source3/utils/net_sam.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Local SAM access routines
   4  *  Copyright (C) Volker Lendecke 2006
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20
  21 #include "includes.h"
  22 #include "system/passwd.h"
  23 #include "utils/net.h"
  24 #include "../librpc/gen_ndr/samr.h"
  25 #include "smbldap.h"
  26 #include "../libcli/security/security.h"
  27 #include "lib/winbind_util.h"
  28 #include "passdb.h"
  29 #include "passdb/pdb_ldap_util.h"
  30 #include "passdb/pdb_ldap_schema.h"
  31 #include "lib/privileges.h"
  32 #include "secrets.h"
  33 #include "idmap.h"
  34
  35 /*
  36  * Set a user's data
  37  */
  38
  39 static int net_sam_userset(struct net_context *c, int argc, const char **argv,
  40                            const char *field,
  41                            bool (*fn)(struct samu *, const char *,
  42                                       enum pdb_value_state))
  43 {
  44         struct samu *sam_acct = NULL;
  45         struct dom_sid sid;
  46         enum lsa_SidType type;
  47         const char *dom, *name;
  48         NTSTATUS status;
  49
  50         if (argc != 2 || c->display_usage) {
  51                 d_fprintf(stderr, "%s\n", _("Usage:"));
  52                 d_fprintf(stderr, _("net sam set %s <user> <value>\n"),
  53                           field);
  54                 return -1;
  55         }
  56
  57         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
  58                          &dom, &name, &sid, &type)) {
  59                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
  60                 return -1;
  61         }
  62
  63         if (type != SID_NAME_USER) {
  64                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
  65                           sid_type_lookup(type));
  66                 return -1;
  67         }
  68
  69         if ( !(sam_acct = samu_new( NULL )) ) {
  70                 d_fprintf(stderr, _("Internal error\n"));
  71                 return -1;
  72         }
  73
  74         if (!pdb_getsampwsid(sam_acct, &sid)) {
  75                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
  76                 return -1;
  77         }
  78
  79         if (!fn(sam_acct, argv[1], PDB_CHANGED)) {
  80                 d_fprintf(stderr, _("Internal error\n"));
  81                 return -1;
  82         }
  83
  84         status = pdb_update_sam_account(sam_acct);
  85         if (!NT_STATUS_IS_OK(status)) {
  86                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
  87                           argv[0], nt_errstr(status));
  88                 return -1;
  89         }
  90
  91         TALLOC_FREE(sam_acct);
  92
  93         d_printf(_("Updated %s for %s\\%s to %s\n"), field, dom, name, argv[1]);
  94         return 0;
  95 }
  96
  97 static int net_sam_set_fullname(struct net_context *c, int argc,
  98                                 const char **argv)
  99 {
 100         return net_sam_userset(c, argc, argv, "fullname",
 101                                pdb_set_fullname);
 102 }
 103
 104 static int net_sam_set_logonscript(struct net_context *c, int argc,
 105                                    const char **argv)
 106 {
 107         return net_sam_userset(c, argc, argv, "logonscript",
 108                                pdb_set_logon_script);
 109 }
 110
 111 static int net_sam_set_profilepath(struct net_context *c, int argc,
 112                                    const char **argv)
 113 {
 114         return net_sam_userset(c, argc, argv, "profilepath",
 115                                pdb_set_profile_path);
 116 }
 117
 118 static int net_sam_set_homedrive(struct net_context *c, int argc,
 119                                  const char **argv)
 120 {
 121         return net_sam_userset(c, argc, argv, "homedrive",
 122                                pdb_set_dir_drive);
 123 }
 124
 125 static int net_sam_set_homedir(struct net_context *c, int argc,
 126                                const char **argv)
 127 {
 128         return net_sam_userset(c, argc, argv, "homedir",
 129                                pdb_set_homedir);
 130 }
 131
 132 static int net_sam_set_workstations(struct net_context *c, int argc,
 133                                     const char **argv)
 134 {
 135         return net_sam_userset(c, argc, argv, "workstations",
 136                                pdb_set_workstations);
 137 }
 138
 139 /*
 140  * Set account flags
 141  */
 142
 143 static int net_sam_set_userflag(struct net_context *c, int argc,
 144                                 const char **argv, const char *field,
 145                                 uint16_t flag)
 146 {
 147         struct samu *sam_acct = NULL;
 148         struct dom_sid sid;
 149         enum lsa_SidType type;
 150         const char *dom, *name;
 151         NTSTATUS status;
 152         uint32_t acct_flags;
 153
 154         if ((argc != 2) || c->display_usage ||
 155             (!strequal(argv[1], "yes") &&
 156              !strequal(argv[1], "no"))) {
 157                 d_fprintf(stderr, "%s\n", _("Usage:"));
 158                 d_fprintf(stderr, _("net sam set %s <user> [yes|no]\n"),
 159                           field);
 160                 return -1;
 161         }
 162
 163         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 164                          &dom, &name, &sid, &type)) {
 165                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 166                 return -1;
 167         }
 168
 169         if (type != SID_NAME_USER) {
 170                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
 171                           sid_type_lookup(type));
 172                 return -1;
 173         }
 174
 175         if ( !(sam_acct = samu_new( NULL )) ) {
 176                 d_fprintf(stderr, _("Internal error\n"));
 177                 return -1;
 178         }
 179
 180         if (!pdb_getsampwsid(sam_acct, &sid)) {
 181                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
 182                 return -1;
 183         }
 184
 185         acct_flags = pdb_get_acct_ctrl(sam_acct);
 186
 187         if (strequal(argv[1], "yes")) {
 188                 acct_flags |= flag;
 189         } else {
 190                 acct_flags &= ~flag;
 191         }
 192
 193         pdb_set_acct_ctrl(sam_acct, acct_flags, PDB_CHANGED);
 194
 195         status = pdb_update_sam_account(sam_acct);
 196         if (!NT_STATUS_IS_OK(status)) {
 197                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
 198                           argv[0], nt_errstr(status));
 199                 return -1;
 200         }
 201
 202         TALLOC_FREE(sam_acct);
 203
 204         d_fprintf(stderr, _("Updated flag %s for %s\\%s to %s\n"), field, dom,
 205                   name, argv[1]);
 206         return 0;
 207 }
 208
 209 static int net_sam_set_disabled(struct net_context *c, int argc,
 210                                 const char **argv)
 211 {
 212         return net_sam_set_userflag(c, argc, argv, "disabled", ACB_DISABLED);
 213 }
 214
 215 static int net_sam_set_pwnotreq(struct net_context *c, int argc,
 216                                 const char **argv)
 217 {
 218         return net_sam_set_userflag(c, argc, argv, "pwnotreq", ACB_PWNOTREQ);
 219 }
 220
 221 static int net_sam_set_autolock(struct net_context *c, int argc,
 222                                 const char **argv)
 223 {
 224         return net_sam_set_userflag(c, argc, argv, "autolock", ACB_AUTOLOCK);
 225 }
 226
 227 static int net_sam_set_pwnoexp(struct net_context *c, int argc,
 228                                const char **argv)
 229 {
 230         return net_sam_set_userflag(c, argc, argv, "pwnoexp", ACB_PWNOEXP);
 231 }
 232
 233 /*
 234  * Set pass last change time, based on force pass change now
 235  */
 236
 237 static int net_sam_set_pwdmustchangenow(struct net_context *c, int argc,
 238                                         const char **argv)
 239 {
 240         struct samu *sam_acct = NULL;
 241         struct dom_sid sid;
 242         enum lsa_SidType type;
 243         const char *dom, *name;
 244         NTSTATUS status;
 245
 246         if ((argc != 2) || c->display_usage ||
 247             (!strequal(argv[1], "yes") &&
 248              !strequal(argv[1], "no"))) {
 249                 d_fprintf(stderr, "%s\n%s",
 250                           _("Usage:"),
 251                           _("net sam set pwdmustchangenow <user> [yes|no]\n"));
 252                 return -1;
 253         }
 254
 255         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 256                          &dom, &name, &sid, &type)) {
 257                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 258                 return -1;
 259         }
 260
 261         if (type != SID_NAME_USER) {
 262                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
 263                           sid_type_lookup(type));
 264                 return -1;
 265         }
 266
 267         if ( !(sam_acct = samu_new( NULL )) ) {
 268                 d_fprintf(stderr, _("Internal error\n"));
 269                 return -1;
 270         }
 271
 272         if (!pdb_getsampwsid(sam_acct, &sid)) {
 273                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
 274                 return -1;
 275         }
 276
 277         if (strequal(argv[1], "yes")) {
 278                 pdb_set_pass_last_set_time(sam_acct, 0, PDB_CHANGED);
 279         } else {
 280                 pdb_set_pass_last_set_time(sam_acct, time(NULL), PDB_CHANGED);
 281         }
 282
 283         status = pdb_update_sam_account(sam_acct);
 284         if (!NT_STATUS_IS_OK(status)) {
 285                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
 286                           argv[0], nt_errstr(status));
 287                 return -1;
 288         }
 289
 290         TALLOC_FREE(sam_acct);
 291
 292         d_fprintf(stderr, _("Updated 'user must change password at next logon' "
 293                             "for %s\\%s to %s\n"), dom,
 294                   name, argv[1]);
 295         return 0;
 296 }
 297
 298
 299 /*
 300  * Set a user's or a group's comment
 301  */
 302
 303 static int net_sam_set_comment(struct net_context *c, int argc,
 304                                const char **argv)
 305 {
 306         GROUP_MAP *map;
 307         struct dom_sid sid;
 308         enum lsa_SidType type;
 309         const char *dom, *name;
 310         NTSTATUS status;
 311
 312         if (argc != 2 || c->display_usage) {
 313                 d_fprintf(stderr, "%s\n%s",
 314                           _("Usage:"),
 315                           _("net sam set comment <name> <comment>\n"));
 316                 return -1;
 317         }
 318
 319         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 320                          &dom, &name, &sid, &type)) {
 321                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 322                 return -1;
 323         }
 324
 325         if (type == SID_NAME_USER) {
 326                 return net_sam_userset(c, argc, argv, "comment",
 327                                        pdb_set_acct_desc);
 328         }
 329
 330         if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
 331             (type != SID_NAME_WKN_GRP)) {
 332                 d_fprintf(stderr, _("%s is a %s, not a group\n"), argv[0],
 333                           sid_type_lookup(type));
 334                 return -1;
 335         }
 336
 337         map = talloc_zero(talloc_tos(), GROUP_MAP);
 338         if (!map) {
 339                 d_fprintf(stderr, _("Out of memory!\n"));
 340                 return -1;
 341         }
 342
 343         if (!pdb_getgrsid(map, sid)) {
 344                 d_fprintf(stderr, _("Could not load group %s\n"), argv[0]);
 345                 return -1;
 346         }
 347
 348         map->comment = talloc_strdup(map, argv[1]);
 349         if (!map->comment) {
 350                 d_fprintf(stderr, _("Out of memory!\n"));
 351                 return -1;
 352         }
 353
 354         status = pdb_update_group_mapping_entry(map);
 355
 356         if (!NT_STATUS_IS_OK(status)) {
 357                 d_fprintf(stderr, _("Updating group mapping entry failed with "
 358                           "%s\n"), nt_errstr(status));
 359                 return -1;
 360         }
 361
 362         d_printf("Updated comment of group %s\\%s to %s\n", dom, name,
 363                  argv[1]);
 364
 365         TALLOC_FREE(map);
 366         return 0;
 367 }
 368
 369 static int net_sam_set(struct net_context *c, int argc, const char **argv)
 370 {
 371         struct functable func[] = {
 372                 {
 373                         "homedir",
 374                         net_sam_set_homedir,
 375                         NET_TRANSPORT_LOCAL,
 376                         N_("Change a user's home directory"),
 377                         N_("net sam set homedir\n"
 378                            "    Change a user's home directory")
 379                 },
 380                 {
 381                         "profilepath",
 382                         net_sam_set_profilepath,
 383                         NET_TRANSPORT_LOCAL,
 384                         N_("Change a user's profile path"),
 385                         N_("net sam set profilepath\n"
 386                            "    Change a user's profile path")
 387                 },
 388                 {
 389                         "comment",
 390                         net_sam_set_comment,
 391                         NET_TRANSPORT_LOCAL,
 392                         N_("Change a users or groups description"),
 393                         N_("net sam set comment\n"
 394                            "    Change a users or groups description")
 395                 },
 396                 {
 397                         "fullname",
 398                         net_sam_set_fullname,
 399                         NET_TRANSPORT_LOCAL,
 400                         N_("Change a user's full name"),
 401                         N_("net sam set fullname\n"
 402                            "    Change a user's full name")
 403                 },
 404                 {
 405                         "logonscript",
 406                         net_sam_set_logonscript,
 407                         NET_TRANSPORT_LOCAL,
 408                         N_("Change a user's logon script"),
 409                         N_("net sam set logonscript\n"
 410                            "    Change a user's logon script")
 411                 },
 412                 {
 413                         "homedrive",
 414                         net_sam_set_homedrive,
 415                         NET_TRANSPORT_LOCAL,
 416                         N_("Change a user's home drive"),
 417                         N_("net sam set homedrive\n"
 418                            "    Change a user's home drive")
 419                 },
 420                 {
 421                         "workstations",
 422                         net_sam_set_workstations,
 423                         NET_TRANSPORT_LOCAL,
 424                         N_("Change a user's allowed workstations"),
 425                         N_("net sam set workstations\n"
 426                            "    Change a user's allowed workstations")
 427                 },
 428                 {
 429                         "disabled",
 430                         net_sam_set_disabled,
 431                         NET_TRANSPORT_LOCAL,
 432                         N_("Disable/Enable a user"),
 433                         N_("net sam set disable\n"
 434                            "    Disable/Enable a user")
 435                 },
 436                 {
 437                         "pwnotreq",
 438                         net_sam_set_pwnotreq,
 439                         NET_TRANSPORT_LOCAL,
 440                         N_("Disable/Enable the password not required flag"),
 441                         N_("net sam set pwnotreq\n"
 442                            "    Disable/Enable the password not required flag")
 443                 },
 444                 {
 445                         "autolock",
 446                         net_sam_set_autolock,
 447                         NET_TRANSPORT_LOCAL,
 448                         N_("Disable/Enable a user's lockout flag"),
 449                         N_("net sam set autolock\n"
 450                            "    Disable/Enable a user's lockout flag")
 451                 },
 452                 {
 453                         "pwnoexp",
 454                         net_sam_set_pwnoexp,
 455                         NET_TRANSPORT_LOCAL,
 456                         N_("Disable/Enable whether a user's pw does not "
 457                            "expire"),
 458                         N_("net sam set pwnoexp\n"
 459                            "    Disable/Enable whether a user's pw does not "
 460                            "expire")
 461                 },
 462                 {
 463                         "pwdmustchangenow",
 464                         net_sam_set_pwdmustchangenow,
 465                         NET_TRANSPORT_LOCAL,
 466                         N_("Force users password must change at next logon"),
 467                         N_("net sam set pwdmustchangenow\n"
 468                            "    Force users password must change at next logon")
 469                 },
 470                 {NULL, NULL, 0, NULL, NULL}
 471         };
 472
 473         return net_run_function(c, argc, argv, "net sam set", func);
 474 }
 475
 476 /*
 477  * Manage account policies
 478  */
 479
 480 static int net_sam_policy_set(struct net_context *c, int argc, const char **argv)
 481 {
 482         const char *account_policy = NULL;
 483         uint32_t value = 0;
 484         uint32_t old_value = 0;
 485         enum pdb_policy_type field;
 486         int err = 0;
 487
 488         if (argc != 2 || c->display_usage) {
 489                 d_fprintf(stderr, "%s\n%s",
 490                           _("Usage:"),
 491                           _("net sam policy set \"<account policy>\" <value>\n"));
 492                 return -1;
 493         }
 494
 495         account_policy = argv[0];
 496         field = account_policy_name_to_typenum(account_policy);
 497
 498         if (strequal(argv[1], "forever") || strequal(argv[1], "never")
 499             || strequal(argv[1], "off")) {
 500                 value = -1;
 501         }
 502         else {
 503                 value = smb_strtoul(argv[1],
 504                                     NULL,
 505                                     10,
 506                                     &err,
 507                                     SMB_STR_FULL_STR_CONV);
 508
 509                 if (err != 0) {
 510                         d_printf(_("Unable to set policy \"%s\"! Invalid value "
 511                                  "\"%s\".\n"),
 512                                  account_policy, argv[1]);
 513                         return -1;
 514                 }
 515         }
 516
 517         if (field == 0) {
 518                 const char **names;
 519                 int i, count;
 520
 521                 account_policy_names_list(talloc_tos(), &names, &count);
 522                 d_fprintf(stderr, _("No account policy \"%s\"!\n\n"), argv[0]);
 523                 d_fprintf(stderr, _("Valid account policies are:\n"));
 524
 525                 for (i=0; i<count; i++) {
 526                         d_fprintf(stderr, "%s\n", names[i]);
 527                 }
 528
 529                 TALLOC_FREE(names);
 530
 531                 return -1;
 532         }
 533
 534         if (!pdb_get_account_policy(field, &old_value)) {
 535                 d_fprintf(stderr, _("Valid account policy, but unable to fetch "
 536                           "value!\n"));
 537         } else {
 538                 d_printf(_("Account policy \"%s\" value was: %d\n"),
 539                         account_policy, old_value);
 540         }
 541
 542         if (!pdb_set_account_policy(field, value)) {
 543                 d_fprintf(stderr, _("Valid account policy, but unable to "
 544                           "set value!\n"));
 545                 return -1;
 546         } else {
 547                 d_printf(_("Account policy \"%s\" value is now: %d\n"),
 548                         account_policy, value);
 549         }
 550
 551         return 0;
 552 }
 553
 554 static int net_sam_policy_show(struct net_context *c, int argc, const char **argv)
 555 {
 556         const char *account_policy = NULL;
 557         uint32_t old_value;
 558         enum pdb_policy_type field;
 559
 560         if (argc != 1 || c->display_usage) {
 561                 d_fprintf(stderr, "%s\n%s",
 562                           _("Usage:"),
 563                           _("net sam policy show \"<account policy>\"\n"));
 564                 return -1;
 565         }
 566
 567         account_policy = argv[0];
 568         field = account_policy_name_to_typenum(account_policy);
 569
 570         if (field == 0) {
 571                 const char **names;
 572                 int count;
 573                 int i;
 574                 account_policy_names_list(talloc_tos(), &names, &count);
 575                 d_fprintf(stderr, _("No account policy by that name!\n"));
 576                 if (count != 0) {
 577                         d_fprintf(stderr, _("Valid account policies "
 578                                   "are:\n"));
 579                         for (i=0; i<count; i++) {
 580                                 d_fprintf(stderr, "%s\n", names[i]);
 581                         }
 582                 }
 583                 TALLOC_FREE(names);
 584                 return -1;
 585         }
 586
 587         if (!pdb_get_account_policy(field, &old_value)) {
 588                 fprintf(stderr, _("Valid account policy, but unable to "
 589                         "fetch value!\n"));
 590                 return -1;
 591         }
 592
 593         printf(_("Account policy \"%s\" description: %s\n"),
 594                account_policy, account_policy_get_desc(field));
 595         printf(_("Account policy \"%s\" value is: %d\n"), account_policy,
 596                old_value);
 597         return 0;
 598 }
 599
 600 static int net_sam_policy_list(struct net_context *c, int argc, const char **argv)
 601 {
 602         const char **names;
 603         int count;
 604         int i;
 605
 606         if (c->display_usage) {
 607                 d_printf(  "%s\n"
 608                            "net sam policy list\n"
 609                            "    %s\n",
 610                          _("Usage:"),
 611                          _("List account policies"));
 612                 return 0;
 613         }
 614
 615         account_policy_names_list(talloc_tos(), &names, &count);
 616         if (count != 0) {
 617                 d_fprintf(stderr, _("Valid account policies "
 618                           "are:\n"));
 619                 for (i = 0; i < count ; i++) {
 620                         d_fprintf(stderr, "%s\n", names[i]);
 621                 }
 622         }
 623         TALLOC_FREE(names);
 624         return -1;
 625 }
 626
 627 static int net_sam_policy(struct net_context *c, int argc, const char **argv)
 628 {
 629         struct functable func[] = {
 630                 {
 631                         "list",
 632                         net_sam_policy_list,
 633                         NET_TRANSPORT_LOCAL,
 634                         N_("List account policies"),
 635                         N_("net sam policy list\n"
 636                            "    List account policies")
 637                 },
 638                 {
 639                         "show",
 640                         net_sam_policy_show,
 641                         NET_TRANSPORT_LOCAL,
 642                         N_("Show account policies"),
 643                         N_("net sam policy show\n"
 644                            "    Show account policies")
 645                 },
 646                 {
 647                         "set",
 648                         net_sam_policy_set,
 649                         NET_TRANSPORT_LOCAL,
 650                         N_("Change account policies"),
 651                         N_("net sam policy set\n"
 652                            "    Change account policies")
 653                 },
 654                 {NULL, NULL, 0, NULL, NULL}
 655         };
 656
 657         return net_run_function(c, argc, argv, "net sam policy", func);
 658 }
 659
 660 static int net_sam_rights_list(struct net_context *c, int argc,
 661                                const char **argv)
 662 {
 663         enum sec_privilege privilege;
 664
 665         if (argc > 1 || c->display_usage) {
 666                 d_fprintf(stderr, "%s\n%s",
 667                           _("Usage:"),
 668                           _("net sam rights list [privilege name]\n"));
 669                 return -1;
 670         }
 671
 672         if (argc == 0) {
 673                 int i;
 674                 int num = num_privileges_in_short_list();
 675
 676                 for (i=0; i<num; i++) {
 677                         d_printf("%s\n", sec_privilege_name_from_index(i));
 678                 }
 679                 return 0;
 680         }
 681
 682         privilege = sec_privilege_id(argv[0]);
 683
 684         if (privilege != SEC_PRIV_INVALID) {
 685                 struct dom_sid *sids;
 686                 int i, num_sids;
 687                 NTSTATUS status;
 688
 689                 status = privilege_enum_sids(privilege, talloc_tos(),
 690                                              &sids, &num_sids);
 691                 if (!NT_STATUS_IS_OK(status)) {
 692                         d_fprintf(stderr, _("Could not list rights: %s\n"),
 693                                   nt_errstr(status));
 694                         return -1;
 695                 }
 696
 697                 for (i=0; i<num_sids; i++) {
 698                         const char *dom, *name;
 699                         enum lsa_SidType type;
 700                         struct dom_sid_buf buf;
 701
 702                         if (lookup_sid(talloc_tos(), &sids[i], &dom, &name,
 703                                        &type)) {
 704                                 d_printf("%s\\%s\n", dom, name);
 705                         }
 706                         else {
 707                                 d_printf("%s\n",
 708                                          dom_sid_str_buf(&sids[i], &buf));
 709                         }
 710                 }
 711                 return 0;
 712         }
 713
 714         return -1;
 715 }
 716
 717 static int net_sam_rights_grant(struct net_context *c, int argc,
 718                                 const char **argv)
 719 {
 720         struct dom_sid sid;
 721         enum lsa_SidType type;
 722         const char *dom, *name;
 723         int i;
 724
 725         if (argc < 2 || c->display_usage) {
 726                 d_fprintf(stderr, "%s\n%s",
 727                           _("Usage:"),
 728                           _("net sam rights grant <name> <rights> ...\n"));
 729                 return -1;
 730         }
 731
 732         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 733                         &dom, &name, &sid, &type)) {
 734                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 735                 return -1;
 736         }
 737
 738         for (i=1; i < argc; i++) {
 739                 enum sec_privilege privilege = sec_privilege_id(argv[i]);
 740                 if (privilege == SEC_PRIV_INVALID) {
 741                         d_fprintf(stderr, _("%s unknown\n"), argv[i]);
 742                         return -1;
 743                 }
 744
 745                 if (!grant_privilege_by_name(&sid, argv[i])) {
 746                         d_fprintf(stderr, _("Could not grant privilege\n"));
 747                         return -1;
 748                 }
 749
 750                 d_printf(_("Granted %s to %s\\%s\n"), argv[i], dom, name);
 751         }
 752
 753         return 0;
 754 }
 755
 756 static int net_sam_rights_revoke(struct net_context *c, int argc,
 757                                 const char **argv)
 758 {
 759         struct dom_sid sid;
 760         enum lsa_SidType type;
 761         const char *dom, *name;
 762         int i;
 763
 764         if (argc < 2 || c->display_usage) {
 765                 d_fprintf(stderr, "%s\n%s",
 766                           _("Usage:"),
 767                           _("net sam rights revoke <name> <rights>\n"));
 768                 return -1;
 769         }
 770
 771         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 772                         &dom, &name, &sid, &type)) {
 773                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 774                 return -1;
 775         }
 776
 777         for (i=1; i < argc; i++) {
 778                 enum sec_privilege privilege = sec_privilege_id(argv[i]);
 779                 if (privilege == SEC_PRIV_INVALID) {
 780                         d_fprintf(stderr, _("%s unknown\n"), argv[i]);
 781                         return -1;
 782                 }
 783
 784                 if (!revoke_privilege_by_name(&sid, argv[i])) {
 785                         d_fprintf(stderr, _("Could not revoke privilege\n"));
 786                         return -1;
 787                 }
 788
 789                 d_printf(_("Revoked %s from %s\\%s\n"), argv[i], dom, name);
 790         }
 791
 792         return 0;
 793 }
 794
 795 static int net_sam_rights(struct net_context *c, int argc, const char **argv)
 796 {
 797         struct functable func[] = {
 798                 {
 799                         "list",
 800                         net_sam_rights_list,
 801                         NET_TRANSPORT_LOCAL,
 802                         N_("List possible user rights"),
 803                         N_("net sam rights list\n"
 804                            "    List possible user rights")
 805                 },
 806                 {
 807                         "grant",
 808                         net_sam_rights_grant,
 809                         NET_TRANSPORT_LOCAL,
 810                         N_("Grant right(s)"),
 811                         N_("net sam rights grant\n"
 812                            "    Grant right(s)")
 813                 },
 814                 {
 815                         "revoke",
 816                         net_sam_rights_revoke,
 817                         NET_TRANSPORT_LOCAL,
 818                         N_("Revoke right(s)"),
 819                         N_("net sam rights revoke\n"
 820                            "    Revoke right(s)")
 821                 },
 822                 {NULL, NULL, 0, NULL, NULL}
 823         };
 824         return net_run_function(c, argc, argv, "net sam rights", func);
 825 }
 826
 827 /*
 828  * Map a unix group to a domain group
 829  */
 830
 831 static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *map)
 832 {
 833         const char *dom, *name;
 834         uint32_t rid;
 835
 836         if (pdb_getgrgid(map, grp->gr_gid)) {
 837                 return NT_STATUS_GROUP_EXISTS;
 838         }
 839
 840         map->gid = grp->gr_gid;
 841
 842         if (lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 843                         &dom, &name, NULL, NULL)) {
 844
 845                 map->nt_name = talloc_asprintf(map, "Unix Group %s",
 846                                                         grp->gr_name);
 847
 848                 DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
 849                           grp->gr_name, dom, name, map->nt_name));
 850         }
 851
 852         if (lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 853                         NULL, NULL, NULL, NULL)) {
 854                 DEBUG(3, ("\"%s\" exists, can't map it\n", grp->gr_name));
 855                 return NT_STATUS_GROUP_EXISTS;
 856         }
 857
 858         if (pdb_capabilities() & PDB_CAP_STORE_RIDS) {
 859                 if (!pdb_new_rid(&rid)) {
 860                         DEBUG(3, ("Could not get a new RID for %s\n",
 861                                   grp->gr_name));
 862                         return NT_STATUS_ACCESS_DENIED;
 863                 }
 864         } else {
 865                 rid = algorithmic_pdb_gid_to_group_rid( grp->gr_gid );
 866         }
 867
 868         sid_compose(&map->sid, get_global_sam_sid(), rid);
 869         map->sid_name_use = SID_NAME_DOM_GRP;
 870         map->comment = talloc_asprintf(map, "Unix Group %s", grp->gr_name);
 871
 872         return pdb_add_group_mapping_entry(map);
 873 }
 874
 875 static int net_sam_mapunixgroup(struct net_context *c, int argc, const char **argv)
 876 {
 877         NTSTATUS status;
 878         GROUP_MAP *map;
 879         struct group *grp;
 880         struct dom_sid_buf buf;
 881
 882         if (argc != 1 || c->display_usage) {
 883                 d_fprintf(stderr, "%s\n%s",
 884                           _("Usage:"),
 885                           _("net sam mapunixgroup <name>\n"));
 886                 return -1;
 887         }
 888
 889         grp = getgrnam(argv[0]);
 890         if (grp == NULL) {
 891                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
 892                 return -1;
 893         }
 894
 895         map = talloc_zero(talloc_tos(), GROUP_MAP);
 896         if (!map) {
 897                 d_fprintf(stderr, _("Out of memory!\n"));
 898                 return -1;
 899         }
 900
 901         status = map_unix_group(grp, map);
 902
 903         if (!NT_STATUS_IS_OK(status)) {
 904                 d_fprintf(stderr, _("Mapping group %s failed with %s\n"),
 905                           argv[0], nt_errstr(status));
 906                 return -1;
 907         }
 908
 909         d_printf(_("Mapped unix group %s to SID %s\n"), argv[0],
 910                  dom_sid_str_buf(&map->sid, &buf));
 911
 912         TALLOC_FREE(map);
 913         return 0;
 914 }
 915
 916 /*
 917  * Remove a group mapping
 918  */
 919
 920 static NTSTATUS unmap_unix_group(const struct group *grp)
 921 {
 922         struct dom_sid dom_sid;
 923         struct unixid id;
 924
 925         if (!lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 926                         NULL, NULL, NULL, NULL)) {
 927                 DEBUG(3, ("\"%s\" does not exist, can't unmap it\n", grp->gr_name));
 928                 return NT_STATUS_NO_SUCH_GROUP;
 929         }
 930
 931         id.id = grp->gr_gid;
 932         id.type = ID_TYPE_GID;
 933         if (!pdb_id_to_sid(&id, &dom_sid)) {
 934                 return NT_STATUS_UNSUCCESSFUL;
 935         }
 936
 937         return pdb_delete_group_mapping_entry(dom_sid);
 938 }
 939
 940 static int net_sam_unmapunixgroup(struct net_context *c, int argc, const char **argv)
 941 {
 942         NTSTATUS status;
 943         struct group *grp;
 944
 945         if (argc != 1 || c->display_usage) {
 946                 d_fprintf(stderr, "%s\n%s",
 947                           _("Usage:"),
 948                           _("net sam unmapunixgroup <name>\n"));
 949                 return -1;
 950         }
 951
 952         grp = getgrnam(argv[0]);
 953         if (grp == NULL) {
 954                 d_fprintf(stderr, _("Could not find mapping for group %s.\n"),
 955                           argv[0]);
 956                 return -1;
 957         }
 958
 959         status = unmap_unix_group(grp);
 960
 961         if (!NT_STATUS_IS_OK(status)) {
 962                 d_fprintf(stderr, _("Unmapping group %s failed with %s.\n"),
 963                           argv[0], nt_errstr(status));
 964                 return -1;
 965         }
 966
 967         d_printf(_("Unmapped unix group %s.\n"), argv[0]);
 968
 969         return 0;
 970 }
 971
 972 /*
 973  * Create a domain group
 974  */
 975
 976 static int net_sam_createdomaingroup(struct net_context *c, int argc,
 977                                      const char **argv)
 978 {
 979         NTSTATUS status;
 980         uint32_t rid;
 981
 982         if (argc != 1 || c->display_usage) {
 983                 d_fprintf(stderr, "%s\n%s",
 984                           _("Usage:"),
 985                           _("net sam createdomaingroup <name>\n"));
 986                 return -1;
 987         }
 988
 989         status = pdb_create_dom_group(talloc_tos(), argv[0], &rid);
 990
 991         if (!NT_STATUS_IS_OK(status)) {
 992                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
 993                           argv[0], nt_errstr(status));
 994                 return -1;
 995         }
 996
 997         d_printf(_("Created domain group %s with RID %d\n"), argv[0], rid);
 998
 999         return 0;
1000 }
1001
1002 /*
1003  * Delete a domain group
1004  */
1005
1006 static int net_sam_deletedomaingroup(struct net_context *c, int argc,
1007                                      const char **argv)
1008 {
1009         struct dom_sid sid;
1010         uint32_t rid;
1011         enum lsa_SidType type;
1012         const char *dom, *name;
1013         NTSTATUS status;
1014
1015         if (argc != 1 || c->display_usage) {
1016                 d_fprintf(stderr, "%s\n%s",
1017                           _("Usage:"),
1018                           _("net sam deletelocalgroup <name>\n"));
1019                 return -1;
1020         }
1021
1022         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1023                          &dom, &name, &sid, &type)) {
1024                 d_fprintf(stderr, _("Could not find %s.\n"), argv[0]);
1025                 return -1;
1026         }
1027
1028         if (type != SID_NAME_DOM_GRP) {
1029                 d_fprintf(stderr, _("%s is a %s, not a domain group.\n"),
1030                           argv[0], sid_type_lookup(type));
1031                 return -1;
1032         }
1033
1034         sid_peek_rid(&sid, &rid);
1035
1036         status = pdb_delete_dom_group(talloc_tos(), rid);
1037
1038         if (!NT_STATUS_IS_OK(status)) {
1039                 d_fprintf(stderr,_("Deleting domain group %s failed with %s\n"),
1040                           argv[0], nt_errstr(status));
1041                 return -1;
1042         }
1043
1044         d_printf(_("Deleted domain group %s.\n"), argv[0]);
1045
1046         return 0;
1047 }
1048
1049 /*
1050  * Create a local group
1051  */
1052
1053 static int net_sam_createlocalgroup(struct net_context *c, int argc, const char **argv)
1054 {
1055         NTSTATUS status;
1056         uint32_t rid;
1057
1058         if (argc != 1 || c->display_usage) {
1059                 d_fprintf(stderr, "%s\n%s",
1060                           _("Usage:"),
1061                           _("net sam createlocalgroup <name>\n"));
1062                 return -1;
1063         }
1064
1065         if (!winbind_ping()) {
1066                 d_fprintf(stderr, _("winbind seems not to run. "
1067                           "createlocalgroup only works when winbind runs.\n"));
1068                 return -1;
1069         }
1070
1071         status = pdb_create_alias(argv[0], &rid);
1072
1073         if (!NT_STATUS_IS_OK(status)) {
1074                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
1075                           argv[0], nt_errstr(status));
1076                 return -1;
1077         }
1078
1079         d_printf(_("Created local group %s with RID %d\n"), argv[0], rid);
1080
1081         return 0;
1082 }
1083
1084 /*
1085  * Delete a local group
1086  */
1087
1088 static int net_sam_deletelocalgroup(struct net_context *c, int argc, const char **argv)
1089 {
1090         struct dom_sid sid;
1091         enum lsa_SidType type;
1092         const char *dom, *name;
1093         NTSTATUS status;
1094
1095         if (argc != 1 || c->display_usage) {
1096                 d_fprintf(stderr, "%s\n%s",
1097                           _("Usage:"),
1098                           _("net sam deletelocalgroup <name>\n"));
1099                 return -1;
1100         }
1101
1102         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1103                          &dom, &name, &sid, &type)) {
1104                 d_fprintf(stderr,_("Could not find %s.\n"), argv[0]);
1105                 return -1;
1106         }
1107
1108         if (type != SID_NAME_ALIAS) {
1109                 d_fprintf(stderr, _("%s is a %s, not a local group.\n"),argv[0],
1110                           sid_type_lookup(type));
1111                 return -1;
1112         }
1113
1114         status = pdb_delete_alias(&sid);
1115
1116         if (!NT_STATUS_IS_OK(status)) {
1117                 d_fprintf(stderr, _("Deleting local group %s failed with %s\n"),
1118                           argv[0], nt_errstr(status));
1119                 return -1;
1120         }
1121
1122         d_printf(_("Deleted local group %s.\n"), argv[0]);
1123
1124         return 0;
1125 }
1126
1127 /*
1128  * Create a builtin group
1129  */
1130
1131 static int net_sam_createbuiltingroup(struct net_context *c, int argc, const char **argv)
1132 {
1133         NTSTATUS status;
1134         uint32_t rid;
1135         enum lsa_SidType type;
1136         fstring groupname;
1137         struct dom_sid sid;
1138
1139         if (argc != 1 || c->display_usage) {
1140                 d_fprintf(stderr, "%s\n%s",
1141                           _("Usage:"),
1142                           _("net sam createbuiltingroup <name>\n"));
1143                 return -1;
1144         }
1145
1146         if (!winbind_ping()) {
1147                 d_fprintf(stderr, _("winbind seems not to run. "
1148                           "createbuiltingroup only works when winbind "
1149                           "runs.\n"));
1150                 return -1;
1151         }
1152
1153         /* validate the name and get the group */
1154
1155         fstrcpy( groupname, "BUILTIN\\" );
1156         fstrcat( groupname, argv[0] );
1157
1158         if ( !lookup_name(talloc_tos(), groupname, LOOKUP_NAME_ALL, NULL,
1159                           NULL, &sid, &type)) {
1160                 d_fprintf(stderr, _("%s is not a BUILTIN group\n"), argv[0]);
1161                 return -1;
1162         }
1163
1164         if ( !sid_peek_rid( &sid, &rid ) ) {
1165                 d_fprintf(stderr, _("Failed to get RID for %s\n"), argv[0]);
1166                 return -1;
1167         }
1168
1169         status = pdb_create_builtin(rid);
1170
1171         if (!NT_STATUS_IS_OK(status)) {
1172                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
1173                           argv[0], nt_errstr(status));
1174                 return -1;
1175         }
1176
1177         d_printf(_("Created BUILTIN group %s with RID %d\n"), argv[0], rid);
1178
1179         return 0;
1180 }
1181
1182 /*
1183  * Add a group member
1184  */
1185
1186 static int net_sam_addmem(struct net_context *c, int argc, const char **argv)
1187 {
1188         const char *groupdomain, *groupname, *memberdomain, *membername;
1189         struct dom_sid group, member;
1190         enum lsa_SidType grouptype, membertype;
1191         NTSTATUS status;
1192
1193         if (argc != 2 || c->display_usage) {
1194                 d_fprintf(stderr, "%s\n%s",
1195                           _("Usage:"),
1196                           _("net sam addmem <group> <member>\n"));
1197                 return -1;
1198         }
1199
1200         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1201                          &groupdomain, &groupname, &group, &grouptype)) {
1202                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1203                 return -1;
1204         }
1205
1206         /* check to see if the member to be added is a name or a SID */
1207
1208         if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
1209                          &memberdomain, &membername, &member, &membertype))
1210         {
1211                 /* try it as a SID */
1212
1213                 if ( !string_to_sid( &member, argv[1] ) ) {
1214                         d_fprintf(stderr, _("Could not find member %s\n"),
1215                                   argv[1]);
1216                         return -1;
1217                 }
1218
1219                 if ( !lookup_sid(talloc_tos(), &member, &memberdomain,
1220                         &membername, &membertype) )
1221                 {
1222                         d_fprintf(stderr, _("Could not resolve SID %s\n"),
1223                                   argv[1]);
1224                         return -1;
1225                 }
1226         }
1227
1228         if ((grouptype == SID_NAME_ALIAS) || (grouptype == SID_NAME_WKN_GRP)) {
1229                 if ((membertype != SID_NAME_USER) &&
1230                     (membertype != SID_NAME_ALIAS) &&
1231                     (membertype != SID_NAME_DOM_GRP)) {
1232                         d_fprintf(stderr, _("Can't add %s: only users, domain "
1233                                             "groups and domain local groups "
1234                                             "can be added. %s is a %s\n"),
1235                                   argv[0], argv[1],
1236                                   sid_type_lookup(membertype));
1237                         return -1;
1238                 }
1239                 status = pdb_add_aliasmem(&group, &member);
1240
1241                 if (!NT_STATUS_IS_OK(status)) {
1242                         d_fprintf(stderr, _("Adding local group member failed "
1243                                   "with %s\n"), nt_errstr(status));
1244                         return -1;
1245                 }
1246         } else if (grouptype == SID_NAME_DOM_GRP) {
1247                 uint32_t grouprid, memberrid;
1248
1249                 sid_peek_rid(&group, &grouprid);
1250                 sid_peek_rid(&member, &memberrid);
1251
1252                 status = pdb_add_groupmem(talloc_tos(), grouprid, memberrid);
1253                 if (!NT_STATUS_IS_OK(status)) {
1254                         d_fprintf(stderr, _("Adding domain group member failed "
1255                                   "with %s\n"), nt_errstr(status));
1256                         return -1;
1257                 }
1258         } else {
1259                 d_fprintf(stderr, _("Can only add members to local groups so "
1260                           "far, %s is a %s\n"), argv[0],
1261                           sid_type_lookup(grouptype));
1262                 return -1;
1263         }
1264
1265         d_printf(_("Added %s\\%s to %s\\%s\n"), memberdomain, membername,
1266                 groupdomain, groupname);
1267
1268         return 0;
1269 }
1270
1271 /*
1272  * Delete a group member
1273  */
1274
1275 static int net_sam_delmem(struct net_context *c, int argc, const char **argv)
1276 {
1277         const char *groupdomain, *groupname;
1278         const char *memberdomain = NULL;
1279         const char *membername = NULL;
1280         struct dom_sid group, member;
1281         enum lsa_SidType grouptype;
1282         NTSTATUS status;
1283
1284         if (argc != 2 || c->display_usage) {
1285                 d_fprintf(stderr,"%s\n%s",
1286                           _("Usage:"),
1287                           _("net sam delmem <group> <member>\n"));
1288                 return -1;
1289         }
1290
1291         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1292                          &groupdomain, &groupname, &group, &grouptype)) {
1293                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1294                 return -1;
1295         }
1296
1297         if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
1298                          &memberdomain, &membername, &member, NULL)) {
1299                 if (!string_to_sid(&member, argv[1])) {
1300                         d_fprintf(stderr, _("Could not find member %s\n"),
1301                                   argv[1]);
1302                         return -1;
1303                 }
1304         }
1305
1306         if ((grouptype == SID_NAME_ALIAS) ||
1307             (grouptype == SID_NAME_WKN_GRP)) {
1308                 status = pdb_del_aliasmem(&group, &member);
1309
1310                 if (!NT_STATUS_IS_OK(status)) {
1311                         d_fprintf(stderr,_("Deleting local group member failed "
1312                                   "with %s\n"), nt_errstr(status));
1313                         return -1;
1314                 }
1315         } else if (grouptype == SID_NAME_DOM_GRP) {
1316                 uint32_t grouprid, memberrid;
1317
1318                 sid_peek_rid(&group, &grouprid);
1319                 sid_peek_rid(&member, &memberrid);
1320
1321                 status = pdb_del_groupmem(talloc_tos(), grouprid, memberrid);
1322                 if (!NT_STATUS_IS_OK(status)) {
1323                         d_fprintf(stderr, _("Deleting domain group member "
1324                                   "failed with %s\n"), nt_errstr(status));
1325                         return -1;
1326                 }
1327         } else {
1328                 d_fprintf(stderr, _("Can only delete members from local groups "
1329                           "so far, %s is a %s\n"), argv[0],
1330                           sid_type_lookup(grouptype));
1331                 return -1;
1332         }
1333
1334         if (membername != NULL) {
1335                 d_printf(_("Deleted %s\\%s from %s\\%s\n"),
1336                          memberdomain, membername, groupdomain, groupname);
1337         } else {
1338                 struct dom_sid_buf buf;
1339                 d_printf(_("Deleted %s from %s\\%s\n"),
1340                          dom_sid_str_buf(&member, &buf),
1341                          groupdomain,
1342                          groupname);
1343         }
1344
1345         return 0;
1346 }
1347
1348 /*
1349  * List group members
1350  */
1351
1352 static int net_sam_listmem(struct net_context *c, int argc, const char **argv)
1353 {
1354         const char *groupdomain, *groupname;
1355         struct dom_sid group;
1356         struct dom_sid *members = NULL;
1357         size_t i, num_members = 0;
1358         enum lsa_SidType grouptype;
1359         NTSTATUS status;
1360
1361         if (argc != 1 || c->display_usage) {
1362                 d_fprintf(stderr, "%s\n%s",
1363                           _("Usage:"),
1364                           _("net sam listmem <group>\n"));
1365                 return -1;
1366         }
1367
1368         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1369                          &groupdomain, &groupname, &group, &grouptype)) {
1370                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1371                 return -1;
1372         }
1373
1374         if ((grouptype == SID_NAME_ALIAS) ||
1375             (grouptype == SID_NAME_WKN_GRP)) {
1376                 status = pdb_enum_aliasmem(&group, talloc_tos(), &members,
1377                                            &num_members);
1378                 if (!NT_STATUS_IS_OK(status)) {
1379                         d_fprintf(stderr, _("Listing group members failed with "
1380                                   "%s\n"), nt_errstr(status));
1381                         return -1;
1382                 }
1383         } else if (grouptype == SID_NAME_DOM_GRP) {
1384                 uint32_t *rids;
1385
1386                 status = pdb_enum_group_members(talloc_tos(), &group,
1387                                                 &rids, &num_members);
1388                 if (!NT_STATUS_IS_OK(status)) {
1389                         d_fprintf(stderr, _("Listing group members failed with "
1390                                   "%s\n"), nt_errstr(status));
1391                         return -1;
1392                 }
1393
1394                 members = talloc_array(talloc_tos(), struct dom_sid,
1395                                        num_members);
1396                 if (members == NULL) {
1397                         TALLOC_FREE(rids);
1398                         return -1;
1399                 }
1400
1401                 for (i=0; i<num_members; i++) {
1402                         sid_compose(&members[i], get_global_sam_sid(),
1403                                     rids[i]);
1404                 }
1405                 TALLOC_FREE(rids);
1406         } else {
1407                 d_fprintf(stderr,_("Can only list local group members so far.\n"
1408                           "%s is a %s\n"), argv[0], sid_type_lookup(grouptype));
1409                 return -1;
1410         }
1411
1412         d_printf(_("%s\\%s has %u members\n"), groupdomain, groupname,
1413                  (unsigned int)num_members);
1414         for (i=0; i<num_members; i++) {
1415                 const char *dom, *name;
1416                 if (lookup_sid(talloc_tos(), &members[i], &dom, &name, NULL)) {
1417                         d_printf(" %s\\%s\n", dom, name);
1418                 } else {
1419                         struct dom_sid_buf buf;
1420                         d_printf(" %s\n",
1421                                  dom_sid_str_buf(&members[i], &buf));
1422                 }
1423         }
1424
1425                 TALLOC_FREE(members);
1426
1427         return 0;
1428 }
1429
1430 /*
1431  * Do the listing
1432  */
1433 static int net_sam_do_list(struct net_context *c, int argc, const char **argv,
1434                            struct pdb_search *search, const char *what)
1435 {
1436         bool verbose = (argc == 1);
1437
1438         if ((argc > 1) || c->display_usage ||
1439             ((argc == 1) && !strequal(argv[0], "verbose"))) {
1440                 d_fprintf(stderr, "%s\n", _("Usage:"));
1441                 d_fprintf(stderr, _("net sam list %s [verbose]\n"), what);
1442                 return -1;
1443         }
1444
1445         if (search == NULL) {
1446                 d_fprintf(stderr, _("Could not start search\n"));
1447                 return -1;
1448         }
1449
1450         while (true) {
1451                 struct samr_displayentry entry;
1452                 if (!search->next_entry(search, &entry)) {
1453                         break;
1454                 }
1455                 if (verbose) {
1456                         d_printf("%s:%d:%s\n",
1457                                  entry.account_name,
1458                                  entry.rid,
1459                                  entry.description);
1460                 } else {
1461                         d_printf("%s\n", entry.account_name);
1462                 }
1463         }
1464
1465         TALLOC_FREE(search);
1466         return 0;
1467 }
1468
1469 static int net_sam_list_users(struct net_context *c, int argc,
1470                               const char **argv)
1471 {
1472         return net_sam_do_list(c, argc, argv,
1473                                pdb_search_users(talloc_tos(), ACB_NORMAL),
1474                                "users");
1475 }
1476
1477 static int net_sam_list_groups(struct net_context *c, int argc,
1478                                const char **argv)
1479 {
1480         return net_sam_do_list(c, argc, argv, pdb_search_groups(talloc_tos()),
1481                                "groups");
1482 }
1483
1484 static int net_sam_list_localgroups(struct net_context *c, int argc,
1485                                     const char **argv)
1486 {
1487         return net_sam_do_list(c, argc, argv,
1488                                pdb_search_aliases(talloc_tos(),
1489                                                   get_global_sam_sid()),
1490                                "localgroups");
1491 }
1492
1493 static int net_sam_list_builtin(struct net_context *c, int argc,
1494                                 const char **argv)
1495 {
1496         return net_sam_do_list(c, argc, argv,
1497                                pdb_search_aliases(talloc_tos(),
1498                                                   &global_sid_Builtin),
1499                                "builtin");
1500 }
1501
1502 static int net_sam_list_workstations(struct net_context *c, int argc,
1503                                      const char **argv)
1504 {
1505         return net_sam_do_list(c, argc, argv,
1506                                pdb_search_users(talloc_tos(), ACB_WSTRUST),
1507                                "workstations");
1508 }
1509
1510 /*
1511  * List stuff
1512  */
1513
1514 static int net_sam_list(struct net_context *c, int argc, const char **argv)
1515 {
1516         struct functable func[] = {
1517                 {
1518                         "users",
1519                         net_sam_list_users,
1520                         NET_TRANSPORT_LOCAL,
1521                         N_("List SAM users"),
1522                         N_("net sam list users\n"
1523                            "    List SAM users")
1524                 },
1525                 {
1526                         "groups",
1527                         net_sam_list_groups,
1528                         NET_TRANSPORT_LOCAL,
1529                         N_("List SAM groups"),
1530                         N_("net sam list groups\n"
1531                            "    List SAM groups")
1532                 },
1533                 {
1534                         "localgroups",
1535                         net_sam_list_localgroups,
1536                         NET_TRANSPORT_LOCAL,
1537                         N_("List SAM local groups"),
1538                         N_("net sam list localgroups\n"
1539                            "    List SAM local groups")
1540                 },
1541                 {
1542                         "builtin",
1543                         net_sam_list_builtin,
1544                         NET_TRANSPORT_LOCAL,
1545                         N_("List builtin groups"),
1546                         N_("net sam list builtin\n"
1547                            "    List builtin groups")
1548                 },
1549                 {
1550                         "workstations",
1551                         net_sam_list_workstations,
1552                         NET_TRANSPORT_LOCAL,
1553                         N_("List domain member workstations"),
1554                         N_("net sam list workstations\n"
1555                            "    List domain member workstations")
1556                 },
1557                 {NULL, NULL, 0, NULL, NULL}
1558         };
1559
1560         return net_run_function(c, argc, argv, "net sam list", func);
1561 }
1562
1563 /*
1564  * Show details of SAM entries
1565  */
1566
1567 static int net_sam_show(struct net_context *c, int argc, const char **argv)
1568 {
1569         struct dom_sid sid;
1570         struct dom_sid_buf buf;
1571         enum lsa_SidType type;
1572         const char *dom, *name;
1573
1574         if (argc != 1 || c->display_usage) {
1575                 d_fprintf(stderr, "%s\n%s",
1576                           _("Usage:"),
1577                           _("net sam show <name>\n"));
1578                 return -1;
1579         }
1580
1581         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1582                          &dom, &name, &sid, &type)) {
1583                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
1584                 return -1;
1585         }
1586
1587         d_printf(_("%s\\%s is a %s with SID %s\n"), dom, name,
1588                  sid_type_lookup(type), dom_sid_str_buf(&sid, &buf));
1589
1590         return 0;
1591 }
1592
1593 #ifdef HAVE_LDAP
1594
1595 /*
1596  * Init an LDAP tree with default users and Groups
1597  * if ldapsam:editposix is enabled
1598  */
1599
1600 static int net_sam_provision(struct net_context *c, int argc, const char **argv)
1601 {
1602         TALLOC_CTX *tc;
1603         char *ldap_bk;
1604         char *ldap_uri = NULL;
1605         char *p;
1606         struct smbldap_state *state = NULL;
1607         GROUP_MAP *gmap = NULL;
1608         struct dom_sid gsid;
1609         gid_t domusers_gid = -1;
1610         gid_t domadmins_gid = -1;
1611         struct samu *samuser;
1612         struct passwd *pwd;
1613         bool is_ipa = false;
1614         char *bind_dn = NULL;
1615         char *bind_secret = NULL;
1616         NTSTATUS status;
1617
1618         if (c->display_usage) {
1619                 d_printf(  "%s\n"
1620                            "net sam provision\n"
1621                             "    %s\n",
1622                           _("Usage:"),
1623                           _("Init an LDAP tree with default users/groups"));
1624                 return 0;
1625         }
1626
1627         tc = talloc_new(NULL);
1628         if (!tc) {
1629                 d_fprintf(stderr, _("Out of Memory!\n"));
1630                 return -1;
1631         }
1632
1633         if ((ldap_bk = talloc_strdup(tc, lp_passdb_backend())) == NULL) {
1634                 d_fprintf(stderr, _("talloc failed\n"));
1635                 talloc_free(tc);
1636                 return -1;
1637         }
1638         p = strchr(ldap_bk, ':');
1639         if (p) {
1640                 *p = 0;
1641                 ldap_uri = talloc_strdup(tc, p+1);
1642                 trim_char(ldap_uri, ' ', ' ');
1643         }
1644
1645         trim_char(ldap_bk, ' ', ' ');
1646
1647         if (strcmp(ldap_bk, "IPA_ldapsam") == 0 ) {
1648                 is_ipa = true;
1649         }
1650
1651         if (strcmp(ldap_bk, "ldapsam") != 0 && !is_ipa ) {
1652                 d_fprintf(stderr,
1653                           _("Provisioning works only with ldapsam backend\n"));
1654                 goto failed;
1655         }
1656
1657         if (!lp_parm_bool(-1, "ldapsam", "trusted", false) ||
1658             !lp_parm_bool(-1, "ldapsam", "editposix", false)) {
1659
1660                 d_fprintf(stderr, _("Provisioning works only if ldapsam:trusted"
1661                                     " and ldapsam:editposix are enabled.\n"));
1662                 goto failed;
1663         }
1664
1665         if (!is_ipa && !winbind_ping()) {
1666                 d_fprintf(stderr, _("winbind seems not to run. Provisioning "
1667                             "LDAP only works when winbind runs.\n"));
1668                 goto failed;
1669         }
1670
1671         if (!fetch_ldap_pw(&bind_dn, &bind_secret)) {
1672                 d_fprintf(stderr, _("Failed to retrieve LDAP password from secrets.tdb\n"));
1673                 goto failed;
1674         }
1675
1676         status = smbldap_init(tc, NULL, ldap_uri, false, bind_dn, bind_secret, &state);
1677
1678         memset(bind_secret, '\0', strlen(bind_secret));
1679         SAFE_FREE(bind_secret);
1680         SAFE_FREE(bind_dn);
1681
1682         if (!NT_STATUS_IS_OK(status)) {
1683                 d_fprintf(stderr, _("Unable to connect to the LDAP server.\n"));
1684                 goto failed;
1685         }
1686
1687         d_printf(_("Checking for Domain Users group.\n"));
1688
1689         sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_USERS);
1690
1691         gmap = talloc_zero(tc, GROUP_MAP);
1692         if (!gmap) {
1693                 d_printf(_("Out of memory!\n"));
1694                 goto failed;
1695         }
1696
1697         if (!pdb_getgrsid(gmap, gsid)) {
1698                 struct dom_sid_buf gsid_str;
1699                 LDAPMod **mods = NULL;
1700                 char *dn;
1701                 char *uname;
1702                 char *wname;
1703                 char *gidstr;
1704                 char *gtype;
1705                 int rc;
1706
1707                 d_printf(_("Adding the Domain Users group.\n"));
1708
1709                 /* lets allocate a new groupid for this group */
1710                 if (is_ipa) {
1711                         domusers_gid = 999;
1712                 } else {
1713                         if (!winbind_allocate_gid(&domusers_gid)) {
1714                                 d_fprintf(stderr, _("Unable to allocate a new gid to "
1715                                                     "create Domain Users group!\n"));
1716                                 goto domu_done;
1717                         }
1718                 }
1719
1720                 uname = talloc_strdup(tc, "domusers");
1721                 wname = talloc_strdup(tc, "Domain Users");
1722                 dn = talloc_asprintf(tc, "cn=%s,%s", "domusers",
1723                                      lp_ldap_group_suffix(talloc_tos()));
1724                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domusers_gid);
1725                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1726
1727                 if (!uname || !wname || !dn || !gidstr || !gtype) {
1728                         d_fprintf(stderr, "Out of Memory!\n");
1729                         goto failed;
1730                 }
1731
1732                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1733                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1734                 if (is_ipa) {
1735                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
1736                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
1737                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
1738                 }
1739                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1740                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1741                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1742                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1743                                 dom_sid_str_buf(&gsid, &gsid_str));
1744                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1745
1746                 smbldap_talloc_autofree_ldapmod(tc, mods);
1747
1748                 rc = smbldap_add(state, dn, mods);
1749
1750                 if (rc != LDAP_SUCCESS) {
1751                         d_fprintf(stderr, _("Failed to add Domain Users group "
1752                                             "to ldap directory\n"));
1753                 }
1754
1755                 if (is_ipa) {
1756                         if (!pdb_getgrsid(gmap, gsid)) {
1757                                 d_fprintf(stderr, _("Failed to read just "
1758                                                     "created domain group.\n"));
1759                                 goto failed;
1760                         } else {
1761                                 domusers_gid = gmap->gid;
1762                         }
1763                 }
1764         } else {
1765                 domusers_gid = gmap->gid;
1766                 d_printf(_("found!\n"));
1767         }
1768
1769 domu_done:
1770
1771         d_printf(_("Checking for Domain Admins group.\n"));
1772
1773         sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_ADMINS);
1774
1775         if (!pdb_getgrsid(gmap, gsid)) {
1776                 struct dom_sid_buf gsid_str;
1777                 LDAPMod **mods = NULL;
1778                 char *dn;
1779                 char *uname;
1780                 char *wname;
1781                 char *gidstr;
1782                 char *gtype;
1783                 int rc;
1784
1785                 d_printf(_("Adding the Domain Admins group.\n"));
1786
1787                 /* lets allocate a new groupid for this group */
1788                 if (is_ipa) {
1789                         domadmins_gid = 999;
1790                 } else {
1791                         if (!winbind_allocate_gid(&domadmins_gid)) {
1792                                 d_fprintf(stderr, _("Unable to allocate a new gid to "
1793                                                     "create Domain Admins group!\n"));
1794                                 goto doma_done;
1795                         }
1796                 }
1797
1798                 uname = talloc_strdup(tc, "domadmins");
1799                 wname = talloc_strdup(tc, "Domain Admins");
1800                 dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins",
1801                                      lp_ldap_group_suffix(talloc_tos()));
1802                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
1803                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1804
1805                 if (!uname || !wname || !dn || !gidstr || !gtype) {
1806                         d_fprintf(stderr, _("Out of Memory!\n"));
1807                         goto failed;
1808                 }
1809
1810                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1811                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1812                 if (is_ipa) {
1813                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
1814                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
1815                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
1816                 }
1817                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1818                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1819                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1820                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1821                                 dom_sid_str_buf(&gsid, &gsid_str));
1822                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1823
1824                 smbldap_talloc_autofree_ldapmod(tc, mods);
1825
1826                 rc = smbldap_add(state, dn, mods);
1827
1828                 if (rc != LDAP_SUCCESS) {
1829                         d_fprintf(stderr, _("Failed to add Domain Admins group "
1830                                             "to ldap directory\n"));
1831                 }
1832
1833                 if (is_ipa) {
1834                         if (!pdb_getgrsid(gmap, gsid)) {
1835                                 d_fprintf(stderr, _("Failed to read just "
1836                                                     "created domain group.\n"));
1837                                 goto failed;
1838                         } else {
1839                                 domadmins_gid = gmap->gid;
1840                         }
1841                 }
1842         } else {
1843                 domadmins_gid = gmap->gid;
1844                 d_printf(_("found!\n"));
1845         }
1846
1847 doma_done:
1848
1849         d_printf(_("Check for Administrator account.\n"));
1850
1851         samuser = samu_new(tc);
1852         if (!samuser) {
1853                 d_fprintf(stderr, _("Out of Memory!\n"));
1854                 goto failed;
1855         }
1856
1857         if (!pdb_getsampwnam(samuser, "Administrator")) {
1858                 LDAPMod **mods = NULL;
1859                 struct dom_sid sid;
1860                 struct dom_sid_buf sid_str;
1861                 char *dn;
1862                 char *name;
1863                 char *uidstr;
1864                 char *gidstr;
1865                 char *shell;
1866                 char *dir;
1867                 char *princ;
1868                 uid_t uid;
1869                 int rc;
1870
1871                 d_printf(_("Adding the Administrator user.\n"));
1872
1873                 if (domadmins_gid == -1) {
1874                         d_fprintf(stderr,
1875                                   _("Can't create Administrator user, Domain "
1876                                     "Admins group not available!\n"));
1877                         goto done;
1878                 }
1879
1880                 if (is_ipa) {
1881                         uid = 999;
1882                 } else {
1883                         if (!winbind_allocate_uid(&uid)) {
1884                                 d_fprintf(stderr,
1885                                           _("Unable to allocate a new uid to create "
1886                                             "the Administrator user!\n"));
1887                                 goto done;
1888                         }
1889                 }
1890
1891                 name = talloc_strdup(tc, "Administrator");
1892                 dn = talloc_asprintf(tc, "uid=Administrator,%s",
1893                                      lp_ldap_user_suffix(talloc_tos()));
1894                 uidstr = talloc_asprintf(tc, "%u", (unsigned int)uid);
1895                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
1896                 dir = talloc_sub_specified(tc, lp_template_homedir(),
1897                                                 "Administrator",
1898                                                 NULL,
1899                                                 get_global_sam_name(),
1900                                                 uid, domadmins_gid);
1901                 shell = talloc_sub_specified(tc, lp_template_shell(),
1902                                                 "Administrator",
1903                                                 NULL,
1904                                                 get_global_sam_name(),
1905                                                 uid, domadmins_gid);
1906
1907                 if (!name || !dn || !uidstr || !gidstr || !dir || !shell) {
1908                         d_fprintf(stderr, _("Out of Memory!\n"));
1909                         goto failed;
1910                 }
1911
1912                 sid_compose(&sid, get_global_sam_sid(), DOMAIN_RID_ADMINISTRATOR);
1913
1914                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
1915                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
1916                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
1917                 if (is_ipa) {
1918                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "person");
1919                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "organizationalperson");
1920                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetorgperson");
1921                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetuser");
1922                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbprincipalaux");
1923                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbticketpolicyaux");
1924                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "sn", name);
1925                         princ = talloc_asprintf(tc, "%s@%s", name, lp_realm());
1926                         if (!princ) {
1927                                 d_fprintf(stderr, _("Out of Memory!\n"));
1928                                 goto failed;
1929                         }
1930                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "krbPrincipalName", princ);
1931                 }
1932                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uid", name);
1933                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
1934                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
1935                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
1936                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1937                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", dir);
1938                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
1939                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
1940                                 dom_sid_str_buf(&sid, &sid_str));
1941                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
1942                                 pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
1943                                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
1944
1945                 smbldap_talloc_autofree_ldapmod(tc, mods);
1946
1947                 rc = smbldap_add(state, dn, mods);
1948
1949                 if (rc != LDAP_SUCCESS) {
1950                         d_fprintf(stderr, _("Failed to add Administrator user "
1951                                             "to ldap directory\n"));
1952                 }
1953
1954                 if (is_ipa) {
1955                         if (!pdb_getsampwnam(samuser, "Administrator")) {
1956                                 d_fprintf(stderr, _("Failed to read just "
1957                                                     "created user.\n"));
1958                                 goto failed;
1959                         }
1960                 }
1961         } else {
1962                 d_printf(_("found!\n"));
1963         }
1964
1965         d_printf(_("Checking for Guest user.\n"));
1966
1967         samuser = samu_new(tc);
1968         if (!samuser) {
1969                 d_fprintf(stderr, _("Out of Memory!\n"));
1970                 goto failed;
1971         }
1972
1973         if (!pdb_getsampwnam(samuser, lp_guest_account())) {
1974                 LDAPMod **mods = NULL;
1975                 struct dom_sid sid;
1976                 struct dom_sid_buf sid_str;
1977                 char *dn;
1978                 char *uidstr;
1979                 char *gidstr;
1980                 int rc;
1981
1982                 d_printf(_("Adding the Guest user.\n"));
1983
1984                 sid_compose(&sid, get_global_sam_sid(), DOMAIN_RID_GUEST);
1985
1986                 pwd = Get_Pwnam_alloc(tc, lp_guest_account());
1987
1988                 if (!pwd) {
1989                         if (domusers_gid == -1) {
1990                                 d_fprintf(stderr,
1991                                           _("Can't create Guest user, Domain "
1992                                             "Users group not available!\n"));
1993                                 goto done;
1994                         }
1995                         if ((pwd = talloc(tc, struct passwd)) == NULL) {
1996                                 d_fprintf(stderr, _("talloc failed\n"));
1997                                 goto done;
1998                         }
1999                         pwd->pw_name = talloc_strdup(pwd, lp_guest_account());
2000
2001                         if (is_ipa) {
2002                                 pwd->pw_uid = 999;
2003                         } else {
2004                                 if (!winbind_allocate_uid(&(pwd->pw_uid))) {
2005                                         d_fprintf(stderr,
2006                                                   _("Unable to allocate a new uid to "
2007                                                     "create the Guest user!\n"));
2008                                         goto done;
2009                                 }
2010                         }
2011                         pwd->pw_gid = domusers_gid;
2012                         pwd->pw_dir = talloc_strdup(tc, "/");
2013                         pwd->pw_shell = talloc_strdup(tc, "/bin/false");
2014                         if (!pwd->pw_dir || !pwd->pw_shell) {
2015                                 d_fprintf(stderr, _("Out of Memory!\n"));
2016                                 goto failed;
2017                         }
2018                 }
2019
2020                 dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name,
2021                                      lp_ldap_user_suffix (talloc_tos()));
2022                 uidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_uid);
2023                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
2024                 if (!dn || !uidstr || !gidstr) {
2025                         d_fprintf(stderr, _("Out of Memory!\n"));
2026                         goto failed;
2027                 }
2028
2029                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
2030                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
2031                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
2032                 if (is_ipa) {
2033                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "person");
2034                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "organizationalperson");
2035                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetorgperson");
2036                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetuser");
2037                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbprincipalaux");
2038                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbticketpolicyaux");
2039                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "sn", pwd->pw_name);
2040                 }
2041                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uid", pwd->pw_name);
2042                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", pwd->pw_name);
2043                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", pwd->pw_name);
2044                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
2045                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
2046                 if ((pwd->pw_dir != NULL) && (pwd->pw_dir[0] != '\0')) {
2047                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", pwd->pw_dir);
2048                 }
2049                 if ((pwd->pw_shell != NULL) && (pwd->pw_shell[0] != '\0')) {
2050                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", pwd->pw_shell);
2051                 }
2052                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
2053                                 dom_sid_str_buf(&sid, &sid_str));
2054                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
2055                                 pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
2056                                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
2057
2058                 smbldap_talloc_autofree_ldapmod(tc, mods);
2059
2060                 rc = smbldap_add(state, dn, mods);
2061
2062                 if (rc != LDAP_SUCCESS) {
2063                         d_fprintf(stderr, _("Failed to add Guest user to "
2064                                             "ldap directory\n"));
2065                 }
2066
2067                 if (is_ipa) {
2068                         if (!pdb_getsampwnam(samuser, lp_guest_account())) {
2069                                 d_fprintf(stderr, _("Failed to read just "
2070                                                     "created user.\n"));
2071                                 goto failed;
2072                         }
2073                 }
2074         } else {
2075                 d_printf(_("found!\n"));
2076         }
2077
2078         d_printf(_("Checking Guest's group.\n"));
2079
2080         pwd = Get_Pwnam_alloc(tc, lp_guest_account());
2081         if (!pwd) {
2082                 d_fprintf(stderr,
2083                           _("Failed to find just created Guest account!\n"
2084                             "   Is nss properly configured?!\n"));
2085                 goto failed;
2086         }
2087
2088         if (pwd->pw_gid == domusers_gid) {
2089                 d_printf(_("found!\n"));
2090                 goto done;
2091         }
2092
2093         if (!pdb_getgrgid(gmap, pwd->pw_gid)) {
2094                 struct dom_sid_buf gsid_str;
2095                 LDAPMod **mods = NULL;
2096                 char *dn;
2097                 char *uname;
2098                 char *wname;
2099                 char *gidstr;
2100                 char *gtype;
2101                 int rc;
2102
2103                 d_printf(_("Adding the Domain Guests group.\n"));
2104
2105                 uname = talloc_strdup(tc, "domguests");
2106                 wname = talloc_strdup(tc, "Domain Guests");
2107                 dn = talloc_asprintf(tc, "cn=%s,%s", "domguests",
2108                                      lp_ldap_group_suffix(talloc_tos()));
2109                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
2110                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
2111
2112                 if (!uname || !wname || !dn || !gidstr || !gtype) {
2113                         d_fprintf(stderr, _("Out of Memory!\n"));
2114                         goto failed;
2115                 }
2116
2117                 sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_GUESTS);
2118
2119                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
2120                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
2121                 if (is_ipa) {
2122                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
2123                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
2124                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
2125                 }
2126                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
2127                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
2128                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
2129                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
2130                                 dom_sid_str_buf(&gsid, &gsid_str));
2131                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
2132
2133                 smbldap_talloc_autofree_ldapmod(tc, mods);
2134
2135                 rc = smbldap_add(state, dn, mods);
2136
2137                 if (rc != LDAP_SUCCESS) {
2138                         d_fprintf(stderr,
2139                                   _("Failed to add Domain Guests group to ldap "
2140                                     "directory\n"));
2141                 }
2142         } else {
2143                 d_printf(_("found!\n"));
2144         }
2145
2146
2147 done:
2148         talloc_free(state);
2149         return 0;
2150
2151 failed:
2152         talloc_free(state);
2153         return -1;
2154 }
2155
2156 #endif
2157
2158 /***********************************************************
2159  migrated functionality from smbgroupedit
2160  **********************************************************/
2161 int net_sam(struct net_context *c, int argc, const char **argv)
2162 {
2163         struct functable func[] = {
2164                 {
2165                         "createbuiltingroup",
2166                         net_sam_createbuiltingroup,
2167                         NET_TRANSPORT_LOCAL,
2168                         N_("Create a new BUILTIN group"),
2169                         N_("net sam createbuiltingroup\n"
2170                            "    Create a new BUILTIN group")
2171                 },
2172                 {
2173                         "createlocalgroup",
2174                         net_sam_createlocalgroup,
2175                         NET_TRANSPORT_LOCAL,
2176                         N_("Create a new local group"),
2177                         N_("net sam createlocalgroup\n"
2178                            "    Create a new local group")
2179                 },
2180                 {
2181                         "createdomaingroup",
2182                         net_sam_createdomaingroup,
2183                         NET_TRANSPORT_LOCAL,
2184                         N_("Create a new group"),
2185                         N_("net sam createdomaingroup\n"
2186                            "    Create a new group")
2187                 },
2188                 {
2189                         "deletelocalgroup",
2190                         net_sam_deletelocalgroup,
2191                         NET_TRANSPORT_LOCAL,
2192                         N_("Delete an existing local group"),
2193                         N_("net sam deletelocalgroup\n"
2194                            "    Delete an existing local group")
2195                 },
2196                 {
2197                         "deletedomaingroup",
2198                         net_sam_deletedomaingroup,
2199                         NET_TRANSPORT_LOCAL,
2200                         N_("Delete a domain group"),
2201                         N_("net sam deletedomaingroup\n"
2202                            "    Delete a group")
2203                 },
2204                 {
2205                         "mapunixgroup",
2206                         net_sam_mapunixgroup,
2207                         NET_TRANSPORT_LOCAL,
2208                         N_("Map a unix group to a domain group"),
2209                         N_("net sam mapunixgroup\n"
2210                            "    Map a unix group to a domain group")
2211                 },
2212                 {
2213                         "unmapunixgroup",
2214                         net_sam_unmapunixgroup,
2215                         NET_TRANSPORT_LOCAL,
2216                         N_("Remove a group mapping of an unix group to a "
2217                            "domain group"),
2218                         N_("net sam unmapunixgroup\n"
2219                            "    Remove a group mapping of an unix group to a "
2220                            "domain group")
2221                 },
2222                 {
2223                         "addmem",
2224                         net_sam_addmem,
2225                         NET_TRANSPORT_LOCAL,
2226                         N_("Add a member to a group"),
2227                         N_("net sam addmem\n"
2228                         "    Add a member to a group")
2229                 },
2230                 {
2231                         "delmem",
2232                         net_sam_delmem,
2233                         NET_TRANSPORT_LOCAL,
2234                         N_("Delete a member from a group"),
2235                         N_("net sam delmem\n"
2236                            "    Delete a member from a group")
2237                 },
2238                 {
2239                         "listmem",
2240                         net_sam_listmem,
2241                         NET_TRANSPORT_LOCAL,
2242                         N_("List group members"),
2243                         N_("net sam listmem\n"
2244                            "    List group members")
2245                 },
2246                 {
2247                         "list",
2248                         net_sam_list,
2249                         NET_TRANSPORT_LOCAL,
2250                         N_("List users, groups and local groups"),
2251                         N_("net sam list\n"
2252                            "    List users, groups and local groups")
2253                 },
2254                 {
2255                         "show",
2256                         net_sam_show,
2257                         NET_TRANSPORT_LOCAL,
2258                         N_("Show details of a SAM entry"),
2259                         N_("net sam show\n"
2260                            "    Show details of a SAM entry")
2261                 },
2262                 {
2263                         "set",
2264                         net_sam_set,
2265                         NET_TRANSPORT_LOCAL,
2266                         N_("Set details of a SAM account"),
2267                         N_("net sam set\n"
2268                            "    Set details of a SAM account")
2269                 },
2270                 {
2271                         "policy",
2272                         net_sam_policy,
2273                         NET_TRANSPORT_LOCAL,
2274                         N_("Set account policies"),
2275                         N_("net sam policy\n"
2276                            "    Set account policies")
2277                 },
2278                 {
2279                         "rights",
2280                         net_sam_rights,
2281                         NET_TRANSPORT_LOCAL,
2282                         N_("Manipulate user privileges"),
2283                         N_("net sam rights\n"
2284                            "    Manipulate user privileges")
2285                 },
2286 #ifdef HAVE_LDAP
2287                 {
2288                         "provision",
2289                         net_sam_provision,
2290                         NET_TRANSPORT_LOCAL,
2291                         N_("Provision a clean user database"),
2292                         N_("net sam privison\n"
2293                            "    Provision a clear user database")
2294                 },
2295 #endif
2296                 {NULL, NULL, 0, NULL, NULL}
2297         };
2298
2299         if (getuid() != 0) {
2300                 d_fprintf(stderr, _("You are not root, most things won't "
2301                           "work\n"));
2302         }
2303
2304         return net_run_function(c, argc, argv, "net sam", func);
2305 }
2306