source/dsdb/samdb/cracknames.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the drsuapi pipe
   5    DsCrackNames()
   6
   7    Copyright (C) Stefan Metzmacher 2004
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "librpc/gen_ndr/ndr_drsuapi.h"
  27 #include "rpc_server/common/common.h"
  28 #include "lib/ldb/include/ldb_errors.h"
  29 #include "system/kerberos.h"
  30 #include "auth/kerberos/kerberos.h"
  31 #include "dsdb/samdb/samdb.h"
  32 #include "libcli/ldap/ldap.h"
  33 #include "auth/auth.h"
  34
  35 static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  36                                    struct smb_krb5_context *smb_krb5_context,
  37                                    uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
  38                                    const struct ldb_dn *name_dn, const char *name,
  39                                    const char *domain_filter, const char *result_filter,
  40                                    struct drsuapi_DsNameInfo1 *info1);
  41 static WERROR DsCrackNameOneSyntactical(TALLOC_CTX *mem_ctx,
  42                                         uint32_t format_offered, uint32_t format_desired,
  43                                         const struct ldb_dn *name_dn, const char *name,
  44                                         struct drsuapi_DsNameInfo1 *info1);
  45
  46 static enum drsuapi_DsNameStatus LDB_lookup_spn_alias(krb5_context context, struct ldb_context *ldb_ctx,
  47                                    TALLOC_CTX *mem_ctx,
  48                                    const char *alias_from,
  49                                    char **alias_to)
  50 {
  51         int i;
  52         int ret;
  53         struct ldb_result *res;
  54         struct ldb_message_element *spnmappings;
  55         struct ldb_dn *service_dn = ldb_dn_string_compose(mem_ctx, samdb_base_dn(mem_ctx),
  56                                                 "CN=Directory Service,CN=Windows NT"
  57                                                 ",CN=Services,CN=Configuration");
  58         char *service_dn_str = ldb_dn_linearize(mem_ctx, service_dn);
  59         const char *directory_attrs[] = {
  60                 "sPNMappings",
  61                 NULL
  62         };
  63
  64         ret = ldb_search(ldb_ctx, service_dn, LDB_SCOPE_BASE, "(objectClass=nTDSService)",
  65                            directory_attrs, &res);
  66         talloc_steal(mem_ctx, res);
  67
  68         if (ret != LDB_SUCCESS) {
  69                 DEBUG(1, ("ldb_search: dn: %s not found: %s", service_dn_str, ldb_errstring(ldb_ctx)));
  70                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  71         } else if (res->count > 1) {
  72                 DEBUG(1, ("ldb_search: dn: %s found %d times!", service_dn_str, res->count));
  73                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  74         }
  75
  76         spnmappings = ldb_msg_find_element(res->msgs[0], "sPNMappings");
  77         if (!spnmappings || spnmappings->num_values == 0) {
  78                 DEBUG(1, ("ldb_search: dn: %s no sPNMappings attribute", service_dn_str));
  79                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  80         }
  81
  82         for (i = 0; i < spnmappings->num_values; i++) {
  83                 char *mapping, *p, *str;
  84                 mapping = talloc_strdup(mem_ctx,
  85                                         (const char *)spnmappings->values[i].data);
  86                 if (!mapping) {
  87                         DEBUG(1, ("LDB_lookup_spn_alias: ldb_search: dn: %s did not have an sPNMapping\n", service_dn_str));
  88                         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  89                 }
  90
  91                 /* C string manipulation sucks */
  92
  93                 p = strchr(mapping, '=');
  94                 if (!p) {
  95                         DEBUG(1, ("ldb_search: dn: %s sPNMapping malformed: %s\n",
  96                                   service_dn_str, mapping));
  97                         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  98                 }
  99                 p[0] = '\0';
 100                 p++;
 101                 do {
 102                         str = p;
 103                         p = strchr(p, ',');
 104                         if (p) {
 105                                 p[0] = '\0';
 106                                 p++;
 107                         }
 108                         if (strcasecmp(str, alias_from) == 0) {
 109                                 *alias_to = mapping;
 110                                 return DRSUAPI_DS_NAME_STATUS_OK;
 111                         }
 112                 } while (p);
 113         }
 114         DEBUG(1, ("LDB_lookup_spn_alias: no alias for service %s applicable\n", alias_from));
 115         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 116 }
 117
 118 /* When cracking a ServicePrincipalName, many services may be served
 119  * by the host/ servicePrincipalName.  The incoming query is for cifs/
 120  * but we translate it here, and search on host/.  This is done after
 121  * the cifs/ entry has been searched for, making this a fallback */
 122
 123 static WERROR DsCrackNameSPNAlias(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 124                                   struct smb_krb5_context *smb_krb5_context,
 125                                   uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 126                                   const char *name, struct drsuapi_DsNameInfo1 *info1)
 127 {
 128         WERROR wret;
 129         krb5_error_code ret;
 130         krb5_principal principal;
 131         const char *service;
 132         char *new_service;
 133         char *new_princ;
 134         enum drsuapi_DsNameStatus namestatus;
 135
 136         /* parse principal */
 137         ret = krb5_parse_name_norealm(smb_krb5_context->krb5_context,
 138                                       name, &principal);
 139         if (ret) {
 140                 DEBUG(2, ("Could not parse principal: %s: %s",
 141                           name, smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 142                                                            ret, mem_ctx)));
 143                 return WERR_NOMEM;
 144         }
 145
 146         /* grab cifs/, http/ etc */
 147
 148         /* This is checked for in callers, but be safe */
 149         if (principal->name.name_string.len < 2) {
 150                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 151                 return WERR_OK;
 152         }
 153         service = principal->name.name_string.val[0];
 154
 155         /* MAP it */
 156         namestatus = LDB_lookup_spn_alias(smb_krb5_context->krb5_context,
 157                                           sam_ctx, mem_ctx,
 158                                           service, &new_service);
 159
 160         if (namestatus != DRSUAPI_DS_NAME_STATUS_OK) {
 161                 info1->status = namestatus;
 162                 return WERR_OK;
 163         }
 164
 165         if (ret != 0) {
 166                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 167                 return WERR_OK;
 168         }
 169
 170         /* ooh, very nasty playing around in the Principal... */
 171         free(principal->name.name_string.val[0]);
 172         principal->name.name_string.val[0] = strdup(new_service);
 173         if (!principal->name.name_string.val[0]) {
 174                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 175                 return WERR_NOMEM;
 176         }
 177
 178         /* reform principal */
 179         ret = krb5_unparse_name_norealm(smb_krb5_context->krb5_context, principal, &new_princ);
 180
 181         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 182
 183         if (ret) {
 184                 return WERR_NOMEM;
 185         }
 186
 187         wret = DsCrackNameOneName(sam_ctx, mem_ctx, format_flags, format_offered, format_desired,
 188                                   new_princ, info1);
 189         free(new_princ);
 190         return wret;
 191 }
 192
 193 /* Subcase of CrackNames, for the userPrincipalName */
 194
 195 static WERROR DsCrackNameUPN(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 196                              struct smb_krb5_context *smb_krb5_context,
 197                              uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 198                              const char *name, struct drsuapi_DsNameInfo1 *info1)
 199 {
 200         WERROR status;
 201         const char *domain_filter = NULL;
 202         const char *result_filter = NULL;
 203         krb5_error_code ret;
 204         krb5_principal principal;
 205         char **realm;
 206         char *unparsed_name_short;
 207
 208         /* Prevent recursion */
 209         if (!name) {
 210                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 211                 return WERR_OK;
 212         }
 213
 214         ret = krb5_parse_name_mustrealm(smb_krb5_context->krb5_context, name, &principal);
 215         if (ret) {
 216                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 217                 return WERR_OK;
 218         }
 219
 220         domain_filter = NULL;
 221         realm = krb5_princ_realm(smb_krb5_context->krb5_context, principal);
 222         domain_filter = talloc_asprintf(mem_ctx,
 223                                         "(&(&(|(&(dnsRoot=%s)(nETBIOSName=*))(nETBIOSName=%s))(objectclass=crossRef))(ncName=*))",
 224                                         ldb_binary_encode_string(mem_ctx, *realm),
 225                                         ldb_binary_encode_string(mem_ctx, *realm));
 226         ret = krb5_unparse_name_norealm(smb_krb5_context->krb5_context, principal, &unparsed_name_short);
 227         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 228
 229         if (ret) {
 230                 free(unparsed_name_short);
 231                 return WERR_NOMEM;
 232         }
 233
 234         /* This may need to be extended for more userPrincipalName variations */
 235         result_filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(samAccountName=%s))",
 236                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short));
 237         if (!result_filter || !domain_filter) {
 238                 free(unparsed_name_short);
 239                 return WERR_NOMEM;
 240         }
 241         status = DsCrackNameOneFilter(sam_ctx, mem_ctx,
 242                                       smb_krb5_context,
 243                                       format_flags, format_offered, format_desired,
 244                                       NULL, unparsed_name_short, domain_filter, result_filter,
 245                                       info1);
 246         free(unparsed_name_short);
 247         return status;
 248 }
 249
 250 /* Crack a single 'name', from format_offered into format_desired, returning the result in info1 */
 251
 252 WERROR DsCrackNameOneName(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 253                           uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 254                           const char *name, struct drsuapi_DsNameInfo1 *info1)
 255 {
 256         krb5_error_code ret;
 257         const char *domain_filter = NULL;
 258         const char *result_filter = NULL;
 259         struct ldb_dn *name_dn = NULL;
 260
 261         struct smb_krb5_context *smb_krb5_context;
 262         ret = smb_krb5_init_context(mem_ctx, &smb_krb5_context);
 263
 264         if (ret) {
 265                 return WERR_NOMEM;
 266         }
 267
 268         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 269         info1->dns_domain_name = NULL;
 270         info1->result_name = NULL;
 271
 272         if (!name) {
 273                 return WERR_INVALID_PARAM;
 274         }
 275
 276         /* TODO: - fill the correct names in all cases!
 277          *       - handle format_flags
 278          */
 279
 280         /* here we need to set the domain_filter and/or the result_filter */
 281         switch (format_offered) {
 282         case DRSUAPI_DS_NAME_FORMAT_CANONICAL: {
 283                 char *str;
 284
 285                 str = talloc_strdup(mem_ctx, name);
 286                 WERR_TALLOC_CHECK(str);
 287
 288                 if (strlen(str) == 0 || str[strlen(str)-1] != '/') {
 289                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 290                         return WERR_OK;
 291                 }
 292
 293                 str[strlen(str)-1] = '\0';
 294
 295                 domain_filter = talloc_asprintf(mem_ctx,
 296                                                 "(&(&(&(dnsRoot=%s)(objectclass=crossRef)))(nETBIOSName=*)(ncName=*))",
 297                                                 ldb_binary_encode_string(mem_ctx, str));
 298                 WERR_TALLOC_CHECK(domain_filter);
 299
 300                 break;
 301         }
 302         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT: {
 303                 char *p;
 304                 char *domain;
 305                 const char *account = NULL;
 306
 307                 domain = talloc_strdup(mem_ctx, name);
 308                 WERR_TALLOC_CHECK(domain);
 309
 310                 p = strchr(domain, '\\');
 311                 if (!p) {
 312                         /* invalid input format */
 313                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 314                         return WERR_OK;
 315                 }
 316                 p[0] = '\0';
 317
 318                 if (p[1]) {
 319                         account = &p[1];
 320                 }
 321
 322                 domain_filter = talloc_asprintf(mem_ctx,
 323                                                 "(&(&(nETBIOSName=%s)(objectclass=crossRef))(ncName=*))",
 324                                                 ldb_binary_encode_string(mem_ctx, domain));
 325                 WERR_TALLOC_CHECK(domain_filter);
 326                 if (account) {
 327                         result_filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)",
 328                                                         ldb_binary_encode_string(mem_ctx, account));
 329                         WERR_TALLOC_CHECK(result_filter);
 330                 }
 331
 332                 talloc_free(domain);
 333                 break;
 334         }
 335         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779: {
 336                 name_dn = ldb_dn_explode(mem_ctx, name);
 337                 domain_filter = NULL;
 338                 if (!name_dn) {
 339                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 340                         return WERR_OK;
 341                 }
 342                 break;
 343         }
 344         case DRSUAPI_DS_NAME_FORMAT_GUID: {
 345                 struct GUID guid;
 346                 char *ldap_guid;
 347                 NTSTATUS nt_status;
 348                 domain_filter = NULL;
 349
 350                 nt_status = GUID_from_string(name, &guid);
 351                 if (!NT_STATUS_IS_OK(nt_status)) {
 352                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 353                         return WERR_OK;
 354                 }
 355
 356                 ldap_guid = ldap_encode_ndr_GUID(mem_ctx, &guid);
 357                 if (!ldap_guid) {
 358                         return WERR_NOMEM;
 359                 }
 360                 result_filter = talloc_asprintf(mem_ctx, "(objectGUID=%s)",
 361                                                 ldap_guid);
 362                 WERR_TALLOC_CHECK(result_filter);
 363                 break;
 364         }
 365         case DRSUAPI_DS_NAME_FORMAT_DISPLAY: {
 366                 domain_filter = NULL;
 367
 368                 result_filter = talloc_asprintf(mem_ctx, "(|(displayName=%s)(samAccountName=%s))",
 369                                                 ldb_binary_encode_string(mem_ctx, name),
 370                                                 ldb_binary_encode_string(mem_ctx, name));
 371                 WERR_TALLOC_CHECK(result_filter);
 372                 break;
 373         }
 374
 375         case DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY: {
 376                 struct dom_sid *sid = dom_sid_parse_talloc(mem_ctx, name);
 377                 char *ldap_sid;
 378
 379                 domain_filter = NULL;
 380                 if (!sid) {
 381                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 382                         return WERR_OK;
 383                 }
 384                 ldap_sid = ldap_encode_ndr_dom_sid(mem_ctx,
 385                                                    sid);
 386                 if (!ldap_sid) {
 387                         return WERR_NOMEM;
 388                 }
 389                 result_filter = talloc_asprintf(mem_ctx, "(objectSid=%s)",
 390                                                 ldap_sid);
 391                 WERR_TALLOC_CHECK(result_filter);
 392                 break;
 393         }
 394         case DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL: {
 395                 krb5_principal principal;
 396                 char *unparsed_name;
 397                 ret = krb5_parse_name(smb_krb5_context->krb5_context, name, &principal);
 398                 if (ret) {
 399                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 400                         return WERR_OK;
 401                 }
 402
 403                 domain_filter = NULL;
 404
 405                 ret = krb5_unparse_name(smb_krb5_context->krb5_context, principal, &unparsed_name);
 406                 if (ret) {
 407                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 408                         return WERR_NOMEM;
 409                 }
 410
 411                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 412                 result_filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(userPrincipalName=%s))",
 413                                                 ldb_binary_encode_string(mem_ctx, unparsed_name));
 414
 415                 free(unparsed_name);
 416                 WERR_TALLOC_CHECK(result_filter);
 417                 break;
 418         }
 419         case DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL: {
 420                 krb5_principal principal;
 421                 char *unparsed_name_short;
 422                 char *service;
 423                 ret = krb5_parse_name_norealm(smb_krb5_context->krb5_context, name, &principal);
 424                 if (ret) {
 425                         /* perhaps it's a principal with a realm, so return the right 'domain only' response */
 426                         char **realm;
 427                         ret = krb5_parse_name_mustrealm(smb_krb5_context->krb5_context, name, &principal);
 428                         if (ret) {
 429                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 430                                 return WERR_OK;
 431                         }
 432
 433                         /* This isn't an allocation assignemnt, so it is free'ed with the krb5_free_principal */
 434                         realm = krb5_princ_realm(smb_krb5_context->krb5_context, principal);
 435
 436                         info1->dns_domain_name  = talloc_strdup(info1, *realm);
 437                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 438
 439                         WERR_TALLOC_CHECK(info1->dns_domain_name);
 440
 441                         info1->status = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
 442                         return WERR_OK;
 443
 444                 } else if (principal->name.name_string.len < 2) {
 445                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 446                         return WERR_OK;
 447                 }
 448
 449                 domain_filter = NULL;
 450
 451                 ret = krb5_unparse_name_norealm(smb_krb5_context->krb5_context, principal, &unparsed_name_short);
 452                 if (ret) {
 453                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 454                         return WERR_NOMEM;
 455                 }
 456
 457                 service = principal->name.name_string.val[0];
 458                 if ((principal->name.name_string.len == 2) && (strcasecmp(service, "host") == 0)) {
 459                         /* the 'cn' attribute is just the leading part of the name */
 460                         char *computer_name;
 461                         computer_name = talloc_strndup(mem_ctx, principal->name.name_string.val[1],
 462                                                       strcspn(principal->name.name_string.val[1], "."));
 463                         if (computer_name == NULL) {
 464                                 return WERR_NOMEM;
 465                         }
 466
 467                         result_filter = talloc_asprintf(mem_ctx, "(|(&(servicePrincipalName=%s)(objectClass=user))(&(cn=%s)(objectClass=computer)))",
 468                                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short),
 469                                                         ldb_binary_encode_string(mem_ctx, computer_name));
 470                 } else {
 471                         result_filter = talloc_asprintf(mem_ctx, "(&(servicePrincipalName=%s)(objectClass=user))",
 472                                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short));
 473                 }
 474                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 475                 free(unparsed_name_short);
 476                 WERR_TALLOC_CHECK(result_filter);
 477
 478                 break;
 479         }
 480         default: {
 481                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 482                 return WERR_OK;
 483         }
 484
 485         }
 486
 487         if (format_flags & DRSUAPI_DS_NAME_FLAG_SYNTACTICAL_ONLY) {
 488                 return DsCrackNameOneSyntactical(mem_ctx, format_offered, format_desired,
 489                                                  name_dn, name, info1);
 490         }
 491
 492         return DsCrackNameOneFilter(sam_ctx, mem_ctx,
 493                                     smb_krb5_context,
 494                                     format_flags, format_offered, format_desired,
 495                                     name_dn, name,
 496                                     domain_filter, result_filter,
 497                                     info1);
 498 }
 499
 500 /* Subcase of CrackNames.  It is possible to translate a LDAP-style DN
 501  * (FQDN_1779) into a canoical name without actually searching the
 502  * database */
 503
 504 static WERROR DsCrackNameOneSyntactical(TALLOC_CTX *mem_ctx,
 505                                         uint32_t format_offered, uint32_t format_desired,
 506                                         const struct ldb_dn *name_dn, const char *name,
 507                                         struct drsuapi_DsNameInfo1 *info1)
 508 {
 509         char *cracked;
 510         if (format_offered != DRSUAPI_DS_NAME_FORMAT_FQDN_1779) {
 511                 info1->status = DRSUAPI_DS_NAME_STATUS_NO_SYNTACTICAL_MAPPING;
 512                 return WERR_OK;
 513         }
 514
 515         switch (format_desired) {
 516         case DRSUAPI_DS_NAME_FORMAT_CANONICAL:
 517                 cracked = ldb_dn_canonical_string(mem_ctx, name_dn);
 518                 break;
 519         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX:
 520                 cracked = ldb_dn_canonical_ex_string(mem_ctx, name_dn);
 521                 break;
 522         default:
 523                 info1->status = DRSUAPI_DS_NAME_STATUS_NO_SYNTACTICAL_MAPPING;
 524                 return WERR_OK;
 525         }
 526         info1->status = DRSUAPI_DS_NAME_STATUS_OK;
 527         info1->result_name      = cracked;
 528         if (!cracked) {
 529                 return WERR_NOMEM;
 530         }
 531
 532         return WERR_OK;
 533 }
 534
 535 /* Given a filter for the domain, and one for the result, perform the
 536  * ldb search. The format offered and desired flags change the
 537  * behaviours, including what attributes to return.
 538  *
 539  * The smb_krb5_context is required because we use the krb5 libs for principal parsing
 540  */
 541
 542 static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 543                                    struct smb_krb5_context *smb_krb5_context,
 544                                    uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 545                                    const struct ldb_dn *name_dn, const char *name,
 546                                    const char *domain_filter, const char *result_filter,
 547                                    struct drsuapi_DsNameInfo1 *info1)
 548 {
 549         int ldb_ret;
 550         struct ldb_message **domain_res = NULL;
 551         const char * const *domain_attrs;
 552         const char * const *result_attrs;
 553         struct ldb_message **result_res = NULL;
 554         const struct ldb_dn *result_basedn;
 555
 556         /* here we need to set the attrs lists for domain and result lookups */
 557         switch (format_desired) {
 558         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779:
 559         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX: {
 560                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", NULL};
 561                 const char * const _result_attrs[] = { NULL};
 562
 563                 domain_attrs = _domain_attrs;
 564                 result_attrs = _result_attrs;
 565                 break;
 566         }
 567         case DRSUAPI_DS_NAME_FORMAT_CANONICAL: {
 568                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", NULL};
 569                 const char * const _result_attrs[] = { "canonicalName", NULL };
 570
 571                 domain_attrs = _domain_attrs;
 572                 result_attrs = _result_attrs;
 573                 break;
 574         }
 575         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT: {
 576                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", "nETBIOSName", NULL};
 577                 const char * const _result_attrs[] = { "sAMAccountName", "objectSid", NULL};
 578
 579                 domain_attrs = _domain_attrs;
 580                 result_attrs = _result_attrs;
 581                 break;
 582         }
 583         case DRSUAPI_DS_NAME_FORMAT_GUID: {
 584                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", NULL};
 585                 const char * const _result_attrs[] = { "objectGUID", NULL};
 586
 587                 domain_attrs = _domain_attrs;
 588                 result_attrs = _result_attrs;
 589                 break;
 590         }
 591         case DRSUAPI_DS_NAME_FORMAT_DISPLAY: {
 592                 const char * const _domain_attrs[] = { "ncName", "dnsRoot", NULL};
 593                 const char * const _result_attrs[] = { "displayName", "samAccountName", NULL};
 594
 595                 domain_attrs = _domain_attrs;
 596                 result_attrs = _result_attrs;
 597                 break;
 598         }
 599         default:
 600                 return WERR_OK;
 601         }
 602
 603         if (domain_filter) {
 604                 /* if we have a domain_filter look it up and set the result_basedn and the dns_domain_name */
 605                 ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, domain_attrs,
 606                                        "%s", domain_filter);
 607         } else {
 608                 ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, domain_attrs,
 609                                        "(ncName=%s)", ldb_dn_linearize(mem_ctx, samdb_base_dn(mem_ctx)));
 610         }
 611
 612         switch (ldb_ret) {
 613         case 1:
 614                 break;
 615         case 0:
 616                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 617                 return WERR_OK;
 618         case -1:
 619                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 620                 return WERR_OK;
 621         default:
 622                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
 623                 return WERR_OK;
 624         }
 625
 626         info1->dns_domain_name  = samdb_result_string(domain_res[0], "dnsRoot", NULL);
 627         WERR_TALLOC_CHECK(info1->dns_domain_name);
 628         info1->status           = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
 629
 630         if (result_filter) {
 631                 result_basedn = samdb_result_dn(mem_ctx, domain_res[0], "ncName", NULL);
 632
 633                 ldb_ret = gendb_search(sam_ctx, mem_ctx, result_basedn, &result_res,
 634                                        result_attrs, "%s", result_filter);
 635         } else if (format_offered == DRSUAPI_DS_NAME_FORMAT_FQDN_1779) {
 636                 ldb_ret = gendb_search_dn(sam_ctx, mem_ctx, name_dn, &result_res,
 637                                           result_attrs);
 638         } else {
 639                 name_dn = samdb_result_dn(mem_ctx, domain_res[0], "ncName", NULL);
 640                 ldb_ret = gendb_search_dn(sam_ctx, mem_ctx, name_dn, &result_res,
 641                                           result_attrs);
 642         }
 643
 644         switch (ldb_ret) {
 645         case 1:
 646                 break;
 647         case 0:
 648                 switch (format_offered) {
 649                 case DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL:
 650                         return DsCrackNameSPNAlias(sam_ctx, mem_ctx,
 651                                                    smb_krb5_context,
 652                                                    format_flags, format_offered, format_desired,
 653                                                    name, info1);
 654
 655                 case DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL:
 656                         return DsCrackNameUPN(sam_ctx, mem_ctx, smb_krb5_context,
 657                                               format_flags, format_offered, format_desired,
 658                                               name, info1);
 659                 }
 660                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 661                 return WERR_OK;
 662         case -1:
 663                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 664                 return WERR_OK;
 665         default:
 666                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
 667                 return WERR_OK;
 668         }
 669
 670         /* here we can use result_res[0] and domain_res[0] */
 671         switch (format_desired) {
 672         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779: {
 673                 info1->result_name      = ldb_dn_linearize(mem_ctx, result_res[0]->dn);
 674                 WERR_TALLOC_CHECK(info1->result_name);
 675
 676                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 677                 return WERR_OK;
 678         }
 679         case DRSUAPI_DS_NAME_FORMAT_CANONICAL: {
 680                 info1->result_name      = samdb_result_string(result_res[0], "canonicalName", NULL);
 681                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 682                 return WERR_OK;
 683         }
 684         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX: {
 685                 /* Not in the virtual ldb attribute */
 686                 return DsCrackNameOneSyntactical(mem_ctx,
 687                                                  DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 688                                                  DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX,
 689                                                  result_res[0]->dn, name, info1);
 690         }
 691         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT: {
 692                 const struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, result_res[0], "objectSid");
 693                 const char *_acc = "", *_dom = "";
 694
 695                 if (!sid || (sid->num_auths < 4) || (sid->num_auths > 5)) {
 696                         info1->status = DRSUAPI_DS_NAME_STATUS_NO_MAPPING;
 697                         return WERR_OK;
 698                 }
 699
 700                 if (sid->num_auths == 4) {
 701                         ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, domain_attrs,
 702                                                "(ncName=%s)", ldb_dn_linearize(mem_ctx, result_res[0]->dn));
 703                         if (ldb_ret != 1) {
 704                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 705                                 return WERR_OK;
 706                         }
 707                         _dom = samdb_result_string(domain_res[0], "nETBIOSName", NULL);
 708                         WERR_TALLOC_CHECK(_dom);
 709
 710                 } else if (sid->num_auths == 5) {
 711                         const char *attrs[] = { NULL };
 712                         struct ldb_message **domain_res2;
 713                         struct dom_sid *dom_sid = dom_sid_dup(mem_ctx, sid);
 714                         if (!dom_sid) {
 715                                 return WERR_OK;
 716                         }
 717                         dom_sid->num_auths--;
 718                         ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, attrs,
 719                                                "(&(objectSid=%s)(objectClass=domain))", ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
 720                         if (ldb_ret != 1) {
 721                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 722                                 return WERR_OK;
 723                         }
 724                         ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res2, domain_attrs,
 725                                                "(ncName=%s)", ldb_dn_linearize(mem_ctx, domain_res[0]->dn));
 726                         if (ldb_ret != 1) {
 727                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 728                                 return WERR_OK;
 729                         }
 730
 731                         _dom = samdb_result_string(domain_res2[0], "nETBIOSName", NULL);
 732                         WERR_TALLOC_CHECK(_dom);
 733
 734                         _acc = samdb_result_string(result_res[0], "sAMAccountName", NULL);
 735                         WERR_TALLOC_CHECK(_acc);
 736                 }
 737
 738                 info1->result_name      = talloc_asprintf(mem_ctx, "%s\\%s", _dom, _acc);
 739                 WERR_TALLOC_CHECK(info1->result_name);
 740
 741                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 742                 return WERR_OK;
 743         }
 744         case DRSUAPI_DS_NAME_FORMAT_GUID: {
 745                 struct GUID guid;
 746
 747                 guid = samdb_result_guid(result_res[0], "objectGUID");
 748
 749                 info1->result_name      = GUID_string2(mem_ctx, &guid);
 750                 WERR_TALLOC_CHECK(info1->result_name);
 751
 752                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 753                 return WERR_OK;
 754         }
 755         case DRSUAPI_DS_NAME_FORMAT_DISPLAY: {
 756                 info1->result_name      = samdb_result_string(result_res[0], "displayName", NULL);
 757                 if (!info1->result_name) {
 758                         info1->result_name      = samdb_result_string(result_res[0], "sAMAccountName", NULL);
 759                 }
 760                 if (!info1->result_name) {
 761                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 762                 } else {
 763                         info1->status = DRSUAPI_DS_NAME_STATUS_OK;
 764                 }
 765                 return WERR_OK;
 766         }
 767         default:
 768                 return WERR_OK;
 769         }
 770
 771         return WERR_INVALID_PARAM;
 772 }
 773
 774 /* Given a user Principal Name (such as foo@bar.com),
 775  * return the user and domain DNs.  This is used in the KDC to then
 776  * return the Keys and evaluate policy */
 777
 778 NTSTATUS crack_user_principal_name(struct ldb_context *sam_ctx,
 779                                    TALLOC_CTX *mem_ctx,
 780                                    const char *user_principal_name,
 781                                    struct ldb_dn **user_dn,
 782                                    struct ldb_dn **domain_dn)
 783 {
 784         WERROR werr;
 785         struct drsuapi_DsNameInfo1 info1;
 786         werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
 787                                   DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL,
 788                                   DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 789                                   user_principal_name,
 790                                   &info1);
 791         if (!W_ERROR_IS_OK(werr)) {
 792                 return werror_to_ntstatus(werr);
 793         }
 794         switch (info1.status) {
 795         case DRSUAPI_DS_NAME_STATUS_OK:
 796                 break;
 797         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 798         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 799         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 800                 return NT_STATUS_NO_SUCH_USER;
 801         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 802         default:
 803                 return NT_STATUS_UNSUCCESSFUL;
 804         }
 805
 806         *user_dn = ldb_dn_explode(mem_ctx, info1.result_name);
 807
 808         if (domain_dn) {
 809                 werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
 810                                           DRSUAPI_DS_NAME_FORMAT_CANONICAL,
 811                                           DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 812                                           talloc_asprintf(mem_ctx, "%s/",
 813                                                           info1.dns_domain_name),
 814                                           &info1);
 815                 if (!W_ERROR_IS_OK(werr)) {
 816                         return werror_to_ntstatus(werr);
 817                 }
 818                 switch (info1.status) {
 819                 case DRSUAPI_DS_NAME_STATUS_OK:
 820                         break;
 821                 case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 822                 case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 823                 case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 824                         return NT_STATUS_NO_SUCH_USER;
 825                 case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 826                 default:
 827                         return NT_STATUS_UNSUCCESSFUL;
 828                 }
 829
 830                 *domain_dn = ldb_dn_explode(mem_ctx, info1.result_name);
 831         }
 832
 833         return NT_STATUS_OK;
 834
 835 }
 836
 837 /* Given a Service Principal Name (such as host/foo.bar.com@BAR.COM),
 838  * return the user and domain DNs.  This is used in the KDC to then
 839  * return the Keys and evaluate policy */
 840
 841 NTSTATUS crack_service_principal_name(struct ldb_context *sam_ctx,
 842                                       TALLOC_CTX *mem_ctx,
 843                                       const char *service_principal_name,
 844                                       struct ldb_dn **user_dn,
 845                                       struct ldb_dn **domain_dn)
 846 {
 847         WERROR werr;
 848         struct drsuapi_DsNameInfo1 info1;
 849         werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
 850                                   DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL,
 851                                   DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 852                                   service_principal_name,
 853                                   &info1);
 854         if (!W_ERROR_IS_OK(werr)) {
 855                 return werror_to_ntstatus(werr);
 856         }
 857         switch (info1.status) {
 858         case DRSUAPI_DS_NAME_STATUS_OK:
 859                 break;
 860         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 861         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 862         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 863                 return NT_STATUS_NO_SUCH_USER;
 864         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 865         default:
 866                 return NT_STATUS_UNSUCCESSFUL;
 867         }
 868
 869         *user_dn = ldb_dn_explode(mem_ctx, info1.result_name);
 870
 871         if (domain_dn) {
 872                 werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
 873                                           DRSUAPI_DS_NAME_FORMAT_CANONICAL,
 874                                           DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 875                                           talloc_asprintf(mem_ctx, "%s/",
 876                                                           info1.dns_domain_name),
 877                                           &info1);
 878                 if (!W_ERROR_IS_OK(werr)) {
 879                         return werror_to_ntstatus(werr);
 880                 }
 881                 switch (info1.status) {
 882                 case DRSUAPI_DS_NAME_STATUS_OK:
 883                         break;
 884                 case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 885                 case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 886                 case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 887                         return NT_STATUS_NO_SUCH_USER;
 888                 case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 889                 default:
 890                         return NT_STATUS_UNSUCCESSFUL;
 891                 }
 892
 893                 *domain_dn = ldb_dn_explode(mem_ctx, info1.result_name);
 894         }
 895
 896         return NT_STATUS_OK;
 897
 898 }
 899
 900 NTSTATUS crack_dn_to_nt4_name(TALLOC_CTX *mem_ctx,
 901                               const char *dn,
 902                               const char **nt4_domain, const char **nt4_account)
 903 {
 904         WERROR werr;
 905         struct drsuapi_DsNameInfo1 info1;
 906         struct ldb_context *ldb;
 907         char *p;
 908
 909         /* Handle anonymous bind */
 910         if (!dn || !*dn) {
 911                 *nt4_domain = "";
 912                 *nt4_account = "";
 913                 return NT_STATUS_OK;
 914         }
 915
 916         ldb = samdb_connect(mem_ctx, system_session(mem_ctx));
 917         if (ldb == NULL) {
 918                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 919         }
 920
 921         werr = DsCrackNameOneName(ldb, mem_ctx, 0,
 922                                   DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 923                                   DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT,
 924                                   dn,
 925                                   &info1);
 926         if (!W_ERROR_IS_OK(werr)) {
 927                 return werror_to_ntstatus(werr);
 928         }
 929         switch (info1.status) {
 930         case DRSUAPI_DS_NAME_STATUS_OK:
 931                 break;
 932         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
 933         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
 934         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
 935                 return NT_STATUS_NO_SUCH_USER;
 936         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
 937         default:
 938                 return NT_STATUS_UNSUCCESSFUL;
 939         }
 940
 941         *nt4_domain = talloc_strdup(mem_ctx, info1.result_name);
 942
 943         p = strchr(*nt4_domain, '\\');
 944         if (!p) {
 945                 return NT_STATUS_INVALID_PARAMETER;
 946         }
 947         p[0] = '\0';
 948
 949         if (p[1]) {
 950                 *nt4_account = talloc_strdup(mem_ctx, &p[1]);
 951         }
 952
 953         if (!*nt4_account || !*nt4_domain) {
 954                 return NT_STATUS_NO_MEMORY;
 955         }
 956
 957         return NT_STATUS_OK;
 958
 959 }