2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2008,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 * Copyright (C) Volker Lendecke 2005.
14 * Copyright (C) Guenther Deschner 2008.
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 3 of the License, or
19 * (at your option) any later version.
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
31 * This is the implementation of the SAMR code.
37 #define DBGC_CLASS DBGC_RPC_SRV
39 #define SAMR_USR_RIGHTS_WRITE_PW \
40 ( READ_CONTROL_ACCESS | \
41 SAMR_USER_ACCESS_CHANGE_PASSWORD | \
42 SAMR_USER_ACCESS_SET_LOC_COM)
43 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
44 ( READ_CONTROL_ACCESS | SAMR_USER_ACCESS_SET_LOC_COM )
46 #define DISP_INFO_CACHE_TIMEOUT 10
48 typedef struct disp_info {
49 DOM_SID sid; /* identify which domain this is. */
50 bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
51 struct pdb_search *users; /* querydispinfo 1 and 4 */
52 struct pdb_search *machines; /* querydispinfo 2 */
53 struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
54 struct pdb_search *aliases; /* enumaliases */
57 struct pdb_search *enum_users; /* enumusers with a mask */
59 struct timed_event *cache_timeout_event; /* cache idle timeout
63 /* We keep a static list of these by SID as modern clients close down
64 all resources between each request in a complete enumeration. */
67 /* for use by the \PIPE\samr policy */
69 bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
70 uint32 status; /* some sort of flag. best to record it. comes from opnum 0x39 */
76 static const struct generic_mapping sam_generic_mapping = {
77 GENERIC_RIGHTS_SAM_READ,
78 GENERIC_RIGHTS_SAM_WRITE,
79 GENERIC_RIGHTS_SAM_EXECUTE,
80 GENERIC_RIGHTS_SAM_ALL_ACCESS};
81 static const struct generic_mapping dom_generic_mapping = {
82 GENERIC_RIGHTS_DOMAIN_READ,
83 GENERIC_RIGHTS_DOMAIN_WRITE,
84 GENERIC_RIGHTS_DOMAIN_EXECUTE,
85 GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
86 static const struct generic_mapping usr_generic_mapping = {
87 GENERIC_RIGHTS_USER_READ,
88 GENERIC_RIGHTS_USER_WRITE,
89 GENERIC_RIGHTS_USER_EXECUTE,
90 GENERIC_RIGHTS_USER_ALL_ACCESS};
91 static const struct generic_mapping usr_nopwchange_generic_mapping = {
92 GENERIC_RIGHTS_USER_READ,
93 GENERIC_RIGHTS_USER_WRITE,
94 GENERIC_RIGHTS_USER_EXECUTE & ~SAMR_USER_ACCESS_CHANGE_PASSWORD,
95 GENERIC_RIGHTS_USER_ALL_ACCESS};
96 static const struct generic_mapping grp_generic_mapping = {
97 GENERIC_RIGHTS_GROUP_READ,
98 GENERIC_RIGHTS_GROUP_WRITE,
99 GENERIC_RIGHTS_GROUP_EXECUTE,
100 GENERIC_RIGHTS_GROUP_ALL_ACCESS};
101 static const struct generic_mapping ali_generic_mapping = {
102 GENERIC_RIGHTS_ALIAS_READ,
103 GENERIC_RIGHTS_ALIAS_WRITE,
104 GENERIC_RIGHTS_ALIAS_EXECUTE,
105 GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
107 /*******************************************************************
108 *******************************************************************/
110 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
111 const struct generic_mapping *map,
112 DOM_SID *sid, uint32 sid_access )
114 DOM_SID domadmin_sid;
115 SEC_ACE ace[5]; /* at most 5 entries */
120 /* basic access for Everyone */
122 init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
123 map->generic_execute | map->generic_read, 0);
125 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
127 init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
128 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
129 init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
130 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
132 /* Add Full Access for Domain Admins if we are a DC */
135 sid_copy( &domadmin_sid, get_global_sam_sid() );
136 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
137 init_sec_ace(&ace[i++], &domadmin_sid,
138 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
141 /* if we have a sid, give it some special access */
144 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, sid_access, 0);
147 /* create the security descriptor */
149 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
150 return NT_STATUS_NO_MEMORY;
152 if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
153 SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
154 psa, sd_size)) == NULL)
155 return NT_STATUS_NO_MEMORY;
160 /*******************************************************************
161 Checks if access to an object should be granted, and returns that
162 level of access for further checks.
163 ********************************************************************/
165 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
166 SE_PRIV *rights, uint32 rights_mask,
167 uint32 des_access, uint32 *acc_granted,
170 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
171 uint32 saved_mask = 0;
173 /* check privileges; certain SAM access bits should be overridden
174 by privileges (mostly having to do with creating/modifying/deleting
177 if ( rights && user_has_any_privilege( token, rights ) ) {
179 saved_mask = (des_access & rights_mask);
180 des_access &= ~saved_mask;
182 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
187 /* check the security descriptor first */
189 status = se_access_check(psd, token, des_access, acc_granted);
190 if (NT_STATUS_IS_OK(status)) {
194 /* give root a free pass */
196 if ( geteuid() == sec_initial_uid() ) {
198 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n", debug, des_access));
199 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
201 *acc_granted = des_access;
203 status = NT_STATUS_OK;
209 /* add in any bits saved during the privilege check (only
210 matters is status is ok) */
212 *acc_granted |= rights_mask;
214 DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
215 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
216 des_access, *acc_granted));
221 /*******************************************************************
222 Checks if access to a function can be granted
223 ********************************************************************/
225 static NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
227 DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
228 debug, acc_granted, acc_required));
230 /* check the security descriptor first */
232 if ( (acc_granted&acc_required) == acc_required )
235 /* give root a free pass */
237 if (geteuid() == sec_initial_uid()) {
239 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
240 debug, acc_granted, acc_required));
241 DEBUGADD(4,("but overwritten by euid == 0\n"));
246 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
247 debug, acc_granted, acc_required));
249 return NT_STATUS_ACCESS_DENIED;
252 /*******************************************************************
253 Map any MAXIMUM_ALLOWED_ACCESS request to a valid access set.
254 ********************************************************************/
256 static void map_max_allowed_access(const NT_USER_TOKEN *token,
257 uint32_t *pacc_requested)
259 if (!((*pacc_requested) & MAXIMUM_ALLOWED_ACCESS)) {
262 *pacc_requested &= ~MAXIMUM_ALLOWED_ACCESS;
264 /* At least try for generic read. */
265 *pacc_requested = GENERIC_READ_ACCESS;
267 /* root gets anything. */
268 if (geteuid() == sec_initial_uid()) {
269 *pacc_requested |= GENERIC_ALL_ACCESS;
273 /* Full Access for 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
275 if (is_sid_in_token(token, &global_sid_Builtin_Administrators) ||
276 is_sid_in_token(token, &global_sid_Builtin_Account_Operators)) {
277 *pacc_requested |= GENERIC_ALL_ACCESS;
281 /* Full access for DOMAIN\Domain Admins. */
283 DOM_SID domadmin_sid;
284 sid_copy( &domadmin_sid, get_global_sam_sid() );
285 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
286 if (is_sid_in_token(token, &domadmin_sid)) {
287 *pacc_requested |= GENERIC_ALL_ACCESS;
291 /* TODO ! Check privileges. */
294 /*******************************************************************
295 Fetch or create a dispinfo struct.
296 ********************************************************************/
298 static DISP_INFO *get_samr_dispinfo_by_sid(DOM_SID *psid)
301 * We do a static cache for DISP_INFO's here. Explanation can be found
302 * in Jeremy's checkin message to r11793:
304 * Fix the SAMR cache so it works across completely insane
305 * client behaviour (ie.:
306 * open pipe/open SAMR handle/enumerate 0 - 1024
307 * close SAMR handle, close pipe.
308 * open pipe/open SAMR handle/enumerate 1024 - 2048...
309 * close SAMR handle, close pipe.
310 * And on ad-nausium. Amazing.... probably object-oriented
311 * client side programming in action yet again.
312 * This change should *massively* improve performance when
313 * enumerating users from an LDAP database.
316 * "Our" and the builtin domain are the only ones where we ever
317 * enumerate stuff, so just cache 2 entries.
320 static struct disp_info builtin_dispinfo;
321 static struct disp_info domain_dispinfo;
323 /* There are two cases to consider here:
324 1) The SID is a domain SID and we look for an equality match, or
325 2) This is an account SID and so we return the DISP_INFO* for our
332 if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
334 * Necessary only once, but it does not really hurt.
336 sid_copy(&builtin_dispinfo.sid, &global_sid_Builtin);
338 return &builtin_dispinfo;
341 if (sid_check_is_domain(psid) || sid_check_is_in_our_domain(psid)) {
343 * Necessary only once, but it does not really hurt.
345 sid_copy(&domain_dispinfo.sid, get_global_sam_sid());
347 return &domain_dispinfo;
353 /*******************************************************************
354 Create a samr_info struct.
355 ********************************************************************/
357 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
359 struct samr_info *info;
364 sid_to_fstring(sid_str, psid);
366 fstrcpy(sid_str,"(NULL)");
369 mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
371 if ((info = TALLOC_ZERO_P(mem_ctx, struct samr_info)) == NULL)
374 DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
376 sid_copy( &info->sid, psid);
377 info->builtin_domain = sid_check_is_builtin(psid);
379 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
380 info->builtin_domain = False;
382 info->mem_ctx = mem_ctx;
384 info->disp_info = get_samr_dispinfo_by_sid(psid);
389 /*******************************************************************
390 Function to free the per SID data.
391 ********************************************************************/
393 static void free_samr_cache(DISP_INFO *disp_info)
395 DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
396 sid_string_dbg(&disp_info->sid)));
398 /* We need to become root here because the paged search might have to
399 * tell the LDAP server we're not interested in the rest anymore. */
403 if (disp_info->users) {
404 DEBUG(10,("free_samr_cache: deleting users cache\n"));
405 pdb_search_destroy(disp_info->users);
406 disp_info->users = NULL;
408 if (disp_info->machines) {
409 DEBUG(10,("free_samr_cache: deleting machines cache\n"));
410 pdb_search_destroy(disp_info->machines);
411 disp_info->machines = NULL;
413 if (disp_info->groups) {
414 DEBUG(10,("free_samr_cache: deleting groups cache\n"));
415 pdb_search_destroy(disp_info->groups);
416 disp_info->groups = NULL;
418 if (disp_info->aliases) {
419 DEBUG(10,("free_samr_cache: deleting aliases cache\n"));
420 pdb_search_destroy(disp_info->aliases);
421 disp_info->aliases = NULL;
423 if (disp_info->enum_users) {
424 DEBUG(10,("free_samr_cache: deleting enum_users cache\n"));
425 pdb_search_destroy(disp_info->enum_users);
426 disp_info->enum_users = NULL;
428 disp_info->enum_acb_mask = 0;
433 /*******************************************************************
434 Function to free the per handle data.
435 ********************************************************************/
437 static void free_samr_info(void *ptr)
439 struct samr_info *info=(struct samr_info *) ptr;
441 /* Only free the dispinfo cache if no one bothered to set up
444 if (info->disp_info && info->disp_info->cache_timeout_event == NULL) {
445 free_samr_cache(info->disp_info);
448 talloc_destroy(info->mem_ctx);
451 /*******************************************************************
452 Idle event handler. Throw away the disp info cache.
453 ********************************************************************/
455 static void disp_info_cache_idle_timeout_handler(struct event_context *ev_ctx,
456 struct timed_event *te,
457 const struct timeval *now,
460 DISP_INFO *disp_info = (DISP_INFO *)private_data;
462 TALLOC_FREE(disp_info->cache_timeout_event);
464 DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
466 free_samr_cache(disp_info);
469 /*******************************************************************
470 Setup cache removal idle event handler.
471 ********************************************************************/
473 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
475 /* Remove any pending timeout and update. */
477 TALLOC_FREE(disp_info->cache_timeout_event);
479 DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
480 "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
481 (unsigned int)secs_fromnow ));
483 disp_info->cache_timeout_event = event_add_timed(
484 smbd_event_context(), NULL,
485 timeval_current_ofs(secs_fromnow, 0),
486 "disp_info_cache_idle_timeout_handler",
487 disp_info_cache_idle_timeout_handler, (void *)disp_info);
490 /*******************************************************************
491 Force flush any cache. We do this on any samr_set_xxx call.
492 We must also remove the timeout handler.
493 ********************************************************************/
495 static void force_flush_samr_cache(DISP_INFO *disp_info)
497 if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
501 DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
502 TALLOC_FREE(disp_info->cache_timeout_event);
503 free_samr_cache(disp_info);
506 /*******************************************************************
507 Ensure password info is never given out. Paranioa... JRA.
508 ********************************************************************/
510 static void samr_clear_sam_passwd(struct samu *sam_pass)
516 /* These now zero out the old password */
518 pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
519 pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
522 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
524 struct samr_displayentry *entry;
526 if (info->builtin_domain) {
527 /* No users in builtin. */
531 if (info->users == NULL) {
532 info->users = pdb_search_users(acct_flags);
533 if (info->users == NULL) {
537 /* Fetch the last possible entry, thus trigger an enumeration */
538 pdb_search_entries(info->users, 0xffffffff, 1, &entry);
540 /* Ensure we cache this enumeration. */
541 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
543 return info->users->num_entries;
546 static uint32 count_sam_groups(struct disp_info *info)
548 struct samr_displayentry *entry;
550 if (info->builtin_domain) {
551 /* No groups in builtin. */
555 if (info->groups == NULL) {
556 info->groups = pdb_search_groups();
557 if (info->groups == NULL) {
561 /* Fetch the last possible entry, thus trigger an enumeration */
562 pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
564 /* Ensure we cache this enumeration. */
565 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
567 return info->groups->num_entries;
570 static uint32 count_sam_aliases(struct disp_info *info)
572 struct samr_displayentry *entry;
574 if (info->aliases == NULL) {
575 info->aliases = pdb_search_aliases(&info->sid);
576 if (info->aliases == NULL) {
580 /* Fetch the last possible entry, thus trigger an enumeration */
581 pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
583 /* Ensure we cache this enumeration. */
584 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
586 return info->aliases->num_entries;
589 /*******************************************************************
591 ********************************************************************/
593 NTSTATUS _samr_Close(pipes_struct *p, struct samr_Close *r)
595 if (!close_policy_hnd(p, r->in.handle)) {
596 return NT_STATUS_INVALID_HANDLE;
599 ZERO_STRUCTP(r->out.handle);
604 /*******************************************************************
606 ********************************************************************/
608 NTSTATUS _samr_OpenDomain(pipes_struct *p,
609 struct samr_OpenDomain *r)
611 struct samr_info *info;
612 SEC_DESC *psd = NULL;
614 uint32 des_access = r->in.access_mask;
619 /* find the connection policy handle. */
621 if ( !find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info) )
622 return NT_STATUS_INVALID_HANDLE;
624 status = access_check_samr_function(info->acc_granted,
625 SAMR_ACCESS_OPEN_DOMAIN,
626 "_samr_OpenDomain" );
628 if ( !NT_STATUS_IS_OK(status) )
631 /*check if access can be granted as requested by client. */
632 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
634 make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
635 se_map_generic( &des_access, &dom_generic_mapping );
637 se_priv_copy( &se_rights, &se_machine_account );
638 se_priv_add( &se_rights, &se_add_users );
640 status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
641 &se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
642 &acc_granted, "_samr_OpenDomain" );
644 if ( !NT_STATUS_IS_OK(status) )
647 if (!sid_check_is_domain(r->in.sid) &&
648 !sid_check_is_builtin(r->in.sid)) {
649 return NT_STATUS_NO_SUCH_DOMAIN;
652 /* associate the domain SID with the (unique) handle. */
653 if ((info = get_samr_info_by_sid(r->in.sid))==NULL)
654 return NT_STATUS_NO_MEMORY;
655 info->acc_granted = acc_granted;
657 /* get a (unique) handle. open a policy on it. */
658 if (!create_policy_hnd(p, r->out.domain_handle, free_samr_info, (void *)info))
659 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
661 DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
666 /*******************************************************************
668 ********************************************************************/
670 NTSTATUS _samr_GetUserPwInfo(pipes_struct *p,
671 struct samr_GetUserPwInfo *r)
673 struct samr_info *info = NULL;
674 enum lsa_SidType sid_type;
675 uint32_t min_password_length = 0;
676 uint32_t password_properties = 0;
680 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
682 /* find the policy handle. open a policy on it. */
683 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info)) {
684 return NT_STATUS_INVALID_HANDLE;
687 status = access_check_samr_function(info->acc_granted,
688 SAMR_USER_ACCESS_GET_ATTRIBUTES,
689 "_samr_GetUserPwInfo" );
690 if (!NT_STATUS_IS_OK(status)) {
694 if (!sid_check_is_in_our_domain(&info->sid)) {
695 return NT_STATUS_OBJECT_TYPE_MISMATCH;
699 ret = lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, &sid_type);
702 return NT_STATUS_NO_SUCH_USER;
708 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
709 &min_password_length);
710 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
711 &password_properties);
714 if (lp_check_password_script() && *lp_check_password_script()) {
715 password_properties |= DOMAIN_PASSWORD_COMPLEX;
723 r->out.info->min_password_length = min_password_length;
724 r->out.info->password_properties = password_properties;
726 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
731 /*******************************************************************
732 ********************************************************************/
734 static bool get_lsa_policy_samr_sid( pipes_struct *p, POLICY_HND *pol,
735 DOM_SID *sid, uint32 *acc_granted,
736 DISP_INFO **ppdisp_info)
738 struct samr_info *info = NULL;
740 /* find the policy handle. open a policy on it. */
741 if (!find_policy_by_hnd(p, pol, (void **)(void *)&info))
748 *acc_granted = info->acc_granted;
750 *ppdisp_info = info->disp_info;
756 /*******************************************************************
758 ********************************************************************/
760 NTSTATUS _samr_SetSecurity(pipes_struct *p,
761 struct samr_SetSecurity *r)
764 uint32 acc_granted, i;
767 struct samu *sampass=NULL;
770 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
771 return NT_STATUS_INVALID_HANDLE;
773 if (!(sampass = samu_new( p->mem_ctx))) {
774 DEBUG(0,("No memory!\n"));
775 return NT_STATUS_NO_MEMORY;
778 /* get the user record */
780 ret = pdb_getsampwsid(sampass, &pol_sid);
784 DEBUG(4, ("User %s not found\n", sid_string_dbg(&pol_sid)));
785 TALLOC_FREE(sampass);
786 return NT_STATUS_INVALID_HANDLE;
789 dacl = r->in.sdbuf->sd->dacl;
790 for (i=0; i < dacl->num_aces; i++) {
791 if (sid_equal(&pol_sid, &dacl->aces[i].trustee)) {
792 ret = pdb_set_pass_can_change(sampass,
793 (dacl->aces[i].access_mask &
794 SAMR_USER_ACCESS_CHANGE_PASSWORD) ?
801 TALLOC_FREE(sampass);
802 return NT_STATUS_ACCESS_DENIED;
805 status = access_check_samr_function(acc_granted,
806 SAMR_USER_ACCESS_SET_ATTRIBUTES,
807 "_samr_SetSecurity");
808 if (NT_STATUS_IS_OK(status)) {
810 status = pdb_update_sam_account(sampass);
814 TALLOC_FREE(sampass);
819 /*******************************************************************
820 build correct perms based on policies and password times for _samr_query_sec_obj
821 *******************************************************************/
822 static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
824 struct samu *sampass=NULL;
827 if ( !(sampass = samu_new( mem_ctx )) ) {
828 DEBUG(0,("No memory!\n"));
833 ret = pdb_getsampwsid(sampass, user_sid);
837 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
838 TALLOC_FREE(sampass);
842 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
844 if (pdb_get_pass_can_change(sampass)) {
845 TALLOC_FREE(sampass);
848 TALLOC_FREE(sampass);
853 /*******************************************************************
855 ********************************************************************/
857 NTSTATUS _samr_QuerySecurity(pipes_struct *p,
858 struct samr_QuerySecurity *r)
862 SEC_DESC * psd = NULL;
867 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
868 return NT_STATUS_INVALID_HANDLE;
870 DEBUG(10,("_samr_QuerySecurity: querying security on SID: %s\n",
871 sid_string_dbg(&pol_sid)));
873 status = access_check_samr_function(acc_granted,
874 STD_RIGHT_READ_CONTROL_ACCESS,
875 "_samr_QuerySecurity");
876 if (!NT_STATUS_IS_OK(status)) {
880 /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
882 /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
883 if (pol_sid.sid_rev_num == 0) {
884 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
885 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
886 } else if (sid_equal(&pol_sid,get_global_sam_sid())) {
887 /* check if it is our domain SID */
888 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
889 "with SID: %s\n", sid_string_dbg(&pol_sid)));
890 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
891 } else if (sid_equal(&pol_sid,&global_sid_Builtin)) {
892 /* check if it is the Builtin Domain */
893 /* TODO: Builtin probably needs a different SD with restricted write access*/
894 DEBUG(5,("_samr_QuerySecurity: querying security on Builtin "
895 "Domain with SID: %s\n", sid_string_dbg(&pol_sid)));
896 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
897 } else if (sid_check_is_in_our_domain(&pol_sid) ||
898 sid_check_is_in_builtin(&pol_sid)) {
899 /* TODO: different SDs have to be generated for aliases groups and users.
900 Currently all three get a default user SD */
901 DEBUG(10,("_samr_QuerySecurity: querying security on Object "
902 "with SID: %s\n", sid_string_dbg(&pol_sid)));
903 if (check_change_pw_access(p->mem_ctx, &pol_sid)) {
904 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
905 &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
907 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_nopwchange_generic_mapping,
908 &pol_sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
911 return NT_STATUS_OBJECT_TYPE_MISMATCH;
914 if ((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
915 return NT_STATUS_NO_MEMORY;
920 /*******************************************************************
921 makes a SAM_ENTRY / UNISTR2* structure from a user list.
922 ********************************************************************/
924 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx,
925 struct samr_SamEntry **sam_pp,
926 uint32_t num_entries,
928 struct samr_displayentry *entries)
931 struct samr_SamEntry *sam;
935 if (num_entries == 0) {
939 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_entries);
941 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
942 return NT_STATUS_NO_MEMORY;
945 for (i = 0; i < num_entries; i++) {
948 * usrmgr expects a non-NULL terminated string with
949 * trust relationships
951 if (entries[i].acct_flags & ACB_DOMTRUST) {
952 init_unistr2(&uni_temp_name, entries[i].account_name,
955 init_unistr2(&uni_temp_name, entries[i].account_name,
959 init_lsa_String(&sam[i].name, entries[i].account_name);
960 sam[i].idx = entries[i].rid;
968 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
970 /*******************************************************************
971 _samr_EnumDomainUsers
972 ********************************************************************/
974 NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
975 struct samr_EnumDomainUsers *r)
978 struct samr_info *info = NULL;
980 uint32 enum_context = *r->in.resume_handle;
981 enum remote_arch_types ra_type = get_remote_arch();
982 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
983 uint32 max_entries = max_sam_entries;
984 struct samr_displayentry *entries = NULL;
985 struct samr_SamArray *samr_array = NULL;
986 struct samr_SamEntry *samr_entries = NULL;
988 /* find the policy handle. open a policy on it. */
989 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
990 return NT_STATUS_INVALID_HANDLE;
992 status = access_check_samr_function(info->acc_granted,
993 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
994 "_samr_EnumDomainUsers");
995 if (!NT_STATUS_IS_OK(status)) {
999 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
1001 if (info->builtin_domain) {
1002 /* No users in builtin. */
1003 *r->out.resume_handle = *r->in.resume_handle;
1004 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
1008 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1010 return NT_STATUS_NO_MEMORY;
1017 if ((info->disp_info->enum_users != NULL) &&
1018 (info->disp_info->enum_acb_mask != r->in.acct_flags)) {
1019 pdb_search_destroy(info->disp_info->enum_users);
1020 info->disp_info->enum_users = NULL;
1023 if (info->disp_info->enum_users == NULL) {
1024 info->disp_info->enum_users = pdb_search_users(r->in.acct_flags);
1025 info->disp_info->enum_acb_mask = r->in.acct_flags;
1028 if (info->disp_info->enum_users == NULL) {
1029 /* END AS ROOT !!!! */
1031 return NT_STATUS_ACCESS_DENIED;
1034 num_account = pdb_search_entries(info->disp_info->enum_users,
1035 enum_context, max_entries,
1038 /* END AS ROOT !!!! */
1042 if (num_account == 0) {
1043 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
1044 "total entries\n"));
1045 *r->out.resume_handle = *r->in.resume_handle;
1046 return NT_STATUS_OK;
1049 status = make_user_sam_entry_list(p->mem_ctx, &samr_entries,
1050 num_account, enum_context,
1052 if (!NT_STATUS_IS_OK(status)) {
1056 if (max_entries <= num_account) {
1057 status = STATUS_MORE_ENTRIES;
1059 status = NT_STATUS_OK;
1062 /* Ensure we cache this enumeration. */
1063 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1065 DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
1067 samr_array->count = num_account;
1068 samr_array->entries = samr_entries;
1070 *r->out.resume_handle = *r->in.resume_handle + num_account;
1071 *r->out.sam = samr_array;
1072 *r->out.num_entries = num_account;
1074 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
1079 /*******************************************************************
1080 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1081 ********************************************************************/
1083 static void make_group_sam_entry_list(TALLOC_CTX *ctx,
1084 struct samr_SamEntry **sam_pp,
1085 uint32_t num_sam_entries,
1086 struct samr_displayentry *entries)
1088 struct samr_SamEntry *sam;
1093 if (num_sam_entries == 0) {
1097 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_sam_entries);
1102 for (i = 0; i < num_sam_entries; i++) {
1104 * JRA. I think this should include the null. TNG does not.
1106 init_lsa_String(&sam[i].name, entries[i].account_name);
1107 sam[i].idx = entries[i].rid;
1113 /*******************************************************************
1114 _samr_EnumDomainGroups
1115 ********************************************************************/
1117 NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
1118 struct samr_EnumDomainGroups *r)
1121 struct samr_info *info = NULL;
1122 struct samr_displayentry *groups;
1124 struct samr_SamArray *samr_array = NULL;
1125 struct samr_SamEntry *samr_entries = NULL;
1127 /* find the policy handle. open a policy on it. */
1128 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1129 return NT_STATUS_INVALID_HANDLE;
1131 status = access_check_samr_function(info->acc_granted,
1132 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1133 "_samr_EnumDomainGroups");
1134 if (!NT_STATUS_IS_OK(status)) {
1138 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1140 if (info->builtin_domain) {
1141 /* No groups in builtin. */
1142 *r->out.resume_handle = *r->in.resume_handle;
1143 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
1147 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1149 return NT_STATUS_NO_MEMORY;
1152 /* the domain group array is being allocated in the function below */
1156 if (info->disp_info->groups == NULL) {
1157 info->disp_info->groups = pdb_search_groups();
1159 if (info->disp_info->groups == NULL) {
1161 return NT_STATUS_ACCESS_DENIED;
1165 num_groups = pdb_search_entries(info->disp_info->groups,
1166 *r->in.resume_handle,
1167 MAX_SAM_ENTRIES, &groups);
1170 /* Ensure we cache this enumeration. */
1171 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1173 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1174 num_groups, groups);
1176 samr_array->count = num_groups;
1177 samr_array->entries = samr_entries;
1179 *r->out.sam = samr_array;
1180 *r->out.num_entries = num_groups;
1181 /* this was missing, IMHO:
1182 *r->out.resume_handle = num_groups + *r->in.resume_handle;
1185 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1190 /*******************************************************************
1191 _samr_EnumDomainAliases
1192 ********************************************************************/
1194 NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
1195 struct samr_EnumDomainAliases *r)
1198 struct samr_info *info;
1199 struct samr_displayentry *aliases;
1200 uint32 num_aliases = 0;
1201 struct samr_SamArray *samr_array = NULL;
1202 struct samr_SamEntry *samr_entries = NULL;
1204 /* find the policy handle. open a policy on it. */
1205 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1206 return NT_STATUS_INVALID_HANDLE;
1208 DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1209 sid_string_dbg(&info->sid)));
1211 status = access_check_samr_function(info->acc_granted,
1212 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1213 "_samr_EnumDomainAliases");
1214 if (!NT_STATUS_IS_OK(status)) {
1218 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1220 return NT_STATUS_NO_MEMORY;
1225 if (info->disp_info->aliases == NULL) {
1226 info->disp_info->aliases = pdb_search_aliases(&info->sid);
1227 if (info->disp_info->aliases == NULL) {
1229 return NT_STATUS_ACCESS_DENIED;
1233 num_aliases = pdb_search_entries(info->disp_info->aliases,
1234 *r->in.resume_handle,
1235 MAX_SAM_ENTRIES, &aliases);
1238 /* Ensure we cache this enumeration. */
1239 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1241 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1242 num_aliases, aliases);
1244 DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
1246 samr_array->count = num_aliases;
1247 samr_array->entries = samr_entries;
1249 *r->out.sam = samr_array;
1250 *r->out.num_entries = num_aliases;
1251 *r->out.resume_handle = num_aliases + *r->in.resume_handle;
1256 /*******************************************************************
1257 inits a samr_DispInfoGeneral structure.
1258 ********************************************************************/
1260 static NTSTATUS init_samr_dispinfo_1(TALLOC_CTX *ctx,
1261 struct samr_DispInfoGeneral *r,
1262 uint32_t num_entries,
1264 struct samr_displayentry *entries)
1268 DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries));
1270 if (num_entries == 0) {
1271 return NT_STATUS_OK;
1274 r->count = num_entries;
1276 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryGeneral, num_entries);
1278 return NT_STATUS_NO_MEMORY;
1281 for (i = 0; i < num_entries ; i++) {
1283 init_lsa_String(&r->entries[i].account_name,
1284 entries[i].account_name);
1286 init_lsa_String(&r->entries[i].description,
1287 entries[i].description);
1289 init_lsa_String(&r->entries[i].full_name,
1290 entries[i].fullname);
1292 r->entries[i].rid = entries[i].rid;
1293 r->entries[i].acct_flags = entries[i].acct_flags;
1294 r->entries[i].idx = start_idx+i+1;
1297 return NT_STATUS_OK;
1300 /*******************************************************************
1301 inits a samr_DispInfoFull structure.
1302 ********************************************************************/
1304 static NTSTATUS init_samr_dispinfo_2(TALLOC_CTX *ctx,
1305 struct samr_DispInfoFull *r,
1306 uint32_t num_entries,
1308 struct samr_displayentry *entries)
1312 DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries));
1314 if (num_entries == 0) {
1315 return NT_STATUS_OK;
1318 r->count = num_entries;
1320 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFull, num_entries);
1322 return NT_STATUS_NO_MEMORY;
1325 for (i = 0; i < num_entries ; i++) {
1327 init_lsa_String(&r->entries[i].account_name,
1328 entries[i].account_name);
1330 init_lsa_String(&r->entries[i].description,
1331 entries[i].description);
1333 r->entries[i].rid = entries[i].rid;
1334 r->entries[i].acct_flags = entries[i].acct_flags;
1335 r->entries[i].idx = start_idx+i+1;
1338 return NT_STATUS_OK;
1341 /*******************************************************************
1342 inits a samr_DispInfoFullGroups structure.
1343 ********************************************************************/
1345 static NTSTATUS init_samr_dispinfo_3(TALLOC_CTX *ctx,
1346 struct samr_DispInfoFullGroups *r,
1347 uint32_t num_entries,
1349 struct samr_displayentry *entries)
1353 DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries));
1355 if (num_entries == 0) {
1356 return NT_STATUS_OK;
1359 r->count = num_entries;
1361 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFullGroup, num_entries);
1363 return NT_STATUS_NO_MEMORY;
1366 for (i = 0; i < num_entries ; i++) {
1368 init_lsa_String(&r->entries[i].account_name,
1369 entries[i].account_name);
1371 init_lsa_String(&r->entries[i].description,
1372 entries[i].description);
1374 r->entries[i].rid = entries[i].rid;
1375 r->entries[i].acct_flags = entries[i].acct_flags;
1376 r->entries[i].idx = start_idx+i+1;
1379 return NT_STATUS_OK;
1382 /*******************************************************************
1383 inits a samr_DispInfoAscii structure.
1384 ********************************************************************/
1386 static NTSTATUS init_samr_dispinfo_4(TALLOC_CTX *ctx,
1387 struct samr_DispInfoAscii *r,
1388 uint32_t num_entries,
1390 struct samr_displayentry *entries)
1394 DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries));
1396 if (num_entries == 0) {
1397 return NT_STATUS_OK;
1400 r->count = num_entries;
1402 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1404 return NT_STATUS_NO_MEMORY;
1407 for (i = 0; i < num_entries ; i++) {
1409 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1410 entries[i].account_name);
1412 r->entries[i].idx = start_idx+i+1;
1415 return NT_STATUS_OK;
1418 /*******************************************************************
1419 inits a samr_DispInfoAscii structure.
1420 ********************************************************************/
1422 static NTSTATUS init_samr_dispinfo_5(TALLOC_CTX *ctx,
1423 struct samr_DispInfoAscii *r,
1424 uint32_t num_entries,
1426 struct samr_displayentry *entries)
1430 DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries));
1432 if (num_entries == 0) {
1433 return NT_STATUS_OK;
1436 r->count = num_entries;
1438 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1440 return NT_STATUS_NO_MEMORY;
1443 for (i = 0; i < num_entries ; i++) {
1445 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1446 entries[i].account_name);
1448 r->entries[i].idx = start_idx+i+1;
1451 return NT_STATUS_OK;
1454 /*******************************************************************
1455 _samr_QueryDisplayInfo
1456 ********************************************************************/
1458 NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
1459 struct samr_QueryDisplayInfo *r)
1462 struct samr_info *info = NULL;
1463 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1465 uint32 max_entries = r->in.max_entries;
1466 uint32 enum_context = r->in.start_idx;
1467 uint32 max_size = r->in.buf_size;
1469 union samr_DispInfo *disp_info = r->out.info;
1471 uint32 temp_size=0, total_data_size=0;
1472 NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1473 uint32 num_account = 0;
1474 enum remote_arch_types ra_type = get_remote_arch();
1475 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1476 struct samr_displayentry *entries = NULL;
1478 DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
1480 /* find the policy handle. open a policy on it. */
1481 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1482 return NT_STATUS_INVALID_HANDLE;
1484 status = access_check_samr_function(info->acc_granted,
1485 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1486 "_samr_QueryDisplayInfo");
1487 if (!NT_STATUS_IS_OK(status)) {
1492 * calculate how many entries we will return.
1494 * - the number of entries the client asked
1495 * - our limit on that
1496 * - the starting point (enumeration context)
1497 * - the buffer size the client will accept
1501 * We are a lot more like W2K. Instead of reading the SAM
1502 * each time to find the records we need to send back,
1503 * we read it once and link that copy to the sam handle.
1504 * For large user list (over the MAX_SAM_ENTRIES)
1505 * it's a definitive win.
1506 * second point to notice: between enumerations
1507 * our sam is now the same as it's a snapshoot.
1508 * third point: got rid of the static SAM_USER_21 struct
1509 * no more intermediate.
1510 * con: it uses much more memory, as a full copy is stored
1513 * If you want to change it, think twice and think
1514 * of the second point , that's really important.
1519 if ((r->in.level < 1) || (r->in.level > 5)) {
1520 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1521 (unsigned int)r->in.level ));
1522 return NT_STATUS_INVALID_INFO_CLASS;
1525 /* first limit the number of entries we will return */
1526 if(max_entries > max_sam_entries) {
1527 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1528 "entries, limiting to %d\n", max_entries,
1530 max_entries = max_sam_entries;
1533 /* calculate the size and limit on the number of entries we will
1536 temp_size=max_entries*struct_size;
1538 if (temp_size>max_size) {
1539 max_entries=MIN((max_size/struct_size),max_entries);;
1540 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1541 "only %d entries\n", max_entries));
1546 /* THe following done as ROOT. Don't return without unbecome_root(). */
1548 switch (r->in.level) {
1551 if (info->disp_info->users == NULL) {
1552 info->disp_info->users = pdb_search_users(ACB_NORMAL);
1553 if (info->disp_info->users == NULL) {
1555 return NT_STATUS_ACCESS_DENIED;
1557 DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1558 (unsigned int)enum_context ));
1560 DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1561 (unsigned int)enum_context ));
1564 num_account = pdb_search_entries(info->disp_info->users,
1565 enum_context, max_entries,
1569 if (info->disp_info->machines == NULL) {
1570 info->disp_info->machines =
1571 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
1572 if (info->disp_info->machines == NULL) {
1574 return NT_STATUS_ACCESS_DENIED;
1576 DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1577 (unsigned int)enum_context ));
1579 DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1580 (unsigned int)enum_context ));
1583 num_account = pdb_search_entries(info->disp_info->machines,
1584 enum_context, max_entries,
1589 if (info->disp_info->groups == NULL) {
1590 info->disp_info->groups = pdb_search_groups();
1591 if (info->disp_info->groups == NULL) {
1593 return NT_STATUS_ACCESS_DENIED;
1595 DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1596 (unsigned int)enum_context ));
1598 DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1599 (unsigned int)enum_context ));
1602 num_account = pdb_search_entries(info->disp_info->groups,
1603 enum_context, max_entries,
1608 smb_panic("info class changed");
1614 /* Now create reply structure */
1615 switch (r->in.level) {
1617 disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
1618 num_account, enum_context,
1622 disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
1623 num_account, enum_context,
1627 disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
1628 num_account, enum_context,
1632 disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
1633 num_account, enum_context,
1637 disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
1638 num_account, enum_context,
1642 smb_panic("info class changed");
1646 if (!NT_STATUS_IS_OK(disp_ret))
1649 /* calculate the total size */
1650 total_data_size=num_account*struct_size;
1652 if (max_entries <= num_account) {
1653 status = STATUS_MORE_ENTRIES;
1655 status = NT_STATUS_OK;
1658 /* Ensure we cache this enumeration. */
1659 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1661 DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
1663 *r->out.total_size = total_data_size;
1664 *r->out.returned_size = temp_size;
1669 /****************************************************************
1670 _samr_QueryDisplayInfo2
1671 ****************************************************************/
1673 NTSTATUS _samr_QueryDisplayInfo2(pipes_struct *p,
1674 struct samr_QueryDisplayInfo2 *r)
1676 struct samr_QueryDisplayInfo q;
1678 q.in.domain_handle = r->in.domain_handle;
1679 q.in.level = r->in.level;
1680 q.in.start_idx = r->in.start_idx;
1681 q.in.max_entries = r->in.max_entries;
1682 q.in.buf_size = r->in.buf_size;
1684 q.out.total_size = r->out.total_size;
1685 q.out.returned_size = r->out.returned_size;
1686 q.out.info = r->out.info;
1688 return _samr_QueryDisplayInfo(p, &q);
1691 /****************************************************************
1692 _samr_QueryDisplayInfo3
1693 ****************************************************************/
1695 NTSTATUS _samr_QueryDisplayInfo3(pipes_struct *p,
1696 struct samr_QueryDisplayInfo3 *r)
1698 struct samr_QueryDisplayInfo q;
1700 q.in.domain_handle = r->in.domain_handle;
1701 q.in.level = r->in.level;
1702 q.in.start_idx = r->in.start_idx;
1703 q.in.max_entries = r->in.max_entries;
1704 q.in.buf_size = r->in.buf_size;
1706 q.out.total_size = r->out.total_size;
1707 q.out.returned_size = r->out.returned_size;
1708 q.out.info = r->out.info;
1710 return _samr_QueryDisplayInfo(p, &q);
1713 /*******************************************************************
1714 _samr_QueryAliasInfo
1715 ********************************************************************/
1717 NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
1718 struct samr_QueryAliasInfo *r)
1721 struct acct_info info;
1724 union samr_AliasInfo *alias_info = NULL;
1725 const char *alias_name = NULL;
1726 const char *alias_description = NULL;
1728 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1730 alias_info = TALLOC_ZERO_P(p->mem_ctx, union samr_AliasInfo);
1732 return NT_STATUS_NO_MEMORY;
1735 /* find the policy handle. open a policy on it. */
1736 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &sid, &acc_granted, NULL))
1737 return NT_STATUS_INVALID_HANDLE;
1739 status = access_check_samr_function(acc_granted,
1740 SA_RIGHT_ALIAS_LOOKUP_INFO,
1741 "_samr_QueryAliasInfo");
1742 if (!NT_STATUS_IS_OK(status)) {
1747 status = pdb_get_aliasinfo(&sid, &info);
1750 if ( !NT_STATUS_IS_OK(status))
1753 /* FIXME: info contains fstrings */
1754 alias_name = talloc_strdup(r, info.acct_name);
1755 alias_description = talloc_strdup(r, info.acct_desc);
1757 switch (r->in.level) {
1759 init_samr_alias_info1(&alias_info->all,
1764 case ALIASINFODESCRIPTION:
1765 init_samr_alias_info3(&alias_info->description,
1769 return NT_STATUS_INVALID_INFO_CLASS;
1772 *r->out.info = alias_info;
1774 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1776 return NT_STATUS_OK;
1779 /*******************************************************************
1781 ********************************************************************/
1783 NTSTATUS _samr_LookupNames(pipes_struct *p,
1784 struct samr_LookupNames *r)
1788 enum lsa_SidType *type;
1790 int num_rids = r->in.num_names;
1793 struct samr_Ids rids, types;
1795 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1797 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL)) {
1798 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1801 status = access_check_samr_function(acc_granted,
1802 0, /* Don't know the acc_bits yet */
1803 "_samr_LookupNames");
1804 if (!NT_STATUS_IS_OK(status)) {
1808 if (num_rids > MAX_SAM_ENTRIES) {
1809 num_rids = MAX_SAM_ENTRIES;
1810 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids));
1813 rid = talloc_array(p->mem_ctx, uint32, num_rids);
1814 NT_STATUS_HAVE_NO_MEMORY(rid);
1816 type = talloc_array(p->mem_ctx, enum lsa_SidType, num_rids);
1817 NT_STATUS_HAVE_NO_MEMORY(type);
1819 DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1820 sid_string_dbg(&pol_sid)));
1822 for (i = 0; i < num_rids; i++) {
1824 status = NT_STATUS_NONE_MAPPED;
1825 type[i] = SID_NAME_UNKNOWN;
1827 rid[i] = 0xffffffff;
1829 if (sid_check_is_builtin(&pol_sid)) {
1830 if (lookup_builtin_name(r->in.names[i].string,
1833 type[i] = SID_NAME_ALIAS;
1836 lookup_global_sam_name(r->in.names[i].string, 0,
1840 if (type[i] != SID_NAME_UNKNOWN) {
1841 status = NT_STATUS_OK;
1845 rids.count = num_rids;
1848 types.count = num_rids;
1851 *r->out.rids = rids;
1852 *r->out.types = types;
1854 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1859 /*******************************************************************
1860 _samr_ChangePasswordUser2
1861 ********************************************************************/
1863 NTSTATUS _samr_ChangePasswordUser2(pipes_struct *p,
1864 struct samr_ChangePasswordUser2 *r)
1870 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1872 fstrcpy(user_name, r->in.account->string);
1873 fstrcpy(wks, r->in.server->string);
1875 DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1878 * Pass the user through the NT -> unix user mapping
1882 (void)map_username(user_name);
1885 * UNIX username case mangling not required, pass_oem_change
1886 * is case insensitive.
1889 status = pass_oem_change(user_name,
1890 r->in.lm_password->data,
1891 r->in.lm_verifier->hash,
1892 r->in.nt_password->data,
1893 r->in.nt_verifier->hash,
1896 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1901 /*******************************************************************
1902 _samr_ChangePasswordUser3
1903 ********************************************************************/
1905 NTSTATUS _samr_ChangePasswordUser3(pipes_struct *p,
1906 struct samr_ChangePasswordUser3 *r)
1910 const char *wks = NULL;
1911 uint32 reject_reason;
1912 struct samr_DomInfo1 *dominfo = NULL;
1913 struct samr_ChangeReject *reject = NULL;
1915 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
1917 fstrcpy(user_name, r->in.account->string);
1918 if (r->in.server && r->in.server->string) {
1919 wks = r->in.server->string;
1922 DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name, wks));
1925 * Pass the user through the NT -> unix user mapping
1929 (void)map_username(user_name);
1932 * UNIX username case mangling not required, pass_oem_change
1933 * is case insensitive.
1936 status = pass_oem_change(user_name,
1937 r->in.lm_password->data,
1938 r->in.lm_verifier->hash,
1939 r->in.nt_password->data,
1940 r->in.nt_verifier->hash,
1943 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) ||
1944 NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_RESTRICTION)) {
1946 uint32 min_pass_len,pass_hist,password_properties;
1947 time_t u_expire, u_min_age;
1948 NTTIME nt_expire, nt_min_age;
1949 uint32 account_policy_temp;
1951 dominfo = TALLOC_ZERO_P(p->mem_ctx, struct samr_DomInfo1);
1953 return NT_STATUS_NO_MEMORY;
1956 reject = TALLOC_ZERO_P(p->mem_ctx, struct samr_ChangeReject);
1958 return NT_STATUS_NO_MEMORY;
1965 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
1966 min_pass_len = account_policy_temp;
1968 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
1969 pass_hist = account_policy_temp;
1971 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
1972 password_properties = account_policy_temp;
1974 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
1975 u_expire = account_policy_temp;
1977 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
1978 u_min_age = account_policy_temp;
1984 unix_to_nt_time_abs(&nt_expire, u_expire);
1985 unix_to_nt_time_abs(&nt_min_age, u_min_age);
1987 if (lp_check_password_script() && *lp_check_password_script()) {
1988 password_properties |= DOMAIN_PASSWORD_COMPLEX;
1991 init_samr_DomInfo1(dominfo,
1994 password_properties,
1998 reject->reason = reject_reason;
2000 *r->out.dominfo = dominfo;
2001 *r->out.reject = reject;
2004 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2009 /*******************************************************************
2010 makes a SAMR_R_LOOKUP_RIDS structure.
2011 ********************************************************************/
2013 static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
2015 struct lsa_String **lsa_name_array_p)
2017 struct lsa_String *lsa_name_array = NULL;
2020 *lsa_name_array_p = NULL;
2022 if (num_names != 0) {
2023 lsa_name_array = TALLOC_ZERO_ARRAY(ctx, struct lsa_String, num_names);
2024 if (!lsa_name_array) {
2029 for (i = 0; i < num_names; i++) {
2030 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
2031 init_lsa_String(&lsa_name_array[i], names[i]);
2034 *lsa_name_array_p = lsa_name_array;
2039 /*******************************************************************
2041 ********************************************************************/
2043 NTSTATUS _samr_LookupRids(pipes_struct *p,
2044 struct samr_LookupRids *r)
2048 enum lsa_SidType *attrs = NULL;
2049 uint32 *wire_attrs = NULL;
2051 int num_rids = (int)r->in.num_rids;
2054 struct lsa_Strings names_array;
2055 struct samr_Ids types_array;
2056 struct lsa_String *lsa_names = NULL;
2058 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2060 /* find the policy handle. open a policy on it. */
2061 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL))
2062 return NT_STATUS_INVALID_HANDLE;
2064 status = access_check_samr_function(acc_granted,
2065 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
2066 "_samr_LookupRids");
2067 if (!NT_STATUS_IS_OK(status)) {
2071 if (num_rids > 1000) {
2072 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2073 "to samba4 idl this is not possible\n", num_rids));
2074 return NT_STATUS_UNSUCCESSFUL;
2078 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
2079 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, enum lsa_SidType, num_rids);
2080 wire_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
2082 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
2083 return NT_STATUS_NO_MEMORY;
2090 become_root(); /* lookup_sid can require root privs */
2091 status = pdb_lookup_rids(&pol_sid, num_rids, r->in.rids,
2095 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) && (num_rids == 0)) {
2096 status = NT_STATUS_OK;
2099 if (!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
2101 return NT_STATUS_NO_MEMORY;
2104 /* Convert from enum lsa_SidType to uint32 for wire format. */
2105 for (i = 0; i < num_rids; i++) {
2106 wire_attrs[i] = (uint32)attrs[i];
2109 names_array.count = num_rids;
2110 names_array.names = lsa_names;
2112 types_array.count = num_rids;
2113 types_array.ids = wire_attrs;
2115 *r->out.names = names_array;
2116 *r->out.types = types_array;
2118 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2123 /*******************************************************************
2125 ********************************************************************/
2127 NTSTATUS _samr_OpenUser(pipes_struct *p,
2128 struct samr_OpenUser *r)
2130 struct samu *sampass=NULL;
2132 POLICY_HND domain_pol = *r->in.domain_handle;
2133 POLICY_HND *user_pol = r->out.user_handle;
2134 struct samr_info *info = NULL;
2135 SEC_DESC *psd = NULL;
2137 uint32 des_access = r->in.access_mask;
2143 /* find the domain policy handle and get domain SID / access bits in the domain policy. */
2145 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
2146 return NT_STATUS_INVALID_HANDLE;
2148 nt_status = access_check_samr_function(acc_granted,
2149 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2152 if ( !NT_STATUS_IS_OK(nt_status) )
2155 if ( !(sampass = samu_new( p->mem_ctx )) ) {
2156 return NT_STATUS_NO_MEMORY;
2159 /* append the user's RID to it */
2161 if (!sid_append_rid(&sid, r->in.rid))
2162 return NT_STATUS_NO_SUCH_USER;
2164 /* check if access can be granted as requested by client. */
2166 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
2168 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2169 se_map_generic(&des_access, &usr_generic_mapping);
2171 se_priv_copy( &se_rights, &se_machine_account );
2172 se_priv_add( &se_rights, &se_add_users );
2174 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2175 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2176 &acc_granted, "_samr_OpenUser");
2178 if ( !NT_STATUS_IS_OK(nt_status) )
2182 ret=pdb_getsampwsid(sampass, &sid);
2185 /* check that the SID exists in our domain. */
2187 return NT_STATUS_NO_SUCH_USER;
2190 TALLOC_FREE(sampass);
2192 /* associate the user's SID and access bits with the new handle. */
2193 if ((info = get_samr_info_by_sid(&sid)) == NULL)
2194 return NT_STATUS_NO_MEMORY;
2195 info->acc_granted = acc_granted;
2197 /* get a (unique) handle. open a policy on it. */
2198 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
2199 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2201 return NT_STATUS_OK;
2204 /*************************************************************************
2205 *************************************************************************/
2207 static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
2209 struct lsa_BinaryString **_r)
2211 struct lsa_BinaryString *r;
2214 return NT_STATUS_INVALID_PARAMETER;
2217 r = TALLOC_ZERO_P(mem_ctx, struct lsa_BinaryString);
2219 return NT_STATUS_NO_MEMORY;
2222 r->array = TALLOC_ZERO_ARRAY(mem_ctx, uint16_t, blob->length/2);
2224 return NT_STATUS_NO_MEMORY;
2226 memcpy(r->array, blob->data, blob->length);
2227 r->size = blob->length;
2228 r->length = blob->length;
2231 return NT_STATUS_NO_MEMORY;
2236 return NT_STATUS_OK;
2239 /*************************************************************************
2240 get_user_info_7. Safe. Only gives out account_name.
2241 *************************************************************************/
2243 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
2244 struct samr_UserInfo7 *r,
2247 struct samu *smbpass=NULL;
2249 const char *account_name = NULL;
2253 if ( !(smbpass = samu_new( mem_ctx )) ) {
2254 return NT_STATUS_NO_MEMORY;
2258 ret = pdb_getsampwsid(smbpass, user_sid);
2262 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2263 return NT_STATUS_NO_SUCH_USER;
2266 account_name = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
2267 if (!account_name) {
2268 TALLOC_FREE(smbpass);
2269 return NT_STATUS_NO_MEMORY;
2271 TALLOC_FREE(smbpass);
2273 DEBUG(3,("User:[%s]\n", account_name));
2275 init_samr_user_info7(r, account_name);
2277 return NT_STATUS_OK;
2280 /*************************************************************************
2281 get_user_info_9. Only gives out primary group SID.
2282 *************************************************************************/
2284 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
2285 struct samr_UserInfo9 *r,
2288 struct samu *smbpass=NULL;
2293 if ( !(smbpass = samu_new( mem_ctx )) ) {
2294 return NT_STATUS_NO_MEMORY;
2298 ret = pdb_getsampwsid(smbpass, user_sid);
2302 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2303 TALLOC_FREE(smbpass);
2304 return NT_STATUS_NO_SUCH_USER;
2307 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
2309 init_samr_user_info9(r, pdb_get_group_rid(smbpass));
2311 TALLOC_FREE(smbpass);
2313 return NT_STATUS_OK;
2316 /*************************************************************************
2317 get_user_info_16. Safe. Only gives out acb bits.
2318 *************************************************************************/
2320 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
2321 struct samr_UserInfo16 *r,
2324 struct samu *smbpass=NULL;
2329 if ( !(smbpass = samu_new( mem_ctx )) ) {
2330 return NT_STATUS_NO_MEMORY;
2334 ret = pdb_getsampwsid(smbpass, user_sid);
2338 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2339 TALLOC_FREE(smbpass);
2340 return NT_STATUS_NO_SUCH_USER;
2343 DEBUG(3,("User:[%s]\n", pdb_get_username(smbpass) ));
2345 init_samr_user_info16(r, pdb_get_acct_ctrl(smbpass));
2347 TALLOC_FREE(smbpass);
2349 return NT_STATUS_OK;
2352 /*************************************************************************
2353 get_user_info_18. OK - this is the killer as it gives out password info.
2354 Ensure that this is only allowed on an encrypted connection with a root
2356 *************************************************************************/
2358 static NTSTATUS get_user_info_18(pipes_struct *p,
2359 TALLOC_CTX *mem_ctx,
2360 struct samr_UserInfo18 *r,
2363 struct samu *smbpass=NULL;
2368 if (p->auth.auth_type != PIPE_AUTH_TYPE_NTLMSSP || p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
2369 return NT_STATUS_ACCESS_DENIED;
2372 if (p->auth.auth_level != PIPE_AUTH_LEVEL_PRIVACY) {
2373 return NT_STATUS_ACCESS_DENIED;
2377 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2380 if ( !(smbpass = samu_new( mem_ctx )) ) {
2381 return NT_STATUS_NO_MEMORY;
2384 ret = pdb_getsampwsid(smbpass, user_sid);
2387 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
2388 TALLOC_FREE(smbpass);
2389 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
2392 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
2394 if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
2395 TALLOC_FREE(smbpass);
2396 return NT_STATUS_ACCOUNT_DISABLED;
2399 init_samr_user_info18(r, pdb_get_lanman_passwd(smbpass),
2400 pdb_get_nt_passwd(smbpass));
2402 TALLOC_FREE(smbpass);
2404 return NT_STATUS_OK;
2407 /*************************************************************************
2409 *************************************************************************/
2411 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
2412 struct samr_UserInfo20 *r,
2415 struct samu *sampass=NULL;
2417 const char *munged_dial = NULL;
2420 struct lsa_BinaryString *parameters = NULL;
2424 if ( !(sampass = samu_new( mem_ctx )) ) {
2425 return NT_STATUS_NO_MEMORY;
2429 ret = pdb_getsampwsid(sampass, user_sid);
2433 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2434 TALLOC_FREE(sampass);
2435 return NT_STATUS_NO_SUCH_USER;
2438 munged_dial = pdb_get_munged_dial(sampass);
2440 samr_clear_sam_passwd(sampass);
2442 DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
2443 munged_dial, (int)strlen(munged_dial)));
2446 blob = base64_decode_data_blob(munged_dial);
2448 blob = data_blob_string_const_null("");
2451 status = init_samr_parameters_string(mem_ctx, &blob, ¶meters);
2452 data_blob_free(&blob);
2453 TALLOC_FREE(sampass);
2454 if (!NT_STATUS_IS_OK(status)) {
2458 init_samr_user_info20(r, parameters);
2460 return NT_STATUS_OK;
2464 /*************************************************************************
2466 *************************************************************************/
2468 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
2469 struct samr_UserInfo21 *r,
2471 DOM_SID *domain_sid)
2474 struct samu *pw = NULL;
2476 const DOM_SID *sid_user, *sid_group;
2477 uint32_t rid, primary_gid;
2478 NTTIME last_logon, last_logoff, last_password_change,
2479 acct_expiry, allow_password_change, force_password_change;
2480 time_t must_change_time;
2481 uint8_t password_expired;
2482 const char *account_name, *full_name, *home_directory, *home_drive,
2483 *logon_script, *profile_path, *description,
2484 *workstations, *comment;
2485 struct samr_LogonHours logon_hours;
2486 struct lsa_BinaryString *parameters = NULL;
2487 const char *munged_dial = NULL;
2492 if (!(pw = samu_new(mem_ctx))) {
2493 return NT_STATUS_NO_MEMORY;
2497 ret = pdb_getsampwsid(pw, user_sid);
2501 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
2503 return NT_STATUS_NO_SUCH_USER;
2506 samr_clear_sam_passwd(pw);
2508 DEBUG(3,("User:[%s]\n", pdb_get_username(pw)));
2510 sid_user = pdb_get_user_sid(pw);
2512 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2513 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2514 "the domain sid %s. Failing operation.\n",
2515 pdb_get_username(pw), sid_string_dbg(sid_user),
2516 sid_string_dbg(domain_sid)));
2518 return NT_STATUS_UNSUCCESSFUL;
2522 sid_group = pdb_get_group_sid(pw);
2525 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2526 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2527 "which conflicts with the domain sid %s. Failing operation.\n",
2528 pdb_get_username(pw), sid_string_dbg(sid_group),
2529 sid_string_dbg(domain_sid)));
2531 return NT_STATUS_UNSUCCESSFUL;
2534 unix_to_nt_time(&last_logon, pdb_get_logon_time(pw));
2535 unix_to_nt_time(&last_logoff, pdb_get_logoff_time(pw));
2536 unix_to_nt_time(&acct_expiry, pdb_get_kickoff_time(pw));
2537 unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(pw));
2538 unix_to_nt_time(&allow_password_change, pdb_get_pass_can_change_time(pw));
2540 must_change_time = pdb_get_pass_must_change_time(pw);
2541 if (must_change_time == get_time_t_max()) {
2542 unix_to_nt_time_abs(&force_password_change, must_change_time);
2544 unix_to_nt_time(&force_password_change, must_change_time);
2547 if (pdb_get_pass_must_change_time(pw) == 0) {
2548 password_expired = PASS_MUST_CHANGE_AT_NEXT_LOGON;
2550 password_expired = 0;
2553 munged_dial = pdb_get_munged_dial(pw);
2555 blob = base64_decode_data_blob(munged_dial);
2557 blob = data_blob_string_const_null("");
2560 status = init_samr_parameters_string(mem_ctx, &blob, ¶meters);
2561 data_blob_free(&blob);
2562 if (!NT_STATUS_IS_OK(status)) {
2567 account_name = talloc_strdup(mem_ctx, pdb_get_username(pw));
2568 full_name = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2569 home_directory = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2570 home_drive = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2571 logon_script = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2572 profile_path = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2573 description = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2574 workstations = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2575 comment = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2577 logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2581 Look at a user on a real NT4 PDC with usrmgr, press
2582 'ok'. Then you will see that fields_present is set to
2583 0x08f827fa. Look at the user immediately after that again,
2584 and you will see that 0x00fffff is returned. This solves
2585 the problem that you get access denied after having looked
2592 init_samr_user_info21(r,
2595 last_password_change,
2597 allow_password_change,
2598 force_password_change,
2611 pdb_get_acct_ctrl(pw),
2612 pdb_build_fields_present(pw),
2614 pdb_get_bad_password_count(pw),
2615 pdb_get_logon_count(pw),
2616 0, /* country_code */
2618 0, /* nt_password_set */
2619 0, /* lm_password_set */
2623 return NT_STATUS_OK;
2626 /*******************************************************************
2628 ********************************************************************/
2630 NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
2631 struct samr_QueryUserInfo *r)
2634 union samr_UserInfo *user_info = NULL;
2635 struct samr_info *info = NULL;
2639 /* search for the handle */
2640 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info))
2641 return NT_STATUS_INVALID_HANDLE;
2643 status = access_check_samr_function(info->acc_granted,
2644 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2645 "_samr_QueryUserInfo");
2646 if (!NT_STATUS_IS_OK(status)) {
2650 domain_sid = info->sid;
2652 sid_split_rid(&domain_sid, &rid);
2654 if (!sid_check_is_in_our_domain(&info->sid))
2655 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2657 DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
2658 sid_string_dbg(&info->sid)));
2660 user_info = TALLOC_ZERO_P(p->mem_ctx, union samr_UserInfo);
2662 return NT_STATUS_NO_MEMORY;
2665 DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
2667 switch (r->in.level) {
2669 status = get_user_info_7(p->mem_ctx, &user_info->info7, &info->sid);
2670 if (!NT_STATUS_IS_OK(status)) {
2675 status = get_user_info_9(p->mem_ctx, &user_info->info9, &info->sid);
2676 if (!NT_STATUS_IS_OK(status)) {
2681 status = get_user_info_16(p->mem_ctx, &user_info->info16, &info->sid);
2682 if (!NT_STATUS_IS_OK(status)) {
2688 status = get_user_info_18(p, p->mem_ctx, &user_info->info18, &info->sid);
2689 if (!NT_STATUS_IS_OK(status)) {
2695 status = get_user_info_20(p->mem_ctx, &user_info->info20, &info->sid);
2696 if (!NT_STATUS_IS_OK(status)) {
2702 status = get_user_info_21(p->mem_ctx, &user_info->info21,
2703 &info->sid, &domain_sid);
2704 if (!NT_STATUS_IS_OK(status)) {
2710 return NT_STATUS_INVALID_INFO_CLASS;
2713 *r->out.info = user_info;
2715 DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
2720 /*******************************************************************
2721 _samr_GetGroupsForUser
2722 ********************************************************************/
2724 NTSTATUS _samr_GetGroupsForUser(pipes_struct *p,
2725 struct samr_GetGroupsForUser *r)
2727 struct samu *sam_pass=NULL;
2730 struct samr_RidWithAttribute dom_gid;
2731 struct samr_RidWithAttribute *gids = NULL;
2732 uint32 primary_group_rid;
2733 size_t num_groups = 0;
2739 bool success = False;
2741 struct samr_RidWithAttributeArray *rids = NULL;
2744 * from the SID in the request:
2745 * we should send back the list of DOMAIN GROUPS
2746 * the user is a member of
2748 * and only the DOMAIN GROUPS
2749 * no ALIASES !!! neither aliases of the domain
2750 * nor aliases of the builtin SID
2755 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2757 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidWithAttributeArray);
2759 return NT_STATUS_NO_MEMORY;
2762 /* find the policy handle. open a policy on it. */
2763 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &sid, &acc_granted, NULL))
2764 return NT_STATUS_INVALID_HANDLE;
2766 result = access_check_samr_function(acc_granted,
2767 SAMR_USER_ACCESS_GET_GROUPS,
2768 "_samr_GetGroupsForUser");
2769 if (!NT_STATUS_IS_OK(result)) {
2773 if (!sid_check_is_in_our_domain(&sid))
2774 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2776 if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
2777 return NT_STATUS_NO_MEMORY;
2781 ret = pdb_getsampwsid(sam_pass, &sid);
2785 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
2786 sid_string_dbg(&sid)));
2787 return NT_STATUS_NO_SUCH_USER;
2792 /* make both calls inside the root block */
2794 result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
2795 &sids, &unix_gids, &num_groups);
2796 if ( NT_STATUS_IS_OK(result) ) {
2797 success = sid_peek_check_rid(get_global_sam_sid(),
2798 pdb_get_group_sid(sam_pass),
2799 &primary_group_rid);
2803 if (!NT_STATUS_IS_OK(result)) {
2804 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2805 sid_string_dbg(&sid)));
2810 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
2811 sid_string_dbg(pdb_get_group_sid(sam_pass)),
2812 pdb_get_username(sam_pass)));
2813 TALLOC_FREE(sam_pass);
2814 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2820 dom_gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
2822 dom_gid.rid = primary_group_rid;
2823 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2825 for (i=0; i<num_groups; i++) {
2827 if (!sid_peek_check_rid(get_global_sam_sid(),
2828 &(sids[i]), &dom_gid.rid)) {
2829 DEBUG(10, ("Found sid %s not in our domain\n",
2830 sid_string_dbg(&sids[i])));
2834 if (dom_gid.rid == primary_group_rid) {
2835 /* We added the primary group directly from the
2836 * sam_account. The other SIDs are unique from
2837 * enum_group_memberships */
2841 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2844 rids->count = num_gids;
2847 *r->out.rids = rids;
2849 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2854 /*******************************************************************
2855 _samr_QueryDomainInfo
2856 ********************************************************************/
2858 NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
2859 struct samr_QueryDomainInfo *r)
2861 NTSTATUS status = NT_STATUS_OK;
2862 struct samr_info *info = NULL;
2863 union samr_DomainInfo *dom_info;
2864 uint32 min_pass_len,pass_hist,password_properties;
2865 time_t u_expire, u_min_age;
2866 NTTIME nt_expire, nt_min_age;
2868 time_t u_lock_duration, u_reset_time;
2869 NTTIME nt_lock_duration, nt_reset_time;
2874 uint32 account_policy_temp;
2879 uint32 num_users=0, num_groups=0, num_aliases=0;
2881 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
2883 dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
2885 return NT_STATUS_NO_MEMORY;
2888 /* find the policy handle. open a policy on it. */
2889 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
2890 return NT_STATUS_INVALID_HANDLE;
2893 status = access_check_samr_function(info->acc_granted,
2894 SAMR_ACCESS_OPEN_DOMAIN,
2895 "_samr_QueryDomainInfo" );
2897 if ( !NT_STATUS_IS_OK(status) )
2900 switch (r->in.level) {
2907 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
2908 min_pass_len = account_policy_temp;
2910 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
2911 pass_hist = account_policy_temp;
2913 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
2914 password_properties = account_policy_temp;
2916 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2917 u_expire = account_policy_temp;
2919 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2920 u_min_age = account_policy_temp;
2926 unix_to_nt_time_abs(&nt_expire, u_expire);
2927 unix_to_nt_time_abs(&nt_min_age, u_min_age);
2929 if (lp_check_password_script() && *lp_check_password_script()) {
2930 password_properties |= DOMAIN_PASSWORD_COMPLEX;
2933 init_samr_DomInfo1(&dom_info->info1,
2934 (uint16)min_pass_len,
2936 password_properties,
2946 num_users = count_sam_users(info->disp_info, ACB_NORMAL);
2947 num_groups = count_sam_groups(info->disp_info);
2948 num_aliases = count_sam_aliases(info->disp_info);
2950 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &account_policy_temp);
2951 u_logout = account_policy_temp;
2953 unix_to_nt_time_abs(&nt_logout, u_logout);
2955 if (!pdb_get_seq_num(&seq_num))
2956 seq_num = time(NULL);
2962 server_role = ROLE_DOMAIN_PDC;
2963 if (lp_server_role() == ROLE_DOMAIN_BDC)
2964 server_role = ROLE_DOMAIN_BDC;
2966 init_samr_DomGeneralInformation(&dom_info->general,
2987 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &ul);
2988 u_logout = (time_t)ul;
2995 unix_to_nt_time_abs(&nt_logout, u_logout);
2997 init_samr_DomInfo3(&dom_info->info3,
3002 init_samr_DomOEMInformation(&dom_info->oem,
3006 init_samr_DomInfo5(&dom_info->info5,
3007 get_global_sam_name());
3010 /* NT returns its own name when a PDC. win2k and later
3011 * only the name of the PDC if itself is a BDC (samba4
3013 init_samr_DomInfo6(&dom_info->info6,
3017 server_role = ROLE_DOMAIN_PDC;
3018 if (lp_server_role() == ROLE_DOMAIN_BDC)
3019 server_role = ROLE_DOMAIN_BDC;
3021 init_samr_DomInfo7(&dom_info->info7,
3030 if (!pdb_get_seq_num(&seq_num)) {
3031 seq_num = time(NULL);
3038 init_samr_DomInfo8(&dom_info->info8,
3048 pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3049 u_lock_duration = account_policy_temp;
3050 if (u_lock_duration != -1) {
3051 u_lock_duration *= 60;
3054 pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
3055 u_reset_time = account_policy_temp * 60;
3057 pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
3058 lockout = account_policy_temp;
3064 unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
3065 unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
3067 init_samr_DomInfo12(&dom_info->info12,
3073 return NT_STATUS_INVALID_INFO_CLASS;
3076 *r->out.info = dom_info;
3078 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3083 /* W2k3 seems to use the same check for all 3 objects that can be created via
3084 * SAMR, if you try to create for example "Dialup" as an alias it says
3085 * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
3088 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
3090 enum lsa_SidType type;
3093 DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
3096 /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
3097 * whether the name already exists */
3098 result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
3099 NULL, NULL, NULL, &type);
3103 DEBUG(10, ("%s does not exist, can create it\n", new_name));
3104 return NT_STATUS_OK;
3107 DEBUG(5, ("trying to create %s, exists as %s\n",
3108 new_name, sid_type_lookup(type)));
3110 if (type == SID_NAME_DOM_GRP) {
3111 return NT_STATUS_GROUP_EXISTS;
3113 if (type == SID_NAME_ALIAS) {
3114 return NT_STATUS_ALIAS_EXISTS;
3117 /* Yes, the default is NT_STATUS_USER_EXISTS */
3118 return NT_STATUS_USER_EXISTS;
3121 /*******************************************************************
3123 ********************************************************************/
3125 NTSTATUS _samr_CreateUser2(pipes_struct *p,
3126 struct samr_CreateUser2 *r)
3128 const char *account = NULL;
3130 POLICY_HND dom_pol = *r->in.domain_handle;
3131 uint32_t acb_info = r->in.acct_flags;
3132 POLICY_HND *user_pol = r->out.user_handle;
3133 struct samr_info *info = NULL;
3138 /* check this, when giving away 'add computer to domain' privs */
3139 uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
3140 bool can_add_account = False;
3142 DISP_INFO *disp_info = NULL;
3144 /* Get the domain SID stored in the domain policy */
3145 if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted,
3147 return NT_STATUS_INVALID_HANDLE;
3149 nt_status = access_check_samr_function(acc_granted,
3150 SAMR_DOMAIN_ACCESS_CREATE_USER,
3151 "_samr_CreateUser2");
3152 if (!NT_STATUS_IS_OK(nt_status)) {
3156 if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
3157 acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
3158 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3159 this parameter is not an account type */
3160 return NT_STATUS_INVALID_PARAMETER;
3163 account = r->in.account_name->string;
3164 if (account == NULL) {
3165 return NT_STATUS_NO_MEMORY;
3168 nt_status = can_create(p->mem_ctx, account);
3169 if (!NT_STATUS_IS_OK(nt_status)) {
3173 /* determine which user right we need to check based on the acb_info */
3175 if ( acb_info & ACB_WSTRUST )
3177 se_priv_copy( &se_rights, &se_machine_account );
3178 can_add_account = user_has_privileges(
3179 p->pipe_user.nt_user_token, &se_rights );
3181 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3182 account for domain trusts and changes the ACB flags later */
3183 else if ( acb_info & ACB_NORMAL &&
3184 (account[strlen(account)-1] != '$') )
3186 se_priv_copy( &se_rights, &se_add_users );
3187 can_add_account = user_has_privileges(
3188 p->pipe_user.nt_user_token, &se_rights );
3190 else /* implicit assumption of a BDC or domain trust account here
3191 * (we already check the flags earlier) */
3193 if ( lp_enable_privileges() ) {
3194 /* only Domain Admins can add a BDC or domain trust */
3195 se_priv_copy( &se_rights, &se_priv_none );
3196 can_add_account = nt_token_check_domain_rid(
3197 p->pipe_user.nt_user_token,
3198 DOMAIN_GROUP_RID_ADMINS );
3202 DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3203 uidtoname(p->pipe_user.ut.uid),
3204 can_add_account ? "True":"False" ));
3206 /********** BEGIN Admin BLOCK **********/
3208 if ( can_add_account )
3211 nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
3214 if ( can_add_account )
3217 /********** END Admin BLOCK **********/
3219 /* now check for failure */
3221 if ( !NT_STATUS_IS_OK(nt_status) )
3224 /* Get the user's SID */
3226 sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
3228 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3230 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
3231 &sid, SAMR_USR_RIGHTS_WRITE_PW);
3232 se_map_generic(&des_access, &usr_generic_mapping);
3234 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3235 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
3236 &acc_granted, "_samr_CreateUser2");
3238 if ( !NT_STATUS_IS_OK(nt_status) ) {
3242 /* associate the user's SID with the new handle. */
3243 if ((info = get_samr_info_by_sid(&sid)) == NULL) {
3244 return NT_STATUS_NO_MEMORY;
3249 info->acc_granted = acc_granted;
3251 /* get a (unique) handle. open a policy on it. */
3252 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
3253 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3256 /* After a "set" ensure we have no cached display info. */
3257 force_flush_samr_cache(info->disp_info);
3259 *r->out.access_granted = acc_granted;
3261 return NT_STATUS_OK;
3264 /*******************************************************************
3266 ********************************************************************/
3268 NTSTATUS _samr_Connect(pipes_struct *p,
3269 struct samr_Connect *r)
3271 struct samr_info *info = NULL;
3272 uint32 des_access = r->in.access_mask;
3276 if (!pipe_access_check(p)) {
3277 DEBUG(3, ("access denied to _samr_Connect\n"));
3278 return NT_STATUS_ACCESS_DENIED;
3281 /* set up the SAMR connect_anon response */
3283 /* associate the user's SID with the new handle. */
3284 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3285 return NT_STATUS_NO_MEMORY;
3287 /* don't give away the farm but this is probably ok. The SAMR_ACCESS_ENUM_DOMAINS
3288 was observed from a win98 client trying to enumerate users (when configured
3289 user level access control on shares) --jerry */
3291 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3293 se_map_generic( &des_access, &sam_generic_mapping );
3294 info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_OPEN_DOMAIN);
3296 /* get a (unique) handle. open a policy on it. */
3297 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3298 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3300 return NT_STATUS_OK;
3303 /*******************************************************************
3305 ********************************************************************/
3307 NTSTATUS _samr_Connect2(pipes_struct *p,
3308 struct samr_Connect2 *r)
3310 struct samr_info *info = NULL;
3311 SEC_DESC *psd = NULL;
3313 uint32 des_access = r->in.access_mask;
3318 DEBUG(5,("_samr_Connect2: %d\n", __LINE__));
3322 if (!pipe_access_check(p)) {
3323 DEBUG(3, ("access denied to _samr_Connect2\n"));
3324 return NT_STATUS_ACCESS_DENIED;
3327 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3329 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3330 se_map_generic(&des_access, &sam_generic_mapping);
3332 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3333 NULL, 0, des_access, &acc_granted, "_samr_Connect2");
3335 if ( !NT_STATUS_IS_OK(nt_status) )
3338 /* associate the user's SID and access granted with the new handle. */
3339 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3340 return NT_STATUS_NO_MEMORY;
3342 info->acc_granted = acc_granted;
3343 info->status = r->in.access_mask; /* this looks so wrong... - gd */
3345 /* get a (unique) handle. open a policy on it. */
3346 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3347 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3349 DEBUG(5,("_samr_Connect2: %d\n", __LINE__));
3354 /*******************************************************************
3356 ********************************************************************/
3358 NTSTATUS _samr_Connect4(pipes_struct *p,
3359 struct samr_Connect4 *r)
3361 struct samr_info *info = NULL;
3362 SEC_DESC *psd = NULL;
3364 uint32 des_access = r->in.access_mask;
3369 DEBUG(5,("_samr_Connect4: %d\n", __LINE__));
3373 if (!pipe_access_check(p)) {
3374 DEBUG(3, ("access denied to samr_Connect4\n"));
3375 return NT_STATUS_ACCESS_DENIED;
3378 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3380 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3381 se_map_generic(&des_access, &sam_generic_mapping);
3383 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3384 NULL, 0, des_access, &acc_granted, "_samr_Connect4");
3386 if ( !NT_STATUS_IS_OK(nt_status) )
3389 /* associate the user's SID and access granted with the new handle. */
3390 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3391 return NT_STATUS_NO_MEMORY;
3393 info->acc_granted = acc_granted;
3394 info->status = r->in.access_mask; /* ??? */
3396 /* get a (unique) handle. open a policy on it. */
3397 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3398 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3400 DEBUG(5,("_samr_Connect4: %d\n", __LINE__));
3402 return NT_STATUS_OK;
3405 /*******************************************************************
3407 ********************************************************************/
3409 NTSTATUS _samr_Connect5(pipes_struct *p,
3410 struct samr_Connect5 *r)
3412 struct samr_info *info = NULL;
3413 SEC_DESC *psd = NULL;
3415 uint32 des_access = r->in.access_mask;
3418 struct samr_ConnectInfo1 info1;
3420 DEBUG(5,("_samr_Connect5: %d\n", __LINE__));
3424 if (!pipe_access_check(p)) {
3425 DEBUG(3, ("access denied to samr_Connect5\n"));
3426 return NT_STATUS_ACCESS_DENIED;
3429 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3431 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3432 se_map_generic(&des_access, &sam_generic_mapping);
3434 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3435 NULL, 0, des_access, &acc_granted, "_samr_Connect5");
3437 if ( !NT_STATUS_IS_OK(nt_status) )
3440 /* associate the user's SID and access granted with the new handle. */
3441 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3442 return NT_STATUS_NO_MEMORY;
3444 info->acc_granted = acc_granted;
3445 info->status = r->in.access_mask; /* ??? */
3447 /* get a (unique) handle. open a policy on it. */
3448 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3449 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3451 DEBUG(5,("_samr_Connect5: %d\n", __LINE__));
3453 info1.client_version = SAMR_CONNECT_AFTER_W2K;
3456 *r->out.level_out = 1;
3457 r->out.info_out->info1 = info1;
3459 return NT_STATUS_OK;
3462 /**********************************************************************
3464 **********************************************************************/
3466 NTSTATUS _samr_LookupDomain(pipes_struct *p,
3467 struct samr_LookupDomain *r)
3469 NTSTATUS status = NT_STATUS_OK;
3470 struct samr_info *info;
3471 const char *domain_name;
3472 DOM_SID *sid = NULL;
3474 if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
3475 return NT_STATUS_INVALID_HANDLE;
3477 /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
3478 Reverted that change so we will work with RAS servers again */
3480 status = access_check_samr_function(info->acc_granted,
3481 SAMR_ACCESS_OPEN_DOMAIN,
3482 "_samr_LookupDomain");
3483 if (!NT_STATUS_IS_OK(status)) {
3487 domain_name = r->in.domain_name->string;
3489 sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
3491 return NT_STATUS_NO_MEMORY;
3494 if (strequal(domain_name, builtin_domain_name())) {
3495 sid_copy(sid, &global_sid_Builtin);
3497 if (!secrets_fetch_domain_sid(domain_name, sid)) {
3498 status = NT_STATUS_NO_SUCH_DOMAIN;
3502 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
3503 sid_string_dbg(sid)));
3510 /**********************************************************************
3512 **********************************************************************/
3514 NTSTATUS _samr_EnumDomains(pipes_struct *p,
3515 struct samr_EnumDomains *r)
3518 struct samr_info *info;
3519 uint32_t num_entries = 2;
3520 struct samr_SamEntry *entry_array = NULL;
3521 struct samr_SamArray *sam;
3523 if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
3524 return NT_STATUS_INVALID_HANDLE;
3526 status = access_check_samr_function(info->acc_granted,
3527 SAMR_ACCESS_ENUM_DOMAINS,
3528 "_samr_EnumDomains");
3529 if (!NT_STATUS_IS_OK(status)) {
3533 sam = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
3535 return NT_STATUS_NO_MEMORY;
3538 entry_array = TALLOC_ZERO_ARRAY(p->mem_ctx,
3539 struct samr_SamEntry,
3542 return NT_STATUS_NO_MEMORY;
3545 entry_array[0].idx = 0;
3546 init_lsa_String(&entry_array[0].name, get_global_sam_name());
3548 entry_array[1].idx = 1;
3549 init_lsa_String(&entry_array[1].name, "Builtin");
3551 sam->count = num_entries;
3552 sam->entries = entry_array;
3555 *r->out.num_entries = num_entries;
3560 /*******************************************************************
3562 ********************************************************************/
3564 NTSTATUS _samr_OpenAlias(pipes_struct *p,
3565 struct samr_OpenAlias *r)
3568 POLICY_HND domain_pol = *r->in.domain_handle;
3569 uint32 alias_rid = r->in.rid;
3570 POLICY_HND *alias_pol = r->out.alias_handle;
3571 struct samr_info *info = NULL;
3572 SEC_DESC *psd = NULL;
3574 uint32 des_access = r->in.access_mask;
3579 /* find the domain policy and get the SID / access bits stored in the domain policy */
3581 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
3582 return NT_STATUS_INVALID_HANDLE;
3584 status = access_check_samr_function(acc_granted,
3585 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
3588 if ( !NT_STATUS_IS_OK(status) )
3591 /* append the alias' RID to it */
3593 if (!sid_append_rid(&sid, alias_rid))
3594 return NT_STATUS_NO_SUCH_ALIAS;
3596 /*check if access can be granted as requested by client. */
3598 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3600 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
3601 se_map_generic(&des_access,&ali_generic_mapping);
3603 se_priv_copy( &se_rights, &se_add_users );
3606 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3607 &se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
3608 &acc_granted, "_samr_OpenAlias");
3610 if ( !NT_STATUS_IS_OK(status) )
3614 /* Check we actually have the requested alias */
3615 enum lsa_SidType type;
3620 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
3623 if (!result || (type != SID_NAME_ALIAS)) {
3624 return NT_STATUS_NO_SUCH_ALIAS;
3627 /* make sure there is a mapping */
3629 if ( !sid_to_gid( &sid, &gid ) ) {
3630 return NT_STATUS_NO_SUCH_ALIAS;
3635 /* associate the alias SID with the new handle. */
3636 if ((info = get_samr_info_by_sid(&sid)) == NULL)
3637 return NT_STATUS_NO_MEMORY;
3639 info->acc_granted = acc_granted;
3641 /* get a (unique) handle. open a policy on it. */
3642 if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
3643 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3645 return NT_STATUS_OK;
3648 /*******************************************************************
3650 ********************************************************************/
3652 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
3653 struct samr_UserInfo7 *id7,
3659 DEBUG(5, ("set_user_info_7: NULL id7\n"));
3661 return NT_STATUS_ACCESS_DENIED;
3664 if (!id7->account_name.string) {
3665 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
3667 return NT_STATUS_ACCESS_DENIED;
3670 /* check to see if the new username already exists. Note: we can't
3671 reliably lock all backends, so there is potentially the
3672 possibility that a user can be created in between this check and
3673 the rename. The rename should fail, but may not get the
3674 exact same failure status code. I think this is small enough
3675 of a window for this type of operation and the results are
3676 simply that the rename fails with a slightly different status
3677 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3679 rc = can_create(mem_ctx, id7->account_name.string);
3680 if (!NT_STATUS_IS_OK(rc)) {
3684 rc = pdb_rename_sam_account(pwd, id7->account_name.string);
3690 /*******************************************************************
3692 ********************************************************************/
3694 static bool set_user_info_16(struct samr_UserInfo16 *id16,
3698 DEBUG(5, ("set_user_info_16: NULL id16\n"));
3703 /* FIX ME: check if the value is really changed --metze */
3704 if (!pdb_set_acct_ctrl(pwd, id16->acct_flags, PDB_CHANGED)) {
3709 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3719 /*******************************************************************
3721 ********************************************************************/
3723 static bool set_user_info_18(struct samr_UserInfo18 *id18,
3727 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
3732 if (!pdb_set_lanman_passwd (pwd, id18->lm_pwd.hash, PDB_CHANGED)) {
3736 if (!pdb_set_nt_passwd (pwd, id18->nt_pwd.hash, PDB_CHANGED)) {
3740 if (!pdb_set_pass_last_set_time (pwd, time(NULL), PDB_CHANGED)) {
3745 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3754 /*******************************************************************
3756 ********************************************************************/
3758 static bool set_user_info_20(struct samr_UserInfo20 *id20,
3762 DEBUG(5, ("set_user_info_20: NULL id20\n"));
3766 copy_id20_to_sam_passwd(pwd, id20);
3768 /* write the change out */
3769 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3779 /*******************************************************************
3781 ********************************************************************/
3783 static NTSTATUS set_user_info_21(TALLOC_CTX *mem_ctx,
3784 struct samr_UserInfo21 *id21,
3790 DEBUG(5, ("set_user_info_21: NULL id21\n"));
3791 return NT_STATUS_INVALID_PARAMETER;
3794 /* we need to separately check for an account rename first */
3796 if (id21->account_name.string &&
3797 (!strequal(id21->account_name.string, pdb_get_username(pwd))))
3800 /* check to see if the new username already exists. Note: we can't
3801 reliably lock all backends, so there is potentially the
3802 possibility that a user can be created in between this check and
3803 the rename. The rename should fail, but may not get the
3804 exact same failure status code. I think this is small enough
3805 of a window for this type of operation and the results are
3806 simply that the rename fails with a slightly different status
3807 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3809 status = can_create(mem_ctx, id21->account_name.string);
3810 if (!NT_STATUS_IS_OK(status)) {
3814 status = pdb_rename_sam_account(pwd, id21->account_name.string);
3816 if (!NT_STATUS_IS_OK(status)) {
3817 DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
3818 nt_errstr(status)));
3823 /* set the new username so that later
3824 functions can work on the new account */
3825 pdb_set_username(pwd, id21->account_name.string, PDB_SET);
3828 copy_id21_to_sam_passwd("INFO_21", pwd, id21);
3831 * The funny part about the previous two calls is
3832 * that pwd still has the password hashes from the
3833 * passdb entry. These have not been updated from
3834 * id21. I don't know if they need to be set. --jerry
3837 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
3838 status = pdb_set_unix_primary_group(mem_ctx, pwd);
3839 if ( !NT_STATUS_IS_OK(status) ) {
3844 /* Don't worry about writing out the user account since the
3845 primary group SID is generated solely from the user's Unix
3848 /* write the change out */
3849 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3856 return NT_STATUS_OK;
3859 /*******************************************************************
3861 ********************************************************************/
3863 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
3864 struct samr_UserInfo23 *id23,
3867 char *plaintext_buf = NULL;
3873 DEBUG(5, ("set_user_info_23: NULL id23\n"));
3874 return NT_STATUS_INVALID_PARAMETER;
3877 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
3878 pdb_get_username(pwd)));
3880 acct_ctrl = pdb_get_acct_ctrl(pwd);
3882 if (!decode_pw_buffer(mem_ctx,
3883 id23->password.data,
3888 return NT_STATUS_INVALID_PARAMETER;
3891 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3893 return NT_STATUS_ACCESS_DENIED;
3896 copy_id23_to_sam_passwd(pwd, id23);
3898 /* if it's a trust account, don't update /etc/passwd */
3899 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3900 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3901 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3902 DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n"));
3904 /* update the UNIX password */
3905 if (lp_unix_password_sync() ) {
3906 struct passwd *passwd;
3907 if (pdb_get_username(pwd) == NULL) {
3908 DEBUG(1, ("chgpasswd: User without name???\n"));
3910 return NT_STATUS_ACCESS_DENIED;
3913 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3914 if (passwd == NULL) {
3915 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3918 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3920 return NT_STATUS_ACCESS_DENIED;
3922 TALLOC_FREE(passwd);
3926 memset(plaintext_buf, '\0', strlen(plaintext_buf));
3928 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
3929 (!NT_STATUS_IS_OK(status = pdb_set_unix_primary_group(mem_ctx,
3935 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3942 return NT_STATUS_OK;
3945 /*******************************************************************
3947 ********************************************************************/
3949 static bool set_user_info_pw(uint8 *pass, struct samu *pwd,
3953 char *plaintext_buf = NULL;
3955 time_t last_set_time;
3956 enum pdb_value_state last_set_state;
3958 DEBUG(5, ("Attempting administrator password change for user %s\n",
3959 pdb_get_username(pwd)));
3961 acct_ctrl = pdb_get_acct_ctrl(pwd);
3962 /* we need to know if it's expired, because this is an admin change, not a
3963 user change, so it's still expired when we're done */
3964 last_set_state = pdb_get_init_flags(pwd, PDB_PASSLASTSET);
3965 last_set_time = pdb_get_pass_last_set_time(pwd);
3967 if (!decode_pw_buffer(talloc_tos(),
3976 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3981 /* if it's a trust account, don't update /etc/passwd */
3982 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3983 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3984 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3985 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
3987 /* update the UNIX password */
3988 if (lp_unix_password_sync()) {
3989 struct passwd *passwd;
3991 if (pdb_get_username(pwd) == NULL) {
3992 DEBUG(1, ("chgpasswd: User without name???\n"));
3997 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3998 if (passwd == NULL) {
3999 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
4002 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
4006 TALLOC_FREE(passwd);
4010 memset(plaintext_buf, '\0', strlen(plaintext_buf));
4013 * A level 25 change does reset the pwdlastset field, a level 24
4014 * change does not. I know this is probably not the full story, but
4015 * it is needed to make XP join LDAP correctly, without it the later
4016 * auth2 check can fail with PWD_MUST_CHANGE.
4020 * restore last set time as this is an admin change, not a
4023 pdb_set_pass_last_set_time (pwd, last_set_time,
4027 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4029 /* update the SAMBA password */
4030 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
4040 /*******************************************************************
4042 ********************************************************************/
4044 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
4045 struct samr_UserInfo25 *id25,
4051 DEBUG(5, ("set_user_info_25: NULL id25\n"));
4052 return NT_STATUS_INVALID_PARAMETER;
4055 copy_id25_to_sam_passwd(pwd, id25);
4057 /* write the change out */
4058 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4064 * We need to "pdb_update_sam_account" before the unix primary group
4065 * is set, because the idealx scripts would also change the
4066 * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4067 * the delete explicit / add explicit, which would then fail to find
4068 * the previous primaryGroupSid value.
4071 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4072 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4073 if ( !NT_STATUS_IS_OK(status) ) {
4078 /* WARNING: No TALLOC_FREE(pwd), we are about to set the password
4081 return NT_STATUS_OK;
4084 /*******************************************************************
4086 ********************************************************************/
4088 NTSTATUS _samr_SetUserInfo(pipes_struct *p,
4089 struct samr_SetUserInfo *r)
4092 struct samu *pwd = NULL;
4094 POLICY_HND *pol = r->in.user_handle;
4095 union samr_UserInfo *info = r->in.info;
4096 uint16_t switch_value = r->in.level;
4097 uint32_t acc_granted;
4098 uint32_t acc_required;
4100 bool has_enough_rights = False;
4102 DISP_INFO *disp_info = NULL;
4104 DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
4106 /* find the policy handle. open a policy on it. */
4107 if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info)) {
4108 return NT_STATUS_INVALID_HANDLE;
4111 /* This is tricky. A WinXP domain join sets
4112 (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
4113 The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
4114 standard Win32 API calls just ask for SAMR_USER_ACCESS_SET_PASSWORD in the SamrOpenUser().
4115 This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
4116 we'll use the set from the WinXP join as the basis. */
4118 switch (switch_value) {
4123 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
4126 acc_required = SAMR_USER_ACCESS_SET_PASSWORD |
4127 SAMR_USER_ACCESS_SET_ATTRIBUTES |
4128 SAMR_USER_ACCESS_GET_ATTRIBUTES;
4132 status = access_check_samr_function(acc_granted,
4134 "_samr_SetUserInfo");
4135 if (!NT_STATUS_IS_OK(status)) {
4139 DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
4140 sid_string_dbg(&sid), switch_value));
4143 DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
4144 return NT_STATUS_INVALID_INFO_CLASS;
4147 if (!(pwd = samu_new(NULL))) {
4148 return NT_STATUS_NO_MEMORY;
4152 ret = pdb_getsampwsid(pwd, &sid);
4157 return NT_STATUS_NO_SUCH_USER;
4160 /* deal with machine password changes differently from userinfo changes */
4161 /* check to see if we have the sufficient rights */
4163 acb_info = pdb_get_acct_ctrl(pwd);
4164 if (acb_info & ACB_WSTRUST)
4165 has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
4166 &se_machine_account);
4167 else if (acb_info & ACB_NORMAL)
4168 has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
4170 else if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
4171 if (lp_enable_privileges()) {
4172 has_enough_rights = nt_token_check_domain_rid(p->pipe_user.nt_user_token,
4173 DOMAIN_GROUP_RID_ADMINS);
4177 DEBUG(5, ("_samr_SetUserInfo: %s does%s possess sufficient rights\n",
4178 uidtoname(p->pipe_user.ut.uid),
4179 has_enough_rights ? "" : " not"));
4181 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
4183 if (has_enough_rights) {
4187 /* ok! user info levels (lots: see MSDEV help), off we go... */
4189 switch (switch_value) {
4192 status = set_user_info_7(p->mem_ctx,
4197 if (!set_user_info_16(&info->info16, pwd)) {
4198 status = NT_STATUS_ACCESS_DENIED;
4203 /* Used by AS/U JRA. */
4204 if (!set_user_info_18(&info->info18, pwd)) {
4205 status = NT_STATUS_ACCESS_DENIED;
4210 if (!set_user_info_20(&info->info20, pwd)) {
4211 status = NT_STATUS_ACCESS_DENIED;
4216 status = set_user_info_21(p->mem_ctx,
4217 &info->info21, pwd);
4221 if (!p->server_info->user_session_key.length) {
4222 status = NT_STATUS_NO_USER_SESSION_KEY;
4224 SamOEMhashBlob(info->info23.password.data, 516,
4225 &p->server_info->user_session_key);
4227 dump_data(100, info->info23.password.data, 516);
4229 status = set_user_info_23(p->mem_ctx,
4230 &info->info23, pwd);
4234 if (!p->server_info->user_session_key.length) {
4235 status = NT_STATUS_NO_USER_SESSION_KEY;
4237 SamOEMhashBlob(info->info24.password.data,
4239 &p->server_info->user_session_key);
4241 dump_data(100, info->info24.password.data, 516);
4243 if (!set_user_info_pw(info->info24.password.data, pwd,
4245 status = NT_STATUS_ACCESS_DENIED;
4250 if (!p->server_info->user_session_key.length) {
4251 status = NT_STATUS_NO_USER_SESSION_KEY;
4253 encode_or_decode_arc4_passwd_buffer(
4254 info->info25.password.data,
4255 &p->server_info->user_session_key);
4257 dump_data(100, info->info25.password.data, 532);
4259 status = set_user_info_25(p->mem_ctx,
4260 &info->info25, pwd);
4261 if (!NT_STATUS_IS_OK(status)) {
4264 if (!set_user_info_pw(info->info25.password.data, pwd,
4266 status = NT_STATUS_ACCESS_DENIED;
4271 if (!p->server_info->user_session_key.length) {
4272 status = NT_STATUS_NO_USER_SESSION_KEY;
4274 encode_or_decode_arc4_passwd_buffer(
4275 info->info26.password.data,
4276 &p->server_info->user_session_key);
4278 dump_data(100, info->info26.password.data, 516);
4280 if (!set_user_info_pw(info->info26.password.data, pwd,
4282 status = NT_STATUS_ACCESS_DENIED;
4287 status = NT_STATUS_INVALID_INFO_CLASS;
4292 if (has_enough_rights) {
4296 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
4298 if (NT_STATUS_IS_OK(status)) {
4299 force_flush_samr_cache(disp_info);
4305 /*******************************************************************
4307 ********************************************************************/
4309 NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
4310 struct samr_SetUserInfo2 *r)
4312 struct samr_SetUserInfo q;
4314 q.in.user_handle = r->in.user_handle;
4315 q.in.level = r->in.level;
4316 q.in.info = r->in.info;
4318 return _samr_SetUserInfo(p, &q);
4321 /*********************************************************************
4322 _samr_GetAliasMembership
4323 *********************************************************************/
4325 NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
4326 struct samr_GetAliasMembership *r)
4328 size_t num_alias_rids;
4330 struct samr_info *info = NULL;
4338 DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
4340 /* find the policy handle. open a policy on it. */
4341 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
4342 return NT_STATUS_INVALID_HANDLE;
4344 ntstatus1 = access_check_samr_function(info->acc_granted,
4345 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
4346 "_samr_GetAliasMembership");
4347 ntstatus2 = access_check_samr_function(info->acc_granted,
4348 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4349 "_samr_GetAliasMembership");
4351 if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
4352 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
4353 !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
4354 return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
4358 if (!sid_check_is_domain(&info->sid) &&
4359 !sid_check_is_builtin(&info->sid))
4360 return NT_STATUS_OBJECT_TYPE_MISMATCH;
4362 if (r->in.sids->num_sids) {
4363 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, r->in.sids->num_sids);
4365 if (members == NULL)
4366 return NT_STATUS_NO_MEMORY;
4371 for (i=0; i<r->in.sids->num_sids; i++)
4372 sid_copy(&members[i], r->in.sids->sids[i].sid);
4378 ntstatus1 = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
4379 r->in.sids->num_sids,
4380 &alias_rids, &num_alias_rids);
4383 if (!NT_STATUS_IS_OK(ntstatus1)) {
4387 r->out.rids->count = num_alias_rids;
4388 r->out.rids->ids = alias_rids;
4390 return NT_STATUS_OK;
4393 /*********************************************************************
4394 _samr_GetMembersInAlias
4395 *********************************************************************/
4397 NTSTATUS _samr_GetMembersInAlias(pipes_struct *p,
4398 struct samr_GetMembersInAlias *r)
4402 size_t num_sids = 0;
4403 struct lsa_SidPtr *sids = NULL;
4404 DOM_SID *pdb_sids = NULL;
4410 /* find the policy handle. open a policy on it. */
4411 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, NULL))
4412 return NT_STATUS_INVALID_HANDLE;
4414 status = access_check_samr_function(acc_granted,
4415 SA_RIGHT_ALIAS_GET_MEMBERS,
4416 "_samr_GetMembersInAlias");
4417 if (!NT_STATUS_IS_OK(status)) {
4421 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4424 status = pdb_enum_aliasmem(&alias_sid, &pdb_sids, &num_sids);
4427 if (!NT_STATUS_IS_OK(status)) {
4432 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr, num_sids);
4434 TALLOC_FREE(pdb_sids);
4435 return NT_STATUS_NO_MEMORY;
4439 for (i = 0; i < num_sids; i++) {
4440 sids[i].sid = sid_dup_talloc(p->mem_ctx, &pdb_sids[i]);
4442 TALLOC_FREE(pdb_sids);
4443 return NT_STATUS_NO_MEMORY;
4447 r->out.sids->num_sids = num_sids;
4448 r->out.sids->sids = sids;
4450 TALLOC_FREE(pdb_sids);
4452 return NT_STATUS_OK;
4455 /*********************************************************************
4456 _samr_QueryGroupMember
4457 *********************************************************************/
4459 NTSTATUS _samr_QueryGroupMember(pipes_struct *p,
4460 struct samr_QueryGroupMember *r)
4463 size_t i, num_members;
4471 struct samr_RidTypeArray *rids = NULL;
4473 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidTypeArray);
4475 return NT_STATUS_NO_MEMORY;
4478 /* find the policy handle. open a policy on it. */
4479 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
4480 return NT_STATUS_INVALID_HANDLE;
4482 status = access_check_samr_function(acc_granted,
4483 SAMR_GROUP_ACCESS_GET_MEMBERS,
4484 "_samr_QueryGroupMember");
4485 if (!NT_STATUS_IS_OK(status)) {
4489 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4491 if (!sid_check_is_in_our_domain(&group_sid)) {
4492 DEBUG(3, ("sid %s is not in our domain\n",
4493 sid_string_dbg(&group_sid)));
4494 return NT_STATUS_NO_SUCH_GROUP;
4497 DEBUG(10, ("lookup on Domain SID\n"));
4500 status = pdb_enum_group_members(p->mem_ctx, &group_sid,
4501 &rid, &num_members);
4504 if (!NT_STATUS_IS_OK(status))
4508 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
4510 return NT_STATUS_NO_MEMORY;
4516 for (i=0; i<num_members; i++)
4517 attr[i] = SID_NAME_USER;
4519 rids->count = num_members;
4523 *r->out.rids = rids;
4525 return NT_STATUS_OK;
4528 /*********************************************************************
4529 _samr_AddAliasMember
4530 *********************************************************************/
4532 NTSTATUS _samr_AddAliasMember(pipes_struct *p,
4533 struct samr_AddAliasMember *r)
4538 bool can_add_accounts;
4540 DISP_INFO *disp_info = NULL;
4542 /* Find the policy handle. Open a policy on it. */
4543 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4544 return NT_STATUS_INVALID_HANDLE;
4546 status = access_check_samr_function(acc_granted,
4547 SA_RIGHT_ALIAS_ADD_MEMBER,
4548 "_samr_AddAliasMember");
4549 if (!NT_STATUS_IS_OK(status)) {
4553 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4555 se_priv_copy( &se_rights, &se_add_users );
4556 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4558 /******** BEGIN SeAddUsers BLOCK *********/
4560 if ( can_add_accounts )
4563 status = pdb_add_aliasmem(&alias_sid, r->in.sid);
4565 if ( can_add_accounts )
4568 /******** END SeAddUsers BLOCK *********/
4570 if (NT_STATUS_IS_OK(status)) {
4571 force_flush_samr_cache(disp_info);
4577 /*********************************************************************
4578 _samr_DeleteAliasMember
4579 *********************************************************************/
4581 NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
4582 struct samr_DeleteAliasMember *r)
4587 bool can_add_accounts;
4589 DISP_INFO *disp_info = NULL;
4591 /* Find the policy handle. Open a policy on it. */
4592 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4593 return NT_STATUS_INVALID_HANDLE;
4595 status = access_check_samr_function(acc_granted,
4596 SA_RIGHT_ALIAS_REMOVE_MEMBER,
4597 "_samr_DeleteAliasMember");
4598 if (!NT_STATUS_IS_OK(status)) {
4602 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
4603 sid_string_dbg(&alias_sid)));
4605 se_priv_copy( &se_rights, &se_add_users );
4606 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4608 /******** BEGIN SeAddUsers BLOCK *********/
4610 if ( can_add_accounts )
4613 status = pdb_del_aliasmem(&alias_sid, r->in.sid);
4615 if ( can_add_accounts )
4618 /******** END SeAddUsers BLOCK *********/
4620 if (NT_STATUS_IS_OK(status)) {
4621 force_flush_samr_cache(disp_info);
4627 /*********************************************************************
4628 _samr_AddGroupMember
4629 *********************************************************************/
4631 NTSTATUS _samr_AddGroupMember(pipes_struct *p,
4632 struct samr_AddGroupMember *r)
4639 bool can_add_accounts;
4640 DISP_INFO *disp_info = NULL;
4642 /* Find the policy handle. Open a policy on it. */
4643 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4644 return NT_STATUS_INVALID_HANDLE;
4646 status = access_check_samr_function(acc_granted,
4647 SAMR_GROUP_ACCESS_ADD_MEMBER,
4648 "_samr_AddGroupMember");
4649 if (!NT_STATUS_IS_OK(status)) {
4653 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4655 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4657 return NT_STATUS_INVALID_HANDLE;
4660 se_priv_copy( &se_rights, &se_add_users );
4661 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4663 /******** BEGIN SeAddUsers BLOCK *********/
4665 if ( can_add_accounts )
4668 status = pdb_add_groupmem(p->mem_ctx, group_rid, r->in.rid);
4670 if ( can_add_accounts )
4673 /******** END SeAddUsers BLOCK *********/
4675 force_flush_samr_cache(disp_info);
4680 /*********************************************************************
4681 _samr_DeleteGroupMember
4682 *********************************************************************/
4684 NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
4685 struct samr_DeleteGroupMember *r)
4693 bool can_add_accounts;
4694 DISP_INFO *disp_info = NULL;
4697 * delete the group member named r->in.rid
4698 * who is a member of the sid associated with the handle
4699 * the rid is a user's rid as the group is a domain group.
4702 /* Find the policy handle. Open a policy on it. */
4703 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4704 return NT_STATUS_INVALID_HANDLE;
4706 status = access_check_samr_function(acc_granted,
4707 SAMR_GROUP_ACCESS_REMOVE_MEMBER,
4708 "_samr_DeleteGroupMember");
4709 if (!NT_STATUS_IS_OK(status)) {
4713 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4715 return NT_STATUS_INVALID_HANDLE;
4718 se_priv_copy( &se_rights, &se_add_users );
4719 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4721 /******** BEGIN SeAddUsers BLOCK *********/
4723 if ( can_add_accounts )
4726 status = pdb_del_groupmem(p->mem_ctx, group_rid, r->in.rid);
4728 if ( can_add_accounts )
4731 /******** END SeAddUsers BLOCK *********/
4733 force_flush_samr_cache(disp_info);
4738 /*********************************************************************
4740 *********************************************************************/
4742 NTSTATUS _samr_DeleteUser(pipes_struct *p,
4743 struct samr_DeleteUser *r)
4747 struct samu *sam_pass=NULL;
4749 bool can_add_accounts;
4751 DISP_INFO *disp_info = NULL;
4754 DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__));
4756 /* Find the policy handle. Open a policy on it. */
4757 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &user_sid, &acc_granted, &disp_info))
4758 return NT_STATUS_INVALID_HANDLE;
4760 status = access_check_samr_function(acc_granted,
4761 STD_RIGHT_DELETE_ACCESS,
4762 "_samr_DeleteUser");
4763 if (!NT_STATUS_IS_OK(status)) {
4767 if (!sid_check_is_in_our_domain(&user_sid))
4768 return NT_STATUS_CANNOT_DELETE;
4770 /* check if the user exists before trying to delete */
4771 if ( !(sam_pass = samu_new( NULL )) ) {
4772 return NT_STATUS_NO_MEMORY;
4776 ret = pdb_getsampwsid(sam_pass, &user_sid);
4780 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
4781 sid_string_dbg(&user_sid)));
4782 TALLOC_FREE(sam_pass);
4783 return NT_STATUS_NO_SUCH_USER;
4786 acb_info = pdb_get_acct_ctrl(sam_pass);
4788 /* For machine accounts it's the SeMachineAccountPrivilege that counts. */
4789 if ( acb_info & ACB_WSTRUST ) {
4790 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account );
4792 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
4795 /******** BEGIN SeAddUsers BLOCK *********/
4797 if ( can_add_accounts )
4800 status = pdb_delete_user(p->mem_ctx, sam_pass);
4802 if ( can_add_accounts )
4805 /******** END SeAddUsers BLOCK *********/
4807 if ( !NT_STATUS_IS_OK(status) ) {
4808 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
4809 "user %s: %s.\n", pdb_get_username(sam_pass),
4810 nt_errstr(status)));
4811 TALLOC_FREE(sam_pass);
4816 TALLOC_FREE(sam_pass);
4818 if (!close_policy_hnd(p, r->in.user_handle))
4819 return NT_STATUS_OBJECT_NAME_INVALID;
4821 ZERO_STRUCTP(r->out.user_handle);
4823 force_flush_samr_cache(disp_info);
4825 return NT_STATUS_OK;
4828 /*********************************************************************
4829 _samr_DeleteDomainGroup
4830 *********************************************************************/
4832 NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
4833 struct samr_DeleteDomainGroup *r)
4840 bool can_add_accounts;
4841 DISP_INFO *disp_info = NULL;
4843 DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__));
4845 /* Find the policy handle. Open a policy on it. */
4846 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4847 return NT_STATUS_INVALID_HANDLE;
4849 status = access_check_samr_function(acc_granted,
4850 STD_RIGHT_DELETE_ACCESS,
4851 "_samr_DeleteDomainGroup");
4852 if (!NT_STATUS_IS_OK(status)) {
4856 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4858 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4860 return NT_STATUS_NO_SUCH_GROUP;
4863 se_priv_copy( &se_rights, &se_add_users );
4864 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4866 /******** BEGIN SeAddUsers BLOCK *********/
4868 if ( can_add_accounts )
4871 status = pdb_delete_dom_group(p->mem_ctx, group_rid);
4873 if ( can_add_accounts )
4876 /******** END SeAddUsers BLOCK *********/
4878 if ( !NT_STATUS_IS_OK(status) ) {
4879 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
4880 "entry for group %s: %s\n",
4881 sid_string_dbg(&group_sid),
4882 nt_errstr(status)));
4886 if (!close_policy_hnd(p, r->in.group_handle))
4887 return NT_STATUS_OBJECT_NAME_INVALID;
4889 force_flush_samr_cache(disp_info);
4891 return NT_STATUS_OK;
4894 /*********************************************************************
4895 _samr_DeleteDomAlias
4896 *********************************************************************/
4898 NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
4899 struct samr_DeleteDomAlias *r)
4904 bool can_add_accounts;
4906 DISP_INFO *disp_info = NULL;
4908 DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__));
4910 /* Find the policy handle. Open a policy on it. */
4911 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4912 return NT_STATUS_INVALID_HANDLE;
4914 /* copy the handle to the outgoing reply */
4916 memcpy(r->out.alias_handle, r->in.alias_handle, sizeof(r->out.alias_handle));
4918 status = access_check_samr_function(acc_granted,
4919 STD_RIGHT_DELETE_ACCESS,
4920 "_samr_DeleteDomAlias");
4921 if (!NT_STATUS_IS_OK(status)) {
4925 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4927 /* Don't let Windows delete builtin groups */
4929 if ( sid_check_is_in_builtin( &alias_sid ) ) {
4930 return NT_STATUS_SPECIAL_ACCOUNT;
4933 if (!sid_check_is_in_our_domain(&alias_sid))
4934 return NT_STATUS_NO_SUCH_ALIAS;
4936 DEBUG(10, ("lookup on Local SID\n"));
4938 se_priv_copy( &se_rights, &se_add_users );
4939 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4941 /******** BEGIN SeAddUsers BLOCK *********/
4943 if ( can_add_accounts )
4946 /* Have passdb delete the alias */
4947 status = pdb_delete_alias(&alias_sid);
4949 if ( can_add_accounts )
4952 /******** END SeAddUsers BLOCK *********/
4954 if ( !NT_STATUS_IS_OK(status))
4957 if (!close_policy_hnd(p, r->in.alias_handle))
4958 return NT_STATUS_OBJECT_NAME_INVALID;
4960 force_flush_samr_cache(disp_info);
4962 return NT_STATUS_OK;
4965 /*********************************************************************
4966 _samr_CreateDomainGroup
4967 *********************************************************************/
4969 NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
4970 struct samr_CreateDomainGroup *r)
4977 struct samr_info *info;
4980 bool can_add_accounts;
4981 DISP_INFO *disp_info = NULL;
4983 /* Find the policy handle. Open a policy on it. */
4984 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
4985 return NT_STATUS_INVALID_HANDLE;
4987 status = access_check_samr_function(acc_granted,
4988 SAMR_DOMAIN_ACCESS_CREATE_GROUP,
4989 "_samr_CreateDomainGroup");
4990 if (!NT_STATUS_IS_OK(status)) {
4994 if (!sid_equal(&dom_sid, get_global_sam_sid()))
4995 return NT_STATUS_ACCESS_DENIED;
4997 name = r->in.name->string;
4999 return NT_STATUS_NO_MEMORY;
5002 status = can_create(p->mem_ctx, name);
5003 if (!NT_STATUS_IS_OK(status)) {
5007 se_priv_copy( &se_rights, &se_add_users );
5008 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5010 /******** BEGIN SeAddUsers BLOCK *********/
5012 if ( can_add_accounts )
5015 /* check that we successfully create the UNIX group */
5017 status = pdb_create_dom_group(p->mem_ctx, name, r->out.rid);
5019 if ( can_add_accounts )
5022 /******** END SeAddUsers BLOCK *********/
5024 /* check if we should bail out here */
5026 if ( !NT_STATUS_IS_OK(status) )
5029 sid_compose(&info_sid, get_global_sam_sid(), *r->out.rid);
5031 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5032 return NT_STATUS_NO_MEMORY;
5034 /* they created it; let the user do what he wants with it */
5036 info->acc_granted = GENERIC_RIGHTS_GROUP_ALL_ACCESS;
5038 /* get a (unique) handle. open a policy on it. */
5039 if (!create_policy_hnd(p, r->out.group_handle, free_samr_info, (void *)info))
5040 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5042 force_flush_samr_cache(disp_info);
5044 return NT_STATUS_OK;
5047 /*********************************************************************
5048 _samr_CreateDomAlias
5049 *********************************************************************/
5051 NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
5052 struct samr_CreateDomAlias *r)
5056 const char *name = NULL;
5057 struct samr_info *info;
5062 bool can_add_accounts;
5063 DISP_INFO *disp_info = NULL;
5065 /* Find the policy handle. Open a policy on it. */
5066 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
5067 return NT_STATUS_INVALID_HANDLE;
5069 result = access_check_samr_function(acc_granted,
5070 SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
5071 "_samr_CreateDomAlias");
5072 if (!NT_STATUS_IS_OK(result)) {
5076 if (!sid_equal(&dom_sid, get_global_sam_sid()))
5077 return NT_STATUS_ACCESS_DENIED;
5079 name = r->in.alias_name->string;
5081 se_priv_copy( &se_rights, &se_add_users );
5082 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5084 result = can_create(p->mem_ctx, name);
5085 if (!NT_STATUS_IS_OK(result)) {
5089 /******** BEGIN SeAddUsers BLOCK *********/
5091 if ( can_add_accounts )
5094 /* Have passdb create the alias */
5095 result = pdb_create_alias(name, r->out.rid);
5097 if ( can_add_accounts )
5100 /******** END SeAddUsers BLOCK *********/
5102 if (!NT_STATUS_IS_OK(result)) {
5103 DEBUG(10, ("pdb_create_alias failed: %s\n",
5104 nt_errstr(result)));
5108 sid_copy(&info_sid, get_global_sam_sid());
5109 sid_append_rid(&info_sid, *r->out.rid);
5111 if (!sid_to_gid(&info_sid, &gid)) {
5112 DEBUG(10, ("Could not find alias just created\n"));
5113 return NT_STATUS_ACCESS_DENIED;
5116 /* check if the group has been successfully created */
5117 if ( getgrgid(gid) == NULL ) {
5118 DEBUG(10, ("getgrgid(%d) of just created alias failed\n",
5120 return NT_STATUS_ACCESS_DENIED;
5123 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5124 return NT_STATUS_NO_MEMORY;
5126 /* they created it; let the user do what he wants with it */
5128 info->acc_granted = GENERIC_RIGHTS_ALIAS_ALL_ACCESS;
5130 /* get a (unique) handle. open a policy on it. */
5131 if (!create_policy_hnd(p, r->out.alias_handle, free_samr_info, (void *)info))
5132 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5134 force_flush_samr_cache(disp_info);
5136 return NT_STATUS_OK;
5139 /*********************************************************************
5140 _samr_QueryGroupInfo
5141 *********************************************************************/
5143 NTSTATUS _samr_QueryGroupInfo(pipes_struct *p,
5144 struct samr_QueryGroupInfo *r)
5149 union samr_GroupInfo *info = NULL;
5152 uint32_t attributes = SE_GROUP_MANDATORY |
5153 SE_GROUP_ENABLED_BY_DEFAULT |
5155 const char *group_name = NULL;
5156 const char *group_description = NULL;
5158 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
5159 return NT_STATUS_INVALID_HANDLE;
5161 status = access_check_samr_function(acc_granted,
5162 SAMR_GROUP_ACCESS_LOOKUP_INFO,
5163 "_samr_QueryGroupInfo");
5164 if (!NT_STATUS_IS_OK(status)) {
5169 ret = get_domain_group_from_sid(group_sid, &map);
5172 return NT_STATUS_INVALID_HANDLE;
5174 /* FIXME: map contains fstrings */
5175 group_name = talloc_strdup(r, map.nt_name);
5176 group_description = talloc_strdup(r, map.comment);
5178 info = TALLOC_ZERO_P(p->mem_ctx, union samr_GroupInfo);
5180 return NT_STATUS_NO_MEMORY;
5183 switch (r->in.level) {
5189 status = pdb_enum_group_members(
5190 p->mem_ctx, &group_sid, &members, &num_members);
5193 if (!NT_STATUS_IS_OK(status)) {
5197 init_samr_group_info1(&info->all,
5205 init_samr_group_info2(&info->name,
5209 init_samr_group_info3(&info->attributes,
5213 init_samr_group_info4(&info->description,
5224 status = pdb_enum_group_members(
5225 p->mem_ctx, &group_sid, &members, &num_members);
5228 if (!NT_STATUS_IS_OK(status)) {
5232 init_samr_group_info5(&info->all2,
5235 0, /* num_members - in w2k3 this is always 0 */
5241 return NT_STATUS_INVALID_INFO_CLASS;
5244 *r->out.info = info;
5246 return NT_STATUS_OK;
5249 /*********************************************************************
5251 *********************************************************************/
5253 NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
5254 struct samr_SetGroupInfo *r)
5261 bool can_mod_accounts;
5262 DISP_INFO *disp_info = NULL;
5264 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
5265 return NT_STATUS_INVALID_HANDLE;
5267 status = access_check_samr_function(acc_granted,
5268 SAMR_GROUP_ACCESS_SET_INFO,
5269 "_samr_SetGroupInfo");
5270 if (!NT_STATUS_IS_OK(status)) {
5275 ret = get_domain_group_from_sid(group_sid, &map);
5278 return NT_STATUS_NO_SUCH_GROUP;
5280 switch (r->in.level) {
5282 fstrcpy(map.comment, r->in.info->all.description.string);
5285 /* group rename is not supported yet */
5286 return NT_STATUS_NOT_SUPPORTED;
5288 fstrcpy(map.comment, r->in.info->description.string);
5291 return NT_STATUS_INVALID_INFO_CLASS;
5294 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
5296 /******** BEGIN SeAddUsers BLOCK *********/
5298 if ( can_mod_accounts )
5301 status = pdb_update_group_mapping_entry(&map);
5303 if ( can_mod_accounts )
5306 /******** End SeAddUsers BLOCK *********/
5308 if (NT_STATUS_IS_OK(status)) {
5309 force_flush_samr_cache(disp_info);
5315 /*********************************************************************
5317 *********************************************************************/
5319 NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
5320 struct samr_SetAliasInfo *r)
5323 struct acct_info info;
5325 bool can_mod_accounts;
5327 DISP_INFO *disp_info = NULL;
5329 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &group_sid, &acc_granted, &disp_info))
5330 return NT_STATUS_INVALID_HANDLE;
5332 status = access_check_samr_function(acc_granted,
5333 SA_RIGHT_ALIAS_SET_INFO,
5334 "_samr_SetAliasInfo");
5335 if (!NT_STATUS_IS_OK(status)) {
5339 /* get the current group information */
5342 status = pdb_get_aliasinfo( &group_sid, &info );
5345 if ( !NT_STATUS_IS_OK(status))
5348 switch (r->in.level) {
5353 /* We currently do not support renaming groups in the
5354 the BUILTIN domain. Refer to util_builtin.c to understand
5355 why. The eventually needs to be fixed to be like Windows
5356 where you can rename builtin groups, just not delete them */
5358 if ( sid_check_is_in_builtin( &group_sid ) ) {
5359 return NT_STATUS_SPECIAL_ACCOUNT;
5362 /* There has to be a valid name (and it has to be different) */
5364 if ( !r->in.info->name.string )
5365 return NT_STATUS_INVALID_PARAMETER;
5367 /* If the name is the same just reply "ok". Yes this
5368 doesn't allow you to change the case of a group name. */
5370 if ( strequal( r->in.info->name.string, info.acct_name ) )
5371 return NT_STATUS_OK;
5373 fstrcpy( info.acct_name, r->in.info->name.string);
5375 /* make sure the name doesn't already exist as a user
5378 fstr_sprintf( group_name, "%s\\%s", global_myname(), info.acct_name );
5379 status = can_create( p->mem_ctx, group_name );
5380 if ( !NT_STATUS_IS_OK( status ) )
5384 case ALIASINFODESCRIPTION:
5385 if (r->in.info->description.string) {
5386 fstrcpy(info.acct_desc,
5387 r->in.info->description.string);
5389 fstrcpy( info.acct_desc, "" );
5393 return NT_STATUS_INVALID_INFO_CLASS;
5396 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
5398 /******** BEGIN SeAddUsers BLOCK *********/
5400 if ( can_mod_accounts )
5403 status = pdb_set_aliasinfo( &group_sid, &info );
5405 if ( can_mod_accounts )
5408 /******** End SeAddUsers BLOCK *********/
5410 if (NT_STATUS_IS_OK(status))
5411 force_flush_samr_cache(disp_info);
5416 /****************************************************************
5418 ****************************************************************/
5420 NTSTATUS _samr_GetDomPwInfo(pipes_struct *p,
5421 struct samr_GetDomPwInfo *r)
5423 uint32_t min_password_length = 0;
5424 uint32_t password_properties = 0;
5426 /* Perform access check. Since this rpc does not require a
5427 policy handle it will not be caught by the access checks on
5428 SAMR_CONNECT or SAMR_CONNECT_ANON. */
5430 if (!pipe_access_check(p)) {
5431 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
5432 return NT_STATUS_ACCESS_DENIED;
5436 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
5437 &min_password_length);
5438 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
5439 &password_properties);
5442 if (lp_check_password_script() && *lp_check_password_script()) {
5443 password_properties |= DOMAIN_PASSWORD_COMPLEX;
5446 r->out.info->min_password_length = min_password_length;
5447 r->out.info->password_properties = password_properties;
5449 return NT_STATUS_OK;
5452 /*********************************************************************
5454 *********************************************************************/
5456 NTSTATUS _samr_OpenGroup(pipes_struct *p,
5457 struct samr_OpenGroup *r)
5463 struct samr_info *info;
5464 SEC_DESC *psd = NULL;
5466 uint32 des_access = r->in.access_mask;
5473 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL))
5474 return NT_STATUS_INVALID_HANDLE;
5476 status = access_check_samr_function(acc_granted,
5477 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
5480 if ( !NT_STATUS_IS_OK(status) )
5483 /*check if access can be granted as requested by client. */
5484 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
5486 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
5487 se_map_generic(&des_access,&grp_generic_mapping);
5489 se_priv_copy( &se_rights, &se_add_users );
5491 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
5492 &se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
5493 &acc_granted, "_samr_OpenGroup");
5495 if ( !NT_STATUS_IS_OK(status) )
5498 /* this should not be hard-coded like this */
5500 if (!sid_equal(&sid, get_global_sam_sid()))
5501 return NT_STATUS_ACCESS_DENIED;
5503 sid_copy(&info_sid, get_global_sam_sid());
5504 sid_append_rid(&info_sid, r->in.rid);
5505 sid_to_fstring(sid_string, &info_sid);
5507 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5508 return NT_STATUS_NO_MEMORY;
5510 info->acc_granted = acc_granted;
5512 DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n", sid_string));
5514 /* check if that group really exists */
5516 ret = get_domain_group_from_sid(info->sid, &map);
5519 return NT_STATUS_NO_SUCH_GROUP;
5521 /* get a (unique) handle. open a policy on it. */
5522 if (!create_policy_hnd(p, r->out.group_handle, free_samr_info, (void *)info))
5523 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5525 return NT_STATUS_OK;
5528 /*********************************************************************
5529 _samr_RemoveMemberFromForeignDomain
5530 *********************************************************************/
5532 NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
5533 struct samr_RemoveMemberFromForeignDomain *r)
5535 DOM_SID delete_sid, domain_sid;
5538 DISP_INFO *disp_info = NULL;
5540 sid_copy( &delete_sid, r->in.sid );
5542 DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
5543 sid_string_dbg(&delete_sid)));
5545 /* Find the policy handle. Open a policy on it. */
5547 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &domain_sid,
5548 &acc_granted, &disp_info))
5549 return NT_STATUS_INVALID_HANDLE;
5551 result = access_check_samr_function(acc_granted,
5552 STD_RIGHT_DELETE_ACCESS,
5553 "_samr_RemoveMemberFromForeignDomain");
5555 if (!NT_STATUS_IS_OK(result))
5558 DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
5559 sid_string_dbg(&domain_sid)));
5561 /* we can only delete a user from a group since we don't have
5562 nested groups anyways. So in the latter case, just say OK */
5564 /* TODO: The above comment nowadays is bogus. Since we have nested
5565 * groups now, and aliases members are never reported out of the unix
5566 * group membership, the "just say OK" makes this call a no-op. For
5567 * us. This needs fixing however. */
5569 /* I've only ever seen this in the wild when deleting a user from
5570 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
5571 * is the user about to be deleted. I very much suspect this is the
5572 * only application of this call. To verify this, let people report
5575 if (!sid_check_is_builtin(&domain_sid)) {
5576 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
5577 "global_sam_sid() = %s\n",
5578 sid_string_dbg(&domain_sid),
5579 sid_string_dbg(get_global_sam_sid())));
5580 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
5581 return NT_STATUS_OK;
5584 force_flush_samr_cache(disp_info);
5586 result = NT_STATUS_OK;
5591 /*******************************************************************
5592 _samr_QueryDomainInfo2
5593 ********************************************************************/
5595 NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
5596 struct samr_QueryDomainInfo2 *r)
5598 struct samr_QueryDomainInfo q;
5600 q.in.domain_handle = r->in.domain_handle;
5601 q.in.level = r->in.level;
5603 q.out.info = r->out.info;
5605 return _samr_QueryDomainInfo(p, &q);
5608 /*******************************************************************
5610 ********************************************************************/
5612 NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
5613 struct samr_SetDomainInfo *r)
5615 struct samr_info *info = NULL;
5616 time_t u_expire, u_min_age;
5618 time_t u_lock_duration, u_reset_time;
5621 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5623 /* find the policy handle. open a policy on it. */
5624 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
5625 return NT_STATUS_INVALID_HANDLE;
5627 /* We do have different access bits for info
5628 * levels here, but we're really just looking for
5629 * GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
5630 * this maps to different specific bits. So
5631 * assume if we have SAMR_DOMAIN_ACCESS_SET_INFO_1
5634 result = access_check_samr_function(info->acc_granted,
5635 SAMR_DOMAIN_ACCESS_SET_INFO_1,
5636 "_samr_SetDomainInfo");
5638 if (!NT_STATUS_IS_OK(result))
5641 DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
5643 switch (r->in.level) {
5645 u_expire=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.max_password_age);
5646 u_min_age=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.min_password_age);
5647 pdb_set_account_policy(AP_MIN_PASSWORD_LEN, (uint32)r->in.info->info1.min_password_length);
5648 pdb_set_account_policy(AP_PASSWORD_HISTORY, (uint32)r->in.info->info1.password_history_length);
5649 pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)r->in.info->info1.password_properties);
5650 pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (int)u_expire);
5651 pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (int)u_min_age);
5656 u_logout=nt_time_to_unix_abs((NTTIME *)&r->in.info->info3.force_logoff_time);
5657 pdb_set_account_policy(AP_TIME_TO_LOGOUT, (int)u_logout);
5666 u_lock_duration=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_duration);
5667 if (u_lock_duration != -1)
5668 u_lock_duration /= 60;
5670 u_reset_time=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_window)/60;
5672 pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
5673 pdb_set_account_policy(AP_RESET_COUNT_TIME, (int)u_reset_time);
5674 pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT, (uint32)r->in.info->info12.lockout_threshold);
5677 return NT_STATUS_INVALID_INFO_CLASS;
5680 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5682 return NT_STATUS_OK;
5685 /****************************************************************
5686 _samr_GetDisplayEnumerationIndex
5687 ****************************************************************/
5689 NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
5690 struct samr_GetDisplayEnumerationIndex *r)
5692 struct samr_info *info = NULL;
5693 uint32_t max_entries = (uint32_t) -1;
5694 uint32_t enum_context = 0;
5696 uint32_t num_account = 0;
5697 struct samr_displayentry *entries = NULL;
5700 DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
5702 /* find the policy handle. open a policy on it. */
5703 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
5704 return NT_STATUS_INVALID_HANDLE;
5707 status = access_check_samr_function(info->acc_granted,
5708 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
5709 "_samr_GetDisplayEnumerationIndex");
5710 if (!NT_STATUS_IS_OK(status)) {
5714 if ((r->in.level < 1) || (r->in.level > 3)) {
5715 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
5716 "Unknown info level (%u)\n",
5718 return NT_STATUS_INVALID_INFO_CLASS;
5723 /* The following done as ROOT. Don't return without unbecome_root(). */
5725 switch (r->in.level) {
5727 if (info->disp_info->users == NULL) {
5728 info->disp_info->users = pdb_search_users(ACB_NORMAL);
5729 if (info->disp_info->users == NULL) {
5731 return NT_STATUS_ACCESS_DENIED;
5733 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5734 "starting user enumeration at index %u\n",
5735 (unsigned int)enum_context));
5737 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5738 "using cached user enumeration at index %u\n",
5739 (unsigned int)enum_context));
5741 num_account = pdb_search_entries(info->disp_info->users,
5742 enum_context, max_entries,
5746 if (info->disp_info->machines == NULL) {
5747 info->disp_info->machines =
5748 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
5749 if (info->disp_info->machines == NULL) {
5751 return NT_STATUS_ACCESS_DENIED;
5753 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5754 "starting machine enumeration at index %u\n",
5755 (unsigned int)enum_context));
5757 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5758 "using cached machine enumeration at index %u\n",
5759 (unsigned int)enum_context));
5761 num_account = pdb_search_entries(info->disp_info->machines,
5762 enum_context, max_entries,
5766 if (info->disp_info->groups == NULL) {
5767 info->disp_info->groups = pdb_search_groups();
5768 if (info->disp_info->groups == NULL) {
5770 return NT_STATUS_ACCESS_DENIED;
5772 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5773 "starting group enumeration at index %u\n",
5774 (unsigned int)enum_context));
5776 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5777 "using cached group enumeration at index %u\n",
5778 (unsigned int)enum_context));
5780 num_account = pdb_search_entries(info->disp_info->groups,
5781 enum_context, max_entries,
5786 smb_panic("info class changed");
5792 /* Ensure we cache this enumeration. */
5793 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
5795 DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
5796 r->in.name->string));
5798 for (i=0; i<num_account; i++) {
5799 if (strequal(entries[i].account_name, r->in.name->string)) {
5800 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5801 "found %s at idx %d\n",
5802 r->in.name->string, i));
5804 return NT_STATUS_OK;
5808 /* assuming account_name lives at the very end */
5809 *r->out.idx = num_account;
5811 return NT_STATUS_NO_MORE_ENTRIES;
5814 /****************************************************************
5815 _samr_GetDisplayEnumerationIndex2
5816 ****************************************************************/
5818 NTSTATUS _samr_GetDisplayEnumerationIndex2(pipes_struct *p,
5819 struct samr_GetDisplayEnumerationIndex2 *r)
5821 struct samr_GetDisplayEnumerationIndex q;
5823 q.in.domain_handle = r->in.domain_handle;
5824 q.in.level = r->in.level;
5825 q.in.name = r->in.name;
5827 q.out.idx = r->out.idx;
5829 return _samr_GetDisplayEnumerationIndex(p, &q);
5832 /****************************************************************
5833 ****************************************************************/
5835 NTSTATUS _samr_Shutdown(pipes_struct *p,
5836 struct samr_Shutdown *r)
5838 p->rng_fault_state = true;
5839 return NT_STATUS_NOT_IMPLEMENTED;
5842 /****************************************************************
5843 ****************************************************************/
5845 NTSTATUS _samr_CreateUser(pipes_struct *p,
5846 struct samr_CreateUser *r)
5848 p->rng_fault_state = true;
5849 return NT_STATUS_NOT_IMPLEMENTED;
5852 /****************************************************************
5853 ****************************************************************/
5855 NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
5856 struct samr_SetMemberAttributesOfGroup *r)
5858 p->rng_fault_state = true;
5859 return NT_STATUS_NOT_IMPLEMENTED;
5862 /****************************************************************
5863 ****************************************************************/
5865 NTSTATUS _samr_ChangePasswordUser(pipes_struct *p,
5866 struct samr_ChangePasswordUser *r)
5868 p->rng_fault_state = true;
5869 return NT_STATUS_NOT_IMPLEMENTED;
5872 /****************************************************************
5873 ****************************************************************/
5875 NTSTATUS _samr_TestPrivateFunctionsDomain(pipes_struct *p,
5876 struct samr_TestPrivateFunctionsDomain *r)
5878 p->rng_fault_state = true;
5879 return NT_STATUS_NOT_IMPLEMENTED;
5882 /****************************************************************
5883 ****************************************************************/
5885 NTSTATUS _samr_TestPrivateFunctionsUser(pipes_struct *p,
5886 struct samr_TestPrivateFunctionsUser *r)
5888 p->rng_fault_state = true;
5889 return NT_STATUS_NOT_IMPLEMENTED;
5892 /****************************************************************
5893 ****************************************************************/
5895 NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
5896 struct samr_QueryUserInfo2 *r)
5898 p->rng_fault_state = true;
5899 return NT_STATUS_NOT_IMPLEMENTED;
5902 /****************************************************************
5903 ****************************************************************/
5905 NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
5906 struct samr_AddMultipleMembersToAlias *r)
5908 p->rng_fault_state = true;
5909 return NT_STATUS_NOT_IMPLEMENTED;
5912 /****************************************************************
5913 ****************************************************************/
5915 NTSTATUS _samr_RemoveMultipleMembersFromAlias(pipes_struct *p,
5916 struct samr_RemoveMultipleMembersFromAlias *r)
5918 p->rng_fault_state = true;
5919 return NT_STATUS_NOT_IMPLEMENTED;
5922 /****************************************************************
5923 ****************************************************************/
5925 NTSTATUS _samr_OemChangePasswordUser2(pipes_struct *p,
5926 struct samr_OemChangePasswordUser2 *r)
5928 p->rng_fault_state = true;
5929 return NT_STATUS_NOT_IMPLEMENTED;
5932 /****************************************************************
5933 ****************************************************************/
5935 NTSTATUS _samr_SetBootKeyInformation(pipes_struct *p,
5936 struct samr_SetBootKeyInformation *r)
5938 p->rng_fault_state = true;
5939 return NT_STATUS_NOT_IMPLEMENTED;
5942 /****************************************************************
5943 ****************************************************************/
5945 NTSTATUS _samr_GetBootKeyInformation(pipes_struct *p,
5946 struct samr_GetBootKeyInformation *r)
5948 p->rng_fault_state = true;
5949 return NT_STATUS_NOT_IMPLEMENTED;
5952 /****************************************************************
5953 ****************************************************************/
5955 NTSTATUS _samr_Connect3(pipes_struct *p,
5956 struct samr_Connect3 *r)
5958 p->rng_fault_state = true;
5959 return NT_STATUS_NOT_IMPLEMENTED;
5962 /****************************************************************
5963 ****************************************************************/
5965 NTSTATUS _samr_RidToSid(pipes_struct *p,
5966 struct samr_RidToSid *r)
5968 p->rng_fault_state = true;
5969 return NT_STATUS_NOT_IMPLEMENTED;
5972 /****************************************************************
5973 ****************************************************************/
5975 NTSTATUS _samr_SetDsrmPassword(pipes_struct *p,
5976 struct samr_SetDsrmPassword *r)
5978 p->rng_fault_state = true;
5979 return NT_STATUS_NOT_IMPLEMENTED;
5982 /****************************************************************
5983 ****************************************************************/
5985 NTSTATUS _samr_ValidatePassword(pipes_struct *p,
5986 struct samr_ValidatePassword *r)
5988 p->rng_fault_state = true;
5989 return NT_STATUS_NOT_IMPLEMENTED;