;
2024         return true;
2025 }
2026
2027 static bool pdb_samba_dsdb_search_aliases(struct pdb_methods *m,
2028                                    struct pdb_search *search,
2029                                    const struct dom_sid *sid)
2030 {
2031         struct pdb_samba_dsdb_search_state *sstate;
2032         bool ret;
2033
2034         ret = pdb_samba_dsdb_search_filter(m, search, &sstate,
2035                                        "(&(grouptype=%d)(objectclass=group))",
2036                                        sid_check_is_builtin(sid)
2037                                        ? GTYPE_SECURITY_BUILTIN_LOCAL_GROUP
2038                                        : GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
2039         if (!ret) {
2040                 return false;
2041         }
2042         sstate->acct_flags = 0;
2043         return true;
2044 }
2045
2046 /*
2047  * Instead of taking a gid or uid, this function takes a pointer to a
2048  * unixid.
2049  *
2050  * This acts as an in-out variable so that the idmap functions can correctly
2051  * receive ID_TYPE_BOTH, and this function ensures cache details are filled
2052  * correctly rather than forcing the cache to store ID_TYPE_UID or ID_TYPE_GID.
2053  */
2054 static bool pdb_samba_dsdb_id_to_sid(struct pdb_methods *m, struct unixid *id,
2055                                      struct dom_sid *sid)
2056 {
2057         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2058                 m->private_data, struct pdb_samba_dsdb_state);
2059         NTSTATUS status;
2060         struct id_map id_map;
2061         struct id_map *id_maps[2];
2062         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2063         if (!tmp_ctx) {
2064                 return false;
2065         }
2066
2067         id_map.xid = *id;
2068         id_maps[0] = &id_map;
2069         id_maps[1] = NULL;
2070
2071         status = idmap_xids_to_sids(state->idmap_ctx, tmp_ctx, id_maps);
2072         if (!NT_STATUS_IS_OK(status)) {
2073                 talloc_free(tmp_ctx);
2074                 return false;
2075         }
2076
2077         if (id_map.xid.type != ID_TYPE_NOT_SPECIFIED) {
2078                 id->type = id_map.xid.type;
2079         }
2080         *sid = *id_map.sid;
2081         talloc_free(tmp_ctx);
2082         return true;
2083 }
2084
2085 static bool pdb_samba_dsdb_sid_to_id(struct pdb_methods *m, const struct dom_sid *sid,
2086                                  struct unixid *id)
2087 {
2088         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2089                 m->private_data, struct pdb_samba_dsdb_state);
2090         struct id_map id_map;
2091         struct id_map *id_maps[2];
2092         NTSTATUS status;
2093         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2094         if (!tmp_ctx) {
2095                 return false;
2096         }
2097
2098         ZERO_STRUCT(id_map);
2099         id_map.sid = discard_const_p(struct dom_sid, sid);
2100         id_maps[0] = &id_map;
2101         id_maps[1] = NULL;
2102
2103         status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
2104         talloc_free(tmp_ctx);
2105         if (!NT_STATUS_IS_OK(status)) {
2106                 return false;
2107         }
2108         if (id_map.xid.type != ID_TYPE_NOT_SPECIFIED) {
2109                 *id = id_map.xid;
2110                 return true;
2111         }
2112         return false;
2113 }
2114
2115 static uint32_t pdb_samba_dsdb_capabilities(struct pdb_methods *m)
2116 {
2117         return PDB_CAP_STORE_RIDS | PDB_CAP_ADS;
2118 }
2119
2120 static bool pdb_samba_dsdb_new_rid(struct pdb_methods *m, uint32_t *rid)
2121 {
2122         return false;
2123 }
2124
2125 static bool pdb_samba_dsdb_get_trusteddom_pw(struct pdb_methods *m,
2126                                       const char *domain, char** pwd,
2127                                       struct dom_sid *sid,
2128                                       time_t *pass_last_set_time)
2129 {
2130         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2131                 m->private_data, struct pdb_samba_dsdb_state);
2132         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2133         const char * const attrs[] = {
2134                 "securityIdentifier",
2135                 "flatName",
2136                 "trustPartner",
2137                 "trustAuthOutgoing",
2138                 "whenCreated",
2139                 "msDS-SupportedEncryptionTypes",
2140                 "trustAttributes",
2141                 "trustDirection",
2142                 "trustType",
2143                 NULL
2144         };
2145         struct ldb_message *msg;
2146         const struct ldb_val *password_val;
2147         int trust_direction_flags;
2148         int trust_type;
2149         int i;
2150         DATA_BLOB password_utf16;
2151         struct trustAuthInOutBlob password_blob;
2152         struct AuthenticationInformationArray *auth_array;
2153         char *password_talloc;
2154         size_t password_len;
2155         enum ndr_err_code ndr_err;
2156         NTSTATUS status;
2157         const char *netbios_domain = NULL;
2158         const struct dom_sid *domain_sid = NULL;
2159
2160         status = sam_get_results_trust(state->ldb, tmp_ctx, domain,
2161                                        NULL, attrs, &msg);
2162         if (!NT_STATUS_IS_OK(status)) {
2163                 /*
2164                  * This can be called to work out of a domain is
2165                  * trusted, rather than just to get the password
2166                  */
2167                 DEBUG(2, ("Failed to get trusted domain password for %s.  "
2168                           "It may not be a trusted domain.\n", domain));
2169                 TALLOC_FREE(tmp_ctx);
2170                 return false;
2171         }
2172
2173         netbios_domain = ldb_msg_find_attr_as_string(msg, "flatName", NULL);
2174         if (netbios_domain == NULL) {
2175                 DEBUG(2, ("Trusted domain %s has to flatName defined.\n",
2176                           domain));
2177                 TALLOC_FREE(tmp_ctx);
2178                 return false;
2179         }
2180
2181         domain_sid = samdb_result_dom_sid(tmp_ctx, msg, "securityIdentifier");
2182         if (domain_sid == NULL) {
2183                 DEBUG(2, ("Trusted domain %s has no securityIdentifier defined.\n",
2184                           domain));
2185                 TALLOC_FREE(tmp_ctx);
2186                 return false;
2187         }
2188
2189         trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
2190         if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
2191                 DEBUG(2, ("Trusted domain %s is is not an outbound trust.\n",
2192                           domain));
2193                 TALLOC_FREE(tmp_ctx);
2194                 return false;
2195         }
2196
2197         trust_type = ldb_msg_find_attr_as_int(msg, "trustType", 0);
2198         if (trust_type == LSA_TRUST_TYPE_MIT) {
2199                 DEBUG(1, ("Trusted domain %s is is not an AD trust "
2200                           "(trustType == LSA_TRUST_TYPE_MIT).\n",
2201                           domain));
2202                 TALLOC_FREE(tmp_ctx);
2203                 return false;
2204         }
2205
2206         password_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
2207         if (password_val == NULL) {
2208                 DEBUG(2, ("Failed to get trusted domain password for %s, "
2209                           "attribute trustAuthOutgoing not returned.\n", domain));
2210                 TALLOC_FREE(tmp_ctx);
2211                 return false;
2212         }
2213
2214         ndr_err = ndr_pull_struct_blob(password_val, tmp_ctx, &password_blob,
2215                                 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
2216         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2217                 DEBUG(0, ("Failed to get trusted domain password for %s, "
2218                           "attribute trustAuthOutgoing coult not be parsed %s.\n",
2219                           domain,
2220                           ndr_map_error2string(ndr_err)));
2221                 TALLOC_FREE(tmp_ctx);
2222                 return false;
2223         }
2224
2225         auth_array = &password_blob.current;
2226
2227         for (i=0; i < auth_array->count; i++) {
2228                 if (auth_array->array[i].AuthType == TRUST_AUTH_TYPE_CLEAR) {
2229                         break;
2230                 }
2231         }
2232
2233         if (i == auth_array->count) {
2234                 DEBUG(0, ("Trusted domain %s does not have a "
2235                           "clear-text password stored\n",
2236                           domain));
2237                 TALLOC_FREE(tmp_ctx);
2238                 return false;
2239         }
2240
2241         password_utf16 = data_blob_const(auth_array->array[i].AuthInfo.clear.password,
2242                                          auth_array->array[i].AuthInfo.clear.size);
2243
2244         /*
2245          * In the future, make this function return a
2246          * cli_credentials that can store a MD4 hash with cli_credential_set_nt_hash()
2247          * but for now convert to UTF8 and fail if the string can not be converted.
2248          *
2249          * We can't safely convert the random strings windows uses into
2250          * utf8.
2251          */
2252         if (!convert_string_talloc(tmp_ctx,
2253                                    CH_UTF16MUNGED, CH_UTF8,
2254                                    password_utf16.data, password_utf16.length,
2255                                    (void *)&password_talloc,
2256                                    &password_len)) {
2257                 DEBUG(0, ("FIXME: Could not convert password for trusted domain %s"
2258                           " to UTF8. This may be a password set from Windows.\n",
2259                           domain));
2260                 TALLOC_FREE(tmp_ctx);
2261                 return false;
2262         }
2263         *pwd = SMB_STRNDUP(password_talloc, password_len);
2264         if (pass_last_set_time) {
2265                 *pass_last_set_time = nt_time_to_unix(auth_array->array[i].LastUpdateTime);
2266         }
2267
2268         if (sid != NULL) {
2269                 sid_copy(sid, domain_sid);
2270         }
2271
2272         TALLOC_FREE(tmp_ctx);
2273         return true;
2274 }
2275
2276 static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m,
2277                                                     const char *domain,
2278                                                     TALLOC_CTX *mem_ctx,
2279                                                     struct cli_credentials **_creds)
2280 {
2281         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2282                 m->private_data, struct pdb_samba_dsdb_state);
2283         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2284         const char * const attrs[] = {
2285                 "securityIdentifier",
2286                 "flatName",
2287                 "trustPartner",
2288                 "trustAuthOutgoing",
2289                 "whenCreated",
2290                 "msDS-SupportedEncryptionTypes",
2291                 "trustAttributes",
2292                 "trustDirection",
2293                 "trustType",
2294                 NULL
2295         };
2296         struct ldb_message *msg;
2297         const struct ldb_val *password_val;
2298         int trust_direction_flags;
2299         int trust_type;
2300         int i;
2301         DATA_BLOB password_utf16 = {};
2302         struct samr_Password *password_nt = NULL;
2303         uint32_t password_version = 0;
2304         DATA_BLOB old_password_utf16 = {};
2305         struct samr_Password *old_password_nt = NULL;
2306         struct trustAuthInOutBlob password_blob;
2307         enum ndr_err_code ndr_err;
2308         NTSTATUS status;
2309         time_t last_set_time = 0;
2310         struct cli_credentials *creds = NULL;
2311         bool ok;
2312         const char *my_netbios_name = NULL;
2313         const char *my_netbios_domain = NULL;
2314         const char *my_dns_domain = NULL;
2315         const char *netbios_domain = NULL;
2316         char *account_name = NULL;
2317         char *principal_name = NULL;
2318         const char *dns_domain = NULL;
2319
2320         status = sam_get_results_trust(state->ldb, tmp_ctx, domain,
2321                                        NULL, attrs, &msg);
2322         if (!NT_STATUS_IS_OK(status)) {
2323                 /*
2324                  * This can be called to work out of a domain is
2325                  * trusted, rather than just to get the password
2326                  */
2327                 DEBUG(2, ("Failed to get trusted domain password for %s.  "
2328                           "It may not be a trusted domain.\n", domain));
2329                 TALLOC_FREE(tmp_ctx);
2330                 return status;
2331         }
2332
2333         netbios_domain = ldb_msg_find_attr_as_string(msg, "flatName", NULL);
2334         if (netbios_domain == NULL) {
2335                 DEBUG(2, ("Trusted domain %s has to flatName defined.\n",
2336                           domain));
2337                 TALLOC_FREE(tmp_ctx);
2338                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2339         }
2340
2341         dns_domain = ldb_msg_find_attr_as_string(msg, "trustPartner", NULL);
2342
2343         trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
2344         if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
2345                 DEBUG(2, ("Trusted domain %s is is not an outbound trust.\n",
2346                           domain));
2347                 TALLOC_FREE(tmp_ctx);
2348                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2349         }
2350
2351         trust_type = ldb_msg_find_attr_as_int(msg, "trustType", 0);
2352         if (trust_type == LSA_TRUST_TYPE_MIT) {
2353                 DEBUG(1, ("Trusted domain %s is is not an AD trust "
2354                           "(trustType == LSA_TRUST_TYPE_MIT).\n",
2355                           domain));
2356                 TALLOC_FREE(tmp_ctx);
2357                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2358         }
2359
2360         password_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
2361         if (password_val == NULL) {
2362                 DEBUG(2, ("Failed to get trusted domain password for %s, "
2363                           "attribute trustAuthOutgoing not returned.\n", domain));
2364                 TALLOC_FREE(tmp_ctx);
2365                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2366         }
2367
2368         ndr_err = ndr_pull_struct_blob(password_val, tmp_ctx, &password_blob,
2369                                 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
2370         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2371                 DEBUG(0, ("Failed to get trusted domain password for %s, "
2372                           "attribute trustAuthOutgoing coult not be parsed %s.\n",
2373                           domain,
2374                           ndr_map_error2string(ndr_err)));
2375                 TALLOC_FREE(tmp_ctx);
2376                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2377         }
2378
2379         for (i=0; i < password_blob.current.count; i++) {
2380                 struct AuthenticationInformation *a =
2381                         &password_blob.current.array[i];
2382
2383                 switch (a->AuthType) {
2384                 case TRUST_AUTH_TYPE_NONE:
2385                         break;
2386
2387                 case TRUST_AUTH_TYPE_VERSION:
2388                         password_version = a->AuthInfo.version.version;
2389                         break;
2390
2391                 case TRUST_AUTH_TYPE_CLEAR:
2392                         last_set_time = nt_time_to_unix(a->LastUpdateTime);
2393
2394                         password_utf16 = data_blob_const(a->AuthInfo.clear.password,
2395                                                          a->AuthInfo.clear.size);
2396                         password_nt = NULL;
2397                         break;
2398
2399                 case TRUST_AUTH_TYPE_NT4OWF:
2400                         if (password_utf16.length != 0) {
2401                                 break;
2402                         }
2403
2404                         last_set_time = nt_time_to_unix(a->LastUpdateTime);
2405
2406                         password_nt = &a->AuthInfo.nt4owf.password;
2407                         break;
2408                 }
2409         }
2410
2411         for (i=0; i < password_blob.previous.count; i++) {
2412                 struct AuthenticationInformation *a = &password_blob.previous.array[i];
2413
2414                 switch (a->AuthType) {
2415                 case TRUST_AUTH_TYPE_NONE:
2416                         break;
2417
2418                 case TRUST_AUTH_TYPE_VERSION:
2419                         break;
2420
2421                 case TRUST_AUTH_TYPE_CLEAR:
2422                         old_password_utf16 = data_blob_const(a->AuthInfo.clear.password,
2423                                                          a->AuthInfo.clear.size);
2424                         old_password_nt = NULL;
2425                         break;
2426
2427                 case TRUST_AUTH_TYPE_NT4OWF:
2428                         if (old_password_utf16.length != 0) {
2429                                 break;
2430                         }
2431
2432                         old_password_nt = &a->AuthInfo.nt4owf.password;
2433                         break;
2434                 }
2435         }
2436
2437         if (password_utf16.length == 0 && password_nt == NULL) {
2438                 DEBUG(0, ("Trusted domain %s does not have a "
2439                           "clear-text nor nt password stored\n",
2440                           domain));
2441                 TALLOC_FREE(tmp_ctx);
2442                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2443         }
2444
2445         my_netbios_name = lpcfg_netbios_name(state->lp_ctx);
2446         my_netbios_domain = lpcfg_workgroup(state->lp_ctx);
2447         my_dns_domain = lpcfg_dnsdomain(state->lp_ctx);
2448
2449         creds = cli_credentials_init(tmp_ctx);
2450         if (creds == NULL) {
2451                 TALLOC_FREE(tmp_ctx);
2452                 return NT_STATUS_NO_MEMORY;
2453         }
2454
2455         ok = cli_credentials_set_workstation(creds, my_netbios_name, CRED_SPECIFIED);
2456         if (!ok) {
2457                 TALLOC_FREE(tmp_ctx);
2458                 return NT_STATUS_NO_MEMORY;
2459         }
2460
2461         ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
2462         if (!ok) {
2463                 TALLOC_FREE(tmp_ctx);
2464                 return NT_STATUS_NO_MEMORY;
2465         }
2466         ok = cli_credentials_set_realm(creds, dns_domain, CRED_SPECIFIED);
2467         if (!ok) {
2468                 TALLOC_FREE(tmp_ctx);
2469                 return NT_STATUS_NO_MEMORY;
2470         }
2471
2472         if (my_dns_domain != NULL && dns_domain != NULL) {
2473                 cli_credentials_set_secure_channel_type(creds, SEC_CHAN_DNS_DOMAIN);
2474                 account_name = talloc_asprintf(tmp_ctx, "%s.", my_dns_domain);
2475                 if (account_name == NULL) {
2476                         TALLOC_FREE(tmp_ctx);
2477                         return NT_STATUS_NO_MEMORY;
2478                 }
2479                 principal_name = talloc_asprintf(tmp_ctx, "%s$@%s", my_netbios_domain,
2480                                                  cli_credentials_get_realm(creds));
2481                 if (principal_name == NULL) {
2482                         TALLOC_FREE(tmp_ctx);
2483                         return NT_STATUS_NO_MEMORY;
2484                 }
2485         } else {
2486                 cli_credentials_set_secure_channel_type(creds, SEC_CHAN_DOMAIN);
2487                 account_name = talloc_asprintf(tmp_ctx, "%s$", my_netbios_domain);
2488                 if (account_name == NULL) {
2489                         TALLOC_FREE(tmp_ctx);
2490                         return NT_STATUS_NO_MEMORY;
2491                 }
2492                 principal_name = NULL;
2493         }
2494
2495         ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED);
2496         if (!ok) {
2497                 TALLOC_FREE(tmp_ctx);
2498                 return NT_STATUS_NO_MEMORY;
2499         }
2500
2501         if (principal_name != NULL) {
2502                 ok = cli_credentials_set_principal(creds, principal_name,
2503                                                    CRED_SPECIFIED);
2504                 if (!ok) {
2505                         TALLOC_FREE(tmp_ctx);
2506                         return NT_STATUS_NO_MEMORY;
2507                 }
2508         }
2509
2510         if (old_password_nt != NULL) {
2511                 ok = cli_credentials_set_old_nt_hash(creds, old_password_nt);
2512                 if (!ok) {
2513                         TALLOC_FREE(tmp_ctx);
2514                         return NT_STATUS_NO_MEMORY;
2515                 }
2516         }
2517
2518         if (old_password_utf16.length > 0) {
2519                 ok = cli_credentials_set_old_utf16_password(creds,
2520                                                             &old_password_utf16);
2521                 if (!ok) {
2522                         TALLOC_FREE(tmp_ctx);
2523                         return NT_STATUS_NO_MEMORY;
2524                 }
2525         }
2526
2527         if (password_nt != NULL) {
2528                 ok = cli_credentials_set_nt_hash(creds, password_nt,
2529                                                  CRED_SPECIFIED);
2530                 if (!ok) {
2531                         TALLOC_FREE(tmp_ctx);
2532                         return NT_STATUS_NO_MEMORY;
2533                 }
2534         }
2535
2536         if (password_utf16.length > 0) {
2537                 ok = cli_credentials_set_utf16_password(creds,
2538                                                         &password_utf16,
2539                                                         CRED_SPECIFIED);
2540                 if (!ok) {
2541                         TALLOC_FREE(tmp_ctx);
2542                         return NT_STATUS_NO_MEMORY;
2543                 }
2544         }
2545
2546         cli_credentials_set_password_last_changed_time(creds, last_set_time);
2547         cli_credentials_set_kvno(creds, password_version);
2548
2549         if (password_utf16.length > 0 && dns_domain != NULL) {
2550                 /*
2551                  * Force kerberos if this is an active directory domain
2552                  */
2553                 cli_credentials_set_kerberos_state(creds,
2554                                                    CRED_MUST_USE_KERBEROS);
2555         } else  {
2556                 /*
2557                  * TODO: we should allow krb5 with the raw nt hash.
2558                  */
2559                 cli_credentials_set_kerberos_state(creds,
2560                                                    CRED_DONT_USE_KERBEROS);
2561         }
2562
2563         *_creds = talloc_move(mem_ctx, &creds);
2564         TALLOC_FREE(tmp_ctx);
2565         return NT_STATUS_OK;
2566 }
2567
2568 static bool pdb_samba_dsdb_set_trusteddom_pw(struct pdb_methods *m,
2569                                       const char* domain, const char* pwd,
2570                                       const struct dom_sid *sid)
2571 {
2572         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2573                 m->private_data, struct pdb_samba_dsdb_state);
2574         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2575         const char * const attrs[] = {
2576                 "trustAuthOutgoing",
2577                 "trustDirection",
2578                 "trustType",
2579                 NULL
2580         };
2581         struct ldb_message *msg = NULL;
2582         int trust_direction_flags;
2583         int trust_type;
2584         int i;
2585         const struct ldb_val *old_val = NULL;
2586         struct trustAuthInOutBlob old_blob = {};
2587         uint32_t old_version = 0;
2588         uint32_t new_version = 0;
2589         DATA_BLOB new_utf16 = {};
2590         struct trustAuthInOutBlob new_blob = {};
2591         struct ldb_val new_val = {};
2592         struct timeval tv = timeval_current();
2593         NTTIME now = timeval_to_nttime(&tv);
2594         enum ndr_err_code ndr_err;
2595         NTSTATUS status;
2596         bool ok;
2597         int ret;
2598
2599         ret = ldb_transaction_start(state->ldb);
2600         if (ret != LDB_SUCCESS) {
2601                 DEBUG(2, ("Failed to start transaction.\n"));
2602                 TALLOC_FREE(tmp_ctx);
2603                 return false;
2604         }
2605
2606         ok = samdb_is_pdc(state->ldb);
2607         if (!ok) {
2608                 DEBUG(2, ("Password changes for domain %s are only allowed on a PDC.\n",
2609                           domain));
2610                 TALLOC_FREE(tmp_ctx);
2611                 ldb_transaction_cancel(state->ldb);
2612                 return false;
2613         }
2614
2615         status = sam_get_results_trust(state->ldb, tmp_ctx, domain,
2616                                        NULL, attrs, &msg);
2617         if (!NT_STATUS_IS_OK(status)) {
2618                 /*
2619                  * This can be called to work out of a domain is
2620                  * trusted, rather than just to get the password
2621                  */
2622                 DEBUG(2, ("Failed to get trusted domain password for %s.  "
2623                           "It may not be a trusted domain.\n", domain));
2624                 TALLOC_FREE(tmp_ctx);
2625                 ldb_transaction_cancel(state->ldb);
2626                 return false;
2627         }
2628
2629         trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
2630         if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
2631                 DEBUG(2, ("Trusted domain %s is is not an outbound trust, can't set a password.\n",
2632                           domain));
2633                 TALLOC_FREE(tmp_ctx);
2634                 ldb_transaction_cancel(state->ldb);
2635                 return false;
2636         }
2637
2638         trust_type = ldb_msg_find_attr_as_int(msg, "trustType", 0);
2639         switch (trust_type) {
2640         case LSA_TRUST_TYPE_DOWNLEVEL:
2641         case LSA_TRUST_TYPE_UPLEVEL:
2642                 break;
2643         default:
2644                 DEBUG(0, ("Trusted domain %s is of type 0x%X - "
2645                           "password changes are not supported\n",
2646                           domain, (unsigned)trust_type));
2647                 TALLOC_FREE(tmp_ctx);
2648                 ldb_transaction_cancel(state->ldb);
2649                 return false;
2650         }
2651
2652         old_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
2653         if (old_val != NULL) {
2654                 ndr_err = ndr_pull_struct_blob(old_val, tmp_ctx, &old_blob,
2655                                 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
2656                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2657                         DEBUG(0, ("Failed to get trusted domain password for %s, "
2658                                   "attribute trustAuthOutgoing coult not be parsed %s.\n",
2659                                   domain,
2660                                   ndr_map_error2string(ndr_err)));
2661                         TALLOC_FREE(tmp_ctx);
2662                         ldb_transaction_cancel(state->ldb);
2663                         return false;
2664                 }
2665         }
2666
2667         for (i=0; i < old_blob.current.count; i++) {
2668                 struct AuthenticationInformation *a =
2669                         &old_blob.current.array[i];
2670
2671                 switch (a->AuthType) {
2672                 case TRUST_AUTH_TYPE_NONE:
2673                         break;
2674
2675                 case TRUST_AUTH_TYPE_VERSION:
2676                         old_version = a->AuthInfo.version.version;
2677                         break;
2678
2679                 case TRUST_AUTH_TYPE_CLEAR:
2680                         break;
2681
2682                 case TRUST_AUTH_TYPE_NT4OWF:
2683                         break;
2684                 }
2685         }
2686
2687         new_version = old_version + 1;
2688         ok = convert_string_talloc(tmp_ctx,
2689                                    CH_UNIX, CH_UTF16,
2690                                    pwd, strlen(pwd),
2691                                    (void *)&new_utf16.data,
2692                                    &new_utf16.length);
2693         if (!ok) {
2694                 DEBUG(0, ("Failed to generate new_utf16 password for  domain %s\n",
2695                           domain));
2696                 TALLOC_FREE(tmp_ctx);
2697                 ldb_transaction_cancel(state->ldb);
2698                 return false;
2699         }
2700
2701         if (new_utf16.length < 28) {
2702                 DEBUG(0, ("new_utf16[%zu] version[%u] for domain %s to short.\n",
2703                           new_utf16.length,
2704                           (unsigned)new_version,
2705                           domain));
2706                 TALLOC_FREE(tmp_ctx);
2707                 ldb_transaction_cancel(state->ldb);
2708                 return false;
2709         }
2710         if (new_utf16.length > 498) {
2711                 DEBUG(0, ("new_utf16[%zu] version[%u] for domain %s to long.\n",
2712                           new_utf16.length,
2713                           (unsigned)new_version,
2714                           domain));
2715                 TALLOC_FREE(tmp_ctx);
2716                 ldb_transaction_cancel(state->ldb);
2717                 return false;
2718         }
2719
2720         new_blob.count = MAX(old_blob.current.count, 2);
2721         new_blob.current.array = talloc_zero_array(tmp_ctx,
2722                                         struct AuthenticationInformation,
2723                                         new_blob.count);
2724         if (new_blob.current.array == NULL) {
2725                 DEBUG(0, ("talloc_zero_array(%u) failed\n",
2726                           (unsigned)new_blob.count));
2727                 TALLOC_FREE(tmp_ctx);
2728                 ldb_transaction_cancel(state->ldb);
2729                 return false;
2730         }
2731         new_blob.previous.array = talloc_zero_array(tmp_ctx,
2732                                         struct AuthenticationInformation,
2733                                         new_blob.count);
2734         if (new_blob.current.array == NULL) {
2735                 DEBUG(0, ("talloc_zero_array(%u) failed\n",
2736                           (unsigned)new_blob.count));
2737                 TALLOC_FREE(tmp_ctx);
2738                 ldb_transaction_cancel(state->ldb);
2739                 return false;
2740         }
2741
2742         for (i = 0; i < old_blob.current.count; i++) {
2743                 struct AuthenticationInformation *o =
2744                         &old_blob.current.array[i];
2745                 struct AuthenticationInformation *p =
2746                         &new_blob.previous.array[i];
2747
2748                 *p = *o;
2749                 new_blob.previous.count++;
2750         }
2751         for (; i < new_blob.count; i++) {
2752                 struct AuthenticationInformation *pi =
2753                         &new_blob.previous.array[i];
2754
2755                 if (i == 0) {
2756                         /*
2757                          * new_blob.previous is still empty so
2758                          * we'll do new_blob.previous = new_blob.current
2759                          * below.
2760                          */
2761                         break;
2762                 }
2763
2764                 pi->LastUpdateTime = now;
2765                 pi->AuthType = TRUST_AUTH_TYPE_NONE;
2766                 new_blob.previous.count++;
2767         }
2768
2769         for (i = 0; i < new_blob.count; i++) {
2770                 struct AuthenticationInformation *ci =
2771                         &new_blob.current.array[i];
2772
2773                 ci->LastUpdateTime = now;
2774                 switch (i) {
2775                 case 0:
2776                         ci->AuthType = TRUST_AUTH_TYPE_CLEAR;
2777                         ci->AuthInfo.clear.size = new_utf16.length;
2778                         ci->AuthInfo.clear.password = new_utf16.data;
2779                         break;
2780                 case 1:
2781                         ci->AuthType = TRUST_AUTH_TYPE_VERSION;
2782                         ci->AuthInfo.version.version = new_version;
2783                         break;
2784                 default:
2785                         ci->AuthType = TRUST_AUTH_TYPE_NONE;
2786                         break;
2787                 }
2788
2789                 new_blob.current.count++;
2790         }
2791
2792         if (new_blob.previous.count == 0) {
2793                 TALLOC_FREE(new_blob.previous.array);
2794                 new_blob.previous = new_blob.current;
2795         }
2796
2797         ndr_err = ndr_push_struct_blob(&new_val, tmp_ctx, &new_blob,
2798                         (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
2799         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2800                 DEBUG(0, ("Failed to generate trustAuthOutgoing for "
2801                           "trusted domain password for %s: %s.\n",
2802                           domain, ndr_map_error2string(ndr_err)));
2803                 TALLOC_FREE(tmp_ctx);
2804                 ldb_transaction_cancel(state->ldb);
2805                 return false;
2806         }
2807
2808         msg->num_elements = 0;
2809         ret = ldb_msg_add_empty(msg, "trustAuthOutgoing",
2810                                 LDB_FLAG_MOD_REPLACE, NULL);
2811         if (ret != LDB_SUCCESS) {
2812                 DEBUG(0, ("ldb_msg_add_empty() failed\n"));
2813                 TALLOC_FREE(tmp_ctx);
2814                 ldb_transaction_cancel(state->ldb);
2815                 return false;
2816         }
2817         ret = ldb_msg_add_value(msg, "trustAuthOutgoing",
2818                                 &new_val, NULL);
2819         if (ret != LDB_SUCCESS) {
2820                 DEBUG(0, ("ldb_msg_add_value() failed\n"));
2821                 TALLOC_FREE(tmp_ctx);
2822                 ldb_transaction_cancel(state->ldb);
2823                 return false;
2824         }
2825
2826         ret = ldb_modify(state->ldb, msg);
2827         if (ret != LDB_SUCCESS) {
2828                 DEBUG(0, ("Failed to replace trustAuthOutgoing for "
2829                           "trusted domain password for %s: %s - %s\n",
2830                           domain, ldb_strerror(ret), ldb_errstring(state->ldb)));
2831                 TALLOC_FREE(tmp_ctx);
2832                 ldb_transaction_cancel(state->ldb);
2833                 return false;
2834         }
2835
2836         ret = ldb_transaction_commit(state->ldb);
2837         if (ret != LDB_SUCCESS) {
2838                 DEBUG(0, ("Failed to commit trustAuthOutgoing for "
2839                           "trusted domain password for %s: %s - %s\n",
2840                           domain, ldb_strerror(ret), ldb_errstring(state->ldb)));
2841                 TALLOC_FREE(tmp_ctx);
2842                 return false;
2843         }
2844
2845         DEBUG(1, ("Added new_version[%u] to trustAuthOutgoing for "
2846                   "trusted domain password for %s.\n",
2847                   (unsigned)new_version, domain));
2848         TALLOC_FREE(tmp_ctx);
2849         return true;
2850 }
2851
2852 static bool pdb_samba_dsdb_del_trusteddom_pw(struct pdb_methods *m,
2853                                       const char *domain)
2854 {
2855         return false;
2856 }
2857
2858 static NTSTATUS pdb_samba_dsdb_enum_trusteddoms(struct pdb_methods *m,
2859                                          TALLOC_CTX *mem_ctx,
2860                                          uint32_t *num_domains,
2861                                          struct trustdom_info ***domains)
2862 {
2863         *num_domains = 0;
2864         *domains = NULL;
2865         return NT_STATUS_OK;
2866 }
2867
2868 static bool pdb_samba_dsdb_is_responsible_for_wellknown(struct pdb_methods *m)
2869 {
2870         return true;
2871 }
2872
2873 static bool pdb_samba_dsdb_is_responsible_for_everything_else(struct pdb_methods *m)
2874 {
2875         return true;
2876 }
2877
2878 static void pdb_samba_dsdb_init_methods(struct pdb_methods *m)
2879 {
2880         m->name = "samba_dsdb";
2881         m->get_domain_info = pdb_samba_dsdb_get_domain_info;
2882         m->getsampwnam = pdb_samba_dsdb_getsampwnam;
2883         m->getsampwsid = pdb_samba_dsdb_getsampwsid;
2884         m->create_user = pdb_samba_dsdb_create_user;
2885         m->delete_user = pdb_samba_dsdb_delete_user;
2886         m->add_sam_account = pdb_samba_dsdb_add_sam_account;
2887         m->update_sam_account = pdb_samba_dsdb_update_sam_account;
2888         m->delete_sam_account = pdb_samba_dsdb_delete_sam_account;
2889         m->rename_sam_account = pdb_samba_dsdb_rename_sam_account;
2890         m->update_login_attempts = pdb_samba_dsdb_update_login_attempts;
2891         m->getgrsid = pdb_samba_dsdb_getgrsid;
2892         m->getgrgid = pdb_samba_dsdb_getgrgid;
2893         m->getgrnam = pdb_samba_dsdb_getgrnam;
2894         m->create_dom_group = pdb_samba_dsdb_create_dom_group;
2895         m->delete_dom_group = pdb_samba_dsdb_delete_dom_group;
2896         m->add_group_mapping_entry = pdb_samba_dsdb_add_group_mapping_entry;
2897         m->update_group_mapping_entry = pdb_samba_dsdb_update_group_mapping_entry;
2898         m->delete_group_mapping_entry = pdb_samba_dsdb_delete_group_mapping_entry;
2899         m->enum_group_mapping = pdb_samba_dsdb_enum_group_mapping;
2900         m->enum_group_members = pdb_samba_dsdb_enum_group_members;
2901         m->enum_group_memberships = pdb_samba_dsdb_enum_group_memberships;
2902         m->set_unix_primary_group = pdb_samba_dsdb_set_unix_primary_group;
2903         m->add_groupmem = pdb_samba_dsdb_add_groupmem;
2904         m->del_groupmem = pdb_samba_dsdb_del_groupmem;
2905         m->create_alias = pdb_samba_dsdb_create_alias;
2906         m->delete_alias = pdb_samba_dsdb_delete_alias;
2907         m->get_aliasinfo = pdb_default_get_aliasinfo;
2908         m->add_aliasmem = pdb_samba_dsdb_add_aliasmem;
2909         m->del_aliasmem = pdb_samba_dsdb_del_aliasmem;
2910         m->enum_aliasmem = pdb_samba_dsdb_enum_aliasmem;
2911         m->enum_alias_memberships = pdb_samba_dsdb_enum_alias_memberships;
2912         m->lookup_rids = pdb_samba_dsdb_lookup_rids;
2913         m->lookup_names = pdb_samba_dsdb_lookup_names;
2914         m->get_account_policy = pdb_samba_dsdb_get_account_policy;
2915         m->set_account_policy = pdb_samba_dsdb_set_account_policy;
2916         m->get_seq_num = pdb_samba_dsdb_get_seq_num;
2917         m->search_users = pdb_samba_dsdb_search_users;
2918         m->search_groups = pdb_samba_dsdb_search_groups;
2919         m->search_aliases = pdb_samba_dsdb_search_aliases;
2920         m->id_to_sid = pdb_samba_dsdb_id_to_sid;
2921         m->sid_to_id = pdb_samba_dsdb_sid_to_id;
2922         m->capabilities = pdb_samba_dsdb_capabilities;
2923         m->new_rid = pdb_samba_dsdb_new_rid;
2924         m->get_trusteddom_pw = pdb_samba_dsdb_get_trusteddom_pw;
2925         m->get_trusteddom_creds = pdb_samba_dsdb_get_trusteddom_creds;
2926         m->set_trusteddom_pw = pdb_samba_dsdb_set_trusteddom_pw;
2927         m->del_trusteddom_pw = pdb_samba_dsdb_del_trusteddom_pw;
2928         m->enum_trusteddoms = pdb_samba_dsdb_enum_trusteddoms;
2929         m->is_responsible_for_wellknown =
2930                                 pdb_samba_dsdb_is_responsible_for_wellknown;
2931         m->is_responsible_for_everything_else =
2932                                 pdb_samba_dsdb_is_responsible_for_everything_else;
2933 }
2934
2935 static void free_private_data(void **vp)
2936 {
2937         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2938                 *vp, struct pdb_samba_dsdb_state);
2939         talloc_unlink(state, state->ldb);
2940         return;
2941 }
2942
2943 static NTSTATUS pdb_samba_dsdb_init_secrets(struct pdb_methods *m)
2944 {
2945         struct pdb_domain_info *dom_info;
2946         struct dom_sid stored_sid;
2947         struct GUID stored_guid;
2948         bool sid_exists_and_matches = false;
2949         bool guid_exists_and_matches = false;
2950         bool ret;
2951
2952         dom_info = pdb_samba_dsdb_get_domain_info(m, m);
2953         if (!dom_info) {
2954                 return NT_STATUS_UNSUCCESSFUL;
2955         }
2956
2957         ret = secrets_fetch_domain_sid(dom_info->name, &stored_sid);
2958         if (ret) {
2959                 if (dom_sid_equal(&stored_sid, &dom_info->sid)) {
2960                         sid_exists_and_matches = true;
2961                 }
2962         }
2963
2964         if (sid_exists_and_matches == false) {
2965                 secrets_clear_domain_protection(dom_info->name);
2966                 ret = secrets_store_domain_sid(dom_info->name,
2967                                                &dom_info->sid);
2968                 ret &= secrets_mark_domain_protected(dom_info->name);
2969                 if (!ret) {
2970                         goto done;
2971                 }
2972         }
2973
2974         ret = secrets_fetch_domain_guid(dom_info->name, &stored_guid);
2975         if (ret) {
2976                 if (GUID_equal(&stored_guid, &dom_info->guid)) {
2977                         guid_exists_and_matches = true;
2978                 }
2979         }
2980
2981         if (guid_exists_and_matches == false) {
2982                 secrets_clear_domain_protection(dom_info->name);
2983                 ret = secrets_store_domain_guid(dom_info->name,
2984                                                &dom_info->guid);
2985                 ret &= secrets_mark_domain_protected(dom_info->name);
2986                 if (!ret) {
2987                         goto done;
2988                 }
2989         }
2990
2991 done:
2992         TALLOC_FREE(dom_info);
2993         if (!ret) {
2994                 return NT_STATUS_UNSUCCESSFUL;
2995         }
2996         return NT_STATUS_OK;
2997 }
2998
2999 static NTSTATUS pdb_init_samba_dsdb(struct pdb_methods **pdb_method,
3000                              const char *location)
3001 {
3002         struct pdb_methods *m;
3003         struct pdb_samba_dsdb_state *state;
3004         NTSTATUS status;
3005
3006         if ( !NT_STATUS_IS_OK(status = make_pdb_method( &m )) ) {
3007                 return status;
3008         }
3009
3010         state = talloc_zero(m, struct pdb_samba_dsdb_state);
3011         if (state == NULL) {
3012                 goto nomem;
3013         }
3014         m->private_data = state;
3015         m->free_private_data = free_private_data;
3016         pdb_samba_dsdb_init_methods(m);
3017
3018         state->ev = s4_event_context_init(state);
3019         if (!state->ev) {
3020                 DEBUG(0, ("s4_event_context_init failed\n"));
3021                 goto nomem;
3022         }
3023
3024         state->lp_ctx = loadparm_init_s3(state, loadparm_s3_helpers());
3025         if (state->lp_ctx == NULL) {
3026                 DEBUG(0, ("loadparm_init_s3 failed\n"));
3027                 goto nomem;
3028         }
3029
3030         if (location) {
3031                 state->ldb = samdb_connect_url(state,
3032                                    state->ev,
3033                                    state->lp_ctx,
3034                                    system_session(state->lp_ctx),
3035                                    0, location);
3036         } else {
3037                 state->ldb = samdb_connect(state,
3038                                    state->ev,
3039                                    state->lp_ctx,
3040                                    system_session(state->lp_ctx), 0);
3041         }
3042
3043         if (!state->ldb) {
3044                 DEBUG(0, ("samdb_connect failed\n"));
3045                 status = NT_STATUS_INTERNAL_ERROR;
3046                 goto fail;
3047         }
3048
3049         state->idmap_ctx = idmap_init(state, state->ev,
3050                                       state->lp_ctx);
3051         if (!state->idmap_ctx) {
3052                 DEBUG(0, ("idmap failed\n"));
3053                 status = NT_STATUS_INTERNAL_ERROR;
3054                 goto fail;
3055         }
3056
3057         status = pdb_samba_dsdb_init_secrets(m);
3058         if (!NT_STATUS_IS_OK(status)) {
3059                 DEBUG(10, ("pdb_samba_dsdb_init_secrets failed!\n"));
3060                 goto fail;
3061         }
3062
3063         *pdb_method = m;
3064         return NT_STATUS_OK;
3065 nomem:
3066         status = NT_STATUS_NO_MEMORY;
3067 fail:
3068         TALLOC_FREE(m);
3069         return status;
3070 }
3071
3072 NTSTATUS pdb_samba_dsdb_init(void);
3073 NTSTATUS pdb_samba_dsdb_init(void)
3074 {
3075         NTSTATUS status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "samba_dsdb",
3076                                               pdb_init_samba_dsdb);
3077         if (!NT_STATUS_IS_OK(status)) {
3078                 return status;
3079         }
3080         return smb_register_passdb(PASSDB_INTERFACE_VERSION, "samba4",
3081                                    pdb_init_samba_dsdb);
3082 }