source3/utils/net_ads.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    net ads commands
   4    Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
   5    Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
   6    Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
   7    Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "utils/net.h"
  25
  26 #include "libnet/libnet.h"
  27
  28 #ifdef HAVE_ADS
  29
  30 /* when we do not have sufficient input parameters to contact a remote domain
  31  * we always fall back to our own realm - Guenther*/
  32
  33 static const char *assume_own_realm(struct net_context *c)
  34 {
  35         if (!c->opt_host && strequal(lp_workgroup(), c->opt_target_workgroup)) {
  36                 return lp_realm();
  37         }
  38
  39         return NULL;
  40 }
  41
  42 /*
  43   do a cldap netlogon query
  44 */
  45 static int net_ads_cldap_netlogon(struct net_context *c, ADS_STRUCT *ads)
  46 {
  47         char addr[INET6_ADDRSTRLEN];
  48         struct nbt_cldap_netlogon_5 reply;
  49
  50         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
  51         if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
  52                 d_fprintf(stderr, "CLDAP query failed!\n");
  53                 return -1;
  54         }
  55
  56         d_printf("Information for Domain Controller: %s\n\n",
  57                 addr);
  58
  59         d_printf("Response Type: ");
  60         switch (reply.type) {
  61         case SAMLOGON_AD_UNK_R:
  62                 d_printf("SAMLOGON\n");
  63                 break;
  64         case SAMLOGON_AD_R:
  65                 d_printf("SAMLOGON_USER\n");
  66                 break;
  67         default:
  68                 d_printf("0x%x\n", reply.type);
  69                 break;
  70         }
  71
  72         d_printf("GUID: %s\n", smb_uuid_string(talloc_tos(), reply.domain_uuid));
  73
  74         d_printf("Flags:\n"
  75                  "\tIs a PDC:                                   %s\n"
  76                  "\tIs a GC of the forest:                      %s\n"
  77                  "\tIs an LDAP server:                          %s\n"
  78                  "\tSupports DS:                                %s\n"
  79                  "\tIs running a KDC:                           %s\n"
  80                  "\tIs running time services:                   %s\n"
  81                  "\tIs the closest DC:                          %s\n"
  82                  "\tIs writable:                                %s\n"
  83                  "\tHas a hardware clock:                       %s\n"
  84                  "\tIs a non-domain NC serviced by LDAP server: %s\n"
  85                  "\tIs NT6 DC that has some secrets:            %s\n"
  86                  "\tIs NT6 DC that has all secrets:             %s\n",
  87                  (reply.server_type & NBT_SERVER_PDC) ? "yes" : "no",
  88                  (reply.server_type & NBT_SERVER_GC) ? "yes" : "no",
  89                  (reply.server_type & NBT_SERVER_LDAP) ? "yes" : "no",
  90                  (reply.server_type & NBT_SERVER_DS) ? "yes" : "no",
  91                  (reply.server_type & NBT_SERVER_KDC) ? "yes" : "no",
  92                  (reply.server_type & NBT_SERVER_TIMESERV) ? "yes" : "no",
  93                  (reply.server_type & NBT_SERVER_CLOSEST) ? "yes" : "no",
  94                  (reply.server_type & NBT_SERVER_WRITABLE) ? "yes" : "no",
  95                  (reply.server_type & NBT_SERVER_GOOD_TIMESERV) ? "yes" : "no",
  96                  (reply.server_type & NBT_SERVER_NDNC) ? "yes" : "no",
  97                  (reply.server_type & NBT_SERVER_SELECT_SECRET_DOMAIN_6) ? "yes" : "no",
  98                  (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? "yes" : "no");
  99
 100
 101         printf("Forest:\t\t\t%s\n", reply.forest);
 102         printf("Domain:\t\t\t%s\n", reply.dns_domain);
 103         printf("Domain Controller:\t%s\n", reply.pdc_dns_name);
 104
 105         printf("Pre-Win2k Domain:\t%s\n", reply.domain);
 106         printf("Pre-Win2k Hostname:\t%s\n", reply.pdc_name);
 107
 108         if (*reply.user_name) printf("User name:\t%s\n", reply.user_name);
 109
 110         printf("Server Site Name :\t\t%s\n", reply.server_site);
 111         printf("Client Site Name :\t\t%s\n", reply.client_site);
 112
 113         d_printf("NT Version: %d\n", reply.nt_version);
 114         d_printf("LMNT Token: %.2x\n", reply.lmnt_token);
 115         d_printf("LM20 Token: %.2x\n", reply.lm20_token);
 116
 117         return 0;
 118 }
 119
 120 /*
 121   this implements the CLDAP based netlogon lookup requests
 122   for finding the domain controller of a ADS domain
 123 */
 124 static int net_ads_lookup(struct net_context *c, int argc, const char **argv)
 125 {
 126         ADS_STRUCT *ads;
 127
 128         if (c->display_usage) {
 129                 d_printf("Usage:\n"
 130                          "net ads lookup\n"
 131                          "    Find the ADS DC using CLDAP lookup.\n");
 132                 return 0;
 133         }
 134
 135         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
 136                 d_fprintf(stderr, "Didn't find the cldap server!\n");
 137                 return -1;
 138         }
 139
 140         if (!ads->config.realm) {
 141                 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
 142                 ads->ldap.port = 389;
 143         }
 144
 145         return net_ads_cldap_netlogon(c, ads);
 146 }
 147
 148
 149
 150 static int net_ads_info(struct net_context *c, int argc, const char **argv)
 151 {
 152         ADS_STRUCT *ads;
 153         char addr[INET6_ADDRSTRLEN];
 154
 155         if (c->display_usage) {
 156                 d_printf("Usage:\n"
 157                          "net ads info\n"
 158                          "    Display information about an Active Directory "
 159                          "server.\n");
 160                 return 0;
 161         }
 162
 163         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
 164                 d_fprintf(stderr, "Didn't find the ldap server!\n");
 165                 return -1;
 166         }
 167
 168         if (!ads || !ads->config.realm) {
 169                 d_fprintf(stderr, "Didn't find the ldap server!\n");
 170                 return -1;
 171         }
 172
 173         /* Try to set the server's current time since we didn't do a full
 174            TCP LDAP session initially */
 175
 176         if ( !ADS_ERR_OK(ads_current_time( ads )) ) {
 177                 d_fprintf( stderr, "Failed to get server's current time!\n");
 178         }
 179
 180         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
 181
 182         d_printf("LDAP server: %s\n", addr);
 183         d_printf("LDAP server name: %s\n", ads->config.ldap_server_name);
 184         d_printf("Realm: %s\n", ads->config.realm);
 185         d_printf("Bind Path: %s\n", ads->config.bind_path);
 186         d_printf("LDAP port: %d\n", ads->ldap.port);
 187         d_printf("Server time: %s\n", http_timestring(ads->config.current_time));
 188
 189         d_printf("KDC server: %s\n", ads->auth.kdc_server );
 190         d_printf("Server time offset: %d\n", ads->auth.time_offset );
 191
 192         return 0;
 193 }
 194
 195 static void use_in_memory_ccache(void) {
 196         /* Use in-memory credentials cache so we do not interfere with
 197          * existing credentials */
 198         setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
 199 }
 200
 201 static ADS_STATUS ads_startup_int(struct net_context *c, bool only_own_domain,
 202                                   uint32 auth_flags, ADS_STRUCT **ads_ret)
 203 {
 204         ADS_STRUCT *ads = NULL;
 205         ADS_STATUS status;
 206         bool need_password = false;
 207         bool second_time = false;
 208         char *cp;
 209         const char *realm = NULL;
 210         bool tried_closest_dc = false;
 211
 212         /* lp_realm() should be handled by a command line param,
 213            However, the join requires that realm be set in smb.conf
 214            and compares our realm with the remote server's so this is
 215            ok until someone needs more flexibility */
 216
 217         *ads_ret = NULL;
 218
 219 retry_connect:
 220         if (only_own_domain) {
 221                 realm = lp_realm();
 222         } else {
 223                 realm = assume_own_realm(c);
 224         }
 225
 226         ads = ads_init(realm, c->opt_target_workgroup, c->opt_host);
 227
 228         if (!c->opt_user_name) {
 229                 c->opt_user_name = "administrator";
 230         }
 231
 232         if (c->opt_user_specified) {
 233                 need_password = true;
 234         }
 235
 236 retry:
 237         if (!c->opt_password && need_password && !c->opt_machine_pass) {
 238                 c->opt_password = net_prompt_pass(c, c->opt_user_name);
 239                 if (!c->opt_password) {
 240                         ads_destroy(&ads);
 241                         return ADS_ERROR(LDAP_NO_MEMORY);
 242                 }
 243         }
 244
 245         if (c->opt_password) {
 246                 use_in_memory_ccache();
 247                 SAFE_FREE(ads->auth.password);
 248                 ads->auth.password = smb_xstrdup(c->opt_password);
 249         }
 250
 251         ads->auth.flags |= auth_flags;
 252         SAFE_FREE(ads->auth.user_name);
 253         ads->auth.user_name = smb_xstrdup(c->opt_user_name);
 254
 255        /*
 256         * If the username is of the form "name@realm",
 257         * extract the realm and convert to upper case.
 258         * This is only used to establish the connection.
 259         */
 260        if ((cp = strchr_m(ads->auth.user_name, '@'))!=0) {
 261                 *cp++ = '\0';
 262                 SAFE_FREE(ads->auth.realm);
 263                 ads->auth.realm = smb_xstrdup(cp);
 264                 strupper_m(ads->auth.realm);
 265        }
 266
 267         status = ads_connect(ads);
 268
 269         if (!ADS_ERR_OK(status)) {
 270
 271                 if (NT_STATUS_EQUAL(ads_ntstatus(status),
 272                                     NT_STATUS_NO_LOGON_SERVERS)) {
 273                         DEBUG(0,("ads_connect: %s\n", ads_errstr(status)));
 274                         ads_destroy(&ads);
 275                         return status;
 276                 }
 277
 278                 if (!need_password && !second_time && !(auth_flags & ADS_AUTH_NO_BIND)) {
 279                         need_password = true;
 280                         second_time = true;
 281                         goto retry;
 282                 } else {
 283                         ads_destroy(&ads);
 284                         return status;
 285                 }
 286         }
 287
 288         /* when contacting our own domain, make sure we use the closest DC.
 289          * This is done by reconnecting to ADS because only the first call to
 290          * ads_connect will give us our own sitename */
 291
 292         if ((only_own_domain || !c->opt_host) && !tried_closest_dc) {
 293
 294                 tried_closest_dc = true; /* avoid loop */
 295
 296                 if (!ads->config.tried_closest_dc) {
 297
 298                         namecache_delete(ads->server.realm, 0x1C);
 299                         namecache_delete(ads->server.workgroup, 0x1C);
 300
 301                         ads_destroy(&ads);
 302                         ads = NULL;
 303
 304                         goto retry_connect;
 305                 }
 306         }
 307
 308         *ads_ret = ads;
 309         return status;
 310 }
 311
 312 ADS_STATUS ads_startup(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
 313 {
 314         return ads_startup_int(c, only_own_domain, 0, ads);
 315 }
 316
 317 ADS_STATUS ads_startup_nobind(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
 318 {
 319         return ads_startup_int(c, only_own_domain, ADS_AUTH_NO_BIND, ads);
 320 }
 321
 322 /*
 323   Check to see if connection can be made via ads.
 324   ads_startup() stores the password in opt_password if it needs to so
 325   that rpc or rap can use it without re-prompting.
 326 */
 327 static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
 328 {
 329         ADS_STRUCT *ads;
 330         ADS_STATUS status;
 331
 332         if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
 333                 return -1;
 334         }
 335
 336         ads->auth.flags |= ADS_AUTH_NO_BIND;
 337
 338         status = ads_connect(ads);
 339         if ( !ADS_ERR_OK(status) ) {
 340                 return -1;
 341         }
 342
 343         ads_destroy(&ads);
 344         return 0;
 345 }
 346
 347 int net_ads_check_our_domain(struct net_context *c)
 348 {
 349         return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
 350 }
 351
 352 int net_ads_check(struct net_context *c)
 353 {
 354         return net_ads_check_int(NULL, c->opt_workgroup, c->opt_host);
 355 }
 356
 357 /*
 358    determine the netbios workgroup name for a domain
 359  */
 360 static int net_ads_workgroup(struct net_context *c, int argc, const char **argv)
 361 {
 362         ADS_STRUCT *ads;
 363         char addr[INET6_ADDRSTRLEN];
 364         struct nbt_cldap_netlogon_5 reply;
 365
 366         if (c->display_usage) {
 367                 d_printf("Usage:\n"
 368                          "net ads workgroup\n"
 369                          "    Print the workgroup name\n");
 370                 return 0;
 371         }
 372
 373         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
 374                 d_fprintf(stderr, "Didn't find the cldap server!\n");
 375                 return -1;
 376         }
 377
 378         if (!ads->config.realm) {
 379                 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
 380                 ads->ldap.port = 389;
 381         }
 382
 383         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
 384         if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
 385                 d_fprintf(stderr, "CLDAP query failed!\n");
 386                 return -1;
 387         }
 388
 389         d_printf("Workgroup: %s\n", reply.domain);
 390
 391         ads_destroy(&ads);
 392
 393         return 0;
 394 }
 395
 396
 397
 398 static bool usergrp_display(ADS_STRUCT *ads, char *field, void **values, void *data_area)
 399 {
 400         char **disp_fields = (char **) data_area;
 401
 402         if (!field) { /* must be end of record */
 403                 if (disp_fields[0]) {
 404                         if (!strchr_m(disp_fields[0], '$')) {
 405                                 if (disp_fields[1])
 406                                         d_printf("%-21.21s %s\n",
 407                                                disp_fields[0], disp_fields[1]);
 408                                 else
 409                                         d_printf("%s\n", disp_fields[0]);
 410                         }
 411                 }
 412                 SAFE_FREE(disp_fields[0]);
 413                 SAFE_FREE(disp_fields[1]);
 414                 return true;
 415         }
 416         if (!values) /* must be new field, indicate string field */
 417                 return true;
 418         if (StrCaseCmp(field, "sAMAccountName") == 0) {
 419                 disp_fields[0] = SMB_STRDUP((char *) values[0]);
 420         }
 421         if (StrCaseCmp(field, "description") == 0)
 422                 disp_fields[1] = SMB_STRDUP((char *) values[0]);
 423         return true;
 424 }
 425
 426 static int net_ads_user_usage(struct net_context *c, int argc, const char **argv)
 427 {
 428         return net_user_usage(c, argc, argv);
 429 }
 430
 431 static int ads_user_add(struct net_context *c, int argc, const char **argv)
 432 {
 433         ADS_STRUCT *ads;
 434         ADS_STATUS status;
 435         char *upn, *userdn;
 436         LDAPMessage *res=NULL;
 437         int rc = -1;
 438         char *ou_str = NULL;
 439
 440         if (argc < 1 || c->display_usage)
 441                 return net_ads_user_usage(c, argc, argv);
 442
 443         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 444                 return -1;
 445         }
 446
 447         status = ads_find_user_acct(ads, &res, argv[0]);
 448
 449         if (!ADS_ERR_OK(status)) {
 450                 d_fprintf(stderr, "ads_user_add: %s\n", ads_errstr(status));
 451                 goto done;
 452         }
 453
 454         if (ads_count_replies(ads, res)) {
 455                 d_fprintf(stderr, "ads_user_add: User %s already exists\n", argv[0]);
 456                 goto done;
 457         }
 458
 459         if (c->opt_container) {
 460                 ou_str = SMB_STRDUP(c->opt_container);
 461         } else {
 462                 ou_str = ads_default_ou_string(ads, WELL_KNOWN_GUID_USERS);
 463         }
 464
 465         status = ads_add_user_acct(ads, argv[0], ou_str, c->opt_comment);
 466
 467         if (!ADS_ERR_OK(status)) {
 468                 d_fprintf(stderr, "Could not add user %s: %s\n", argv[0],
 469                          ads_errstr(status));
 470                 goto done;
 471         }
 472
 473         /* if no password is to be set, we're done */
 474         if (argc == 1) {
 475                 d_printf("User %s added\n", argv[0]);
 476                 rc = 0;
 477                 goto done;
 478         }
 479
 480         /* try setting the password */
 481         asprintf(&upn, "%s@%s", argv[0], ads->config.realm);
 482         status = ads_krb5_set_password(ads->auth.kdc_server, upn, argv[1],
 483                                        ads->auth.time_offset);
 484         safe_free(upn);
 485         if (ADS_ERR_OK(status)) {
 486                 d_printf("User %s added\n", argv[0]);
 487                 rc = 0;
 488                 goto done;
 489         }
 490
 491         /* password didn't set, delete account */
 492         d_fprintf(stderr, "Could not add user %s.  Error setting password %s\n",
 493                  argv[0], ads_errstr(status));
 494         ads_msgfree(ads, res);
 495         status=ads_find_user_acct(ads, &res, argv[0]);
 496         if (ADS_ERR_OK(status)) {
 497                 userdn = ads_get_dn(ads, res);
 498                 ads_del_dn(ads, userdn);
 499                 ads_memfree(ads, userdn);
 500         }
 501
 502  done:
 503         if (res)
 504                 ads_msgfree(ads, res);
 505         ads_destroy(&ads);
 506         SAFE_FREE(ou_str);
 507         return rc;
 508 }
 509
 510 static int ads_user_info(struct net_context *c, int argc, const char **argv)
 511 {
 512         ADS_STRUCT *ads;
 513         ADS_STATUS rc;
 514         LDAPMessage *res;
 515         const char *attrs[] = {"memberOf", NULL};
 516         char *searchstring=NULL;
 517         char **grouplist;
 518         char *escaped_user;
 519
 520         if (argc < 1 || c->display_usage) {
 521                 return net_ads_user_usage(c, argc, argv);
 522         }
 523
 524         escaped_user = escape_ldap_string_alloc(argv[0]);
 525
 526         if (!escaped_user) {
 527                 d_fprintf(stderr, "ads_user_info: failed to escape user %s\n", argv[0]);
 528                 return -1;
 529         }
 530
 531         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 532                 SAFE_FREE(escaped_user);
 533                 return -1;
 534         }
 535
 536         asprintf(&searchstring, "(sAMAccountName=%s)", escaped_user);
 537         rc = ads_search(ads, &res, searchstring, attrs);
 538         safe_free(searchstring);
 539
 540         if (!ADS_ERR_OK(rc)) {
 541                 d_fprintf(stderr, "ads_search: %s\n", ads_errstr(rc));
 542                 ads_destroy(&ads);
 543                 SAFE_FREE(escaped_user);
 544                 return -1;
 545         }
 546
 547         grouplist = ldap_get_values((LDAP *)ads->ldap.ld,
 548                                     (LDAPMessage *)res, "memberOf");
 549
 550         if (grouplist) {
 551                 int i;
 552                 char **groupname;
 553                 for (i=0;grouplist[i];i++) {
 554                         groupname = ldap_explode_dn(grouplist[i], 1);
 555                         d_printf("%s\n", groupname[0]);
 556                         ldap_value_free(groupname);
 557                 }
 558                 ldap_value_free(grouplist);
 559         }
 560
 561         ads_msgfree(ads, res);
 562         ads_destroy(&ads);
 563         SAFE_FREE(escaped_user);
 564         return 0;
 565 }
 566
 567 static int ads_user_delete(struct net_context *c, int argc, const char **argv)
 568 {
 569         ADS_STRUCT *ads;
 570         ADS_STATUS rc;
 571         LDAPMessage *res = NULL;
 572         char *userdn;
 573
 574         if (argc < 1) {
 575                 return net_ads_user_usage(c, argc, argv);
 576         }
 577
 578         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 579                 return -1;
 580         }
 581
 582         rc = ads_find_user_acct(ads, &res, argv[0]);
 583         if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
 584                 d_printf("User %s does not exist.\n", argv[0]);
 585                 ads_msgfree(ads, res);
 586                 ads_destroy(&ads);
 587                 return -1;
 588         }
 589         userdn = ads_get_dn(ads, res);
 590         ads_msgfree(ads, res);
 591         rc = ads_del_dn(ads, userdn);
 592         ads_memfree(ads, userdn);
 593         if (ADS_ERR_OK(rc)) {
 594                 d_printf("User %s deleted\n", argv[0]);
 595                 ads_destroy(&ads);
 596                 return 0;
 597         }
 598         d_fprintf(stderr, "Error deleting user %s: %s\n", argv[0],
 599                  ads_errstr(rc));
 600         ads_destroy(&ads);
 601         return -1;
 602 }
 603
 604 int net_ads_user(struct net_context *c, int argc, const char **argv)
 605 {
 606         struct functable3 func[] = {
 607                 {
 608                         "add",
 609                         ads_user_add,
 610                         NET_TRANSPORT_ADS,
 611                         "Add an AD user",
 612                         "net ads user add\n"
 613                         "    Add an AD user"
 614                 },
 615                 {
 616                         "info",
 617                         ads_user_info,
 618                         NET_TRANSPORT_ADS,
 619                         "Display information about an AD user",
 620                         "net ads user info\n"
 621                         "    Display information about an AD user"
 622                 },
 623                 {
 624                         "delete",
 625                         ads_user_delete,
 626                         NET_TRANSPORT_ADS,
 627                         "Delete an AD user",
 628                         "net ads user delete\n"
 629                         "    Delete an AD user"
 630                 },
 631                 {NULL, NULL, 0, NULL, NULL}
 632         };
 633         ADS_STRUCT *ads;
 634         ADS_STATUS rc;
 635         const char *shortattrs[] = {"sAMAccountName", NULL};
 636         const char *longattrs[] = {"sAMAccountName", "description", NULL};
 637         char *disp_fields[2] = {NULL, NULL};
 638
 639         if (argc == 0) {
 640                 if (c->display_usage) {
 641                         d_printf("Usage:\n");
 642                         d_printf("net ads user\n"
 643                                  "    List AD users\n");
 644                         net_display_usage_from_functable(func);
 645                         return 0;
 646                 }
 647
 648                 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 649                         return -1;
 650                 }
 651
 652                 if (c->opt_long_list_entries)
 653                         d_printf("\nUser name             Comment"
 654                                  "\n-----------------------------\n");
 655
 656                 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
 657                                           LDAP_SCOPE_SUBTREE,
 658                                           "(objectCategory=user)",
 659                                           c->opt_long_list_entries ? longattrs :
 660                                           shortattrs, usergrp_display,
 661                                           disp_fields);
 662                 ads_destroy(&ads);
 663                 return ADS_ERR_OK(rc) ? 0 : -1;
 664         }
 665
 666         return net_run_function3(c, argc, argv, "net ads user", func);
 667 }
 668
 669 static int net_ads_group_usage(struct net_context *c, int argc, const char **argv)
 670 {
 671         return net_group_usage(c, argc, argv);
 672 }
 673
 674 static int ads_group_add(struct net_context *c, int argc, const char **argv)
 675 {
 676         ADS_STRUCT *ads;
 677         ADS_STATUS status;
 678         LDAPMessage *res=NULL;
 679         int rc = -1;
 680         char *ou_str = NULL;
 681
 682         if (argc < 1 || c->display_usage) {
 683                 return net_ads_group_usage(c, argc, argv);
 684         }
 685
 686         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 687                 return -1;
 688         }
 689
 690         status = ads_find_user_acct(ads, &res, argv[0]);
 691
 692         if (!ADS_ERR_OK(status)) {
 693                 d_fprintf(stderr, "ads_group_add: %s\n", ads_errstr(status));
 694                 goto done;
 695         }
 696
 697         if (ads_count_replies(ads, res)) {
 698                 d_fprintf(stderr, "ads_group_add: Group %s already exists\n", argv[0]);
 699                 goto done;
 700         }
 701
 702         if (c->opt_container) {
 703                 ou_str = SMB_STRDUP(c->opt_container);
 704         } else {
 705                 ou_str = ads_default_ou_string(ads, WELL_KNOWN_GUID_USERS);
 706         }
 707
 708         status = ads_add_group_acct(ads, argv[0], ou_str, c->opt_comment);
 709
 710         if (ADS_ERR_OK(status)) {
 711                 d_printf("Group %s added\n", argv[0]);
 712                 rc = 0;
 713         } else {
 714                 d_fprintf(stderr, "Could not add group %s: %s\n", argv[0],
 715                          ads_errstr(status));
 716         }
 717
 718  done:
 719         if (res)
 720                 ads_msgfree(ads, res);
 721         ads_destroy(&ads);
 722         SAFE_FREE(ou_str);
 723         return rc;
 724 }
 725
 726 static int ads_group_delete(struct net_context *c, int argc, const char **argv)
 727 {
 728         ADS_STRUCT *ads;
 729         ADS_STATUS rc;
 730         LDAPMessage *res = NULL;
 731         char *groupdn;
 732
 733         if (argc < 1 || c->display_usage) {
 734                 return net_ads_group_usage(c, argc, argv);
 735         }
 736
 737         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 738                 return -1;
 739         }
 740
 741         rc = ads_find_user_acct(ads, &res, argv[0]);
 742         if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
 743                 d_printf("Group %s does not exist.\n", argv[0]);
 744                 ads_msgfree(ads, res);
 745                 ads_destroy(&ads);
 746                 return -1;
 747         }
 748         groupdn = ads_get_dn(ads, res);
 749         ads_msgfree(ads, res);
 750         rc = ads_del_dn(ads, groupdn);
 751         ads_memfree(ads, groupdn);
 752         if (ADS_ERR_OK(rc)) {
 753                 d_printf("Group %s deleted\n", argv[0]);
 754                 ads_destroy(&ads);
 755                 return 0;
 756         }
 757         d_fprintf(stderr, "Error deleting group %s: %s\n", argv[0],
 758                  ads_errstr(rc));
 759         ads_destroy(&ads);
 760         return -1;
 761 }
 762
 763 int net_ads_group(struct net_context *c, int argc, const char **argv)
 764 {
 765         struct functable3 func[] = {
 766                 {
 767                         "add",
 768                         ads_group_add,
 769                         NET_TRANSPORT_ADS,
 770                         "Add an AD group",
 771                         "net ads group add\n"
 772                         "    Add an AD group"
 773                 },
 774                 {
 775                         "delete",
 776                         ads_group_delete,
 777                         NET_TRANSPORT_ADS,
 778                         "Delete an AD group",
 779                         "net ads group delete\n"
 780                         "    Delete an AD group"
 781                 },
 782                 {NULL, NULL, 0, NULL, NULL}
 783         };
 784         ADS_STRUCT *ads;
 785         ADS_STATUS rc;
 786         const char *shortattrs[] = {"sAMAccountName", NULL};
 787         const char *longattrs[] = {"sAMAccountName", "description", NULL};
 788         char *disp_fields[2] = {NULL, NULL};
 789
 790         if (argc == 0) {
 791                 if (c->display_usage) {
 792                         d_printf("Usage:\n");
 793                         d_printf("net ads group\n"
 794                                  "    List AD groups\n");
 795                         net_display_usage_from_functable(func);
 796                         return 0;
 797                 }
 798
 799                 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 800                         return -1;
 801                 }
 802
 803                 if (c->opt_long_list_entries)
 804                         d_printf("\nGroup name            Comment"
 805                                  "\n-----------------------------\n");
 806                 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
 807                                           LDAP_SCOPE_SUBTREE,
 808                                           "(objectCategory=group)",
 809                                           c->opt_long_list_entries ? longattrs :
 810                                           shortattrs, usergrp_display,
 811                                           disp_fields);
 812
 813                 ads_destroy(&ads);
 814                 return ADS_ERR_OK(rc) ? 0 : -1;
 815         }
 816         return net_run_function3(c, argc, argv, "net ads group", func);
 817 }
 818
 819 static int net_ads_status(struct net_context *c, int argc, const char **argv)
 820 {
 821         ADS_STRUCT *ads;
 822         ADS_STATUS rc;
 823         LDAPMessage *res;
 824
 825         if (c->display_usage) {
 826                 d_printf("Usage:\n"
 827                          "net ads status\n"
 828                          "    Display machine account details\n");
 829                 return 0;
 830         }
 831
 832         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
 833                 return -1;
 834         }
 835
 836         rc = ads_find_machine_acct(ads, &res, global_myname());
 837         if (!ADS_ERR_OK(rc)) {
 838                 d_fprintf(stderr, "ads_find_machine_acct: %s\n", ads_errstr(rc));
 839                 ads_destroy(&ads);
 840                 return -1;
 841         }
 842
 843         if (ads_count_replies(ads, res) == 0) {
 844                 d_fprintf(stderr, "No machine account for '%s' found\n", global_myname());
 845                 ads_destroy(&ads);
 846                 return -1;
 847         }
 848
 849         ads_dump(ads, res);
 850         ads_destroy(&ads);
 851         return 0;
 852 }
 853
 854 /*******************************************************************
 855  Leave an AD domain.  Windows XP disables the machine account.
 856  We'll try the same.  The old code would do an LDAP delete.
 857  That only worked using the machine creds because added the machine
 858  with full control to the computer object's ACL.
 859 *******************************************************************/
 860
 861 static int net_ads_leave(struct net_context *c, int argc, const char **argv)
 862 {
 863         TALLOC_CTX *ctx;
 864         struct libnet_UnjoinCtx *r = NULL;
 865         WERROR werr;
 866
 867         if (c->display_usage) {
 868                 d_printf("Usage:\n"
 869                          "net ads leave\n"
 870                          "    Leave an AD domain\n");
 871                 return 0;
 872         }
 873
 874         if (!*lp_realm()) {
 875                 d_fprintf(stderr, "No realm set, are we joined ?\n");
 876                 return -1;
 877         }
 878
 879         if (!(ctx = talloc_init("net_ads_leave"))) {
 880                 d_fprintf(stderr, "Could not initialise talloc context.\n");
 881                 return -1;
 882         }
 883
 884         use_in_memory_ccache();
 885
 886         werr = libnet_init_UnjoinCtx(ctx, &r);
 887         if (!W_ERROR_IS_OK(werr)) {
 888                 d_fprintf(stderr, "Could not initialise unjoin context.\n");
 889                 return -1;
 890         }
 891
 892         r->in.debug             = true;
 893         r->in.dc_name           = c->opt_host;
 894         r->in.domain_name       = lp_realm();
 895         r->in.admin_account     = c->opt_user_name;
 896         r->in.admin_password    = net_prompt_pass(c, c->opt_user_name);
 897         r->in.modify_config     = lp_config_backend_is_registry();
 898         r->in.unjoin_flags      = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
 899                                   WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
 900
 901         werr = libnet_Unjoin(ctx, r);
 902         if (!W_ERROR_IS_OK(werr)) {
 903                 d_printf("Failed to leave domain: %s\n",
 904                          r->out.error_string ? r->out.error_string :
 905                          get_friendly_werror_msg(werr));
 906                 goto done;
 907         }
 908
 909         if (W_ERROR_IS_OK(werr)) {
 910                 d_printf("Deleted account for '%s' in realm '%s'\n",
 911                         r->in.machine_name, r->out.dns_domain_name);
 912                 goto done;
 913         }
 914
 915         /* We couldn't delete it - see if the disable succeeded. */
 916         if (r->out.disabled_machine_account) {
 917                 d_printf("Disabled account for '%s' in realm '%s'\n",
 918                         r->in.machine_name, r->out.dns_domain_name);
 919                 werr = WERR_OK;
 920                 goto done;
 921         }
 922
 923         d_fprintf(stderr, "Failed to disable machine account for '%s' in realm '%s'\n",
 924                   r->in.machine_name, r->out.dns_domain_name);
 925
 926  done:
 927         TALLOC_FREE(r);
 928         TALLOC_FREE(ctx);
 929
 930         if (W_ERROR_IS_OK(werr)) {
 931                 return 0;
 932         }
 933
 934         return -1;
 935 }
 936
 937 static NTSTATUS net_ads_join_ok(struct net_context *c)
 938 {
 939         ADS_STRUCT *ads = NULL;
 940         ADS_STATUS status;
 941
 942         if (!secrets_init()) {
 943                 DEBUG(1,("Failed to initialise secrets database\n"));
 944                 return NT_STATUS_ACCESS_DENIED;
 945         }
 946
 947         net_use_krb_machine_account(c);
 948
 949         status = ads_startup(c, true, &ads);
 950         if (!ADS_ERR_OK(status)) {
 951                 return ads_ntstatus(status);
 952         }
 953
 954         ads_destroy(&ads);
 955         return NT_STATUS_OK;
 956 }
 957
 958 /*
 959   check that an existing join is OK
 960  */
 961 int net_ads_testjoin(struct net_context *c, int argc, const char **argv)
 962 {
 963         NTSTATUS status;
 964         use_in_memory_ccache();
 965
 966         if (c->display_usage) {
 967                 d_printf("Usage:\n"
 968                          "net ads testjoin\n"
 969                          "    Test if the existing join is ok\n");
 970                 return 0;
 971         }
 972
 973         /* Display success or failure */
 974         status = net_ads_join_ok(c);
 975         if (!NT_STATUS_IS_OK(status)) {
 976                 fprintf(stderr,"Join to domain is not valid: %s\n",
 977                         get_friendly_nt_error_msg(status));
 978                 return -1;
 979         }
 980
 981         printf("Join is OK\n");
 982         return 0;
 983 }
 984
 985 /*******************************************************************
 986   Simple configu checks before beginning the join
 987  ********************************************************************/
 988
 989 static WERROR check_ads_config( void )
 990 {
 991         if (lp_server_role() != ROLE_DOMAIN_MEMBER ) {
 992                 d_printf("Host is not configured as a member server.\n");
 993                 return WERR_INVALID_DOMAIN_ROLE;
 994         }
 995
 996         if (strlen(global_myname()) > 15) {
 997                 d_printf("Our netbios name can be at most 15 chars long, "
 998                          "\"%s\" is %u chars long\n", global_myname(),
 999                          (unsigned int)strlen(global_myname()));
1000                 return WERR_INVALID_COMPUTER_NAME;
1001         }
1002
1003         if ( lp_security() == SEC_ADS && !*lp_realm()) {
1004                 d_fprintf(stderr, "realm must be set in in %s for ADS "
1005                         "join to succeed.\n", get_dyn_CONFIGFILE());
1006                 return WERR_INVALID_PARAM;
1007         }
1008
1009         return WERR_OK;
1010 }
1011
1012 /*******************************************************************
1013  Send a DNS update request
1014 *******************************************************************/
1015
1016 #if defined(WITH_DNS_UPDATES)
1017 #include "dns.h"
1018 DNS_ERROR DoDNSUpdate(char *pszServerName,
1019                       const char *pszDomainName, const char *pszHostName,
1020                       const struct sockaddr_storage *sslist,
1021                       size_t num_addrs );
1022
1023 static NTSTATUS net_update_dns_internal(TALLOC_CTX *ctx, ADS_STRUCT *ads,
1024                                         const char *machine_name,
1025                                         const struct sockaddr_storage *addrs,
1026                                         int num_addrs)
1027 {
1028         struct dns_rr_ns *nameservers = NULL;
1029         int ns_count = 0;
1030         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1031         DNS_ERROR dns_err;
1032         fstring dns_server;
1033         const char *dnsdomain = NULL;
1034         char *root_domain = NULL;
1035
1036         if ( (dnsdomain = strchr_m( machine_name, '.')) == NULL ) {
1037                 d_printf("No DNS domain configured for %s. "
1038                          "Unable to perform DNS Update.\n", machine_name);
1039                 status = NT_STATUS_INVALID_PARAMETER;
1040                 goto done;
1041         }
1042         dnsdomain++;
1043
1044         status = ads_dns_lookup_ns( ctx, dnsdomain, &nameservers, &ns_count );
1045         if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1046                 /* Child domains often do not have NS records.  Look
1047                    for the NS record for the forest root domain
1048                    (rootDomainNamingContext in therootDSE) */
1049
1050                 const char *rootname_attrs[] =  { "rootDomainNamingContext", NULL };
1051                 LDAPMessage *msg = NULL;
1052                 char *root_dn;
1053                 ADS_STATUS ads_status;
1054
1055                 if ( !ads->ldap.ld ) {
1056                         ads_status = ads_connect( ads );
1057                         if ( !ADS_ERR_OK(ads_status) ) {
1058                                 DEBUG(0,("net_update_dns_internal: Failed to connect to our DC!\n"));
1059                                 goto done;
1060                         }
1061                 }
1062
1063                 ads_status = ads_do_search(ads, "", LDAP_SCOPE_BASE,
1064                                        "(objectclass=*)", rootname_attrs, &msg);
1065                 if (!ADS_ERR_OK(ads_status)) {
1066                         goto done;
1067                 }
1068
1069                 root_dn = ads_pull_string(ads, ctx, msg,  "rootDomainNamingContext");
1070                 if ( !root_dn ) {
1071                         ads_msgfree( ads, msg );
1072                         goto done;
1073                 }
1074
1075                 root_domain = ads_build_domain( root_dn );
1076
1077                 /* cleanup */
1078                 ads_msgfree( ads, msg );
1079
1080                 /* try again for NS servers */
1081
1082                 status = ads_dns_lookup_ns( ctx, root_domain, &nameservers, &ns_count );
1083
1084                 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1085                         DEBUG(3,("net_ads_join: Failed to find name server for the %s "
1086                          "realm\n", ads->config.realm));
1087                         goto done;
1088                 }
1089
1090                 dnsdomain = root_domain;
1091
1092         }
1093
1094         /* Now perform the dns update - we'll try non-secure and if we fail,
1095            we'll follow it up with a secure update */
1096
1097         fstrcpy( dns_server, nameservers[0].hostname );
1098
1099         dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs);
1100         if (!ERR_DNS_IS_OK(dns_err)) {
1101                 status = NT_STATUS_UNSUCCESSFUL;
1102         }
1103
1104 done:
1105
1106         SAFE_FREE( root_domain );
1107
1108         return status;
1109 }
1110
1111 static NTSTATUS net_update_dns(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads)
1112 {
1113         int num_addrs;
1114         struct sockaddr_storage *iplist = NULL;
1115         fstring machine_name;
1116         NTSTATUS status;
1117
1118         name_to_fqdn( machine_name, global_myname() );
1119         strlower_m( machine_name );
1120
1121         /* Get our ip address (not the 127.0.0.x address but a real ip
1122          * address) */
1123
1124         num_addrs = get_my_ip_address( &iplist );
1125         if ( num_addrs <= 0 ) {
1126                 DEBUG(4,("net_update_dns: Failed to find my non-loopback IP "
1127                          "addresses!\n"));
1128                 return NT_STATUS_INVALID_PARAMETER;
1129         }
1130
1131         status = net_update_dns_internal(mem_ctx, ads, machine_name,
1132                                          iplist, num_addrs);
1133         SAFE_FREE( iplist );
1134         return status;
1135 }
1136 #endif
1137
1138
1139 /*******************************************************************
1140  ********************************************************************/
1141
1142 static int net_ads_join_usage(struct net_context *c, int argc, const char **argv)
1143 {
1144         d_printf("net ads join [options]\n");
1145         d_printf("Valid options:\n");
1146         d_printf("   createupn[=UPN]    Set the userPrincipalName attribute during the join.\n");
1147         d_printf("                      The deault UPN is in the form host/netbiosname@REALM.\n");
1148         d_printf("   createcomputer=OU  Precreate the computer account in a specific OU.\n");
1149         d_printf("                      The OU string read from top to bottom without RDNs and delimited by a '/'.\n");
1150         d_printf("                      E.g. \"createcomputer=Computers/Servers/Unix\"\n");
1151         d_printf("                      NB: A backslash '\\' is used as escape at multiple levels and may\n");
1152         d_printf("                          need to be doubled or even quadrupled.  It is not used as a separator.\n");
1153         d_printf("   osName=string      Set the operatingSystem attribute during the join.\n");
1154         d_printf("   osVer=string       Set the operatingSystemVersion attribute during the join.\n");
1155         d_printf("                      NB: osName and osVer must be specified together for either to take effect.\n");
1156         d_printf("                          Also, the operatingSystemService attribute is also set when along with\n");
1157         d_printf("                          the two other attributes.\n");
1158
1159         return -1;
1160 }
1161
1162 /*******************************************************************
1163  ********************************************************************/
1164
1165 int net_ads_join(struct net_context *c, int argc, const char **argv)
1166 {
1167         TALLOC_CTX *ctx = NULL;
1168         struct libnet_JoinCtx *r = NULL;
1169         const char *domain = lp_realm();
1170         WERROR werr = WERR_SETUP_NOT_JOINED;
1171         bool createupn = false;
1172         const char *machineupn = NULL;
1173         const char *create_in_ou = NULL;
1174         int i;
1175         const char *os_name = NULL;
1176         const char *os_version = NULL;
1177         bool modify_config = lp_config_backend_is_registry();
1178
1179         if (c->display_usage)
1180                 return net_ads_join_usage(c, argc, argv);
1181
1182         if (!modify_config) {
1183
1184                 werr = check_ads_config();
1185                 if (!W_ERROR_IS_OK(werr)) {
1186                         d_fprintf(stderr, "Invalid configuration.  Exiting....\n");
1187                         goto fail;
1188                 }
1189         }
1190
1191         if (!(ctx = talloc_init("net_ads_join"))) {
1192                 d_fprintf(stderr, "Could not initialise talloc context.\n");
1193                 werr = WERR_NOMEM;
1194                 goto fail;
1195         }
1196
1197         use_in_memory_ccache();
1198
1199         werr = libnet_init_JoinCtx(ctx, &r);
1200         if (!W_ERROR_IS_OK(werr)) {
1201                 goto fail;
1202         }
1203
1204         /* process additional command line args */
1205
1206         for ( i=0; i<argc; i++ ) {
1207                 if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
1208                         createupn = true;
1209                         machineupn = get_string_param(argv[i]);
1210                 }
1211                 else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
1212                         if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
1213                                 d_fprintf(stderr, "Please supply a valid OU path.\n");
1214                                 werr = WERR_INVALID_PARAM;
1215                                 goto fail;
1216                         }
1217                 }
1218                 else if ( !StrnCaseCmp(argv[i], "osName", strlen("osName")) ) {
1219                         if ( (os_name = get_string_param(argv[i])) == NULL ) {
1220                                 d_fprintf(stderr, "Please supply a operating system name.\n");
1221                                 werr = WERR_INVALID_PARAM;
1222                                 goto fail;
1223                         }
1224                 }
1225                 else if ( !StrnCaseCmp(argv[i], "osVer", strlen("osVer")) ) {
1226                         if ( (os_version = get_string_param(argv[i])) == NULL ) {
1227                                 d_fprintf(stderr, "Please supply a valid operating system version.\n");
1228                                 werr = WERR_INVALID_PARAM;
1229                                 goto fail;
1230                         }
1231                 }
1232                 else {
1233                         domain = argv[i];
1234                 }
1235         }
1236
1237         if (!*domain) {
1238                 d_fprintf(stderr, "Please supply a valid domain name\n");
1239                 werr = WERR_INVALID_PARAM;
1240                 goto fail;
1241         }
1242
1243         /* Do the domain join here */
1244
1245         r->in.domain_name       = domain;
1246         r->in.create_upn        = createupn;
1247         r->in.upn               = machineupn;
1248         r->in.account_ou        = create_in_ou;
1249         r->in.os_name           = os_name;
1250         r->in.os_version        = os_version;
1251         r->in.dc_name           = c->opt_host;
1252         r->in.admin_account     = c->opt_user_name;
1253         r->in.admin_password    = net_prompt_pass(c, c->opt_user_name);
1254         r->in.debug             = true;
1255         r->in.modify_config     = modify_config;
1256         r->in.join_flags        = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1257                                   WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
1258                                   WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
1259
1260         werr = libnet_Join(ctx, r);
1261         if (!W_ERROR_IS_OK(werr)) {
1262                 goto fail;
1263         }
1264
1265         /* Check the short name of the domain */
1266
1267         if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
1268                 d_printf("The workgroup in %s does not match the short\n", get_dyn_CONFIGFILE());
1269                 d_printf("domain name obtained from the server.\n");
1270                 d_printf("Using the name [%s] from the server.\n", r->out.netbios_domain_name);
1271                 d_printf("You should set \"workgroup = %s\" in %s.\n",
1272                          r->out.netbios_domain_name, get_dyn_CONFIGFILE());
1273         }
1274
1275         d_printf("Using short domain name -- %s\n", r->out.netbios_domain_name);
1276
1277         if (r->out.dns_domain_name) {
1278                 d_printf("Joined '%s' to realm '%s'\n", r->in.machine_name,
1279                         r->out.dns_domain_name);
1280         } else {
1281                 d_printf("Joined '%s' to domain '%s'\n", r->in.machine_name,
1282                         r->out.netbios_domain_name);
1283         }
1284
1285 #if defined(WITH_DNS_UPDATES)
1286         if (r->out.domain_is_ad) {
1287                 /* We enter this block with user creds */
1288                 ADS_STRUCT *ads_dns = NULL;
1289
1290                 if ( (ads_dns = ads_init( lp_realm(), NULL, NULL )) != NULL ) {
1291                         /* kinit with the machine password */
1292
1293                         use_in_memory_ccache();
1294                         asprintf( &ads_dns->auth.user_name, "%s$", global_myname() );
1295                         ads_dns->auth.password = secrets_fetch_machine_password(
1296                                 r->out.netbios_domain_name, NULL, NULL );
1297                         ads_dns->auth.realm = SMB_STRDUP( r->out.dns_domain_name );
1298                         strupper_m(ads_dns->auth.realm );
1299                         ads_kinit_password( ads_dns );
1300                 }
1301
1302                 if ( !ads_dns || !NT_STATUS_IS_OK(net_update_dns( ctx, ads_dns )) ) {
1303                         d_fprintf( stderr, "DNS update failed!\n" );
1304                 }
1305
1306                 /* exit from this block using machine creds */
1307                 ads_destroy(&ads_dns);
1308         }
1309 #endif
1310         TALLOC_FREE(r);
1311         TALLOC_FREE( ctx );
1312
1313         return 0;
1314
1315 fail:
1316         /* issue an overall failure message at the end. */
1317         d_printf("Failed to join domain: %s\n",
1318                 r && r->out.error_string ? r->out.error_string :
1319                 get_friendly_werror_msg(werr));
1320         TALLOC_FREE( ctx );
1321
1322         return -1;
1323 }
1324
1325 /*******************************************************************
1326  ********************************************************************/
1327
1328 static int net_ads_dns_register(struct net_context *c, int argc, const char **argv)
1329 {
1330 #if defined(WITH_DNS_UPDATES)
1331         ADS_STRUCT *ads;
1332         ADS_STATUS status;
1333         TALLOC_CTX *ctx;
1334
1335 #ifdef DEVELOPER
1336         talloc_enable_leak_report();
1337 #endif
1338
1339         if (argc > 0 || c->display_usage) {
1340                 d_printf("Usage:\n"
1341                          "net ads dns register\n"
1342                          "    Register hostname with DNS\n");
1343                 return -1;
1344         }
1345
1346         if (!(ctx = talloc_init("net_ads_dns"))) {
1347                 d_fprintf(stderr, "Could not initialise talloc context\n");
1348                 return -1;
1349         }
1350
1351         status = ads_startup(c, true, &ads);
1352         if ( !ADS_ERR_OK(status) ) {
1353                 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status)));
1354                 TALLOC_FREE(ctx);
1355                 return -1;
1356         }
1357
1358         if ( !NT_STATUS_IS_OK(net_update_dns(ctx, ads)) ) {
1359                 d_fprintf( stderr, "DNS update failed!\n" );
1360                 ads_destroy( &ads );
1361                 TALLOC_FREE( ctx );
1362                 return -1;
1363         }
1364
1365         d_fprintf( stderr, "Successfully registered hostname with DNS\n" );
1366
1367         ads_destroy(&ads);
1368         TALLOC_FREE( ctx );
1369
1370         return 0;
1371 #else
1372         d_fprintf(stderr, "DNS update support not enabled at compile time!\n");
1373         return -1;
1374 #endif
1375 }
1376
1377 #if defined(WITH_DNS_UPDATES)
1378 DNS_ERROR do_gethostbyname(const char *server, const char *host);
1379 #endif
1380
1381 static int net_ads_dns_gethostbyname(struct net_context *c, int argc, const char **argv)
1382 {
1383 #if defined(WITH_DNS_UPDATES)
1384         DNS_ERROR err;
1385
1386 #ifdef DEVELOPER
1387         talloc_enable_leak_report();
1388 #endif
1389
1390         if (argc != 2 || c->display_usage) {
1391                 d_printf("Usage:\n"
1392                          "net ads dns gethostbyname <server> <name>\n"
1393                          "  Look up hostname from the AD\n"
1394                          "    server\tName server to use\n"
1395                          "    name\tName to look up\n");
1396                 return -1;
1397         }
1398
1399         err = do_gethostbyname(argv[0], argv[1]);
1400
1401         d_printf("do_gethostbyname returned %d\n", ERROR_DNS_V(err));
1402 #endif
1403         return 0;
1404 }
1405
1406 static int net_ads_dns(struct net_context *c, int argc, const char *argv[])
1407 {
1408         struct functable3 func[] = {
1409                 {
1410                         "register",
1411                         net_ads_dns_register,
1412                         NET_TRANSPORT_ADS,
1413                         "Add host dns entry to AD",
1414                         "net ads dns register\n"
1415                         "    Add host dns entry to AD"
1416                 },
1417                 {
1418                         "gethostbyname",
1419                         net_ads_dns_gethostbyname,
1420                         NET_TRANSPORT_ADS,
1421                         "Look up host",
1422                         "net ads dns gethostbyname\n"
1423                         "    Look up host"
1424                 },
1425                 {NULL, NULL, 0, NULL, NULL}
1426         };
1427
1428         return net_run_function3(c, argc, argv, "net ads dns", func);
1429 }
1430
1431 /*******************************************************************
1432  ********************************************************************/
1433
1434 int net_ads_printer_usage(struct net_context *c, int argc, const char **argv)
1435 {
1436         d_printf(
1437 "\nnet ads printer search <printer>"
1438 "\n\tsearch for a printer in the directory\n"
1439 "\nnet ads printer info <printer> <server>"
1440 "\n\tlookup info in directory for printer on server"
1441 "\n\t(note: printer defaults to \"*\", server defaults to local)\n"
1442 "\nnet ads printer publish <printername>"
1443 "\n\tpublish printer in directory"
1444 "\n\t(note: printer name is required)\n"
1445 "\nnet ads printer remove <printername>"
1446 "\n\tremove printer from directory"
1447 "\n\t(note: printer name is required)\n");
1448         return -1;
1449 }
1450
1451 /*******************************************************************
1452  ********************************************************************/
1453
1454 static int net_ads_printer_search(struct net_context *c, int argc, const char **argv)
1455 {
1456         ADS_STRUCT *ads;
1457         ADS_STATUS rc;
1458         LDAPMessage *res = NULL;
1459
1460         if (c->display_usage) {
1461                 d_printf("Usage:\n"
1462                          "net ads printer search\n"
1463                          "    List printers in the AD\n");
1464                 return 0;
1465         }
1466
1467         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1468                 return -1;
1469         }
1470
1471         rc = ads_find_printers(ads, &res);
1472
1473         if (!ADS_ERR_OK(rc)) {
1474                 d_fprintf(stderr, "ads_find_printer: %s\n", ads_errstr(rc));
1475                 ads_msgfree(ads, res);
1476                 ads_destroy(&ads);
1477                 return -1;
1478         }
1479
1480         if (ads_count_replies(ads, res) == 0) {
1481                 d_fprintf(stderr, "No results found\n");
1482                 ads_msgfree(ads, res);
1483                 ads_destroy(&ads);
1484                 return -1;
1485         }
1486
1487         ads_dump(ads, res);
1488         ads_msgfree(ads, res);
1489         ads_destroy(&ads);
1490         return 0;
1491 }
1492
1493 static int net_ads_printer_info(struct net_context *c, int argc, const char **argv)
1494 {
1495         ADS_STRUCT *ads;
1496         ADS_STATUS rc;
1497         const char *servername, *printername;
1498         LDAPMessage *res = NULL;
1499
1500         if (c->display_usage) {
1501                 d_printf("Usage:\n"
1502                          "net ads printer info [printername [servername]]\n"
1503                          "  Display printer info from AD\n"
1504                          "    printername\tPrinter name or wildcard\n"
1505                          "    servername\tName of the print server\n");
1506                 return 0;
1507         }
1508
1509         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1510                 return -1;
1511         }
1512
1513         if (argc > 0) {
1514                 printername = argv[0];
1515         } else {
1516                 printername = "*";
1517         }
1518
1519         if (argc > 1) {
1520                 servername =  argv[1];
1521         } else {
1522                 servername = global_myname();
1523         }
1524
1525         rc = ads_find_printer_on_server(ads, &res, printername, servername);
1526
1527         if (!ADS_ERR_OK(rc)) {
1528                 d_fprintf(stderr, "Server '%s' not found: %s\n",
1529                         servername, ads_errstr(rc));
1530                 ads_msgfree(ads, res);
1531                 ads_destroy(&ads);
1532                 return -1;
1533         }
1534
1535         if (ads_count_replies(ads, res) == 0) {
1536                 d_fprintf(stderr, "Printer '%s' not found\n", printername);
1537                 ads_msgfree(ads, res);
1538                 ads_destroy(&ads);
1539                 return -1;
1540         }
1541
1542         ads_dump(ads, res);
1543         ads_msgfree(ads, res);
1544         ads_destroy(&ads);
1545
1546         return 0;
1547 }
1548
1549 static int net_ads_printer_publish(struct net_context *c, int argc, const char **argv)
1550 {
1551         ADS_STRUCT *ads;
1552         ADS_STATUS rc;
1553         const char *servername, *printername;
1554         struct cli_state *cli;
1555         struct rpc_pipe_client *pipe_hnd;
1556         struct sockaddr_storage server_ss;
1557         NTSTATUS nt_status;
1558         TALLOC_CTX *mem_ctx = talloc_init("net_ads_printer_publish");
1559         ADS_MODLIST mods = ads_init_mods(mem_ctx);
1560         char *prt_dn, *srv_dn, **srv_cn;
1561         char *srv_cn_escaped = NULL, *printername_escaped = NULL;
1562         LDAPMessage *res = NULL;
1563
1564         if (argc < 1 || c->display_usage) {
1565                 d_printf("Usage:\n"
1566                          "net ads printer publish <printername> [servername]\n"
1567                          "  Publish printer in AD\n"
1568                          "    printername\tName of the printer\n"
1569                          "    servername\tName of the print server\n");
1570                 talloc_destroy(mem_ctx);
1571                 return -1;
1572         }
1573
1574         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1575                 talloc_destroy(mem_ctx);
1576                 return -1;
1577         }
1578
1579         printername = argv[0];
1580
1581         if (argc == 2) {
1582                 servername = argv[1];
1583         } else {
1584                 servername = global_myname();
1585         }
1586
1587         /* Get printer data from SPOOLSS */
1588
1589         resolve_name(servername, &server_ss, 0x20);
1590
1591         nt_status = cli_full_connection(&cli, global_myname(), servername,
1592                                         &server_ss, 0,
1593                                         "IPC$", "IPC",
1594                                         c->opt_user_name, c->opt_workgroup,
1595                                         c->opt_password ? c->opt_password : "",
1596                                         CLI_FULL_CONNECTION_USE_KERBEROS,
1597                                         Undefined, NULL);
1598
1599         if (NT_STATUS_IS_ERR(nt_status)) {
1600                 d_fprintf(stderr, "Unable to open a connnection to %s to obtain data "
1601                          "for %s\n", servername, printername);
1602                 ads_destroy(&ads);
1603                 talloc_destroy(mem_ctx);
1604                 return -1;
1605         }
1606
1607         /* Publish on AD server */
1608
1609         ads_find_machine_acct(ads, &res, servername);
1610
1611         if (ads_count_replies(ads, res) == 0) {
1612                 d_fprintf(stderr, "Could not find machine account for server %s\n",
1613                          servername);
1614                 ads_destroy(&ads);
1615                 talloc_destroy(mem_ctx);
1616                 return -1;
1617         }
1618
1619         srv_dn = ldap_get_dn((LDAP *)ads->ldap.ld, (LDAPMessage *)res);
1620         srv_cn = ldap_explode_dn(srv_dn, 1);
1621
1622         srv_cn_escaped = escape_rdn_val_string_alloc(srv_cn[0]);
1623         printername_escaped = escape_rdn_val_string_alloc(printername);
1624         if (!srv_cn_escaped || !printername_escaped) {
1625                 SAFE_FREE(srv_cn_escaped);
1626                 SAFE_FREE(printername_escaped);
1627                 d_fprintf(stderr, "Internal error, out of memory!");
1628                 ads_destroy(&ads);
1629                 talloc_destroy(mem_ctx);
1630                 return -1;
1631         }
1632
1633         asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn_escaped, printername_escaped, srv_dn);
1634
1635         SAFE_FREE(srv_cn_escaped);
1636         SAFE_FREE(printername_escaped);
1637
1638         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SPOOLSS, &nt_status);
1639         if (!pipe_hnd) {
1640                 d_fprintf(stderr, "Unable to open a connnection to the spoolss pipe on %s\n",
1641                          servername);
1642                 SAFE_FREE(prt_dn);
1643                 ads_destroy(&ads);
1644                 talloc_destroy(mem_ctx);
1645                 return -1;
1646         }
1647
1648         if (!W_ERROR_IS_OK(get_remote_printer_publishing_data(pipe_hnd, mem_ctx, &mods,
1649                                                               printername))) {
1650                 SAFE_FREE(prt_dn);
1651                 ads_destroy(&ads);
1652                 talloc_destroy(mem_ctx);
1653                 return -1;
1654         }
1655
1656         rc = ads_add_printer_entry(ads, prt_dn, mem_ctx, &mods);
1657         if (!ADS_ERR_OK(rc)) {
1658                 d_fprintf(stderr, "ads_publish_printer: %s\n", ads_errstr(rc));
1659                 SAFE_FREE(prt_dn);
1660                 ads_destroy(&ads);
1661                 talloc_destroy(mem_ctx);
1662                 return -1;
1663         }
1664
1665         d_printf("published printer\n");
1666         SAFE_FREE(prt_dn);
1667         ads_destroy(&ads);
1668         talloc_destroy(mem_ctx);
1669
1670         return 0;
1671 }
1672
1673 static int net_ads_printer_remove(struct net_context *c, int argc, const char **argv)
1674 {
1675         ADS_STRUCT *ads;
1676         ADS_STATUS rc;
1677         const char *servername;
1678         char *prt_dn;
1679         LDAPMessage *res = NULL;
1680
1681         if (argc < 1 || c->display_usage) {
1682                 d_printf("Usage:\n"
1683                          "net ads printer remove <printername> [servername]\n"
1684                          "  Remove a printer from the AD\n"
1685                          "    printername\tName of the printer\n"
1686                          "    servername\tName of the print server\n");
1687                 return -1;
1688         }
1689
1690         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1691                 return -1;
1692         }
1693
1694         if (argc > 1) {
1695                 servername = argv[1];
1696         } else {
1697                 servername = global_myname();
1698         }
1699
1700         rc = ads_find_printer_on_server(ads, &res, argv[0], servername);
1701
1702         if (!ADS_ERR_OK(rc)) {
1703                 d_fprintf(stderr, "ads_find_printer_on_server: %s\n", ads_errstr(rc));
1704                 ads_msgfree(ads, res);
1705                 ads_destroy(&ads);
1706                 return -1;
1707         }
1708
1709         if (ads_count_replies(ads, res) == 0) {
1710                 d_fprintf(stderr, "Printer '%s' not found\n", argv[1]);
1711                 ads_msgfree(ads, res);
1712                 ads_destroy(&ads);
1713                 return -1;
1714         }
1715
1716         prt_dn = ads_get_dn(ads, res);
1717         ads_msgfree(ads, res);
1718         rc = ads_del_dn(ads, prt_dn);
1719         ads_memfree(ads, prt_dn);
1720
1721         if (!ADS_ERR_OK(rc)) {
1722                 d_fprintf(stderr, "ads_del_dn: %s\n", ads_errstr(rc));
1723                 ads_destroy(&ads);
1724                 return -1;
1725         }
1726
1727         ads_destroy(&ads);
1728         return 0;
1729 }
1730
1731 static int net_ads_printer(struct net_context *c, int argc, const char **argv)
1732 {
1733         struct functable3 func[] = {
1734                 {
1735                         "search",
1736                         net_ads_printer_search,
1737                         NET_TRANSPORT_ADS,
1738                         "Search for a printer",
1739                         "net ads printer search\n"
1740                         "    Search for a printer"
1741                 },
1742                 {
1743                         "info",
1744                         net_ads_printer_info,
1745                         NET_TRANSPORT_ADS,
1746                         "Display printer information",
1747                         "net ads printer info\n"
1748                         "    Display printer information"
1749                 },
1750                 {
1751                         "publish",
1752                         net_ads_printer_publish,
1753                         NET_TRANSPORT_ADS,
1754                         "Publish a printer",
1755                         "net ads printer publish\n"
1756                         "    Publish a printer"
1757                 },
1758                 {
1759                         "remove",
1760                         net_ads_printer_remove,
1761                         NET_TRANSPORT_ADS,
1762                         "Delete a printer",
1763                         "net ads printer remove\n"
1764                         "    Delete a printer"
1765                 },
1766                 {NULL, NULL, 0, NULL, NULL}
1767         };
1768
1769         return net_run_function3(c, argc, argv, "net ads printer", func);
1770 }
1771
1772
1773 static int net_ads_password(struct net_context *c, int argc, const char **argv)
1774 {
1775         ADS_STRUCT *ads;
1776         const char *auth_principal = c->opt_user_name;
1777         const char *auth_password = c->opt_password;
1778         char *realm = NULL;
1779         char *new_password = NULL;
1780         char *chr, *prompt;
1781         const char *user;
1782         ADS_STATUS ret;
1783
1784         if (c->display_usage) {
1785                 d_printf("Usage:\n"
1786                          "net ads password <username>\n"
1787                          "  Change password for user\n"
1788                          "    username\tName of user to change password for\n");
1789                 return 0;
1790         }
1791
1792         if (c->opt_user_name == NULL || c->opt_password == NULL) {
1793                 d_fprintf(stderr, "You must supply an administrator username/password\n");
1794                 return -1;
1795         }
1796
1797         if (argc < 1) {
1798                 d_fprintf(stderr, "ERROR: You must say which username to change password for\n");
1799                 return -1;
1800         }
1801
1802         user = argv[0];
1803         if (!strchr_m(user, '@')) {
1804                 asprintf(&chr, "%s@%s", argv[0], lp_realm());
1805                 user = chr;
1806         }
1807
1808         use_in_memory_ccache();
1809         chr = strchr_m(auth_principal, '@');
1810         if (chr) {
1811                 realm = ++chr;
1812         } else {
1813                 realm = lp_realm();
1814         }
1815
1816         /* use the realm so we can eventually change passwords for users
1817         in realms other than default */
1818         if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) {
1819                 return -1;
1820         }
1821
1822         /* we don't actually need a full connect, but it's the easy way to
1823                 fill in the KDC's addresss */
1824         ads_connect(ads);
1825
1826         if (!ads->config.realm) {
1827                 d_fprintf(stderr, "Didn't find the kerberos server!\n");
1828                 return -1;
1829         }
1830
1831         if (argv[1]) {
1832                 new_password = (char *)argv[1];
1833         } else {
1834                 asprintf(&prompt, "Enter new password for %s:", user);
1835                 new_password = getpass(prompt);
1836                 free(prompt);
1837         }
1838
1839         ret = kerberos_set_password(ads->auth.kdc_server, auth_principal,
1840                                 auth_password, user, new_password, ads->auth.time_offset);
1841         if (!ADS_ERR_OK(ret)) {
1842                 d_fprintf(stderr, "Password change failed: %s\n", ads_errstr(ret));
1843                 ads_destroy(&ads);
1844                 return -1;
1845         }
1846
1847         d_printf("Password change for %s completed.\n", user);
1848         ads_destroy(&ads);
1849
1850         return 0;
1851 }
1852
1853 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
1854 {
1855         ADS_STRUCT *ads;
1856         char *host_principal;
1857         fstring my_name;
1858         ADS_STATUS ret;
1859
1860         if (c->display_usage) {
1861                 d_printf("Usage:\n"
1862                          "net ads changetrustpw\n"
1863                          "    Change the machine account's trust password\n");
1864                 return 0;
1865         }
1866
1867         if (!secrets_init()) {
1868                 DEBUG(1,("Failed to initialise secrets database\n"));
1869                 return -1;
1870         }
1871
1872         net_use_krb_machine_account(c);
1873
1874         use_in_memory_ccache();
1875
1876         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1877                 return -1;
1878         }
1879
1880         fstrcpy(my_name, global_myname());
1881         strlower_m(my_name);
1882         asprintf(&host_principal, "%s$@%s", my_name, ads->config.realm);
1883         d_printf("Changing password for principal: %s\n", host_principal);
1884
1885         ret = ads_change_trust_account_password(ads, host_principal);
1886
1887         if (!ADS_ERR_OK(ret)) {
1888                 d_fprintf(stderr, "Password change failed: %s\n", ads_errstr(ret));
1889                 ads_destroy(&ads);
1890                 SAFE_FREE(host_principal);
1891                 return -1;
1892         }
1893
1894         d_printf("Password change for principal %s succeeded.\n", host_principal);
1895
1896         if (lp_use_kerberos_keytab()) {
1897                 d_printf("Attempting to update system keytab with new password.\n");
1898                 if (ads_keytab_create_default(ads)) {
1899                         d_printf("Failed to update system keytab.\n");
1900                 }
1901         }
1902
1903         ads_destroy(&ads);
1904         SAFE_FREE(host_principal);
1905
1906         return 0;
1907 }
1908
1909 /*
1910   help for net ads search
1911 */
1912 static int net_ads_search_usage(struct net_context *c, int argc, const char **argv)
1913 {
1914         d_printf(
1915                 "\nnet ads search <expression> <attributes...>\n"
1916                 "\nperform a raw LDAP search on a ADS server and dump the results\n"
1917                 "The expression is a standard LDAP search expression, and the\n"
1918                 "attributes are a list of LDAP fields to show in the results\n\n"
1919                 "Example: net ads search '(objectCategory=group)' sAMAccountName\n\n"
1920                 );
1921         net_common_flags_usage(c, argc, argv);
1922         return -1;
1923 }
1924
1925
1926 /*
1927   general ADS search function. Useful in diagnosing problems in ADS
1928 */
1929 static int net_ads_search(struct net_context *c, int argc, const char **argv)
1930 {
1931         ADS_STRUCT *ads;
1932         ADS_STATUS rc;
1933         const char *ldap_exp;
1934         const char **attrs;
1935         LDAPMessage *res = NULL;
1936
1937         if (argc < 1 || c->display_usage) {
1938                 return net_ads_search_usage(c, argc, argv);
1939         }
1940
1941         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1942                 return -1;
1943         }
1944
1945         ldap_exp = argv[0];
1946         attrs = (argv + 1);
1947
1948         rc = ads_do_search_all(ads, ads->config.bind_path,
1949                                LDAP_SCOPE_SUBTREE,
1950                                ldap_exp, attrs, &res);
1951         if (!ADS_ERR_OK(rc)) {
1952                 d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
1953                 ads_destroy(&ads);
1954                 return -1;
1955         }
1956
1957         d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
1958
1959         /* dump the results */
1960         ads_dump(ads, res);
1961
1962         ads_msgfree(ads, res);
1963         ads_destroy(&ads);
1964
1965         return 0;
1966 }
1967
1968
1969 /*
1970   help for net ads search
1971 */
1972 static int net_ads_dn_usage(struct net_context *c, int argc, const char **argv)
1973 {
1974         d_printf(
1975                 "\nnet ads dn <dn> <attributes...>\n"
1976                 "\nperform a raw LDAP search on a ADS server and dump the results\n"
1977                 "The DN standard LDAP DN, and the attributes are a list of LDAP fields \n"
1978                 "to show in the results\n\n"
1979                 "Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' sAMAccountName\n\n"
1980                 "Note: the DN must be provided properly escaped. See RFC 4514 for details\n\n"
1981                 );
1982         net_common_flags_usage(c, argc, argv);
1983         return -1;
1984 }
1985
1986
1987 /*
1988   general ADS search function. Useful in diagnosing problems in ADS
1989 */
1990 static int net_ads_dn(struct net_context *c, int argc, const char **argv)
1991 {
1992         ADS_STRUCT *ads;
1993         ADS_STATUS rc;
1994         const char *dn;
1995         const char **attrs;
1996         LDAPMessage *res = NULL;
1997
1998         if (argc < 1 || c->display_usage) {
1999                 return net_ads_dn_usage(c, argc, argv);
2000         }
2001
2002         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2003                 return -1;
2004         }
2005
2006         dn = argv[0];
2007         attrs = (argv + 1);
2008
2009         rc = ads_do_search_all(ads, dn,
2010                                LDAP_SCOPE_BASE,
2011                                "(objectclass=*)", attrs, &res);
2012         if (!ADS_ERR_OK(rc)) {
2013                 d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
2014                 ads_destroy(&ads);
2015                 return -1;
2016         }
2017
2018         d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2019
2020         /* dump the results */
2021         ads_dump(ads, res);
2022
2023         ads_msgfree(ads, res);
2024         ads_destroy(&ads);
2025
2026         return 0;
2027 }
2028
2029 /*
2030   help for net ads sid search
2031 */
2032 static int net_ads_sid_usage(struct net_context *c, int argc, const char **argv)
2033 {
2034         d_printf(
2035                 "\nnet ads sid <sid> <attributes...>\n"
2036                 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2037                 "The SID is in string format, and the attributes are a list of LDAP fields \n"
2038                 "to show in the results\n\n"
2039                 "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
2040                 );
2041         net_common_flags_usage(c, argc, argv);
2042         return -1;
2043 }
2044
2045
2046 /*
2047   general ADS search function. Useful in diagnosing problems in ADS
2048 */
2049 static int net_ads_sid(struct net_context *c, int argc, const char **argv)
2050 {
2051         ADS_STRUCT *ads;
2052         ADS_STATUS rc;
2053         const char *sid_string;
2054         const char **attrs;
2055         LDAPMessage *res = NULL;
2056         DOM_SID sid;
2057
2058         if (argc < 1 || c->display_usage) {
2059                 return net_ads_sid_usage(c, argc, argv);
2060         }
2061
2062         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2063                 return -1;
2064         }
2065
2066         sid_string = argv[0];
2067         attrs = (argv + 1);
2068
2069         if (!string_to_sid(&sid, sid_string)) {
2070                 d_fprintf(stderr, "could not convert sid\n");
2071                 ads_destroy(&ads);
2072                 return -1;
2073         }
2074
2075         rc = ads_search_retry_sid(ads, &res, &sid, attrs);
2076         if (!ADS_ERR_OK(rc)) {
2077                 d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
2078                 ads_destroy(&ads);
2079                 return -1;
2080         }
2081
2082         d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2083
2084         /* dump the results */
2085         ads_dump(ads, res);
2086
2087         ads_msgfree(ads, res);
2088         ads_destroy(&ads);
2089
2090         return 0;
2091 }
2092
2093 static int net_ads_keytab_flush(struct net_context *c, int argc, const char **argv)
2094 {
2095         int ret;
2096         ADS_STRUCT *ads;
2097
2098         if (c->display_usage) {
2099                 d_printf("Usage:\n"
2100                          "net ads keytab flush\n"
2101                          "    Delete the whole keytab\n");
2102                 return 0;
2103         }
2104
2105         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2106                 return -1;
2107         }
2108         ret = ads_keytab_flush(ads);
2109         ads_destroy(&ads);
2110         return ret;
2111 }
2112
2113 static int net_ads_keytab_add(struct net_context *c, int argc, const char **argv)
2114 {
2115         int i;
2116         int ret = 0;
2117         ADS_STRUCT *ads;
2118
2119         if (c->display_usage) {
2120                 d_printf("Usage:\n"
2121                          "net ads keytab add <principal> [principal ...]\n"
2122                          "  Add principals to local keytab\n"
2123                          "    principal\tKerberos principal to add to "
2124                          "keytab\n");
2125                 return 0;
2126         }
2127
2128         d_printf("Processing principals to add...\n");
2129         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2130                 return -1;
2131         }
2132         for (i = 0; i < argc; i++) {
2133                 ret |= ads_keytab_add_entry(ads, argv[i]);
2134         }
2135         ads_destroy(&ads);
2136         return ret;
2137 }
2138
2139 static int net_ads_keytab_create(struct net_context *c, int argc, const char **argv)
2140 {
2141         ADS_STRUCT *ads;
2142         int ret;
2143
2144         if (c->display_usage) {
2145                 d_printf("Usage:\n"
2146                          "net ads keytab create\n"
2147                          "    Create new default keytab\n");
2148                 return 0;
2149         }
2150
2151         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2152                 return -1;
2153         }
2154         ret = ads_keytab_create_default(ads);
2155         ads_destroy(&ads);
2156         return ret;
2157 }
2158
2159 static int net_ads_keytab_list(struct net_context *c, int argc, const char **argv)
2160 {
2161         const char *keytab = NULL;
2162
2163         if (c->display_usage) {
2164                 d_printf("Usage:\n"
2165                          "net ads keytab list [keytab]\n"
2166                          "  List a local keytab\n"
2167                          "    keytab\tKeytab to list\n");
2168                 return 0;
2169         }
2170
2171         if (argc >= 1) {
2172                 keytab = argv[0];
2173         }
2174
2175         return ads_keytab_list(keytab);
2176 }
2177
2178
2179 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2180 {
2181         struct functable3 func[] = {
2182                 {
2183                         "add",
2184                         net_ads_keytab_add,
2185                         NET_TRANSPORT_ADS,
2186                         "Add a service principal",
2187                         "net ads keytab add\n"
2188                         "    Add a service principal"
2189                 },
2190                 {
2191                         "create",
2192                         net_ads_keytab_create,
2193                         NET_TRANSPORT_ADS,
2194                         "Create a fresh keytab",
2195                         "net ads keytab create\n"
2196                         "    Create a fresh keytab"
2197                 },
2198                 {
2199                         "flush",
2200                         net_ads_keytab_flush,
2201                         NET_TRANSPORT_ADS,
2202                         "Remove all keytab entries",
2203                         "net ads keytab flush\n"
2204                         "    Remove all keytab entries"
2205                 },
2206                 {
2207                         "list",
2208                         net_ads_keytab_list,
2209                         NET_TRANSPORT_ADS,
2210                         "List a keytab",
2211                         "net ads keytab list\n"
2212                         "    List a keytab"
2213                 },
2214                 {NULL, NULL, 0, NULL, NULL}
2215         };
2216
2217         if (!lp_use_kerberos_keytab()) {
2218                 d_printf("\nWarning: \"use kerberos keytab\" must be set to \"true\" in order to \
2219 use keytab functions.\n");
2220         }
2221
2222         return net_run_function3(c, argc, argv, "net ads keytab", func);
2223 }
2224
2225 static int net_ads_kerberos_renew(struct net_context *c, int argc, const char **argv)
2226 {
2227         int ret = -1;
2228
2229         if (c->display_usage) {
2230                 d_printf("Usage:\n"
2231                          "net ads kerberos renew\n"
2232                          "    Renew TGT from existing credential cache\n");
2233                 return 0;
2234         }
2235
2236         ret = smb_krb5_renew_ticket(NULL, NULL, NULL, NULL);
2237         if (ret) {
2238                 d_printf("failed to renew kerberos ticket: %s\n",
2239                         error_message(ret));
2240         }
2241         return ret;
2242 }
2243
2244 static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
2245 {
2246         struct PAC_DATA *pac = NULL;
2247         struct PAC_LOGON_INFO *info = NULL;
2248         TALLOC_CTX *mem_ctx = NULL;
2249         NTSTATUS status;
2250         int ret = -1;
2251
2252         if (c->display_usage) {
2253                 d_printf("Usage:\n"
2254                          "net ads kerberos pac\n"
2255                          "    Dump the Kerberos PAC\n");
2256                 return 0;
2257         }
2258
2259         mem_ctx = talloc_init("net_ads_kerberos_pac");
2260         if (!mem_ctx) {
2261                 goto out;
2262         }
2263
2264         c->opt_password = net_prompt_pass(c, c->opt_user_name);
2265
2266         status = kerberos_return_pac(mem_ctx,
2267                                      c->opt_user_name,
2268                                      c->opt_password,
2269                                      0,
2270                                      NULL,
2271                                      NULL,
2272                                      NULL,
2273                                      true,
2274                                      true,
2275                                      2592000, /* one month */
2276                                      &pac);
2277         if (!NT_STATUS_IS_OK(status)) {
2278                 d_printf("failed to query kerberos PAC: %s\n",
2279                         nt_errstr(status));
2280                 goto out;
2281         }
2282
2283         info = get_logon_info_from_pac(pac);
2284         if (info) {
2285                 const char *s;
2286                 s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_LOGON_INFO, info);
2287                 d_printf("The Pac: %s\n", s);
2288         }
2289
2290         ret = 0;
2291  out:
2292         TALLOC_FREE(mem_ctx);
2293         return ret;
2294 }
2295
2296 static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char **argv)
2297 {
2298         TALLOC_CTX *mem_ctx = NULL;
2299         int ret = -1;
2300         NTSTATUS status;
2301
2302         if (c->display_usage) {
2303                 d_printf("Usage:\n"
2304                          "net ads kerberos kinit\n"
2305                          "    Get Ticket Granting Ticket (TGT) for the user\n");
2306                 return 0;
2307         }
2308
2309         mem_ctx = talloc_init("net_ads_kerberos_kinit");
2310         if (!mem_ctx) {
2311                 goto out;
2312         }
2313
2314         c->opt_password = net_prompt_pass(c, c->opt_user_name);
2315
2316         ret = kerberos_kinit_password_ext(c->opt_user_name,
2317                                           c->opt_password,
2318                                           0,
2319                                           NULL,
2320                                           NULL,
2321                                           NULL,
2322                                           true,
2323                                           true,
2324                                           2592000, /* one month */
2325                                           &status);
2326         if (ret) {
2327                 d_printf("failed to kinit password: %s\n",
2328                         nt_errstr(status));
2329         }
2330  out:
2331         return ret;
2332 }
2333
2334 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2335 {
2336         struct functable3 func[] = {
2337                 {
2338                         "kinit",
2339                         net_ads_kerberos_kinit,
2340                         NET_TRANSPORT_ADS,
2341                         "Retrieve Ticket Granting Ticket (TGT)",
2342                         "net ads kerberos kinit\n"
2343                         "    Receive Ticket Granting Ticket (TGT)"
2344                 },
2345                 {
2346                         "renew",
2347                         net_ads_kerberos_renew,
2348                         NET_TRANSPORT_ADS,
2349                         "Renew Ticket Granting Ticket from credential cache"
2350                         "net ads kerberos renew\n"
2351                         "    Renew Ticket Granting Ticket from credential cache"
2352                 },
2353                 {
2354                         "pac",
2355                         net_ads_kerberos_pac,
2356                         NET_TRANSPORT_ADS,
2357                         "Dump Kerberos PAC",
2358                         "net ads kerberos pac\n"
2359                         "    Dump Kerberos PAC"
2360                 },
2361                 {NULL, NULL, 0, NULL, NULL}
2362         };
2363
2364         return net_run_function3(c, argc, argv, "net ads kerberos", func);
2365 }
2366
2367 int net_ads(struct net_context *c, int argc, const char **argv)
2368 {
2369         struct functable3 func[] = {
2370                 {
2371                         "info",
2372                         net_ads_info,
2373                         NET_TRANSPORT_ADS,
2374                         "Display details on remote ADS server",
2375                         "net ads info\n"
2376                         "    Display details on remote ADS server"
2377                 },
2378                 {
2379                         "join",
2380                         net_ads_join,
2381                         NET_TRANSPORT_ADS,
2382                         "Join the local machine to ADS realm",
2383                         "net ads join\n"
2384                         "    Join the local machine to ADS realm"
2385                 },
2386                 {
2387                         "testjoin",
2388                         net_ads_testjoin,
2389                         NET_TRANSPORT_ADS,
2390                         "Validate machine account",
2391                         "net ads testjoin\n"
2392                         "    Validate machine account"
2393                 },
2394                 {
2395                         "leave",
2396                         net_ads_leave,
2397                         NET_TRANSPORT_ADS,
2398                         "Remove the local machine from ADS",
2399                         "net ads leave\n"
2400                         "    Remove the local machine from ADS"
2401                 },
2402                 {
2403                         "status",
2404                         net_ads_status,
2405                         NET_TRANSPORT_ADS,
2406                         "Display machine account details",
2407                         "net ads status\n"
2408                         "    Display machine account details"
2409                 },
2410                 {
2411                         "user",
2412                         net_ads_user,
2413                         NET_TRANSPORT_ADS,
2414                         "List/modify users",
2415                         "net ads user\n"
2416                         "    List/modify users"
2417                 },
2418                 {
2419                         "group",
2420                         net_ads_group,
2421                         NET_TRANSPORT_ADS,
2422                         "List/modify groups",
2423                         "net ads group\n"
2424                         "    List/modify groups"
2425                 },
2426                 {
2427                         "dns",
2428                         net_ads_dns,
2429                         NET_TRANSPORT_ADS,
2430                         "Issue dynamic DNS update",
2431                         "net ads dns\n"
2432                         "    Issue dynamic DNS update"
2433                 },
2434                 {
2435                         "password",
2436                         net_ads_password,
2437                         NET_TRANSPORT_ADS,
2438                         "Change user passwords",
2439                         "net ads password\n"
2440                         "    Change user passwords"
2441                 },
2442                 {
2443                         "changetrustpw",
2444                         net_ads_changetrustpw,
2445                         NET_TRANSPORT_ADS,
2446                         "Change trust account password",
2447                         "net ads changetrustpw\n"
2448                         "    Change trust account password"
2449                 },
2450                 {
2451                         "printer",
2452                         net_ads_printer,
2453                         NET_TRANSPORT_ADS,
2454                         "List/modify printer entries",
2455                         "net ads printer\n"
2456                         "    List/modify printer entries"
2457                 },
2458                 {
2459                         "search",
2460                         net_ads_search,
2461                         NET_TRANSPORT_ADS,
2462                         "Issue LDAP search using filter",
2463                         "net ads search\n"
2464                         "    Issue LDAP search using filter"
2465                 },
2466                 {
2467                         "dn",
2468                         net_ads_dn,
2469                         NET_TRANSPORT_ADS,
2470                         "Issue LDAP search by DN",
2471                         "net ads dn\n"
2472                         "    Issue LDAP search by DN"
2473                 },
2474                 {
2475                         "sid",
2476                         net_ads_sid,
2477                         NET_TRANSPORT_ADS,
2478                         "Issue LDAP search by SID",
2479                         "net ads sid\n"
2480                         "    Issue LDAP search by SID"
2481                 },
2482                 {
2483                         "workgroup",
2484                         net_ads_workgroup,
2485                         NET_TRANSPORT_ADS,
2486                         "Display workgroup name",
2487                         "net ads workgroup\n"
2488                         "    Display the workgroup name"
2489                 },
2490                 {
2491                         "lookup",
2492                         net_ads_lookup,
2493                         NET_TRANSPORT_ADS,
2494                         "Perfom CLDAP query on DC",
2495                         "net ads lookup\n"
2496                         "    Find the ADS DC using CLDAP lookups"
2497                 },
2498                 {
2499                         "keytab",
2500                         net_ads_keytab,
2501                         NET_TRANSPORT_ADS,
2502                         "Manage local keytab file",
2503                         "net ads keytab\n"
2504                         "    Manage local keytab file"
2505                 },
2506                 {
2507                         "gpo",
2508                         net_ads_gpo,
2509                         NET_TRANSPORT_ADS,
2510                         "Manage group policy objects",
2511                         "net ads gpo\n"
2512                         "    Manage group policy objects"
2513                 },
2514                 {
2515                         "kerberos",
2516                         net_ads_kerberos,
2517                         NET_TRANSPORT_ADS,
2518                         "Manage kerberos keytab",
2519                         "net ads kerberos\n"
2520                         "    Manage kerberos keytab"
2521                 },
2522                 {NULL, NULL, 0, NULL, NULL}
2523         };
2524
2525         return net_run_function3(c, argc, argv, "net ads", func);
2526 }
2527
2528 #else
2529
2530 static int net_ads_noads(void)
2531 {
2532         d_fprintf(stderr, "ADS support not compiled in\n");
2533         return -1;
2534 }
2535
2536 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2537 {
2538         return net_ads_noads();
2539 }
2540
2541 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2542 {
2543         return net_ads_noads();
2544 }
2545
2546 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2547 {
2548         return net_ads_noads();
2549 }
2550
2551 int net_ads_join(struct net_context *c, int argc, const char **argv)
2552 {
2553         return net_ads_noads();
2554 }
2555
2556 int net_ads_user(struct net_context *c, int argc, const char **argv)
2557 {
2558         return net_ads_noads();
2559 }
2560
2561 int net_ads_group(struct net_context *c, int argc, const char **argv)
2562 {
2563         return net_ads_noads();
2564 }
2565
2566 /* this one shouldn't display a message */
2567 int net_ads_check(struct net_context *c)
2568 {
2569         return -1;
2570 }
2571
2572 int net_ads_check_our_domain(struct net_context *c)
2573 {
2574         return -1;
2575 }
2576
2577 int net_ads(struct net_context *c, int argc, const char **argv)
2578 {
2579         return net_ads_usage(c, argc, argv);
2580 }
2581
2582 #endif  /* WITH_ADS */