2 * Unix SMB/CIFS implementation.
4 * Copyright (C) Gerald (Jerry) Carter 2006
5 * Copyright (C) Guenther Deschner 2007-2008
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
23 #include "librpc/gen_ndr/ndr_libnet_join.h"
24 #include "libnet/libnet_join.h"
25 #include "libcli/auth/libcli_auth.h"
26 #include "../librpc/gen_ndr/cli_samr.h"
27 #include "rpc_client/init_samr.h"
28 #include "../librpc/gen_ndr/cli_lsa.h"
29 #include "rpc_client/cli_lsarpc.h"
30 #include "../librpc/gen_ndr/cli_netlogon.h"
31 #include "rpc_client/cli_netlogon.h"
32 #include "lib/smbconf/smbconf.h"
33 #include "lib/smbconf/smbconf_reg.h"
34 #include "../libds/common/flags.h"
37 /****************************************************************
38 ****************************************************************/
40 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
43 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
44 DEBUG(1,("libnet_Join:\n%s", str)); \
48 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
49 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
50 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
51 LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
53 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
56 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
57 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
61 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
62 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
63 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
64 LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
66 /****************************************************************
67 ****************************************************************/
69 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
70 struct libnet_JoinCtx *r,
71 const char *format, ...)
75 if (r->out.error_string) {
79 va_start(args, format);
80 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
84 /****************************************************************
85 ****************************************************************/
87 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
88 struct libnet_UnjoinCtx *r,
89 const char *format, ...)
93 if (r->out.error_string) {
97 va_start(args, format);
98 r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
104 /****************************************************************
105 ****************************************************************/
107 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
108 const char *netbios_domain_name,
110 const char *user_name,
111 const char *password,
115 ADS_STRUCT *my_ads = NULL;
118 my_ads = ads_init(dns_domain_name,
122 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
126 SAFE_FREE(my_ads->auth.user_name);
127 my_ads->auth.user_name = SMB_STRDUP(user_name);
128 if ((cp = strchr_m(my_ads->auth.user_name, '@'))!=0) {
130 SAFE_FREE(my_ads->auth.realm);
131 my_ads->auth.realm = smb_xstrdup(cp);
132 strupper_m(my_ads->auth.realm);
137 SAFE_FREE(my_ads->auth.password);
138 my_ads->auth.password = SMB_STRDUP(password);
141 status = ads_connect_user_creds(my_ads);
142 if (!ADS_ERR_OK(status)) {
143 ads_destroy(&my_ads);
151 /****************************************************************
152 ****************************************************************/
154 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
155 struct libnet_JoinCtx *r)
159 status = libnet_connect_ads(r->out.dns_domain_name,
160 r->out.netbios_domain_name,
163 r->in.admin_password,
165 if (!ADS_ERR_OK(status)) {
166 libnet_join_set_error_string(mem_ctx, r,
167 "failed to connect to AD: %s",
172 if (!r->out.netbios_domain_name) {
173 r->out.netbios_domain_name = talloc_strdup(mem_ctx,
174 r->in.ads->server.workgroup);
175 ADS_ERROR_HAVE_NO_MEMORY(r->out.netbios_domain_name);
178 if (!r->out.dns_domain_name) {
179 r->out.dns_domain_name = talloc_strdup(mem_ctx,
180 r->in.ads->config.realm);
181 ADS_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
184 r->out.domain_is_ad = true;
189 /****************************************************************
190 ****************************************************************/
192 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
193 struct libnet_UnjoinCtx *r)
197 status = libnet_connect_ads(r->in.domain_name,
201 r->in.admin_password,
203 if (!ADS_ERR_OK(status)) {
204 libnet_unjoin_set_error_string(mem_ctx, r,
205 "failed to connect to AD: %s",
212 /****************************************************************
213 join a domain using ADS (LDAP mods)
214 ****************************************************************/
216 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
217 struct libnet_JoinCtx *r)
220 LDAPMessage *res = NULL;
221 const char *attrs[] = { "dn", NULL };
224 status = ads_check_ou_dn(mem_ctx, r->in.ads, &r->in.account_ou);
225 if (!ADS_ERR_OK(status)) {
229 status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
230 if (!ADS_ERR_OK(status)) {
234 if (ads_count_replies(r->in.ads, res) != 1) {
235 ads_msgfree(r->in.ads, res);
236 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
239 ads_msgfree(r->in.ads, res);
241 /* Attempt to create the machine account and bail if this fails.
242 Assume that the admin wants exactly what they requested */
244 status = ads_create_machine_acct(r->in.ads,
248 if (ADS_ERR_OK(status)) {
249 DEBUG(1,("machine account creation created\n"));
251 } else if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
252 (status.err.rc == LDAP_ALREADY_EXISTS)) {
253 status = ADS_SUCCESS;
256 if (!ADS_ERR_OK(status)) {
257 DEBUG(1,("machine account creation failed\n"));
261 status = ads_move_machine_acct(r->in.ads,
265 if (!ADS_ERR_OK(status)) {
266 DEBUG(1,("failure to locate/move pre-existing "
267 "machine account\n"));
271 DEBUG(1,("The machine account %s the specified OU.\n",
272 moved ? "was moved into" : "already exists in"));
277 /****************************************************************
278 ****************************************************************/
280 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
281 struct libnet_UnjoinCtx *r)
286 status = libnet_unjoin_connect_ads(mem_ctx, r);
287 if (!ADS_ERR_OK(status)) {
288 libnet_unjoin_set_error_string(mem_ctx, r,
289 "failed to connect to AD: %s",
295 status = ads_leave_realm(r->in.ads, r->in.machine_name);
296 if (!ADS_ERR_OK(status)) {
297 libnet_unjoin_set_error_string(mem_ctx, r,
298 "failed to leave realm: %s",
306 /****************************************************************
307 ****************************************************************/
309 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
310 struct libnet_JoinCtx *r)
313 LDAPMessage *res = NULL;
316 if (!r->in.machine_name) {
317 return ADS_ERROR(LDAP_NO_MEMORY);
320 status = ads_find_machine_acct(r->in.ads,
323 if (!ADS_ERR_OK(status)) {
327 if (ads_count_replies(r->in.ads, res) != 1) {
328 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
332 dn = ads_get_dn(r->in.ads, mem_ctx, res);
334 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
338 r->out.dn = talloc_strdup(mem_ctx, dn);
340 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
345 ads_msgfree(r->in.ads, res);
351 /****************************************************************
352 Set a machines dNSHostName and servicePrincipalName attributes
353 ****************************************************************/
355 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
356 struct libnet_JoinCtx *r)
361 const char *spn_array[3] = {NULL, NULL, NULL};
366 status = libnet_join_find_machine_acct(mem_ctx, r);
367 if (!ADS_ERR_OK(status)) {
371 /* Windows only creates HOST/shortname & HOST/fqdn. */
373 spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
375 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
380 if (!name_to_fqdn(my_fqdn, r->in.machine_name)
381 || (strchr(my_fqdn, '.') == NULL)) {
382 fstr_sprintf(my_fqdn, "%s.%s", r->in.machine_name,
383 r->out.dns_domain_name);
388 if (!strequal(my_fqdn, r->in.machine_name)) {
389 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
391 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
396 mods = ads_init_mods(mem_ctx);
398 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
401 /* fields of primary importance */
403 status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
404 if (!ADS_ERR_OK(status)) {
405 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
408 status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
410 if (!ADS_ERR_OK(status)) {
411 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
414 return ads_gen_mod(r->in.ads, r->out.dn, mods);
417 /****************************************************************
418 ****************************************************************/
420 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
421 struct libnet_JoinCtx *r)
426 if (!r->in.create_upn) {
432 status = libnet_join_find_machine_acct(mem_ctx, r);
433 if (!ADS_ERR_OK(status)) {
438 r->in.upn = talloc_asprintf(mem_ctx,
441 r->out.dns_domain_name);
443 return ADS_ERROR(LDAP_NO_MEMORY);
447 /* now do the mods */
449 mods = ads_init_mods(mem_ctx);
451 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
454 /* fields of primary importance */
456 status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
457 if (!ADS_ERR_OK(status)) {
458 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
461 return ads_gen_mod(r->in.ads, r->out.dn, mods);
465 /****************************************************************
466 ****************************************************************/
468 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
469 struct libnet_JoinCtx *r)
475 if (!r->in.os_name || !r->in.os_version ) {
481 status = libnet_join_find_machine_acct(mem_ctx, r);
482 if (!ADS_ERR_OK(status)) {
486 /* now do the mods */
488 mods = ads_init_mods(mem_ctx);
490 return ADS_ERROR(LDAP_NO_MEMORY);
493 os_sp = talloc_asprintf(mem_ctx, "Samba %s", samba_version_string());
495 return ADS_ERROR(LDAP_NO_MEMORY);
498 /* fields of primary importance */
500 status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
502 if (!ADS_ERR_OK(status)) {
506 status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
508 if (!ADS_ERR_OK(status)) {
512 status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
514 if (!ADS_ERR_OK(status)) {
518 return ads_gen_mod(r->in.ads, r->out.dn, mods);
521 /****************************************************************
522 ****************************************************************/
524 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
525 struct libnet_JoinCtx *r)
527 if (!USE_SYSTEM_KEYTAB) {
531 if (ads_keytab_create_default(r->in.ads) != 0) {
538 /****************************************************************
539 ****************************************************************/
541 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
542 struct libnet_JoinCtx *r)
544 uint32_t domain_func;
546 const char *salt = NULL;
547 char *std_salt = NULL;
549 status = ads_domain_func_level(r->in.ads, &domain_func);
550 if (!ADS_ERR_OK(status)) {
551 libnet_join_set_error_string(mem_ctx, r,
552 "failed to determine domain functional level: %s",
557 /* go ahead and setup the default salt */
559 std_salt = kerberos_standard_des_salt();
561 libnet_join_set_error_string(mem_ctx, r,
562 "failed to obtain standard DES salt");
566 salt = talloc_strdup(mem_ctx, std_salt);
573 /* if it's a Windows functional domain, we have to look for the UPN */
575 if (domain_func == DS_DOMAIN_FUNCTION_2000) {
578 upn = ads_get_upn(r->in.ads, mem_ctx,
581 salt = talloc_strdup(mem_ctx, upn);
588 return kerberos_secrets_store_des_salt(salt);
591 /****************************************************************
592 ****************************************************************/
594 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
595 struct libnet_JoinCtx *r)
600 status = libnet_join_connect_ads(mem_ctx, r);
601 if (!ADS_ERR_OK(status)) {
606 status = libnet_join_set_machine_spn(mem_ctx, r);
607 if (!ADS_ERR_OK(status)) {
608 libnet_join_set_error_string(mem_ctx, r,
609 "failed to set machine spn: %s",
614 status = libnet_join_set_os_attributes(mem_ctx, r);
615 if (!ADS_ERR_OK(status)) {
616 libnet_join_set_error_string(mem_ctx, r,
617 "failed to set machine os attributes: %s",
622 status = libnet_join_set_machine_upn(mem_ctx, r);
623 if (!ADS_ERR_OK(status)) {
624 libnet_join_set_error_string(mem_ctx, r,
625 "failed to set machine upn: %s",
630 if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
631 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
634 if (!libnet_join_create_keytab(mem_ctx, r)) {
635 libnet_join_set_error_string(mem_ctx, r,
636 "failed to create kerberos keytab");
637 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
642 #endif /* WITH_ADS */
644 /****************************************************************
645 Store the machine password and domain SID
646 ****************************************************************/
648 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
649 struct libnet_JoinCtx *r)
651 if (!secrets_store_domain_sid(r->out.netbios_domain_name,
654 DEBUG(1,("Failed to save domain sid\n"));
658 if (!secrets_store_machine_password(r->in.machine_password,
659 r->out.netbios_domain_name,
660 r->in.secure_channel_type))
662 DEBUG(1,("Failed to save machine password\n"));
669 /****************************************************************
670 Connect dc's IPC$ share
671 ****************************************************************/
673 static NTSTATUS libnet_join_connect_dc_ipc(const char *dc,
677 struct cli_state **cli)
682 flags |= CLI_FULL_CONNECTION_USE_KERBEROS;
685 if (use_kerberos && pass) {
686 flags |= CLI_FULL_CONNECTION_FALLBACK_AFTER_KERBEROS;
689 return cli_full_connection(cli, NULL,
700 /****************************************************************
701 Lookup domain dc's info
702 ****************************************************************/
704 static NTSTATUS libnet_join_lookup_dc_rpc(TALLOC_CTX *mem_ctx,
705 struct libnet_JoinCtx *r,
706 struct cli_state **cli)
708 struct rpc_pipe_client *pipe_hnd = NULL;
709 struct policy_handle lsa_pol;
710 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
711 union lsa_PolicyInformation *info = NULL;
713 status = libnet_join_connect_dc_ipc(r->in.dc_name,
715 r->in.admin_password,
718 if (!NT_STATUS_IS_OK(status)) {
722 status = cli_rpc_pipe_open_noauth(*cli, &ndr_table_lsarpc.syntax_id,
724 if (!NT_STATUS_IS_OK(status)) {
725 DEBUG(0,("Error connecting to LSA pipe. Error was %s\n",
730 status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, true,
731 SEC_FLAG_MAXIMUM_ALLOWED, &lsa_pol);
732 if (!NT_STATUS_IS_OK(status)) {
736 status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
740 if (NT_STATUS_IS_OK(status)) {
741 r->out.domain_is_ad = true;
742 r->out.netbios_domain_name = info->dns.name.string;
743 r->out.dns_domain_name = info->dns.dns_domain.string;
744 r->out.forest_name = info->dns.dns_forest.string;
745 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->dns.sid);
746 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
749 if (!NT_STATUS_IS_OK(status)) {
750 status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
752 LSA_POLICY_INFO_ACCOUNT_DOMAIN,
754 if (!NT_STATUS_IS_OK(status)) {
758 r->out.netbios_domain_name = info->account_domain.name.string;
759 r->out.domain_sid = sid_dup_talloc(mem_ctx, info->account_domain.sid);
760 NT_STATUS_HAVE_NO_MEMORY(r->out.domain_sid);
763 rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
764 TALLOC_FREE(pipe_hnd);
770 /****************************************************************
771 Do the domain join unsecure
772 ****************************************************************/
774 static NTSTATUS libnet_join_joindomain_rpc_unsecure(TALLOC_CTX *mem_ctx,
775 struct libnet_JoinCtx *r,
776 struct cli_state *cli)
778 struct rpc_pipe_client *pipe_hnd = NULL;
779 unsigned char orig_trust_passwd_hash[16];
780 unsigned char new_trust_passwd_hash[16];
781 fstring trust_passwd;
784 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
786 if (!NT_STATUS_IS_OK(status)) {
790 if (!r->in.machine_password) {
791 r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
792 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
795 E_md4hash(r->in.machine_password, new_trust_passwd_hash);
797 /* according to WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED */
798 fstrcpy(trust_passwd, r->in.admin_password);
799 strlower_m(trust_passwd);
802 * Machine names can be 15 characters, but the max length on
803 * a password is 14. --jerry
806 trust_passwd[14] = '\0';
808 E_md4hash(trust_passwd, orig_trust_passwd_hash);
810 status = rpccli_netlogon_set_trust_password(pipe_hnd, mem_ctx,
812 orig_trust_passwd_hash,
813 r->in.machine_password,
814 new_trust_passwd_hash,
815 r->in.secure_channel_type);
820 /****************************************************************
822 ****************************************************************/
824 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
825 struct libnet_JoinCtx *r,
826 struct cli_state *cli)
828 struct rpc_pipe_client *pipe_hnd = NULL;
829 struct policy_handle sam_pol, domain_pol, user_pol;
830 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
832 struct lsa_String lsa_acct_name;
834 uint32_t acct_flags = ACB_WSTRUST;
835 struct samr_Ids user_rids;
836 struct samr_Ids name_types;
837 union samr_UserInfo user_info;
839 struct samr_CryptPassword crypt_pwd;
840 struct samr_CryptPasswordEx crypt_pwd_ex;
842 ZERO_STRUCT(sam_pol);
843 ZERO_STRUCT(domain_pol);
844 ZERO_STRUCT(user_pol);
846 switch (r->in.secure_channel_type) {
848 acct_flags = ACB_WSTRUST;
851 acct_flags = ACB_SVRTRUST;
854 return NT_STATUS_INVALID_PARAMETER;
857 if (!r->in.machine_password) {
858 r->in.machine_password = generate_random_str(mem_ctx, DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH);
859 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
862 /* Open the domain */
864 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
866 if (!NT_STATUS_IS_OK(status)) {
867 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
872 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
874 SAMR_ACCESS_ENUM_DOMAINS
875 | SAMR_ACCESS_LOOKUP_DOMAIN,
877 if (!NT_STATUS_IS_OK(status)) {
881 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
883 SAMR_DOMAIN_ACCESS_LOOKUP_INFO_1
884 | SAMR_DOMAIN_ACCESS_CREATE_USER
885 | SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
888 if (!NT_STATUS_IS_OK(status)) {
892 /* Create domain user */
894 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
895 strlower_m(acct_name);
897 init_lsa_String(&lsa_acct_name, acct_name);
899 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
900 uint32_t access_desired =
901 SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
902 SEC_STD_WRITE_DAC | SEC_STD_DELETE |
903 SAMR_USER_ACCESS_SET_PASSWORD |
904 SAMR_USER_ACCESS_GET_ATTRIBUTES |
905 SAMR_USER_ACCESS_SET_ATTRIBUTES;
906 uint32_t access_granted = 0;
908 DEBUG(10,("Creating account with desired access mask: %d\n",
911 status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
919 if (!NT_STATUS_IS_OK(status) &&
920 !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
922 DEBUG(10,("Creation of workstation account failed: %s\n",
925 /* If NT_STATUS_ACCESS_DENIED then we have a valid
926 username/password combo but the user does not have
927 administrator access. */
929 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
930 libnet_join_set_error_string(mem_ctx, r,
931 "User specified does not have "
932 "administrator privileges");
938 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
939 if (!(r->in.join_flags &
940 WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
945 /* We *must* do this.... don't ask... */
947 if (NT_STATUS_IS_OK(status)) {
948 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
952 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
958 if (!NT_STATUS_IS_OK(status)) {
962 if (name_types.ids[0] != SID_NAME_USER) {
963 DEBUG(0,("%s is not a user account (type=%d)\n",
964 acct_name, name_types.ids[0]));
965 status = NT_STATUS_INVALID_WORKSTATION;
969 user_rid = user_rids.ids[0];
971 /* Open handle on user */
973 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
975 SEC_FLAG_MAXIMUM_ALLOWED,
978 if (!NT_STATUS_IS_OK(status)) {
982 /* Fill in the additional account flags now */
984 acct_flags |= ACB_PWNOEXP;
985 if (r->out.domain_is_ad) {
986 #if !defined(ENCTYPE_ARCFOUR_HMAC)
987 acct_flags |= ACB_USE_DES_KEY_ONLY;
992 /* Set account flags on machine account */
993 ZERO_STRUCT(user_info.info16);
994 user_info.info16.acct_flags = acct_flags;
996 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1001 if (!NT_STATUS_IS_OK(status)) {
1003 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
1006 libnet_join_set_error_string(mem_ctx, r,
1007 "Failed to set account flags for machine account (%s)\n",
1012 /* Set password on machine account - first try level 26 */
1014 init_samr_CryptPasswordEx(r->in.machine_password,
1015 &cli->user_session_key,
1018 user_info.info26.password = crypt_pwd_ex;
1019 user_info.info26.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1021 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
1026 if (NT_STATUS_EQUAL(status, NT_STATUS(DCERPC_FAULT_INVALID_TAG))) {
1028 /* retry with level 24 */
1030 init_samr_CryptPassword(r->in.machine_password,
1031 &cli->user_session_key,
1034 user_info.info24.password = crypt_pwd;
1035 user_info.info24.password_expired = PASS_DONT_CHANGE_AT_NEXT_LOGON;
1037 status = rpccli_samr_SetUserInfo2(pipe_hnd, mem_ctx,
1043 if (!NT_STATUS_IS_OK(status)) {
1045 rpccli_samr_DeleteUser(pipe_hnd, mem_ctx,
1048 libnet_join_set_error_string(mem_ctx, r,
1049 "Failed to set password for machine account (%s)\n",
1054 status = NT_STATUS_OK;
1061 if (is_valid_policy_hnd(&sam_pol)) {
1062 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1064 if (is_valid_policy_hnd(&domain_pol)) {
1065 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1067 if (is_valid_policy_hnd(&user_pol)) {
1068 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1070 TALLOC_FREE(pipe_hnd);
1075 /****************************************************************
1076 ****************************************************************/
1078 NTSTATUS libnet_join_ok(const char *netbios_domain_name,
1079 const char *machine_name,
1080 const char *dc_name)
1082 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
1083 struct cli_state *cli = NULL;
1084 struct rpc_pipe_client *pipe_hnd = NULL;
1085 struct rpc_pipe_client *netlogon_pipe = NULL;
1087 char *machine_password = NULL;
1088 char *machine_account = NULL;
1091 return NT_STATUS_INVALID_PARAMETER;
1094 if (!secrets_init()) {
1095 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
1098 machine_password = secrets_fetch_machine_password(netbios_domain_name,
1100 if (!machine_password) {
1101 return NT_STATUS_NO_TRUST_LSA_SECRET;
1104 if (asprintf(&machine_account, "%s$", machine_name) == -1) {
1105 SAFE_FREE(machine_password);
1106 return NT_STATUS_NO_MEMORY;
1109 status = cli_full_connection(&cli, NULL,
1118 free(machine_account);
1119 free(machine_password);
1121 if (!NT_STATUS_IS_OK(status)) {
1122 status = cli_full_connection(&cli, NULL,
1133 if (!NT_STATUS_IS_OK(status)) {
1137 status = get_schannel_session_key(cli, netbios_domain_name,
1138 &neg_flags, &netlogon_pipe);
1139 if (!NT_STATUS_IS_OK(status)) {
1140 if (NT_STATUS_EQUAL(status, NT_STATUS_INVALID_NETWORK_RESPONSE)) {
1142 return NT_STATUS_OK;
1145 DEBUG(0,("libnet_join_ok: failed to get schannel session "
1146 "key from server %s for domain %s. Error was %s\n",
1147 cli->desthost, netbios_domain_name, nt_errstr(status)));
1152 if (!lp_client_schannel()) {
1154 return NT_STATUS_OK;
1157 status = cli_rpc_pipe_open_schannel_with_key(
1158 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
1159 DCERPC_AUTH_LEVEL_PRIVACY,
1160 netbios_domain_name, &netlogon_pipe->dc, &pipe_hnd);
1164 if (!NT_STATUS_IS_OK(status)) {
1165 DEBUG(0,("libnet_join_ok: failed to open schannel session "
1166 "on netlogon pipe to server %s for domain %s. "
1168 cli->desthost, netbios_domain_name, nt_errstr(status)));
1172 return NT_STATUS_OK;
1175 /****************************************************************
1176 ****************************************************************/
1178 static WERROR libnet_join_post_verify(TALLOC_CTX *mem_ctx,
1179 struct libnet_JoinCtx *r)
1183 status = libnet_join_ok(r->out.netbios_domain_name,
1186 if (!NT_STATUS_IS_OK(status)) {
1187 libnet_join_set_error_string(mem_ctx, r,
1188 "failed to verify domain membership after joining: %s",
1189 get_friendly_nt_error_msg(status));
1190 return WERR_SETUP_NOT_JOINED;
1196 /****************************************************************
1197 ****************************************************************/
1199 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
1200 struct libnet_UnjoinCtx *r)
1202 if (!secrets_delete_machine_password_ex(lp_workgroup())) {
1206 if (!secrets_delete_domain_sid(lp_workgroup())) {
1213 /****************************************************************
1214 ****************************************************************/
1216 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
1217 struct libnet_UnjoinCtx *r)
1219 struct cli_state *cli = NULL;
1220 struct rpc_pipe_client *pipe_hnd = NULL;
1221 struct policy_handle sam_pol, domain_pol, user_pol;
1222 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1225 struct lsa_String lsa_acct_name;
1226 struct samr_Ids user_rids;
1227 struct samr_Ids name_types;
1228 union samr_UserInfo *info = NULL;
1230 ZERO_STRUCT(sam_pol);
1231 ZERO_STRUCT(domain_pol);
1232 ZERO_STRUCT(user_pol);
1234 status = libnet_join_connect_dc_ipc(r->in.dc_name,
1235 r->in.admin_account,
1236 r->in.admin_password,
1239 if (!NT_STATUS_IS_OK(status)) {
1243 /* Open the domain */
1245 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_samr.syntax_id,
1247 if (!NT_STATUS_IS_OK(status)) {
1248 DEBUG(0,("Error connecting to SAM pipe. Error was %s\n",
1249 nt_errstr(status)));
1253 status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
1255 SEC_FLAG_MAXIMUM_ALLOWED,
1257 if (!NT_STATUS_IS_OK(status)) {
1261 status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
1263 SEC_FLAG_MAXIMUM_ALLOWED,
1266 if (!NT_STATUS_IS_OK(status)) {
1270 /* Create domain user */
1272 acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
1273 strlower_m(acct_name);
1275 init_lsa_String(&lsa_acct_name, acct_name);
1277 status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
1284 if (!NT_STATUS_IS_OK(status)) {
1288 if (name_types.ids[0] != SID_NAME_USER) {
1289 DEBUG(0, ("%s is not a user account (type=%d)\n", acct_name,
1290 name_types.ids[0]));
1291 status = NT_STATUS_INVALID_WORKSTATION;
1295 user_rid = user_rids.ids[0];
1297 /* Open handle on user */
1299 status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
1301 SEC_FLAG_MAXIMUM_ALLOWED,
1304 if (!NT_STATUS_IS_OK(status)) {
1310 status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
1314 if (!NT_STATUS_IS_OK(status)) {
1315 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1319 /* now disable and setuser info */
1321 info->info16.acct_flags |= ACB_DISABLED;
1323 status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
1328 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
1332 if (is_valid_policy_hnd(&domain_pol)) {
1333 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
1335 if (is_valid_policy_hnd(&sam_pol)) {
1336 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
1338 TALLOC_FREE(pipe_hnd);
1348 /****************************************************************
1349 ****************************************************************/
1351 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
1354 struct smbconf_ctx *ctx;
1356 werr = smbconf_init_reg(r, &ctx, NULL);
1357 if (!W_ERROR_IS_OK(werr)) {
1361 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1363 werr = smbconf_set_global_parameter(ctx, "security", "user");
1364 W_ERROR_NOT_OK_GOTO_DONE(werr);
1366 werr = smbconf_set_global_parameter(ctx, "workgroup",
1369 smbconf_delete_global_parameter(ctx, "realm");
1373 werr = smbconf_set_global_parameter(ctx, "security", "domain");
1374 W_ERROR_NOT_OK_GOTO_DONE(werr);
1376 werr = smbconf_set_global_parameter(ctx, "workgroup",
1377 r->out.netbios_domain_name);
1378 W_ERROR_NOT_OK_GOTO_DONE(werr);
1380 if (r->out.domain_is_ad) {
1381 werr = smbconf_set_global_parameter(ctx, "security", "ads");
1382 W_ERROR_NOT_OK_GOTO_DONE(werr);
1384 werr = smbconf_set_global_parameter(ctx, "realm",
1385 r->out.dns_domain_name);
1386 W_ERROR_NOT_OK_GOTO_DONE(werr);
1390 smbconf_shutdown(ctx);
1394 /****************************************************************
1395 ****************************************************************/
1397 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
1399 WERROR werr = WERR_OK;
1400 struct smbconf_ctx *ctx;
1402 werr = smbconf_init_reg(r, &ctx, NULL);
1403 if (!W_ERROR_IS_OK(werr)) {
1407 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1409 werr = smbconf_set_global_parameter(ctx, "security", "user");
1410 W_ERROR_NOT_OK_GOTO_DONE(werr);
1412 werr = smbconf_delete_global_parameter(ctx, "workgroup");
1413 W_ERROR_NOT_OK_GOTO_DONE(werr);
1415 smbconf_delete_global_parameter(ctx, "realm");
1419 smbconf_shutdown(ctx);
1423 /****************************************************************
1424 ****************************************************************/
1426 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1430 if (!W_ERROR_IS_OK(r->out.result)) {
1431 return r->out.result;
1434 if (!r->in.modify_config) {
1438 werr = do_join_modify_vals_config(r);
1439 if (!W_ERROR_IS_OK(werr)) {
1443 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1445 r->out.modified_config = true;
1446 r->out.result = werr;
1451 /****************************************************************
1452 ****************************************************************/
1454 static WERROR libnet_unjoin_config(struct libnet_UnjoinCtx *r)
1458 if (!W_ERROR_IS_OK(r->out.result)) {
1459 return r->out.result;
1462 if (!r->in.modify_config) {
1466 werr = do_unjoin_modify_vals_config(r);
1467 if (!W_ERROR_IS_OK(werr)) {
1471 lp_load(get_dyn_CONFIGFILE(),true,false,false,true);
1473 r->out.modified_config = true;
1474 r->out.result = werr;
1479 /****************************************************************
1480 ****************************************************************/
1482 static bool libnet_parse_domain_dc(TALLOC_CTX *mem_ctx,
1483 const char *domain_str,
1484 const char **domain_p,
1487 char *domain = NULL;
1489 const char *p = NULL;
1491 if (!domain_str || !domain_p || !dc_p) {
1495 p = strchr_m(domain_str, '\\');
1498 domain = talloc_strndup(mem_ctx, domain_str,
1499 PTR_DIFF(p, domain_str));
1500 dc = talloc_strdup(mem_ctx, p+1);
1505 domain = talloc_strdup(mem_ctx, domain_str);
1521 /****************************************************************
1522 ****************************************************************/
1524 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1525 struct libnet_JoinCtx *r)
1527 if (!r->in.domain_name) {
1528 libnet_join_set_error_string(mem_ctx, r,
1529 "No domain name defined");
1530 return WERR_INVALID_PARAM;
1533 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
1536 libnet_join_set_error_string(mem_ctx, r,
1537 "Failed to parse domain name");
1538 return WERR_INVALID_PARAM;
1542 return WERR_SETUP_DOMAIN_CONTROLLER;
1545 if (!secrets_init()) {
1546 libnet_join_set_error_string(mem_ctx, r,
1547 "Unable to open secrets database");
1548 return WERR_CAN_NOT_COMPLETE;
1554 /****************************************************************
1555 ****************************************************************/
1557 static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
1561 /* Try adding dom admins to builtin\admins. Only log failures. */
1562 status = create_builtin_administrators(domain_sid);
1563 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1564 DEBUG(10,("Unable to auto-add domain administrators to "
1565 "BUILTIN\\Administrators during join because "
1566 "winbindd must be running."));
1567 } else if (!NT_STATUS_IS_OK(status)) {
1568 DEBUG(5, ("Failed to auto-add domain administrators to "
1569 "BUILTIN\\Administrators during join: %s\n",
1570 nt_errstr(status)));
1573 /* Try adding dom users to builtin\users. Only log failures. */
1574 status = create_builtin_users(domain_sid);
1575 if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
1576 DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
1577 "during join because winbindd must be running."));
1578 } else if (!NT_STATUS_IS_OK(status)) {
1579 DEBUG(5, ("Failed to auto-add domain administrators to "
1580 "BUILTIN\\Administrators during join: %s\n",
1581 nt_errstr(status)));
1585 /****************************************************************
1586 ****************************************************************/
1588 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1589 struct libnet_JoinCtx *r)
1593 if (!W_ERROR_IS_OK(r->out.result)) {
1594 return r->out.result;
1597 werr = do_JoinConfig(r);
1598 if (!W_ERROR_IS_OK(werr)) {
1602 if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
1606 saf_join_store(r->out.netbios_domain_name, r->in.dc_name);
1607 if (r->out.dns_domain_name) {
1608 saf_join_store(r->out.dns_domain_name, r->in.dc_name);
1612 if (r->out.domain_is_ad &&
1613 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1614 ADS_STATUS ads_status;
1616 ads_status = libnet_join_post_processing_ads(mem_ctx, r);
1617 if (!ADS_ERR_OK(ads_status)) {
1618 return WERR_GENERAL_FAILURE;
1621 #endif /* WITH_ADS */
1623 libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
1628 /****************************************************************
1629 ****************************************************************/
1631 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1633 const char *krb5_cc_env = NULL;
1636 ads_destroy(&r->in.ads);
1639 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1640 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1641 unsetenv(KRB5_ENV_CCNAME);
1647 /****************************************************************
1648 ****************************************************************/
1650 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1652 const char *krb5_cc_env = NULL;
1655 ads_destroy(&r->in.ads);
1658 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1659 if (krb5_cc_env && StrCaseCmp(krb5_cc_env, "MEMORY:libnetjoin")) {
1660 unsetenv(KRB5_ENV_CCNAME);
1666 /****************************************************************
1667 ****************************************************************/
1669 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1670 struct libnet_JoinCtx **r)
1672 struct libnet_JoinCtx *ctx;
1673 const char *krb5_cc_env = NULL;
1675 ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1680 talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1682 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1683 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1685 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1686 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1687 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1688 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1689 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1692 ctx->in.secure_channel_type = SEC_CHAN_WKSTA;
1699 /****************************************************************
1700 ****************************************************************/
1702 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1703 struct libnet_UnjoinCtx **r)
1705 struct libnet_UnjoinCtx *ctx;
1706 const char *krb5_cc_env = NULL;
1708 ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1713 talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1715 ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1716 W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1718 krb5_cc_env = getenv(KRB5_ENV_CCNAME);
1719 if (!krb5_cc_env || (strlen(krb5_cc_env) == 0)) {
1720 krb5_cc_env = talloc_strdup(mem_ctx, "MEMORY:libnetjoin");
1721 W_ERROR_HAVE_NO_MEMORY(krb5_cc_env);
1722 setenv(KRB5_ENV_CCNAME, krb5_cc_env, 1);
1730 /****************************************************************
1731 ****************************************************************/
1733 static WERROR libnet_join_check_config(TALLOC_CTX *mem_ctx,
1734 struct libnet_JoinCtx *r)
1736 bool valid_security = false;
1737 bool valid_workgroup = false;
1738 bool valid_realm = false;
1740 /* check if configuration is already set correctly */
1742 valid_workgroup = strequal(lp_workgroup(), r->out.netbios_domain_name);
1744 switch (r->out.domain_is_ad) {
1746 valid_security = (lp_security() == SEC_DOMAIN);
1747 if (valid_workgroup && valid_security) {
1748 /* nothing to be done */
1753 valid_realm = strequal(lp_realm(), r->out.dns_domain_name);
1754 switch (lp_security()) {
1757 valid_security = true;
1760 if (valid_workgroup && valid_realm && valid_security) {
1761 /* nothing to be done */
1767 /* check if we are supposed to manipulate configuration */
1769 if (!r->in.modify_config) {
1771 char *wrong_conf = talloc_strdup(mem_ctx, "");
1773 if (!valid_workgroup) {
1774 wrong_conf = talloc_asprintf_append(wrong_conf,
1775 "\"workgroup\" set to '%s', should be '%s'",
1776 lp_workgroup(), r->out.netbios_domain_name);
1777 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1781 wrong_conf = talloc_asprintf_append(wrong_conf,
1782 "\"realm\" set to '%s', should be '%s'",
1783 lp_realm(), r->out.dns_domain_name);
1784 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1787 if (!valid_security) {
1788 const char *sec = NULL;
1789 switch (lp_security()) {
1790 case SEC_SHARE: sec = "share"; break;
1791 case SEC_USER: sec = "user"; break;
1792 case SEC_DOMAIN: sec = "domain"; break;
1793 case SEC_ADS: sec = "ads"; break;
1795 wrong_conf = talloc_asprintf_append(wrong_conf,
1796 "\"security\" set to '%s', should be %s",
1797 sec, r->out.domain_is_ad ?
1798 "either 'domain' or 'ads'" : "'domain'");
1799 W_ERROR_HAVE_NO_MEMORY(wrong_conf);
1802 libnet_join_set_error_string(mem_ctx, r,
1803 "Invalid configuration (%s) and configuration modification "
1804 "was not requested", wrong_conf);
1805 return WERR_CAN_NOT_COMPLETE;
1808 /* check if we are able to manipulate configuration */
1810 if (!lp_config_backend_is_registry()) {
1811 libnet_join_set_error_string(mem_ctx, r,
1812 "Configuration manipulation requested but not "
1813 "supported by backend");
1814 return WERR_NOT_SUPPORTED;
1820 /****************************************************************
1821 ****************************************************************/
1823 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1824 struct libnet_JoinCtx *r)
1828 struct cli_state *cli = NULL;
1830 ADS_STATUS ads_status;
1831 #endif /* WITH_ADS */
1833 if (!r->in.dc_name) {
1834 struct netr_DsRGetDCNameInfo *info;
1836 status = dsgetdcname(mem_ctx,
1841 DS_FORCE_REDISCOVERY |
1842 DS_DIRECTORY_SERVICE_REQUIRED |
1843 DS_WRITABLE_REQUIRED |
1846 if (!NT_STATUS_IS_OK(status)) {
1847 libnet_join_set_error_string(mem_ctx, r,
1848 "failed to find DC for domain %s",
1850 get_friendly_nt_error_msg(status));
1851 return WERR_DCNOTFOUND;
1854 dc = strip_hostname(info->dc_unc);
1855 r->in.dc_name = talloc_strdup(mem_ctx, dc);
1856 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1859 status = libnet_join_lookup_dc_rpc(mem_ctx, r, &cli);
1860 if (!NT_STATUS_IS_OK(status)) {
1861 libnet_join_set_error_string(mem_ctx, r,
1862 "failed to lookup DC info for domain '%s' over rpc: %s",
1863 r->in.domain_name, get_friendly_nt_error_msg(status));
1864 return ntstatus_to_werror(status);
1867 werr = libnet_join_check_config(mem_ctx, r);
1868 if (!W_ERROR_IS_OK(werr)) {
1873 if (r->out.domain_is_ad && r->in.account_ou &&
1874 !(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE)) {
1876 ads_status = libnet_join_connect_ads(mem_ctx, r);
1877 if (!ADS_ERR_OK(ads_status)) {
1878 return WERR_DEFAULT_JOIN_REQUIRED;
1881 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1882 if (!ADS_ERR_OK(ads_status)) {
1883 libnet_join_set_error_string(mem_ctx, r,
1884 "failed to precreate account in ou %s: %s",
1886 ads_errstr(ads_status));
1887 return WERR_DEFAULT_JOIN_REQUIRED;
1890 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1892 #endif /* WITH_ADS */
1894 if ((r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_UNSECURE) &&
1895 (r->in.join_flags & WKSSVC_JOIN_FLAGS_MACHINE_PWD_PASSED)) {
1896 status = libnet_join_joindomain_rpc_unsecure(mem_ctx, r, cli);
1898 status = libnet_join_joindomain_rpc(mem_ctx, r, cli);
1900 if (!NT_STATUS_IS_OK(status)) {
1901 libnet_join_set_error_string(mem_ctx, r,
1902 "failed to join domain '%s' over rpc: %s",
1903 r->in.domain_name, get_friendly_nt_error_msg(status));
1904 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1905 return WERR_SETUP_ALREADY_JOINED;
1907 werr = ntstatus_to_werror(status);
1911 if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1912 werr = WERR_SETUP_NOT_JOINED;
1926 /****************************************************************
1927 ****************************************************************/
1929 static WERROR libnet_join_rollback(TALLOC_CTX *mem_ctx,
1930 struct libnet_JoinCtx *r)
1933 struct libnet_UnjoinCtx *u = NULL;
1935 werr = libnet_init_UnjoinCtx(mem_ctx, &u);
1936 if (!W_ERROR_IS_OK(werr)) {
1940 u->in.debug = r->in.debug;
1941 u->in.dc_name = r->in.dc_name;
1942 u->in.domain_name = r->in.domain_name;
1943 u->in.admin_account = r->in.admin_account;
1944 u->in.admin_password = r->in.admin_password;
1945 u->in.modify_config = r->in.modify_config;
1946 u->in.unjoin_flags = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1947 WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
1949 werr = libnet_Unjoin(mem_ctx, u);
1955 /****************************************************************
1956 ****************************************************************/
1958 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1959 struct libnet_JoinCtx *r)
1964 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1967 werr = libnet_join_pre_processing(mem_ctx, r);
1968 if (!W_ERROR_IS_OK(werr)) {
1972 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1973 werr = libnet_DomainJoin(mem_ctx, r);
1974 if (!W_ERROR_IS_OK(werr)) {
1979 werr = libnet_join_post_processing(mem_ctx, r);
1980 if (!W_ERROR_IS_OK(werr)) {
1984 if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1985 werr = libnet_join_post_verify(mem_ctx, r);
1986 if (!W_ERROR_IS_OK(werr)) {
1987 libnet_join_rollback(mem_ctx, r);
1992 r->out.result = werr;
1995 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
2000 /****************************************************************
2001 ****************************************************************/
2003 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
2004 struct libnet_UnjoinCtx *r)
2008 if (!r->in.domain_sid) {
2010 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
2011 libnet_unjoin_set_error_string(mem_ctx, r,
2012 "Unable to fetch domain sid: are we joined?");
2013 return WERR_SETUP_NOT_JOINED;
2015 r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
2016 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
2019 if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) &&
2020 !r->in.delete_machine_account) {
2021 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2025 if (!r->in.dc_name) {
2026 struct netr_DsRGetDCNameInfo *info;
2028 status = dsgetdcname(mem_ctx,
2033 DS_DIRECTORY_SERVICE_REQUIRED |
2034 DS_WRITABLE_REQUIRED |
2037 if (!NT_STATUS_IS_OK(status)) {
2038 libnet_unjoin_set_error_string(mem_ctx, r,
2039 "failed to find DC for domain %s",
2041 get_friendly_nt_error_msg(status));
2042 return WERR_DCNOTFOUND;
2045 dc = strip_hostname(info->dc_unc);
2046 r->in.dc_name = talloc_strdup(mem_ctx, dc);
2047 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
2051 /* for net ads leave, try to delete the account. If it works,
2052 no sense in disabling. If it fails, we can still try to
2055 if (r->in.delete_machine_account) {
2056 ADS_STATUS ads_status;
2057 ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
2058 if (ADS_ERR_OK(ads_status)) {
2060 r->out.dns_domain_name =
2061 talloc_strdup(mem_ctx,
2062 r->in.ads->server.realm);
2064 libnet_unjoin_remove_machine_acct(mem_ctx, r);
2066 if (!ADS_ERR_OK(ads_status)) {
2067 libnet_unjoin_set_error_string(mem_ctx, r,
2068 "failed to remove machine account from AD: %s",
2069 ads_errstr(ads_status));
2071 r->out.deleted_machine_account = true;
2072 W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
2073 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2077 #endif /* WITH_ADS */
2079 /* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means
2081 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
2082 status = libnet_join_unjoindomain_rpc(mem_ctx, r);
2083 if (!NT_STATUS_IS_OK(status)) {
2084 libnet_unjoin_set_error_string(mem_ctx, r,
2085 "failed to disable machine account via rpc: %s",
2086 get_friendly_nt_error_msg(status));
2087 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
2088 return WERR_SETUP_NOT_JOINED;
2090 return ntstatus_to_werror(status);
2093 r->out.disabled_machine_account = true;
2096 /* If disable succeeded or was not requested at all, we
2097 should be getting rid of our end of things */
2099 libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
2104 /****************************************************************
2105 ****************************************************************/
2107 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
2108 struct libnet_UnjoinCtx *r)
2110 if (!r->in.domain_name) {
2111 libnet_unjoin_set_error_string(mem_ctx, r,
2112 "No domain name defined");
2113 return WERR_INVALID_PARAM;
2116 if (!libnet_parse_domain_dc(mem_ctx, r->in.domain_name,
2119 libnet_unjoin_set_error_string(mem_ctx, r,
2120 "Failed to parse domain name");
2121 return WERR_INVALID_PARAM;
2125 return WERR_SETUP_DOMAIN_CONTROLLER;
2128 if (!secrets_init()) {
2129 libnet_unjoin_set_error_string(mem_ctx, r,
2130 "Unable to open secrets database");
2131 return WERR_CAN_NOT_COMPLETE;
2137 /****************************************************************
2138 ****************************************************************/
2140 static WERROR libnet_unjoin_post_processing(TALLOC_CTX *mem_ctx,
2141 struct libnet_UnjoinCtx *r)
2143 saf_delete(r->out.netbios_domain_name);
2144 saf_delete(r->out.dns_domain_name);
2146 return libnet_unjoin_config(r);
2149 /****************************************************************
2150 ****************************************************************/
2152 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
2153 struct libnet_UnjoinCtx *r)
2158 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
2161 werr = libnet_unjoin_pre_processing(mem_ctx, r);
2162 if (!W_ERROR_IS_OK(werr)) {
2166 if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
2167 werr = libnet_DomainUnjoin(mem_ctx, r);
2168 if (!W_ERROR_IS_OK(werr)) {
2169 libnet_unjoin_config(r);
2174 werr = libnet_unjoin_post_processing(mem_ctx, r);
2175 if (!W_ERROR_IS_OK(werr)) {
2180 r->out.result = werr;
2183 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);