source3/utils/net_sam.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  Local SAM access routines
   4  *  Copyright (C) Volker Lendecke 2006
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20
  21 #include "includes.h"
  22 #include "system/passwd.h"
  23 #include "utils/net.h"
  24 #include "../librpc/gen_ndr/samr.h"
  25 #include "smbldap.h"
  26 #include "../libcli/security/security.h"
  27 #include "lib/winbind_util.h"
  28 #include "passdb.h"
  29 #include "passdb/pdb_ldap_util.h"
  30 #include "passdb/pdb_ldap_schema.h"
  31 #include "lib/privileges.h"
  32 #include "secrets.h"
  33 #include "idmap.h"
  34
  35 /*
  36  * Set a user's data
  37  */
  38
  39 static int net_sam_userset(struct net_context *c, int argc, const char **argv,
  40                            const char *field,
  41                            bool (*fn)(struct samu *, const char *,
  42                                       enum pdb_value_state))
  43 {
  44         struct samu *sam_acct = NULL;
  45         struct dom_sid sid;
  46         enum lsa_SidType type;
  47         const char *dom, *name;
  48         NTSTATUS status;
  49
  50         if (argc != 2 || c->display_usage) {
  51                 d_fprintf(stderr, "%s\n", _("Usage:"));
  52                 d_fprintf(stderr, _("net sam set %s <user> <value>\n"),
  53                           field);
  54                 return -1;
  55         }
  56
  57         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
  58                          &dom, &name, &sid, &type)) {
  59                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
  60                 return -1;
  61         }
  62
  63         if (type != SID_NAME_USER) {
  64                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
  65                           sid_type_lookup(type));
  66                 return -1;
  67         }
  68
  69         if ( !(sam_acct = samu_new( NULL )) ) {
  70                 d_fprintf(stderr, _("Internal error\n"));
  71                 return -1;
  72         }
  73
  74         if (!pdb_getsampwsid(sam_acct, &sid)) {
  75                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
  76                 return -1;
  77         }
  78
  79         if (!fn(sam_acct, argv[1], PDB_CHANGED)) {
  80                 d_fprintf(stderr, _("Internal error\n"));
  81                 return -1;
  82         }
  83
  84         status = pdb_update_sam_account(sam_acct);
  85         if (!NT_STATUS_IS_OK(status)) {
  86                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
  87                           argv[0], nt_errstr(status));
  88                 return -1;
  89         }
  90
  91         TALLOC_FREE(sam_acct);
  92
  93         d_printf(_("Updated %s for %s\\%s to %s\n"), field, dom, name, argv[1]);
  94         return 0;
  95 }
  96
  97 static int net_sam_set_fullname(struct net_context *c, int argc,
  98                                 const char **argv)
  99 {
 100         return net_sam_userset(c, argc, argv, "fullname",
 101                                pdb_set_fullname);
 102 }
 103
 104 static int net_sam_set_logonscript(struct net_context *c, int argc,
 105                                    const char **argv)
 106 {
 107         return net_sam_userset(c, argc, argv, "logonscript",
 108                                pdb_set_logon_script);
 109 }
 110
 111 static int net_sam_set_profilepath(struct net_context *c, int argc,
 112                                    const char **argv)
 113 {
 114         return net_sam_userset(c, argc, argv, "profilepath",
 115                                pdb_set_profile_path);
 116 }
 117
 118 static int net_sam_set_homedrive(struct net_context *c, int argc,
 119                                  const char **argv)
 120 {
 121         return net_sam_userset(c, argc, argv, "homedrive",
 122                                pdb_set_dir_drive);
 123 }
 124
 125 static int net_sam_set_homedir(struct net_context *c, int argc,
 126                                const char **argv)
 127 {
 128         return net_sam_userset(c, argc, argv, "homedir",
 129                                pdb_set_homedir);
 130 }
 131
 132 static int net_sam_set_workstations(struct net_context *c, int argc,
 133                                     const char **argv)
 134 {
 135         return net_sam_userset(c, argc, argv, "workstations",
 136                                pdb_set_workstations);
 137 }
 138
 139 /*
 140  * Set account flags
 141  */
 142
 143 static int net_sam_set_userflag(struct net_context *c, int argc,
 144                                 const char **argv, const char *field,
 145                                 uint16_t flag)
 146 {
 147         struct samu *sam_acct = NULL;
 148         struct dom_sid sid;
 149         enum lsa_SidType type;
 150         const char *dom, *name;
 151         NTSTATUS status;
 152         uint32_t acct_flags;
 153
 154         if ((argc != 2) || c->display_usage ||
 155             (!strequal(argv[1], "yes") &&
 156              !strequal(argv[1], "no"))) {
 157                 d_fprintf(stderr, "%s\n", _("Usage:"));
 158                 d_fprintf(stderr, _("net sam set %s <user> [yes|no]\n"),
 159                           field);
 160                 return -1;
 161         }
 162
 163         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 164                          &dom, &name, &sid, &type)) {
 165                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 166                 return -1;
 167         }
 168
 169         if (type != SID_NAME_USER) {
 170                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
 171                           sid_type_lookup(type));
 172                 return -1;
 173         }
 174
 175         if ( !(sam_acct = samu_new( NULL )) ) {
 176                 d_fprintf(stderr, _("Internal error\n"));
 177                 return -1;
 178         }
 179
 180         if (!pdb_getsampwsid(sam_acct, &sid)) {
 181                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
 182                 return -1;
 183         }
 184
 185         acct_flags = pdb_get_acct_ctrl(sam_acct);
 186
 187         if (strequal(argv[1], "yes")) {
 188                 acct_flags |= flag;
 189         } else {
 190                 acct_flags &= ~flag;
 191         }
 192
 193         pdb_set_acct_ctrl(sam_acct, acct_flags, PDB_CHANGED);
 194
 195         status = pdb_update_sam_account(sam_acct);
 196         if (!NT_STATUS_IS_OK(status)) {
 197                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
 198                           argv[0], nt_errstr(status));
 199                 return -1;
 200         }
 201
 202         TALLOC_FREE(sam_acct);
 203
 204         d_fprintf(stderr, _("Updated flag %s for %s\\%s to %s\n"), field, dom,
 205                   name, argv[1]);
 206         return 0;
 207 }
 208
 209 static int net_sam_set_disabled(struct net_context *c, int argc,
 210                                 const char **argv)
 211 {
 212         return net_sam_set_userflag(c, argc, argv, "disabled", ACB_DISABLED);
 213 }
 214
 215 static int net_sam_set_pwnotreq(struct net_context *c, int argc,
 216                                 const char **argv)
 217 {
 218         return net_sam_set_userflag(c, argc, argv, "pwnotreq", ACB_PWNOTREQ);
 219 }
 220
 221 static int net_sam_set_autolock(struct net_context *c, int argc,
 222                                 const char **argv)
 223 {
 224         return net_sam_set_userflag(c, argc, argv, "autolock", ACB_AUTOLOCK);
 225 }
 226
 227 static int net_sam_set_pwnoexp(struct net_context *c, int argc,
 228                                const char **argv)
 229 {
 230         return net_sam_set_userflag(c, argc, argv, "pwnoexp", ACB_PWNOEXP);
 231 }
 232
 233 /*
 234  * Set pass last change time, based on force pass change now
 235  */
 236
 237 static int net_sam_set_pwdmustchangenow(struct net_context *c, int argc,
 238                                         const char **argv)
 239 {
 240         struct samu *sam_acct = NULL;
 241         struct dom_sid sid;
 242         enum lsa_SidType type;
 243         const char *dom, *name;
 244         NTSTATUS status;
 245
 246         if ((argc != 2) || c->display_usage ||
 247             (!strequal(argv[1], "yes") &&
 248              !strequal(argv[1], "no"))) {
 249                 d_fprintf(stderr, "%s\n%s",
 250                           _("Usage:"),
 251                           _("net sam set pwdmustchangenow <user> [yes|no]\n"));
 252                 return -1;
 253         }
 254
 255         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 256                          &dom, &name, &sid, &type)) {
 257                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 258                 return -1;
 259         }
 260
 261         if (type != SID_NAME_USER) {
 262                 d_fprintf(stderr, _("%s is a %s, not a user\n"), argv[0],
 263                           sid_type_lookup(type));
 264                 return -1;
 265         }
 266
 267         if ( !(sam_acct = samu_new( NULL )) ) {
 268                 d_fprintf(stderr, _("Internal error\n"));
 269                 return -1;
 270         }
 271
 272         if (!pdb_getsampwsid(sam_acct, &sid)) {
 273                 d_fprintf(stderr, _("Loading user %s failed\n"), argv[0]);
 274                 return -1;
 275         }
 276
 277         if (strequal(argv[1], "yes")) {
 278                 pdb_set_pass_last_set_time(sam_acct, 0, PDB_CHANGED);
 279         } else {
 280                 pdb_set_pass_last_set_time(sam_acct, time(NULL), PDB_CHANGED);
 281         }
 282
 283         status = pdb_update_sam_account(sam_acct);
 284         if (!NT_STATUS_IS_OK(status)) {
 285                 d_fprintf(stderr, _("Updating sam account %s failed with %s\n"),
 286                           argv[0], nt_errstr(status));
 287                 return -1;
 288         }
 289
 290         TALLOC_FREE(sam_acct);
 291
 292         d_fprintf(stderr, _("Updated 'user must change password at next logon' "
 293                             "for %s\\%s to %s\n"), dom,
 294                   name, argv[1]);
 295         return 0;
 296 }
 297
 298
 299 /*
 300  * Set a user's or a group's comment
 301  */
 302
 303 static int net_sam_set_comment(struct net_context *c, int argc,
 304                                const char **argv)
 305 {
 306         GROUP_MAP *map;
 307         struct dom_sid sid;
 308         enum lsa_SidType type;
 309         const char *dom, *name;
 310         NTSTATUS status;
 311
 312         if (argc != 2 || c->display_usage) {
 313                 d_fprintf(stderr, "%s\n%s",
 314                           _("Usage:"),
 315                           _("net sam set comment <name> <comment>\n"));
 316                 return -1;
 317         }
 318
 319         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 320                          &dom, &name, &sid, &type)) {
 321                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 322                 return -1;
 323         }
 324
 325         if (type == SID_NAME_USER) {
 326                 return net_sam_userset(c, argc, argv, "comment",
 327                                        pdb_set_acct_desc);
 328         }
 329
 330         if ((type != SID_NAME_DOM_GRP) && (type != SID_NAME_ALIAS) &&
 331             (type != SID_NAME_WKN_GRP)) {
 332                 d_fprintf(stderr, _("%s is a %s, not a group\n"), argv[0],
 333                           sid_type_lookup(type));
 334                 return -1;
 335         }
 336
 337         map = talloc_zero(talloc_tos(), GROUP_MAP);
 338         if (!map) {
 339                 d_fprintf(stderr, _("Out of memory!\n"));
 340                 return -1;
 341         }
 342
 343         if (!pdb_getgrsid(map, sid)) {
 344                 d_fprintf(stderr, _("Could not load group %s\n"), argv[0]);
 345                 return -1;
 346         }
 347
 348         map->comment = talloc_strdup(map, argv[1]);
 349         if (!map->comment) {
 350                 d_fprintf(stderr, _("Out of memory!\n"));
 351                 return -1;
 352         }
 353
 354         status = pdb_update_group_mapping_entry(map);
 355
 356         if (!NT_STATUS_IS_OK(status)) {
 357                 d_fprintf(stderr, _("Updating group mapping entry failed with "
 358                           "%s\n"), nt_errstr(status));
 359                 return -1;
 360         }
 361
 362         d_printf("Updated comment of group %s\\%s to %s\n", dom, name,
 363                  argv[1]);
 364
 365         TALLOC_FREE(map);
 366         return 0;
 367 }
 368
 369 static int net_sam_set(struct net_context *c, int argc, const char **argv)
 370 {
 371         struct functable func[] = {
 372                 {
 373                         "homedir",
 374                         net_sam_set_homedir,
 375                         NET_TRANSPORT_LOCAL,
 376                         N_("Change a user's home directory"),
 377                         N_("net sam set homedir\n"
 378                            "    Change a user's home directory")
 379                 },
 380                 {
 381                         "profilepath",
 382                         net_sam_set_profilepath,
 383                         NET_TRANSPORT_LOCAL,
 384                         N_("Change a user's profile path"),
 385                         N_("net sam set profilepath\n"
 386                            "    Change a user's profile path")
 387                 },
 388                 {
 389                         "comment",
 390                         net_sam_set_comment,
 391                         NET_TRANSPORT_LOCAL,
 392                         N_("Change a users or groups description"),
 393                         N_("net sam set comment\n"
 394                            "    Change a users or groups description")
 395                 },
 396                 {
 397                         "fullname",
 398                         net_sam_set_fullname,
 399                         NET_TRANSPORT_LOCAL,
 400                         N_("Change a user's full name"),
 401                         N_("net sam set fullname\n"
 402                            "    Change a user's full name")
 403                 },
 404                 {
 405                         "logonscript",
 406                         net_sam_set_logonscript,
 407                         NET_TRANSPORT_LOCAL,
 408                         N_("Change a user's logon script"),
 409                         N_("net sam set logonscript\n"
 410                            "    Change a user's logon script")
 411                 },
 412                 {
 413                         "homedrive",
 414                         net_sam_set_homedrive,
 415                         NET_TRANSPORT_LOCAL,
 416                         N_("Change a user's home drive"),
 417                         N_("net sam set homedrive\n"
 418                            "    Change a user's home drive")
 419                 },
 420                 {
 421                         "workstations",
 422                         net_sam_set_workstations,
 423                         NET_TRANSPORT_LOCAL,
 424                         N_("Change a user's allowed workstations"),
 425                         N_("net sam set workstations\n"
 426                            "    Change a user's allowed workstations")
 427                 },
 428                 {
 429                         "disabled",
 430                         net_sam_set_disabled,
 431                         NET_TRANSPORT_LOCAL,
 432                         N_("Disable/Enable a user"),
 433                         N_("net sam set disable\n"
 434                            "    Disable/Enable a user")
 435                 },
 436                 {
 437                         "pwnotreq",
 438                         net_sam_set_pwnotreq,
 439                         NET_TRANSPORT_LOCAL,
 440                         N_("Disable/Enable the password not required flag"),
 441                         N_("net sam set pwnotreq\n"
 442                            "    Disable/Enable the password not required flag")
 443                 },
 444                 {
 445                         "autolock",
 446                         net_sam_set_autolock,
 447                         NET_TRANSPORT_LOCAL,
 448                         N_("Disable/Enable a user's lockout flag"),
 449                         N_("net sam set autolock\n"
 450                            "    Disable/Enable a user's lockout flag")
 451                 },
 452                 {
 453                         "pwnoexp",
 454                         net_sam_set_pwnoexp,
 455                         NET_TRANSPORT_LOCAL,
 456                         N_("Disable/Enable whether a user's pw does not "
 457                            "expire"),
 458                         N_("net sam set pwnoexp\n"
 459                            "    Disable/Enable whether a user's pw does not "
 460                            "expire")
 461                 },
 462                 {
 463                         "pwdmustchangenow",
 464                         net_sam_set_pwdmustchangenow,
 465                         NET_TRANSPORT_LOCAL,
 466                         N_("Force users password must change at next logon"),
 467                         N_("net sam set pwdmustchangenow\n"
 468                            "    Force users password must change at next logon")
 469                 },
 470                 {NULL, NULL, 0, NULL, NULL}
 471         };
 472
 473         return net_run_function(c, argc, argv, "net sam set", func);
 474 }
 475
 476 /*
 477  * Manage account policies
 478  */
 479
 480 static int net_sam_policy_set(struct net_context *c, int argc, const char **argv)
 481 {
 482         const char *account_policy = NULL;
 483         uint32_t value = 0;
 484         uint32_t old_value = 0;
 485         enum pdb_policy_type field;
 486         char *endptr;
 487
 488         if (argc != 2 || c->display_usage) {
 489                 d_fprintf(stderr, "%s\n%s",
 490                           _("Usage:"),
 491                           _("net sam policy set \"<account policy>\" <value>\n"));
 492                 return -1;
 493         }
 494
 495         account_policy = argv[0];
 496         field = account_policy_name_to_typenum(account_policy);
 497
 498         if (strequal(argv[1], "forever") || strequal(argv[1], "never")
 499             || strequal(argv[1], "off")) {
 500                 value = -1;
 501         }
 502         else {
 503                 value = strtoul(argv[1], &endptr, 10);
 504
 505                 if ((endptr == argv[1]) || (endptr[0] != '\0')) {
 506                         d_printf(_("Unable to set policy \"%s\"! Invalid value "
 507                                  "\"%s\".\n"),
 508                                  account_policy, argv[1]);
 509                         return -1;
 510                 }
 511         }
 512
 513         if (field == 0) {
 514                 const char **names;
 515                 int i, count;
 516
 517                 account_policy_names_list(talloc_tos(), &names, &count);
 518                 d_fprintf(stderr, _("No account policy \"%s\"!\n\n"), argv[0]);
 519                 d_fprintf(stderr, _("Valid account policies are:\n"));
 520
 521                 for (i=0; i<count; i++) {
 522                         d_fprintf(stderr, "%s\n", names[i]);
 523                 }
 524
 525                 TALLOC_FREE(names);
 526
 527                 return -1;
 528         }
 529
 530         if (!pdb_get_account_policy(field, &old_value)) {
 531                 d_fprintf(stderr, _("Valid account policy, but unable to fetch "
 532                           "value!\n"));
 533         } else {
 534                 d_printf(_("Account policy \"%s\" value was: %d\n"),
 535                         account_policy, old_value);
 536         }
 537
 538         if (!pdb_set_account_policy(field, value)) {
 539                 d_fprintf(stderr, _("Valid account policy, but unable to "
 540                           "set value!\n"));
 541                 return -1;
 542         } else {
 543                 d_printf(_("Account policy \"%s\" value is now: %d\n"),
 544                         account_policy, value);
 545         }
 546
 547         return 0;
 548 }
 549
 550 static int net_sam_policy_show(struct net_context *c, int argc, const char **argv)
 551 {
 552         const char *account_policy = NULL;
 553         uint32_t old_value;
 554         enum pdb_policy_type field;
 555
 556         if (argc != 1 || c->display_usage) {
 557                 d_fprintf(stderr, "%s\n%s",
 558                           _("Usage:"),
 559                           _("net sam policy show \"<account policy>\"\n"));
 560                 return -1;
 561         }
 562
 563         account_policy = argv[0];
 564         field = account_policy_name_to_typenum(account_policy);
 565
 566         if (field == 0) {
 567                 const char **names;
 568                 int count;
 569                 int i;
 570                 account_policy_names_list(talloc_tos(), &names, &count);
 571                 d_fprintf(stderr, _("No account policy by that name!\n"));
 572                 if (count != 0) {
 573                         d_fprintf(stderr, _("Valid account policies "
 574                                   "are:\n"));
 575                         for (i=0; i<count; i++) {
 576                                 d_fprintf(stderr, "%s\n", names[i]);
 577                         }
 578                 }
 579                 TALLOC_FREE(names);
 580                 return -1;
 581         }
 582
 583         if (!pdb_get_account_policy(field, &old_value)) {
 584                 fprintf(stderr, _("Valid account policy, but unable to "
 585                         "fetch value!\n"));
 586                 return -1;
 587         }
 588
 589         printf(_("Account policy \"%s\" description: %s\n"),
 590                account_policy, account_policy_get_desc(field));
 591         printf(_("Account policy \"%s\" value is: %d\n"), account_policy,
 592                old_value);
 593         return 0;
 594 }
 595
 596 static int net_sam_policy_list(struct net_context *c, int argc, const char **argv)
 597 {
 598         const char **names;
 599         int count;
 600         int i;
 601
 602         if (c->display_usage) {
 603                 d_printf(  "%s\n"
 604                            "net sam policy list\n"
 605                            "    %s\n",
 606                          _("Usage:"),
 607                          _("List account policies"));
 608                 return 0;
 609         }
 610
 611         account_policy_names_list(talloc_tos(), &names, &count);
 612         if (count != 0) {
 613                 d_fprintf(stderr, _("Valid account policies "
 614                           "are:\n"));
 615                 for (i = 0; i < count ; i++) {
 616                         d_fprintf(stderr, "%s\n", names[i]);
 617                 }
 618         }
 619         TALLOC_FREE(names);
 620         return -1;
 621 }
 622
 623 static int net_sam_policy(struct net_context *c, int argc, const char **argv)
 624 {
 625         struct functable func[] = {
 626                 {
 627                         "list",
 628                         net_sam_policy_list,
 629                         NET_TRANSPORT_LOCAL,
 630                         N_("List account policies"),
 631                         N_("net sam policy list\n"
 632                            "    List account policies")
 633                 },
 634                 {
 635                         "show",
 636                         net_sam_policy_show,
 637                         NET_TRANSPORT_LOCAL,
 638                         N_("Show account policies"),
 639                         N_("net sam policy show\n"
 640                            "    Show account policies")
 641                 },
 642                 {
 643                         "set",
 644                         net_sam_policy_set,
 645                         NET_TRANSPORT_LOCAL,
 646                         N_("Change account policies"),
 647                         N_("net sam policy set\n"
 648                            "    Change account policies")
 649                 },
 650                 {NULL, NULL, 0, NULL, NULL}
 651         };
 652
 653         return net_run_function(c, argc, argv, "net sam policy", func);
 654 }
 655
 656 static int net_sam_rights_list(struct net_context *c, int argc,
 657                                const char **argv)
 658 {
 659         enum sec_privilege privilege;
 660
 661         if (argc > 1 || c->display_usage) {
 662                 d_fprintf(stderr, "%s\n%s",
 663                           _("Usage:"),
 664                           _("net sam rights list [privilege name]\n"));
 665                 return -1;
 666         }
 667
 668         if (argc == 0) {
 669                 int i;
 670                 int num = num_privileges_in_short_list();
 671
 672                 for (i=0; i<num; i++) {
 673                         d_printf("%s\n", sec_privilege_name_from_index(i));
 674                 }
 675                 return 0;
 676         }
 677
 678         privilege = sec_privilege_id(argv[0]);
 679
 680         if (privilege != SEC_PRIV_INVALID) {
 681                 struct dom_sid *sids;
 682                 int i, num_sids;
 683                 NTSTATUS status;
 684
 685                 status = privilege_enum_sids(privilege, talloc_tos(),
 686                                              &sids, &num_sids);
 687                 if (!NT_STATUS_IS_OK(status)) {
 688                         d_fprintf(stderr, _("Could not list rights: %s\n"),
 689                                   nt_errstr(status));
 690                         return -1;
 691                 }
 692
 693                 for (i=0; i<num_sids; i++) {
 694                         const char *dom, *name;
 695                         enum lsa_SidType type;
 696
 697                         if (lookup_sid(talloc_tos(), &sids[i], &dom, &name,
 698                                        &type)) {
 699                                 d_printf("%s\\%s\n", dom, name);
 700                         }
 701                         else {
 702                                 d_printf("%s\n", sid_string_tos(&sids[i]));
 703                         }
 704                 }
 705                 return 0;
 706         }
 707
 708         return -1;
 709 }
 710
 711 static int net_sam_rights_grant(struct net_context *c, int argc,
 712                                 const char **argv)
 713 {
 714         struct dom_sid sid;
 715         enum lsa_SidType type;
 716         const char *dom, *name;
 717         int i;
 718
 719         if (argc < 2 || c->display_usage) {
 720                 d_fprintf(stderr, "%s\n%s",
 721                           _("Usage:"),
 722                           _("net sam rights grant <name> <rights> ...\n"));
 723                 return -1;
 724         }
 725
 726         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 727                         &dom, &name, &sid, &type)) {
 728                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 729                 return -1;
 730         }
 731
 732         for (i=1; i < argc; i++) {
 733                 enum sec_privilege privilege = sec_privilege_id(argv[i]);
 734                 if (privilege == SEC_PRIV_INVALID) {
 735                         d_fprintf(stderr, _("%s unknown\n"), argv[i]);
 736                         return -1;
 737                 }
 738
 739                 if (!grant_privilege_by_name(&sid, argv[i])) {
 740                         d_fprintf(stderr, _("Could not grant privilege\n"));
 741                         return -1;
 742                 }
 743
 744                 d_printf(_("Granted %s to %s\\%s\n"), argv[i], dom, name);
 745         }
 746
 747         return 0;
 748 }
 749
 750 static int net_sam_rights_revoke(struct net_context *c, int argc,
 751                                 const char **argv)
 752 {
 753         struct dom_sid sid;
 754         enum lsa_SidType type;
 755         const char *dom, *name;
 756         int i;
 757
 758         if (argc < 2 || c->display_usage) {
 759                 d_fprintf(stderr, "%s\n%s",
 760                           _("Usage:"),
 761                           _("net sam rights revoke <name> <rights>\n"));
 762                 return -1;
 763         }
 764
 765         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
 766                         &dom, &name, &sid, &type)) {
 767                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
 768                 return -1;
 769         }
 770
 771         for (i=1; i < argc; i++) {
 772                 enum sec_privilege privilege = sec_privilege_id(argv[i]);
 773                 if (privilege == SEC_PRIV_INVALID) {
 774                         d_fprintf(stderr, _("%s unknown\n"), argv[i]);
 775                         return -1;
 776                 }
 777
 778                 if (!revoke_privilege_by_name(&sid, argv[i])) {
 779                         d_fprintf(stderr, _("Could not revoke privilege\n"));
 780                         return -1;
 781                 }
 782
 783                 d_printf(_("Revoked %s from %s\\%s\n"), argv[i], dom, name);
 784         }
 785
 786         return 0;
 787 }
 788
 789 static int net_sam_rights(struct net_context *c, int argc, const char **argv)
 790 {
 791         struct functable func[] = {
 792                 {
 793                         "list",
 794                         net_sam_rights_list,
 795                         NET_TRANSPORT_LOCAL,
 796                         N_("List possible user rights"),
 797                         N_("net sam rights list\n"
 798                            "    List possible user rights")
 799                 },
 800                 {
 801                         "grant",
 802                         net_sam_rights_grant,
 803                         NET_TRANSPORT_LOCAL,
 804                         N_("Grant right(s)"),
 805                         N_("net sam rights grant\n"
 806                            "    Grant right(s)")
 807                 },
 808                 {
 809                         "revoke",
 810                         net_sam_rights_revoke,
 811                         NET_TRANSPORT_LOCAL,
 812                         N_("Revoke right(s)"),
 813                         N_("net sam rights revoke\n"
 814                            "    Revoke right(s)")
 815                 },
 816                 {NULL, NULL, 0, NULL, NULL}
 817         };
 818         return net_run_function(c, argc, argv, "net sam rights", func);
 819 }
 820
 821 /*
 822  * Map a unix group to a domain group
 823  */
 824
 825 static NTSTATUS map_unix_group(const struct group *grp, GROUP_MAP *map)
 826 {
 827         const char *dom, *name;
 828         uint32_t rid;
 829
 830         if (pdb_getgrgid(map, grp->gr_gid)) {
 831                 return NT_STATUS_GROUP_EXISTS;
 832         }
 833
 834         map->gid = grp->gr_gid;
 835
 836         if (lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 837                         &dom, &name, NULL, NULL)) {
 838
 839                 map->nt_name = talloc_asprintf(map, "Unix Group %s",
 840                                                         grp->gr_name);
 841
 842                 DEBUG(5, ("%s exists as %s\\%s, retrying as \"%s\"\n",
 843                           grp->gr_name, dom, name, map->nt_name));
 844         }
 845
 846         if (lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 847                         NULL, NULL, NULL, NULL)) {
 848                 DEBUG(3, ("\"%s\" exists, can't map it\n", grp->gr_name));
 849                 return NT_STATUS_GROUP_EXISTS;
 850         }
 851
 852         if (pdb_capabilities() & PDB_CAP_STORE_RIDS) {
 853                 if (!pdb_new_rid(&rid)) {
 854                         DEBUG(3, ("Could not get a new RID for %s\n",
 855                                   grp->gr_name));
 856                         return NT_STATUS_ACCESS_DENIED;
 857                 }
 858         } else {
 859                 rid = algorithmic_pdb_gid_to_group_rid( grp->gr_gid );
 860         }
 861
 862         sid_compose(&map->sid, get_global_sam_sid(), rid);
 863         map->sid_name_use = SID_NAME_DOM_GRP;
 864         map->comment = talloc_asprintf(map, "Unix Group %s", grp->gr_name);
 865
 866         return pdb_add_group_mapping_entry(map);
 867 }
 868
 869 static int net_sam_mapunixgroup(struct net_context *c, int argc, const char **argv)
 870 {
 871         NTSTATUS status;
 872         GROUP_MAP *map;
 873         struct group *grp;
 874
 875         if (argc != 1 || c->display_usage) {
 876                 d_fprintf(stderr, "%s\n%s",
 877                           _("Usage:"),
 878                           _("net sam mapunixgroup <name>\n"));
 879                 return -1;
 880         }
 881
 882         grp = getgrnam(argv[0]);
 883         if (grp == NULL) {
 884                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
 885                 return -1;
 886         }
 887
 888         map = talloc_zero(talloc_tos(), GROUP_MAP);
 889         if (!map) {
 890                 d_fprintf(stderr, _("Out of memory!\n"));
 891                 return -1;
 892         }
 893
 894         status = map_unix_group(grp, map);
 895
 896         if (!NT_STATUS_IS_OK(status)) {
 897                 d_fprintf(stderr, _("Mapping group %s failed with %s\n"),
 898                           argv[0], nt_errstr(status));
 899                 return -1;
 900         }
 901
 902         d_printf(_("Mapped unix group %s to SID %s\n"), argv[0],
 903                  sid_string_tos(&map->sid));
 904
 905         TALLOC_FREE(map);
 906         return 0;
 907 }
 908
 909 /*
 910  * Remove a group mapping
 911  */
 912
 913 static NTSTATUS unmap_unix_group(const struct group *grp)
 914 {
 915         struct dom_sid dom_sid;
 916         struct unixid id;
 917
 918         if (!lookup_name(talloc_tos(), grp->gr_name, LOOKUP_NAME_LOCAL,
 919                         NULL, NULL, NULL, NULL)) {
 920                 DEBUG(3, ("\"%s\" does not exist, can't unmap it\n", grp->gr_name));
 921                 return NT_STATUS_NO_SUCH_GROUP;
 922         }
 923
 924         id.id = grp->gr_gid;
 925         id.type = ID_TYPE_GID;
 926         if (!pdb_id_to_sid(&id, &dom_sid)) {
 927                 return NT_STATUS_UNSUCCESSFUL;
 928         }
 929
 930         return pdb_delete_group_mapping_entry(dom_sid);
 931 }
 932
 933 static int net_sam_unmapunixgroup(struct net_context *c, int argc, const char **argv)
 934 {
 935         NTSTATUS status;
 936         struct group *grp;
 937
 938         if (argc != 1 || c->display_usage) {
 939                 d_fprintf(stderr, "%s\n%s",
 940                           _("Usage:"),
 941                           _("net sam unmapunixgroup <name>\n"));
 942                 return -1;
 943         }
 944
 945         grp = getgrnam(argv[0]);
 946         if (grp == NULL) {
 947                 d_fprintf(stderr, _("Could not find mapping for group %s.\n"),
 948                           argv[0]);
 949                 return -1;
 950         }
 951
 952         status = unmap_unix_group(grp);
 953
 954         if (!NT_STATUS_IS_OK(status)) {
 955                 d_fprintf(stderr, _("Unmapping group %s failed with %s.\n"),
 956                           argv[0], nt_errstr(status));
 957                 return -1;
 958         }
 959
 960         d_printf(_("Unmapped unix group %s.\n"), argv[0]);
 961
 962         return 0;
 963 }
 964
 965 /*
 966  * Create a domain group
 967  */
 968
 969 static int net_sam_createdomaingroup(struct net_context *c, int argc,
 970                                      const char **argv)
 971 {
 972         NTSTATUS status;
 973         uint32_t rid;
 974
 975         if (argc != 1 || c->display_usage) {
 976                 d_fprintf(stderr, "%s\n%s",
 977                           _("Usage:"),
 978                           _("net sam createdomaingroup <name>\n"));
 979                 return -1;
 980         }
 981
 982         status = pdb_create_dom_group(talloc_tos(), argv[0], &rid);
 983
 984         if (!NT_STATUS_IS_OK(status)) {
 985                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
 986                           argv[0], nt_errstr(status));
 987                 return -1;
 988         }
 989
 990         d_printf(_("Created domain group %s with RID %d\n"), argv[0], rid);
 991
 992         return 0;
 993 }
 994
 995 /*
 996  * Delete a domain group
 997  */
 998
 999 static int net_sam_deletedomaingroup(struct net_context *c, int argc,
1000                                      const char **argv)
1001 {
1002         struct dom_sid sid;
1003         uint32_t rid;
1004         enum lsa_SidType type;
1005         const char *dom, *name;
1006         NTSTATUS status;
1007
1008         if (argc != 1 || c->display_usage) {
1009                 d_fprintf(stderr, "%s\n%s",
1010                           _("Usage:"),
1011                           _("net sam deletelocalgroup <name>\n"));
1012                 return -1;
1013         }
1014
1015         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1016                          &dom, &name, &sid, &type)) {
1017                 d_fprintf(stderr, _("Could not find %s.\n"), argv[0]);
1018                 return -1;
1019         }
1020
1021         if (type != SID_NAME_DOM_GRP) {
1022                 d_fprintf(stderr, _("%s is a %s, not a domain group.\n"),
1023                           argv[0], sid_type_lookup(type));
1024                 return -1;
1025         }
1026
1027         sid_peek_rid(&sid, &rid);
1028
1029         status = pdb_delete_dom_group(talloc_tos(), rid);
1030
1031         if (!NT_STATUS_IS_OK(status)) {
1032                 d_fprintf(stderr,_("Deleting domain group %s failed with %s\n"),
1033                           argv[0], nt_errstr(status));
1034                 return -1;
1035         }
1036
1037         d_printf(_("Deleted domain group %s.\n"), argv[0]);
1038
1039         return 0;
1040 }
1041
1042 /*
1043  * Create a local group
1044  */
1045
1046 static int net_sam_createlocalgroup(struct net_context *c, int argc, const char **argv)
1047 {
1048         NTSTATUS status;
1049         uint32_t rid;
1050
1051         if (argc != 1 || c->display_usage) {
1052                 d_fprintf(stderr, "%s\n%s",
1053                           _("Usage:"),
1054                           _("net sam createlocalgroup <name>\n"));
1055                 return -1;
1056         }
1057
1058         if (!winbind_ping()) {
1059                 d_fprintf(stderr, _("winbind seems not to run. "
1060                           "createlocalgroup only works when winbind runs.\n"));
1061                 return -1;
1062         }
1063
1064         status = pdb_create_alias(argv[0], &rid);
1065
1066         if (!NT_STATUS_IS_OK(status)) {
1067                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
1068                           argv[0], nt_errstr(status));
1069                 return -1;
1070         }
1071
1072         d_printf(_("Created local group %s with RID %d\n"), argv[0], rid);
1073
1074         return 0;
1075 }
1076
1077 /*
1078  * Delete a local group
1079  */
1080
1081 static int net_sam_deletelocalgroup(struct net_context *c, int argc, const char **argv)
1082 {
1083         struct dom_sid sid;
1084         enum lsa_SidType type;
1085         const char *dom, *name;
1086         NTSTATUS status;
1087
1088         if (argc != 1 || c->display_usage) {
1089                 d_fprintf(stderr, "%s\n%s",
1090                           _("Usage:"),
1091                           _("net sam deletelocalgroup <name>\n"));
1092                 return -1;
1093         }
1094
1095         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1096                          &dom, &name, &sid, &type)) {
1097                 d_fprintf(stderr,_("Could not find %s.\n"), argv[0]);
1098                 return -1;
1099         }
1100
1101         if (type != SID_NAME_ALIAS) {
1102                 d_fprintf(stderr, _("%s is a %s, not a local group.\n"),argv[0],
1103                           sid_type_lookup(type));
1104                 return -1;
1105         }
1106
1107         status = pdb_delete_alias(&sid);
1108
1109         if (!NT_STATUS_IS_OK(status)) {
1110                 d_fprintf(stderr, _("Deleting local group %s failed with %s\n"),
1111                           argv[0], nt_errstr(status));
1112                 return -1;
1113         }
1114
1115         d_printf(_("Deleted local group %s.\n"), argv[0]);
1116
1117         return 0;
1118 }
1119
1120 /*
1121  * Create a builtin group
1122  */
1123
1124 static int net_sam_createbuiltingroup(struct net_context *c, int argc, const char **argv)
1125 {
1126         NTSTATUS status;
1127         uint32_t rid;
1128         enum lsa_SidType type;
1129         fstring groupname;
1130         struct dom_sid sid;
1131
1132         if (argc != 1 || c->display_usage) {
1133                 d_fprintf(stderr, "%s\n%s",
1134                           _("Usage:"),
1135                           _("net sam createbuiltingroup <name>\n"));
1136                 return -1;
1137         }
1138
1139         if (!winbind_ping()) {
1140                 d_fprintf(stderr, _("winbind seems not to run. "
1141                           "createbuiltingroup only works when winbind "
1142                           "runs.\n"));
1143                 return -1;
1144         }
1145
1146         /* validate the name and get the group */
1147
1148         fstrcpy( groupname, "BUILTIN\\" );
1149         fstrcat( groupname, argv[0] );
1150
1151         if ( !lookup_name(talloc_tos(), groupname, LOOKUP_NAME_ALL, NULL,
1152                           NULL, &sid, &type)) {
1153                 d_fprintf(stderr, _("%s is not a BUILTIN group\n"), argv[0]);
1154                 return -1;
1155         }
1156
1157         if ( !sid_peek_rid( &sid, &rid ) ) {
1158                 d_fprintf(stderr, _("Failed to get RID for %s\n"), argv[0]);
1159                 return -1;
1160         }
1161
1162         status = pdb_create_builtin(rid);
1163
1164         if (!NT_STATUS_IS_OK(status)) {
1165                 d_fprintf(stderr, _("Creating %s failed with %s\n"),
1166                           argv[0], nt_errstr(status));
1167                 return -1;
1168         }
1169
1170         d_printf(_("Created BUILTIN group %s with RID %d\n"), argv[0], rid);
1171
1172         return 0;
1173 }
1174
1175 /*
1176  * Add a group member
1177  */
1178
1179 static int net_sam_addmem(struct net_context *c, int argc, const char **argv)
1180 {
1181         const char *groupdomain, *groupname, *memberdomain, *membername;
1182         struct dom_sid group, member;
1183         enum lsa_SidType grouptype, membertype;
1184         NTSTATUS status;
1185
1186         if (argc != 2 || c->display_usage) {
1187                 d_fprintf(stderr, "%s\n%s",
1188                           _("Usage:"),
1189                           _("net sam addmem <group> <member>\n"));
1190                 return -1;
1191         }
1192
1193         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1194                          &groupdomain, &groupname, &group, &grouptype)) {
1195                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1196                 return -1;
1197         }
1198
1199         /* check to see if the member to be added is a name or a SID */
1200
1201         if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
1202                          &memberdomain, &membername, &member, &membertype))
1203         {
1204                 /* try it as a SID */
1205
1206                 if ( !string_to_sid( &member, argv[1] ) ) {
1207                         d_fprintf(stderr, _("Could not find member %s\n"),
1208                                   argv[1]);
1209                         return -1;
1210                 }
1211
1212                 if ( !lookup_sid(talloc_tos(), &member, &memberdomain,
1213                         &membername, &membertype) )
1214                 {
1215                         d_fprintf(stderr, _("Could not resolve SID %s\n"),
1216                                   argv[1]);
1217                         return -1;
1218                 }
1219         }
1220
1221         if ((grouptype == SID_NAME_ALIAS) || (grouptype == SID_NAME_WKN_GRP)) {
1222                 if ((membertype != SID_NAME_USER) &&
1223                     (membertype != SID_NAME_ALIAS) &&
1224                     (membertype != SID_NAME_DOM_GRP)) {
1225                         d_fprintf(stderr, _("Can't add %s: only users, domain "
1226                                             "groups and domain local groups "
1227                                             "can be added. %s is a %s\n"),
1228                                   argv[0], argv[1],
1229                                   sid_type_lookup(membertype));
1230                         return -1;
1231                 }
1232                 status = pdb_add_aliasmem(&group, &member);
1233
1234                 if (!NT_STATUS_IS_OK(status)) {
1235                         d_fprintf(stderr, _("Adding local group member failed "
1236                                   "with %s\n"), nt_errstr(status));
1237                         return -1;
1238                 }
1239         } else if (grouptype == SID_NAME_DOM_GRP) {
1240                 uint32_t grouprid, memberrid;
1241
1242                 sid_peek_rid(&group, &grouprid);
1243                 sid_peek_rid(&member, &memberrid);
1244
1245                 status = pdb_add_groupmem(talloc_tos(), grouprid, memberrid);
1246                 if (!NT_STATUS_IS_OK(status)) {
1247                         d_fprintf(stderr, _("Adding domain group member failed "
1248                                   "with %s\n"), nt_errstr(status));
1249                         return -1;
1250                 }
1251         } else {
1252                 d_fprintf(stderr, _("Can only add members to local groups so "
1253                           "far, %s is a %s\n"), argv[0],
1254                           sid_type_lookup(grouptype));
1255                 return -1;
1256         }
1257
1258         d_printf(_("Added %s\\%s to %s\\%s\n"), memberdomain, membername,
1259                 groupdomain, groupname);
1260
1261         return 0;
1262 }
1263
1264 /*
1265  * Delete a group member
1266  */
1267
1268 static int net_sam_delmem(struct net_context *c, int argc, const char **argv)
1269 {
1270         const char *groupdomain, *groupname;
1271         const char *memberdomain = NULL;
1272         const char *membername = NULL;
1273         struct dom_sid group, member;
1274         enum lsa_SidType grouptype;
1275         NTSTATUS status;
1276
1277         if (argc != 2 || c->display_usage) {
1278                 d_fprintf(stderr,"%s\n%s",
1279                           _("Usage:"),
1280                           _("net sam delmem <group> <member>\n"));
1281                 return -1;
1282         }
1283
1284         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1285                          &groupdomain, &groupname, &group, &grouptype)) {
1286                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1287                 return -1;
1288         }
1289
1290         if (!lookup_name(talloc_tos(), argv[1], LOOKUP_NAME_LOCAL,
1291                          &memberdomain, &membername, &member, NULL)) {
1292                 if (!string_to_sid(&member, argv[1])) {
1293                         d_fprintf(stderr, _("Could not find member %s\n"),
1294                                   argv[1]);
1295                         return -1;
1296                 }
1297         }
1298
1299         if ((grouptype == SID_NAME_ALIAS) ||
1300             (grouptype == SID_NAME_WKN_GRP)) {
1301                 status = pdb_del_aliasmem(&group, &member);
1302
1303                 if (!NT_STATUS_IS_OK(status)) {
1304                         d_fprintf(stderr,_("Deleting local group member failed "
1305                                   "with %s\n"), nt_errstr(status));
1306                         return -1;
1307                 }
1308         } else if (grouptype == SID_NAME_DOM_GRP) {
1309                 uint32_t grouprid, memberrid;
1310
1311                 sid_peek_rid(&group, &grouprid);
1312                 sid_peek_rid(&member, &memberrid);
1313
1314                 status = pdb_del_groupmem(talloc_tos(), grouprid, memberrid);
1315                 if (!NT_STATUS_IS_OK(status)) {
1316                         d_fprintf(stderr, _("Deleting domain group member "
1317                                   "failed with %s\n"), nt_errstr(status));
1318                         return -1;
1319                 }
1320         } else {
1321                 d_fprintf(stderr, _("Can only delete members from local groups "
1322                           "so far, %s is a %s\n"), argv[0],
1323                           sid_type_lookup(grouptype));
1324                 return -1;
1325         }
1326
1327         if (membername != NULL) {
1328                 d_printf(_("Deleted %s\\%s from %s\\%s\n"),
1329                          memberdomain, membername, groupdomain, groupname);
1330         } else {
1331                 d_printf(_("Deleted %s from %s\\%s\n"),
1332                          sid_string_tos(&member), groupdomain, groupname);
1333         }
1334
1335         return 0;
1336 }
1337
1338 /*
1339  * List group members
1340  */
1341
1342 static int net_sam_listmem(struct net_context *c, int argc, const char **argv)
1343 {
1344         const char *groupdomain, *groupname;
1345         struct dom_sid group;
1346         struct dom_sid *members = NULL;
1347         size_t i, num_members = 0;
1348         enum lsa_SidType grouptype;
1349         NTSTATUS status;
1350
1351         if (argc != 1 || c->display_usage) {
1352                 d_fprintf(stderr, "%s\n%s",
1353                           _("Usage:"),
1354                           _("net sam listmem <group>\n"));
1355                 return -1;
1356         }
1357
1358         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1359                          &groupdomain, &groupname, &group, &grouptype)) {
1360                 d_fprintf(stderr, _("Could not find group %s\n"), argv[0]);
1361                 return -1;
1362         }
1363
1364         if ((grouptype == SID_NAME_ALIAS) ||
1365             (grouptype == SID_NAME_WKN_GRP)) {
1366                 status = pdb_enum_aliasmem(&group, talloc_tos(), &members,
1367                                            &num_members);
1368                 if (!NT_STATUS_IS_OK(status)) {
1369                         d_fprintf(stderr, _("Listing group members failed with "
1370                                   "%s\n"), nt_errstr(status));
1371                         return -1;
1372                 }
1373         } else if (grouptype == SID_NAME_DOM_GRP) {
1374                 uint32_t *rids;
1375
1376                 status = pdb_enum_group_members(talloc_tos(), &group,
1377                                                 &rids, &num_members);
1378                 if (!NT_STATUS_IS_OK(status)) {
1379                         d_fprintf(stderr, _("Listing group members failed with "
1380                                   "%s\n"), nt_errstr(status));
1381                         return -1;
1382                 }
1383
1384                 members = talloc_array(talloc_tos(), struct dom_sid,
1385                                        num_members);
1386                 if (members == NULL) {
1387                         TALLOC_FREE(rids);
1388                         return -1;
1389                 }
1390
1391                 for (i=0; i<num_members; i++) {
1392                         sid_compose(&members[i], get_global_sam_sid(),
1393                                     rids[i]);
1394                 }
1395                 TALLOC_FREE(rids);
1396         } else {
1397                 d_fprintf(stderr,_("Can only list local group members so far.\n"
1398                           "%s is a %s\n"), argv[0], sid_type_lookup(grouptype));
1399                 return -1;
1400         }
1401
1402         d_printf(_("%s\\%s has %u members\n"), groupdomain, groupname,
1403                  (unsigned int)num_members);
1404         for (i=0; i<num_members; i++) {
1405                 const char *dom, *name;
1406                 if (lookup_sid(talloc_tos(), &members[i], &dom, &name, NULL)) {
1407                         d_printf(" %s\\%s\n", dom, name);
1408                 } else {
1409                         d_printf(" %s\n", sid_string_tos(&members[i]));
1410                 }
1411         }
1412
1413                 TALLOC_FREE(members);
1414
1415         return 0;
1416 }
1417
1418 /*
1419  * Do the listing
1420  */
1421 static int net_sam_do_list(struct net_context *c, int argc, const char **argv,
1422                            struct pdb_search *search, const char *what)
1423 {
1424         bool verbose = (argc == 1);
1425
1426         if ((argc > 1) || c->display_usage ||
1427             ((argc == 1) && !strequal(argv[0], "verbose"))) {
1428                 d_fprintf(stderr, "%s\n", _("Usage:"));
1429                 d_fprintf(stderr, _("net sam list %s [verbose]\n"), what);
1430                 return -1;
1431         }
1432
1433         if (search == NULL) {
1434                 d_fprintf(stderr, _("Could not start search\n"));
1435                 return -1;
1436         }
1437
1438         while (true) {
1439                 struct samr_displayentry entry;
1440                 if (!search->next_entry(search, &entry)) {
1441                         break;
1442                 }
1443                 if (verbose) {
1444                         d_printf("%s:%d:%s\n",
1445                                  entry.account_name,
1446                                  entry.rid,
1447                                  entry.description);
1448                 } else {
1449                         d_printf("%s\n", entry.account_name);
1450                 }
1451         }
1452
1453         TALLOC_FREE(search);
1454         return 0;
1455 }
1456
1457 static int net_sam_list_users(struct net_context *c, int argc,
1458                               const char **argv)
1459 {
1460         return net_sam_do_list(c, argc, argv,
1461                                pdb_search_users(talloc_tos(), ACB_NORMAL),
1462                                "users");
1463 }
1464
1465 static int net_sam_list_groups(struct net_context *c, int argc,
1466                                const char **argv)
1467 {
1468         return net_sam_do_list(c, argc, argv, pdb_search_groups(talloc_tos()),
1469                                "groups");
1470 }
1471
1472 static int net_sam_list_localgroups(struct net_context *c, int argc,
1473                                     const char **argv)
1474 {
1475         return net_sam_do_list(c, argc, argv,
1476                                pdb_search_aliases(talloc_tos(),
1477                                                   get_global_sam_sid()),
1478                                "localgroups");
1479 }
1480
1481 static int net_sam_list_builtin(struct net_context *c, int argc,
1482                                 const char **argv)
1483 {
1484         return net_sam_do_list(c, argc, argv,
1485                                pdb_search_aliases(talloc_tos(),
1486                                                   &global_sid_Builtin),
1487                                "builtin");
1488 }
1489
1490 static int net_sam_list_workstations(struct net_context *c, int argc,
1491                                      const char **argv)
1492 {
1493         return net_sam_do_list(c, argc, argv,
1494                                pdb_search_users(talloc_tos(), ACB_WSTRUST),
1495                                "workstations");
1496 }
1497
1498 /*
1499  * List stuff
1500  */
1501
1502 static int net_sam_list(struct net_context *c, int argc, const char **argv)
1503 {
1504         struct functable func[] = {
1505                 {
1506                         "users",
1507                         net_sam_list_users,
1508                         NET_TRANSPORT_LOCAL,
1509                         N_("List SAM users"),
1510                         N_("net sam list users\n"
1511                            "    List SAM users")
1512                 },
1513                 {
1514                         "groups",
1515                         net_sam_list_groups,
1516                         NET_TRANSPORT_LOCAL,
1517                         N_("List SAM groups"),
1518                         N_("net sam list groups\n"
1519                            "    List SAM groups")
1520                 },
1521                 {
1522                         "localgroups",
1523                         net_sam_list_localgroups,
1524                         NET_TRANSPORT_LOCAL,
1525                         N_("List SAM local groups"),
1526                         N_("net sam list localgroups\n"
1527                            "    List SAM local groups")
1528                 },
1529                 {
1530                         "builtin",
1531                         net_sam_list_builtin,
1532                         NET_TRANSPORT_LOCAL,
1533                         N_("List builtin groups"),
1534                         N_("net sam list builtin\n"
1535                            "    List builtin groups")
1536                 },
1537                 {
1538                         "workstations",
1539                         net_sam_list_workstations,
1540                         NET_TRANSPORT_LOCAL,
1541                         N_("List domain member workstations"),
1542                         N_("net sam list workstations\n"
1543                            "    List domain member workstations")
1544                 },
1545                 {NULL, NULL, 0, NULL, NULL}
1546         };
1547
1548         return net_run_function(c, argc, argv, "net sam list", func);
1549 }
1550
1551 /*
1552  * Show details of SAM entries
1553  */
1554
1555 static int net_sam_show(struct net_context *c, int argc, const char **argv)
1556 {
1557         struct dom_sid sid;
1558         enum lsa_SidType type;
1559         const char *dom, *name;
1560
1561         if (argc != 1 || c->display_usage) {
1562                 d_fprintf(stderr, "%s\n%s",
1563                           _("Usage:"),
1564                           _("net sam show <name>\n"));
1565                 return -1;
1566         }
1567
1568         if (!lookup_name(talloc_tos(), argv[0], LOOKUP_NAME_LOCAL,
1569                          &dom, &name, &sid, &type)) {
1570                 d_fprintf(stderr, _("Could not find name %s\n"), argv[0]);
1571                 return -1;
1572         }
1573
1574         d_printf(_("%s\\%s is a %s with SID %s\n"), dom, name,
1575                  sid_type_lookup(type), sid_string_tos(&sid));
1576
1577         return 0;
1578 }
1579
1580 #ifdef HAVE_LDAP
1581
1582 /*
1583  * Init an LDAP tree with default users and Groups
1584  * if ldapsam:editposix is enabled
1585  */
1586
1587 static int net_sam_provision(struct net_context *c, int argc, const char **argv)
1588 {
1589         TALLOC_CTX *tc;
1590         char *ldap_bk;
1591         char *ldap_uri = NULL;
1592         char *p;
1593         struct smbldap_state *state = NULL;
1594         GROUP_MAP *gmap = NULL;
1595         struct dom_sid gsid;
1596         gid_t domusers_gid = -1;
1597         gid_t domadmins_gid = -1;
1598         struct samu *samuser;
1599         struct passwd *pwd;
1600         bool is_ipa = false;
1601         char *bind_dn = NULL;
1602         char *bind_secret = NULL;
1603         NTSTATUS status;
1604
1605         if (c->display_usage) {
1606                 d_printf(  "%s\n"
1607                            "net sam provision\n"
1608                             "    %s\n",
1609                           _("Usage:"),
1610                           _("Init an LDAP tree with default users/groups"));
1611                 return 0;
1612         }
1613
1614         tc = talloc_new(NULL);
1615         if (!tc) {
1616                 d_fprintf(stderr, _("Out of Memory!\n"));
1617                 return -1;
1618         }
1619
1620         if ((ldap_bk = talloc_strdup(tc, lp_passdb_backend())) == NULL) {
1621                 d_fprintf(stderr, _("talloc failed\n"));
1622                 talloc_free(tc);
1623                 return -1;
1624         }
1625         p = strchr(ldap_bk, ':');
1626         if (p) {
1627                 *p = 0;
1628                 ldap_uri = talloc_strdup(tc, p+1);
1629                 trim_char(ldap_uri, ' ', ' ');
1630         }
1631
1632         trim_char(ldap_bk, ' ', ' ');
1633
1634         if (strcmp(ldap_bk, "IPA_ldapsam") == 0 ) {
1635                 is_ipa = true;
1636         }
1637
1638         if (strcmp(ldap_bk, "ldapsam") != 0 && !is_ipa ) {
1639                 d_fprintf(stderr,
1640                           _("Provisioning works only with ldapsam backend\n"));
1641                 goto failed;
1642         }
1643
1644         if (!lp_parm_bool(-1, "ldapsam", "trusted", false) ||
1645             !lp_parm_bool(-1, "ldapsam", "editposix", false)) {
1646
1647                 d_fprintf(stderr, _("Provisioning works only if ldapsam:trusted"
1648                                     " and ldapsam:editposix are enabled.\n"));
1649                 goto failed;
1650         }
1651
1652         if (!is_ipa && !winbind_ping()) {
1653                 d_fprintf(stderr, _("winbind seems not to run. Provisioning "
1654                             "LDAP only works when winbind runs.\n"));
1655                 goto failed;
1656         }
1657
1658         if (!fetch_ldap_pw(&bind_dn, &bind_secret)) {
1659                 d_fprintf(stderr, _("Failed to retrieve LDAP password from secrets.tdb\n"));
1660                 goto failed;
1661         }
1662
1663         status = smbldap_init(tc, NULL, ldap_uri, false, bind_dn, bind_secret, &state);
1664
1665         memset(bind_secret, '\0', strlen(bind_secret));
1666         SAFE_FREE(bind_secret);
1667         SAFE_FREE(bind_dn);
1668
1669         if (!NT_STATUS_IS_OK(status)) {
1670                 d_fprintf(stderr, _("Unable to connect to the LDAP server.\n"));
1671                 goto failed;
1672         }
1673
1674         d_printf(_("Checking for Domain Users group.\n"));
1675
1676         sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_USERS);
1677
1678         gmap = talloc_zero(tc, GROUP_MAP);
1679         if (!gmap) {
1680                 d_printf(_("Out of memory!\n"));
1681                 goto failed;
1682         }
1683
1684         if (!pdb_getgrsid(gmap, gsid)) {
1685                 LDAPMod **mods = NULL;
1686                 char *dn;
1687                 char *uname;
1688                 char *wname;
1689                 char *gidstr;
1690                 char *gtype;
1691                 int rc;
1692
1693                 d_printf(_("Adding the Domain Users group.\n"));
1694
1695                 /* lets allocate a new groupid for this group */
1696                 if (is_ipa) {
1697                         domusers_gid = 999;
1698                 } else {
1699                         if (!winbind_allocate_gid(&domusers_gid)) {
1700                                 d_fprintf(stderr, _("Unable to allocate a new gid to "
1701                                                     "create Domain Users group!\n"));
1702                                 goto domu_done;
1703                         }
1704                 }
1705
1706                 uname = talloc_strdup(tc, "domusers");
1707                 wname = talloc_strdup(tc, "Domain Users");
1708                 dn = talloc_asprintf(tc, "cn=%s,%s", "domusers",
1709                                      lp_ldap_group_suffix(talloc_tos()));
1710                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domusers_gid);
1711                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1712
1713                 if (!uname || !wname || !dn || !gidstr || !gtype) {
1714                         d_fprintf(stderr, "Out of Memory!\n");
1715                         goto failed;
1716                 }
1717
1718                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1719                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1720                 if (is_ipa) {
1721                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
1722                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
1723                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
1724                 }
1725                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1726                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1727                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1728                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1729                                 sid_string_talloc(tc, &gsid));
1730                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1731
1732                 smbldap_talloc_autofree_ldapmod(tc, mods);
1733
1734                 rc = smbldap_add(state, dn, mods);
1735
1736                 if (rc != LDAP_SUCCESS) {
1737                         d_fprintf(stderr, _("Failed to add Domain Users group "
1738                                             "to ldap directory\n"));
1739                 }
1740
1741                 if (is_ipa) {
1742                         if (!pdb_getgrsid(gmap, gsid)) {
1743                                 d_fprintf(stderr, _("Failed to read just "
1744                                                     "created domain group.\n"));
1745                                 goto failed;
1746                         } else {
1747                                 domusers_gid = gmap->gid;
1748                         }
1749                 }
1750         } else {
1751                 domusers_gid = gmap->gid;
1752                 d_printf(_("found!\n"));
1753         }
1754
1755 domu_done:
1756
1757         d_printf(_("Checking for Domain Admins group.\n"));
1758
1759         sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_ADMINS);
1760
1761         if (!pdb_getgrsid(gmap, gsid)) {
1762                 LDAPMod **mods = NULL;
1763                 char *dn;
1764                 char *uname;
1765                 char *wname;
1766                 char *gidstr;
1767                 char *gtype;
1768                 int rc;
1769
1770                 d_printf(_("Adding the Domain Admins group.\n"));
1771
1772                 /* lets allocate a new groupid for this group */
1773                 if (is_ipa) {
1774                         domadmins_gid = 999;
1775                 } else {
1776                         if (!winbind_allocate_gid(&domadmins_gid)) {
1777                                 d_fprintf(stderr, _("Unable to allocate a new gid to "
1778                                                     "create Domain Admins group!\n"));
1779                                 goto doma_done;
1780                         }
1781                 }
1782
1783                 uname = talloc_strdup(tc, "domadmins");
1784                 wname = talloc_strdup(tc, "Domain Admins");
1785                 dn = talloc_asprintf(tc, "cn=%s,%s", "domadmins",
1786                                      lp_ldap_group_suffix(talloc_tos()));
1787                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
1788                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
1789
1790                 if (!uname || !wname || !dn || !gidstr || !gtype) {
1791                         d_fprintf(stderr, _("Out of Memory!\n"));
1792                         goto failed;
1793                 }
1794
1795                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
1796                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
1797                 if (is_ipa) {
1798                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
1799                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
1800                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
1801                 }
1802                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
1803                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
1804                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1805                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
1806                                 sid_string_talloc(tc, &gsid));
1807                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
1808
1809                 smbldap_talloc_autofree_ldapmod(tc, mods);
1810
1811                 rc = smbldap_add(state, dn, mods);
1812
1813                 if (rc != LDAP_SUCCESS) {
1814                         d_fprintf(stderr, _("Failed to add Domain Admins group "
1815                                             "to ldap directory\n"));
1816                 }
1817
1818                 if (is_ipa) {
1819                         if (!pdb_getgrsid(gmap, gsid)) {
1820                                 d_fprintf(stderr, _("Failed to read just "
1821                                                     "created domain group.\n"));
1822                                 goto failed;
1823                         } else {
1824                                 domadmins_gid = gmap->gid;
1825                         }
1826                 }
1827         } else {
1828                 domadmins_gid = gmap->gid;
1829                 d_printf(_("found!\n"));
1830         }
1831
1832 doma_done:
1833
1834         d_printf(_("Check for Administrator account.\n"));
1835
1836         samuser = samu_new(tc);
1837         if (!samuser) {
1838                 d_fprintf(stderr, _("Out of Memory!\n"));
1839                 goto failed;
1840         }
1841
1842         if (!pdb_getsampwnam(samuser, "Administrator")) {
1843                 LDAPMod **mods = NULL;
1844                 struct dom_sid sid;
1845                 char *dn;
1846                 char *name;
1847                 char *uidstr;
1848                 char *gidstr;
1849                 char *shell;
1850                 char *dir;
1851                 char *princ;
1852                 uid_t uid;
1853                 int rc;
1854
1855                 d_printf(_("Adding the Administrator user.\n"));
1856
1857                 if (domadmins_gid == -1) {
1858                         d_fprintf(stderr,
1859                                   _("Can't create Administrator user, Domain "
1860                                     "Admins group not available!\n"));
1861                         goto done;
1862                 }
1863
1864                 if (is_ipa) {
1865                         uid = 999;
1866                 } else {
1867                         if (!winbind_allocate_uid(&uid)) {
1868                                 d_fprintf(stderr,
1869                                           _("Unable to allocate a new uid to create "
1870                                             "the Administrator user!\n"));
1871                                 goto done;
1872                         }
1873                 }
1874
1875                 name = talloc_strdup(tc, "Administrator");
1876                 dn = talloc_asprintf(tc, "uid=Administrator,%s",
1877                                      lp_ldap_user_suffix(talloc_tos()));
1878                 uidstr = talloc_asprintf(tc, "%u", (unsigned int)uid);
1879                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)domadmins_gid);
1880                 dir = talloc_sub_specified(tc, lp_template_homedir(),
1881                                                 "Administrator",
1882                                                 NULL,
1883                                                 get_global_sam_name(),
1884                                                 uid, domadmins_gid);
1885                 shell = talloc_sub_specified(tc, lp_template_shell(),
1886                                                 "Administrator",
1887                                                 NULL,
1888                                                 get_global_sam_name(),
1889                                                 uid, domadmins_gid);
1890
1891                 if (!name || !dn || !uidstr || !gidstr || !dir || !shell) {
1892                         d_fprintf(stderr, _("Out of Memory!\n"));
1893                         goto failed;
1894                 }
1895
1896                 sid_compose(&sid, get_global_sam_sid(), DOMAIN_RID_ADMINISTRATOR);
1897
1898                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
1899                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
1900                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
1901                 if (is_ipa) {
1902                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "person");
1903                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "organizationalperson");
1904                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetorgperson");
1905                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetuser");
1906                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbprincipalaux");
1907                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbticketpolicyaux");
1908                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "sn", name);
1909                         princ = talloc_asprintf(tc, "%s@%s", name, lp_realm());
1910                         if (!princ) {
1911                                 d_fprintf(stderr, _("Out of Memory!\n"));
1912                                 goto failed;
1913                         }
1914                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "krbPrincipalName", princ);
1915                 }
1916                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uid", name);
1917                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", name);
1918                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", name);
1919                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
1920                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
1921                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", dir);
1922                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", shell);
1923                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
1924                                 sid_string_talloc(tc, &sid));
1925                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
1926                                 pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
1927                                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
1928
1929                 smbldap_talloc_autofree_ldapmod(tc, mods);
1930
1931                 rc = smbldap_add(state, dn, mods);
1932
1933                 if (rc != LDAP_SUCCESS) {
1934                         d_fprintf(stderr, _("Failed to add Administrator user "
1935                                             "to ldap directory\n"));
1936                 }
1937
1938                 if (is_ipa) {
1939                         if (!pdb_getsampwnam(samuser, "Administrator")) {
1940                                 d_fprintf(stderr, _("Failed to read just "
1941                                                     "created user.\n"));
1942                                 goto failed;
1943                         }
1944                 }
1945         } else {
1946                 d_printf(_("found!\n"));
1947         }
1948
1949         d_printf(_("Checking for Guest user.\n"));
1950
1951         samuser = samu_new(tc);
1952         if (!samuser) {
1953                 d_fprintf(stderr, _("Out of Memory!\n"));
1954                 goto failed;
1955         }
1956
1957         if (!pdb_getsampwnam(samuser, lp_guest_account())) {
1958                 LDAPMod **mods = NULL;
1959                 struct dom_sid sid;
1960                 char *dn;
1961                 char *uidstr;
1962                 char *gidstr;
1963                 int rc;
1964
1965                 d_printf(_("Adding the Guest user.\n"));
1966
1967                 sid_compose(&sid, get_global_sam_sid(), DOMAIN_RID_GUEST);
1968
1969                 pwd = Get_Pwnam_alloc(tc, lp_guest_account());
1970
1971                 if (!pwd) {
1972                         if (domusers_gid == -1) {
1973                                 d_fprintf(stderr,
1974                                           _("Can't create Guest user, Domain "
1975                                             "Users group not available!\n"));
1976                                 goto done;
1977                         }
1978                         if ((pwd = talloc(tc, struct passwd)) == NULL) {
1979                                 d_fprintf(stderr, _("talloc failed\n"));
1980                                 goto done;
1981                         }
1982                         pwd->pw_name = talloc_strdup(pwd, lp_guest_account());
1983
1984                         if (is_ipa) {
1985                                 pwd->pw_uid = 999;
1986                         } else {
1987                                 if (!winbind_allocate_uid(&(pwd->pw_uid))) {
1988                                         d_fprintf(stderr,
1989                                                   _("Unable to allocate a new uid to "
1990                                                     "create the Guest user!\n"));
1991                                         goto done;
1992                                 }
1993                         }
1994                         pwd->pw_gid = domusers_gid;
1995                         pwd->pw_dir = talloc_strdup(tc, "/");
1996                         pwd->pw_shell = talloc_strdup(tc, "/bin/false");
1997                         if (!pwd->pw_dir || !pwd->pw_shell) {
1998                                 d_fprintf(stderr, _("Out of Memory!\n"));
1999                                 goto failed;
2000                         }
2001                 }
2002
2003                 dn = talloc_asprintf(tc, "uid=%s,%s", pwd->pw_name,
2004                                      lp_ldap_user_suffix (talloc_tos()));
2005                 uidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_uid);
2006                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
2007                 if (!dn || !uidstr || !gidstr) {
2008                         d_fprintf(stderr, _("Out of Memory!\n"));
2009                         goto failed;
2010                 }
2011
2012                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_ACCOUNT);
2013                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXACCOUNT);
2014                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_SAMBASAMACCOUNT);
2015                 if (is_ipa) {
2016                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "person");
2017                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "organizationalperson");
2018                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetorgperson");
2019                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "inetuser");
2020                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbprincipalaux");
2021                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "krbticketpolicyaux");
2022                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "sn", pwd->pw_name);
2023                 }
2024                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uid", pwd->pw_name);
2025                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", pwd->pw_name);
2026                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", pwd->pw_name);
2027                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "uidNumber", uidstr);
2028                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
2029                 if ((pwd->pw_dir != NULL) && (pwd->pw_dir[0] != '\0')) {
2030                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "homeDirectory", pwd->pw_dir);
2031                 }
2032                 if ((pwd->pw_shell != NULL) && (pwd->pw_shell[0] != '\0')) {
2033                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "loginShell", pwd->pw_shell);
2034                 }
2035                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSID",
2036                                 sid_string_talloc(tc, &sid));
2037                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaAcctFlags",
2038                                 pdb_encode_acct_ctrl(ACB_NORMAL|ACB_DISABLED,
2039                                 NEW_PW_FORMAT_SPACE_PADDED_LEN));
2040
2041                 smbldap_talloc_autofree_ldapmod(tc, mods);
2042
2043                 rc = smbldap_add(state, dn, mods);
2044
2045                 if (rc != LDAP_SUCCESS) {
2046                         d_fprintf(stderr, _("Failed to add Guest user to "
2047                                             "ldap directory\n"));
2048                 }
2049
2050                 if (is_ipa) {
2051                         if (!pdb_getsampwnam(samuser, lp_guest_account())) {
2052                                 d_fprintf(stderr, _("Failed to read just "
2053                                                     "created user.\n"));
2054                                 goto failed;
2055                         }
2056                 }
2057         } else {
2058                 d_printf(_("found!\n"));
2059         }
2060
2061         d_printf(_("Checking Guest's group.\n"));
2062
2063         pwd = Get_Pwnam_alloc(tc, lp_guest_account());
2064         if (!pwd) {
2065                 d_fprintf(stderr,
2066                           _("Failed to find just created Guest account!\n"
2067                             "   Is nss properly configured?!\n"));
2068                 goto failed;
2069         }
2070
2071         if (pwd->pw_gid == domusers_gid) {
2072                 d_printf(_("found!\n"));
2073                 goto done;
2074         }
2075
2076         if (!pdb_getgrgid(gmap, pwd->pw_gid)) {
2077                 LDAPMod **mods = NULL;
2078                 char *dn;
2079                 char *uname;
2080                 char *wname;
2081                 char *gidstr;
2082                 char *gtype;
2083                 int rc;
2084
2085                 d_printf(_("Adding the Domain Guests group.\n"));
2086
2087                 uname = talloc_strdup(tc, "domguests");
2088                 wname = talloc_strdup(tc, "Domain Guests");
2089                 dn = talloc_asprintf(tc, "cn=%s,%s", "domguests",
2090                                      lp_ldap_group_suffix(talloc_tos()));
2091                 gidstr = talloc_asprintf(tc, "%u", (unsigned int)pwd->pw_gid);
2092                 gtype = talloc_asprintf(tc, "%d", SID_NAME_DOM_GRP);
2093
2094                 if (!uname || !wname || !dn || !gidstr || !gtype) {
2095                         d_fprintf(stderr, _("Out of Memory!\n"));
2096                         goto failed;
2097                 }
2098
2099                 sid_compose(&gsid, get_global_sam_sid(), DOMAIN_RID_GUESTS);
2100
2101                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_POSIXGROUP);
2102                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", LDAP_OBJ_GROUPMAP);
2103                 if (is_ipa) {
2104                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "groupofnames");
2105                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "nestedgroup");
2106                         smbldap_set_mod(&mods, LDAP_MOD_ADD, "objectClass", "ipausergroup");
2107                 }
2108                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "cn", uname);
2109                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "displayName", wname);
2110                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "gidNumber", gidstr);
2111                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaSid",
2112                                 sid_string_talloc(tc, &gsid));
2113                 smbldap_set_mod(&mods, LDAP_MOD_ADD, "sambaGroupType", gtype);
2114
2115                 smbldap_talloc_autofree_ldapmod(tc, mods);
2116
2117                 rc = smbldap_add(state, dn, mods);
2118
2119                 if (rc != LDAP_SUCCESS) {
2120                         d_fprintf(stderr,
2121                                   _("Failed to add Domain Guests group to ldap "
2122                                     "directory\n"));
2123                 }
2124         } else {
2125                 d_printf(_("found!\n"));
2126         }
2127
2128
2129 done:
2130         talloc_free(state);
2131         return 0;
2132
2133 failed:
2134         talloc_free(state);
2135         return -1;
2136 }
2137
2138 #endif
2139
2140 /***********************************************************
2141  migrated functionality from smbgroupedit
2142  **********************************************************/
2143 int net_sam(struct net_context *c, int argc, const char **argv)
2144 {
2145         struct functable func[] = {
2146                 {
2147                         "createbuiltingroup",
2148                         net_sam_createbuiltingroup,
2149                         NET_TRANSPORT_LOCAL,
2150                         N_("Create a new BUILTIN group"),
2151                         N_("net sam createbuiltingroup\n"
2152                            "    Create a new BUILTIN group")
2153                 },
2154                 {
2155                         "createlocalgroup",
2156                         net_sam_createlocalgroup,
2157                         NET_TRANSPORT_LOCAL,
2158                         N_("Create a new local group"),
2159                         N_("net sam createlocalgroup\n"
2160                            "    Create a new local group")
2161                 },
2162                 {
2163                         "createdomaingroup",
2164                         net_sam_createdomaingroup,
2165                         NET_TRANSPORT_LOCAL,
2166                         N_("Create a new group"),
2167                         N_("net sam createdomaingroup\n"
2168                            "    Create a new group")
2169                 },
2170                 {
2171                         "deletelocalgroup",
2172                         net_sam_deletelocalgroup,
2173                         NET_TRANSPORT_LOCAL,
2174                         N_("Delete an existing local group"),
2175                         N_("net sam deletelocalgroup\n"
2176                            "    Delete an existing local group")
2177                 },
2178                 {
2179                         "deletedomaingroup",
2180                         net_sam_deletedomaingroup,
2181                         NET_TRANSPORT_LOCAL,
2182                         N_("Delete a domain group"),
2183                         N_("net sam deletedomaingroup\n"
2184                            "    Delete a group")
2185                 },
2186                 {
2187                         "mapunixgroup",
2188                         net_sam_mapunixgroup,
2189                         NET_TRANSPORT_LOCAL,
2190                         N_("Map a unix group to a domain group"),
2191                         N_("net sam mapunixgroup\n"
2192                            "    Map a unix group to a domain group")
2193                 },
2194                 {
2195                         "unmapunixgroup",
2196                         net_sam_unmapunixgroup,
2197                         NET_TRANSPORT_LOCAL,
2198                         N_("Remove a group mapping of an unix group to a "
2199                            "domain group"),
2200                         N_("net sam unmapunixgroup\n"
2201                            "    Remove a group mapping of an unix group to a "
2202                            "domain group")
2203                 },
2204                 {
2205                         "addmem",
2206                         net_sam_addmem,
2207                         NET_TRANSPORT_LOCAL,
2208                         N_("Add a member to a group"),
2209                         N_("net sam addmem\n"
2210                         "    Add a member to a group")
2211                 },
2212                 {
2213                         "delmem",
2214                         net_sam_delmem,
2215                         NET_TRANSPORT_LOCAL,
2216                         N_("Delete a member from a group"),
2217                         N_("net sam delmem\n"
2218                            "    Delete a member from a group")
2219                 },
2220                 {
2221                         "listmem",
2222                         net_sam_listmem,
2223                         NET_TRANSPORT_LOCAL,
2224                         N_("List group members"),
2225                         N_("net sam listmem\n"
2226                            "    List group members")
2227                 },
2228                 {
2229                         "list",
2230                         net_sam_list,
2231                         NET_TRANSPORT_LOCAL,
2232                         N_("List users, groups and local groups"),
2233                         N_("net sam list\n"
2234                            "    List users, groups and local groups")
2235                 },
2236                 {
2237                         "show",
2238                         net_sam_show,
2239                         NET_TRANSPORT_LOCAL,
2240                         N_("Show details of a SAM entry"),
2241                         N_("net sam show\n"
2242                            "    Show details of a SAM entry")
2243                 },
2244                 {
2245                         "set",
2246                         net_sam_set,
2247                         NET_TRANSPORT_LOCAL,
2248                         N_("Set details of a SAM account"),
2249                         N_("net sam set\n"
2250                            "    Set details of a SAM account")
2251                 },
2252                 {
2253                         "policy",
2254                         net_sam_policy,
2255                         NET_TRANSPORT_LOCAL,
2256                         N_("Set account policies"),
2257                         N_("net sam policy\n"
2258                            "    Set account policies")
2259                 },
2260                 {
2261                         "rights",
2262                         net_sam_rights,
2263                         NET_TRANSPORT_LOCAL,
2264                         N_("Manipulate user privileges"),
2265                         N_("net sam rights\n"
2266                            "    Manipulate user privileges")
2267                 },
2268 #ifdef HAVE_LDAP
2269                 {
2270                         "provision",
2271                         net_sam_provision,
2272                         NET_TRANSPORT_LOCAL,
2273                         N_("Provision a clean user database"),
2274                         N_("net sam privison\n"
2275                            "    Provision a clear user database")
2276                 },
2277 #endif
2278                 {NULL, NULL, 0, NULL, NULL}
2279         };
2280
2281         if (getuid() != 0) {
2282                 d_fprintf(stderr, _("You are not root, most things won't "
2283                           "work\n"));
2284         }
2285
2286         return net_run_function(c, argc, argv, "net sam", func);
2287 }
2288