2 Unix SMB/CIFS implementation.
4 Winbind ADS backend functions
6 Copyright (C) Andrew Tridgell 2001
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2003
8 Copyright (C) Gerald (Jerry) Carter 2004
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
31 #define DBGC_CLASS DBGC_WINBIND
34 return our ads connections structure for a domain. We keep the connection
35 open to make things faster
37 static ADS_STRUCT *ads_cached_connection(struct winbindd_domain *domain)
42 if (domain->private) {
43 ads = (ADS_STRUCT *)domain->private;
45 /* check for a valid structure */
47 DEBUG(7, ("Current tickets expire at %d, time is now %d\n",
48 (uint32) ads->auth.expire, (uint32) time(NULL)));
49 if ( ads->config.realm && (ads->auth.expire > time(NULL))) {
53 /* we own this ADS_STRUCT so make sure it goes away */
56 ads_kdestroy("MEMORY:winbind_ccache");
57 domain->private = NULL;
61 /* we don't want this to affect the users ccache */
62 setenv("KRB5CCNAME", "MEMORY:winbind_ccache", 1);
64 ads = ads_init(domain->alt_name, domain->name, NULL);
66 DEBUG(1,("ads_init for domain %s failed\n", domain->name));
70 /* the machine acct password might have change - fetch it every time */
71 SAFE_FREE(ads->auth.password);
72 ads->auth.password = secrets_fetch_machine_password(lp_workgroup(), NULL, NULL);
74 SAFE_FREE(ads->auth.realm);
75 ads->auth.realm = SMB_STRDUP(lp_realm());
77 status = ads_connect(ads);
78 if (!ADS_ERR_OK(status) || !ads->config.realm) {
79 extern struct winbindd_methods msrpc_methods, cache_methods;
80 DEBUG(1,("ads_connect for domain %s failed: %s\n",
81 domain->name, ads_errstr(status)));
84 /* if we get ECONNREFUSED then it might be a NT4
85 server, fall back to MSRPC */
86 if (status.error_type == ENUM_ADS_ERROR_SYSTEM &&
87 status.err.rc == ECONNREFUSED) {
88 DEBUG(1,("Trying MSRPC methods\n"));
89 if (domain->methods == &cache_methods) {
90 domain->backend = &msrpc_methods;
92 domain->methods = &msrpc_methods;
98 /* set the flag that says we don't own the memory even
99 though we do so that ads_destroy() won't destroy the
100 structure we pass back by reference */
102 ads->is_mine = False;
104 domain->private = (void *)ads;
109 /* Query display info for a realm. This is the basic user list fn */
110 static NTSTATUS query_user_list(struct winbindd_domain *domain,
113 WINBIND_USERINFO **info)
115 ADS_STRUCT *ads = NULL;
116 const char *attrs[] = {"userPrincipalName",
118 "name", "objectSid", "primaryGroupID",
119 "sAMAccountType", NULL};
124 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
128 DEBUG(3,("ads: query_user_list\n"));
130 ads = ads_cached_connection(domain);
133 domain->last_status = NT_STATUS_SERVER_DISABLED;
137 rc = ads_search_retry(ads, &res, "(objectClass=user)", attrs);
138 if (!ADS_ERR_OK(rc) || !res) {
139 DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
143 count = ads_count_replies(ads, res);
145 DEBUG(1,("query_user_list: No users found\n"));
149 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, WINBIND_USERINFO, count);
151 status = NT_STATUS_NO_MEMORY;
157 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
165 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &atype) ||
166 ads_atype_map(atype) != SID_NAME_USER) {
167 DEBUG(1,("Not a user account? atype=0x%x\n", atype));
171 name = ads_pull_username(ads, mem_ctx, msg);
172 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
173 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
174 DEBUG(1,("No sid for %s !?\n", name));
177 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group)) {
178 DEBUG(1,("No primary group for %s !?\n", name));
182 sid2 = TALLOC_P(mem_ctx, DOM_SID);
184 status = NT_STATUS_NO_MEMORY;
188 sid_copy(sid2, &sid);
190 group_sid = rid_to_talloced_sid(domain, mem_ctx, group);
192 (*info)[i].acct_name = name;
193 (*info)[i].full_name = gecos;
194 (*info)[i].user_sid = sid2;
195 (*info)[i].group_sid = group_sid;
200 status = NT_STATUS_OK;
202 DEBUG(3,("ads query_user_list gave %d entries\n", (*num_entries)));
206 ads_msgfree(ads, res);
211 /* list all domain groups */
212 static NTSTATUS enum_dom_groups(struct winbindd_domain *domain,
215 struct acct_info **info)
217 ADS_STRUCT *ads = NULL;
218 const char *attrs[] = {"userPrincipalName", "sAMAccountName",
220 "sAMAccountType", NULL};
225 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
230 DEBUG(3,("ads: enum_dom_groups\n"));
232 ads = ads_cached_connection(domain);
235 domain->last_status = NT_STATUS_SERVER_DISABLED;
239 rc = ads_search_retry(ads, &res, "(objectCategory=group)", attrs);
240 if (!ADS_ERR_OK(rc) || !res) {
241 DEBUG(1,("enum_dom_groups ads_search: %s\n", ads_errstr(rc)));
245 count = ads_count_replies(ads, res);
247 DEBUG(1,("enum_dom_groups: No groups found\n"));
251 (*info) = TALLOC_ZERO_ARRAY(mem_ctx, struct acct_info, count);
253 status = NT_STATUS_NO_MEMORY;
259 group_flags = ATYPE_GLOBAL_GROUP;
261 /* only grab domain local groups for our domain */
262 if ( domain->native_mode && strequal(lp_realm(), domain->alt_name) )
263 group_flags |= ATYPE_LOCAL_GROUP;
265 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
271 if (!ads_pull_uint32(ads, msg, "sAMAccountType", &account_type) || !(account_type & group_flags) )
274 name = ads_pull_username(ads, mem_ctx, msg);
275 gecos = ads_pull_string(ads, mem_ctx, msg, "name");
276 if (!ads_pull_sid(ads, msg, "objectSid", &sid)) {
277 DEBUG(1,("No sid for %s !?\n", name));
281 if (!sid_peek_check_rid(&domain->sid, &sid, &rid)) {
282 DEBUG(1,("No rid for %s !?\n", name));
286 fstrcpy((*info)[i].acct_name, name);
287 fstrcpy((*info)[i].acct_desc, gecos);
288 (*info)[i].rid = rid;
294 status = NT_STATUS_OK;
296 DEBUG(3,("ads enum_dom_groups gave %d entries\n", (*num_entries)));
300 ads_msgfree(ads, res);
305 /* list all domain local groups */
306 static NTSTATUS enum_local_groups(struct winbindd_domain *domain,
309 struct acct_info **info)
312 * This is a stub function only as we returned the domain
313 * local groups in enum_dom_groups() if the domain->native field
314 * was true. This is a simple performance optimization when
317 * if we ever need to enumerate domain local groups separately,
318 * then this the optimization in enum_dom_groups() will need
326 /* convert a DN to a name, SID and name type
327 this might become a major speed bottleneck if groups have
328 lots of users, in which case we could cache the results
330 static BOOL dn_lookup(ADS_STRUCT *ads, TALLOC_CTX *mem_ctx,
332 char **name, uint32 *name_type, DOM_SID *sid)
335 const char *attrs[] = {"userPrincipalName", "sAMAccountName",
336 "objectSid", "sAMAccountType", NULL};
339 DEBUG(3,("ads: dn_lookup\n"));
341 rc = ads_search_retry_dn(ads, &res, dn, attrs);
343 if (!ADS_ERR_OK(rc) || !res) {
347 (*name) = ads_pull_username(ads, mem_ctx, res);
349 if (!ads_pull_uint32(ads, res, "sAMAccountType", &atype)) {
352 (*name_type) = ads_atype_map(atype);
354 if (!ads_pull_sid(ads, res, "objectSid", sid)) {
359 ads_msgfree(ads, res);
365 ads_msgfree(ads, res);
370 /* Lookup user information from a rid */
371 static NTSTATUS query_user(struct winbindd_domain *domain,
374 WINBIND_USERINFO *info)
376 ADS_STRUCT *ads = NULL;
377 const char *attrs[] = {"userPrincipalName",
380 "primaryGroupID", NULL};
387 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
391 DEBUG(3,("ads: query_user\n"));
393 ads = ads_cached_connection(domain);
396 domain->last_status = NT_STATUS_SERVER_DISABLED;
400 sidstr = sid_binstring(sid);
401 asprintf(&ldap_exp, "(objectSid=%s)", sidstr);
402 rc = ads_search_retry(ads, &msg, ldap_exp, attrs);
405 if (!ADS_ERR_OK(rc) || !msg) {
406 DEBUG(1,("query_user(sid=%s) ads_search: %s\n", sid_to_string(sid_string, sid), ads_errstr(rc)));
410 count = ads_count_replies(ads, msg);
412 DEBUG(1,("query_user(sid=%s): Not found\n", sid_to_string(sid_string, sid)));
416 info->acct_name = ads_pull_username(ads, mem_ctx, msg);
417 info->full_name = ads_pull_string(ads, mem_ctx, msg, "name");
419 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &group_rid)) {
420 DEBUG(1,("No primary group for %s !?\n", sid_to_string(sid_string, sid)));
424 sid2 = TALLOC_P(mem_ctx, DOM_SID);
426 status = NT_STATUS_NO_MEMORY;
431 info->user_sid = sid2;
433 info->group_sid = rid_to_talloced_sid(domain, mem_ctx, group_rid);
435 status = NT_STATUS_OK;
437 DEBUG(3,("ads query_user gave %s\n", info->acct_name));
440 ads_msgfree(ads, msg);
445 /* Lookup groups a user is a member of - alternate method, for when
446 tokenGroups are not available. */
447 static NTSTATUS lookup_usergroups_alt(struct winbindd_domain *domain,
450 DOM_SID *primary_group,
451 uint32 *num_groups, DOM_SID ***user_gids)
454 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
460 const char *group_attrs[] = {"objectSid", NULL};
463 DEBUG(3,("ads: lookup_usergroups_alt\n"));
465 ads = ads_cached_connection(domain);
468 domain->last_status = NT_STATUS_SERVER_DISABLED;
472 if (!(escaped_dn = escape_ldap_string_alloc(user_dn))) {
473 status = NT_STATUS_NO_MEMORY;
477 /* buggy server, no tokenGroups. Instead lookup what groups this user
478 is a member of by DN search on member*/
480 if (!(ldap_exp = talloc_asprintf(mem_ctx, "(&(member=%s)(objectClass=group))", escaped_dn))) {
481 DEBUG(1,("lookup_usergroups(dn=%s) asprintf failed!\n", user_dn));
482 SAFE_FREE(escaped_dn);
483 status = NT_STATUS_NO_MEMORY;
487 SAFE_FREE(escaped_dn);
489 rc = ads_search_retry(ads, &res, ldap_exp, group_attrs);
491 if (!ADS_ERR_OK(rc) || !res) {
492 DEBUG(1,("lookup_usergroups ads_search member=%s: %s\n", user_dn, ads_errstr(rc)));
493 return ads_ntstatus(rc);
496 count = ads_count_replies(ads, res);
498 DEBUG(5,("lookup_usergroups: No supp groups found\n"));
500 status = ads_ntstatus(rc);
504 (*user_gids) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID *, count + 1);
505 (*user_gids)[0] = primary_group;
509 for (msg = ads_first_entry(ads, res); msg; msg = ads_next_entry(ads, msg)) {
512 if (!ads_pull_sid(ads, msg, "objectSid", &group_sid)) {
513 DEBUG(1,("No sid for this group ?!?\n"));
517 if (sid_equal(&group_sid, primary_group)) continue;
519 (*user_gids)[*num_groups] = TALLOC_P(mem_ctx, DOM_SID);
520 if (!(*user_gids)[*num_groups]) {
521 status = NT_STATUS_NO_MEMORY;
525 sid_copy((*user_gids)[*num_groups], &group_sid);
531 status = NT_STATUS_OK;
533 DEBUG(3,("ads lookup_usergroups (alt) for dn=%s\n", user_dn));
536 ads_msgfree(ads, res);
541 /* Lookup groups a user is a member of. */
542 static NTSTATUS lookup_usergroups(struct winbindd_domain *domain,
545 uint32 *num_groups, DOM_SID ***user_gids)
547 ADS_STRUCT *ads = NULL;
548 const char *attrs[] = {"tokenGroups", "primaryGroupID", NULL};
551 LDAPMessage *msg = NULL;
555 DOM_SID *primary_group;
556 uint32 primary_group_rid;
558 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
560 DEBUG(3,("ads: lookup_usergroups\n"));
563 ads = ads_cached_connection(domain);
566 domain->last_status = NT_STATUS_SERVER_DISABLED;
567 status = NT_STATUS_SERVER_DISABLED;
571 rc = ads_sid_to_dn(ads, mem_ctx, sid, &user_dn);
572 if (!ADS_ERR_OK(rc)) {
573 status = ads_ntstatus(rc);
577 rc = ads_search_retry_dn(ads, (void**)&msg, user_dn, attrs);
578 if (!ADS_ERR_OK(rc)) {
579 status = ads_ntstatus(rc);
580 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: %s\n",
581 sid_to_string(sid_string, sid), ads_errstr(rc)));
586 DEBUG(1,("lookup_usergroups(sid=%s) ads_search tokenGroups: NULL msg\n",
587 sid_to_string(sid_string, sid)));
588 status = NT_STATUS_UNSUCCESSFUL;
592 if (!ads_pull_uint32(ads, msg, "primaryGroupID", &primary_group_rid)) {
593 DEBUG(1,("%s: No primary group for sid=%s !?\n",
594 domain->name, sid_to_string(sid_string, sid)));
598 primary_group = rid_to_talloced_sid(domain, mem_ctx, primary_group_rid);
600 count = ads_pull_sids(ads, mem_ctx, msg, "tokenGroups", &sids);
603 ads_msgfree(ads, msg);
605 /* there must always be at least one group in the token,
606 unless we are talking to a buggy Win2k server */
608 return lookup_usergroups_alt(domain, mem_ctx, user_dn,
610 num_groups, user_gids);
613 (*user_gids) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID *, count + 1);
614 (*user_gids)[0] = primary_group;
618 for (i=0;i<count;i++) {
619 if (sid_equal(&sids[i], primary_group)) continue;
621 (*user_gids)[*num_groups] = TALLOC_P(mem_ctx, DOM_SID);
622 if (!(*user_gids)[*num_groups]) {
623 status = NT_STATUS_NO_MEMORY;
627 sid_copy((*user_gids)[*num_groups], &sids[i]);
631 status = NT_STATUS_OK;
632 DEBUG(3,("ads lookup_usergroups for sid=%s\n", sid_to_string(sid_string, sid)));
638 find the members of a group, given a group rid and domain
640 static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
642 const DOM_SID *group_sid, uint32 *num_names,
643 DOM_SID ***sid_mem, char ***names,
649 ADS_STRUCT *ads = NULL;
651 NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
662 DEBUG(10,("ads: lookup_groupmem %s sid=%s\n", domain->name,
663 sid_string_static(group_sid)));
667 ads = ads_cached_connection(domain);
670 domain->last_status = NT_STATUS_SERVER_DISABLED;
674 sidstr = sid_binstring(group_sid);
676 /* search for all members of the group */
677 if (!(ldap_exp = talloc_asprintf(mem_ctx, "(objectSid=%s)",sidstr))) {
679 DEBUG(1, ("ads: lookup_groupmem: tallloc_asprintf for ldap_exp failed!\n"));
680 status = NT_STATUS_NO_MEMORY;
688 attrs = TALLOC_ARRAY(mem_ctx, const char *, 3);
689 attrs[1] = talloc_strdup(mem_ctx, "usnChanged");
693 if (num_members == 0)
694 attrs[0] = talloc_strdup(mem_ctx, "member");
696 DEBUG(10, ("Searching for attrs[0] = %s, attrs[1] = %s\n", attrs[0], attrs[1]));
698 rc = ads_search_retry(ads, &res, ldap_exp, attrs);
700 if (!ADS_ERR_OK(rc) || !res) {
701 DEBUG(1,("ads: lookup_groupmem ads_search: %s\n",
703 status = ads_ntstatus(rc);
707 count = ads_count_replies(ads, res);
711 if (num_members == 0) {
712 if (!ads_pull_uint32(ads, res, "usnChanged", &first_usn)) {
713 DEBUG(1, ("ads: lookup_groupmem could not pull usnChanged!\n"));
718 if (!ads_pull_uint32(ads, res, "usnChanged", ¤t_usn)) {
719 DEBUG(1, ("ads: lookup_groupmem could not pull usnChanged!\n"));
723 if (first_usn != current_usn) {
724 DEBUG(5, ("ads: lookup_groupmem USN on this record changed"
725 " - restarting search\n"));
726 if (num_retries < 5) {
731 DEBUG(5, ("ads: lookup_groupmem USN on this record changed"
732 " - restarted search too many times, aborting!\n"));
733 status = NT_STATUS_UNSUCCESSFUL;
738 members = ads_pull_strings_range(ads, mem_ctx, res,
745 if ((members == NULL) || (num_members == 0))
748 } while (more_values);
750 /* now we need to turn a list of members into rids, names and name types
751 the problem is that the members are in the form of distinguised names
754 (*sid_mem) = TALLOC_ZERO_ARRAY(mem_ctx, DOM_SID *, num_members);
755 (*name_types) = TALLOC_ZERO_ARRAY(mem_ctx, uint32, num_members);
756 (*names) = TALLOC_ZERO_ARRAY(mem_ctx, char *, num_members);
758 for (i=0;i<num_members;i++) {
763 if (dn_lookup(ads, mem_ctx, members[i], &name, &name_type, &sid)) {
764 (*names)[*num_names] = name;
765 (*name_types)[*num_names] = name_type;
766 (*sid_mem)[*num_names] = TALLOC_P(mem_ctx, DOM_SID);
767 if (!(*sid_mem)[*num_names]) {
768 status = NT_STATUS_NO_MEMORY;
771 sid_copy((*sid_mem)[*num_names], &sid);
776 status = NT_STATUS_OK;
777 DEBUG(3,("ads lookup_groupmem for sid=%s\n", sid_to_string(sid_string, group_sid)));
781 ads_msgfree(ads, res);
786 /* find the sequence number for a domain */
787 static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
789 ADS_STRUCT *ads = NULL;
792 DEBUG(3,("ads: fetch sequence_number for %s\n", domain->name));
794 *seq = DOM_SEQUENCE_NONE;
796 ads = ads_cached_connection(domain);
799 domain->last_status = NT_STATUS_SERVER_DISABLED;
800 return NT_STATUS_UNSUCCESSFUL;
803 rc = ads_USN(ads, seq);
805 if (!ADS_ERR_OK(rc)) {
807 /* its a dead connection ; don't destroy it
808 through since ads_USN() has already done
811 domain->private = NULL;
813 return ads_ntstatus(rc);
816 /* get a list of trusted domains */
817 static NTSTATUS trusted_domains(struct winbindd_domain *domain,
824 NTSTATUS result = NT_STATUS_UNSUCCESSFUL;
825 struct ds_domain_trust *domains = NULL;
828 struct cli_state *cli = NULL;
829 /* i think we only need our forest and downlevel trusted domains */
830 uint32 flags = DS_DOMAIN_IN_FOREST | DS_DOMAIN_DIRECT_OUTBOUND;
832 DEBUG(3,("ads: trusted_domains\n"));
839 if ( !NT_STATUS_IS_OK(result = cm_fresh_connection(domain, PI_NETLOGON, &cli)) ) {
840 DEBUG(5, ("trusted_domains: Could not open a connection to %s for PIPE_NETLOGON (%s)\n",
841 domain->name, nt_errstr(result)));
842 return NT_STATUS_UNSUCCESSFUL;
845 if ( NT_STATUS_IS_OK(result) )
846 result = cli_ds_enum_domain_trusts( cli, mem_ctx, cli->desthost,
847 flags, &domains, (unsigned int *)&count );
849 if ( NT_STATUS_IS_OK(result) && count) {
851 /* Allocate memory for trusted domain names and sids */
853 if ( !(*names = TALLOC_ARRAY(mem_ctx, char *, count)) ) {
854 DEBUG(0, ("trusted_domains: out of memory\n"));
855 result = NT_STATUS_NO_MEMORY;
859 if ( !(*alt_names = TALLOC_ARRAY(mem_ctx, char *, count)) ) {
860 DEBUG(0, ("trusted_domains: out of memory\n"));
861 result = NT_STATUS_NO_MEMORY;
865 if ( !(*dom_sids = TALLOC_ARRAY(mem_ctx, DOM_SID, count)) ) {
866 DEBUG(0, ("trusted_domains: out of memory\n"));
867 result = NT_STATUS_NO_MEMORY;
871 /* Copy across names and sids */
873 for (i = 0; i < count; i++) {
874 (*names)[i] = domains[i].netbios_domain;
875 (*alt_names)[i] = domains[i].dns_domain;
877 sid_copy(&(*dom_sids)[i], &domains[i].sid);
880 *num_domains = count;
885 /* remove connection; This is a special case to the \NETLOGON pipe */
893 /* find the domain sid for a domain */
894 static NTSTATUS domain_sid(struct winbindd_domain *domain, DOM_SID *sid)
899 DEBUG(3,("ads: domain_sid\n"));
901 ads = ads_cached_connection(domain);
904 domain->last_status = NT_STATUS_SERVER_DISABLED;
905 return NT_STATUS_UNSUCCESSFUL;
908 rc = ads_domain_sid(ads, sid);
910 if (!ADS_ERR_OK(rc)) {
912 /* its a dead connection; don't destroy it though
913 since that has already been done indirectly
914 by ads_domain_sid() */
916 domain->private = NULL;
919 return ads_ntstatus(rc);
923 /* find alternate names list for the domain - for ADS this is the
925 static NTSTATUS alternate_name(struct winbindd_domain *domain)
930 const char *workgroup;
932 DEBUG(3,("ads: alternate_name\n"));
934 ads = ads_cached_connection(domain);
937 domain->last_status = NT_STATUS_SERVER_DISABLED;
938 return NT_STATUS_UNSUCCESSFUL;
941 if (!(ctx = talloc_init("alternate_name"))) {
942 return NT_STATUS_NO_MEMORY;
945 rc = ads_workgroup_name(ads, ctx, &workgroup);
947 if (ADS_ERR_OK(rc)) {
948 fstrcpy(domain->name, workgroup);
949 fstrcpy(domain->alt_name, ads->config.realm);
950 strupper_m(domain->alt_name);
951 strupper_m(domain->name);
956 return ads_ntstatus(rc);
959 /* the ADS backend methods are exposed via this structure */
960 struct winbindd_methods ads_methods = {
969 msrpc_lookup_useraliases,