Generate ACB_PW_EXPIRED correctly

[jelmer/samba4-debian.git] / source / rpc_server / samr / dcesrv_samr.c

diff --git a/source/rpc_server/samr/dcesrv_samr.c b/source/rpc_server/samr/dcesrv_samr.c
index 760d774f2ea6ebc46a8bcebaf199bb077f8e894f..2ad35e0eb3c60820480a914cf138e5c0a089e1cd 100644 (file)
--- a/source/rpc_server/samr/dcesrv_samr.c
+++ b/source/rpc_server/samr/dcesrv_samr.c
@@ -56,7 +56,7 @@
 #define QUERY_LHOURS(msg, field, attr) \
        r->out.info->field = samdb_result_logon_hours(mem_ctx, msg, attr);
 #define QUERY_AFLAGS(msg, field, attr) \
-       r->out.info->field = samdb_result_acct_flags(msg, attr);
+       r->out.info->field = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, a_state->domain_state->domain_dn);
 
 
 /* these are used to make the Set[User|Group]Info code easier to follow */
@@ -102,10 +102,11 @@
         set_el = ldb_msg_find_element(msg, attr);                      \
        set_el->flags = LDB_FLAG_MOD_REPLACE;                           \
 } while (0)                                                            
-                                                                       
+       
+/* Set account flags, discarding flags that cannot be set with SAMR */                                                         
 #define SET_AFLAGS(msg, field, attr) do {                              \
        struct ldb_message_element *set_el;                             \
-       if (samdb_msg_add_acct_flags(sam_ctx, mem_ctx, msg, attr, r->in.info->field) != 0) { \
+       if (samdb_msg_add_acct_flags(sam_ctx, mem_ctx, msg, attr, (r->in.info->field & ~(ACB_AUTOLOCK|ACB_PW_EXPIRED))) != 0) { \
                return NT_STATUS_NO_MEMORY;                             \
        }                                                               \
         set_el = ldb_msg_find_element(msg, attr);                      \
@@ -1484,8 +1485,8 @@ static NTSTATUS dcesrv_samr_EnumDomainUsers(struct dcesrv_call_state *dce_call,
        for (i=0;i<count;i++) {
                /* Check if a mask has been requested */
                if (r->in.acct_flags
-                   && ((samdb_result_acct_flags(res[i], 
-                                                "userAccountControl") & r->in.acct_flags) == 0)) {
+                   && ((samdb_result_acct_flags(d_state->sam_ctx, mem_ctx, res[i], 
+                                                d_state->domain_dn) & r->in.acct_flags) == 0)) {
                        continue;
                }
                entries[num_filtered_entries].idx = samdb_result_rid_from_sid(mem_ctx, res[i], "objectSid", 0);
@@ -3066,7 +3067,7 @@ static NTSTATUS dcesrv_samr_QueryUserInfo(struct dcesrv_call_state *dce_call, TA
        }
        case 16:
        {
-               static const char * const attrs2[] = {"userAccountControl", NULL};
+               static const char * const attrs2[] = {"userAccountControl", "pwdLastSet", NULL};
                attrs = attrs2;
                break;
        }
@@ -3613,7 +3614,7 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
        struct ldb_message **res;
        int ldb_cnt, count, i;
        const char * const attrs[] = { "objectSid", "sAMAccountName", "displayName",
-                                       "description", "userAccountControl", NULL };
+                                      "description", "userAccountControl", "pwdLastSet", NULL };
        struct samr_DispEntryFull *entriesFull = NULL;
        struct samr_DispEntryFullGroup *entriesFullGroup = NULL;
        struct samr_DispEntryAscii *entriesAscii = NULL;
@@ -3702,8 +3703,9 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
                        entriesGeneral[count].rid = 
                                objectsid->sub_auths[objectsid->num_auths-1];
                        entriesGeneral[count].acct_flags =
-                               samdb_result_acct_flags(res[i], 
-                                                       "userAccountControl");
+                               samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
+                                                       res[i], 
+                                                       d_state->domain_dn);
                        entriesGeneral[count].account_name.string =
                                samdb_result_string(res[i],
                                                    "sAMAccountName", "");
@@ -3719,8 +3721,9 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
 
                        /* No idea why we need to or in ACB_NORMAL here, but this is what Win2k3 seems to do... */
                        entriesFull[count].acct_flags =
-                               samdb_result_acct_flags(res[i], 
-                                                       "userAccountControl") | ACB_NORMAL;
+                               samdb_result_acct_flags(d_state->sam_ctx, mem_ctx,
+                                                       res[i], 
+                                                       d_state->domain_dn) | ACB_NORMAL;
                        entriesFull[count].account_name.string =
                                samdb_result_string(res[i], "sAMAccountName",
                                                    "");
@@ -3731,9 +3734,6 @@ static NTSTATUS dcesrv_samr_QueryDisplayInfo(struct dcesrv_call_state *dce_call,
                        entriesFullGroup[count].idx = count + 1;
                        entriesFullGroup[count].rid =
                                objectsid->sub_auths[objectsid->num_auths-1];
-                       entriesFullGroup[count].acct_flags =
-                               samdb_result_acct_flags(res[i], 
-                                                       "userAccountControl");
                        /* We get a "7" here for groups */
                        entriesFullGroup[count].acct_flags
                                = SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT | SE_GROUP_ENABLED;