This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "libnet/libnet.h"
-#include "librpc/gen_ndr/ndr_samr.h"
-#include "librpc/gen_ndr/ndr_lsa.h"
-#include "librpc/gen_ndr/ndr_drsuapi.h"
+#include "librpc/gen_ndr/ndr_drsuapi_c.h"
#include "lib/ldb/include/ldb.h"
-#include "libcli/cldap/cldap.h"
-#include "include/secrets.h"
-#include "librpc/gen_ndr/drsuapi.h"
-
-/*
- * find out Site specific stuff:
- * 1.) setup an CLDAP socket
- * 2.) lookup the Site name
- * 3.) Add entry CN=<netbios name>,CN=Servers,CN=<site name>,CN=Sites,CN=Configuration,<domain dn>.
- * TODO: 4.) use DsAddEntry() to create CN=NTDS Settings,CN=<netbios name>,CN=Servers,CN=<site name>...
- */
-static NTSTATUS libnet_JoinSite(struct libnet_context *ctx,
- struct dcerpc_pipe *drsuapi_pipe,
- struct policy_handle drsuapi_bind_handle,
- struct ldb_context *remote_ldb,
- struct libnet_JoinDomain *libnet_r)
-{
- NTSTATUS status;
- TALLOC_CTX *tmp_ctx;
-
- struct cldap_socket *cldap = NULL;
- struct cldap_netlogon search;
-
- struct ldb_dn *server_dn;
- struct ldb_message *msg;
- int rtn;
-
- const char *site_name;
- const char *server_dn_str;
- const char *config_dn_str;
-
- tmp_ctx = talloc_named(libnet_r, 0, "libnet_JoinSite temp context");
- if (!tmp_ctx) {
- libnet_r->out.error_string = NULL;
- return NT_STATUS_NO_MEMORY;
- }
-
- /* Resolve the site name. */
-
- ZERO_STRUCT(search);
- search.in.dest_address = libnet_r->out.samr_binding->host;
- search.in.acct_control = -1;
- search.in.version = 6;
-
- cldap = cldap_socket_init(tmp_ctx, NULL);
- status = cldap_netlogon(cldap, tmp_ctx, &search);
- if (!NT_STATUS_IS_OK(status)) {
- /* Default to using Default-First-Site-Name rather than returning status at this point. */
- site_name = talloc_asprintf(tmp_ctx, "%s", "Default-First-Site-Name");
- if (!site_name) {
- libnet_r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
- } else {
- site_name = search.out.netlogon.logon5.site_name;
- }
-
- config_dn_str = talloc_asprintf(tmp_ctx, "CN=Configuration,%s", libnet_r->out.domain_dn_str);
- if (!config_dn_str) {
- libnet_r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- server_dn_str = talloc_asprintf(tmp_ctx, "CN=%s,CN=Servers,CN=%s,CN=Sites,%s",
- libnet_r->in.netbios_name, site_name, config_dn_str);
- if (!server_dn_str) {
- libnet_r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- /*
- Add entry CN=<netbios name>,CN=Servers,CN=<site name>,CN=Sites,CN=Configuration,<domain dn>.
- */
- msg = ldb_msg_new(tmp_ctx);
- if (!msg) {
- libnet_r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- rtn = ldb_msg_add_string(msg, "objectClass", "server");
- if (rtn != 0) {
- libnet_r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
- rtn = ldb_msg_add_string(msg, "systemFlags", "50000000");
- if (rtn != 0) {
- libnet_r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
- rtn = ldb_msg_add_string(msg, "serverReference",libnet_r->out.account_dn_str);
- if (rtn != 0) {
- libnet_r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- server_dn = ldb_dn_explode(tmp_ctx, server_dn_str);
- if (server_dn == NULL) {
- libnet_r->out.error_string = talloc_asprintf(libnet_r,
- "Invalid server dn: %s",
- server_dn_str);
- talloc_free(tmp_ctx);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
- msg->dn = server_dn;
- msg->elements->flags = LDB_FLAG_MOD_ADD;
-
- rtn = ldb_add(remote_ldb, msg);
- if (rtn != 0) {
- libnet_r->out.error_string
- = talloc_asprintf(libnet_r,
- "Failed to add server entry %s: %s.",
- server_dn_str,
- ldb_errstring(remote_ldb));
- talloc_free(tmp_ctx);
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- }
- DEBUG(0, ("We still need to perform a DsAddEntry() so that we can create the CN=NTDS Settings container.\n"));
-
- /* Store the server DN in libnet_r */
- libnet_r->out.server_dn_str = server_dn_str;
- talloc_steal(libnet_r, server_dn_str);
-
- talloc_free(tmp_ctx);
- return NT_STATUS_OK;
-}
+#include "lib/ldb/include/ldb_errors.h"
+#include "param/secrets.h"
+#include "dsdb/samdb/samdb.h"
+#include "ldb_wrap.h"
+#include "util/util_ldb.h"
+#include "libcli/security/security.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
+#include "librpc/gen_ndr/ndr_samr_c.h"
+#include "param/param.h"
/*
* complete a domain join, when joining to a AD domain:
struct GUID drsuapi_bind_guid;
struct ldb_context *remote_ldb;
- const struct ldb_dn *account_dn;
+ struct ldb_dn *account_dn;
const char *account_dn_str;
const char *remote_ldb_url;
- struct ldb_message **msgs, *msg;
+ struct ldb_result *res;
+ struct ldb_message *msg;
- int rtn;
+ int ret, rtn;
- unsigned int kvno;
-
const char * const attrs[] = {
"msDS-KeyVersionNumber",
"servicePrincipalName",
"dNSHostName",
+ "objectGUID",
NULL,
};
status = dcerpc_pipe_connect_b(tmp_ctx,
&drsuapi_pipe,
drsuapi_binding,
- DCERPC_DRSUAPI_UUID,
- DCERPC_DRSUAPI_VERSION,
+ &ndr_table_drsuapi,
ctx->cred,
- ctx->event_ctx);
+ ctx->event_ctx,
+ ctx->lp_ctx);
if (!NT_STATUS_IS_OK(status)) {
r->out.error_string = talloc_asprintf(r,
"Connection to DRSUAPI pipe of PDC of domain '%s' failed: %s",
- r->in.domain_name,
+ r->out.domain_name,
nt_errstr(status));
talloc_free(tmp_ctx);
return status;
if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
r->out.error_string
= talloc_asprintf(r,
- "dcerpc_drsuapi_DsBind for [%s\\%s] failed - %s\n",
- r->in.domain_name, r->in.account_name,
+ "dcerpc_drsuapi_DsBind failed - %s",
dcerpc_errstr(tmp_ctx, drsuapi_pipe->last_fault_code));
talloc_free(tmp_ctx);
return status;
} else {
r->out.error_string
= talloc_asprintf(r,
- "dcerpc_drsuapi_DsBind for [%s\\%s] failed - %s\n",
- r->in.domain_name, r->in.account_name,
+ "dcerpc_drsuapi_DsBind failed - %s",
nt_errstr(status));
talloc_free(tmp_ctx);
return status;
} else if (!W_ERROR_IS_OK(r_drsuapi_bind.out.result)) {
r->out.error_string
= talloc_asprintf(r,
- "DsBind failed - %s\n",
+ "DsBind failed - %s",
win_errstr(r_drsuapi_bind.out.result));
talloc_free(tmp_ctx);
return NT_STATUS_UNSUCCESSFUL;
ZERO_STRUCT(r_crack_names);
r_crack_names.in.bind_handle = &drsuapi_bind_handle;
r_crack_names.in.level = 1;
- r_crack_names.in.req.req1.unknown1 = 0x000004e4;
- r_crack_names.in.req.req1.unknown2 = 0x00000407;
+ r_crack_names.in.req.req1.codepage = 1252; /* western european */
+ r_crack_names.in.req.req1.language = 0x00000407; /* german */
r_crack_names.in.req.req1.count = 1;
r_crack_names.in.req.req1.names = names;
r_crack_names.in.req.req1.format_flags = DRSUAPI_DS_NAME_FLAG_NO_FLAGS;
if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
r->out.error_string
= talloc_asprintf(r,
- "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s\n",
+ "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
names[0].str,
dcerpc_errstr(tmp_ctx, drsuapi_pipe->last_fault_code));
talloc_free(tmp_ctx);
} else {
r->out.error_string
= talloc_asprintf(r,
- "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s\n",
+ "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
names[0].str,
nt_errstr(status));
talloc_free(tmp_ctx);
} else if (!W_ERROR_IS_OK(r_crack_names.out.result)) {
r->out.error_string
= talloc_asprintf(r,
- "DsCrackNames failed - %s\n", win_errstr(r_crack_names.out.result));
+ "DsCrackNames failed - %s", win_errstr(r_crack_names.out.result));
talloc_free(tmp_ctx);
return NT_STATUS_UNSUCCESSFUL;
} else if (r_crack_names.out.level != 1
|| !r_crack_names.out.ctr.ctr1
- || r_crack_names.out.ctr.ctr1->count != 1
- || !r_crack_names.out.ctr.ctr1->array[0].result_name
- || r_crack_names.out.ctr.ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) {
- r->out.error_string = talloc_asprintf(r, "DsCrackNames failed\n");
+ || r_crack_names.out.ctr.ctr1->count != 1) {
+ r->out.error_string = talloc_asprintf(r, "DsCrackNames failed");
+ talloc_free(tmp_ctx);
+ return NT_STATUS_INVALID_PARAMETER;
+ } else if (r_crack_names.out.ctr.ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) {
+ r->out.error_string = talloc_asprintf(r, "DsCrackNames failed: %d", r_crack_names.out.ctr.ctr1->array[0].status);
talloc_free(tmp_ctx);
return NT_STATUS_UNSUCCESSFUL;
+ } else if (r_crack_names.out.ctr.ctr1->array[0].result_name == NULL) {
+ r->out.error_string = talloc_asprintf(r, "DsCrackNames failed: no result name");
+ talloc_free(tmp_ctx);
+ return NT_STATUS_INVALID_PARAMETER;
}
/* Store the DN of our machine account. */
account_dn_str = r_crack_names.out.ctr.ctr1->array[0].result_name;
- account_dn = ldb_dn_explode(tmp_ctx, account_dn_str);
- if (!account_dn) {
- r->out.error_string = talloc_asprintf(r, "Invalid account dn: %s",
- account_dn_str);
- talloc_free(tmp_ctx);
- return NT_STATUS_UNSUCCESSFUL;
- }
-
/* Now we know the user's DN, open with LDAP, read and modify a few things */
remote_ldb_url = talloc_asprintf(tmp_ctx, "ldap://%s",
- drsuapi_binding->host);
+ drsuapi_binding->target_hostname);
if (!remote_ldb_url) {
r->out.error_string = NULL;
talloc_free(tmp_ctx);
return NT_STATUS_NO_MEMORY;
}
- remote_ldb = ldb_wrap_connect(tmp_ctx, remote_ldb_url, 0, NULL);
+ remote_ldb = ldb_wrap_connect(tmp_ctx, ctx->lp_ctx,
+ remote_ldb_url,
+ NULL, ctx->cred, 0, NULL);
if (!remote_ldb) {
r->out.error_string = NULL;
talloc_free(tmp_ctx);
return NT_STATUS_UNSUCCESSFUL;
}
+ account_dn = ldb_dn_new(tmp_ctx, remote_ldb, account_dn_str);
+ if (! ldb_dn_validate(account_dn)) {
+ r->out.error_string = talloc_asprintf(r, "Invalid account dn: %s",
+ account_dn_str);
+ talloc_free(tmp_ctx);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
/* search for the user's record */
- rtn = ldb_search(remote_ldb, account_dn, LDB_SCOPE_BASE,
- NULL, attrs, &msgs);
- if (rtn != 1) {
- r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - %s\n",
+ ret = ldb_search(remote_ldb, account_dn, LDB_SCOPE_BASE,
+ NULL, attrs, &res);
+ if (ret != LDB_SUCCESS) {
+ r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - %s",
account_dn_str, ldb_errstring(remote_ldb));
talloc_free(tmp_ctx);
return NT_STATUS_UNSUCCESSFUL;
}
- /* If we have a kvno recorded in AD, we need it locally as well */
- kvno = ldb_msg_find_uint(msgs[0], "msDS-KeyVersionNumber", 0);
+ talloc_steal(tmp_ctx, res);
+
+ if (res->count != 1) {
+ r->out.error_string = talloc_asprintf(r, "ldb_search for %s failed - found %d entries",
+ account_dn_str, res->count);
+ talloc_free(tmp_ctx);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
/* Prepare a new message, for the modify */
msg = ldb_msg_new(tmp_ctx);
talloc_free(tmp_ctx);
return NT_STATUS_NO_MEMORY;
}
- msg->dn = msgs[0]->dn;
+ msg->dn = res->msgs[0]->dn;
{
int i;
talloc_free(tmp_ctx);
return NT_STATUS_NO_MEMORY;
}
+ rtn = samdb_msg_add_string(remote_ldb, tmp_ctx, msg, "servicePrincipalName", service_principal_name[i]);
+ if (rtn == -1) {
+ r->out.error_string = NULL;
+ talloc_free(tmp_ctx);
+ return NT_STATUS_NO_MEMORY;
+ }
}
rtn = samdb_msg_add_string(remote_ldb, tmp_ctx, msg, "dNSHostName", dns_host_name);
talloc_free(tmp_ctx);
return NT_STATUS_NO_MEMORY;
}
- rtn = samdb_msg_add_string(remote_ldb, tmp_ctx, msg, "servicePrincipalName", service_principal_name[0]);
- if (rtn == -1) {
- r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
- rtn = samdb_msg_add_string(remote_ldb, tmp_ctx, msg, "servicePrincipalName", service_principal_name[1]);
- if (rtn == -1) {
- r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
rtn = samdb_replace(remote_ldb, tmp_ctx, msg);
if (rtn != 0) {
r->out.error_string
= talloc_asprintf(r,
- "Failed to replace entries on %s\n",
- ldb_dn_linearize(tmp_ctx, msg->dn));
+ "Failed to replace entries on %s",
+ ldb_dn_get_linearized(msg->dn));
talloc_free(tmp_ctx);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
r->out.error_string
= talloc_asprintf(r,
- "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s\n",
+ "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
r->in.domain_name,
dcerpc_errstr(tmp_ctx, drsuapi_pipe->last_fault_code));
talloc_free(tmp_ctx);
} else {
r->out.error_string
= talloc_asprintf(r,
- "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s\n",
+ "dcerpc_drsuapi_DsCrackNames for [%s] failed - %s",
r->in.domain_name,
nt_errstr(status));
talloc_free(tmp_ctx);
} else if (!W_ERROR_IS_OK(r_crack_names.out.result)) {
r->out.error_string
= talloc_asprintf(r,
- "DsCrackNames failed - %s\n", win_errstr(r_crack_names.out.result));
+ "DsCrackNames failed - %s", win_errstr(r_crack_names.out.result));
talloc_free(tmp_ctx);
return NT_STATUS_UNSUCCESSFUL;
} else if (r_crack_names.out.level != 1
|| r_crack_names.out.ctr.ctr1->count != 1
|| !r_crack_names.out.ctr.ctr1->array[0].result_name
|| r_crack_names.out.ctr.ctr1->array[0].status != DRSUAPI_DS_NAME_STATUS_OK) {
- r->out.error_string = talloc_asprintf(r, "DsCrackNames failed\n");
+ r->out.error_string = talloc_asprintf(r, "DsCrackNames failed");
talloc_free(tmp_ctx);
return NT_STATUS_UNSUCCESSFUL;
}
r->out.domain_dn_str = r_crack_names.out.ctr.ctr1->array[0].result_name;
talloc_steal(r, r_crack_names.out.ctr.ctr1->array[0].result_name);
- r->out.kvno = kvno;
+ /* Store the KVNO of the account, critical for some kerberos
+ * operations */
+ r->out.kvno = ldb_msg_find_attr_as_uint(res->msgs[0], "msDS-KeyVersionNumber", 0);
+
+ /* Store the account GUID. */
+ r->out.account_guid = samdb_result_guid(res->msgs[0], "objectGUID");
- if (r->in.acct_type == ACB_SVRTRUST) {
- status = libnet_JoinSite(ctx,
- drsuapi_pipe, drsuapi_bind_handle,
- remote_ldb, r);
+ if (r->in.acct_type == ACB_SVRTRUST) {
+ status = libnet_JoinSite(ctx, remote_ldb, r);
}
talloc_free(tmp_ctx);
/*
* do a domain join using DCERPC/SAMR calls
- * 1. connect to the SAMR pipe of users domain PDC (maybe a standalone server or workstation)
- * is it correct to contact the the pdc of the domain of the user who's password should be set?
- * 2. do a samr_Connect to get a policy handle
- * 3. do a samr_LookupDomain to get the domain sid
- * 4. do a samr_OpenDomain to get a domain handle
- * 5. do a samr_CreateAccount to try and get a new account
+ * - connect to the LSA pipe, to try and find out information about the domain
+ * - create a secondary connection to SAMR pipe
+ * - do a samr_Connect to get a policy handle
+ * - do a samr_LookupDomain to get the domain sid
+ * - do a samr_OpenDomain to get a domain handle
+ * - do a samr_CreateAccount to try and get a new account
*
* If that fails, do:
- * 5.1. do a samr_LookupNames to get the users rid
- * 5.2. do a samr_OpenUser to get a user handle
+ * - do a samr_LookupNames to get the users rid
+ * - do a samr_OpenUser to get a user handle
+ * - potentially delete and recreate the user
+ * - assert the account is of the right type with samrQueryUserInfo
*
- * 6. call libnet_SetPassword_samr_handle to set the password
+ * - call libnet_SetPassword_samr_handle to set the password,
+ * and pass a samr_UserInfo21 struct to set full_name and the account flags
*
- * 7. do a samrSetUserInfo to set the account flags
- * 8. do some ADS specific things when we join as Domain Controller,
+ * - do some ADS specific things when we join as Domain Controller,
* look at libnet_joinADSDomain() for the details
*/
NTSTATUS libnet_JoinDomain(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_JoinDomain *r)
TALLOC_CTX *tmp_ctx;
NTSTATUS status, cu_status;
- struct libnet_RpcConnect *c;
- struct lsa_ObjectAttribute attr;
- struct lsa_QosInfo qos;
- struct lsa_OpenPolicy2 lsa_open_policy;
- struct policy_handle lsa_p_handle;
- struct lsa_QueryInfoPolicy2 lsa_query_info2;
- struct lsa_QueryInfoPolicy lsa_query_info;
-
- struct dcerpc_binding *samr_binding;
+
+ struct libnet_RpcConnect *connect_with_info;
struct dcerpc_pipe *samr_pipe;
- struct dcerpc_pipe *lsa_pipe;
+
struct samr_Connect sc;
struct policy_handle p_handle;
struct samr_OpenDomain od;
struct samr_CreateUser2 cu;
struct policy_handle *u_handle = NULL;
struct samr_QueryUserInfo qui;
- struct samr_SetUserInfo sui;
- union samr_UserInfo u_info;
+ struct samr_UserInfo21 u_info21;
union libnet_SetPassword r2;
struct samr_GetUserPwInfo pwp;
struct lsa_String samr_account_name;
- uint32_t acct_flags;
+ uint32_t acct_flags, old_acct_flags;
uint32_t rid, access_granted;
int policy_min_pw_len = 0;
- struct dom_sid *domain_sid = NULL;
struct dom_sid *account_sid = NULL;
- const char *domain_name = NULL;
const char *password_str = NULL;
- const char *realm = NULL; /* Also flag for remote being AD */
-
r->out.error_string = NULL;
r2.samr_handle.out.error_string = NULL;
return NT_STATUS_NO_MEMORY;
}
- samr_pipe = talloc(tmp_ctx, struct dcerpc_pipe);
- if (!samr_pipe) {
+ connect_with_info = talloc(tmp_ctx, struct libnet_RpcConnect);
+ if (!connect_with_info) {
r->out.error_string = NULL;
talloc_free(tmp_ctx);
return NT_STATUS_NO_MEMORY;
}
-
- c = talloc(tmp_ctx, struct libnet_RpcConnect);
- if (!c) {
- r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- /* prepare connect to the LSA pipe of PDC */
+
+ /* prepare connect to the SAMR pipe of PDC */
if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) {
- c->level = LIBNET_RPC_CONNECT_PDC;
- c->in.domain_name = r->in.domain_name;
+ connect_with_info->in.binding = NULL;
+ connect_with_info->in.name = r->in.domain_name;
} else {
- c->level = LIBNET_RPC_CONNECT_BINDING;
- c->in.binding = r->in.binding;
+ connect_with_info->in.binding = r->in.binding;
+ connect_with_info->in.name = NULL;
}
- c->in.dcerpc_iface_name = DCERPC_LSARPC_NAME;
- c->in.dcerpc_iface_uuid = DCERPC_LSARPC_UUID;
- c->in.dcerpc_iface_version = DCERPC_LSARPC_VERSION;
-
- /* connect to the LSA pipe of the PDC */
- status = libnet_RpcConnect(ctx, c, c);
+ /* This level makes a connection to the LSA pipe on the way,
+ * to get some useful bits of information about the domain */
+ connect_with_info->level = LIBNET_RPC_CONNECT_DC_INFO;
+ connect_with_info->in.dcerpc_iface = &ndr_table_samr;
+
+ /*
+ establish the SAMR connection
+ */
+ status = libnet_RpcConnect(ctx, tmp_ctx, connect_with_info);
if (!NT_STATUS_IS_OK(status)) {
- if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) {
+ if (r->in.binding) {
r->out.error_string = talloc_asprintf(mem_ctx,
- "Connection to LSA pipe of PDC of domain '%s' failed: %s",
- r->in.domain_name, nt_errstr(status));
+ "Connection to SAMR pipe of DC %s failed: %s",
+ r->in.binding, connect_with_info->out.error_string);
} else {
r->out.error_string = talloc_asprintf(mem_ctx,
- "Connection to LSA pipe with binding '%s' failed: %s",
- r->in.binding, nt_errstr(status));
+ "Connection to SAMR pipe of PDC for %s failed: %s",
+ r->in.domain_name, connect_with_info->out.error_string);
}
talloc_free(tmp_ctx);
return status;
- }
- lsa_pipe = c->out.dcerpc_pipe;
-
- /* Get an LSA policy handle */
-
- ZERO_STRUCT(lsa_p_handle);
- qos.len = 0;
- qos.impersonation_level = 2;
- qos.context_mode = 1;
- qos.effective_only = 0;
-
- attr.len = 0;
- attr.root_dir = NULL;
- attr.object_name = NULL;
- attr.attributes = 0;
- attr.sec_desc = NULL;
- attr.sec_qos = &qos;
-
- lsa_open_policy.in.attr = &attr;
-
- lsa_open_policy.in.system_name = talloc_asprintf(tmp_ctx, "\\");
- if (!lsa_open_policy.in.system_name) {
- r->out.error_string = NULL;
- talloc_free(tmp_ctx);
- return NT_STATUS_NO_MEMORY;
}
- lsa_open_policy.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
- lsa_open_policy.out.handle = &lsa_p_handle;
-
- status = dcerpc_lsa_OpenPolicy2(lsa_pipe, tmp_ctx, &lsa_open_policy);
+ samr_pipe = connect_with_info->out.dcerpc_pipe;
- /* This now fails on ncacn_ip_tcp against Win2k3 SP1 */
- if (NT_STATUS_IS_OK(status)) {
- /* Look to see if this is ADS (a fault indicates NT4 or Samba 3.0) */
-
- lsa_query_info2.in.handle = &lsa_p_handle;
- lsa_query_info2.in.level = LSA_POLICY_INFO_DNS;
-
- status = dcerpc_lsa_QueryInfoPolicy2(lsa_pipe, tmp_ctx,
- &lsa_query_info2);
-
- if (!NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
- if (!NT_STATUS_IS_OK(status)) {
- r->out.error_string = talloc_asprintf(mem_ctx,
- "lsa_QueryInfoPolicy2 failed: %s",
- nt_errstr(status));
- talloc_free(tmp_ctx);
- return status;
- }
- realm = lsa_query_info2.out.info->dns.dns_domain.string;
- }
-
- /* Grab the domain SID (regardless of the result of the previous call */
-
- lsa_query_info.in.handle = &lsa_p_handle;
- lsa_query_info.in.level = LSA_POLICY_INFO_DOMAIN;
-
- status = dcerpc_lsa_QueryInfoPolicy(lsa_pipe, tmp_ctx,
- &lsa_query_info);
-
- if (!NT_STATUS_IS_OK(status)) {
- r->out.error_string = talloc_asprintf(mem_ctx,
- "lsa_QueryInfoPolicy2 failed: %s",
- nt_errstr(status));
- talloc_free(tmp_ctx);
- return status;
- }
-
- domain_sid = lsa_query_info.out.info->domain.sid;
- domain_name = lsa_query_info.out.info->domain.name.string;
- } else {
- /* Cause the code further down to try this with just SAMR */
- domain_sid = NULL;
- if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) {
- domain_name = talloc_strdup(tmp_ctx, r->in.domain_name);
- } else {
- /* Bugger, we just lost our way to automaticly find the domain name */
- domain_name = talloc_strdup(tmp_ctx, lp_workgroup());
- }
- }
-
- DEBUG(0, ("Joining domain %s\n", domain_name));
-
- /*
- establish a SAMR connection, on the same CIFS transport
- */
-
- /* Find the original binding string */
- status = dcerpc_parse_binding(tmp_ctx, lsa_pipe->conn->binding_string, &samr_binding);
- if (!NT_STATUS_IS_OK(status)) {
- r->out.error_string = talloc_asprintf(mem_ctx,
- "Failed to parse lsa binding '%s'",
- lsa_pipe->conn->binding_string);
- talloc_free(tmp_ctx);
- return status;
- }
-
- /* Make binding string for samr, not the other pipe */
- status = dcerpc_epm_map_binding(tmp_ctx, samr_binding,
- DCERPC_SAMR_UUID, DCERPC_SAMR_VERSION,
- lsa_pipe->conn->event_ctx);
- if (!NT_STATUS_IS_OK(status)) {
- r->out.error_string = talloc_asprintf(mem_ctx,
- "Failed to map DCERPC/TCP NCACN_NP pipe for '%s' - %s",
- DCERPC_NETLOGON_UUID,
- nt_errstr(status));
- talloc_free(tmp_ctx);
- return status;
- }
-
- /* Setup a SAMR connection */
- status = dcerpc_secondary_connection(lsa_pipe, &samr_pipe, samr_binding);
- if (!NT_STATUS_IS_OK(status)) {
- r->out.error_string = talloc_asprintf(mem_ctx,
- "SAMR secondary connection failed: %s",
- nt_errstr(status));
- talloc_free(tmp_ctx);
- return status;
- }
-
- status = dcerpc_pipe_auth(samr_pipe, samr_binding, DCERPC_SAMR_UUID,
- DCERPC_SAMR_VERSION, ctx->cred);
+ status = dcerpc_pipe_auth(tmp_ctx, &samr_pipe,
+ connect_with_info->out.dcerpc_pipe->binding,
+ &ndr_table_samr, ctx->cred, ctx->lp_ctx);
if (!NT_STATUS_IS_OK(status)) {
r->out.error_string = talloc_asprintf(mem_ctx,
"SAMR bind failed: %s",
return status;
}
+ /* If this is a connection on ncacn_ip_tcp to Win2k3 SP1, we don't get back this useful info */
+ if (!connect_with_info->out.domain_name) {
+ if (r->in.level == LIBNET_JOINDOMAIN_AUTOMATIC) {
+ connect_with_info->out.domain_name = talloc_strdup(tmp_ctx, r->in.domain_name);
+ } else {
+ /* Bugger, we just lost our way to automaticly find the domain name */
+ connect_with_info->out.domain_name = talloc_strdup(tmp_ctx, lp_workgroup(ctx->lp_ctx));
+ connect_with_info->out.realm = talloc_strdup(tmp_ctx, lp_realm(ctx->lp_ctx));
+ }
+ }
+
/* Perhaps we didn't get a SID above, because we are against ncacn_ip_tcp */
- if (!domain_sid) {
+ if (!connect_with_info->out.domain_sid) {
struct lsa_String name;
struct samr_LookupDomain l;
- name.string = domain_name;
+ name.string = connect_with_info->out.domain_name;
l.in.connect_handle = &p_handle;
l.in.domain_name = &name;
talloc_free(tmp_ctx);
return status;
}
- domain_sid = l.out.sid;
+ connect_with_info->out.domain_sid = l.out.sid;
}
/* prepare samr_OpenDomain */
ZERO_STRUCT(d_handle);
od.in.connect_handle = &p_handle;
od.in.access_mask = SEC_FLAG_MAXIMUM_ALLOWED;
- od.in.sid = domain_sid;
+ od.in.sid = connect_with_info->out.domain_sid;
od.out.domain_handle = &d_handle;
- /* 4. do a samr_OpenDomain to get a domain handle */
+ /* do a samr_OpenDomain to get a domain handle */
status = dcerpc_samr_OpenDomain(samr_pipe, tmp_ctx, &od);
if (!NT_STATUS_IS_OK(status)) {
r->out.error_string = talloc_asprintf(mem_ctx,
- "samr_OpenDomain for [%s] failed: %s",
- r->in.domain_name,
- nt_errstr(status));
+ "samr_OpenDomain for [%s] failed: %s",
+ dom_sid_string(tmp_ctx, connect_with_info->out.domain_sid),
+ nt_errstr(status));
talloc_free(tmp_ctx);
return status;
}
cu.out.rid = &rid;
cu.out.access_granted = &access_granted;
- /* 4. do a samr_CreateUser2 to get an account handle, or an error */
+ /* do a samr_CreateUser2 to get an account handle, or an error */
cu_status = dcerpc_samr_CreateUser2(samr_pipe, tmp_ctx, &cu);
status = cu_status;
- if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
- r->out.error_string = talloc_asprintf(mem_ctx,
- "samr_CreateUser2 for [%s] failed: %s\n",
- r->in.domain_name, nt_errstr(status));
- talloc_free(tmp_ctx);
- return status;
-
- } else if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
+ if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
/* prepare samr_LookupNames */
ln.in.domain_handle = &d_handle;
ln.in.num_names = 1;
/* check if we got one RID for the user */
if (ln.out.rids.count != 1) {
r->out.error_string = talloc_asprintf(mem_ctx,
- "samr_LookupNames for [%s] returns %d RIDs\n",
+ "samr_LookupNames for [%s] returns %d RIDs",
r->in.account_name, ln.out.rids.count);
talloc_free(tmp_ctx);
return NT_STATUS_INVALID_PARAMETER;
talloc_free(tmp_ctx);
return status;
}
- }
- /* Find out what password policy this user has */
- pwp.in.user_handle = u_handle;
- status = dcerpc_samr_GetUserPwInfo(samr_pipe, tmp_ctx, &pwp);
- if (NT_STATUS_IS_OK(status)) {
- policy_min_pw_len = pwp.out.info.min_password_length;
- }
-
- /* Grab a password of that minimum length */
-
- password_str = generate_random_str(tmp_ctx, MAX(8, policy_min_pw_len));
-
- r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
- r2.samr_handle.in.account_name = r->in.account_name;
- r2.samr_handle.in.newpassword = password_str;
- r2.samr_handle.in.user_handle = u_handle;
- r2.samr_handle.in.dcerpc_pipe = samr_pipe;
+ if (r->in.recreate_account) {
+ struct samr_DeleteUser d;
+ d.in.user_handle = u_handle;
+ d.out.user_handle = u_handle;
+ status = dcerpc_samr_DeleteUser(samr_pipe, mem_ctx, &d);
+ if (!NT_STATUS_IS_OK(status)) {
+ r->out.error_string = talloc_asprintf(mem_ctx,
+ "samr_DeleteUser (for recreate) of [%s] failed: %s",
+ r->in.account_name,
+ nt_errstr(status));
+ talloc_free(tmp_ctx);
+ return status;
+ }
- status = libnet_SetPassword(ctx, tmp_ctx, &r2);
- if (!NT_STATUS_IS_OK(status)) {
- r->out.error_string = talloc_steal(mem_ctx, r2.samr_handle.out.error_string);
+ /* We want to recreate, so delete and another samr_CreateUser2 */
+
+ /* &cu filled in above */
+ status = dcerpc_samr_CreateUser2(samr_pipe, tmp_ctx, &cu);
+ if (!NT_STATUS_IS_OK(status)) {
+ r->out.error_string = talloc_asprintf(mem_ctx,
+ "samr_CreateUser2 (recreate) for [%s] failed: %s",
+ r->in.account_name, nt_errstr(status));
+ talloc_free(tmp_ctx);
+ return status;
+ }
+ }
+ } else if (!NT_STATUS_IS_OK(status)) {
+ r->out.error_string = talloc_asprintf(mem_ctx,
+ "samr_CreateUser2 for [%s] failed: %s",
+ r->in.account_name, nt_errstr(status));
talloc_free(tmp_ctx);
return status;
}
status = NT_STATUS_INVALID_PARAMETER;
r->out.error_string
= talloc_asprintf(mem_ctx,
- "samr_QueryUserInfo failed to return qui.out.info for [%s]: %s\n",
+ "samr_QueryUserInfo failed to return qui.out.info for [%s]: %s",
r->in.account_name, nt_errstr(status));
talloc_free(tmp_ctx);
return status;
}
- /* Possibly change account type (if we are creating a new account) */
- if (((qui.out.info->info16.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST | ACB_DOMTRUST))
- != r->in.acct_type) && (!NT_STATUS_EQUAL(cu_status, NT_STATUS_USER_EXISTS))) {
- acct_flags = (qui.out.info->info16.acct_flags & ~(ACB_WSTRUST | ACB_SVRTRUST | ACB_DOMTRUST))
- | r->in.acct_type;
+ old_acct_flags = (qui.out.info->info16.acct_flags & (ACB_WSTRUST | ACB_SVRTRUST | ACB_DOMTRUST));
+ /* Possibly bail if the account is of the wrong type */
+ if (old_acct_flags
+ != r->in.acct_type) {
+ const char *old_account_type, *new_account_type;
+ switch (old_acct_flags) {
+ case ACB_WSTRUST:
+ old_account_type = "domain member (member)";
+ break;
+ case ACB_SVRTRUST:
+ old_account_type = "domain controller (bdc)";
+ break;
+ case ACB_DOMTRUST:
+ old_account_type = "trusted domain";
+ break;
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+ switch (r->in.acct_type) {
+ case ACB_WSTRUST:
+ new_account_type = "domain member (member)";
+ break;
+ case ACB_SVRTRUST:
+ new_account_type = "domain controller (bdc)";
+ break;
+ case ACB_DOMTRUST:
+ new_account_type = "trusted domain";
+ break;
+ default:
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ if (!NT_STATUS_EQUAL(cu_status, NT_STATUS_USER_EXISTS)) {
+ /* We created a new user, but they didn't come out the right type?!? */
+ r->out.error_string
+ = talloc_asprintf(mem_ctx,
+ "We asked to create a new machine account (%s) of type %s, "
+ "but we got an account of type %s. This is unexpected. "
+ "Perhaps delete the account and try again.",
+ r->in.account_name, new_account_type, old_account_type);
+ talloc_free(tmp_ctx);
+ return NT_STATUS_INVALID_PARAMETER;
+ } else {
+ /* The account is of the wrong type, so bail */
+
+ /* TODO: We should allow a --force option to override, and redo this from the top setting r.in.recreate_account */
+ r->out.error_string
+ = talloc_asprintf(mem_ctx,
+ "The machine account (%s) already exists in the domain %s, "
+ "but is a %s. You asked to join as a %s. Please delete "
+ "the account and try again.",
+ r->in.account_name, connect_with_info->out.domain_name, old_account_type, new_account_type);
+ talloc_free(tmp_ctx);
+ return NT_STATUS_USER_EXISTS;
+ }
} else {
acct_flags = qui.out.info->info16.acct_flags;
}
- acct_flags = (acct_flags & ~ACB_DISABLED);
+ acct_flags = (acct_flags & ~(ACB_DISABLED|ACB_PWNOTREQ));
- /* reset flags (if required) */
- if (acct_flags != qui.out.info->info16.acct_flags) {
- ZERO_STRUCT(u_info);
- u_info.info16.acct_flags = acct_flags;
+ /* Find out what password policy this user has */
+ pwp.in.user_handle = u_handle;
- sui.in.user_handle = u_handle;
- sui.in.info = &u_info;
- sui.in.level = 16;
-
- dcerpc_samr_SetUserInfo(samr_pipe, tmp_ctx, &sui);
- if (!NT_STATUS_IS_OK(status)) {
- r->out.error_string = talloc_asprintf(mem_ctx,
- "samr_SetUserInfo for [%s] failed to remove ACB_DISABLED flag: %s",
- r->in.account_name,
- nt_errstr(status));
- talloc_free(tmp_ctx);
- return status;
- }
+ status = dcerpc_samr_GetUserPwInfo(samr_pipe, tmp_ctx, &pwp);
+ if (NT_STATUS_IS_OK(status)) {
+ policy_min_pw_len = pwp.out.info.min_password_length;
+ }
+
+ /* Grab a password of that minimum length */
+
+ password_str = generate_random_str(tmp_ctx, MAX(8, policy_min_pw_len));
+
+ /* set full_name and reset flags */
+ ZERO_STRUCT(u_info21);
+ u_info21.full_name.string = r->in.account_name;
+ u_info21.acct_flags = acct_flags;
+ u_info21.fields_present = SAMR_FIELD_FULL_NAME | SAMR_FIELD_ACCT_FLAGS;
+
+ r2.samr_handle.level = LIBNET_SET_PASSWORD_SAMR_HANDLE;
+ r2.samr_handle.in.account_name = r->in.account_name;
+ r2.samr_handle.in.newpassword = password_str;
+ r2.samr_handle.in.user_handle = u_handle;
+ r2.samr_handle.in.dcerpc_pipe = samr_pipe;
+ r2.samr_handle.in.info21 = &u_info21;
+
+ status = libnet_SetPassword(ctx, tmp_ctx, &r2);
+ if (!NT_STATUS_IS_OK(status)) {
+ r->out.error_string = talloc_steal(mem_ctx, r2.samr_handle.out.error_string);
+ talloc_free(tmp_ctx);
+ return status;
}
- account_sid = dom_sid_add_rid(mem_ctx, domain_sid, rid);
+ account_sid = dom_sid_add_rid(mem_ctx, connect_with_info->out.domain_sid, rid);
if (!account_sid) {
r->out.error_string = NULL;
talloc_free(tmp_ctx);
return NT_STATUS_NO_MEMORY;
}
+ /* Finish out by pushing various bits of status data out for the caller to use */
r->out.join_password = password_str;
- talloc_steal(mem_ctx, password_str);
+ talloc_steal(mem_ctx, r->out.join_password);
- r->out.domain_sid = domain_sid;
- talloc_steal(mem_ctx, domain_sid);
+ r->out.domain_sid = connect_with_info->out.domain_sid;
+ talloc_steal(mem_ctx, r->out.domain_sid);
r->out.account_sid = account_sid;
- talloc_steal(mem_ctx, account_sid);
-
- r->out.domain_name = domain_name;
- talloc_steal(mem_ctx, domain_name);
- r->out.realm = realm;
- talloc_steal(mem_ctx, realm);
- r->out.lsa_pipe = lsa_pipe;
- talloc_steal(mem_ctx, lsa_pipe);
+ talloc_steal(mem_ctx, r->out.account_sid);
+
+ r->out.domain_name = connect_with_info->out.domain_name;
+ talloc_steal(mem_ctx, r->out.domain_name);
+ r->out.realm = connect_with_info->out.realm;
+ talloc_steal(mem_ctx, r->out.realm);
r->out.samr_pipe = samr_pipe;
talloc_steal(mem_ctx, samr_pipe);
- r->out.samr_binding = samr_binding;
- talloc_steal(mem_ctx, samr_binding);
+ r->out.samr_binding = samr_pipe->binding;
+ talloc_steal(mem_ctx, r->out.samr_binding);
r->out.user_handle = u_handle;
talloc_steal(mem_ctx, u_handle);
r->out.error_string = r2.samr_handle.out.error_string;
/* Now, if it was AD, then we want to start looking changing a
* few more things. Otherwise, we are done. */
- if (realm) {
+ if (r->out.realm) {
status = libnet_JoinADSDomain(ctx, r);
return status;
}
struct libnet_JoinDomain *r2;
int ret, rtn;
struct ldb_context *ldb;
- const struct ldb_dn *base_dn;
+ struct ldb_dn *base_dn;
struct ldb_message **msgs, *msg;
const char *sct;
const char * const attrs[] = {
"secret",
"priorSecret",
"priorChanged",
+ "krb5Keytab",
+ "privateKeytab",
NULL
};
uint32_t acct_type = 0;
return NT_STATUS_NO_MEMORY;
}
- if (r->in.secure_channel_type == SEC_CHAN_BDC) {
+ if (r->in.join_type == SEC_CHAN_BDC) {
acct_type = ACB_SVRTRUST;
- } else if (r->in.secure_channel_type == SEC_CHAN_WKSTA) {
+ } else if (r->in.join_type == SEC_CHAN_WKSTA) {
acct_type = ACB_WSTRUST;
} else {
r->out.error_string = NULL;
return NT_STATUS_INVALID_PARAMETER;
}
- if ((r->in.netbios_name != NULL) && (r->in.level != LIBNET_JOIN_AUTOMATIC)) {
+ if (r->in.netbios_name != NULL) {
netbios_name = r->in.netbios_name;
} else {
- netbios_name = talloc_asprintf(tmp_mem, "%s", lp_netbios_name());
+ netbios_name = talloc_reference(tmp_mem, lp_netbios_name(ctx->lp_ctx));
if (!netbios_name) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
}
}
- account_name = talloc_asprintf(tmp_mem, "%s$", netbios_name);
+ account_name = talloc_asprintf(tmp_mem, "%s$", netbios_name);
if (!account_name) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
* Local secrets are stored in secrets.ldb
* open it to make sure we can write the info into it after the join
*/
- ldb = secrets_db_connect(tmp_mem);
+ ldb = secrets_db_connect(tmp_mem, ctx->lp_ctx);
if (!ldb) {
r->out.error_string
= talloc_asprintf(mem_ctx,
- "Could not open secrets database\n");
+ "Could not open secrets database");
talloc_free(tmp_mem);
return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
}
r2->in.netbios_name = netbios_name;
r2->in.level = LIBNET_JOINDOMAIN_AUTOMATIC;
r2->in.acct_type = acct_type;
+ r2->in.recreate_account = false;
status = libnet_JoinDomain(ctx, r2, r2);
if (!NT_STATUS_IS_OK(status)) {
r->out.error_string = talloc_steal(mem_ctx, r2->out.error_string);
/*
* now prepare the record for secrets.ldb
*/
- sct = talloc_asprintf(tmp_mem, "%d", r->in.secure_channel_type);
+ sct = talloc_asprintf(tmp_mem, "%d", r->in.join_type);
if (!sct) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
- base_dn = ldb_dn_explode(tmp_mem, "cn=Primary Domains");
+ base_dn = ldb_dn_new(tmp_mem, ldb, "cn=Primary Domains");
if (!base_dn) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
- msg->dn = ldb_dn_build_child(tmp_mem, "flatname", r2->out.domain_name, base_dn);
- if (!msg->dn) {
+ msg->dn = ldb_dn_copy(tmp_mem, base_dn);
+ if ( ! ldb_dn_add_child_fmt(msg->dn, "flatname=%s", r2->out.domain_name)) {
r->out.error_string = NULL;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
+
+ rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "objectClass", "primaryDomain");
+ if (rtn == -1) {
+ r->out.error_string = NULL;
+ talloc_free(tmp_mem);
+ return NT_STATUS_NO_MEMORY;
+ }
}
rtn = samdb_msg_add_string(ldb, tmp_mem, msg, "objectClass", "primaryDomain");
"(|" SECRETS_PRIMARY_DOMAIN_FILTER "(realm=%s))",
r2->out.domain_name, r2->out.realm);
if (ret == 0) {
+ rtn = samdb_msg_set_string(ldb, tmp_mem, msg, "secretsKeytab", "secrets.keytab");
+ if (rtn == -1) {
+ r->out.error_string = NULL;
+ talloc_free(tmp_mem);
+ return NT_STATUS_NO_MEMORY;
+ }
} else if (ret == -1) {
r->out.error_string
= talloc_asprintf(mem_ctx,
talloc_free(tmp_mem);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
} else {
+ const struct ldb_val *private_keytab;
+ const struct ldb_val *krb5_main_keytab;
const struct ldb_val *prior_secret;
const struct ldb_val *prior_modified_time;
int i;
talloc_free(tmp_mem);
return NT_STATUS_NO_MEMORY;
}
+
+ /* We will want to keep the keytab names */
+ private_keytab = ldb_msg_find_ldb_val(msgs[0], "privateKeytab");
+ if (private_keytab) {
+ rtn = samdb_msg_set_value(ldb, tmp_mem, msg, "privateKeytab", private_keytab);
+ if (rtn == -1) {
+ r->out.error_string = NULL;
+ talloc_free(tmp_mem);
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
+ krb5_main_keytab = ldb_msg_find_ldb_val(msgs[0], "krb5Keytab");
+ if (krb5_main_keytab) {
+ rtn = samdb_msg_set_value(ldb, tmp_mem, msg,
+ "krb5Keytab", krb5_main_keytab);
+ if (rtn == -1) {
+ r->out.error_string = NULL;
+ talloc_free(tmp_mem);
+ return NT_STATUS_NO_MEMORY;
+ }
+ }
}
/* create the secret */
- ret = samdb_add(ldb, tmp_mem, msg);
+ ret = ldb_add(ldb, msg);
if (ret != 0) {
- r->out.error_string = talloc_asprintf(mem_ctx, "Failed to create secret record %s\n",
- ldb_dn_linearize(ldb, msg->dn));
+ r->out.error_string = talloc_asprintf(mem_ctx, "Failed to create secret record %s",
+ ldb_dn_get_linearized(msg->dn));
talloc_free(tmp_mem);
return NT_STATUS_INTERNAL_DB_CORRUPTION;
}
talloc_steal(mem_ctx, r2->out.join_password);
r->out.domain_sid = r2->out.domain_sid;
talloc_steal(mem_ctx, r2->out.domain_sid);
+ r->out.domain_name = r2->out.domain_name;
+ talloc_steal(mem_ctx, r2->out.domain_name);
talloc_free(tmp_mem);
return NT_STATUS_OK;
}
NTSTATUS libnet_Join(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_Join *r)
{
- switch (r->in.secure_channel_type) {
+ switch (r->in.join_type) {
case SEC_CHAN_WKSTA:
return libnet_Join_primary_domain(ctx, mem_ctx, r);
case SEC_CHAN_BDC:
}
r->out.error_string = talloc_asprintf(mem_ctx,
- "Invalid secure channel type specified (%08X) attempting to join domain %s",
- r->in.secure_channel_type, r->in.domain_name);
+ "Invalid join type specified (%08X) attempting to join domain %s",
+ r->in.join_type, r->in.domain_name);
return NT_STATUS_INVALID_PARAMETER;
}
-
-
git.samba.org / ira / wip.git / blobdiff