2 Unix SMB/CIFS implementation.
4 endpoint server for the lsarpc pipe
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2007
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
23 #include "rpc_server/lsa/lsa.h"
34 .rtype = SID_NAME_WKN_GRP,
37 .name = "CREATOR OWNER",
38 .sid = SID_CREATOR_OWNER,
39 .rtype = SID_NAME_WKN_GRP,
42 .name = "CREATOR GROUP",
43 .sid = SID_CREATOR_GROUP,
44 .rtype = SID_NAME_WKN_GRP,
47 .name = "Owner Rights",
48 .sid = SID_OWNER_RIGHTS,
49 .rtype = SID_NAME_WKN_GRP,
52 .domain = "NT AUTHORITY",
55 .rtype = SID_NAME_WKN_GRP,
58 .domain = "NT AUTHORITY",
60 .sid = SID_NT_NETWORK,
61 .rtype = SID_NAME_WKN_GRP,
64 .domain = "NT AUTHORITY",
67 .rtype = SID_NAME_WKN_GRP,
70 .domain = "NT AUTHORITY",
71 .name = "Interactive",
72 .sid = SID_NT_INTERACTIVE,
73 .rtype = SID_NAME_WKN_GRP,
76 .domain = "NT AUTHORITY",
78 .sid = SID_NT_SERVICE,
79 .rtype = SID_NAME_WKN_GRP,
82 .domain = "NT AUTHORITY",
83 .name = "ANONYMOUS LOGON",
84 .sid = SID_NT_ANONYMOUS,
85 .rtype = SID_NAME_WKN_GRP,
88 .domain = "NT AUTHORITY",
91 .rtype = SID_NAME_WKN_GRP,
94 .domain = "NT AUTHORITY",
95 .name = "ServerLogon",
96 .sid = SID_NT_ENTERPRISE_DCS,
97 .rtype = SID_NAME_WKN_GRP,
100 .domain = "NT AUTHORITY",
103 .rtype = SID_NAME_WKN_GRP,
106 .domain = "NT AUTHORITY",
107 .name = "Authenticated Users",
108 .sid = SID_NT_AUTHENTICATED_USERS,
109 .rtype = SID_NAME_WKN_GRP,
112 .domain = "NT AUTHORITY",
113 .name = "Restricted",
114 .sid = SID_NT_RESTRICTED,
115 .rtype = SID_NAME_WKN_GRP,
118 .domain = "NT AUTHORITY",
119 .name = "Terminal Server User",
120 .sid = SID_NT_TERMINAL_SERVER_USERS,
121 .rtype = SID_NAME_WKN_GRP,
124 .domain = "NT AUTHORITY",
125 .name = "Remote Interactive Logon",
126 .sid = SID_NT_REMOTE_INTERACTIVE,
127 .rtype = SID_NAME_WKN_GRP,
130 .domain = "NT AUTHORITY",
131 .name = "This Organization",
132 .sid = SID_NT_THIS_ORGANISATION,
133 .rtype = SID_NAME_WKN_GRP,
136 .domain = "NT AUTHORITY",
138 .sid = SID_NT_SYSTEM,
139 .rtype = SID_NAME_WKN_GRP,
142 .domain = "NT AUTHORITY",
143 .name = "Local Service",
144 .sid = SID_NT_LOCAL_SERVICE,
145 .rtype = SID_NAME_WKN_GRP,
148 .domain = "NT AUTHORITY",
149 .name = "Network Service",
150 .sid = SID_NT_NETWORK_SERVICE,
151 .rtype = SID_NAME_WKN_GRP,
154 .domain = "NT AUTHORITY",
155 .name = "Digest Authentication",
156 .sid = SID_NT_DIGEST_AUTHENTICATION,
157 .rtype = SID_NAME_WKN_GRP,
160 .domain = "NT AUTHORITY",
161 .name = "Enterprise Domain Controllers",
162 .sid = SID_NT_ENTERPRISE_DCS,
163 .rtype = SID_NAME_WKN_GRP,
166 .domain = "NT AUTHORITY",
167 .name = "NTLM Authentication",
168 .sid = SID_NT_NTLM_AUTHENTICATION,
169 .rtype = SID_NAME_WKN_GRP,
172 .domain = "NT AUTHORITY",
173 .name = "Other Organization",
174 .sid = SID_NT_OTHER_ORGANISATION,
175 .rtype = SID_NAME_WKN_GRP,
178 .domain = "NT AUTHORITY",
179 .name = "SChannel Authentication",
180 .sid = SID_NT_SCHANNEL_AUTHENTICATION,
181 .rtype = SID_NAME_WKN_GRP,
184 .domain = "NT AUTHORITY",
187 .rtype = SID_NAME_WKN_GRP,
194 static NTSTATUS lookup_well_known_names(TALLOC_CTX *mem_ctx, const char *domain,
195 const char *name, const char **authority_name,
196 struct dom_sid **sid, uint32_t *rtype)
199 for (i=0; well_known[i].sid; i++) {
201 if (strcasecmp_m(domain, well_known[i].domain) == 0
202 && strcasecmp_m(name, well_known[i].name) == 0) {
203 *authority_name = well_known[i].domain;
204 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
205 *rtype = well_known[i].rtype;
209 if (strcasecmp_m(name, well_known[i].name) == 0) {
210 *authority_name = well_known[i].domain;
211 *sid = dom_sid_parse_talloc(mem_ctx, well_known[i].sid);
212 *rtype = well_known[i].rtype;
217 return NT_STATUS_NOT_FOUND;
220 static NTSTATUS lookup_well_known_sids(TALLOC_CTX *mem_ctx,
221 const char *sid_str, const char **authority_name,
222 const char **name, uint32_t *rtype)
225 for (i=0; well_known[i].sid; i++) {
226 if (strcasecmp_m(sid_str, well_known[i].sid) == 0) {
227 *authority_name = well_known[i].domain;
228 *name = well_known[i].name;
229 *rtype = well_known[i].rtype;
233 return NT_STATUS_NOT_FOUND;
237 lookup a SID for 1 name
239 static NTSTATUS dcesrv_lsa_lookup_name(struct event_context *ev_ctx,
240 struct loadparm_context *lp_ctx,
241 struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
242 const char *name, const char **authority_name,
243 struct dom_sid **sid, enum lsa_SidType *rtype)
246 struct ldb_message **res;
247 const char * const attrs[] = { "objectSid", "sAMAccountType", NULL};
250 const char *username;
251 struct ldb_dn *domain_dn;
252 struct dom_sid *domain_sid;
255 p = strchr_m(name, '\\');
257 domain = talloc_strndup(mem_ctx, name, p-name);
259 return NT_STATUS_NO_MEMORY;
262 } else if (strchr_m(name, '@')) {
263 status = crack_name_to_nt4_name(mem_ctx, ev_ctx, lp_ctx, DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL, name, &domain, &username);
264 if (!NT_STATUS_IS_OK(status)) {
265 DEBUG(3, ("Failed to crack name %s into an NT4 name: %s\n", name, nt_errstr(status)));
274 /* Look up table of well known names */
275 status = lookup_well_known_names(mem_ctx, NULL, username, authority_name, sid, rtype);
276 if (NT_STATUS_IS_OK(status)) {
280 if (strcasecmp_m(username, NAME_NT_AUTHORITY) == 0) {
281 *authority_name = NAME_NT_AUTHORITY;
282 *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
283 *rtype = SID_NAME_DOMAIN;
286 if (strcasecmp_m(username, NAME_BUILTIN) == 0) {
287 *authority_name = NAME_BUILTIN;
288 *sid = dom_sid_parse_talloc(mem_ctx, SID_BUILTIN);
289 *rtype = SID_NAME_DOMAIN;
292 if (strcasecmp_m(username, state->domain_dns) == 0) {
293 *authority_name = state->domain_name;
294 *sid = state->domain_sid;
295 *rtype = SID_NAME_DOMAIN;
298 if (strcasecmp_m(username, state->domain_name) == 0) {
299 *authority_name = state->domain_name;
300 *sid = state->domain_sid;
301 *rtype = SID_NAME_DOMAIN;
305 /* Perhaps this is a well known user? */
306 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_NT_AUTHORITY, username);
308 return NT_STATUS_NO_MEMORY;
310 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
311 if (NT_STATUS_IS_OK(status)) {
315 /* Perhaps this is a BUILTIN user? */
316 name = talloc_asprintf(mem_ctx, "%s\\%s", NAME_BUILTIN, username);
318 return NT_STATUS_NO_MEMORY;
320 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
321 if (NT_STATUS_IS_OK(status)) {
325 /* OK, I give up - perhaps we need to assume the user is in our domain? */
326 name = talloc_asprintf(mem_ctx, "%s\\%s", state->domain_name, username);
328 return NT_STATUS_NO_MEMORY;
330 status = dcesrv_lsa_lookup_name(ev_ctx, lp_ctx, state, mem_ctx, name, authority_name, sid, rtype);
331 if (NT_STATUS_IS_OK(status)) {
335 return STATUS_SOME_UNMAPPED;
336 } else if (strcasecmp_m(domain, NAME_NT_AUTHORITY) == 0) {
338 *authority_name = NAME_NT_AUTHORITY;
339 *sid = dom_sid_parse_talloc(mem_ctx, SID_NT_AUTHORITY);
340 *rtype = SID_NAME_DOMAIN;
344 /* Look up table of well known names */
345 return lookup_well_known_names(mem_ctx, domain, username, authority_name,
347 } else if (strcasecmp_m(domain, NAME_BUILTIN) == 0) {
348 *authority_name = NAME_BUILTIN;
349 domain_dn = state->builtin_dn;
350 } else if (strcasecmp_m(domain, state->domain_dns) == 0) {
351 *authority_name = state->domain_name;
352 domain_dn = state->domain_dn;
353 } else if (strcasecmp_m(domain, state->domain_name) == 0) {
354 *authority_name = state->domain_name;
355 domain_dn = state->domain_dn;
357 /* Not local, need to ask winbind in future */
358 return STATUS_SOME_UNMAPPED;
361 ret = gendb_search_dn(state->sam_ldb, mem_ctx, domain_dn, &res, attrs);
363 domain_sid = samdb_result_dom_sid(mem_ctx, res[0], "objectSid");
364 if (domain_sid == NULL) {
365 return NT_STATUS_INVALID_SID;
368 return NT_STATUS_INVALID_SID;
373 *rtype = SID_NAME_DOMAIN;
377 ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
378 "(&(sAMAccountName=%s)(objectSid=*))",
379 ldb_binary_encode_string(mem_ctx, username));
381 return NT_STATUS_INVALID_SID;
384 for (i=0; i < ret; i++) {
385 *sid = samdb_result_dom_sid(mem_ctx, res[i], "objectSid");
387 return NT_STATUS_INVALID_SID;
390 /* Check that this is in the domain */
391 if (!dom_sid_in_domain(domain_sid, *sid)) {
395 atype = samdb_result_uint(res[i], "sAMAccountType", 0);
397 *rtype = samdb_atype_map(atype);
398 if (*rtype == SID_NAME_UNKNOWN) {
399 return STATUS_SOME_UNMAPPED;
405 /* need to check for an allocated sid */
407 return NT_STATUS_INVALID_SID;
412 add to the lsa_RefDomainList for LookupSids and LookupNames
414 static NTSTATUS dcesrv_lsa_authority_list(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
415 enum lsa_SidType rtype,
416 const char *authority_name,
418 struct lsa_RefDomainList *domains,
421 struct dom_sid *authority_sid;
424 if (rtype != SID_NAME_DOMAIN) {
425 authority_sid = dom_sid_dup(mem_ctx, sid);
426 if (authority_sid == NULL) {
427 return NT_STATUS_NO_MEMORY;
429 authority_sid->num_auths--;
434 /* see if we've already done this authority name */
435 for (i=0;i<domains->count;i++) {
436 if (strcasecmp_m(authority_name, domains->domains[i].name.string) == 0) {
442 domains->domains = talloc_realloc(domains,
444 struct lsa_DomainInfo,
446 if (domains->domains == NULL) {
447 return NT_STATUS_NO_MEMORY;
449 domains->domains[i].name.string = authority_name;
450 domains->domains[i].sid = authority_sid;
452 domains->max_size = LSA_REF_DOMAIN_LIST_MULTIPLIER * domains->count;
459 lookup a name for 1 SID
461 static NTSTATUS dcesrv_lsa_lookup_sid(struct lsa_policy_state *state, TALLOC_CTX *mem_ctx,
462 struct dom_sid *sid, const char *sid_str,
463 const char **authority_name,
464 const char **name, enum lsa_SidType *rtype)
469 struct ldb_message **res;
470 struct ldb_dn *domain_dn;
471 const char * const attrs[] = { "sAMAccountName", "sAMAccountType", "cn", NULL};
473 status = lookup_well_known_sids(mem_ctx, sid_str, authority_name, name, rtype);
474 if (NT_STATUS_IS_OK(status)) {
478 if (dom_sid_in_domain(state->domain_sid, sid)) {
479 *authority_name = state->domain_name;
480 domain_dn = state->domain_dn;
481 } else if (dom_sid_in_domain(state->builtin_sid, sid)) {
482 *authority_name = NAME_BUILTIN;
483 domain_dn = state->builtin_dn;
485 /* Not well known, our domain or built in */
487 /* In future, we must look at SID histories, and at trusted domains via winbind */
489 return NT_STATUS_NOT_FOUND;
492 ret = gendb_search(state->sam_ldb, mem_ctx, domain_dn, &res, attrs,
493 "objectSid=%s", ldap_encode_ndr_dom_sid(mem_ctx, sid));
495 *name = ldb_msg_find_attr_as_string(res[0], "sAMAccountName", NULL);
497 *name = ldb_msg_find_attr_as_string(res[0], "cn", NULL);
499 *name = talloc_strdup(mem_ctx, sid_str);
500 NT_STATUS_HAVE_NO_MEMORY(*name);
504 atype = samdb_result_uint(res[0], "sAMAccountType", 0);
506 *rtype = samdb_atype_map(atype);
511 /* need to re-add a check for an allocated sid */
513 return NT_STATUS_NOT_FOUND;
520 NTSTATUS dcesrv_lsa_LookupSids2(struct dcesrv_call_state *dce_call,
522 struct lsa_LookupSids2 *r)
524 struct lsa_policy_state *state;
526 NTSTATUS status = NT_STATUS_OK;
528 r->out.domains = NULL;
530 status = dcesrv_lsa_get_policy_state(dce_call, mem_ctx, &state);
531 if (!NT_STATUS_IS_OK(status)) {
535 r->out.domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
536 if (r->out.domains == NULL) {
537 return NT_STATUS_NO_MEMORY;
540 r->out.names = talloc_zero(mem_ctx, struct lsa_TransNameArray2);
541 if (r->out.names == NULL) {
542 return NT_STATUS_NO_MEMORY;
547 r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName2,
548 r->in.sids->num_sids);
549 if (r->out.names->names == NULL) {
550 return NT_STATUS_NO_MEMORY;
553 for (i=0;i<r->in.sids->num_sids;i++) {
554 struct dom_sid *sid = r->in.sids->sids[i].sid;
555 char *sid_str = dom_sid_string(mem_ctx, sid);
556 const char *name, *authority_name;
557 enum lsa_SidType rtype;
561 r->out.names->count++;
563 r->out.names->names[i].sid_type = SID_NAME_UNKNOWN;
564 r->out.names->names[i].name.string = sid_str;
565 r->out.names->names[i].sid_index = 0xFFFFFFFF;
566 r->out.names->names[i].unknown = 0;
568 if (sid_str == NULL) {
569 r->out.names->names[i].name.string = "(SIDERROR)";
570 status = STATUS_SOME_UNMAPPED;
574 status2 = dcesrv_lsa_lookup_sid(state, mem_ctx, sid, sid_str,
575 &authority_name, &name, &rtype);
576 if (!NT_STATUS_IS_OK(status2)) {
577 status = STATUS_SOME_UNMAPPED;
581 /* set up the authority table */
582 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype,
584 r->out.domains, &sid_index);
585 if (!NT_STATUS_IS_OK(status2)) {
589 r->out.names->names[i].sid_type = rtype;
590 r->out.names->names[i].name.string = name;
591 r->out.names->names[i].sid_index = sid_index;
592 r->out.names->names[i].unknown = 0;
597 if (*r->out.count == 0) {
598 return NT_STATUS_NONE_MAPPED;
600 if (*r->out.count != r->in.sids->num_sids) {
601 return STATUS_SOME_UNMAPPED;
611 Identical to LookupSids2, but doesn't take a policy handle
614 NTSTATUS dcesrv_lsa_LookupSids3(struct dcesrv_call_state *dce_call,
616 struct lsa_LookupSids3 *r)
618 struct lsa_LookupSids2 r2;
619 struct lsa_OpenPolicy2 pol;
621 struct dcesrv_handle *h;
623 /* No policy handle on the wire, so make one up here */
624 r2.in.handle = talloc(mem_ctx, struct policy_handle);
626 return NT_STATUS_NO_MEMORY;
629 pol.out.handle = r2.in.handle;
630 pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
632 pol.in.system_name = NULL;
633 status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
634 if (!NT_STATUS_IS_OK(status)) {
638 /* ensure this handle goes away at the end of this call */
639 DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
640 talloc_steal(mem_ctx, h);
642 r2.in.sids = r->in.sids;
643 r2.in.names = r->in.names;
644 r2.in.level = r->in.level;
645 r2.in.count = r->in.count;
646 r2.in.unknown1 = r->in.unknown1;
647 r2.in.unknown2 = r->in.unknown2;
648 r2.out.count = r->out.count;
649 r2.out.names = r->out.names;
651 status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
652 if (dce_call->fault_code != 0) {
656 r->out.domains = r2.out.domains;
657 r->out.names = r2.out.names;
658 r->out.count = r2.out.count;
667 NTSTATUS dcesrv_lsa_LookupSids(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
668 struct lsa_LookupSids *r)
670 struct lsa_LookupSids2 r2;
674 r2.in.handle = r->in.handle;
675 r2.in.sids = r->in.sids;
677 r2.in.level = r->in.level;
678 r2.in.count = r->in.count;
681 r2.out.count = r->out.count;
684 status = dcesrv_lsa_LookupSids2(dce_call, mem_ctx, &r2);
685 if (dce_call->fault_code != 0) {
689 r->out.domains = r2.out.domains;
695 r->out.names = talloc(mem_ctx, struct lsa_TransNameArray);
696 if (r->out.names == NULL) {
697 return NT_STATUS_NO_MEMORY;
699 r->out.names->count = r2.out.names->count;
700 r->out.names->names = talloc_array(r->out.names, struct lsa_TranslatedName,
701 r->out.names->count);
702 if (r->out.names->names == NULL) {
703 return NT_STATUS_NO_MEMORY;
705 for (i=0;i<r->out.names->count;i++) {
706 r->out.names->names[i].sid_type = r2.out.names->names[i].sid_type;
707 r->out.names->names[i].name.string = r2.out.names->names[i].name.string;
708 r->out.names->names[i].sid_index = r2.out.names->names[i].sid_index;
718 NTSTATUS dcesrv_lsa_LookupNames3(struct dcesrv_call_state *dce_call,
720 struct lsa_LookupNames3 *r)
722 struct lsa_policy_state *policy_state;
723 struct dcesrv_handle *policy_handle;
725 struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
727 DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
729 policy_state = policy_handle->data;
731 r->out.domains = NULL;
733 r->out.domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
734 if (r->out.domains == NULL) {
735 return NT_STATUS_NO_MEMORY;
738 r->out.sids = talloc_zero(mem_ctx, struct lsa_TransSidArray3);
739 if (r->out.sids == NULL) {
740 return NT_STATUS_NO_MEMORY;
745 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid3,
747 if (r->out.sids->sids == NULL) {
748 return NT_STATUS_NO_MEMORY;
751 for (i=0;i<r->in.num_names;i++) {
752 const char *name = r->in.names[i].string;
753 const char *authority_name;
756 enum lsa_SidType rtype;
759 r->out.sids->count++;
761 r->out.sids->sids[i].sid_type = SID_NAME_UNKNOWN;
762 r->out.sids->sids[i].sid = NULL;
763 r->out.sids->sids[i].sid_index = 0xFFFFFFFF;
764 r->out.sids->sids[i].unknown = 0;
766 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, policy_state, mem_ctx, name, &authority_name, &sid, &rtype);
767 if (!NT_STATUS_IS_OK(status2) || sid->num_auths == 0) {
771 status2 = dcesrv_lsa_authority_list(policy_state, mem_ctx, rtype, authority_name,
772 sid, r->out.domains, &sid_index);
773 if (!NT_STATUS_IS_OK(status2)) {
777 r->out.sids->sids[i].sid_type = rtype;
778 r->out.sids->sids[i].sid = sid;
779 r->out.sids->sids[i].sid_index = sid_index;
780 r->out.sids->sids[i].unknown = 0;
785 if (*r->out.count == 0) {
786 return NT_STATUS_NONE_MAPPED;
788 if (*r->out.count != r->in.num_names) {
789 return STATUS_SOME_UNMAPPED;
798 Identical to LookupNames3, but doesn't take a policy handle
801 NTSTATUS dcesrv_lsa_LookupNames4(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
802 struct lsa_LookupNames4 *r)
804 struct lsa_LookupNames3 r2;
805 struct lsa_OpenPolicy2 pol;
807 struct dcesrv_handle *h;
809 /* No policy handle on the wire, so make one up here */
810 r2.in.handle = talloc(mem_ctx, struct policy_handle);
812 return NT_STATUS_NO_MEMORY;
815 pol.out.handle = r2.in.handle;
816 pol.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
818 pol.in.system_name = NULL;
819 status = dcesrv_lsa_OpenPolicy2(dce_call, mem_ctx, &pol);
820 if (!NT_STATUS_IS_OK(status)) {
824 /* ensure this handle goes away at the end of this call */
825 DCESRV_PULL_HANDLE(h, r2.in.handle, LSA_HANDLE_POLICY);
826 talloc_steal(mem_ctx, h);
828 r2.in.num_names = r->in.num_names;
829 r2.in.names = r->in.names;
830 r2.in.sids = r->in.sids;
831 r2.in.count = r->in.count;
832 r2.in.unknown1 = r->in.unknown1;
833 r2.in.unknown2 = r->in.unknown2;
834 r2.out.domains = r->out.domains;
835 r2.out.sids = r->out.sids;
836 r2.out.count = r->out.count;
838 status = dcesrv_lsa_LookupNames3(dce_call, mem_ctx, &r2);
839 if (dce_call->fault_code != 0) {
843 r->out.domains = r2.out.domains;
844 r->out.sids = r2.out.sids;
845 r->out.count = r2.out.count;
852 NTSTATUS dcesrv_lsa_LookupNames2(struct dcesrv_call_state *dce_call,
854 struct lsa_LookupNames2 *r)
856 struct lsa_policy_state *state;
857 struct dcesrv_handle *h;
859 struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
861 r->out.domains = NULL;
863 DCESRV_PULL_HANDLE(h, r->in.handle, LSA_HANDLE_POLICY);
867 r->out.domains = talloc_zero(mem_ctx, struct lsa_RefDomainList);
868 if (r->out.domains == NULL) {
869 return NT_STATUS_NO_MEMORY;
872 r->out.sids = talloc_zero(mem_ctx, struct lsa_TransSidArray2);
873 if (r->out.sids == NULL) {
874 return NT_STATUS_NO_MEMORY;
879 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid2,
881 if (r->out.sids->sids == NULL) {
882 return NT_STATUS_NO_MEMORY;
885 for (i=0;i<r->in.num_names;i++) {
886 const char *name = r->in.names[i].string;
887 const char *authority_name;
889 uint32_t rtype, sid_index;
892 r->out.sids->count++;
894 r->out.sids->sids[i].sid_type = SID_NAME_UNKNOWN;
895 /* MS-LSAT 3.1.4.7 - rid zero is considered equivalent
896 to sid NULL - so we should return 0 rid for
898 r->out.sids->sids[i].rid = 0;
899 r->out.sids->sids[i].sid_index = 0xFFFFFFFF;
900 r->out.sids->sids[i].unknown = 0;
902 status2 = dcesrv_lsa_lookup_name(dce_call->event_ctx, lp_ctx, state, mem_ctx, name,
903 &authority_name, &sid, &rtype);
904 if (!NT_STATUS_IS_OK(status2)) {
908 status2 = dcesrv_lsa_authority_list(state, mem_ctx, rtype, authority_name,
909 sid, r->out.domains, &sid_index);
910 if (!NT_STATUS_IS_OK(status2)) {
914 r->out.sids->sids[i].sid_type = rtype;
915 r->out.sids->sids[i].rid = sid->sub_auths[sid->num_auths-1];
916 r->out.sids->sids[i].sid_index = sid_index;
917 r->out.sids->sids[i].unknown = 0;
922 if (*r->out.count == 0) {
923 return NT_STATUS_NONE_MAPPED;
925 if (*r->out.count != r->in.num_names) {
926 return STATUS_SOME_UNMAPPED;
935 NTSTATUS dcesrv_lsa_LookupNames(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
936 struct lsa_LookupNames *r)
938 struct lsa_LookupNames2 r2;
942 r2.in.handle = r->in.handle;
943 r2.in.num_names = r->in.num_names;
944 r2.in.names = r->in.names;
946 r2.in.level = r->in.level;
947 r2.in.count = r->in.count;
950 r2.out.count = r->out.count;
952 status = dcesrv_lsa_LookupNames2(dce_call, mem_ctx, &r2);
953 if (dce_call->fault_code != 0) {
957 r->out.domains = r2.out.domains;
958 r->out.sids = talloc(mem_ctx, struct lsa_TransSidArray);
959 if (r->out.sids == NULL) {
960 return NT_STATUS_NO_MEMORY;
962 r->out.sids->count = r2.out.sids->count;
963 r->out.sids->sids = talloc_array(r->out.sids, struct lsa_TranslatedSid,
965 if (r->out.sids->sids == NULL) {
966 return NT_STATUS_NO_MEMORY;
968 for (i=0;i<r->out.sids->count;i++) {
969 r->out.sids->sids[i].sid_type = r2.out.sids->sids[i].sid_type;
970 r->out.sids->sids[i].rid = r2.out.sids->sids[i].rid;
971 r->out.sids->sids[i].sid_index = r2.out.sids->sids[i].sid_index;