s3:libnet: accept empty realm for AD domains when only security=domain is set.
[samba.git] / source3 / libnet / libnet_samsync_passdb.c
index 388b10a0faff343fef36578f62fe13d23ec4278a..91482e69f2e627acf88db00697f37599ff66ef17 100644 (file)
 */
 
 #include "includes.h"
-#include "libnet/libnet.h"
+#include "system/passwd.h"
+#include "libnet/libnet_samsync.h"
+#include "../libcli/security/security.h"
+#include "passdb.h"
+#include "lib/util/base64.h"
 
 /* Convert a struct samu_DELTA to a struct samu. */
 #define STRING_CHANGED (old_string && !new_string) ||\
@@ -35,6 +39,9 @@
                    (!(s1) && (s2)) ||\
                ((s1) && (s2) && (strcmp((s1), (s2)) != 0))
 
+/****************************************************************
+****************************************************************/
+
 static NTSTATUS sam_account_from_delta(struct samu *account,
                                       struct netr_DELTA_USER *r)
 {
@@ -120,12 +127,15 @@ static NTSTATUS sam_account_from_delta(struct samu *account,
 
        if (r->parameters.array) {
                DATA_BLOB mung;
-               char *newstr;
+               char *newstr = NULL;
                old_string = pdb_get_munged_dial(account);
                mung.length = r->parameters.length * 2;
                mung.data = (uint8_t *) r->parameters.array;
-               newstr = (mung.length == 0) ? NULL :
-                       base64_encode_data_blob(talloc_tos(), mung);
+
+               if (mung.length != 0) {
+                       newstr = base64_encode_data_blob(talloc_tos(), mung);
+                       SMB_ASSERT(newstr != NULL);
+               }
 
                if (STRING_CHANGED_NC(old_string, newstr))
                        pdb_set_munged_dial(account, newstr, PDB_CHANGED);
@@ -175,7 +185,8 @@ static NTSTATUS sam_account_from_delta(struct samu *account,
                pdb_sethexhours(oldstr, pdb_get_hours(account));
                pdb_sethexhours(newstr, r->logon_hours.bits);
                if (!strequal(oldstr, newstr))
-                       pdb_set_hours(account, r->logon_hours.bits, PDB_CHANGED);
+                       pdb_set_hours(account, r->logon_hours.bits,
+                                     pdb_get_hours_len(account), PDB_CHANGED);
        }
 
        if (pdb_get_bad_password_count(account) != r->bad_password_count)
@@ -223,76 +234,99 @@ static NTSTATUS sam_account_from_delta(struct samu *account,
        return NT_STATUS_OK;
 }
 
-static NTSTATUS fetch_account_info(uint32_t rid,
+
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS smb_create_user(TALLOC_CTX *mem_ctx,
+                               uint32_t acct_flags,
+                               const char *account,
+                               struct passwd **passwd_p)
+{
+       struct passwd *passwd;
+       char *add_script = NULL;
+
+       passwd = Get_Pwnam_alloc(mem_ctx, account);
+       if (passwd) {
+               *passwd_p = passwd;
+               return NT_STATUS_OK;
+       }
+
+       /* Create appropriate user */
+       if (acct_flags & ACB_NORMAL) {
+               add_script = lp_add_user_script(mem_ctx);
+       } else if ( (acct_flags & ACB_WSTRUST) ||
+                   (acct_flags & ACB_SVRTRUST) ||
+                   (acct_flags & ACB_DOMTRUST) ) {
+               add_script = lp_add_machine_script(mem_ctx);
+       } else {
+               DEBUG(1, ("Unknown user type: %s\n",
+                         pdb_encode_acct_ctrl(acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
+               return NT_STATUS_UNSUCCESSFUL;
+       }
+
+       if (!add_script) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (*add_script) {
+               int add_ret;
+               add_script = talloc_all_string_sub(mem_ctx, add_script,
+                                                  "%u", account);
+               if (!add_script) {
+                       return NT_STATUS_NO_MEMORY;
+               }
+               add_ret = smbrun(add_script, NULL);
+               DEBUG(add_ret ? 0 : 1,("fetch_account: Running the command `%s' "
+                        "gave %d\n", add_script, add_ret));
+               if (add_ret == 0) {
+                       smb_nscd_flush_user_cache();
+               }
+       }
+
+       /* try and find the possible unix account again */
+       passwd = Get_Pwnam_alloc(mem_ctx, account);
+       if (!passwd) {
+               return NT_STATUS_NO_SUCH_USER;
+       }
+
+       *passwd_p = passwd;
+
+       return NT_STATUS_OK;
+}
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS fetch_account_info(TALLOC_CTX *mem_ctx,
+                                  uint32_t rid,
                                   struct netr_DELTA_USER *r)
 {
 
        NTSTATUS nt_ret = NT_STATUS_UNSUCCESSFUL;
        fstring account;
-       char *add_script = NULL;
        struct samu *sam_account=NULL;
-       GROUP_MAP map;
+       GROUP_MAP *map = NULL;
        struct group *grp;
-       DOM_SID user_sid;
-       DOM_SID group_sid;
-       struct passwd *passwd;
+       struct dom_sid user_sid;
+       struct dom_sid group_sid;
+       struct passwd *passwd = NULL;
        fstring sid_string;
 
        fstrcpy(account, r->account_name.string);
        d_printf("Creating account: %s\n", account);
 
-       if ( !(sam_account = samu_new( NULL )) ) {
+       if ( !(sam_account = samu_new(mem_ctx)) ) {
                return NT_STATUS_NO_MEMORY;
        }
 
-       if (!(passwd = Get_Pwnam_alloc(sam_account, account))) {
-               /* Create appropriate user */
-               if (r->acct_flags & ACB_NORMAL) {
-                       add_script = talloc_strdup(sam_account,
-                                       lp_adduser_script());
-               } else if ( (r->acct_flags & ACB_WSTRUST) ||
-                           (r->acct_flags & ACB_SVRTRUST) ||
-                           (r->acct_flags & ACB_DOMTRUST) ) {
-                       add_script = talloc_strdup(sam_account,
-                                       lp_addmachine_script());
-               } else {
-                       DEBUG(1, ("Unknown user type: %s\n",
-                                 pdb_encode_acct_ctrl(r->acct_flags, NEW_PW_FORMAT_SPACE_PADDED_LEN)));
-                       nt_ret = NT_STATUS_UNSUCCESSFUL;
-                       goto done;
-               }
-               if (!add_script) {
-                       nt_ret = NT_STATUS_NO_MEMORY;
-                       goto done;
-               }
-               if (*add_script) {
-                       int add_ret;
-                       add_script = talloc_all_string_sub(sam_account,
-                                       add_script,
-                                       "%u",
-                                       account);
-                       if (!add_script) {
-                               nt_ret = NT_STATUS_NO_MEMORY;
-                               goto done;
-                       }
-                       add_ret = smbrun(add_script,NULL);
-                       DEBUG(add_ret ? 0 : 1,("fetch_account: Running the command `%s' "
-                                "gave %d\n", add_script, add_ret));
-                       if (add_ret == 0) {
-                               smb_nscd_flush_user_cache();
-                       }
-               }
-
-               /* try and find the possible unix account again */
-               if ( !(passwd = Get_Pwnam_alloc(sam_account, account)) ) {
-                       d_fprintf(stderr, "Could not create posix account info for '%s'\n", account);
-                       nt_ret = NT_STATUS_NO_SUCH_USER;
-                       goto done;
-               }
+       nt_ret = smb_create_user(sam_account, r->acct_flags, account, &passwd);
+       if (!NT_STATUS_IS_OK(nt_ret)) {
+               d_fprintf(stderr, "Could not create posix account info for '%s'\n",
+                       account);
+               goto done;
        }
 
-       sid_copy(&user_sid, get_global_sam_sid());
-       sid_append_rid(&user_sid, r->rid);
+       sid_compose(&user_sid, get_global_sam_sid(), r->rid);
 
        DEBUG(3, ("Attempting to find SID %s for user %s in the passdb\n",
                  sid_to_fstring(sid_string, &user_sid), account));
@@ -325,14 +359,19 @@ static NTSTATUS fetch_account_info(uint32_t rid,
 
        group_sid = *pdb_get_group_sid(sam_account);
 
-       if (!pdb_getgrsid(&map, group_sid)) {
+       map = talloc_zero(mem_ctx, GROUP_MAP);
+       if (!map) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
+       if (!pdb_getgrsid(map, group_sid)) {
                DEBUG(0, ("Primary group of %s has no mapping!\n",
                          pdb_get_username(sam_account)));
        } else {
-               if (map.gid != passwd->pw_gid) {
-                       if (!(grp = getgrgid(map.gid))) {
+               if (map->gid != passwd->pw_gid) {
+                       if (!(grp = getgrgid(map->gid))) {
                                DEBUG(0, ("Could not find unix group %lu for user %s (group SID=%s)\n",
-                                         (unsigned long)map.gid, pdb_get_username(sam_account), sid_string_tos(&group_sid)));
+                                         (unsigned long)map->gid, pdb_get_username(sam_account), sid_string_tos(&group_sid)));
                        } else {
                                smb_set_primary_group(grp->gr_name, pdb_get_username(sam_account));
                        }
@@ -346,109 +385,124 @@ static NTSTATUS fetch_account_info(uint32_t rid,
 
  done:
        TALLOC_FREE(sam_account);
+       TALLOC_FREE(map);
        return nt_ret;
 }
 
-static NTSTATUS fetch_group_info(uint32_t rid,
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS fetch_group_info(TALLOC_CTX *mem_ctx,
+                                uint32_t rid,
                                 struct netr_DELTA_GROUP *r)
 {
-       fstring name;
-       fstring comment;
        struct group *grp = NULL;
-       DOM_SID group_sid;
+       struct dom_sid group_sid;
        fstring sid_string;
-       GROUP_MAP map;
+       GROUP_MAP *map;
        bool insert = true;
 
-       fstrcpy(name, r->group_name.string);
-       fstrcpy(comment, r->description.string);
-
+       map = talloc_zero(mem_ctx, GROUP_MAP);
+       if (!map) {
+               return NT_STATUS_NO_MEMORY;
+       }
        /* add the group to the mapping table */
-       sid_copy(&group_sid, get_global_sam_sid());
-       sid_append_rid(&group_sid, rid);
+       sid_compose(&group_sid, get_global_sam_sid(), rid);
        sid_to_fstring(sid_string, &group_sid);
 
-       if (pdb_getgrsid(&map, group_sid)) {
-               if ( map.gid != -1 )
-                       grp = getgrgid(map.gid);
+       if (pdb_getgrsid(map, group_sid)) {
+               if (map->gid != -1) {
+                       grp = getgrgid(map->gid);
+               }
                insert = false;
        }
 
+       map->nt_name = talloc_strdup(map, r->group_name.string);
+       if (!map->nt_name) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       map->comment = talloc_strdup(map, r->description.string);
+       if (!map->comment) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
        if (grp == NULL) {
                gid_t gid;
 
                /* No group found from mapping, find it from its name. */
-               if ((grp = getgrnam(name)) == NULL) {
+               if ((grp = getgrnam(map->nt_name)) == NULL) {
 
                        /* No appropriate group found, create one */
 
-                       d_printf("Creating unix group: '%s'\n", name);
+                       d_printf("Creating unix group: '%s'\n", map->nt_name);
 
-                       if (smb_create_group(name, &gid) != 0)
+                       if (smb_create_group(map->nt_name, &gid) != 0)
                                return NT_STATUS_ACCESS_DENIED;
 
-                       if ((grp = getgrnam(name)) == NULL)
+                       if ((grp = getgrnam(map->nt_name)) == NULL)
                                return NT_STATUS_ACCESS_DENIED;
                }
        }
 
-       map.gid = grp->gr_gid;
-       map.sid = group_sid;
-       map.sid_name_use = SID_NAME_DOM_GRP;
-       fstrcpy(map.nt_name, name);
-       if (r->description.string) {
-               fstrcpy(map.comment, comment);
+       map->gid = grp->gr_gid;
+       map->sid = group_sid;
+       map->sid_name_use = SID_NAME_DOM_GRP;
+
+       if (insert) {
+               pdb_add_group_mapping_entry(map);
        } else {
-               fstrcpy(map.comment, "");
+               pdb_update_group_mapping_entry(map);
        }
 
-       if (insert)
-               pdb_add_group_mapping_entry(&map);
-       else
-               pdb_update_group_mapping_entry(&map);
-
+       TALLOC_FREE(map);
        return NT_STATUS_OK;
 }
 
-static NTSTATUS fetch_group_mem_info(uint32_t rid,
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS fetch_group_mem_info(TALLOC_CTX *mem_ctx,
+                                    uint32_t rid,
                                     struct netr_DELTA_GROUP_MEMBER *r)
 {
        int i;
-       TALLOC_CTX *t = NULL;
        char **nt_members = NULL;
        char **unix_members;
-       DOM_SID group_sid;
-       GROUP_MAP map;
+       struct dom_sid group_sid;
+       GROUP_MAP *map;
        struct group *grp;
 
        if (r->num_rids == 0) {
                return NT_STATUS_OK;
        }
 
-       sid_copy(&group_sid, get_global_sam_sid());
-       sid_append_rid(&group_sid, rid);
+       sid_compose(&group_sid, get_global_sam_sid(), rid);
+
+       map = talloc_zero(mem_ctx, GROUP_MAP);
+       if (!map) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
-       if (!get_domain_group_from_sid(group_sid, &map)) {
+       if (!get_domain_group_from_sid(group_sid, map)) {
                DEBUG(0, ("Could not find global group %d\n", rid));
+               TALLOC_FREE(map);
                return NT_STATUS_NO_SUCH_GROUP;
        }
 
-       if (!(grp = getgrgid(map.gid))) {
-               DEBUG(0, ("Could not find unix group %lu\n", (unsigned long)map.gid));
+       if (!(grp = getgrgid(map->gid))) {
+               DEBUG(0, ("Could not find unix group %lu\n",
+                                               (unsigned long)map->gid));
+               TALLOC_FREE(map);
                return NT_STATUS_NO_SUCH_GROUP;
        }
 
-       d_printf("Group members of %s: ", grp->gr_name);
+       TALLOC_FREE(map);
 
-       if (!(t = talloc_init("fetch_group_mem_info"))) {
-               DEBUG(0, ("could not talloc_init\n"));
-               return NT_STATUS_NO_MEMORY;
-       }
+       d_printf("Group members of %s: ", grp->gr_name);
 
        if (r->num_rids) {
-               if ((nt_members = TALLOC_ZERO_ARRAY(t, char *, r->num_rids)) == NULL) {
+               if ((nt_members = talloc_zero_array(mem_ctx, char *, r->num_rids)) == NULL) {
                        DEBUG(0, ("talloc failed\n"));
-                       talloc_free(t);
                        return NT_STATUS_NO_MEMORY;
                }
        } else {
@@ -457,15 +511,13 @@ static NTSTATUS fetch_group_mem_info(uint32_t rid,
 
        for (i=0; i < r->num_rids; i++) {
                struct samu *member = NULL;
-               DOM_SID member_sid;
+               struct dom_sid member_sid;
 
-               if ( !(member = samu_new(t)) ) {
-                       talloc_destroy(t);
+               if ( !(member = samu_new(mem_ctx)) ) {
                        return NT_STATUS_NO_MEMORY;
                }
 
-               sid_copy(&member_sid, get_global_sam_sid());
-               sid_append_rid(&member_sid, r->rids[i]);
+               sid_compose(&member_sid, get_global_sam_sid(), r->rids[i]);
 
                if (!pdb_getsampwsid(member, &member_sid)) {
                        DEBUG(1, ("Found bogus group member: %d (member_sid=%s group=%s)\n",
@@ -481,7 +533,7 @@ static NTSTATUS fetch_group_mem_info(uint32_t rid,
                }
 
                d_printf("%s,", pdb_get_username(member));
-               nt_members[i] = talloc_strdup(t, pdb_get_username(member));
+               nt_members[i] = talloc_strdup(mem_ctx, pdb_get_username(member));
                TALLOC_FREE(member);
        }
 
@@ -537,76 +589,95 @@ static NTSTATUS fetch_group_mem_info(uint32_t rid,
                }
        }
 
-       talloc_destroy(t);
        return NT_STATUS_OK;
 }
 
-static NTSTATUS fetch_alias_info(uint32_t rid,
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS fetch_alias_info(TALLOC_CTX *mem_ctx,
+                                uint32_t rid,
                                 struct netr_DELTA_ALIAS *r,
-                                const DOM_SID *dom_sid)
+                                const struct dom_sid *dom_sid)
 {
-       fstring name;
-       fstring comment;
        struct group *grp = NULL;
-       DOM_SID alias_sid;
+       struct dom_sid alias_sid;
        fstring sid_string;
-       GROUP_MAP map;
+       GROUP_MAP *map;
        bool insert = true;
 
-       fstrcpy(name, r->alias_name.string);
-       fstrcpy(comment, r->description.string);
+       map = talloc_zero(mem_ctx, GROUP_MAP);
+       if (!map) {
+               return NT_STATUS_NO_MEMORY;
+       }
 
        /* Find out whether the group is already mapped */
-       sid_copy(&alias_sid, dom_sid);
-       sid_append_rid(&alias_sid, rid);
+       sid_compose(&alias_sid, dom_sid, rid);
        sid_to_fstring(sid_string, &alias_sid);
 
-       if (pdb_getgrsid(&map, alias_sid)) {
-               grp = getgrgid(map.gid);
+       if (pdb_getgrsid(map, alias_sid)) {
+               grp = getgrgid(map->gid);
                insert = false;
        }
 
+       map->nt_name = talloc_strdup(map, r->alias_name.string);
+       if (!map->nt_name) {
+               return NT_STATUS_NO_MEMORY;
+       }
+       map->comment = talloc_strdup(map, r->description.string);
+       if (!map->comment) {
+               return NT_STATUS_NO_MEMORY;
+       }
+
        if (grp == NULL) {
                gid_t gid;
 
                /* No group found from mapping, find it from its name. */
-               if ((grp = getgrnam(name)) == NULL) {
+               if ((grp = getgrnam(map->nt_name)) == NULL) {
                        /* No appropriate group found, create one */
-                       d_printf("Creating unix group: '%s'\n", name);
-                       if (smb_create_group(name, &gid) != 0)
+                       d_printf("Creating unix group: '%s'\n", map->nt_name);
+                       if (smb_create_group(map->nt_name, &gid) != 0)
                                return NT_STATUS_ACCESS_DENIED;
                        if ((grp = getgrgid(gid)) == NULL)
                                return NT_STATUS_ACCESS_DENIED;
                }
        }
 
-       map.gid = grp->gr_gid;
-       map.sid = alias_sid;
+       map->gid = grp->gr_gid;
+       map->sid = alias_sid;
 
-       if (sid_equal(dom_sid, &global_sid_Builtin))
-               map.sid_name_use = SID_NAME_WKN_GRP;
-       else
-               map.sid_name_use = SID_NAME_ALIAS;
-
-       fstrcpy(map.nt_name, name);
-       fstrcpy(map.comment, comment);
+       if (dom_sid_equal(dom_sid, &global_sid_Builtin)) {
+               map->sid_name_use = SID_NAME_WKN_GRP;
+       } else {
+               map->sid_name_use = SID_NAME_ALIAS;
+       }
 
-       if (insert)
-               pdb_add_group_mapping_entry(&map);
-       else
-               pdb_update_group_mapping_entry(&map);
+       if (insert) {
+               pdb_add_group_mapping_entry(map);
+       } else {
+               pdb_update_group_mapping_entry(map);
+       }
 
+       TALLOC_FREE(map);
        return NT_STATUS_OK;
 }
 
-static NTSTATUS fetch_alias_mem(uint32_t rid,
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS fetch_alias_mem(TALLOC_CTX *mem_ctx,
+                               uint32_t rid,
                                struct netr_DELTA_ALIAS_MEMBER *r,
-                               const DOM_SID *dom_sid)
+                               const struct dom_sid *dom_sid)
 {
        return NT_STATUS_OK;
 }
 
-static NTSTATUS fetch_domain_info(uint32_t rid,
+/****************************************************************
+****************************************************************/
+
+static NTSTATUS fetch_domain_info(TALLOC_CTX *mem_ctx,
+                                 uint32_t rid,
                                  struct netr_DELTA_DOMAIN *r)
 {
        time_t u_max_age, u_min_age, u_logout;
@@ -614,7 +685,6 @@ static NTSTATUS fetch_domain_info(uint32_t rid,
        const char *domname;
        struct netr_AcctLockStr *lockstr = NULL;
        NTSTATUS status;
-       TALLOC_CTX *mem_ctx = talloc_tos();
 
        status = pull_netr_AcctLockStr(mem_ctx, &r->account_lockout,
                                       &lockstr);
@@ -623,9 +693,9 @@ static NTSTATUS fetch_domain_info(uint32_t rid,
                        nt_errstr(status));
        }
 
-       u_max_age = uint64s_nt_time_to_unix_abs((uint64 *)&r->max_password_age);
-       u_min_age = uint64s_nt_time_to_unix_abs((uint64 *)&r->min_password_age);
-       u_logout = uint64s_nt_time_to_unix_abs((uint64 *)&r->force_logoff_time);
+       u_max_age = uint64s_nt_time_to_unix_abs((uint64_t *)&r->max_password_age);
+       u_min_age = uint64s_nt_time_to_unix_abs((uint64_t *)&r->min_password_age);
+       u_logout = uint64s_nt_time_to_unix_abs((uint64_t *)&r->force_logoff_time);
 
        domname = r->domain_name.string;
        if (!domname) {
@@ -639,21 +709,24 @@ static NTSTATUS fetch_domain_info(uint32_t rid,
        }
 
 
-       if (!pdb_set_account_policy(AP_PASSWORD_HISTORY,
+       if (!pdb_set_account_policy(PDB_POLICY_PASSWORD_HISTORY,
                                    r->password_history_length))
                return nt_status;
 
-       if (!pdb_set_account_policy(AP_MIN_PASSWORD_LEN,
+       if (!pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_LEN,
                                    r->min_password_length))
                return nt_status;
 
-       if (!pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (uint32)u_max_age))
+       if (!pdb_set_account_policy(PDB_POLICY_MAX_PASSWORD_AGE,
+                                   (uint32_t)u_max_age))
                return nt_status;
 
-       if (!pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (uint32)u_min_age))
+       if (!pdb_set_account_policy(PDB_POLICY_MIN_PASSWORD_AGE,
+                                   (uint32_t)u_min_age))
                return nt_status;
 
-       if (!pdb_set_account_policy(AP_TIME_TO_LOGOUT, (uint32)u_logout))
+       if (!pdb_set_account_policy(PDB_POLICY_TIME_TO_LOGOUT,
+                                   (uint32_t)u_logout))
                return nt_status;
 
        if (lockstr) {
@@ -662,58 +735,71 @@ static NTSTATUS fetch_domain_info(uint32_t rid,
                u_lockoutreset = uint64s_nt_time_to_unix_abs(&lockstr->reset_count);
                u_lockouttime = uint64s_nt_time_to_unix_abs((uint64_t *)&lockstr->lockout_duration);
 
-               if (!pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT,
+               if (!pdb_set_account_policy(PDB_POLICY_BAD_ATTEMPT_LOCKOUT,
                                            lockstr->bad_attempt_lockout))
                        return nt_status;
 
-               if (!pdb_set_account_policy(AP_RESET_COUNT_TIME, (uint32_t)u_lockoutreset/60))
+               if (!pdb_set_account_policy(PDB_POLICY_RESET_COUNT_TIME,
+                                           (uint32_t)u_lockoutreset/60))
                        return nt_status;
 
                if (u_lockouttime != -1)
                        u_lockouttime /= 60;
 
-               if (!pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION, (uint32_t)u_lockouttime))
+               if (!pdb_set_account_policy(PDB_POLICY_LOCK_ACCOUNT_DURATION,
+                                           (uint32_t)u_lockouttime))
                        return nt_status;
        }
 
-       if (!pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
+       if (!pdb_set_account_policy(PDB_POLICY_USER_MUST_LOGON_TO_CHG_PASS,
                                    r->logon_to_chgpass))
                return nt_status;
 
        return NT_STATUS_OK;
 }
 
+/****************************************************************
+****************************************************************/
+
 static NTSTATUS fetch_sam_entry(TALLOC_CTX *mem_ctx,
                                enum netr_SamDatabaseID database_id,
                                struct netr_DELTA_ENUM *r,
                                struct samsync_context *ctx)
 {
-       switch(r->delta_type) {
+       NTSTATUS status = NT_STATUS_NOT_IMPLEMENTED;
+
+       switch (r->delta_type) {
        case NETR_DELTA_USER:
-               fetch_account_info(r->delta_id_union.rid,
-                                  r->delta_union.user);
+               status = fetch_account_info(mem_ctx,
+                                           r->delta_id_union.rid,
+                                           r->delta_union.user);
                break;
        case NETR_DELTA_GROUP:
-               fetch_group_info(r->delta_id_union.rid,
-                                r->delta_union.group);
+               status = fetch_group_info(mem_ctx,
+                                         r->delta_id_union.rid,
+                                         r->delta_union.group);
                break;
        case NETR_DELTA_GROUP_MEMBER:
-               fetch_group_mem_info(r->delta_id_union.rid,
-                                    r->delta_union.group_member);
+               status = fetch_group_mem_info(mem_ctx,
+                                             r->delta_id_union.rid,
+                                             r->delta_union.group_member);
                break;
        case NETR_DELTA_ALIAS:
-               fetch_alias_info(r->delta_id_union.rid,
-                                r->delta_union.alias,
-                                ctx->domain_sid);
+               status = fetch_alias_info(mem_ctx,
+                                         r->delta_id_union.rid,
+                                         r->delta_union.alias,
+                                         ctx->domain_sid);
                break;
        case NETR_DELTA_ALIAS_MEMBER:
-               fetch_alias_mem(r->delta_id_union.rid,
-                               r->delta_union.alias_member,
-                               ctx->domain_sid);
+               status = fetch_alias_mem(mem_ctx,
+                                        r->delta_id_union.rid,
+                                        r->delta_union.alias_member,
+                                        ctx->domain_sid);
                break;
        case NETR_DELTA_DOMAIN:
-               fetch_domain_info(r->delta_id_union.rid,
-                                 r->delta_union.domain);
+               status = fetch_domain_info(mem_ctx,
+                                          r->delta_id_union.rid,
+                                          r->delta_union.domain);
                break;
        /* The following types are recognised but not handled */
        case NETR_DELTA_RENAME_GROUP:
@@ -766,12 +852,16 @@ static NTSTATUS fetch_sam_entry(TALLOC_CTX *mem_ctx,
                break;
        default:
                d_printf("Unknown delta record type %d\n", r->delta_type);
+               status = NT_STATUS_INVALID_PARAMETER;
                break;
        }
 
-       return NT_STATUS_OK;
+       return status;
 }
 
+/****************************************************************
+****************************************************************/
+
 static NTSTATUS fetch_sam_entries(TALLOC_CTX *mem_ctx,
                                  enum netr_SamDatabaseID database_id,
                                  struct netr_DELTA_ENUM_ARRAY *r,
@@ -787,6 +877,9 @@ static NTSTATUS fetch_sam_entries(TALLOC_CTX *mem_ctx,
        return NT_STATUS_OK;
 }
 
+/****************************************************************
+****************************************************************/
+
 const struct samsync_ops libnet_samsync_passdb_ops = {
        .process_objects        = fetch_sam_entries,
 };