Fix uninstallman.

[samba.git] / source4 / auth / sam.c

diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index 9a8045f62d62071aac9a5bfb05112ea261fbe845..819bca0db0422b5eae77ec555db1163e5a254e89 100644 (file)
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -23,12 +23,13 @@
 #include "system/time.h"
 #include "auth/auth.h"
 #include <ldb.h>
-#include "util/util_ldb.h"
+#include "../lib/util/util_ldb.h"
 #include "dsdb/samdb/samdb.h"
 #include "libcli/security/security.h"
 #include "libcli/ldap/ldap.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
 #include "param/param.h"
+#include "auth/auth_sam.h"
 
 const char *user_attrs[] = {
        /* required for the krb5 kdc */
@@ -143,7 +144,8 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
                            struct ldb_message *msg,
                            struct ldb_message *msg_domain_ref,
                            const char *logon_workstation,
-                           const char *name_for_logs)
+                           const char *name_for_logs,
+                           bool allow_domain_trust)
 {
        uint16_t acct_flags;
        const char *workstation_list;
@@ -157,7 +159,7 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
 
        acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
        
-       acct_expiry = samdb_result_nttime(msg, "accountExpires", 0);
+       acct_expiry = samdb_result_account_expires(msg);
 
        /* Check for when we must change this password, taking the
         * userAccountControl flags into account */
@@ -207,7 +209,7 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
        if (logon_workstation && workstation_list && *workstation_list) {
                bool invalid_ws = true;
                int i;
-               const char **workstations = str_list_make(mem_ctx, workstation_list, ",");
+               const char **workstations = (const char **)str_list_make(mem_ctx, workstation_list, ",");
                
                for (i = 0; workstations && workstations[i]; i++) {
                        DEBUG(10,("sam_account_ok: checking for workstation match '%s' and '%s'\n",
@@ -230,11 +232,12 @@ _PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
                return NT_STATUS_INVALID_LOGON_HOURS;
        }
        
-       if (acct_flags & ACB_DOMTRUST) {
-               DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", name_for_logs));
-               return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
+       if (!allow_domain_trust) {
+               if (acct_flags & ACB_DOMTRUST) {
+                       DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", name_for_logs));
+                       return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
+               }
        }
-       
        if (!(logon_parameters & MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT)) {
                if (acct_flags & ACB_SVRTRUST) {
                        DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", name_for_logs));
@@ -351,7 +354,7 @@ _PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_conte
 
        server_info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
        server_info->last_logoff = samdb_result_nttime(msg, "lastLogoff", 0);
-       server_info->acct_expiry = samdb_result_nttime(msg, "accountExpires", 0);
+       server_info->acct_expiry = samdb_result_account_expires(msg);
        server_info->last_password_change = samdb_result_nttime(msg, "pwdLastSet", 0);
 
        ncname = samdb_result_dn(sam_ctx, mem_ctx, msg_domain_ref, "nCName", NULL);
@@ -383,7 +386,7 @@ _PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx, struct ldb_conte
        return NT_STATUS_OK;
 }
 
-_PUBLIC_ NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
+NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
                                   TALLOC_CTX *mem_ctx, const char *principal,
                                   struct ldb_message ***msgs,
                                   struct ldb_message ***msgs_domain_ref)
@@ -425,45 +428,3 @@ _PUBLIC_ NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
        
        return NT_STATUS_OK;
 }
-                                  
-/* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available */
-NTSTATUS sam_get_server_info_principal(TALLOC_CTX *mem_ctx, 
-                                      struct loadparm_context *lp_ctx,
-                                      const char *principal,
-                                      struct auth_serversupplied_info **server_info)
-{
-       NTSTATUS nt_status;
-       DATA_BLOB user_sess_key = data_blob(NULL, 0);
-       DATA_BLOB lm_sess_key = data_blob(NULL, 0);
-
-       struct ldb_message **msgs;
-       struct ldb_message **msgs_domain_ref;
-       struct ldb_context *sam_ctx;
-
-       TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
-       if (!tmp_ctx) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       sam_ctx = samdb_connect(tmp_ctx, lp_ctx, system_session(tmp_ctx, lp_ctx));
-       if (sam_ctx == NULL) {
-               talloc_free(tmp_ctx);
-               return NT_STATUS_INVALID_SYSTEM_SERVICE;
-       }
-
-       nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal, 
-                                             &msgs, &msgs_domain_ref);
-       if (!NT_STATUS_IS_OK(nt_status)) {
-               return nt_status;
-       }
-
-       nt_status = authsam_make_server_info(tmp_ctx, sam_ctx, lp_netbios_name(lp_ctx),
-                                            msgs[0], msgs_domain_ref[0],
-                                            user_sess_key, lm_sess_key,
-                                            server_info);
-       if (NT_STATUS_IS_OK(nt_status)) {
-               talloc_steal(mem_ctx, *server_info);
-       }
-       talloc_free(tmp_ctx);
-       return nt_status;
-}