2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2008,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 * Copyright (C) Volker Lendecke 2005.
14 * Copyright (C) Guenther Deschner 2008.
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 3 of the License, or
19 * (at your option) any later version.
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
31 * This is the implementation of the SAMR code.
37 #define DBGC_CLASS DBGC_RPC_SRV
39 #define SAMR_USR_RIGHTS_WRITE_PW \
40 ( READ_CONTROL_ACCESS | \
41 SAMR_USER_ACCESS_CHANGE_PASSWORD | \
42 SAMR_USER_ACCESS_SET_LOC_COM)
43 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
44 ( READ_CONTROL_ACCESS | SAMR_USER_ACCESS_SET_LOC_COM )
46 #define DISP_INFO_CACHE_TIMEOUT 10
48 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
49 #define MAX_SAM_ENTRIES_W95 50
51 struct samr_connect_info {
55 typedef struct disp_info {
56 DOM_SID sid; /* identify which domain this is. */
57 struct pdb_search *users; /* querydispinfo 1 and 4 */
58 struct pdb_search *machines; /* querydispinfo 2 */
59 struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
60 struct pdb_search *aliases; /* enumaliases */
63 struct pdb_search *enum_users; /* enumusers with a mask */
65 struct timed_event *cache_timeout_event; /* cache idle timeout
69 /* We keep a static list of these by SID as modern clients close down
70 all resources between each request in a complete enumeration. */
73 /* for use by the \PIPE\samr policy */
75 uint32 status; /* some sort of flag. best to record it. comes from opnum 0x39 */
80 static const struct generic_mapping sam_generic_mapping = {
81 GENERIC_RIGHTS_SAM_READ,
82 GENERIC_RIGHTS_SAM_WRITE,
83 GENERIC_RIGHTS_SAM_EXECUTE,
84 GENERIC_RIGHTS_SAM_ALL_ACCESS};
85 static const struct generic_mapping dom_generic_mapping = {
86 GENERIC_RIGHTS_DOMAIN_READ,
87 GENERIC_RIGHTS_DOMAIN_WRITE,
88 GENERIC_RIGHTS_DOMAIN_EXECUTE,
89 GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
90 static const struct generic_mapping usr_generic_mapping = {
91 GENERIC_RIGHTS_USER_READ,
92 GENERIC_RIGHTS_USER_WRITE,
93 GENERIC_RIGHTS_USER_EXECUTE,
94 GENERIC_RIGHTS_USER_ALL_ACCESS};
95 static const struct generic_mapping usr_nopwchange_generic_mapping = {
96 GENERIC_RIGHTS_USER_READ,
97 GENERIC_RIGHTS_USER_WRITE,
98 GENERIC_RIGHTS_USER_EXECUTE & ~SAMR_USER_ACCESS_CHANGE_PASSWORD,
99 GENERIC_RIGHTS_USER_ALL_ACCESS};
100 static const struct generic_mapping grp_generic_mapping = {
101 GENERIC_RIGHTS_GROUP_READ,
102 GENERIC_RIGHTS_GROUP_WRITE,
103 GENERIC_RIGHTS_GROUP_EXECUTE,
104 GENERIC_RIGHTS_GROUP_ALL_ACCESS};
105 static const struct generic_mapping ali_generic_mapping = {
106 GENERIC_RIGHTS_ALIAS_READ,
107 GENERIC_RIGHTS_ALIAS_WRITE,
108 GENERIC_RIGHTS_ALIAS_EXECUTE,
109 GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
111 /*******************************************************************
112 *******************************************************************/
114 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
115 const struct generic_mapping *map,
116 DOM_SID *sid, uint32 sid_access )
118 DOM_SID domadmin_sid;
119 SEC_ACE ace[5]; /* at most 5 entries */
124 /* basic access for Everyone */
126 init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
127 map->generic_execute | map->generic_read, 0);
129 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
131 init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
132 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
133 init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
134 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
136 /* Add Full Access for Domain Admins if we are a DC */
139 sid_copy( &domadmin_sid, get_global_sam_sid() );
140 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
141 init_sec_ace(&ace[i++], &domadmin_sid,
142 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
145 /* if we have a sid, give it some special access */
148 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, sid_access, 0);
151 /* create the security descriptor */
153 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
154 return NT_STATUS_NO_MEMORY;
156 if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
157 SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
158 psa, sd_size)) == NULL)
159 return NT_STATUS_NO_MEMORY;
164 /*******************************************************************
165 Checks if access to an object should be granted, and returns that
166 level of access for further checks.
167 ********************************************************************/
169 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
170 SE_PRIV *rights, uint32 rights_mask,
171 uint32 des_access, uint32 *acc_granted,
174 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
175 uint32 saved_mask = 0;
177 /* check privileges; certain SAM access bits should be overridden
178 by privileges (mostly having to do with creating/modifying/deleting
181 if ( rights && user_has_any_privilege( token, rights ) ) {
183 saved_mask = (des_access & rights_mask);
184 des_access &= ~saved_mask;
186 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
191 /* check the security descriptor first */
193 status = se_access_check(psd, token, des_access, acc_granted);
194 if (NT_STATUS_IS_OK(status)) {
198 /* give root a free pass */
200 if ( geteuid() == sec_initial_uid() ) {
202 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n", debug, des_access));
203 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
205 *acc_granted = des_access;
207 status = NT_STATUS_OK;
213 /* add in any bits saved during the privilege check (only
214 matters is status is ok) */
216 *acc_granted |= rights_mask;
218 DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
219 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
220 des_access, *acc_granted));
225 /*******************************************************************
226 Checks if access to a function can be granted
227 ********************************************************************/
229 static NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
231 DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
232 debug, acc_granted, acc_required));
234 /* check the security descriptor first */
236 if ( (acc_granted&acc_required) == acc_required )
239 /* give root a free pass */
241 if (geteuid() == sec_initial_uid()) {
243 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
244 debug, acc_granted, acc_required));
245 DEBUGADD(4,("but overwritten by euid == 0\n"));
250 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
251 debug, acc_granted, acc_required));
253 return NT_STATUS_ACCESS_DENIED;
256 /*******************************************************************
257 Map any MAXIMUM_ALLOWED_ACCESS request to a valid access set.
258 ********************************************************************/
260 static void map_max_allowed_access(const NT_USER_TOKEN *token,
261 uint32_t *pacc_requested)
263 if (!((*pacc_requested) & MAXIMUM_ALLOWED_ACCESS)) {
266 *pacc_requested &= ~MAXIMUM_ALLOWED_ACCESS;
268 /* At least try for generic read. */
269 *pacc_requested = GENERIC_READ_ACCESS;
271 /* root gets anything. */
272 if (geteuid() == sec_initial_uid()) {
273 *pacc_requested |= GENERIC_ALL_ACCESS;
277 /* Full Access for 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
279 if (is_sid_in_token(token, &global_sid_Builtin_Administrators) ||
280 is_sid_in_token(token, &global_sid_Builtin_Account_Operators)) {
281 *pacc_requested |= GENERIC_ALL_ACCESS;
285 /* Full access for DOMAIN\Domain Admins. */
287 DOM_SID domadmin_sid;
288 sid_copy( &domadmin_sid, get_global_sam_sid() );
289 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
290 if (is_sid_in_token(token, &domadmin_sid)) {
291 *pacc_requested |= GENERIC_ALL_ACCESS;
295 /* TODO ! Check privileges. */
298 /*******************************************************************
299 Fetch or create a dispinfo struct.
300 ********************************************************************/
302 static DISP_INFO *get_samr_dispinfo_by_sid(DOM_SID *psid)
305 * We do a static cache for DISP_INFO's here. Explanation can be found
306 * in Jeremy's checkin message to r11793:
308 * Fix the SAMR cache so it works across completely insane
309 * client behaviour (ie.:
310 * open pipe/open SAMR handle/enumerate 0 - 1024
311 * close SAMR handle, close pipe.
312 * open pipe/open SAMR handle/enumerate 1024 - 2048...
313 * close SAMR handle, close pipe.
314 * And on ad-nausium. Amazing.... probably object-oriented
315 * client side programming in action yet again.
316 * This change should *massively* improve performance when
317 * enumerating users from an LDAP database.
320 * "Our" and the builtin domain are the only ones where we ever
321 * enumerate stuff, so just cache 2 entries.
324 static struct disp_info *builtin_dispinfo;
325 static struct disp_info *domain_dispinfo;
327 /* There are two cases to consider here:
328 1) The SID is a domain SID and we look for an equality match, or
329 2) This is an account SID and so we return the DISP_INFO* for our
336 if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
338 * Necessary only once, but it does not really hurt.
340 if (builtin_dispinfo == NULL) {
341 builtin_dispinfo = talloc_zero(
342 talloc_autofree_context(), struct disp_info);
343 if (builtin_dispinfo == NULL) {
347 sid_copy(&builtin_dispinfo->sid, &global_sid_Builtin);
349 return builtin_dispinfo;
352 if (sid_check_is_domain(psid) || sid_check_is_in_our_domain(psid)) {
354 * Necessary only once, but it does not really hurt.
356 if (domain_dispinfo == NULL) {
357 domain_dispinfo = talloc_zero(
358 talloc_autofree_context(), struct disp_info);
359 if (domain_dispinfo == NULL) {
363 sid_copy(&domain_dispinfo->sid, get_global_sam_sid());
365 return domain_dispinfo;
371 /*******************************************************************
372 Create a samr_info struct.
373 ********************************************************************/
375 static int samr_info_destructor(struct samr_info *info);
377 static struct samr_info *get_samr_info_by_sid(TALLOC_CTX *mem_ctx,
380 struct samr_info *info;
382 info = talloc_zero(mem_ctx, struct samr_info);
386 talloc_set_destructor(info, samr_info_destructor);
388 DEBUG(10, ("get_samr_info_by_sid: created new info for sid %s\n",
389 sid_string_dbg(psid)));
392 sid_copy( &info->sid, psid);
394 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
397 info->disp_info = get_samr_dispinfo_by_sid(psid);
402 /*******************************************************************
403 Function to free the per SID data.
404 ********************************************************************/
406 static void free_samr_cache(DISP_INFO *disp_info)
408 DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
409 sid_string_dbg(&disp_info->sid)));
411 /* We need to become root here because the paged search might have to
412 * tell the LDAP server we're not interested in the rest anymore. */
416 TALLOC_FREE(disp_info->users);
417 TALLOC_FREE(disp_info->machines);
418 TALLOC_FREE(disp_info->groups);
419 TALLOC_FREE(disp_info->aliases);
420 TALLOC_FREE(disp_info->enum_users);
425 static int samr_info_destructor(struct samr_info *info)
427 /* Only free the dispinfo cache if no one bothered to set up
430 if (info->disp_info && info->disp_info->cache_timeout_event == NULL) {
431 free_samr_cache(info->disp_info);
436 /*******************************************************************
437 Idle event handler. Throw away the disp info cache.
438 ********************************************************************/
440 static void disp_info_cache_idle_timeout_handler(struct event_context *ev_ctx,
441 struct timed_event *te,
445 DISP_INFO *disp_info = (DISP_INFO *)private_data;
447 TALLOC_FREE(disp_info->cache_timeout_event);
449 DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
451 free_samr_cache(disp_info);
454 /*******************************************************************
455 Setup cache removal idle event handler.
456 ********************************************************************/
458 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
460 /* Remove any pending timeout and update. */
462 TALLOC_FREE(disp_info->cache_timeout_event);
464 DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
465 "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
466 (unsigned int)secs_fromnow ));
468 disp_info->cache_timeout_event = event_add_timed(
469 smbd_event_context(), NULL,
470 timeval_current_ofs(secs_fromnow, 0),
471 disp_info_cache_idle_timeout_handler, (void *)disp_info);
474 /*******************************************************************
475 Force flush any cache. We do this on any samr_set_xxx call.
476 We must also remove the timeout handler.
477 ********************************************************************/
479 static void force_flush_samr_cache(DISP_INFO *disp_info)
481 if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
485 DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
486 TALLOC_FREE(disp_info->cache_timeout_event);
487 free_samr_cache(disp_info);
490 /*******************************************************************
491 Ensure password info is never given out. Paranioa... JRA.
492 ********************************************************************/
494 static void samr_clear_sam_passwd(struct samu *sam_pass)
500 /* These now zero out the old password */
502 pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
503 pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
506 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
508 struct samr_displayentry *entry;
510 if (sid_check_is_builtin(&info->sid)) {
511 /* No users in builtin. */
515 if (info->users == NULL) {
516 info->users = pdb_search_users(info, acct_flags);
517 if (info->users == NULL) {
521 /* Fetch the last possible entry, thus trigger an enumeration */
522 pdb_search_entries(info->users, 0xffffffff, 1, &entry);
524 /* Ensure we cache this enumeration. */
525 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
527 return info->users->num_entries;
530 static uint32 count_sam_groups(struct disp_info *info)
532 struct samr_displayentry *entry;
534 if (sid_check_is_builtin(&info->sid)) {
535 /* No groups in builtin. */
539 if (info->groups == NULL) {
540 info->groups = pdb_search_groups(info);
541 if (info->groups == NULL) {
545 /* Fetch the last possible entry, thus trigger an enumeration */
546 pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
548 /* Ensure we cache this enumeration. */
549 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
551 return info->groups->num_entries;
554 static uint32 count_sam_aliases(struct disp_info *info)
556 struct samr_displayentry *entry;
558 if (info->aliases == NULL) {
559 info->aliases = pdb_search_aliases(info, &info->sid);
560 if (info->aliases == NULL) {
564 /* Fetch the last possible entry, thus trigger an enumeration */
565 pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
567 /* Ensure we cache this enumeration. */
568 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
570 return info->aliases->num_entries;
573 /*******************************************************************
575 ********************************************************************/
577 NTSTATUS _samr_Close(pipes_struct *p, struct samr_Close *r)
579 if (!close_policy_hnd(p, r->in.handle)) {
580 return NT_STATUS_INVALID_HANDLE;
583 ZERO_STRUCTP(r->out.handle);
588 /*******************************************************************
590 ********************************************************************/
592 NTSTATUS _samr_OpenDomain(pipes_struct *p,
593 struct samr_OpenDomain *r)
595 struct samr_connect_info *cinfo;
596 struct samr_info *info;
597 SEC_DESC *psd = NULL;
599 uint32 des_access = r->in.access_mask;
604 /* find the connection policy handle. */
606 cinfo = policy_handle_find(p, r->in.connect_handle, 0, NULL,
607 struct samr_connect_info, &status);
608 if (!NT_STATUS_IS_OK(status)) {
612 /*check if access can be granted as requested by client. */
613 map_max_allowed_access(p->server_info->ptok, &des_access);
615 make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
616 se_map_generic( &des_access, &dom_generic_mapping );
618 se_priv_copy( &se_rights, &se_machine_account );
619 se_priv_add( &se_rights, &se_add_users );
621 status = access_check_samr_object( psd, p->server_info->ptok,
622 &se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
623 &acc_granted, "_samr_OpenDomain" );
625 if ( !NT_STATUS_IS_OK(status) )
628 if (!sid_check_is_domain(r->in.sid) &&
629 !sid_check_is_builtin(r->in.sid)) {
630 return NT_STATUS_NO_SUCH_DOMAIN;
633 /* associate the domain SID with the (unique) handle. */
634 if ((info = get_samr_info_by_sid(p->mem_ctx, r->in.sid))==NULL)
635 return NT_STATUS_NO_MEMORY;
636 info->acc_granted = acc_granted;
638 /* get a (unique) handle. open a policy on it. */
639 if (!create_policy_hnd(p, r->out.domain_handle, info))
640 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
642 DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
647 /*******************************************************************
649 ********************************************************************/
651 NTSTATUS _samr_GetUserPwInfo(pipes_struct *p,
652 struct samr_GetUserPwInfo *r)
654 struct samr_info *info = NULL;
655 enum lsa_SidType sid_type;
656 uint32_t min_password_length = 0;
657 uint32_t password_properties = 0;
661 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
663 /* find the policy handle. open a policy on it. */
664 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info)) {
665 return NT_STATUS_INVALID_HANDLE;
668 status = access_check_samr_function(info->acc_granted,
669 SAMR_USER_ACCESS_GET_ATTRIBUTES,
670 "_samr_GetUserPwInfo" );
671 if (!NT_STATUS_IS_OK(status)) {
675 if (!sid_check_is_in_our_domain(&info->sid)) {
676 return NT_STATUS_OBJECT_TYPE_MISMATCH;
680 ret = lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, &sid_type);
683 return NT_STATUS_NO_SUCH_USER;
689 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
690 &min_password_length);
691 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
692 &password_properties);
695 if (lp_check_password_script() && *lp_check_password_script()) {
696 password_properties |= DOMAIN_PASSWORD_COMPLEX;
704 r->out.info->min_password_length = min_password_length;
705 r->out.info->password_properties = password_properties;
707 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
712 /*******************************************************************
713 ********************************************************************/
715 static bool get_lsa_policy_samr_sid( pipes_struct *p, struct policy_handle *pol,
716 DOM_SID *sid, uint32 *acc_granted,
717 DISP_INFO **ppdisp_info)
719 struct samr_info *info = NULL;
721 /* find the policy handle. open a policy on it. */
722 if (!find_policy_by_hnd(p, pol, (void **)(void *)&info))
729 *acc_granted = info->acc_granted;
731 *ppdisp_info = info->disp_info;
737 /*******************************************************************
739 ********************************************************************/
741 NTSTATUS _samr_SetSecurity(pipes_struct *p,
742 struct samr_SetSecurity *r)
745 uint32 acc_granted, i;
748 struct samu *sampass=NULL;
751 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
752 return NT_STATUS_INVALID_HANDLE;
754 if (!(sampass = samu_new( p->mem_ctx))) {
755 DEBUG(0,("No memory!\n"));
756 return NT_STATUS_NO_MEMORY;
759 /* get the user record */
761 ret = pdb_getsampwsid(sampass, &pol_sid);
765 DEBUG(4, ("User %s not found\n", sid_string_dbg(&pol_sid)));
766 TALLOC_FREE(sampass);
767 return NT_STATUS_INVALID_HANDLE;
770 dacl = r->in.sdbuf->sd->dacl;
771 for (i=0; i < dacl->num_aces; i++) {
772 if (sid_equal(&pol_sid, &dacl->aces[i].trustee)) {
773 ret = pdb_set_pass_can_change(sampass,
774 (dacl->aces[i].access_mask &
775 SAMR_USER_ACCESS_CHANGE_PASSWORD) ?
782 TALLOC_FREE(sampass);
783 return NT_STATUS_ACCESS_DENIED;
786 status = access_check_samr_function(acc_granted,
787 SAMR_USER_ACCESS_SET_ATTRIBUTES,
788 "_samr_SetSecurity");
789 if (NT_STATUS_IS_OK(status)) {
791 status = pdb_update_sam_account(sampass);
795 TALLOC_FREE(sampass);
800 /*******************************************************************
801 build correct perms based on policies and password times for _samr_query_sec_obj
802 *******************************************************************/
803 static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
805 struct samu *sampass=NULL;
808 if ( !(sampass = samu_new( mem_ctx )) ) {
809 DEBUG(0,("No memory!\n"));
814 ret = pdb_getsampwsid(sampass, user_sid);
818 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
819 TALLOC_FREE(sampass);
823 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
825 if (pdb_get_pass_can_change(sampass)) {
826 TALLOC_FREE(sampass);
829 TALLOC_FREE(sampass);
834 /*******************************************************************
836 ********************************************************************/
838 NTSTATUS _samr_QuerySecurity(pipes_struct *p,
839 struct samr_QuerySecurity *r)
843 SEC_DESC * psd = NULL;
848 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
849 return NT_STATUS_INVALID_HANDLE;
851 DEBUG(10,("_samr_QuerySecurity: querying security on SID: %s\n",
852 sid_string_dbg(&pol_sid)));
854 status = access_check_samr_function(acc_granted,
855 STD_RIGHT_READ_CONTROL_ACCESS,
856 "_samr_QuerySecurity");
857 if (!NT_STATUS_IS_OK(status)) {
861 /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
863 /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
864 if (pol_sid.sid_rev_num == 0) {
865 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
866 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
867 } else if (sid_equal(&pol_sid,get_global_sam_sid())) {
868 /* check if it is our domain SID */
869 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
870 "with SID: %s\n", sid_string_dbg(&pol_sid)));
871 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
872 } else if (sid_equal(&pol_sid,&global_sid_Builtin)) {
873 /* check if it is the Builtin Domain */
874 /* TODO: Builtin probably needs a different SD with restricted write access*/
875 DEBUG(5,("_samr_QuerySecurity: querying security on Builtin "
876 "Domain with SID: %s\n", sid_string_dbg(&pol_sid)));
877 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
878 } else if (sid_check_is_in_our_domain(&pol_sid) ||
879 sid_check_is_in_builtin(&pol_sid)) {
880 /* TODO: different SDs have to be generated for aliases groups and users.
881 Currently all three get a default user SD */
882 DEBUG(10,("_samr_QuerySecurity: querying security on Object "
883 "with SID: %s\n", sid_string_dbg(&pol_sid)));
884 if (check_change_pw_access(p->mem_ctx, &pol_sid)) {
885 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
886 &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
888 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_nopwchange_generic_mapping,
889 &pol_sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
892 return NT_STATUS_OBJECT_TYPE_MISMATCH;
895 if ((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
896 return NT_STATUS_NO_MEMORY;
901 /*******************************************************************
902 makes a SAM_ENTRY / UNISTR2* structure from a user list.
903 ********************************************************************/
905 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx,
906 struct samr_SamEntry **sam_pp,
907 uint32_t num_entries,
909 struct samr_displayentry *entries)
912 struct samr_SamEntry *sam;
916 if (num_entries == 0) {
920 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_entries);
922 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
923 return NT_STATUS_NO_MEMORY;
926 for (i = 0; i < num_entries; i++) {
929 * usrmgr expects a non-NULL terminated string with
930 * trust relationships
932 if (entries[i].acct_flags & ACB_DOMTRUST) {
933 init_unistr2(&uni_temp_name, entries[i].account_name,
936 init_unistr2(&uni_temp_name, entries[i].account_name,
940 init_lsa_String(&sam[i].name, entries[i].account_name);
941 sam[i].idx = entries[i].rid;
949 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
951 /*******************************************************************
952 _samr_EnumDomainUsers
953 ********************************************************************/
955 NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
956 struct samr_EnumDomainUsers *r)
959 struct samr_info *info = NULL;
961 uint32 enum_context = *r->in.resume_handle;
962 enum remote_arch_types ra_type = get_remote_arch();
963 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
964 uint32 max_entries = max_sam_entries;
965 struct samr_displayentry *entries = NULL;
966 struct samr_SamArray *samr_array = NULL;
967 struct samr_SamEntry *samr_entries = NULL;
969 /* find the policy handle. open a policy on it. */
970 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
971 return NT_STATUS_INVALID_HANDLE;
973 status = access_check_samr_function(info->acc_granted,
974 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
975 "_samr_EnumDomainUsers");
976 if (!NT_STATUS_IS_OK(status)) {
980 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
982 if (sid_check_is_builtin(&info->sid)) {
983 /* No users in builtin. */
984 *r->out.resume_handle = *r->in.resume_handle;
985 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
989 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
991 return NT_STATUS_NO_MEMORY;
993 *r->out.sam = samr_array;
999 if ((info->disp_info->enum_users != NULL) &&
1000 (info->disp_info->enum_acb_mask != r->in.acct_flags)) {
1001 TALLOC_FREE(info->disp_info->enum_users);
1004 if (info->disp_info->enum_users == NULL) {
1005 info->disp_info->enum_users = pdb_search_users(
1006 info->disp_info, r->in.acct_flags);
1007 info->disp_info->enum_acb_mask = r->in.acct_flags;
1010 if (info->disp_info->enum_users == NULL) {
1011 /* END AS ROOT !!!! */
1013 return NT_STATUS_ACCESS_DENIED;
1016 num_account = pdb_search_entries(info->disp_info->enum_users,
1017 enum_context, max_entries,
1020 /* END AS ROOT !!!! */
1024 if (num_account == 0) {
1025 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
1026 "total entries\n"));
1027 *r->out.resume_handle = *r->in.resume_handle;
1028 return NT_STATUS_OK;
1031 status = make_user_sam_entry_list(p->mem_ctx, &samr_entries,
1032 num_account, enum_context,
1034 if (!NT_STATUS_IS_OK(status)) {
1038 if (max_entries <= num_account) {
1039 status = STATUS_MORE_ENTRIES;
1041 status = NT_STATUS_OK;
1044 /* Ensure we cache this enumeration. */
1045 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1047 DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
1049 samr_array->count = num_account;
1050 samr_array->entries = samr_entries;
1052 *r->out.resume_handle = *r->in.resume_handle + num_account;
1053 *r->out.num_entries = num_account;
1055 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
1060 /*******************************************************************
1061 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1062 ********************************************************************/
1064 static void make_group_sam_entry_list(TALLOC_CTX *ctx,
1065 struct samr_SamEntry **sam_pp,
1066 uint32_t num_sam_entries,
1067 struct samr_displayentry *entries)
1069 struct samr_SamEntry *sam;
1074 if (num_sam_entries == 0) {
1078 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_sam_entries);
1083 for (i = 0; i < num_sam_entries; i++) {
1085 * JRA. I think this should include the null. TNG does not.
1087 init_lsa_String(&sam[i].name, entries[i].account_name);
1088 sam[i].idx = entries[i].rid;
1094 /*******************************************************************
1095 _samr_EnumDomainGroups
1096 ********************************************************************/
1098 NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
1099 struct samr_EnumDomainGroups *r)
1102 struct samr_info *info = NULL;
1103 struct samr_displayentry *groups;
1105 struct samr_SamArray *samr_array = NULL;
1106 struct samr_SamEntry *samr_entries = NULL;
1108 /* find the policy handle. open a policy on it. */
1109 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1110 return NT_STATUS_INVALID_HANDLE;
1112 status = access_check_samr_function(info->acc_granted,
1113 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1114 "_samr_EnumDomainGroups");
1115 if (!NT_STATUS_IS_OK(status)) {
1119 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1121 if (sid_check_is_builtin(&info->sid)) {
1122 /* No groups in builtin. */
1123 *r->out.resume_handle = *r->in.resume_handle;
1124 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
1128 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1130 return NT_STATUS_NO_MEMORY;
1133 /* the domain group array is being allocated in the function below */
1137 if (info->disp_info->groups == NULL) {
1138 info->disp_info->groups = pdb_search_groups(info->disp_info);
1140 if (info->disp_info->groups == NULL) {
1142 return NT_STATUS_ACCESS_DENIED;
1146 num_groups = pdb_search_entries(info->disp_info->groups,
1147 *r->in.resume_handle,
1148 MAX_SAM_ENTRIES, &groups);
1151 /* Ensure we cache this enumeration. */
1152 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1154 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1155 num_groups, groups);
1157 samr_array->count = num_groups;
1158 samr_array->entries = samr_entries;
1160 *r->out.sam = samr_array;
1161 *r->out.num_entries = num_groups;
1162 *r->out.resume_handle = num_groups + *r->in.resume_handle;
1164 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1169 /*******************************************************************
1170 _samr_EnumDomainAliases
1171 ********************************************************************/
1173 NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
1174 struct samr_EnumDomainAliases *r)
1177 struct samr_info *info;
1178 struct samr_displayentry *aliases;
1179 uint32 num_aliases = 0;
1180 struct samr_SamArray *samr_array = NULL;
1181 struct samr_SamEntry *samr_entries = NULL;
1183 /* find the policy handle. open a policy on it. */
1184 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1185 return NT_STATUS_INVALID_HANDLE;
1187 DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1188 sid_string_dbg(&info->sid)));
1190 status = access_check_samr_function(info->acc_granted,
1191 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1192 "_samr_EnumDomainAliases");
1193 if (!NT_STATUS_IS_OK(status)) {
1197 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1199 return NT_STATUS_NO_MEMORY;
1204 if (info->disp_info->aliases == NULL) {
1205 info->disp_info->aliases = pdb_search_aliases(
1206 info->disp_info, &info->sid);
1207 if (info->disp_info->aliases == NULL) {
1209 return NT_STATUS_ACCESS_DENIED;
1213 num_aliases = pdb_search_entries(info->disp_info->aliases,
1214 *r->in.resume_handle,
1215 MAX_SAM_ENTRIES, &aliases);
1218 /* Ensure we cache this enumeration. */
1219 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1221 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1222 num_aliases, aliases);
1224 DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
1226 samr_array->count = num_aliases;
1227 samr_array->entries = samr_entries;
1229 *r->out.sam = samr_array;
1230 *r->out.num_entries = num_aliases;
1231 *r->out.resume_handle = num_aliases + *r->in.resume_handle;
1236 /*******************************************************************
1237 inits a samr_DispInfoGeneral structure.
1238 ********************************************************************/
1240 static NTSTATUS init_samr_dispinfo_1(TALLOC_CTX *ctx,
1241 struct samr_DispInfoGeneral *r,
1242 uint32_t num_entries,
1244 struct samr_displayentry *entries)
1248 DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries));
1250 if (num_entries == 0) {
1251 return NT_STATUS_OK;
1254 r->count = num_entries;
1256 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryGeneral, num_entries);
1258 return NT_STATUS_NO_MEMORY;
1261 for (i = 0; i < num_entries ; i++) {
1263 init_lsa_String(&r->entries[i].account_name,
1264 entries[i].account_name);
1266 init_lsa_String(&r->entries[i].description,
1267 entries[i].description);
1269 init_lsa_String(&r->entries[i].full_name,
1270 entries[i].fullname);
1272 r->entries[i].rid = entries[i].rid;
1273 r->entries[i].acct_flags = entries[i].acct_flags;
1274 r->entries[i].idx = start_idx+i+1;
1277 return NT_STATUS_OK;
1280 /*******************************************************************
1281 inits a samr_DispInfoFull structure.
1282 ********************************************************************/
1284 static NTSTATUS init_samr_dispinfo_2(TALLOC_CTX *ctx,
1285 struct samr_DispInfoFull *r,
1286 uint32_t num_entries,
1288 struct samr_displayentry *entries)
1292 DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries));
1294 if (num_entries == 0) {
1295 return NT_STATUS_OK;
1298 r->count = num_entries;
1300 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFull, num_entries);
1302 return NT_STATUS_NO_MEMORY;
1305 for (i = 0; i < num_entries ; i++) {
1307 init_lsa_String(&r->entries[i].account_name,
1308 entries[i].account_name);
1310 init_lsa_String(&r->entries[i].description,
1311 entries[i].description);
1313 r->entries[i].rid = entries[i].rid;
1314 r->entries[i].acct_flags = entries[i].acct_flags;
1315 r->entries[i].idx = start_idx+i+1;
1318 return NT_STATUS_OK;
1321 /*******************************************************************
1322 inits a samr_DispInfoFullGroups structure.
1323 ********************************************************************/
1325 static NTSTATUS init_samr_dispinfo_3(TALLOC_CTX *ctx,
1326 struct samr_DispInfoFullGroups *r,
1327 uint32_t num_entries,
1329 struct samr_displayentry *entries)
1333 DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries));
1335 if (num_entries == 0) {
1336 return NT_STATUS_OK;
1339 r->count = num_entries;
1341 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFullGroup, num_entries);
1343 return NT_STATUS_NO_MEMORY;
1346 for (i = 0; i < num_entries ; i++) {
1348 init_lsa_String(&r->entries[i].account_name,
1349 entries[i].account_name);
1351 init_lsa_String(&r->entries[i].description,
1352 entries[i].description);
1354 r->entries[i].rid = entries[i].rid;
1355 r->entries[i].acct_flags = entries[i].acct_flags;
1356 r->entries[i].idx = start_idx+i+1;
1359 return NT_STATUS_OK;
1362 /*******************************************************************
1363 inits a samr_DispInfoAscii structure.
1364 ********************************************************************/
1366 static NTSTATUS init_samr_dispinfo_4(TALLOC_CTX *ctx,
1367 struct samr_DispInfoAscii *r,
1368 uint32_t num_entries,
1370 struct samr_displayentry *entries)
1374 DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries));
1376 if (num_entries == 0) {
1377 return NT_STATUS_OK;
1380 r->count = num_entries;
1382 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1384 return NT_STATUS_NO_MEMORY;
1387 for (i = 0; i < num_entries ; i++) {
1389 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1390 entries[i].account_name);
1392 r->entries[i].idx = start_idx+i+1;
1395 return NT_STATUS_OK;
1398 /*******************************************************************
1399 inits a samr_DispInfoAscii structure.
1400 ********************************************************************/
1402 static NTSTATUS init_samr_dispinfo_5(TALLOC_CTX *ctx,
1403 struct samr_DispInfoAscii *r,
1404 uint32_t num_entries,
1406 struct samr_displayentry *entries)
1410 DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries));
1412 if (num_entries == 0) {
1413 return NT_STATUS_OK;
1416 r->count = num_entries;
1418 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1420 return NT_STATUS_NO_MEMORY;
1423 for (i = 0; i < num_entries ; i++) {
1425 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1426 entries[i].account_name);
1428 r->entries[i].idx = start_idx+i+1;
1431 return NT_STATUS_OK;
1434 /*******************************************************************
1435 _samr_QueryDisplayInfo
1436 ********************************************************************/
1438 NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
1439 struct samr_QueryDisplayInfo *r)
1442 struct samr_info *info = NULL;
1443 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1445 uint32 max_entries = r->in.max_entries;
1446 uint32 enum_context = r->in.start_idx;
1447 uint32 max_size = r->in.buf_size;
1449 union samr_DispInfo *disp_info = r->out.info;
1451 uint32 temp_size=0, total_data_size=0;
1452 NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1453 uint32 num_account = 0;
1454 enum remote_arch_types ra_type = get_remote_arch();
1455 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1456 struct samr_displayentry *entries = NULL;
1458 DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
1460 /* find the policy handle. open a policy on it. */
1461 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1462 return NT_STATUS_INVALID_HANDLE;
1464 if (sid_check_is_builtin(&info->sid)) {
1465 DEBUG(5,("_samr_QueryDisplayInfo: Nothing in BUILTIN\n"));
1466 return NT_STATUS_OK;
1469 status = access_check_samr_function(info->acc_granted,
1470 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1471 "_samr_QueryDisplayInfo");
1472 if (!NT_STATUS_IS_OK(status)) {
1477 * calculate how many entries we will return.
1479 * - the number of entries the client asked
1480 * - our limit on that
1481 * - the starting point (enumeration context)
1482 * - the buffer size the client will accept
1486 * We are a lot more like W2K. Instead of reading the SAM
1487 * each time to find the records we need to send back,
1488 * we read it once and link that copy to the sam handle.
1489 * For large user list (over the MAX_SAM_ENTRIES)
1490 * it's a definitive win.
1491 * second point to notice: between enumerations
1492 * our sam is now the same as it's a snapshoot.
1493 * third point: got rid of the static SAM_USER_21 struct
1494 * no more intermediate.
1495 * con: it uses much more memory, as a full copy is stored
1498 * If you want to change it, think twice and think
1499 * of the second point , that's really important.
1504 if ((r->in.level < 1) || (r->in.level > 5)) {
1505 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1506 (unsigned int)r->in.level ));
1507 return NT_STATUS_INVALID_INFO_CLASS;
1510 /* first limit the number of entries we will return */
1511 if(max_entries > max_sam_entries) {
1512 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1513 "entries, limiting to %d\n", max_entries,
1515 max_entries = max_sam_entries;
1518 /* calculate the size and limit on the number of entries we will
1521 temp_size=max_entries*struct_size;
1523 if (temp_size>max_size) {
1524 max_entries=MIN((max_size/struct_size),max_entries);;
1525 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1526 "only %d entries\n", max_entries));
1531 /* THe following done as ROOT. Don't return without unbecome_root(). */
1533 switch (r->in.level) {
1536 if (info->disp_info->users == NULL) {
1537 info->disp_info->users = pdb_search_users(
1538 info->disp_info, ACB_NORMAL);
1539 if (info->disp_info->users == NULL) {
1541 return NT_STATUS_ACCESS_DENIED;
1543 DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1544 (unsigned int)enum_context ));
1546 DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1547 (unsigned int)enum_context ));
1550 num_account = pdb_search_entries(info->disp_info->users,
1551 enum_context, max_entries,
1555 if (info->disp_info->machines == NULL) {
1556 info->disp_info->machines = pdb_search_users(
1557 info->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
1558 if (info->disp_info->machines == NULL) {
1560 return NT_STATUS_ACCESS_DENIED;
1562 DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1563 (unsigned int)enum_context ));
1565 DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1566 (unsigned int)enum_context ));
1569 num_account = pdb_search_entries(info->disp_info->machines,
1570 enum_context, max_entries,
1575 if (info->disp_info->groups == NULL) {
1576 info->disp_info->groups = pdb_search_groups(
1578 if (info->disp_info->groups == NULL) {
1580 return NT_STATUS_ACCESS_DENIED;
1582 DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1583 (unsigned int)enum_context ));
1585 DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1586 (unsigned int)enum_context ));
1589 num_account = pdb_search_entries(info->disp_info->groups,
1590 enum_context, max_entries,
1595 smb_panic("info class changed");
1601 /* Now create reply structure */
1602 switch (r->in.level) {
1604 disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
1605 num_account, enum_context,
1609 disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
1610 num_account, enum_context,
1614 disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
1615 num_account, enum_context,
1619 disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
1620 num_account, enum_context,
1624 disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
1625 num_account, enum_context,
1629 smb_panic("info class changed");
1633 if (!NT_STATUS_IS_OK(disp_ret))
1636 /* calculate the total size */
1637 total_data_size=num_account*struct_size;
1639 if (max_entries <= num_account) {
1640 status = STATUS_MORE_ENTRIES;
1642 status = NT_STATUS_OK;
1645 /* Ensure we cache this enumeration. */
1646 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1648 DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
1650 *r->out.total_size = total_data_size;
1651 *r->out.returned_size = temp_size;
1656 /****************************************************************
1657 _samr_QueryDisplayInfo2
1658 ****************************************************************/
1660 NTSTATUS _samr_QueryDisplayInfo2(pipes_struct *p,
1661 struct samr_QueryDisplayInfo2 *r)
1663 struct samr_QueryDisplayInfo q;
1665 q.in.domain_handle = r->in.domain_handle;
1666 q.in.level = r->in.level;
1667 q.in.start_idx = r->in.start_idx;
1668 q.in.max_entries = r->in.max_entries;
1669 q.in.buf_size = r->in.buf_size;
1671 q.out.total_size = r->out.total_size;
1672 q.out.returned_size = r->out.returned_size;
1673 q.out.info = r->out.info;
1675 return _samr_QueryDisplayInfo(p, &q);
1678 /****************************************************************
1679 _samr_QueryDisplayInfo3
1680 ****************************************************************/
1682 NTSTATUS _samr_QueryDisplayInfo3(pipes_struct *p,
1683 struct samr_QueryDisplayInfo3 *r)
1685 struct samr_QueryDisplayInfo q;
1687 q.in.domain_handle = r->in.domain_handle;
1688 q.in.level = r->in.level;
1689 q.in.start_idx = r->in.start_idx;
1690 q.in.max_entries = r->in.max_entries;
1691 q.in.buf_size = r->in.buf_size;
1693 q.out.total_size = r->out.total_size;
1694 q.out.returned_size = r->out.returned_size;
1695 q.out.info = r->out.info;
1697 return _samr_QueryDisplayInfo(p, &q);
1700 /*******************************************************************
1701 _samr_QueryAliasInfo
1702 ********************************************************************/
1704 NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
1705 struct samr_QueryAliasInfo *r)
1708 struct acct_info info;
1711 union samr_AliasInfo *alias_info = NULL;
1712 const char *alias_name = NULL;
1713 const char *alias_description = NULL;
1715 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1717 alias_info = TALLOC_ZERO_P(p->mem_ctx, union samr_AliasInfo);
1719 return NT_STATUS_NO_MEMORY;
1722 /* find the policy handle. open a policy on it. */
1723 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &sid, &acc_granted, NULL))
1724 return NT_STATUS_INVALID_HANDLE;
1726 status = access_check_samr_function(acc_granted,
1727 SAMR_ALIAS_ACCESS_LOOKUP_INFO,
1728 "_samr_QueryAliasInfo");
1729 if (!NT_STATUS_IS_OK(status)) {
1734 status = pdb_get_aliasinfo(&sid, &info);
1737 if ( !NT_STATUS_IS_OK(status))
1740 /* FIXME: info contains fstrings */
1741 alias_name = talloc_strdup(r, info.acct_name);
1742 alias_description = talloc_strdup(r, info.acct_desc);
1744 switch (r->in.level) {
1746 alias_info->all.name.string = alias_name;
1747 alias_info->all.num_members = 1; /* ??? */
1748 alias_info->all.description.string = alias_description;
1750 case ALIASINFODESCRIPTION:
1751 alias_info->description.string = alias_description;
1754 return NT_STATUS_INVALID_INFO_CLASS;
1757 *r->out.info = alias_info;
1759 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1761 return NT_STATUS_OK;
1764 /*******************************************************************
1766 ********************************************************************/
1768 NTSTATUS _samr_LookupNames(pipes_struct *p,
1769 struct samr_LookupNames *r)
1773 enum lsa_SidType *type;
1775 int num_rids = r->in.num_names;
1778 struct samr_Ids rids, types;
1779 uint32_t num_mapped = 0;
1781 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1783 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL)) {
1784 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1787 status = access_check_samr_function(acc_granted,
1788 0, /* Don't know the acc_bits yet */
1789 "_samr_LookupNames");
1790 if (!NT_STATUS_IS_OK(status)) {
1794 if (num_rids > MAX_SAM_ENTRIES) {
1795 num_rids = MAX_SAM_ENTRIES;
1796 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids));
1799 rid = talloc_array(p->mem_ctx, uint32, num_rids);
1800 NT_STATUS_HAVE_NO_MEMORY(rid);
1802 type = talloc_array(p->mem_ctx, enum lsa_SidType, num_rids);
1803 NT_STATUS_HAVE_NO_MEMORY(type);
1805 DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1806 sid_string_dbg(&pol_sid)));
1808 for (i = 0; i < num_rids; i++) {
1810 status = NT_STATUS_NONE_MAPPED;
1811 type[i] = SID_NAME_UNKNOWN;
1813 rid[i] = 0xffffffff;
1815 if (sid_check_is_builtin(&pol_sid)) {
1816 if (lookup_builtin_name(r->in.names[i].string,
1819 type[i] = SID_NAME_ALIAS;
1822 lookup_global_sam_name(r->in.names[i].string, 0,
1826 if (type[i] != SID_NAME_UNKNOWN) {
1831 if (num_mapped == num_rids) {
1832 status = NT_STATUS_OK;
1833 } else if (num_mapped == 0) {
1834 status = NT_STATUS_NONE_MAPPED;
1836 status = STATUS_SOME_UNMAPPED;
1839 rids.count = num_rids;
1842 types.count = num_rids;
1845 *r->out.rids = rids;
1846 *r->out.types = types;
1848 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1853 /*******************************************************************
1854 _samr_ChangePasswordUser2
1855 ********************************************************************/
1857 NTSTATUS _samr_ChangePasswordUser2(pipes_struct *p,
1858 struct samr_ChangePasswordUser2 *r)
1864 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1866 fstrcpy(user_name, r->in.account->string);
1867 fstrcpy(wks, r->in.server->string);
1869 DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1872 * Pass the user through the NT -> unix user mapping
1876 (void)map_username(user_name);
1879 * UNIX username case mangling not required, pass_oem_change
1880 * is case insensitive.
1883 status = pass_oem_change(user_name,
1884 r->in.lm_password->data,
1885 r->in.lm_verifier->hash,
1886 r->in.nt_password->data,
1887 r->in.nt_verifier->hash,
1890 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1895 /*******************************************************************
1896 _samr_ChangePasswordUser3
1897 ********************************************************************/
1899 NTSTATUS _samr_ChangePasswordUser3(pipes_struct *p,
1900 struct samr_ChangePasswordUser3 *r)
1904 const char *wks = NULL;
1905 uint32 reject_reason;
1906 struct samr_DomInfo1 *dominfo = NULL;
1907 struct samr_ChangeReject *reject = NULL;
1910 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
1912 fstrcpy(user_name, r->in.account->string);
1913 if (r->in.server && r->in.server->string) {
1914 wks = r->in.server->string;
1917 DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name, wks));
1920 * Pass the user through the NT -> unix user mapping
1924 (void)map_username(user_name);
1927 * UNIX username case mangling not required, pass_oem_change
1928 * is case insensitive.
1931 status = pass_oem_change(user_name,
1932 r->in.lm_password->data,
1933 r->in.lm_verifier->hash,
1934 r->in.nt_password->data,
1935 r->in.nt_verifier->hash,
1938 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) ||
1939 NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_RESTRICTION)) {
1941 time_t u_expire, u_min_age;
1942 uint32 account_policy_temp;
1944 dominfo = TALLOC_ZERO_P(p->mem_ctx, struct samr_DomInfo1);
1946 return NT_STATUS_NO_MEMORY;
1949 reject = TALLOC_ZERO_P(p->mem_ctx, struct samr_ChangeReject);
1951 return NT_STATUS_NO_MEMORY;
1958 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &tmp);
1959 dominfo->min_password_length = tmp;
1961 pdb_get_account_policy(AP_PASSWORD_HISTORY, &tmp);
1962 dominfo->password_history_length = tmp;
1964 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
1965 &dominfo->password_properties);
1967 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
1968 u_expire = account_policy_temp;
1970 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
1971 u_min_age = account_policy_temp;
1977 unix_to_nt_time_abs((NTTIME *)&dominfo->max_password_age, u_expire);
1978 unix_to_nt_time_abs((NTTIME *)&dominfo->min_password_age, u_min_age);
1980 if (lp_check_password_script() && *lp_check_password_script()) {
1981 dominfo->password_properties |= DOMAIN_PASSWORD_COMPLEX;
1984 reject->reason = reject_reason;
1986 *r->out.dominfo = dominfo;
1987 *r->out.reject = reject;
1990 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
1995 /*******************************************************************
1996 makes a SAMR_R_LOOKUP_RIDS structure.
1997 ********************************************************************/
1999 static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
2001 struct lsa_String **lsa_name_array_p)
2003 struct lsa_String *lsa_name_array = NULL;
2006 *lsa_name_array_p = NULL;
2008 if (num_names != 0) {
2009 lsa_name_array = TALLOC_ZERO_ARRAY(ctx, struct lsa_String, num_names);
2010 if (!lsa_name_array) {
2015 for (i = 0; i < num_names; i++) {
2016 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
2017 init_lsa_String(&lsa_name_array[i], names[i]);
2020 *lsa_name_array_p = lsa_name_array;
2025 /*******************************************************************
2027 ********************************************************************/
2029 NTSTATUS _samr_LookupRids(pipes_struct *p,
2030 struct samr_LookupRids *r)
2034 enum lsa_SidType *attrs = NULL;
2035 uint32 *wire_attrs = NULL;
2037 int num_rids = (int)r->in.num_rids;
2040 struct lsa_Strings names_array;
2041 struct samr_Ids types_array;
2042 struct lsa_String *lsa_names = NULL;
2044 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2046 /* find the policy handle. open a policy on it. */
2047 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL))
2048 return NT_STATUS_INVALID_HANDLE;
2050 status = access_check_samr_function(acc_granted,
2051 0, /* Don't know the acc_bits yet */
2052 "_samr_LookupRids");
2053 if (!NT_STATUS_IS_OK(status)) {
2057 if (num_rids > 1000) {
2058 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2059 "to samba4 idl this is not possible\n", num_rids));
2060 return NT_STATUS_UNSUCCESSFUL;
2064 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
2065 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, enum lsa_SidType, num_rids);
2066 wire_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
2068 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
2069 return NT_STATUS_NO_MEMORY;
2076 become_root(); /* lookup_sid can require root privs */
2077 status = pdb_lookup_rids(&pol_sid, num_rids, r->in.rids,
2081 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) && (num_rids == 0)) {
2082 status = NT_STATUS_OK;
2085 if (!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
2087 return NT_STATUS_NO_MEMORY;
2090 /* Convert from enum lsa_SidType to uint32 for wire format. */
2091 for (i = 0; i < num_rids; i++) {
2092 wire_attrs[i] = (uint32)attrs[i];
2095 names_array.count = num_rids;
2096 names_array.names = lsa_names;
2098 types_array.count = num_rids;
2099 types_array.ids = wire_attrs;
2101 *r->out.names = names_array;
2102 *r->out.types = types_array;
2104 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2109 /*******************************************************************
2111 ********************************************************************/
2113 NTSTATUS _samr_OpenUser(pipes_struct *p,
2114 struct samr_OpenUser *r)
2116 struct samu *sampass=NULL;
2118 struct samr_info *info = NULL;
2119 SEC_DESC *psd = NULL;
2121 uint32 des_access = r->in.access_mask;
2127 /* find the domain policy handle and get domain SID / access bits in the domain policy. */
2129 if ( !get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL) )
2130 return NT_STATUS_INVALID_HANDLE;
2132 nt_status = access_check_samr_function(acc_granted,
2133 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2136 if ( !NT_STATUS_IS_OK(nt_status) )
2139 if ( !(sampass = samu_new( p->mem_ctx )) ) {
2140 return NT_STATUS_NO_MEMORY;
2143 /* append the user's RID to it */
2145 if (!sid_append_rid(&sid, r->in.rid))
2146 return NT_STATUS_NO_SUCH_USER;
2148 /* check if access can be granted as requested by client. */
2150 map_max_allowed_access(p->server_info->ptok, &des_access);
2152 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2153 se_map_generic(&des_access, &usr_generic_mapping);
2155 se_priv_copy( &se_rights, &se_machine_account );
2156 se_priv_add( &se_rights, &se_add_users );
2158 nt_status = access_check_samr_object(psd, p->server_info->ptok,
2159 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2160 &acc_granted, "_samr_OpenUser");
2162 if ( !NT_STATUS_IS_OK(nt_status) )
2166 ret=pdb_getsampwsid(sampass, &sid);
2169 /* check that the SID exists in our domain. */
2171 return NT_STATUS_NO_SUCH_USER;
2174 TALLOC_FREE(sampass);
2176 /* associate the user's SID and access bits with the new handle. */
2177 if ((info = get_samr_info_by_sid(p->mem_ctx, &sid)) == NULL)
2178 return NT_STATUS_NO_MEMORY;
2179 info->acc_granted = acc_granted;
2181 /* get a (unique) handle. open a policy on it. */
2182 if (!create_policy_hnd(p, r->out.user_handle, info))
2183 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2185 return NT_STATUS_OK;
2188 /*************************************************************************
2189 *************************************************************************/
2191 static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
2193 struct lsa_BinaryString **_r)
2195 struct lsa_BinaryString *r;
2198 return NT_STATUS_INVALID_PARAMETER;
2201 r = TALLOC_ZERO_P(mem_ctx, struct lsa_BinaryString);
2203 return NT_STATUS_NO_MEMORY;
2206 r->array = TALLOC_ZERO_ARRAY(mem_ctx, uint16_t, blob->length/2);
2208 return NT_STATUS_NO_MEMORY;
2210 memcpy(r->array, blob->data, blob->length);
2211 r->size = blob->length;
2212 r->length = blob->length;
2215 return NT_STATUS_NO_MEMORY;
2220 return NT_STATUS_OK;
2223 static NTSTATUS get_user_info_5(TALLOC_CTX *mem_ctx,
2224 struct samr_UserInfo5 *r,
2226 DOM_SID *domain_sid)
2228 const DOM_SID *sid_user, *sid_group;
2229 uint32_t rid, primary_gid;
2231 sid_user = pdb_get_user_sid(pw);
2233 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2234 DEBUG(0, ("get_user_info_5: User %s has SID %s, \nwhich conflicts with "
2235 "the domain sid %s. Failing operation.\n",
2236 pdb_get_username(pw), sid_string_dbg(sid_user),
2237 sid_string_dbg(domain_sid)));
2238 return NT_STATUS_UNSUCCESSFUL;
2242 sid_group = pdb_get_group_sid(pw);
2245 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2246 DEBUG(0, ("get_user_info_5: User %s has Primary Group SID %s, \n"
2247 "which conflicts with the domain sid %s. Failing operation.\n",
2248 pdb_get_username(pw), sid_string_dbg(sid_group),
2249 sid_string_dbg(domain_sid)));
2250 return NT_STATUS_UNSUCCESSFUL;
2253 unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2254 unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2255 unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2256 unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2258 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(pw));
2259 r->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2260 r->home_directory.string= talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2261 r->home_drive.string = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2262 r->logon_script.string = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2263 r->profile_path.string = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2264 r->description.string = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2265 r->workstations.string = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2267 r->logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2269 r->primary_gid = primary_gid;
2270 r->acct_flags = pdb_get_acct_ctrl(pw);
2271 r->bad_password_count = pdb_get_bad_password_count(pw);
2272 r->logon_count = pdb_get_logon_count(pw);
2274 return NT_STATUS_OK;
2277 /*************************************************************************
2278 get_user_info_7. Safe. Only gives out account_name.
2279 *************************************************************************/
2281 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
2282 struct samr_UserInfo7 *r,
2283 struct samu *smbpass)
2285 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
2286 if (!r->account_name.string) {
2287 return NT_STATUS_NO_MEMORY;
2290 return NT_STATUS_OK;
2293 /*************************************************************************
2294 get_user_info_9. Only gives out primary group SID.
2295 *************************************************************************/
2297 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
2298 struct samr_UserInfo9 *r,
2299 struct samu *smbpass)
2301 r->primary_gid = pdb_get_group_rid(smbpass);
2303 return NT_STATUS_OK;
2306 /*************************************************************************
2307 get_user_info_16. Safe. Only gives out acb bits.
2308 *************************************************************************/
2310 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
2311 struct samr_UserInfo16 *r,
2312 struct samu *smbpass)
2314 r->acct_flags = pdb_get_acct_ctrl(smbpass);
2316 return NT_STATUS_OK;
2319 /*************************************************************************
2320 get_user_info_18. OK - this is the killer as it gives out password info.
2321 Ensure that this is only allowed on an encrypted connection with a root
2323 *************************************************************************/
2325 static NTSTATUS get_user_info_18(pipes_struct *p,
2326 TALLOC_CTX *mem_ctx,
2327 struct samr_UserInfo18 *r,
2330 struct samu *smbpass=NULL;
2335 if (p->auth.auth_type != PIPE_AUTH_TYPE_NTLMSSP || p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
2336 return NT_STATUS_ACCESS_DENIED;
2339 if (p->auth.auth_level != PIPE_AUTH_LEVEL_PRIVACY) {
2340 return NT_STATUS_ACCESS_DENIED;
2344 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2347 if ( !(smbpass = samu_new( mem_ctx )) ) {
2348 return NT_STATUS_NO_MEMORY;
2351 ret = pdb_getsampwsid(smbpass, user_sid);
2354 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
2355 TALLOC_FREE(smbpass);
2356 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
2359 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
2361 if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
2362 TALLOC_FREE(smbpass);
2363 return NT_STATUS_ACCOUNT_DISABLED;
2366 r->lm_pwd_active = true;
2367 r->nt_pwd_active = true;
2368 memcpy(r->lm_pwd.hash, pdb_get_lanman_passwd(smbpass), 16);
2369 memcpy(r->nt_pwd.hash, pdb_get_nt_passwd(smbpass), 16);
2370 r->password_expired = 0; /* FIXME */
2372 TALLOC_FREE(smbpass);
2374 return NT_STATUS_OK;
2377 /*************************************************************************
2379 *************************************************************************/
2381 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
2382 struct samr_UserInfo20 *r,
2383 struct samu *sampass)
2385 const char *munged_dial = NULL;
2388 struct lsa_BinaryString *parameters = NULL;
2392 munged_dial = pdb_get_munged_dial(sampass);
2394 DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
2395 munged_dial, (int)strlen(munged_dial)));
2398 blob = base64_decode_data_blob(munged_dial);
2400 blob = data_blob_string_const_null("");
2403 status = init_samr_parameters_string(mem_ctx, &blob, ¶meters);
2404 data_blob_free(&blob);
2405 if (!NT_STATUS_IS_OK(status)) {
2409 r->parameters = *parameters;
2411 return NT_STATUS_OK;
2415 /*************************************************************************
2417 *************************************************************************/
2419 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
2420 struct samr_UserInfo21 *r,
2422 DOM_SID *domain_sid)
2425 const DOM_SID *sid_user, *sid_group;
2426 uint32_t rid, primary_gid;
2427 NTTIME force_password_change;
2428 time_t must_change_time;
2429 struct lsa_BinaryString *parameters = NULL;
2430 const char *munged_dial = NULL;
2435 sid_user = pdb_get_user_sid(pw);
2437 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2438 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2439 "the domain sid %s. Failing operation.\n",
2440 pdb_get_username(pw), sid_string_dbg(sid_user),
2441 sid_string_dbg(domain_sid)));
2442 return NT_STATUS_UNSUCCESSFUL;
2446 sid_group = pdb_get_group_sid(pw);
2449 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2450 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2451 "which conflicts with the domain sid %s. Failing operation.\n",
2452 pdb_get_username(pw), sid_string_dbg(sid_group),
2453 sid_string_dbg(domain_sid)));
2454 return NT_STATUS_UNSUCCESSFUL;
2457 unix_to_nt_time(&r->last_logon, pdb_get_logon_time(pw));
2458 unix_to_nt_time(&r->last_logoff, pdb_get_logoff_time(pw));
2459 unix_to_nt_time(&r->acct_expiry, pdb_get_kickoff_time(pw));
2460 unix_to_nt_time(&r->last_password_change, pdb_get_pass_last_set_time(pw));
2461 unix_to_nt_time(&r->allow_password_change, pdb_get_pass_can_change_time(pw));
2463 must_change_time = pdb_get_pass_must_change_time(pw);
2464 if (must_change_time == get_time_t_max()) {
2465 unix_to_nt_time_abs(&force_password_change, must_change_time);
2467 unix_to_nt_time(&force_password_change, must_change_time);
2470 munged_dial = pdb_get_munged_dial(pw);
2472 blob = base64_decode_data_blob(munged_dial);
2474 blob = data_blob_string_const_null("");
2477 status = init_samr_parameters_string(mem_ctx, &blob, ¶meters);
2478 data_blob_free(&blob);
2479 if (!NT_STATUS_IS_OK(status)) {
2483 r->force_password_change = force_password_change;
2485 r->account_name.string = talloc_strdup(mem_ctx, pdb_get_username(pw));
2486 r->full_name.string = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2487 r->home_directory.string = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2488 r->home_drive.string = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2489 r->logon_script.string = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2490 r->profile_path.string = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2491 r->description.string = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2492 r->workstations.string = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2493 r->comment.string = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2495 r->logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2496 r->parameters = *parameters;
2498 r->primary_gid = primary_gid;
2499 r->acct_flags = pdb_get_acct_ctrl(pw);
2500 r->bad_password_count = pdb_get_bad_password_count(pw);
2501 r->logon_count = pdb_get_logon_count(pw);
2502 r->fields_present = pdb_build_fields_present(pw);
2503 r->password_expired = (pdb_get_pass_must_change_time(pw) == 0) ?
2504 PASS_MUST_CHANGE_AT_NEXT_LOGON : 0;
2505 r->country_code = 0;
2507 r->lm_password_set = 0;
2508 r->nt_password_set = 0;
2513 Look at a user on a real NT4 PDC with usrmgr, press
2514 'ok'. Then you will see that fields_present is set to
2515 0x08f827fa. Look at the user immediately after that again,
2516 and you will see that 0x00fffff is returned. This solves
2517 the problem that you get access denied after having looked
2525 return NT_STATUS_OK;
2528 /*******************************************************************
2530 ********************************************************************/
2532 NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
2533 struct samr_QueryUserInfo *r)
2536 union samr_UserInfo *user_info = NULL;
2537 struct samr_info *info = NULL;
2541 struct samu *pwd = NULL;
2543 /* search for the handle */
2544 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info))
2545 return NT_STATUS_INVALID_HANDLE;
2547 status = access_check_samr_function(info->acc_granted,
2548 SAMR_USER_ACCESS_GET_ATTRIBUTES,
2549 "_samr_QueryUserInfo");
2550 if (!NT_STATUS_IS_OK(status)) {
2554 domain_sid = info->sid;
2556 sid_split_rid(&domain_sid, &rid);
2558 if (!sid_check_is_in_our_domain(&info->sid))
2559 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2561 DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
2562 sid_string_dbg(&info->sid)));
2564 user_info = TALLOC_ZERO_P(p->mem_ctx, union samr_UserInfo);
2566 return NT_STATUS_NO_MEMORY;
2569 DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
2571 if (!(pwd = samu_new(p->mem_ctx))) {
2572 return NT_STATUS_NO_MEMORY;
2576 ret = pdb_getsampwsid(pwd, &info->sid);
2580 DEBUG(4,("User %s not found\n", sid_string_dbg(&info->sid)));
2582 return NT_STATUS_NO_SUCH_USER;
2585 DEBUG(3,("User:[%s]\n", pdb_get_username(pwd)));
2587 samr_clear_sam_passwd(pwd);
2589 switch (r->in.level) {
2591 status = get_user_info_5(p->mem_ctx, &user_info->info5, pwd, &domain_sid);
2594 status = get_user_info_7(p->mem_ctx, &user_info->info7, pwd);
2597 status = get_user_info_9(p->mem_ctx, &user_info->info9, pwd);
2600 status = get_user_info_16(p->mem_ctx, &user_info->info16, pwd);
2603 /* level 18 is special */
2604 status = get_user_info_18(p, p->mem_ctx, &user_info->info18, &info->sid);
2607 status = get_user_info_20(p->mem_ctx, &user_info->info20, pwd);
2610 status = get_user_info_21(p->mem_ctx, &user_info->info21, pwd, &domain_sid);
2613 status = NT_STATUS_INVALID_INFO_CLASS;
2619 *r->out.info = user_info;
2621 DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
2626 /****************************************************************
2627 ****************************************************************/
2629 NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
2630 struct samr_QueryUserInfo2 *r)
2632 struct samr_QueryUserInfo u;
2634 u.in.user_handle = r->in.user_handle;
2635 u.in.level = r->in.level;
2636 u.out.info = r->out.info;
2638 return _samr_QueryUserInfo(p, &u);
2641 /*******************************************************************
2642 _samr_GetGroupsForUser
2643 ********************************************************************/
2645 NTSTATUS _samr_GetGroupsForUser(pipes_struct *p,
2646 struct samr_GetGroupsForUser *r)
2648 struct samu *sam_pass=NULL;
2651 struct samr_RidWithAttribute dom_gid;
2652 struct samr_RidWithAttribute *gids = NULL;
2653 uint32 primary_group_rid;
2654 size_t num_groups = 0;
2660 bool success = False;
2662 struct samr_RidWithAttributeArray *rids = NULL;
2665 * from the SID in the request:
2666 * we should send back the list of DOMAIN GROUPS
2667 * the user is a member of
2669 * and only the DOMAIN GROUPS
2670 * no ALIASES !!! neither aliases of the domain
2671 * nor aliases of the builtin SID
2676 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2678 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidWithAttributeArray);
2680 return NT_STATUS_NO_MEMORY;
2683 /* find the policy handle. open a policy on it. */
2684 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &sid, &acc_granted, NULL))
2685 return NT_STATUS_INVALID_HANDLE;
2687 result = access_check_samr_function(acc_granted,
2688 SAMR_USER_ACCESS_GET_GROUPS,
2689 "_samr_GetGroupsForUser");
2690 if (!NT_STATUS_IS_OK(result)) {
2694 if (!sid_check_is_in_our_domain(&sid))
2695 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2697 if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
2698 return NT_STATUS_NO_MEMORY;
2702 ret = pdb_getsampwsid(sam_pass, &sid);
2706 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
2707 sid_string_dbg(&sid)));
2708 return NT_STATUS_NO_SUCH_USER;
2713 /* make both calls inside the root block */
2715 result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
2716 &sids, &unix_gids, &num_groups);
2717 if ( NT_STATUS_IS_OK(result) ) {
2718 success = sid_peek_check_rid(get_global_sam_sid(),
2719 pdb_get_group_sid(sam_pass),
2720 &primary_group_rid);
2724 if (!NT_STATUS_IS_OK(result)) {
2725 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2726 sid_string_dbg(&sid)));
2731 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
2732 sid_string_dbg(pdb_get_group_sid(sam_pass)),
2733 pdb_get_username(sam_pass)));
2734 TALLOC_FREE(sam_pass);
2735 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2741 dom_gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
2743 dom_gid.rid = primary_group_rid;
2744 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2746 for (i=0; i<num_groups; i++) {
2748 if (!sid_peek_check_rid(get_global_sam_sid(),
2749 &(sids[i]), &dom_gid.rid)) {
2750 DEBUG(10, ("Found sid %s not in our domain\n",
2751 sid_string_dbg(&sids[i])));
2755 if (dom_gid.rid == primary_group_rid) {
2756 /* We added the primary group directly from the
2757 * sam_account. The other SIDs are unique from
2758 * enum_group_memberships */
2762 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2765 rids->count = num_gids;
2768 *r->out.rids = rids;
2770 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2775 /*******************************************************************
2776 _samr_QueryDomainInfo
2777 ********************************************************************/
2779 NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
2780 struct samr_QueryDomainInfo *r)
2782 NTSTATUS status = NT_STATUS_OK;
2783 struct samr_info *info = NULL;
2784 union samr_DomainInfo *dom_info;
2785 time_t u_expire, u_min_age;
2787 time_t u_lock_duration, u_reset_time;
2790 uint32 account_policy_temp;
2795 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
2797 dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
2799 return NT_STATUS_NO_MEMORY;
2802 /* find the policy handle. open a policy on it. */
2803 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
2804 return NT_STATUS_INVALID_HANDLE;
2807 status = access_check_samr_function(info->acc_granted,
2808 SAMR_ACCESS_LOOKUP_DOMAIN,
2809 "_samr_QueryDomainInfo" );
2811 if ( !NT_STATUS_IS_OK(status) )
2814 switch (r->in.level) {
2821 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
2822 &account_policy_temp);
2823 dom_info->info1.min_password_length = account_policy_temp;
2825 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
2826 dom_info->info1.password_history_length = account_policy_temp;
2828 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
2829 &dom_info->info1.password_properties);
2831 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2832 u_expire = account_policy_temp;
2834 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2835 u_min_age = account_policy_temp;
2841 unix_to_nt_time_abs((NTTIME *)&dom_info->info1.max_password_age, u_expire);
2842 unix_to_nt_time_abs((NTTIME *)&dom_info->info1.min_password_age, u_min_age);
2844 if (lp_check_password_script() && *lp_check_password_script()) {
2845 dom_info->info1.password_properties |= DOMAIN_PASSWORD_COMPLEX;
2855 dom_info->general.num_users = count_sam_users(info->disp_info, ACB_NORMAL);
2856 dom_info->general.num_groups = count_sam_groups(info->disp_info);
2857 dom_info->general.num_aliases = count_sam_aliases(info->disp_info);
2859 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &u_logout);
2861 unix_to_nt_time_abs(&dom_info->general.force_logoff_time, u_logout);
2863 if (!pdb_get_seq_num(&seq_num))
2864 seq_num = time(NULL);
2870 server_role = ROLE_DOMAIN_PDC;
2871 if (lp_server_role() == ROLE_DOMAIN_BDC)
2872 server_role = ROLE_DOMAIN_BDC;
2874 dom_info->general.oem_information.string = lp_serverstring();
2875 dom_info->general.domain_name.string = lp_workgroup();
2876 dom_info->general.primary.string = global_myname();
2877 dom_info->general.sequence_num = seq_num;
2878 dom_info->general.domain_server_state = DOMAIN_SERVER_ENABLED;
2879 dom_info->general.role = server_role;
2880 dom_info->general.unknown3 = 1;
2891 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &ul);
2892 u_logout = (time_t)ul;
2899 unix_to_nt_time_abs(&dom_info->info3.force_logoff_time, u_logout);
2903 dom_info->oem.oem_information.string = lp_serverstring();
2906 dom_info->info5.domain_name.string = get_global_sam_name();
2909 /* NT returns its own name when a PDC. win2k and later
2910 * only the name of the PDC if itself is a BDC (samba4
2912 dom_info->info6.primary.string = global_myname();
2915 server_role = ROLE_DOMAIN_PDC;
2916 if (lp_server_role() == ROLE_DOMAIN_BDC)
2917 server_role = ROLE_DOMAIN_BDC;
2919 dom_info->info7.role = server_role;
2927 if (!pdb_get_seq_num(&seq_num)) {
2928 seq_num = time(NULL);
2935 dom_info->info8.sequence_num = seq_num;
2936 dom_info->info8.domain_create_time = 0;
2945 pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
2946 u_lock_duration = account_policy_temp;
2947 if (u_lock_duration != -1) {
2948 u_lock_duration *= 60;
2951 pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
2952 u_reset_time = account_policy_temp * 60;
2954 pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT,
2955 &account_policy_temp);
2956 dom_info->info12.lockout_threshold = account_policy_temp;
2962 unix_to_nt_time_abs(&dom_info->info12.lockout_duration,
2964 unix_to_nt_time_abs(&dom_info->info12.lockout_window,
2969 return NT_STATUS_INVALID_INFO_CLASS;
2972 *r->out.info = dom_info;
2974 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
2979 /* W2k3 seems to use the same check for all 3 objects that can be created via
2980 * SAMR, if you try to create for example "Dialup" as an alias it says
2981 * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
2984 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
2986 enum lsa_SidType type;
2989 DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
2992 /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
2993 * whether the name already exists */
2994 result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
2995 NULL, NULL, NULL, &type);
2999 DEBUG(10, ("%s does not exist, can create it\n", new_name));
3000 return NT_STATUS_OK;
3003 DEBUG(5, ("trying to create %s, exists as %s\n",
3004 new_name, sid_type_lookup(type)));
3006 if (type == SID_NAME_DOM_GRP) {
3007 return NT_STATUS_GROUP_EXISTS;
3009 if (type == SID_NAME_ALIAS) {
3010 return NT_STATUS_ALIAS_EXISTS;
3013 /* Yes, the default is NT_STATUS_USER_EXISTS */
3014 return NT_STATUS_USER_EXISTS;
3017 /*******************************************************************
3019 ********************************************************************/
3021 NTSTATUS _samr_CreateUser2(pipes_struct *p,
3022 struct samr_CreateUser2 *r)
3024 const char *account = NULL;
3026 uint32_t acb_info = r->in.acct_flags;
3027 struct samr_info *info = NULL;
3032 /* check this, when giving away 'add computer to domain' privs */
3033 uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
3034 bool can_add_account = False;
3037 /* Get the domain SID stored in the domain policy */
3038 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid,
3039 &acc_granted, NULL))
3040 return NT_STATUS_INVALID_HANDLE;
3042 if (sid_check_is_builtin(&sid)) {
3043 DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
3044 return NT_STATUS_ACCESS_DENIED;
3047 nt_status = access_check_samr_function(acc_granted,
3048 SAMR_DOMAIN_ACCESS_CREATE_USER,
3049 "_samr_CreateUser2");
3050 if (!NT_STATUS_IS_OK(nt_status)) {
3054 if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
3055 acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
3056 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3057 this parameter is not an account type */
3058 return NT_STATUS_INVALID_PARAMETER;
3061 account = r->in.account_name->string;
3062 if (account == NULL) {
3063 return NT_STATUS_NO_MEMORY;
3066 nt_status = can_create(p->mem_ctx, account);
3067 if (!NT_STATUS_IS_OK(nt_status)) {
3071 /* determine which user right we need to check based on the acb_info */
3073 if ( acb_info & ACB_WSTRUST )
3075 se_priv_copy( &se_rights, &se_machine_account );
3076 can_add_account = user_has_privileges(
3077 p->server_info->ptok, &se_rights );
3079 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3080 account for domain trusts and changes the ACB flags later */
3081 else if ( acb_info & ACB_NORMAL &&
3082 (account[strlen(account)-1] != '$') )
3084 se_priv_copy( &se_rights, &se_add_users );
3085 can_add_account = user_has_privileges(
3086 p->server_info->ptok, &se_rights );
3088 else /* implicit assumption of a BDC or domain trust account here
3089 * (we already check the flags earlier) */
3091 if ( lp_enable_privileges() ) {
3092 /* only Domain Admins can add a BDC or domain trust */
3093 se_priv_copy( &se_rights, &se_priv_none );
3094 can_add_account = nt_token_check_domain_rid(
3095 p->server_info->ptok,
3096 DOMAIN_GROUP_RID_ADMINS );
3100 DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3101 uidtoname(p->server_info->utok.uid),
3102 can_add_account ? "True":"False" ));
3104 /********** BEGIN Admin BLOCK **********/
3106 if ( can_add_account )
3109 nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
3112 if ( can_add_account )
3115 /********** END Admin BLOCK **********/
3117 /* now check for failure */
3119 if ( !NT_STATUS_IS_OK(nt_status) )
3122 /* Get the user's SID */
3124 sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
3126 map_max_allowed_access(p->server_info->ptok, &des_access);
3128 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
3129 &sid, SAMR_USR_RIGHTS_WRITE_PW);
3130 se_map_generic(&des_access, &usr_generic_mapping);
3132 nt_status = access_check_samr_object(psd, p->server_info->ptok,
3133 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
3134 &acc_granted, "_samr_CreateUser2");
3136 if ( !NT_STATUS_IS_OK(nt_status) ) {
3140 /* associate the user's SID with the new handle. */
3141 if ((info = get_samr_info_by_sid(p->mem_ctx, &sid)) == NULL) {
3142 return NT_STATUS_NO_MEMORY;
3147 info->acc_granted = acc_granted;
3149 /* get a (unique) handle. open a policy on it. */
3150 if (!create_policy_hnd(p, r->out.user_handle, info)) {
3151 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3154 /* After a "set" ensure we have no cached display info. */
3155 force_flush_samr_cache(info->disp_info);
3157 *r->out.access_granted = acc_granted;
3159 return NT_STATUS_OK;
3162 /****************************************************************
3163 ****************************************************************/
3165 NTSTATUS _samr_CreateUser(pipes_struct *p,
3166 struct samr_CreateUser *r)
3168 struct samr_CreateUser2 c;
3169 uint32_t access_granted;
3171 c.in.domain_handle = r->in.domain_handle;
3172 c.in.account_name = r->in.account_name;
3173 c.in.acct_flags = ACB_NORMAL;
3174 c.in.access_mask = r->in.access_mask;
3175 c.out.user_handle = r->out.user_handle;
3176 c.out.access_granted = &access_granted;
3177 c.out.rid = r->out.rid;
3179 return _samr_CreateUser2(p, &c);
3182 /*******************************************************************
3184 ********************************************************************/
3186 NTSTATUS _samr_Connect(pipes_struct *p,
3187 struct samr_Connect *r)
3189 struct samr_connect_info *info;
3190 uint32_t acc_granted;
3191 struct policy_handle hnd;
3192 uint32 des_access = r->in.access_mask;
3197 if (!pipe_access_check(p)) {
3198 DEBUG(3, ("access denied to _samr_Connect\n"));
3199 return NT_STATUS_ACCESS_DENIED;
3202 /* don't give away the farm but this is probably ok. The SAMR_ACCESS_ENUM_DOMAINS
3203 was observed from a win98 client trying to enumerate users (when configured
3204 user level access control on shares) --jerry */
3206 map_max_allowed_access(p->server_info->ptok, &des_access);
3208 se_map_generic( &des_access, &sam_generic_mapping );
3210 acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS
3211 |SAMR_ACCESS_LOOKUP_DOMAIN);
3213 /* set up the SAMR connect_anon response */
3215 info = policy_handle_create(p, &hnd, acc_granted,
3216 struct samr_connect_info,
3218 if (!NT_STATUS_IS_OK(status)) {
3222 *r->out.connect_handle = hnd;
3223 return NT_STATUS_OK;
3226 /*******************************************************************
3228 ********************************************************************/
3230 NTSTATUS _samr_Connect2(pipes_struct *p,
3231 struct samr_Connect2 *r)
3233 struct samr_connect_info *info = NULL;
3234 struct policy_handle hnd;
3235 SEC_DESC *psd = NULL;
3237 uint32 des_access = r->in.access_mask;
3240 const char *fn = "_samr_Connect2";
3242 switch (p->hdr_req.opnum) {
3243 case NDR_SAMR_CONNECT2:
3244 fn = "_samr_Connect2";
3246 case NDR_SAMR_CONNECT3:
3247 fn = "_samr_Connect3";
3249 case NDR_SAMR_CONNECT4:
3250 fn = "_samr_Connect4";
3252 case NDR_SAMR_CONNECT5:
3253 fn = "_samr_Connect5";
3257 DEBUG(5,("%s: %d\n", fn, __LINE__));
3261 if (!pipe_access_check(p)) {
3262 DEBUG(3, ("access denied to %s\n", fn));
3263 return NT_STATUS_ACCESS_DENIED;
3266 map_max_allowed_access(p->server_info->ptok, &des_access);
3268 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3269 se_map_generic(&des_access, &sam_generic_mapping);
3271 nt_status = access_check_samr_object(psd, p->server_info->ptok,
3272 NULL, 0, des_access, &acc_granted, fn);
3274 if ( !NT_STATUS_IS_OK(nt_status) )
3277 info = policy_handle_create(p, &hnd, acc_granted,
3278 struct samr_connect_info, &nt_status);
3279 if (!NT_STATUS_IS_OK(nt_status)) {
3283 DEBUG(5,("%s: %d\n", fn, __LINE__));
3285 *r->out.connect_handle = hnd;
3286 return NT_STATUS_OK;
3289 /****************************************************************
3291 ****************************************************************/
3293 NTSTATUS _samr_Connect3(pipes_struct *p,
3294 struct samr_Connect3 *r)
3296 struct samr_Connect2 c;
3298 c.in.system_name = r->in.system_name;
3299 c.in.access_mask = r->in.access_mask;
3300 c.out.connect_handle = r->out.connect_handle;
3302 return _samr_Connect2(p, &c);
3305 /*******************************************************************
3307 ********************************************************************/
3309 NTSTATUS _samr_Connect4(pipes_struct *p,
3310 struct samr_Connect4 *r)
3312 struct samr_Connect2 c;
3314 c.in.system_name = r->in.system_name;
3315 c.in.access_mask = r->in.access_mask;
3316 c.out.connect_handle = r->out.connect_handle;
3318 return _samr_Connect2(p, &c);
3321 /*******************************************************************
3323 ********************************************************************/
3325 NTSTATUS _samr_Connect5(pipes_struct *p,
3326 struct samr_Connect5 *r)
3329 struct samr_Connect2 c;
3330 struct samr_ConnectInfo1 info1;
3332 info1.client_version = SAMR_CONNECT_AFTER_W2K;
3335 c.in.system_name = r->in.system_name;
3336 c.in.access_mask = r->in.access_mask;
3337 c.out.connect_handle = r->out.connect_handle;
3339 status = _samr_Connect2(p, &c);
3340 if (!NT_STATUS_IS_OK(status)) {
3344 *r->out.level_out = 1;
3345 r->out.info_out->info1 = info1;
3347 return NT_STATUS_OK;
3350 /**********************************************************************
3352 **********************************************************************/
3354 NTSTATUS _samr_LookupDomain(pipes_struct *p,
3355 struct samr_LookupDomain *r)
3358 struct samr_connect_info *info;
3359 const char *domain_name;
3360 DOM_SID *sid = NULL;
3362 /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
3363 Reverted that change so we will work with RAS servers again */
3365 info = policy_handle_find(p, r->in.connect_handle,
3366 SAMR_ACCESS_LOOKUP_DOMAIN, NULL,
3367 struct samr_connect_info,
3369 if (!NT_STATUS_IS_OK(status)) {
3373 domain_name = r->in.domain_name->string;
3375 return NT_STATUS_INVALID_PARAMETER;
3378 sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
3380 return NT_STATUS_NO_MEMORY;
3383 if (strequal(domain_name, builtin_domain_name())) {
3384 sid_copy(sid, &global_sid_Builtin);
3386 if (!secrets_fetch_domain_sid(domain_name, sid)) {
3387 status = NT_STATUS_NO_SUCH_DOMAIN;
3391 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
3392 sid_string_dbg(sid)));
3399 /**********************************************************************
3401 **********************************************************************/
3403 NTSTATUS _samr_EnumDomains(pipes_struct *p,
3404 struct samr_EnumDomains *r)
3407 struct samr_connect_info *info;
3408 uint32_t num_entries = 2;
3409 struct samr_SamEntry *entry_array = NULL;
3410 struct samr_SamArray *sam;
3412 info = policy_handle_find(p, r->in.connect_handle,
3413 SAMR_ACCESS_ENUM_DOMAINS, NULL,
3414 struct samr_connect_info, &status);
3415 if (!NT_STATUS_IS_OK(status)) {
3419 sam = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
3421 return NT_STATUS_NO_MEMORY;
3424 entry_array = TALLOC_ZERO_ARRAY(p->mem_ctx,
3425 struct samr_SamEntry,
3428 return NT_STATUS_NO_MEMORY;
3431 entry_array[0].idx = 0;
3432 init_lsa_String(&entry_array[0].name, get_global_sam_name());
3434 entry_array[1].idx = 1;
3435 init_lsa_String(&entry_array[1].name, "Builtin");
3437 sam->count = num_entries;
3438 sam->entries = entry_array;
3441 *r->out.num_entries = num_entries;
3446 /*******************************************************************
3448 ********************************************************************/
3450 NTSTATUS _samr_OpenAlias(pipes_struct *p,
3451 struct samr_OpenAlias *r)
3454 uint32 alias_rid = r->in.rid;
3455 struct samr_info *info = NULL;
3456 SEC_DESC *psd = NULL;
3458 uint32 des_access = r->in.access_mask;
3463 /* find the domain policy and get the SID / access bits stored in the domain policy */
3465 if ( !get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL) )
3466 return NT_STATUS_INVALID_HANDLE;
3468 status = access_check_samr_function(acc_granted,
3469 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
3472 if ( !NT_STATUS_IS_OK(status) )
3475 /* append the alias' RID to it */
3477 if (!sid_append_rid(&sid, alias_rid))
3478 return NT_STATUS_NO_SUCH_ALIAS;
3480 /*check if access can be granted as requested by client. */
3482 map_max_allowed_access(p->server_info->ptok, &des_access);
3484 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
3485 se_map_generic(&des_access,&ali_generic_mapping);
3487 se_priv_copy( &se_rights, &se_add_users );
3490 status = access_check_samr_object(psd, p->server_info->ptok,
3491 &se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
3492 &acc_granted, "_samr_OpenAlias");
3494 if ( !NT_STATUS_IS_OK(status) )
3498 /* Check we actually have the requested alias */
3499 enum lsa_SidType type;
3504 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
3507 if (!result || (type != SID_NAME_ALIAS)) {
3508 return NT_STATUS_NO_SUCH_ALIAS;
3511 /* make sure there is a mapping */
3513 if ( !sid_to_gid( &sid, &gid ) ) {
3514 return NT_STATUS_NO_SUCH_ALIAS;
3519 /* associate the alias SID with the new handle. */
3520 if ((info = get_samr_info_by_sid(p->mem_ctx, &sid)) == NULL)
3521 return NT_STATUS_NO_MEMORY;
3523 info->acc_granted = acc_granted;
3525 /* get a (unique) handle. open a policy on it. */
3526 if (!create_policy_hnd(p, r->out.alias_handle, info))
3527 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3529 return NT_STATUS_OK;
3532 /*******************************************************************
3534 ********************************************************************/
3536 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
3537 struct samr_UserInfo7 *id7,
3543 DEBUG(5, ("set_user_info_7: NULL id7\n"));
3544 return NT_STATUS_ACCESS_DENIED;
3547 if (!id7->account_name.string) {
3548 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
3549 return NT_STATUS_ACCESS_DENIED;
3552 /* check to see if the new username already exists. Note: we can't
3553 reliably lock all backends, so there is potentially the
3554 possibility that a user can be created in between this check and
3555 the rename. The rename should fail, but may not get the
3556 exact same failure status code. I think this is small enough
3557 of a window for this type of operation and the results are
3558 simply that the rename fails with a slightly different status
3559 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3561 rc = can_create(mem_ctx, id7->account_name.string);
3562 if (!NT_STATUS_IS_OK(rc)) {
3566 rc = pdb_rename_sam_account(pwd, id7->account_name.string);
3571 /*******************************************************************
3573 ********************************************************************/
3575 static bool set_user_info_16(struct samr_UserInfo16 *id16,
3579 DEBUG(5, ("set_user_info_16: NULL id16\n"));
3583 /* FIX ME: check if the value is really changed --metze */
3584 if (!pdb_set_acct_ctrl(pwd, id16->acct_flags, PDB_CHANGED)) {
3588 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3595 /*******************************************************************
3597 ********************************************************************/
3599 static NTSTATUS set_user_info_18(struct samr_UserInfo18 *id18,
3600 TALLOC_CTX *mem_ctx,
3601 DATA_BLOB *session_key,
3605 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
3606 return NT_STATUS_INVALID_PARAMETER;
3609 if (id18->nt_pwd_active || id18->lm_pwd_active) {
3610 if (!session_key->length) {
3611 return NT_STATUS_NO_USER_SESSION_KEY;
3615 if (id18->nt_pwd_active) {
3619 in = data_blob_const(id18->nt_pwd.hash, 16);
3620 out = data_blob_talloc_zero(mem_ctx, 16);
3622 sess_crypt_blob(&out, &in, session_key, false);
3624 if (!pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED)) {
3625 return NT_STATUS_ACCESS_DENIED;
3628 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
3631 if (id18->lm_pwd_active) {
3635 in = data_blob_const(id18->lm_pwd.hash, 16);
3636 out = data_blob_talloc_zero(mem_ctx, 16);
3638 sess_crypt_blob(&out, &in, session_key, false);
3640 if (!pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED)) {
3641 return NT_STATUS_ACCESS_DENIED;
3644 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
3647 copy_id18_to_sam_passwd(pwd, id18);
3649 return pdb_update_sam_account(pwd);
3652 /*******************************************************************
3654 ********************************************************************/
3656 static bool set_user_info_20(struct samr_UserInfo20 *id20,
3660 DEBUG(5, ("set_user_info_20: NULL id20\n"));
3664 copy_id20_to_sam_passwd(pwd, id20);
3666 /* write the change out */
3667 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3674 /*******************************************************************
3676 ********************************************************************/
3678 static NTSTATUS set_user_info_21(struct samr_UserInfo21 *id21,
3679 TALLOC_CTX *mem_ctx,
3680 DATA_BLOB *session_key,
3686 DEBUG(5, ("set_user_info_21: NULL id21\n"));
3687 return NT_STATUS_INVALID_PARAMETER;
3690 if (id21->fields_present == 0) {
3691 return NT_STATUS_INVALID_PARAMETER;
3694 if (id21->fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
3695 return NT_STATUS_ACCESS_DENIED;
3698 if (id21->fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) {
3699 if (id21->nt_password_set) {
3702 if ((id21->nt_owf_password.length != 16) ||
3703 (id21->nt_owf_password.size != 16)) {
3704 return NT_STATUS_INVALID_PARAMETER;
3707 if (!session_key->length) {
3708 return NT_STATUS_NO_USER_SESSION_KEY;
3711 in = data_blob_const(id21->nt_owf_password.array, 16);
3712 out = data_blob_talloc_zero(mem_ctx, 16);
3714 sess_crypt_blob(&out, &in, session_key, false);
3716 pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED);
3717 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
3721 if (id21->fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT) {
3722 if (id21->lm_password_set) {
3725 if ((id21->lm_owf_password.length != 16) ||
3726 (id21->lm_owf_password.size != 16)) {
3727 return NT_STATUS_INVALID_PARAMETER;
3730 if (!session_key->length) {
3731 return NT_STATUS_NO_USER_SESSION_KEY;
3734 in = data_blob_const(id21->lm_owf_password.array, 16);
3735 out = data_blob_talloc_zero(mem_ctx, 16);
3737 sess_crypt_blob(&out, &in, session_key, false);
3739 pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED);
3740 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
3744 /* we need to separately check for an account rename first */
3746 if (id21->account_name.string &&
3747 (!strequal(id21->account_name.string, pdb_get_username(pwd))))
3750 /* check to see if the new username already exists. Note: we can't
3751 reliably lock all backends, so there is potentially the
3752 possibility that a user can be created in between this check and
3753 the rename. The rename should fail, but may not get the
3754 exact same failure status code. I think this is small enough
3755 of a window for this type of operation and the results are
3756 simply that the rename fails with a slightly different status
3757 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3759 status = can_create(mem_ctx, id21->account_name.string);
3760 if (!NT_STATUS_IS_OK(status)) {
3764 status = pdb_rename_sam_account(pwd, id21->account_name.string);
3766 if (!NT_STATUS_IS_OK(status)) {
3767 DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
3768 nt_errstr(status)));
3772 /* set the new username so that later
3773 functions can work on the new account */
3774 pdb_set_username(pwd, id21->account_name.string, PDB_SET);
3777 copy_id21_to_sam_passwd("INFO_21", pwd, id21);
3780 * The funny part about the previous two calls is
3781 * that pwd still has the password hashes from the
3782 * passdb entry. These have not been updated from
3783 * id21. I don't know if they need to be set. --jerry
3786 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
3787 status = pdb_set_unix_primary_group(mem_ctx, pwd);
3788 if ( !NT_STATUS_IS_OK(status) ) {
3793 /* Don't worry about writing out the user account since the
3794 primary group SID is generated solely from the user's Unix
3797 /* write the change out */
3798 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3802 return NT_STATUS_OK;
3805 /*******************************************************************
3807 ********************************************************************/
3809 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
3810 struct samr_UserInfo23 *id23,
3813 char *plaintext_buf = NULL;
3819 DEBUG(5, ("set_user_info_23: NULL id23\n"));
3820 return NT_STATUS_INVALID_PARAMETER;
3823 if (id23->info.fields_present == 0) {
3824 return NT_STATUS_INVALID_PARAMETER;
3827 if (id23->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
3828 return NT_STATUS_ACCESS_DENIED;
3831 if ((id23->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3832 (id23->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
3834 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
3835 pdb_get_username(pwd)));
3837 if (!decode_pw_buffer(mem_ctx,
3838 id23->password.data,
3842 return NT_STATUS_WRONG_PASSWORD;
3845 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3846 return NT_STATUS_ACCESS_DENIED;
3850 copy_id23_to_sam_passwd(pwd, id23);
3852 acct_ctrl = pdb_get_acct_ctrl(pwd);
3854 /* if it's a trust account, don't update /etc/passwd */
3855 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3856 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3857 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3858 DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n"));
3859 } else if (plaintext_buf) {
3860 /* update the UNIX password */
3861 if (lp_unix_password_sync() ) {
3862 struct passwd *passwd;
3863 if (pdb_get_username(pwd) == NULL) {
3864 DEBUG(1, ("chgpasswd: User without name???\n"));
3865 return NT_STATUS_ACCESS_DENIED;
3868 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3869 if (passwd == NULL) {
3870 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3873 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3874 return NT_STATUS_ACCESS_DENIED;
3876 TALLOC_FREE(passwd);
3880 if (plaintext_buf) {
3881 memset(plaintext_buf, '\0', strlen(plaintext_buf));
3884 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
3885 (!NT_STATUS_IS_OK(status = pdb_set_unix_primary_group(mem_ctx,
3890 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3894 return NT_STATUS_OK;
3897 /*******************************************************************
3899 ********************************************************************/
3901 static bool set_user_info_pw(uint8 *pass, struct samu *pwd)
3904 char *plaintext_buf = NULL;
3907 DEBUG(5, ("Attempting administrator password change for user %s\n",
3908 pdb_get_username(pwd)));
3910 acct_ctrl = pdb_get_acct_ctrl(pwd);
3912 if (!decode_pw_buffer(talloc_tos(),
3920 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3924 /* if it's a trust account, don't update /etc/passwd */
3925 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3926 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3927 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3928 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
3930 /* update the UNIX password */
3931 if (lp_unix_password_sync()) {
3932 struct passwd *passwd;
3934 if (pdb_get_username(pwd) == NULL) {
3935 DEBUG(1, ("chgpasswd: User without name???\n"));
3939 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3940 if (passwd == NULL) {
3941 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3944 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3947 TALLOC_FREE(passwd);
3951 memset(plaintext_buf, '\0', strlen(plaintext_buf));
3953 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
3958 /*******************************************************************
3960 ********************************************************************/
3962 static NTSTATUS set_user_info_24(TALLOC_CTX *mem_ctx,
3963 struct samr_UserInfo24 *id24,
3969 DEBUG(5, ("set_user_info_24: NULL id24\n"));
3970 return NT_STATUS_INVALID_PARAMETER;
3973 if (!set_user_info_pw(id24->password.data, pwd)) {
3974 return NT_STATUS_WRONG_PASSWORD;
3977 copy_id24_to_sam_passwd(pwd, id24);
3979 status = pdb_update_sam_account(pwd);
3980 if (!NT_STATUS_IS_OK(status)) {
3984 return NT_STATUS_OK;
3987 /*******************************************************************
3989 ********************************************************************/
3991 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
3992 struct samr_UserInfo25 *id25,
3998 DEBUG(5, ("set_user_info_25: NULL id25\n"));
3999 return NT_STATUS_INVALID_PARAMETER;
4002 if (id25->info.fields_present == 0) {
4003 return NT_STATUS_INVALID_PARAMETER;
4006 if (id25->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4007 return NT_STATUS_ACCESS_DENIED;
4010 if ((id25->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
4011 (id25->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
4013 if (!set_user_info_pw(id25->password.data, pwd)) {
4014 return NT_STATUS_WRONG_PASSWORD;
4018 copy_id25_to_sam_passwd(pwd, id25);
4020 /* write the change out */
4021 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4026 * We need to "pdb_update_sam_account" before the unix primary group
4027 * is set, because the idealx scripts would also change the
4028 * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4029 * the delete explicit / add explicit, which would then fail to find
4030 * the previous primaryGroupSid value.
4033 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4034 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4035 if ( !NT_STATUS_IS_OK(status) ) {
4040 return NT_STATUS_OK;
4043 /*******************************************************************
4045 ********************************************************************/
4047 static NTSTATUS set_user_info_26(TALLOC_CTX *mem_ctx,
4048 struct samr_UserInfo26 *id26,
4054 DEBUG(5, ("set_user_info_26: NULL id26\n"));
4055 return NT_STATUS_INVALID_PARAMETER;
4058 if (!set_user_info_pw(id26->password.data, pwd)) {
4059 return NT_STATUS_WRONG_PASSWORD;
4062 copy_id26_to_sam_passwd(pwd, id26);
4064 status = pdb_update_sam_account(pwd);
4065 if (!NT_STATUS_IS_OK(status)) {
4069 return NT_STATUS_OK;
4073 /*******************************************************************
4075 ********************************************************************/
4077 NTSTATUS _samr_SetUserInfo(pipes_struct *p,
4078 struct samr_SetUserInfo *r)
4081 struct samu *pwd = NULL;
4083 union samr_UserInfo *info = r->in.info;
4084 uint16_t switch_value = r->in.level;
4085 uint32_t acc_granted;
4086 uint32_t acc_required;
4088 bool has_enough_rights = False;
4090 DISP_INFO *disp_info = NULL;
4092 DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
4094 /* find the policy handle. open a policy on it. */
4095 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &sid, &acc_granted, &disp_info)) {
4096 return NT_STATUS_INVALID_HANDLE;
4099 /* This is tricky. A WinXP domain join sets
4100 (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
4101 The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
4102 standard Win32 API calls just ask for SAMR_USER_ACCESS_SET_PASSWORD in the SamrOpenUser().
4103 This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
4104 we'll use the set from the WinXP join as the basis. */
4106 switch (switch_value) {
4111 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
4114 acc_required = SAMR_USER_ACCESS_SET_PASSWORD |
4115 SAMR_USER_ACCESS_SET_ATTRIBUTES |
4116 SAMR_USER_ACCESS_GET_ATTRIBUTES;
4120 status = access_check_samr_function(acc_granted,
4122 "_samr_SetUserInfo");
4123 if (!NT_STATUS_IS_OK(status)) {
4127 DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
4128 sid_string_dbg(&sid), switch_value));
4131 DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
4132 return NT_STATUS_INVALID_INFO_CLASS;
4135 if (!(pwd = samu_new(NULL))) {
4136 return NT_STATUS_NO_MEMORY;
4140 ret = pdb_getsampwsid(pwd, &sid);
4145 return NT_STATUS_NO_SUCH_USER;
4148 /* deal with machine password changes differently from userinfo changes */
4149 /* check to see if we have the sufficient rights */
4151 acb_info = pdb_get_acct_ctrl(pwd);
4152 if (acb_info & ACB_WSTRUST)
4153 has_enough_rights = user_has_privileges(p->server_info->ptok,
4154 &se_machine_account);
4155 else if (acb_info & ACB_NORMAL)
4156 has_enough_rights = user_has_privileges(p->server_info->ptok,
4158 else if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
4159 if (lp_enable_privileges()) {
4160 has_enough_rights = nt_token_check_domain_rid(p->server_info->ptok,
4161 DOMAIN_GROUP_RID_ADMINS);
4165 DEBUG(5, ("_samr_SetUserInfo: %s does%s possess sufficient rights\n",
4166 uidtoname(p->server_info->utok.uid),
4167 has_enough_rights ? "" : " not"));
4169 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
4171 if (has_enough_rights) {
4175 /* ok! user info levels (lots: see MSDEV help), off we go... */
4177 switch (switch_value) {
4180 status = set_user_info_7(p->mem_ctx,
4185 if (!set_user_info_16(&info->info16, pwd)) {
4186 status = NT_STATUS_ACCESS_DENIED;
4191 /* Used by AS/U JRA. */
4192 status = set_user_info_18(&info->info18,
4194 &p->server_info->user_session_key,
4199 if (!set_user_info_20(&info->info20, pwd)) {
4200 status = NT_STATUS_ACCESS_DENIED;
4205 status = set_user_info_21(&info->info21,
4207 &p->server_info->user_session_key,
4212 if (!p->server_info->user_session_key.length) {
4213 status = NT_STATUS_NO_USER_SESSION_KEY;
4215 SamOEMhashBlob(info->info23.password.data, 516,
4216 &p->server_info->user_session_key);
4218 dump_data(100, info->info23.password.data, 516);
4220 status = set_user_info_23(p->mem_ctx,
4221 &info->info23, pwd);
4225 if (!p->server_info->user_session_key.length) {
4226 status = NT_STATUS_NO_USER_SESSION_KEY;
4228 SamOEMhashBlob(info->info24.password.data,
4230 &p->server_info->user_session_key);
4232 dump_data(100, info->info24.password.data, 516);
4234 status = set_user_info_24(p->mem_ctx,
4235 &info->info24, pwd);
4239 if (!p->server_info->user_session_key.length) {
4240 status = NT_STATUS_NO_USER_SESSION_KEY;
4242 encode_or_decode_arc4_passwd_buffer(
4243 info->info25.password.data,
4244 &p->server_info->user_session_key);
4246 dump_data(100, info->info25.password.data, 532);
4248 status = set_user_info_25(p->mem_ctx,
4249 &info->info25, pwd);
4253 if (!p->server_info->user_session_key.length) {
4254 status = NT_STATUS_NO_USER_SESSION_KEY;
4256 encode_or_decode_arc4_passwd_buffer(
4257 info->info26.password.data,
4258 &p->server_info->user_session_key);
4260 dump_data(100, info->info26.password.data, 516);
4262 status = set_user_info_26(p->mem_ctx,
4263 &info->info26, pwd);
4267 status = NT_STATUS_INVALID_INFO_CLASS;
4272 if (has_enough_rights) {
4276 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
4278 if (NT_STATUS_IS_OK(status)) {
4279 force_flush_samr_cache(disp_info);
4285 /*******************************************************************
4287 ********************************************************************/
4289 NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
4290 struct samr_SetUserInfo2 *r)
4292 struct samr_SetUserInfo q;
4294 q.in.user_handle = r->in.user_handle;
4295 q.in.level = r->in.level;
4296 q.in.info = r->in.info;
4298 return _samr_SetUserInfo(p, &q);
4301 /*********************************************************************
4302 _samr_GetAliasMembership
4303 *********************************************************************/
4305 NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
4306 struct samr_GetAliasMembership *r)
4308 size_t num_alias_rids;
4310 struct samr_info *info = NULL;
4318 DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
4320 /* find the policy handle. open a policy on it. */
4321 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
4322 return NT_STATUS_INVALID_HANDLE;
4324 ntstatus1 = access_check_samr_function(info->acc_granted,
4325 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
4326 "_samr_GetAliasMembership");
4327 ntstatus2 = access_check_samr_function(info->acc_granted,
4328 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4329 "_samr_GetAliasMembership");
4331 if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
4332 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
4333 !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
4334 return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
4338 if (!sid_check_is_domain(&info->sid) &&
4339 !sid_check_is_builtin(&info->sid))
4340 return NT_STATUS_OBJECT_TYPE_MISMATCH;
4342 if (r->in.sids->num_sids) {
4343 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, r->in.sids->num_sids);
4345 if (members == NULL)
4346 return NT_STATUS_NO_MEMORY;
4351 for (i=0; i<r->in.sids->num_sids; i++)
4352 sid_copy(&members[i], r->in.sids->sids[i].sid);
4358 ntstatus1 = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
4359 r->in.sids->num_sids,
4360 &alias_rids, &num_alias_rids);
4363 if (!NT_STATUS_IS_OK(ntstatus1)) {
4367 r->out.rids->count = num_alias_rids;
4368 r->out.rids->ids = alias_rids;
4370 return NT_STATUS_OK;
4373 /*********************************************************************
4374 _samr_GetMembersInAlias
4375 *********************************************************************/
4377 NTSTATUS _samr_GetMembersInAlias(pipes_struct *p,
4378 struct samr_GetMembersInAlias *r)
4382 size_t num_sids = 0;
4383 struct lsa_SidPtr *sids = NULL;
4384 DOM_SID *pdb_sids = NULL;
4390 /* find the policy handle. open a policy on it. */
4391 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, NULL))
4392 return NT_STATUS_INVALID_HANDLE;
4394 status = access_check_samr_function(acc_granted,
4395 SAMR_ALIAS_ACCESS_GET_MEMBERS,
4396 "_samr_GetMembersInAlias");
4397 if (!NT_STATUS_IS_OK(status)) {
4401 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4404 status = pdb_enum_aliasmem(&alias_sid, &pdb_sids, &num_sids);
4407 if (!NT_STATUS_IS_OK(status)) {
4412 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr, num_sids);
4414 TALLOC_FREE(pdb_sids);
4415 return NT_STATUS_NO_MEMORY;
4419 for (i = 0; i < num_sids; i++) {
4420 sids[i].sid = sid_dup_talloc(p->mem_ctx, &pdb_sids[i]);
4422 TALLOC_FREE(pdb_sids);
4423 return NT_STATUS_NO_MEMORY;
4427 r->out.sids->num_sids = num_sids;
4428 r->out.sids->sids = sids;
4430 TALLOC_FREE(pdb_sids);
4432 return NT_STATUS_OK;
4435 /*********************************************************************
4436 _samr_QueryGroupMember
4437 *********************************************************************/
4439 NTSTATUS _samr_QueryGroupMember(pipes_struct *p,
4440 struct samr_QueryGroupMember *r)
4443 size_t i, num_members;
4451 struct samr_RidTypeArray *rids = NULL;
4453 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidTypeArray);
4455 return NT_STATUS_NO_MEMORY;
4458 /* find the policy handle. open a policy on it. */
4459 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
4460 return NT_STATUS_INVALID_HANDLE;
4462 status = access_check_samr_function(acc_granted,
4463 SAMR_GROUP_ACCESS_GET_MEMBERS,
4464 "_samr_QueryGroupMember");
4465 if (!NT_STATUS_IS_OK(status)) {
4469 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4471 if (!sid_check_is_in_our_domain(&group_sid)) {
4472 DEBUG(3, ("sid %s is not in our domain\n",
4473 sid_string_dbg(&group_sid)));
4474 return NT_STATUS_NO_SUCH_GROUP;
4477 DEBUG(10, ("lookup on Domain SID\n"));
4480 status = pdb_enum_group_members(p->mem_ctx, &group_sid,
4481 &rid, &num_members);
4484 if (!NT_STATUS_IS_OK(status))
4488 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
4490 return NT_STATUS_NO_MEMORY;
4496 for (i=0; i<num_members; i++)
4497 attr[i] = SID_NAME_USER;
4499 rids->count = num_members;
4503 *r->out.rids = rids;
4505 return NT_STATUS_OK;
4508 /*********************************************************************
4509 _samr_AddAliasMember
4510 *********************************************************************/
4512 NTSTATUS _samr_AddAliasMember(pipes_struct *p,
4513 struct samr_AddAliasMember *r)
4518 bool can_add_accounts;
4520 DISP_INFO *disp_info = NULL;
4522 /* Find the policy handle. Open a policy on it. */
4523 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4524 return NT_STATUS_INVALID_HANDLE;
4526 status = access_check_samr_function(acc_granted,
4527 SAMR_ALIAS_ACCESS_ADD_MEMBER,
4528 "_samr_AddAliasMember");
4529 if (!NT_STATUS_IS_OK(status)) {
4533 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4535 se_priv_copy( &se_rights, &se_add_users );
4536 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
4538 /******** BEGIN SeAddUsers BLOCK *********/
4540 if ( can_add_accounts )
4543 status = pdb_add_aliasmem(&alias_sid, r->in.sid);
4545 if ( can_add_accounts )
4548 /******** END SeAddUsers BLOCK *********/
4550 if (NT_STATUS_IS_OK(status)) {
4551 force_flush_samr_cache(disp_info);
4557 /*********************************************************************
4558 _samr_DeleteAliasMember
4559 *********************************************************************/
4561 NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
4562 struct samr_DeleteAliasMember *r)
4567 bool can_add_accounts;
4569 DISP_INFO *disp_info = NULL;
4571 /* Find the policy handle. Open a policy on it. */
4572 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4573 return NT_STATUS_INVALID_HANDLE;
4575 status = access_check_samr_function(acc_granted,
4576 SAMR_ALIAS_ACCESS_REMOVE_MEMBER,
4577 "_samr_DeleteAliasMember");
4578 if (!NT_STATUS_IS_OK(status)) {
4582 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
4583 sid_string_dbg(&alias_sid)));
4585 se_priv_copy( &se_rights, &se_add_users );
4586 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
4588 /******** BEGIN SeAddUsers BLOCK *********/
4590 if ( can_add_accounts )
4593 status = pdb_del_aliasmem(&alias_sid, r->in.sid);
4595 if ( can_add_accounts )
4598 /******** END SeAddUsers BLOCK *********/
4600 if (NT_STATUS_IS_OK(status)) {
4601 force_flush_samr_cache(disp_info);
4607 /*********************************************************************
4608 _samr_AddGroupMember
4609 *********************************************************************/
4611 NTSTATUS _samr_AddGroupMember(pipes_struct *p,
4612 struct samr_AddGroupMember *r)
4619 bool can_add_accounts;
4620 DISP_INFO *disp_info = NULL;
4622 /* Find the policy handle. Open a policy on it. */
4623 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4624 return NT_STATUS_INVALID_HANDLE;
4626 status = access_check_samr_function(acc_granted,
4627 SAMR_GROUP_ACCESS_ADD_MEMBER,
4628 "_samr_AddGroupMember");
4629 if (!NT_STATUS_IS_OK(status)) {
4633 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4635 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4637 return NT_STATUS_INVALID_HANDLE;
4640 se_priv_copy( &se_rights, &se_add_users );
4641 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
4643 /******** BEGIN SeAddUsers BLOCK *********/
4645 if ( can_add_accounts )
4648 status = pdb_add_groupmem(p->mem_ctx, group_rid, r->in.rid);
4650 if ( can_add_accounts )
4653 /******** END SeAddUsers BLOCK *********/
4655 force_flush_samr_cache(disp_info);
4660 /*********************************************************************
4661 _samr_DeleteGroupMember
4662 *********************************************************************/
4664 NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
4665 struct samr_DeleteGroupMember *r)
4673 bool can_add_accounts;
4674 DISP_INFO *disp_info = NULL;
4677 * delete the group member named r->in.rid
4678 * who is a member of the sid associated with the handle
4679 * the rid is a user's rid as the group is a domain group.
4682 /* Find the policy handle. Open a policy on it. */
4683 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4684 return NT_STATUS_INVALID_HANDLE;
4686 status = access_check_samr_function(acc_granted,
4687 SAMR_GROUP_ACCESS_REMOVE_MEMBER,
4688 "_samr_DeleteGroupMember");
4689 if (!NT_STATUS_IS_OK(status)) {
4693 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4695 return NT_STATUS_INVALID_HANDLE;
4698 se_priv_copy( &se_rights, &se_add_users );
4699 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
4701 /******** BEGIN SeAddUsers BLOCK *********/
4703 if ( can_add_accounts )
4706 status = pdb_del_groupmem(p->mem_ctx, group_rid, r->in.rid);
4708 if ( can_add_accounts )
4711 /******** END SeAddUsers BLOCK *********/
4713 force_flush_samr_cache(disp_info);
4718 /*********************************************************************
4720 *********************************************************************/
4722 NTSTATUS _samr_DeleteUser(pipes_struct *p,
4723 struct samr_DeleteUser *r)
4727 struct samu *sam_pass=NULL;
4729 bool can_add_accounts;
4731 DISP_INFO *disp_info = NULL;
4734 DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__));
4736 /* Find the policy handle. Open a policy on it. */
4737 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &user_sid, &acc_granted, &disp_info))
4738 return NT_STATUS_INVALID_HANDLE;
4740 status = access_check_samr_function(acc_granted,
4741 STD_RIGHT_DELETE_ACCESS,
4742 "_samr_DeleteUser");
4743 if (!NT_STATUS_IS_OK(status)) {
4747 if (!sid_check_is_in_our_domain(&user_sid))
4748 return NT_STATUS_CANNOT_DELETE;
4750 /* check if the user exists before trying to delete */
4751 if ( !(sam_pass = samu_new( NULL )) ) {
4752 return NT_STATUS_NO_MEMORY;
4756 ret = pdb_getsampwsid(sam_pass, &user_sid);
4760 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
4761 sid_string_dbg(&user_sid)));
4762 TALLOC_FREE(sam_pass);
4763 return NT_STATUS_NO_SUCH_USER;
4766 acb_info = pdb_get_acct_ctrl(sam_pass);
4768 /* For machine accounts it's the SeMachineAccountPrivilege that counts. */
4769 if ( acb_info & ACB_WSTRUST ) {
4770 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_machine_account );
4772 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
4775 /******** BEGIN SeAddUsers BLOCK *********/
4777 if ( can_add_accounts )
4780 status = pdb_delete_user(p->mem_ctx, sam_pass);
4782 if ( can_add_accounts )
4785 /******** END SeAddUsers BLOCK *********/
4787 if ( !NT_STATUS_IS_OK(status) ) {
4788 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
4789 "user %s: %s.\n", pdb_get_username(sam_pass),
4790 nt_errstr(status)));
4791 TALLOC_FREE(sam_pass);
4796 TALLOC_FREE(sam_pass);
4798 if (!close_policy_hnd(p, r->in.user_handle))
4799 return NT_STATUS_OBJECT_NAME_INVALID;
4801 ZERO_STRUCTP(r->out.user_handle);
4803 force_flush_samr_cache(disp_info);
4805 return NT_STATUS_OK;
4808 /*********************************************************************
4809 _samr_DeleteDomainGroup
4810 *********************************************************************/
4812 NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
4813 struct samr_DeleteDomainGroup *r)
4820 bool can_add_accounts;
4821 DISP_INFO *disp_info = NULL;
4823 DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__));
4825 /* Find the policy handle. Open a policy on it. */
4826 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4827 return NT_STATUS_INVALID_HANDLE;
4829 status = access_check_samr_function(acc_granted,
4830 STD_RIGHT_DELETE_ACCESS,
4831 "_samr_DeleteDomainGroup");
4832 if (!NT_STATUS_IS_OK(status)) {
4836 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4838 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4840 return NT_STATUS_NO_SUCH_GROUP;
4843 se_priv_copy( &se_rights, &se_add_users );
4844 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
4846 /******** BEGIN SeAddUsers BLOCK *********/
4848 if ( can_add_accounts )
4851 status = pdb_delete_dom_group(p->mem_ctx, group_rid);
4853 if ( can_add_accounts )
4856 /******** END SeAddUsers BLOCK *********/
4858 if ( !NT_STATUS_IS_OK(status) ) {
4859 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
4860 "entry for group %s: %s\n",
4861 sid_string_dbg(&group_sid),
4862 nt_errstr(status)));
4866 if (!close_policy_hnd(p, r->in.group_handle))
4867 return NT_STATUS_OBJECT_NAME_INVALID;
4869 force_flush_samr_cache(disp_info);
4871 return NT_STATUS_OK;
4874 /*********************************************************************
4875 _samr_DeleteDomAlias
4876 *********************************************************************/
4878 NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
4879 struct samr_DeleteDomAlias *r)
4884 bool can_add_accounts;
4886 DISP_INFO *disp_info = NULL;
4888 DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__));
4890 /* Find the policy handle. Open a policy on it. */
4891 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4892 return NT_STATUS_INVALID_HANDLE;
4894 /* copy the handle to the outgoing reply */
4896 memcpy(r->out.alias_handle, r->in.alias_handle, sizeof(r->out.alias_handle));
4898 status = access_check_samr_function(acc_granted,
4899 STD_RIGHT_DELETE_ACCESS,
4900 "_samr_DeleteDomAlias");
4901 if (!NT_STATUS_IS_OK(status)) {
4905 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4907 /* Don't let Windows delete builtin groups */
4909 if ( sid_check_is_in_builtin( &alias_sid ) ) {
4910 return NT_STATUS_SPECIAL_ACCOUNT;
4913 if (!sid_check_is_in_our_domain(&alias_sid))
4914 return NT_STATUS_NO_SUCH_ALIAS;
4916 DEBUG(10, ("lookup on Local SID\n"));
4918 se_priv_copy( &se_rights, &se_add_users );
4919 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
4921 /******** BEGIN SeAddUsers BLOCK *********/
4923 if ( can_add_accounts )
4926 /* Have passdb delete the alias */
4927 status = pdb_delete_alias(&alias_sid);
4929 if ( can_add_accounts )
4932 /******** END SeAddUsers BLOCK *********/
4934 if ( !NT_STATUS_IS_OK(status))
4937 if (!close_policy_hnd(p, r->in.alias_handle))
4938 return NT_STATUS_OBJECT_NAME_INVALID;
4940 force_flush_samr_cache(disp_info);
4942 return NT_STATUS_OK;
4945 /*********************************************************************
4946 _samr_CreateDomainGroup
4947 *********************************************************************/
4949 NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
4950 struct samr_CreateDomainGroup *r)
4957 struct samr_info *info;
4960 bool can_add_accounts;
4961 DISP_INFO *disp_info = NULL;
4963 /* Find the policy handle. Open a policy on it. */
4964 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
4965 return NT_STATUS_INVALID_HANDLE;
4967 status = access_check_samr_function(acc_granted,
4968 SAMR_DOMAIN_ACCESS_CREATE_GROUP,
4969 "_samr_CreateDomainGroup");
4970 if (!NT_STATUS_IS_OK(status)) {
4974 if (!sid_equal(&dom_sid, get_global_sam_sid()))
4975 return NT_STATUS_ACCESS_DENIED;
4977 name = r->in.name->string;
4979 return NT_STATUS_NO_MEMORY;
4982 status = can_create(p->mem_ctx, name);
4983 if (!NT_STATUS_IS_OK(status)) {
4987 se_priv_copy( &se_rights, &se_add_users );
4988 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
4990 /******** BEGIN SeAddUsers BLOCK *********/
4992 if ( can_add_accounts )
4995 /* check that we successfully create the UNIX group */
4997 status = pdb_create_dom_group(p->mem_ctx, name, r->out.rid);
4999 if ( can_add_accounts )
5002 /******** END SeAddUsers BLOCK *********/
5004 /* check if we should bail out here */
5006 if ( !NT_STATUS_IS_OK(status) )
5009 sid_compose(&info_sid, get_global_sam_sid(), *r->out.rid);
5011 if ((info = get_samr_info_by_sid(p->mem_ctx, &info_sid)) == NULL)
5012 return NT_STATUS_NO_MEMORY;
5014 /* they created it; let the user do what he wants with it */
5016 info->acc_granted = GENERIC_RIGHTS_GROUP_ALL_ACCESS;
5018 /* get a (unique) handle. open a policy on it. */
5019 if (!create_policy_hnd(p, r->out.group_handle, info))
5020 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5022 force_flush_samr_cache(disp_info);
5024 return NT_STATUS_OK;
5027 /*********************************************************************
5028 _samr_CreateDomAlias
5029 *********************************************************************/
5031 NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
5032 struct samr_CreateDomAlias *r)
5036 const char *name = NULL;
5037 struct samr_info *info;
5042 bool can_add_accounts;
5043 DISP_INFO *disp_info = NULL;
5045 /* Find the policy handle. Open a policy on it. */
5046 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
5047 return NT_STATUS_INVALID_HANDLE;
5049 result = access_check_samr_function(acc_granted,
5050 SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
5051 "_samr_CreateDomAlias");
5052 if (!NT_STATUS_IS_OK(result)) {
5056 if (!sid_equal(&dom_sid, get_global_sam_sid()))
5057 return NT_STATUS_ACCESS_DENIED;
5059 name = r->in.alias_name->string;
5061 se_priv_copy( &se_rights, &se_add_users );
5062 can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
5064 result = can_create(p->mem_ctx, name);
5065 if (!NT_STATUS_IS_OK(result)) {
5069 /******** BEGIN SeAddUsers BLOCK *********/
5071 if ( can_add_accounts )
5074 /* Have passdb create the alias */
5075 result = pdb_create_alias(name, r->out.rid);
5077 if ( can_add_accounts )
5080 /******** END SeAddUsers BLOCK *********/
5082 if (!NT_STATUS_IS_OK(result)) {
5083 DEBUG(10, ("pdb_create_alias failed: %s\n",
5084 nt_errstr(result)));
5088 sid_copy(&info_sid, get_global_sam_sid());
5089 sid_append_rid(&info_sid, *r->out.rid);
5091 if (!sid_to_gid(&info_sid, &gid)) {
5092 DEBUG(10, ("Could not find alias just created\n"));
5093 return NT_STATUS_ACCESS_DENIED;
5096 /* check if the group has been successfully created */
5097 if ( getgrgid(gid) == NULL ) {
5098 DEBUG(10, ("getgrgid(%d) of just created alias failed\n",
5100 return NT_STATUS_ACCESS_DENIED;
5103 if ((info = get_samr_info_by_sid(p->mem_ctx, &info_sid)) == NULL)
5104 return NT_STATUS_NO_MEMORY;
5106 /* they created it; let the user do what he wants with it */
5108 info->acc_granted = GENERIC_RIGHTS_ALIAS_ALL_ACCESS;
5110 /* get a (unique) handle. open a policy on it. */
5111 if (!create_policy_hnd(p, r->out.alias_handle, info))
5112 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5114 force_flush_samr_cache(disp_info);
5116 return NT_STATUS_OK;
5119 /*********************************************************************
5120 _samr_QueryGroupInfo
5121 *********************************************************************/
5123 NTSTATUS _samr_QueryGroupInfo(pipes_struct *p,
5124 struct samr_QueryGroupInfo *r)
5129 union samr_GroupInfo *info = NULL;
5132 uint32_t attributes = SE_GROUP_MANDATORY |
5133 SE_GROUP_ENABLED_BY_DEFAULT |
5135 const char *group_name = NULL;
5136 const char *group_description = NULL;
5138 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
5139 return NT_STATUS_INVALID_HANDLE;
5141 status = access_check_samr_function(acc_granted,
5142 SAMR_GROUP_ACCESS_LOOKUP_INFO,
5143 "_samr_QueryGroupInfo");
5144 if (!NT_STATUS_IS_OK(status)) {
5149 ret = get_domain_group_from_sid(group_sid, &map);
5152 return NT_STATUS_INVALID_HANDLE;
5154 /* FIXME: map contains fstrings */
5155 group_name = talloc_strdup(r, map.nt_name);
5156 group_description = talloc_strdup(r, map.comment);
5158 info = TALLOC_ZERO_P(p->mem_ctx, union samr_GroupInfo);
5160 return NT_STATUS_NO_MEMORY;
5163 switch (r->in.level) {
5169 status = pdb_enum_group_members(
5170 p->mem_ctx, &group_sid, &members, &num_members);
5173 if (!NT_STATUS_IS_OK(status)) {
5177 info->all.name.string = group_name;
5178 info->all.attributes = attributes;
5179 info->all.num_members = num_members;
5180 info->all.description.string = group_description;
5184 info->name.string = group_name;
5187 info->attributes.attributes = attributes;
5190 info->description.string = group_description;
5200 status = pdb_enum_group_members(
5201 p->mem_ctx, &group_sid, &members, &num_members);
5204 if (!NT_STATUS_IS_OK(status)) {
5208 info->all2.name.string = group_name;
5209 info->all2.attributes = attributes;
5210 info->all2.num_members = 0; /* num_members - in w2k3 this is always 0 */
5211 info->all2.description.string = group_description;
5216 return NT_STATUS_INVALID_INFO_CLASS;
5219 *r->out.info = info;
5221 return NT_STATUS_OK;
5224 /*********************************************************************
5226 *********************************************************************/
5228 NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
5229 struct samr_SetGroupInfo *r)
5236 bool can_mod_accounts;
5237 DISP_INFO *disp_info = NULL;
5239 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
5240 return NT_STATUS_INVALID_HANDLE;
5242 status = access_check_samr_function(acc_granted,
5243 SAMR_GROUP_ACCESS_SET_INFO,
5244 "_samr_SetGroupInfo");
5245 if (!NT_STATUS_IS_OK(status)) {
5250 ret = get_domain_group_from_sid(group_sid, &map);
5253 return NT_STATUS_NO_SUCH_GROUP;
5255 switch (r->in.level) {
5257 fstrcpy(map.comment, r->in.info->all.description.string);
5260 /* group rename is not supported yet */
5261 return NT_STATUS_NOT_SUPPORTED;
5263 fstrcpy(map.comment, r->in.info->description.string);
5266 return NT_STATUS_INVALID_INFO_CLASS;
5269 can_mod_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
5271 /******** BEGIN SeAddUsers BLOCK *********/
5273 if ( can_mod_accounts )
5276 status = pdb_update_group_mapping_entry(&map);
5278 if ( can_mod_accounts )
5281 /******** End SeAddUsers BLOCK *********/
5283 if (NT_STATUS_IS_OK(status)) {
5284 force_flush_samr_cache(disp_info);
5290 /*********************************************************************
5292 *********************************************************************/
5294 NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
5295 struct samr_SetAliasInfo *r)
5298 struct acct_info info;
5300 bool can_mod_accounts;
5302 DISP_INFO *disp_info = NULL;
5304 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &group_sid, &acc_granted, &disp_info))
5305 return NT_STATUS_INVALID_HANDLE;
5307 status = access_check_samr_function(acc_granted,
5308 SAMR_ALIAS_ACCESS_SET_INFO,
5309 "_samr_SetAliasInfo");
5310 if (!NT_STATUS_IS_OK(status)) {
5314 /* get the current group information */
5317 status = pdb_get_aliasinfo( &group_sid, &info );
5320 if ( !NT_STATUS_IS_OK(status))
5323 switch (r->in.level) {
5328 /* We currently do not support renaming groups in the
5329 the BUILTIN domain. Refer to util_builtin.c to understand
5330 why. The eventually needs to be fixed to be like Windows
5331 where you can rename builtin groups, just not delete them */
5333 if ( sid_check_is_in_builtin( &group_sid ) ) {
5334 return NT_STATUS_SPECIAL_ACCOUNT;
5337 /* There has to be a valid name (and it has to be different) */
5339 if ( !r->in.info->name.string )
5340 return NT_STATUS_INVALID_PARAMETER;
5342 /* If the name is the same just reply "ok". Yes this
5343 doesn't allow you to change the case of a group name. */
5345 if ( strequal( r->in.info->name.string, info.acct_name ) )
5346 return NT_STATUS_OK;
5348 fstrcpy( info.acct_name, r->in.info->name.string);
5350 /* make sure the name doesn't already exist as a user
5353 fstr_sprintf( group_name, "%s\\%s", global_myname(), info.acct_name );
5354 status = can_create( p->mem_ctx, group_name );
5355 if ( !NT_STATUS_IS_OK( status ) )
5359 case ALIASINFODESCRIPTION:
5360 if (r->in.info->description.string) {
5361 fstrcpy(info.acct_desc,
5362 r->in.info->description.string);
5364 fstrcpy( info.acct_desc, "" );
5368 return NT_STATUS_INVALID_INFO_CLASS;
5371 can_mod_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
5373 /******** BEGIN SeAddUsers BLOCK *********/
5375 if ( can_mod_accounts )
5378 status = pdb_set_aliasinfo( &group_sid, &info );
5380 if ( can_mod_accounts )
5383 /******** End SeAddUsers BLOCK *********/
5385 if (NT_STATUS_IS_OK(status))
5386 force_flush_samr_cache(disp_info);
5391 /****************************************************************
5393 ****************************************************************/
5395 NTSTATUS _samr_GetDomPwInfo(pipes_struct *p,
5396 struct samr_GetDomPwInfo *r)
5398 uint32_t min_password_length = 0;
5399 uint32_t password_properties = 0;
5401 /* Perform access check. Since this rpc does not require a
5402 policy handle it will not be caught by the access checks on
5403 SAMR_CONNECT or SAMR_CONNECT_ANON. */
5405 if (!pipe_access_check(p)) {
5406 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
5407 return NT_STATUS_ACCESS_DENIED;
5411 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
5412 &min_password_length);
5413 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
5414 &password_properties);
5417 if (lp_check_password_script() && *lp_check_password_script()) {
5418 password_properties |= DOMAIN_PASSWORD_COMPLEX;
5421 r->out.info->min_password_length = min_password_length;
5422 r->out.info->password_properties = password_properties;
5424 return NT_STATUS_OK;
5427 /*********************************************************************
5429 *********************************************************************/
5431 NTSTATUS _samr_OpenGroup(pipes_struct *p,
5432 struct samr_OpenGroup *r)
5438 struct samr_info *info;
5439 SEC_DESC *psd = NULL;
5441 uint32 des_access = r->in.access_mask;
5448 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL))
5449 return NT_STATUS_INVALID_HANDLE;
5451 status = access_check_samr_function(acc_granted,
5452 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
5455 if ( !NT_STATUS_IS_OK(status) )
5458 /*check if access can be granted as requested by client. */
5459 map_max_allowed_access(p->server_info->ptok, &des_access);
5461 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
5462 se_map_generic(&des_access,&grp_generic_mapping);
5464 se_priv_copy( &se_rights, &se_add_users );
5466 status = access_check_samr_object(psd, p->server_info->ptok,
5467 &se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
5468 &acc_granted, "_samr_OpenGroup");
5470 if ( !NT_STATUS_IS_OK(status) )
5473 /* this should not be hard-coded like this */
5475 if (!sid_equal(&sid, get_global_sam_sid()))
5476 return NT_STATUS_ACCESS_DENIED;
5478 sid_copy(&info_sid, get_global_sam_sid());
5479 sid_append_rid(&info_sid, r->in.rid);
5480 sid_to_fstring(sid_string, &info_sid);
5482 if ((info = get_samr_info_by_sid(p->mem_ctx, &info_sid)) == NULL)
5483 return NT_STATUS_NO_MEMORY;
5485 info->acc_granted = acc_granted;
5487 DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n", sid_string));
5489 /* check if that group really exists */
5491 ret = get_domain_group_from_sid(info->sid, &map);
5494 return NT_STATUS_NO_SUCH_GROUP;
5496 /* get a (unique) handle. open a policy on it. */
5497 if (!create_policy_hnd(p, r->out.group_handle, info))
5498 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5500 return NT_STATUS_OK;
5503 /*********************************************************************
5504 _samr_RemoveMemberFromForeignDomain
5505 *********************************************************************/
5507 NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
5508 struct samr_RemoveMemberFromForeignDomain *r)
5510 DOM_SID delete_sid, domain_sid;
5513 DISP_INFO *disp_info = NULL;
5515 sid_copy( &delete_sid, r->in.sid );
5517 DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
5518 sid_string_dbg(&delete_sid)));
5520 /* Find the policy handle. Open a policy on it. */
5522 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &domain_sid,
5523 &acc_granted, &disp_info))
5524 return NT_STATUS_INVALID_HANDLE;
5526 result = access_check_samr_function(acc_granted,
5527 STD_RIGHT_DELETE_ACCESS,
5528 "_samr_RemoveMemberFromForeignDomain");
5530 if (!NT_STATUS_IS_OK(result))
5533 DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
5534 sid_string_dbg(&domain_sid)));
5536 /* we can only delete a user from a group since we don't have
5537 nested groups anyways. So in the latter case, just say OK */
5539 /* TODO: The above comment nowadays is bogus. Since we have nested
5540 * groups now, and aliases members are never reported out of the unix
5541 * group membership, the "just say OK" makes this call a no-op. For
5542 * us. This needs fixing however. */
5544 /* I've only ever seen this in the wild when deleting a user from
5545 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
5546 * is the user about to be deleted. I very much suspect this is the
5547 * only application of this call. To verify this, let people report
5550 if (!sid_check_is_builtin(&domain_sid)) {
5551 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
5552 "global_sam_sid() = %s\n",
5553 sid_string_dbg(&domain_sid),
5554 sid_string_dbg(get_global_sam_sid())));
5555 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
5556 return NT_STATUS_OK;
5559 force_flush_samr_cache(disp_info);
5561 result = NT_STATUS_OK;
5566 /*******************************************************************
5567 _samr_QueryDomainInfo2
5568 ********************************************************************/
5570 NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
5571 struct samr_QueryDomainInfo2 *r)
5573 struct samr_QueryDomainInfo q;
5575 q.in.domain_handle = r->in.domain_handle;
5576 q.in.level = r->in.level;
5578 q.out.info = r->out.info;
5580 return _samr_QueryDomainInfo(p, &q);
5583 /*******************************************************************
5585 ********************************************************************/
5587 NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
5588 struct samr_SetDomainInfo *r)
5590 struct samr_info *info = NULL;
5591 time_t u_expire, u_min_age;
5593 time_t u_lock_duration, u_reset_time;
5596 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5598 /* find the policy handle. open a policy on it. */
5599 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
5600 return NT_STATUS_INVALID_HANDLE;
5602 /* We do have different access bits for info
5603 * levels here, but we're really just looking for
5604 * GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
5605 * this maps to different specific bits. So
5606 * assume if we have SAMR_DOMAIN_ACCESS_SET_INFO_1
5609 result = access_check_samr_function(info->acc_granted,
5610 SAMR_DOMAIN_ACCESS_SET_INFO_1,
5611 "_samr_SetDomainInfo");
5613 if (!NT_STATUS_IS_OK(result))
5616 DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
5618 switch (r->in.level) {
5620 u_expire=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.max_password_age);
5621 u_min_age=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.min_password_age);
5622 pdb_set_account_policy(AP_MIN_PASSWORD_LEN, (uint32)r->in.info->info1.min_password_length);
5623 pdb_set_account_policy(AP_PASSWORD_HISTORY, (uint32)r->in.info->info1.password_history_length);
5624 pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)r->in.info->info1.password_properties);
5625 pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (int)u_expire);
5626 pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (int)u_min_age);
5631 u_logout=nt_time_to_unix_abs((NTTIME *)&r->in.info->info3.force_logoff_time);
5632 pdb_set_account_policy(AP_TIME_TO_LOGOUT, (int)u_logout);
5641 u_lock_duration=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_duration);
5642 if (u_lock_duration != -1)
5643 u_lock_duration /= 60;
5645 u_reset_time=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_window)/60;
5647 pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
5648 pdb_set_account_policy(AP_RESET_COUNT_TIME, (int)u_reset_time);
5649 pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT, (uint32)r->in.info->info12.lockout_threshold);
5652 return NT_STATUS_INVALID_INFO_CLASS;
5655 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5657 return NT_STATUS_OK;
5660 /****************************************************************
5661 _samr_GetDisplayEnumerationIndex
5662 ****************************************************************/
5664 NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
5665 struct samr_GetDisplayEnumerationIndex *r)
5667 struct samr_info *info = NULL;
5668 uint32_t max_entries = (uint32_t) -1;
5669 uint32_t enum_context = 0;
5671 uint32_t num_account = 0;
5672 struct samr_displayentry *entries = NULL;
5675 DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
5677 /* find the policy handle. open a policy on it. */
5678 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
5679 return NT_STATUS_INVALID_HANDLE;
5682 status = access_check_samr_function(info->acc_granted,
5683 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
5684 "_samr_GetDisplayEnumerationIndex");
5685 if (!NT_STATUS_IS_OK(status)) {
5689 if ((r->in.level < 1) || (r->in.level > 3)) {
5690 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
5691 "Unknown info level (%u)\n",
5693 return NT_STATUS_INVALID_INFO_CLASS;
5698 /* The following done as ROOT. Don't return without unbecome_root(). */
5700 switch (r->in.level) {
5702 if (info->disp_info->users == NULL) {
5703 info->disp_info->users = pdb_search_users(
5704 info->disp_info, ACB_NORMAL);
5705 if (info->disp_info->users == NULL) {
5707 return NT_STATUS_ACCESS_DENIED;
5709 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5710 "starting user enumeration at index %u\n",
5711 (unsigned int)enum_context));
5713 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5714 "using cached user enumeration at index %u\n",
5715 (unsigned int)enum_context));
5717 num_account = pdb_search_entries(info->disp_info->users,
5718 enum_context, max_entries,
5722 if (info->disp_info->machines == NULL) {
5723 info->disp_info->machines = pdb_search_users(
5724 info->disp_info, ACB_WSTRUST|ACB_SVRTRUST);
5725 if (info->disp_info->machines == NULL) {
5727 return NT_STATUS_ACCESS_DENIED;
5729 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5730 "starting machine enumeration at index %u\n",
5731 (unsigned int)enum_context));
5733 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5734 "using cached machine enumeration at index %u\n",
5735 (unsigned int)enum_context));
5737 num_account = pdb_search_entries(info->disp_info->machines,
5738 enum_context, max_entries,
5742 if (info->disp_info->groups == NULL) {
5743 info->disp_info->groups = pdb_search_groups(
5745 if (info->disp_info->groups == NULL) {
5747 return NT_STATUS_ACCESS_DENIED;
5749 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5750 "starting group enumeration at index %u\n",
5751 (unsigned int)enum_context));
5753 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5754 "using cached group enumeration at index %u\n",
5755 (unsigned int)enum_context));
5757 num_account = pdb_search_entries(info->disp_info->groups,
5758 enum_context, max_entries,
5763 smb_panic("info class changed");
5769 /* Ensure we cache this enumeration. */
5770 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
5772 DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
5773 r->in.name->string));
5775 for (i=0; i<num_account; i++) {
5776 if (strequal(entries[i].account_name, r->in.name->string)) {
5777 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5778 "found %s at idx %d\n",
5779 r->in.name->string, i));
5781 return NT_STATUS_OK;
5785 /* assuming account_name lives at the very end */
5786 *r->out.idx = num_account;
5788 return NT_STATUS_NO_MORE_ENTRIES;
5791 /****************************************************************
5792 _samr_GetDisplayEnumerationIndex2
5793 ****************************************************************/
5795 NTSTATUS _samr_GetDisplayEnumerationIndex2(pipes_struct *p,
5796 struct samr_GetDisplayEnumerationIndex2 *r)
5798 struct samr_GetDisplayEnumerationIndex q;
5800 q.in.domain_handle = r->in.domain_handle;
5801 q.in.level = r->in.level;
5802 q.in.name = r->in.name;
5804 q.out.idx = r->out.idx;
5806 return _samr_GetDisplayEnumerationIndex(p, &q);
5809 /****************************************************************
5810 ****************************************************************/
5812 NTSTATUS _samr_Shutdown(pipes_struct *p,
5813 struct samr_Shutdown *r)
5815 p->rng_fault_state = true;
5816 return NT_STATUS_NOT_IMPLEMENTED;
5819 /****************************************************************
5820 ****************************************************************/
5822 NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
5823 struct samr_SetMemberAttributesOfGroup *r)
5825 p->rng_fault_state = true;
5826 return NT_STATUS_NOT_IMPLEMENTED;
5829 /****************************************************************
5830 ****************************************************************/
5832 NTSTATUS _samr_ChangePasswordUser(pipes_struct *p,
5833 struct samr_ChangePasswordUser *r)
5835 p->rng_fault_state = true;
5836 return NT_STATUS_NOT_IMPLEMENTED;
5839 /****************************************************************
5840 ****************************************************************/
5842 NTSTATUS _samr_TestPrivateFunctionsDomain(pipes_struct *p,
5843 struct samr_TestPrivateFunctionsDomain *r)
5845 p->rng_fault_state = true;
5846 return NT_STATUS_NOT_IMPLEMENTED;
5849 /****************************************************************
5850 ****************************************************************/
5852 NTSTATUS _samr_TestPrivateFunctionsUser(pipes_struct *p,
5853 struct samr_TestPrivateFunctionsUser *r)
5855 p->rng_fault_state = true;
5856 return NT_STATUS_NOT_IMPLEMENTED;
5859 /****************************************************************
5860 ****************************************************************/
5862 NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
5863 struct samr_AddMultipleMembersToAlias *r)
5865 p->rng_fault_state = true;
5866 return NT_STATUS_NOT_IMPLEMENTED;
5869 /****************************************************************
5870 ****************************************************************/
5872 NTSTATUS _samr_RemoveMultipleMembersFromAlias(pipes_struct *p,
5873 struct samr_RemoveMultipleMembersFromAlias *r)
5875 p->rng_fault_state = true;
5876 return NT_STATUS_NOT_IMPLEMENTED;
5879 /****************************************************************
5880 ****************************************************************/
5882 NTSTATUS _samr_OemChangePasswordUser2(pipes_struct *p,
5883 struct samr_OemChangePasswordUser2 *r)
5885 p->rng_fault_state = true;
5886 return NT_STATUS_NOT_IMPLEMENTED;
5889 /****************************************************************
5890 ****************************************************************/
5892 NTSTATUS _samr_SetBootKeyInformation(pipes_struct *p,
5893 struct samr_SetBootKeyInformation *r)
5895 p->rng_fault_state = true;
5896 return NT_STATUS_NOT_IMPLEMENTED;
5899 /****************************************************************
5900 ****************************************************************/
5902 NTSTATUS _samr_GetBootKeyInformation(pipes_struct *p,
5903 struct samr_GetBootKeyInformation *r)
5905 p->rng_fault_state = true;
5906 return NT_STATUS_NOT_IMPLEMENTED;
5909 /****************************************************************
5910 ****************************************************************/
5912 NTSTATUS _samr_RidToSid(pipes_struct *p,
5913 struct samr_RidToSid *r)
5915 p->rng_fault_state = true;
5916 return NT_STATUS_NOT_IMPLEMENTED;
5919 /****************************************************************
5920 ****************************************************************/
5922 NTSTATUS _samr_SetDsrmPassword(pipes_struct *p,
5923 struct samr_SetDsrmPassword *r)
5925 p->rng_fault_state = true;
5926 return NT_STATUS_NOT_IMPLEMENTED;
5929 /****************************************************************
5930 ****************************************************************/
5932 NTSTATUS _samr_ValidatePassword(pipes_struct *p,
5933 struct samr_ValidatePassword *r)
5935 p->rng_fault_state = true;
5936 return NT_STATUS_NOT_IMPLEMENTED;