2 Unix SMB/CIFS implementation.
4 Winbind rpc backend functions
6 Copyright (C) Tim Potter 2000-2001,2003
7 Copyright (C) Andrew Tridgell 2001
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2008 (pidl conversion)
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "winbindd_rpc.h"
29 #include "../librpc/gen_ndr/cli_samr.h"
30 #include "rpc_client/cli_samr.h"
31 #include "rpc_client/cli_lsarpc.h"
32 #include "../libcli/security/security.h"
35 #define DBGC_CLASS DBGC_WINBIND
38 /* Query display info for a domain. This returns enough information plus a
39 bit extra to give an overview of domain users for the User Manager
41 static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
44 struct wbint_userinfo **pinfo)
46 struct rpc_pipe_client *samr_pipe = NULL;
47 struct policy_handle dom_pol;
48 struct wbint_userinfo *info = NULL;
49 uint32_t num_info = 0;
53 DEBUG(3, ("msrpc_query_user_list\n"));
59 tmp_ctx = talloc_stackframe();
60 if (tmp_ctx == NULL) {
61 return NT_STATUS_NO_MEMORY;
64 if ( !winbindd_can_contact_domain( domain ) ) {
65 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
67 status = NT_STATUS_OK;
71 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
72 if (!NT_STATUS_IS_OK(status)) {
76 status = rpc_query_user_list(tmp_ctx,
82 if (!NT_STATUS_IS_OK(status)) {
87 *pnum_info = num_info;
91 *pinfo = talloc_move(mem_ctx, &info);
99 /* list all domain groups */
100 static NTSTATUS msrpc_enum_dom_groups(struct winbindd_domain *domain,
103 struct acct_info **pinfo)
105 struct rpc_pipe_client *samr_pipe;
106 struct policy_handle dom_pol;
107 struct acct_info *info = NULL;
108 uint32_t num_info = 0;
112 DEBUG(3,("msrpc_enum_dom_groups\n"));
118 tmp_ctx = talloc_stackframe();
119 if (tmp_ctx == NULL) {
120 return NT_STATUS_NO_MEMORY;
123 if ( !winbindd_can_contact_domain( domain ) ) {
124 DEBUG(10,("enum_domain_groups: No incoming trust for domain %s\n",
126 status = NT_STATUS_OK;
130 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
131 if (!NT_STATUS_IS_OK(status)) {
135 status = rpc_enum_dom_groups(tmp_ctx,
140 if (!NT_STATUS_IS_OK(status)) {
145 *pnum_info = num_info;
149 *pinfo = talloc_move(mem_ctx, &info);
153 TALLOC_FREE(tmp_ctx);
157 /* List all domain groups */
159 static NTSTATUS msrpc_enum_local_groups(struct winbindd_domain *domain,
162 struct acct_info **pinfo)
164 struct rpc_pipe_client *samr_pipe;
165 struct policy_handle dom_pol;
166 struct acct_info *info = NULL;
167 uint32_t num_info = 0;
171 DEBUG(3,("msrpc_enum_local_groups\n"));
177 tmp_ctx = talloc_stackframe();
178 if (tmp_ctx == NULL) {
179 return NT_STATUS_NO_MEMORY;
182 if ( !winbindd_can_contact_domain( domain ) ) {
183 DEBUG(10,("enum_local_groups: No incoming trust for domain %s\n",
185 status = NT_STATUS_OK;
189 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
190 if (!NT_STATUS_IS_OK(status)) {
194 status = rpc_enum_local_groups(mem_ctx,
199 if (!NT_STATUS_IS_OK(status)) {
204 *pnum_info = num_info;
208 *pinfo = talloc_move(mem_ctx, &info);
212 TALLOC_FREE(tmp_ctx);
216 /* convert a single name to a sid in a domain */
217 static NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
219 const char *domain_name,
223 enum lsa_SidType *type)
226 struct dom_sid *sids = NULL;
227 enum lsa_SidType *types = NULL;
228 char *full_name = NULL;
229 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
230 char *mapped_name = NULL;
232 if (name == NULL || *name=='\0') {
233 full_name = talloc_asprintf(mem_ctx, "%s", domain_name);
234 } else if (domain_name == NULL || *domain_name == '\0') {
235 full_name = talloc_asprintf(mem_ctx, "%s", name);
237 full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain_name, name);
240 DEBUG(0, ("talloc_asprintf failed!\n"));
241 return NT_STATUS_NO_MEMORY;
244 DEBUG(3, ("msrpc_name_to_sid: name=%s\n", full_name));
246 name_map_status = normalize_name_unmap(mem_ctx, full_name,
249 /* Reset the full_name pointer if we mapped anytthing */
251 if (NT_STATUS_IS_OK(name_map_status) ||
252 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
254 full_name = mapped_name;
257 DEBUG(3,("name_to_sid [rpc] %s for domain %s\n",
258 full_name?full_name:"", domain_name ));
260 result = winbindd_lookup_names(mem_ctx, domain, 1,
261 (const char **)&full_name, NULL,
263 if (!NT_STATUS_IS_OK(result))
266 /* Return rid and type if lookup successful */
268 sid_copy(sid, &sids[0]);
275 convert a domain SID to a user or group name
277 static NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
279 const struct dom_sid *sid,
282 enum lsa_SidType *type)
286 enum lsa_SidType *types = NULL;
288 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
289 char *mapped_name = NULL;
291 DEBUG(3, ("msrpc_sid_to_name: %s for domain %s\n", sid_string_dbg(sid),
294 result = winbindd_lookup_sids(mem_ctx,
301 if (!NT_STATUS_IS_OK(result)) {
302 DEBUG(2,("msrpc_sid_to_name: failed to lookup sids: %s\n",
308 *type = (enum lsa_SidType)types[0];
309 *domain_name = domains[0];
312 DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name));
314 name_map_status = normalize_name_map(mem_ctx, domain, *name,
316 if (NT_STATUS_IS_OK(name_map_status) ||
317 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
320 DEBUG(5,("returning mapped name -- %s\n", *name));
326 static NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
328 const struct dom_sid *sid,
333 enum lsa_SidType **types)
337 struct dom_sid *sids;
341 DEBUG(3, ("msrpc_rids_to_names: domain %s\n", domain->name ));
344 sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, num_rids);
346 return NT_STATUS_NO_MEMORY;
352 for (i=0; i<num_rids; i++) {
353 if (!sid_compose(&sids[i], sid, rids[i])) {
354 return NT_STATUS_INTERNAL_ERROR;
358 result = winbindd_lookup_sids(mem_ctx,
366 if (!NT_STATUS_IS_OK(result) &&
367 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
372 for (i=0; i<num_rids; i++) {
373 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
374 char *mapped_name = NULL;
376 if ((*types)[i] != SID_NAME_UNKNOWN) {
377 name_map_status = normalize_name_map(mem_ctx,
381 if (NT_STATUS_IS_OK(name_map_status) ||
382 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
384 ret_names[i] = mapped_name;
387 *domain_name = domains[i];
394 /* Lookup user information from a rid or username. */
395 static NTSTATUS msrpc_query_user(struct winbindd_domain *domain,
397 const struct dom_sid *user_sid,
398 struct wbint_userinfo *user_info)
400 struct rpc_pipe_client *samr_pipe;
401 struct policy_handle dom_pol;
402 struct netr_SamInfo3 *user;
406 DEBUG(3,("msrpc_query_user sid=%s\n", sid_string_dbg(user_sid)));
408 tmp_ctx = talloc_stackframe();
409 if (tmp_ctx == NULL) {
410 return NT_STATUS_NO_MEMORY;
414 user_info->homedir = NULL;
415 user_info->shell = NULL;
416 user_info->primary_gid = (gid_t)-1;
419 /* try netsamlogon cache first */
420 user = netsamlogon_cache_get(tmp_ctx, user_sid);
422 DEBUG(5,("msrpc_query_user: Cache lookup succeeded for %s\n",
423 sid_string_dbg(user_sid)));
425 sid_compose(&user_info->user_sid, &domain->sid, user->base.rid);
426 sid_compose(&user_info->group_sid, &domain->sid,
427 user->base.primary_gid);
429 user_info->acct_name = talloc_strdup(user_info,
430 user->base.account_name.string);
431 user_info->full_name = talloc_strdup(user_info,
432 user->base.full_name.string);
434 status = NT_STATUS_OK;
438 if ( !winbindd_can_contact_domain( domain ) ) {
439 DEBUG(10,("query_user: No incoming trust for domain %s\n",
441 /* Tell the cache manager not to remember this one */
442 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
446 /* no cache; hit the wire */
447 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
448 if (!NT_STATUS_IS_OK(status)) {
452 status = rpc_query_user(tmp_ctx,
460 TALLOC_FREE(tmp_ctx);
464 /* Lookup groups a user is a member of. I wish Unix had a call like this! */
465 static NTSTATUS msrpc_lookup_usergroups(struct winbindd_domain *domain,
467 const struct dom_sid *user_sid,
468 uint32_t *pnum_groups,
469 struct dom_sid **puser_grpsids)
471 struct rpc_pipe_client *samr_pipe;
472 struct policy_handle dom_pol;
473 struct dom_sid *user_grpsids = NULL;
474 uint32_t num_groups = 0;
478 DEBUG(3,("msrpc_lookup_usergroups sid=%s\n", sid_string_dbg(user_sid)));
482 tmp_ctx = talloc_stackframe();
483 if (tmp_ctx == NULL) {
484 return NT_STATUS_NO_MEMORY;
487 /* Check if we have a cached user_info_3 */
488 status = lookup_usergroups_cached(domain,
493 if (NT_STATUS_IS_OK(status)) {
497 if ( !winbindd_can_contact_domain( domain ) ) {
498 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
501 /* Tell the cache manager not to remember this one */
502 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
506 /* no cache; hit the wire */
507 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
508 if (!NT_STATUS_IS_OK(status)) {
512 status = rpc_lookup_usergroups(tmp_ctx,
519 if (!NT_STATUS_IS_OK(status)) {
525 *pnum_groups = num_groups;
529 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
533 TALLOC_FREE(tmp_ctx);
538 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
540 static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
542 uint32 num_sids, const struct dom_sid *sids,
543 uint32 *pnum_aliases,
544 uint32 **palias_rids)
546 struct rpc_pipe_client *samr_pipe;
547 struct policy_handle dom_pol;
548 uint32_t num_aliases = 0;
549 uint32_t *alias_rids = NULL;
553 DEBUG(3,("msrpc_lookup_useraliases\n"));
559 tmp_ctx = talloc_stackframe();
560 if (tmp_ctx == NULL) {
561 return NT_STATUS_NO_MEMORY;
564 if (!winbindd_can_contact_domain(domain)) {
565 DEBUG(10,("msrpc_lookup_useraliases: No incoming trust for domain %s\n",
567 /* Tell the cache manager not to remember this one */
568 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
572 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
573 if (!NT_STATUS_IS_OK(status)) {
577 status = rpc_lookup_useraliases(tmp_ctx,
584 if (!NT_STATUS_IS_OK(status)) {
589 *pnum_aliases = num_aliases;
593 *palias_rids = talloc_move(mem_ctx, &alias_rids);
597 TALLOC_FREE(tmp_ctx);
602 /* Lookup group membership given a rid. */
603 static NTSTATUS msrpc_lookup_groupmem(struct winbindd_domain *domain,
605 const struct dom_sid *group_sid,
606 enum lsa_SidType type,
608 struct dom_sid **sid_mem,
610 uint32_t **name_types)
612 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
613 uint32 i, total_names = 0;
614 struct policy_handle dom_pol, group_pol;
615 uint32 des_access = SEC_FLAG_MAXIMUM_ALLOWED;
616 uint32 *rid_mem = NULL;
619 struct rpc_pipe_client *cli;
620 unsigned int orig_timeout;
621 struct samr_RidAttrArray *rids = NULL;
623 DEBUG(3,("msrpc_lookup_groupmem: %s sid=%s\n", domain->name,
624 sid_string_dbg(group_sid)));
626 if ( !winbindd_can_contact_domain( domain ) ) {
627 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
632 if (!sid_peek_check_rid(&domain->sid, group_sid, &group_rid))
633 return NT_STATUS_UNSUCCESSFUL;
637 result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
638 if (!NT_STATUS_IS_OK(result))
641 result = rpccli_samr_OpenGroup(cli, mem_ctx,
647 if (!NT_STATUS_IS_OK(result))
650 /* Step #1: Get a list of user rids that are the members of the
653 /* This call can take a long time - allow the server to time out.
654 35 seconds should do it. */
656 orig_timeout = rpccli_set_timeout(cli, 35000);
658 result = rpccli_samr_QueryGroupMember(cli, mem_ctx,
662 /* And restore our original timeout. */
663 rpccli_set_timeout(cli, orig_timeout);
665 rpccli_samr_Close(cli, mem_ctx, &group_pol);
667 if (!NT_STATUS_IS_OK(result))
670 if (!rids || !rids->count) {
677 *num_names = rids->count;
678 rid_mem = rids->rids;
680 /* Step #2: Convert list of rids into list of usernames. Do this
681 in bunches of ~1000 to avoid crashing NT4. It looks like there
682 is a buffer overflow or something like that lurking around
685 #define MAX_LOOKUP_RIDS 900
687 *names = TALLOC_ZERO_ARRAY(mem_ctx, char *, *num_names);
688 *name_types = TALLOC_ZERO_ARRAY(mem_ctx, uint32, *num_names);
689 *sid_mem = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, *num_names);
691 for (j=0;j<(*num_names);j++)
692 sid_compose(&(*sid_mem)[j], &domain->sid, rid_mem[j]);
694 if (*num_names>0 && (!*names || !*name_types))
695 return NT_STATUS_NO_MEMORY;
697 for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
698 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
699 struct lsa_Strings tmp_names;
700 struct samr_Ids tmp_types;
702 /* Lookup a chunk of rids */
704 result = rpccli_samr_LookupRids(cli, mem_ctx,
711 /* see if we have a real error (and yes the
712 STATUS_SOME_UNMAPPED is the one returned from 2k) */
714 if (!NT_STATUS_IS_OK(result) &&
715 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
718 /* Copy result into array. The talloc system will take
719 care of freeing the temporary arrays later on. */
721 if (tmp_names.count != tmp_types.count) {
722 return NT_STATUS_UNSUCCESSFUL;
725 for (r=0; r<tmp_names.count; r++) {
726 if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
729 (*names)[total_names] = fill_domain_username_talloc(
730 mem_ctx, domain->name,
731 tmp_names.names[r].string, true);
732 (*name_types)[total_names] = tmp_types.ids[r];
737 *num_names = total_names;
746 static int get_ldap_seq(const char *server, int port, uint32 *seq)
750 const char *attrs[] = {"highestCommittedUSN", NULL};
751 LDAPMessage *res = NULL;
752 char **values = NULL;
755 *seq = DOM_SEQUENCE_NONE;
758 * Parameterised (5) second timeout on open. This is needed as the
759 * search timeout doesn't seem to apply to doing an open as well. JRA.
762 ldp = ldap_open_with_timeout(server, port, lp_ldap_timeout());
766 /* Timeout if no response within 20 seconds. */
770 if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
771 CONST_DISCARD(char **, attrs), 0, &to, &res))
774 if (ldap_count_entries(ldp, res) != 1)
777 values = ldap_get_values(ldp, res, "highestCommittedUSN");
778 if (!values || !values[0])
781 *seq = atoi(values[0]);
787 ldap_value_free(values);
795 /**********************************************************************
796 Get the sequence number for a Windows AD native mode domain using
798 **********************************************************************/
800 static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32 *seq)
803 char addr[INET6_ADDRSTRLEN];
805 print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
806 if ((ret = get_ldap_seq(addr, LDAP_PORT, seq)) == 0) {
807 DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
808 "number for Domain (%s) from DC (%s)\n",
809 domain->name, addr));
814 #endif /* HAVE_LDAP */
816 /* find the sequence number for a domain */
817 static NTSTATUS msrpc_sequence_number(struct winbindd_domain *domain,
820 struct rpc_pipe_client *samr_pipe;
821 struct policy_handle dom_pol;
826 DEBUG(3, ("msrpc_sequence_number: fetch sequence_number for %s\n", domain->name));
829 *pseq = DOM_SEQUENCE_NONE;
832 tmp_ctx = talloc_stackframe();
833 if (tmp_ctx == NULL) {
834 return NT_STATUS_NO_MEMORY;
837 if ( !winbindd_can_contact_domain( domain ) ) {
838 DEBUG(10,("sequence_number: No incoming trust for domain %s\n",
843 status = NT_STATUS_OK;
848 if (domain->active_directory) {
851 DEBUG(8,("using get_ldap_seq() to retrieve the "
852 "sequence number\n"));
854 rc = get_ldap_sequence_number(domain, &seq);
856 DEBUG(10,("domain_sequence_number: LDAP for "
864 status = NT_STATUS_OK;
868 DEBUG(10,("domain_sequence_number: failed to get LDAP "
869 "sequence number for domain %s\n",
872 #endif /* HAVE_LDAP */
874 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
875 if (!NT_STATUS_IS_OK(status)) {
879 status = rpc_sequence_number(tmp_ctx,
884 if (!NT_STATUS_IS_OK(status)) {
893 TALLOC_FREE(tmp_ctx);
897 /* get a list of trusted domains */
898 static NTSTATUS msrpc_trusted_domains(struct winbindd_domain *domain,
900 struct netr_DomainTrustList *ptrust_list)
902 struct rpc_pipe_client *lsa_pipe;
903 struct policy_handle lsa_policy;
904 struct netr_DomainTrust *trusts = NULL;
905 uint32_t num_trusts = 0;
909 DEBUG(3,("msrpc_trusted_domains\n"));
912 ZERO_STRUCTP(ptrust_list);
915 tmp_ctx = talloc_stackframe();
916 if (tmp_ctx == NULL) {
917 return NT_STATUS_NO_MEMORY;
920 status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
921 if (!NT_STATUS_IS_OK(status))
924 status = rpc_trusted_domains(tmp_ctx,
929 if (!NT_STATUS_IS_OK(status)) {
934 ptrust_list->count = num_trusts;
935 ptrust_list->array = talloc_move(mem_ctx, &trusts);
939 TALLOC_FREE(tmp_ctx);
943 /* find the lockout policy for a domain */
944 static NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
946 struct samr_DomInfo12 *lockout_policy)
949 struct rpc_pipe_client *cli;
950 struct policy_handle dom_pol;
951 union samr_DomainInfo *info = NULL;
953 DEBUG(3, ("msrpc_lockout_policy: fetch lockout policy for %s\n", domain->name));
955 if ( !winbindd_can_contact_domain( domain ) ) {
956 DEBUG(10,("msrpc_lockout_policy: No incoming trust for domain %s\n",
958 return NT_STATUS_NOT_SUPPORTED;
961 result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
962 if (!NT_STATUS_IS_OK(result)) {
966 result = rpccli_samr_QueryDomainInfo(cli, mem_ctx,
970 if (!NT_STATUS_IS_OK(result)) {
974 *lockout_policy = info->info12;
976 DEBUG(10,("msrpc_lockout_policy: lockout_threshold %d\n",
977 info->info12.lockout_threshold));
984 /* find the password policy for a domain */
985 static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
987 struct samr_DomInfo1 *password_policy)
990 struct rpc_pipe_client *cli;
991 struct policy_handle dom_pol;
992 union samr_DomainInfo *info = NULL;
994 DEBUG(3, ("msrpc_password_policy: fetch password policy for %s\n",
997 if ( !winbindd_can_contact_domain( domain ) ) {
998 DEBUG(10,("msrpc_password_policy: No incoming trust for domain %s\n",
1000 return NT_STATUS_NOT_SUPPORTED;
1003 result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
1004 if (!NT_STATUS_IS_OK(result)) {
1008 result = rpccli_samr_QueryDomainInfo(cli, mem_ctx,
1012 if (!NT_STATUS_IS_OK(result)) {
1016 *password_policy = info->info1;
1018 DEBUG(10,("msrpc_password_policy: min_length_password %d\n",
1019 info->info1.min_password_length));
1026 typedef NTSTATUS (*lookup_sids_fn_t)(struct rpc_pipe_client *cli,
1027 TALLOC_CTX *mem_ctx,
1028 struct policy_handle *pol,
1030 const struct dom_sid *sids,
1033 enum lsa_SidType **ptypes);
1035 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
1036 struct winbindd_domain *domain,
1038 const struct dom_sid *sids,
1041 enum lsa_SidType **types)
1044 struct rpc_pipe_client *cli = NULL;
1045 struct policy_handle lsa_policy;
1046 unsigned int orig_timeout;
1047 lookup_sids_fn_t lookup_sids_fn = rpccli_lsa_lookup_sids;
1049 if (domain->can_do_ncacn_ip_tcp) {
1050 status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
1051 if (NT_STATUS_IS_OK(status)) {
1052 lookup_sids_fn = rpccli_lsa_lookup_sids3;
1055 domain->can_do_ncacn_ip_tcp = false;
1057 status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
1059 if (!NT_STATUS_IS_OK(status)) {
1065 * This call can take a long time
1066 * allow the server to time out.
1067 * 35 seconds should do it.
1069 orig_timeout = rpccli_set_timeout(cli, 35000);
1071 status = lookup_sids_fn(cli,
1080 /* And restore our original timeout. */
1081 rpccli_set_timeout(cli, orig_timeout);
1086 typedef NTSTATUS (*lookup_names_fn_t)(struct rpc_pipe_client *cli,
1087 TALLOC_CTX *mem_ctx,
1088 struct policy_handle *pol,
1091 const char ***dom_names,
1093 struct dom_sid **sids,
1094 enum lsa_SidType **types);
1096 NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
1097 struct winbindd_domain *domain,
1100 const char ***domains,
1101 struct dom_sid **sids,
1102 enum lsa_SidType **types)
1105 struct rpc_pipe_client *cli = NULL;
1106 struct policy_handle lsa_policy;
1107 unsigned int orig_timeout = 0;
1108 lookup_names_fn_t lookup_names_fn = rpccli_lsa_lookup_names;
1110 if (domain->can_do_ncacn_ip_tcp) {
1111 status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
1112 if (NT_STATUS_IS_OK(status)) {
1113 lookup_names_fn = rpccli_lsa_lookup_names4;
1116 domain->can_do_ncacn_ip_tcp = false;
1118 status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
1120 if (!NT_STATUS_IS_OK(status)) {
1127 * This call can take a long time
1128 * allow the server to time out.
1129 * 35 seconds should do it.
1131 orig_timeout = rpccli_set_timeout(cli, 35000);
1133 status = lookup_names_fn(cli,
1137 (const char **) names,
1143 /* And restore our original timeout. */
1144 rpccli_set_timeout(cli, orig_timeout);
1146 if (!NT_STATUS_IS_OK(status)) {
1153 /* the rpc backend methods are exposed via this structure */
1154 struct winbindd_methods msrpc_methods = {
1156 msrpc_query_user_list,
1157 msrpc_enum_dom_groups,
1158 msrpc_enum_local_groups,
1161 msrpc_rids_to_names,
1163 msrpc_lookup_usergroups,
1164 msrpc_lookup_useraliases,
1165 msrpc_lookup_groupmem,
1166 msrpc_sequence_number,
1167 msrpc_lockout_policy,
1168 msrpc_password_policy,
1169 msrpc_trusted_domains,