Use W_ERROR_NOT_OK_GOTO_DONE macro in libnetjoin.
[jra/samba/.git] / source3 / libnet / libnet_join.c
1 /*
2  *  Unix SMB/CIFS implementation.
3  *  libnet Join Support
4  *  Copyright (C) Gerald (Jerry) Carter 2006
5  *  Copyright (C) Guenther Deschner 2007-2008
6  *
7  *  This program is free software; you can redistribute it and/or modify
8  *  it under the terms of the GNU General Public License as published by
9  *  the Free Software Foundation; either version 3 of the License, or
10  *  (at your option) any later version.
11  *
12  *  This program is distributed in the hope that it will be useful,
13  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
14  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
15  *  GNU General Public License for more details.
16  *
17  *  You should have received a copy of the GNU General Public License
18  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
19  */
20
21 #include "includes.h"
22 #include "libnet/libnet.h"
23
24 /****************************************************************
25 ****************************************************************/
26
27 #define LIBNET_JOIN_DUMP_CTX(ctx, r, f) \
28         do { \
29                 char *str = NULL; \
30                 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_JoinCtx, f, r); \
31                 DEBUG(1,("libnet_Join:\n%s", str)); \
32                 talloc_free(str); \
33         } while (0)
34
35 #define LIBNET_JOIN_IN_DUMP_CTX(ctx, r) \
36         LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
37 #define LIBNET_JOIN_OUT_DUMP_CTX(ctx, r) \
38         LIBNET_JOIN_DUMP_CTX(ctx, r, NDR_OUT)
39
40 #define LIBNET_UNJOIN_DUMP_CTX(ctx, r, f) \
41         do { \
42                 char *str = NULL; \
43                 str = NDR_PRINT_FUNCTION_STRING(ctx, libnet_UnjoinCtx, f, r); \
44                 DEBUG(1,("libnet_Unjoin:\n%s", str)); \
45                 talloc_free(str); \
46         } while (0)
47
48 #define LIBNET_UNJOIN_IN_DUMP_CTX(ctx, r) \
49         LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_IN | NDR_SET_VALUES)
50 #define LIBNET_UNJOIN_OUT_DUMP_CTX(ctx, r) \
51         LIBNET_UNJOIN_DUMP_CTX(ctx, r, NDR_OUT)
52
53 #define W_ERROR_NOT_OK_GOTO_DONE(x) do { \
54         if (!W_ERROR_IS_OK(x)) {\
55                 goto done;\
56         }\
57 } while (0)
58
59 /****************************************************************
60 ****************************************************************/
61
62 static void libnet_join_set_error_string(TALLOC_CTX *mem_ctx,
63                                          struct libnet_JoinCtx *r,
64                                          const char *format, ...)
65 {
66         va_list args;
67
68         if (r->out.error_string) {
69                 return;
70         }
71
72         va_start(args, format);
73         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
74         va_end(args);
75 }
76
77 /****************************************************************
78 ****************************************************************/
79
80 static void libnet_unjoin_set_error_string(TALLOC_CTX *mem_ctx,
81                                            struct libnet_UnjoinCtx *r,
82                                            const char *format, ...)
83 {
84         va_list args;
85
86         if (r->out.error_string) {
87                 return;
88         }
89
90         va_start(args, format);
91         r->out.error_string = talloc_vasprintf(mem_ctx, format, args);
92         va_end(args);
93 }
94
95 #ifdef WITH_ADS
96
97 /****************************************************************
98 ****************************************************************/
99
100 static ADS_STATUS libnet_connect_ads(const char *dns_domain_name,
101                                      const char *netbios_domain_name,
102                                      const char *dc_name,
103                                      const char *user_name,
104                                      const char *password,
105                                      ADS_STRUCT **ads)
106 {
107         ADS_STATUS status;
108         ADS_STRUCT *my_ads = NULL;
109
110         my_ads = ads_init(dns_domain_name,
111                           netbios_domain_name,
112                           dc_name);
113         if (!my_ads) {
114                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
115         }
116
117         if (user_name) {
118                 SAFE_FREE(my_ads->auth.user_name);
119                 my_ads->auth.user_name = SMB_STRDUP(user_name);
120         }
121
122         if (password) {
123                 SAFE_FREE(my_ads->auth.password);
124                 my_ads->auth.password = SMB_STRDUP(password);
125         }
126
127         status = ads_connect(my_ads);
128         if (!ADS_ERR_OK(status)) {
129                 ads_destroy(&my_ads);
130                 return status;
131         }
132
133         *ads = my_ads;
134         return ADS_SUCCESS;
135 }
136
137 /****************************************************************
138 ****************************************************************/
139
140 static ADS_STATUS libnet_join_connect_ads(TALLOC_CTX *mem_ctx,
141                                           struct libnet_JoinCtx *r)
142 {
143         ADS_STATUS status;
144
145         status = libnet_connect_ads(r->in.domain_name,
146                                     r->in.domain_name,
147                                     r->in.dc_name,
148                                     r->in.admin_account,
149                                     r->in.admin_password,
150                                     &r->in.ads);
151         if (!ADS_ERR_OK(status)) {
152                 libnet_join_set_error_string(mem_ctx, r,
153                         "failed to connect to AD: %s",
154                         ads_errstr(status));
155         }
156
157         return status;
158 }
159
160 /****************************************************************
161 ****************************************************************/
162
163 static ADS_STATUS libnet_unjoin_connect_ads(TALLOC_CTX *mem_ctx,
164                                             struct libnet_UnjoinCtx *r)
165 {
166         ADS_STATUS status;
167
168         status = libnet_connect_ads(r->in.domain_name,
169                                     r->in.domain_name,
170                                     r->in.dc_name,
171                                     r->in.admin_account,
172                                     r->in.admin_password,
173                                     &r->in.ads);
174         if (!ADS_ERR_OK(status)) {
175                 libnet_unjoin_set_error_string(mem_ctx, r,
176                         "failed to connect to AD: %s",
177                         ads_errstr(status));
178         }
179
180         return status;
181 }
182
183 /****************************************************************
184 ****************************************************************/
185
186 static ADS_STATUS libnet_join_precreate_machine_acct(TALLOC_CTX *mem_ctx,
187                                                      struct libnet_JoinCtx *r)
188 {
189         ADS_STATUS status;
190         LDAPMessage *res = NULL;
191         const char *attrs[] = { "dn", NULL };
192
193         status = ads_search_dn(r->in.ads, &res, r->in.account_ou, attrs);
194         if (!ADS_ERR_OK(status)) {
195                 return status;
196         }
197
198         if (ads_count_replies(r->in.ads, res) != 1) {
199                 ads_msgfree(r->in.ads, res);
200                 return ADS_ERROR_LDAP(LDAP_NO_SUCH_OBJECT);
201         }
202
203         status = ads_create_machine_acct(r->in.ads,
204                                          r->in.machine_name,
205                                          r->in.account_ou);
206         ads_msgfree(r->in.ads, res);
207
208         if ((status.error_type == ENUM_ADS_ERROR_LDAP) &&
209             (status.err.rc == LDAP_ALREADY_EXISTS)) {
210                 status = ADS_SUCCESS;
211         }
212
213         return status;
214 }
215
216 /****************************************************************
217 ****************************************************************/
218
219 static ADS_STATUS libnet_unjoin_remove_machine_acct(TALLOC_CTX *mem_ctx,
220                                                     struct libnet_UnjoinCtx *r)
221 {
222         ADS_STATUS status;
223
224         if (!r->in.ads) {
225                 status = libnet_unjoin_connect_ads(mem_ctx, r);
226                 if (!ADS_ERR_OK(status)) {
227                         return status;
228                 }
229         }
230
231         status = ads_leave_realm(r->in.ads, r->in.machine_name);
232         if (!ADS_ERR_OK(status)) {
233                 libnet_unjoin_set_error_string(mem_ctx, r,
234                         "failed to leave realm: %s",
235                         ads_errstr(status));
236                 return status;
237         }
238
239         return ADS_SUCCESS;
240 }
241
242 /****************************************************************
243 ****************************************************************/
244
245 static ADS_STATUS libnet_join_find_machine_acct(TALLOC_CTX *mem_ctx,
246                                                 struct libnet_JoinCtx *r)
247 {
248         ADS_STATUS status;
249         LDAPMessage *res = NULL;
250         char *dn = NULL;
251
252         if (!r->in.machine_name) {
253                 return ADS_ERROR(LDAP_NO_MEMORY);
254         }
255
256         status = ads_find_machine_acct(r->in.ads,
257                                        &res,
258                                        r->in.machine_name);
259         if (!ADS_ERR_OK(status)) {
260                 return status;
261         }
262
263         if (ads_count_replies(r->in.ads, res) != 1) {
264                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
265                 goto done;
266         }
267
268         dn = ads_get_dn(r->in.ads, res);
269         if (!dn) {
270                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
271                 goto done;
272         }
273
274         r->out.dn = talloc_strdup(mem_ctx, dn);
275         if (!r->out.dn) {
276                 status = ADS_ERROR_LDAP(LDAP_NO_MEMORY);
277                 goto done;
278         }
279
280  done:
281         ads_msgfree(r->in.ads, res);
282         ads_memfree(r->in.ads, dn);
283
284         return status;
285 }
286
287 /****************************************************************
288 ****************************************************************/
289
290 static ADS_STATUS libnet_join_set_machine_spn(TALLOC_CTX *mem_ctx,
291                                               struct libnet_JoinCtx *r)
292 {
293         ADS_STATUS status;
294         ADS_MODLIST mods;
295         fstring my_fqdn;
296         const char *spn_array[3] = {NULL, NULL, NULL};
297         char *spn = NULL;
298
299         if (!r->in.ads) {
300                 status = libnet_join_connect_ads(mem_ctx, r);
301                 if (!ADS_ERR_OK(status)) {
302                         return status;
303                 }
304         }
305
306         status = libnet_join_find_machine_acct(mem_ctx, r);
307         if (!ADS_ERR_OK(status)) {
308                 return status;
309         }
310
311         spn = talloc_asprintf(mem_ctx, "HOST/%s", r->in.machine_name);
312         if (!spn) {
313                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
314         }
315         strupper_m(spn);
316         spn_array[0] = spn;
317
318         if (name_to_fqdn(my_fqdn, r->in.machine_name) &&
319             !strequal(my_fqdn, r->in.machine_name)) {
320
321                 strlower_m(my_fqdn);
322                 spn = talloc_asprintf(mem_ctx, "HOST/%s", my_fqdn);
323                 if (!spn) {
324                         return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
325                 }
326                 spn_array[1] = spn;
327         }
328
329         mods = ads_init_mods(mem_ctx);
330         if (!mods) {
331                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
332         }
333
334         status = ads_mod_str(mem_ctx, &mods, "dNSHostName", my_fqdn);
335         if (!ADS_ERR_OK(status)) {
336                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
337         }
338
339         status = ads_mod_strlist(mem_ctx, &mods, "servicePrincipalName",
340                                  spn_array);
341         if (!ADS_ERR_OK(status)) {
342                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
343         }
344
345         return ads_gen_mod(r->in.ads, r->out.dn, mods);
346 }
347
348 /****************************************************************
349 ****************************************************************/
350
351 static ADS_STATUS libnet_join_set_machine_upn(TALLOC_CTX *mem_ctx,
352                                               struct libnet_JoinCtx *r)
353 {
354         ADS_STATUS status;
355         ADS_MODLIST mods;
356
357         if (!r->in.create_upn) {
358                 return ADS_SUCCESS;
359         }
360
361         if (!r->in.ads) {
362                 status = libnet_join_connect_ads(mem_ctx, r);
363                 if (!ADS_ERR_OK(status)) {
364                         return status;
365                 }
366         }
367
368         status = libnet_join_find_machine_acct(mem_ctx, r);
369         if (!ADS_ERR_OK(status)) {
370                 return status;
371         }
372
373         if (!r->in.upn) {
374                 r->in.upn = talloc_asprintf(mem_ctx,
375                                             "host/%s@%s",
376                                             r->in.machine_name,
377                                             r->out.dns_domain_name);
378                 if (!r->in.upn) {
379                         return ADS_ERROR(LDAP_NO_MEMORY);
380                 }
381         }
382
383         mods = ads_init_mods(mem_ctx);
384         if (!mods) {
385                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
386         }
387
388         status = ads_mod_str(mem_ctx, &mods, "userPrincipalName", r->in.upn);
389         if (!ADS_ERR_OK(status)) {
390                 return ADS_ERROR_LDAP(LDAP_NO_MEMORY);
391         }
392
393         return ads_gen_mod(r->in.ads, r->out.dn, mods);
394 }
395
396
397 /****************************************************************
398 ****************************************************************/
399
400 static ADS_STATUS libnet_join_set_os_attributes(TALLOC_CTX *mem_ctx,
401                                                 struct libnet_JoinCtx *r)
402 {
403         ADS_STATUS status;
404         ADS_MODLIST mods;
405         char *os_sp = NULL;
406
407         if (!r->in.os_name || !r->in.os_version ) {
408                 return ADS_SUCCESS;
409         }
410
411         if (!r->in.ads) {
412                 status = libnet_join_connect_ads(mem_ctx, r);
413                 if (!ADS_ERR_OK(status)) {
414                         return status;
415                 }
416         }
417
418         status = libnet_join_find_machine_acct(mem_ctx, r);
419         if (!ADS_ERR_OK(status)) {
420                 return status;
421         }
422
423         mods = ads_init_mods(mem_ctx);
424         if (!mods) {
425                 return ADS_ERROR(LDAP_NO_MEMORY);
426         }
427
428         os_sp = talloc_asprintf(mem_ctx, "Samba %s", SAMBA_VERSION_STRING);
429         if (!os_sp) {
430                 return ADS_ERROR(LDAP_NO_MEMORY);
431         }
432
433         status = ads_mod_str(mem_ctx, &mods, "operatingSystem",
434                              r->in.os_name);
435         if (!ADS_ERR_OK(status)) {
436                 return status;
437         }
438
439         status = ads_mod_str(mem_ctx, &mods, "operatingSystemVersion",
440                              r->in.os_version);
441         if (!ADS_ERR_OK(status)) {
442                 return status;
443         }
444
445         status = ads_mod_str(mem_ctx, &mods, "operatingSystemServicePack",
446                              os_sp);
447         if (!ADS_ERR_OK(status)) {
448                 return status;
449         }
450
451         return ads_gen_mod(r->in.ads, r->out.dn, mods);
452 }
453
454 /****************************************************************
455 ****************************************************************/
456
457 static bool libnet_join_create_keytab(TALLOC_CTX *mem_ctx,
458                                       struct libnet_JoinCtx *r)
459 {
460         if (!lp_use_kerberos_keytab()) {
461                 return true;
462         }
463
464         if (!ads_keytab_create_default(r->in.ads)) {
465                 return false;
466         }
467
468         return true;
469 }
470
471 /****************************************************************
472 ****************************************************************/
473
474 static bool libnet_join_derive_salting_principal(TALLOC_CTX *mem_ctx,
475                                                  struct libnet_JoinCtx *r)
476 {
477         uint32_t domain_func;
478         ADS_STATUS status;
479         const char *salt = NULL;
480         char *std_salt = NULL;
481
482         status = ads_domain_func_level(r->in.ads, &domain_func);
483         if (!ADS_ERR_OK(status)) {
484                 libnet_join_set_error_string(mem_ctx, r,
485                         "failed to determine domain functional level: %s",
486                         ads_errstr(status));
487                 return false;
488         }
489
490         std_salt = kerberos_standard_des_salt();
491         if (!std_salt) {
492                 libnet_join_set_error_string(mem_ctx, r,
493                         "failed to obtain standard DES salt");
494                 return false;
495         }
496
497         salt = talloc_strdup(mem_ctx, std_salt);
498         if (!salt) {
499                 return false;
500         }
501
502         SAFE_FREE(std_salt);
503
504         if (domain_func == DS_DOMAIN_FUNCTION_2000) {
505                 char *upn;
506
507                 upn = ads_get_upn(r->in.ads, mem_ctx,
508                                   r->in.machine_name);
509                 if (upn) {
510                         salt = talloc_strdup(mem_ctx, upn);
511                         if (!salt) {
512                                 return false;
513                         }
514                 }
515         }
516
517         return kerberos_secrets_store_des_salt(salt);
518 }
519
520 /****************************************************************
521 ****************************************************************/
522
523 static ADS_STATUS libnet_join_post_processing_ads(TALLOC_CTX *mem_ctx,
524                                                   struct libnet_JoinCtx *r)
525 {
526         ADS_STATUS status;
527
528         status = libnet_join_set_machine_spn(mem_ctx, r);
529         if (!ADS_ERR_OK(status)) {
530                 libnet_join_set_error_string(mem_ctx, r,
531                         "failed to set machine spn: %s",
532                         ads_errstr(status));
533                 return status;
534         }
535
536         status = libnet_join_set_os_attributes(mem_ctx, r);
537         if (!ADS_ERR_OK(status)) {
538                 libnet_join_set_error_string(mem_ctx, r,
539                         "failed to set machine os attributes: %s",
540                         ads_errstr(status));
541                 return status;
542         }
543
544         status = libnet_join_set_machine_upn(mem_ctx, r);
545         if (!ADS_ERR_OK(status)) {
546                 libnet_join_set_error_string(mem_ctx, r,
547                         "failed to set machine upn: %s",
548                         ads_errstr(status));
549                 return status;
550         }
551
552         if (!libnet_join_derive_salting_principal(mem_ctx, r)) {
553                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
554         }
555
556         if (!libnet_join_create_keytab(mem_ctx, r)) {
557                 libnet_join_set_error_string(mem_ctx, r,
558                         "failed to create kerberos keytab");
559                 return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
560         }
561
562         return ADS_SUCCESS;
563 }
564 #endif /* WITH_ADS */
565
566 /****************************************************************
567 ****************************************************************/
568
569 static bool libnet_join_joindomain_store_secrets(TALLOC_CTX *mem_ctx,
570                                                  struct libnet_JoinCtx *r)
571 {
572         if (!secrets_store_domain_sid(r->out.netbios_domain_name,
573                                       r->out.domain_sid))
574         {
575                 return false;
576         }
577
578         if (!secrets_store_machine_password(r->in.machine_password,
579                                             r->out.netbios_domain_name,
580                                             SEC_CHAN_WKSTA))
581         {
582                 return false;
583         }
584
585         return true;
586 }
587
588 /****************************************************************
589 ****************************************************************/
590
591 static NTSTATUS libnet_join_joindomain_rpc(TALLOC_CTX *mem_ctx,
592                                            struct libnet_JoinCtx *r)
593 {
594         struct cli_state *cli = NULL;
595         struct rpc_pipe_client *pipe_hnd = NULL;
596         POLICY_HND sam_pol, domain_pol, user_pol, lsa_pol;
597         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
598         char *acct_name;
599         struct lsa_String lsa_acct_name;
600         uint32 user_rid;
601         uint32 acb_info = ACB_WSTRUST;
602         uchar pwbuf[532];
603         struct MD5Context md5ctx;
604         uchar md5buffer[16];
605         DATA_BLOB digested_session_key;
606         uchar md4_trust_password[16];
607         union lsa_PolicyInformation *info = NULL;
608         struct samr_Ids user_rids;
609         struct samr_Ids name_types;
610         union samr_UserInfo user_info;
611
612         if (!r->in.machine_password) {
613                 r->in.machine_password = talloc_strdup(mem_ctx, generate_random_str(DEFAULT_TRUST_ACCOUNT_PASSWORD_LENGTH));
614                 NT_STATUS_HAVE_NO_MEMORY(r->in.machine_password);
615         }
616
617         status = cli_full_connection(&cli, NULL,
618                                      r->in.dc_name,
619                                      NULL, 0,
620                                      "IPC$", "IPC",
621                                      r->in.admin_account,
622                                      NULL,
623                                      r->in.admin_password,
624                                      0,
625                                      Undefined, NULL);
626
627         if (!NT_STATUS_IS_OK(status)) {
628                 goto done;
629         }
630
631         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_LSARPC, &status);
632         if (!pipe_hnd) {
633                 goto done;
634         }
635
636         status = rpccli_lsa_open_policy(pipe_hnd, mem_ctx, True,
637                                         SEC_RIGHTS_MAXIMUM_ALLOWED, &lsa_pol);
638         if (!NT_STATUS_IS_OK(status)) {
639                 goto done;
640         }
641
642         status = rpccli_lsa_QueryInfoPolicy2(pipe_hnd, mem_ctx,
643                                              &lsa_pol,
644                                              LSA_POLICY_INFO_DNS,
645                                              &info);
646         if (NT_STATUS_IS_OK(status)) {
647                 r->out.domain_is_ad = true;
648                 r->out.netbios_domain_name = info->dns.name.string;
649                 r->out.dns_domain_name = info->dns.dns_domain.string;
650                 r->out.domain_sid = info->dns.sid;
651         }
652
653         if (!NT_STATUS_IS_OK(status)) {
654                 status = rpccli_lsa_QueryInfoPolicy(pipe_hnd, mem_ctx,
655                                                     &lsa_pol,
656                                                     LSA_POLICY_INFO_ACCOUNT_DOMAIN,
657                                                     &info);
658                 if (!NT_STATUS_IS_OK(status)) {
659                         goto done;
660                 }
661
662                 r->out.netbios_domain_name = info->account_domain.name.string;
663                 r->out.domain_sid = info->account_domain.sid;
664         }
665
666         rpccli_lsa_Close(pipe_hnd, mem_ctx, &lsa_pol);
667         cli_rpc_pipe_close(pipe_hnd);
668
669         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
670         if (!pipe_hnd) {
671                 goto done;
672         }
673
674         status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
675                                       pipe_hnd->cli->desthost,
676                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
677                                       &sam_pol);
678         if (!NT_STATUS_IS_OK(status)) {
679                 goto done;
680         }
681
682         status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
683                                         &sam_pol,
684                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
685                                         r->out.domain_sid,
686                                         &domain_pol);
687         if (!NT_STATUS_IS_OK(status)) {
688                 goto done;
689         }
690
691         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
692         strlower_m(acct_name);
693
694         init_lsa_String(&lsa_acct_name, acct_name);
695
696         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE) {
697                 uint32_t acct_flags =
698                         SEC_GENERIC_READ | SEC_GENERIC_WRITE | SEC_GENERIC_EXECUTE |
699                         SEC_STD_WRITE_DAC | SEC_STD_DELETE |
700                         SAMR_USER_ACCESS_SET_PASSWORD |
701                         SAMR_USER_ACCESS_GET_ATTRIBUTES |
702                         SAMR_USER_ACCESS_SET_ATTRIBUTES;
703                 uint32_t access_granted = 0;
704
705                 status = rpccli_samr_CreateUser2(pipe_hnd, mem_ctx,
706                                                  &domain_pol,
707                                                  &lsa_acct_name,
708                                                  ACB_WSTRUST,
709                                                  acct_flags,
710                                                  &user_pol,
711                                                  &access_granted,
712                                                  &user_rid);
713                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
714                         if (!(r->in.join_flags &
715                               WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED)) {
716                                 goto done;
717                         }
718                 }
719
720                 if (NT_STATUS_IS_OK(status)) {
721                         rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
722                 }
723         }
724
725         status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
726                                          &domain_pol,
727                                          1,
728                                          &lsa_acct_name,
729                                          &user_rids,
730                                          &name_types);
731         if (!NT_STATUS_IS_OK(status)) {
732                 goto done;
733         }
734
735         if (name_types.ids[0] != SID_NAME_USER) {
736                 status = NT_STATUS_INVALID_WORKSTATION;
737                 goto done;
738         }
739
740         user_rid = user_rids.ids[0];
741
742         status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
743                                       &domain_pol,
744                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
745                                       user_rid,
746                                       &user_pol);
747         if (!NT_STATUS_IS_OK(status)) {
748                 goto done;
749         }
750
751         E_md4hash(r->in.machine_password, md4_trust_password);
752         encode_pw_buffer(pwbuf, r->in.machine_password, STR_UNICODE);
753
754         generate_random_buffer((uint8*)md5buffer, sizeof(md5buffer));
755         digested_session_key = data_blob_talloc(mem_ctx, 0, 16);
756
757         MD5Init(&md5ctx);
758         MD5Update(&md5ctx, md5buffer, sizeof(md5buffer));
759         MD5Update(&md5ctx, cli->user_session_key.data,
760                   cli->user_session_key.length);
761         MD5Final(digested_session_key.data, &md5ctx);
762
763         SamOEMhashBlob(pwbuf, sizeof(pwbuf), &digested_session_key);
764         memcpy(&pwbuf[516], md5buffer, sizeof(md5buffer));
765
766         acb_info |= ACB_PWNOEXP;
767         if (r->out.domain_is_ad) {
768 #if !defined(ENCTYPE_ARCFOUR_HMAC)
769                 acb_info |= ACB_USE_DES_KEY_ONLY;
770 #endif
771                 ;;
772         }
773
774         ZERO_STRUCT(user_info.info25);
775
776         user_info.info25.info.fields_present = ACCT_NT_PWD_SET |
777                                                ACCT_LM_PWD_SET |
778                                                SAMR_FIELD_ACCT_FLAGS;
779         user_info.info25.info.acct_flags = acb_info;
780         memcpy(&user_info.info25.password.data, pwbuf, sizeof(pwbuf));
781
782         status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
783                                          &user_pol,
784                                          25,
785                                          &user_info);
786         if (!NT_STATUS_IS_OK(status)) {
787                 goto done;
788         }
789
790         rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
791         cli_rpc_pipe_close(pipe_hnd);
792
793         status = NT_STATUS_OK;
794  done:
795         if (cli) {
796                 cli_shutdown(cli);
797         }
798
799         return status;
800 }
801
802 /****************************************************************
803 ****************************************************************/
804
805 static bool libnet_join_unjoindomain_remove_secrets(TALLOC_CTX *mem_ctx,
806                                                     struct libnet_UnjoinCtx *r)
807 {
808         if (!secrets_delete_machine_password_ex(lp_workgroup())) {
809                 return false;
810         }
811
812         if (!secrets_delete_domain_sid(lp_workgroup())) {
813                 return false;
814         }
815
816         return true;
817 }
818
819 /****************************************************************
820 ****************************************************************/
821
822 static NTSTATUS libnet_join_unjoindomain_rpc(TALLOC_CTX *mem_ctx,
823                                              struct libnet_UnjoinCtx *r)
824 {
825         struct cli_state *cli = NULL;
826         struct rpc_pipe_client *pipe_hnd = NULL;
827         POLICY_HND sam_pol, domain_pol, user_pol;
828         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
829         char *acct_name;
830         uint32 user_rid;
831         struct lsa_String lsa_acct_name;
832         struct samr_Ids user_rids;
833         struct samr_Ids name_types;
834         union samr_UserInfo *info = NULL;
835
836         status = cli_full_connection(&cli, NULL,
837                                      r->in.dc_name,
838                                      NULL, 0,
839                                      "IPC$", "IPC",
840                                      r->in.admin_account,
841                                      NULL,
842                                      r->in.admin_password,
843                                      0, Undefined, NULL);
844
845         if (!NT_STATUS_IS_OK(status)) {
846                 goto done;
847         }
848
849         pipe_hnd = cli_rpc_pipe_open_noauth(cli, PI_SAMR, &status);
850         if (!pipe_hnd) {
851                 goto done;
852         }
853
854         status = rpccli_samr_Connect2(pipe_hnd, mem_ctx,
855                                       pipe_hnd->cli->desthost,
856                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
857                                       &sam_pol);
858         if (!NT_STATUS_IS_OK(status)) {
859                 goto done;
860         }
861
862         status = rpccli_samr_OpenDomain(pipe_hnd, mem_ctx,
863                                         &sam_pol,
864                                         SEC_RIGHTS_MAXIMUM_ALLOWED,
865                                         r->in.domain_sid,
866                                         &domain_pol);
867         if (!NT_STATUS_IS_OK(status)) {
868                 goto done;
869         }
870
871         acct_name = talloc_asprintf(mem_ctx, "%s$", r->in.machine_name);
872         strlower_m(acct_name);
873
874         init_lsa_String(&lsa_acct_name, acct_name);
875
876         status = rpccli_samr_LookupNames(pipe_hnd, mem_ctx,
877                                          &domain_pol,
878                                          1,
879                                          &lsa_acct_name,
880                                          &user_rids,
881                                          &name_types);
882
883         if (!NT_STATUS_IS_OK(status)) {
884                 goto done;
885         }
886
887         if (name_types.ids[0] != SID_NAME_USER) {
888                 status = NT_STATUS_INVALID_WORKSTATION;
889                 goto done;
890         }
891
892         user_rid = user_rids.ids[0];
893
894         status = rpccli_samr_OpenUser(pipe_hnd, mem_ctx,
895                                       &domain_pol,
896                                       SEC_RIGHTS_MAXIMUM_ALLOWED,
897                                       user_rid,
898                                       &user_pol);
899         if (!NT_STATUS_IS_OK(status)) {
900                 goto done;
901         }
902
903         status = rpccli_samr_QueryUserInfo(pipe_hnd, mem_ctx,
904                                            &user_pol,
905                                            16,
906                                            &info);
907         if (!NT_STATUS_IS_OK(status)) {
908                 rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
909                 goto done;
910         }
911
912         info->info16.acct_flags |= ACB_DISABLED;
913
914         status = rpccli_samr_SetUserInfo(pipe_hnd, mem_ctx,
915                                          &user_pol,
916                                          16,
917                                          info);
918
919         rpccli_samr_Close(pipe_hnd, mem_ctx, &user_pol);
920
921 done:
922         if (pipe_hnd) {
923                 rpccli_samr_Close(pipe_hnd, mem_ctx, &domain_pol);
924                 rpccli_samr_Close(pipe_hnd, mem_ctx, &sam_pol);
925                 cli_rpc_pipe_close(pipe_hnd);
926         }
927
928         if (cli) {
929                 cli_shutdown(cli);
930         }
931
932         return status;
933 }
934
935 /****************************************************************
936 ****************************************************************/
937
938 static WERROR do_join_modify_vals_config(struct libnet_JoinCtx *r)
939 {
940         WERROR werr;
941         struct libnet_conf_ctx *ctx;
942
943         werr = libnet_conf_open(r, &ctx);
944         if (!W_ERROR_IS_OK(werr)) {
945                 goto done;
946         }
947
948         if (!(r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE)) {
949
950                 werr = libnet_conf_set_global_parameter(ctx, "security", "user");
951                 W_ERROR_NOT_OK_GOTO_DONE(werr);
952
953                 werr = libnet_conf_set_global_parameter(ctx, "workgroup",
954                                                         r->in.domain_name);
955                 goto done;
956         }
957
958         werr = libnet_conf_set_global_parameter(ctx, "security", "domain");
959         W_ERROR_NOT_OK_GOTO_DONE(werr);
960
961         werr = libnet_conf_set_global_parameter(ctx, "workgroup",
962                                                 r->out.netbios_domain_name);
963         W_ERROR_NOT_OK_GOTO_DONE(werr);
964
965         if (r->out.domain_is_ad) {
966                 werr = libnet_conf_set_global_parameter(ctx, "security", "ads");
967                 W_ERROR_NOT_OK_GOTO_DONE(werr);
968
969                 werr = libnet_conf_set_global_parameter(ctx, "realm",
970                                                         r->out.dns_domain_name);
971                 W_ERROR_NOT_OK_GOTO_DONE(werr);
972         }
973
974  done:
975         libnet_conf_close(ctx);
976         return werr;
977 }
978
979 /****************************************************************
980 ****************************************************************/
981
982 static WERROR do_unjoin_modify_vals_config(struct libnet_UnjoinCtx *r)
983 {
984         WERROR werr = WERR_OK;
985         struct libnet_conf_ctx *ctx;
986
987         werr = libnet_conf_open(r, &ctx);
988         if (!W_ERROR_IS_OK(werr)) {
989                 goto done;
990         }
991
992         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
993
994                 werr = libnet_conf_set_global_parameter(ctx, "security", "user");
995                 W_ERROR_NOT_OK_GOTO_DONE(werr);
996                 libnet_conf_delete_global_parameter(ctx, "realm");
997         }
998
999  done:
1000         libnet_conf_close(ctx);
1001         return werr;
1002 }
1003
1004 /****************************************************************
1005 ****************************************************************/
1006
1007 static WERROR do_JoinConfig(struct libnet_JoinCtx *r)
1008 {
1009         WERROR werr;
1010
1011         if (!W_ERROR_IS_OK(r->out.result)) {
1012                 return r->out.result;
1013         }
1014
1015         if (!r->in.modify_config) {
1016                 return WERR_OK;
1017         }
1018
1019         werr = do_join_modify_vals_config(r);
1020         if (!W_ERROR_IS_OK(werr)) {
1021                 return werr;
1022         }
1023
1024         r->out.modified_config = true;
1025         r->out.result = werr;
1026
1027         return werr;
1028 }
1029
1030 /****************************************************************
1031 ****************************************************************/
1032
1033 static WERROR do_UnjoinConfig(struct libnet_UnjoinCtx *r)
1034 {
1035         WERROR werr;
1036
1037         if (!W_ERROR_IS_OK(r->out.result)) {
1038                 return r->out.result;
1039         }
1040
1041         if (!r->in.modify_config) {
1042                 return WERR_OK;
1043         }
1044
1045         werr = do_unjoin_modify_vals_config(r);
1046         if (!W_ERROR_IS_OK(werr)) {
1047                 return werr;
1048         }
1049
1050         r->out.modified_config = true;
1051         r->out.result = werr;
1052
1053         return werr;
1054 }
1055
1056 /****************************************************************
1057 ****************************************************************/
1058
1059 static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
1060                                          struct libnet_JoinCtx *r)
1061 {
1062
1063         if (!r->in.domain_name) {
1064                 return WERR_INVALID_PARAM;
1065         }
1066
1067         if (r->in.modify_config && !lp_config_backend_is_registry()) {
1068                 return WERR_NOT_SUPPORTED;
1069         }
1070
1071         if (IS_DC) {
1072                 return WERR_SETUP_DOMAIN_CONTROLLER;
1073         }
1074
1075         if (!secrets_init()) {
1076                 libnet_join_set_error_string(mem_ctx, r,
1077                         "Unable to open secrets database");
1078                 return WERR_CAN_NOT_COMPLETE;
1079         }
1080
1081         return WERR_OK;
1082 }
1083
1084 /****************************************************************
1085 ****************************************************************/
1086
1087 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
1088                                           struct libnet_JoinCtx *r)
1089 {
1090         WERROR werr;
1091
1092         if (!W_ERROR_IS_OK(r->out.result)) {
1093                 return r->out.result;
1094         }
1095
1096         werr = do_JoinConfig(r);
1097         if (!W_ERROR_IS_OK(werr)) {
1098                 return werr;
1099         }
1100
1101         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1102                 saf_store(r->in.domain_name, r->in.dc_name);
1103         }
1104
1105         return WERR_OK;
1106 }
1107
1108 /****************************************************************
1109 ****************************************************************/
1110
1111 static int libnet_destroy_JoinCtx(struct libnet_JoinCtx *r)
1112 {
1113         if (r->in.ads) {
1114                 ads_destroy(&r->in.ads);
1115         }
1116
1117         return 0;
1118 }
1119
1120 /****************************************************************
1121 ****************************************************************/
1122
1123 static int libnet_destroy_UnjoinCtx(struct libnet_UnjoinCtx *r)
1124 {
1125         if (r->in.ads) {
1126                 ads_destroy(&r->in.ads);
1127         }
1128
1129         return 0;
1130 }
1131
1132 /****************************************************************
1133 ****************************************************************/
1134
1135 WERROR libnet_init_JoinCtx(TALLOC_CTX *mem_ctx,
1136                            struct libnet_JoinCtx **r)
1137 {
1138         struct libnet_JoinCtx *ctx;
1139
1140         ctx = talloc_zero(mem_ctx, struct libnet_JoinCtx);
1141         if (!ctx) {
1142                 return WERR_NOMEM;
1143         }
1144
1145         talloc_set_destructor(ctx, libnet_destroy_JoinCtx);
1146
1147         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1148         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1149
1150         *r = ctx;
1151
1152         return WERR_OK;
1153 }
1154
1155 /****************************************************************
1156 ****************************************************************/
1157
1158 WERROR libnet_init_UnjoinCtx(TALLOC_CTX *mem_ctx,
1159                              struct libnet_UnjoinCtx **r)
1160 {
1161         struct libnet_UnjoinCtx *ctx;
1162
1163         ctx = talloc_zero(mem_ctx, struct libnet_UnjoinCtx);
1164         if (!ctx) {
1165                 return WERR_NOMEM;
1166         }
1167
1168         talloc_set_destructor(ctx, libnet_destroy_UnjoinCtx);
1169
1170         ctx->in.machine_name = talloc_strdup(mem_ctx, global_myname());
1171         W_ERROR_HAVE_NO_MEMORY(ctx->in.machine_name);
1172
1173         *r = ctx;
1174
1175         return WERR_OK;
1176 }
1177
1178 /****************************************************************
1179 ****************************************************************/
1180
1181 static WERROR libnet_DomainJoin(TALLOC_CTX *mem_ctx,
1182                                 struct libnet_JoinCtx *r)
1183 {
1184         NTSTATUS status;
1185 #ifdef WITH_ADS
1186         ADS_STATUS ads_status;
1187 #endif /* WITH_ADS */
1188
1189         if (!r->in.dc_name) {
1190                 struct DS_DOMAIN_CONTROLLER_INFO *info;
1191                 status = dsgetdcname(mem_ctx,
1192                                      r->in.domain_name,
1193                                      NULL,
1194                                      NULL,
1195                                      DS_DIRECTORY_SERVICE_REQUIRED |
1196                                      DS_WRITABLE_REQUIRED |
1197                                      DS_RETURN_DNS_NAME,
1198                                      &info);
1199                 if (!NT_STATUS_IS_OK(status)) {
1200                         libnet_join_set_error_string(mem_ctx, r,
1201                                 "failed to find DC for domain %s",
1202                                 r->in.domain_name,
1203                                 get_friendly_nt_error_msg(status));
1204                         return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1205                 }
1206
1207                 r->in.dc_name = talloc_strdup(mem_ctx,
1208                                               info->domain_controller_name);
1209                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1210         }
1211
1212 #ifdef WITH_ADS
1213         if (r->in.account_ou) {
1214
1215                 ads_status = libnet_join_connect_ads(mem_ctx, r);
1216                 if (!ADS_ERR_OK(ads_status)) {
1217                         return WERR_DEFAULT_JOIN_REQUIRED;
1218                 }
1219
1220                 ads_status = libnet_join_precreate_machine_acct(mem_ctx, r);
1221                 if (!ADS_ERR_OK(ads_status)) {
1222                         libnet_join_set_error_string(mem_ctx, r,
1223                                 "failed to precreate account in ou %s: %s",
1224                                 r->in.account_ou,
1225                                 ads_errstr(ads_status));
1226                         return WERR_DEFAULT_JOIN_REQUIRED;
1227                 }
1228
1229                 r->in.join_flags &= ~WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE;
1230         }
1231 #endif /* WITH_ADS */
1232
1233         status = libnet_join_joindomain_rpc(mem_ctx, r);
1234         if (!NT_STATUS_IS_OK(status)) {
1235                 libnet_join_set_error_string(mem_ctx, r,
1236                         "failed to join domain over rpc: %s",
1237                         get_friendly_nt_error_msg(status));
1238                 if (NT_STATUS_EQUAL(status, NT_STATUS_USER_EXISTS)) {
1239                         return WERR_SETUP_ALREADY_JOINED;
1240                 }
1241                 return ntstatus_to_werror(status);
1242         }
1243
1244         if (!libnet_join_joindomain_store_secrets(mem_ctx, r)) {
1245                 return WERR_SETUP_NOT_JOINED;
1246         }
1247
1248 #ifdef WITH_ADS
1249         if (r->out.domain_is_ad) {
1250                 ads_status  = libnet_join_post_processing_ads(mem_ctx, r);
1251                 if (!ADS_ERR_OK(ads_status)) {
1252                         return WERR_GENERAL_FAILURE;
1253                 }
1254         }
1255 #endif /* WITH_ADS */
1256
1257         return WERR_OK;
1258 }
1259
1260 /****************************************************************
1261 ****************************************************************/
1262
1263 WERROR libnet_Join(TALLOC_CTX *mem_ctx,
1264                    struct libnet_JoinCtx *r)
1265 {
1266         WERROR werr;
1267
1268         if (r->in.debug) {
1269                 LIBNET_JOIN_IN_DUMP_CTX(mem_ctx, r);
1270         }
1271
1272         werr = libnet_join_pre_processing(mem_ctx, r);
1273         if (!W_ERROR_IS_OK(werr)) {
1274                 goto done;
1275         }
1276
1277         if (r->in.join_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1278                 werr = libnet_DomainJoin(mem_ctx, r);
1279                 if (!W_ERROR_IS_OK(werr)) {
1280                         goto done;
1281                 }
1282         }
1283
1284         werr = libnet_join_post_processing(mem_ctx, r);
1285         if (!W_ERROR_IS_OK(werr)) {
1286                 goto done;
1287         }
1288  done:
1289         r->out.result = werr;
1290
1291         if (r->in.debug) {
1292                 LIBNET_JOIN_OUT_DUMP_CTX(mem_ctx, r);
1293         }
1294         return werr;
1295 }
1296
1297 /****************************************************************
1298 ****************************************************************/
1299
1300 static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
1301                                   struct libnet_UnjoinCtx *r)
1302 {
1303         NTSTATUS status;
1304
1305         if (!r->in.domain_sid) {
1306                 struct dom_sid sid;
1307                 if (!secrets_fetch_domain_sid(lp_workgroup(), &sid)) {
1308                         libnet_unjoin_set_error_string(mem_ctx, r,
1309                                 "Unable to fetch domain sid: are we joined?");
1310                         return WERR_SETUP_NOT_JOINED;
1311                 }
1312                 r->in.domain_sid = sid_dup_talloc(mem_ctx, &sid);
1313                 W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
1314         }
1315
1316         if (!r->in.dc_name) {
1317                 struct DS_DOMAIN_CONTROLLER_INFO *info;
1318                 status = dsgetdcname(mem_ctx,
1319                                      r->in.domain_name,
1320                                      NULL,
1321                                      NULL,
1322                                      DS_DIRECTORY_SERVICE_REQUIRED |
1323                                      DS_WRITABLE_REQUIRED |
1324                                      DS_RETURN_DNS_NAME,
1325                                      &info);
1326                 if (!NT_STATUS_IS_OK(status)) {
1327                         libnet_unjoin_set_error_string(mem_ctx, r,
1328                                 "failed to find DC for domain %s",
1329                                 r->in.domain_name,
1330                                 get_friendly_nt_error_msg(status));
1331                         return WERR_DOMAIN_CONTROLLER_NOT_FOUND;
1332                 }
1333
1334                 r->in.dc_name = talloc_strdup(mem_ctx,
1335                                               info->domain_controller_name);
1336                 W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
1337         }
1338
1339         status = libnet_join_unjoindomain_rpc(mem_ctx, r);
1340         if (!NT_STATUS_IS_OK(status)) {
1341                 libnet_unjoin_set_error_string(mem_ctx, r,
1342                         "failed to disable machine account via rpc: %s",
1343                         get_friendly_nt_error_msg(status));
1344                 if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
1345                         return WERR_SETUP_NOT_JOINED;
1346                 }
1347                 return ntstatus_to_werror(status);
1348         }
1349
1350 #ifdef WITH_ADS
1351         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
1352                 ADS_STATUS ads_status;
1353                 libnet_unjoin_connect_ads(mem_ctx, r);
1354                 ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
1355                 if (!ADS_ERR_OK(ads_status)) {
1356                         libnet_unjoin_set_error_string(mem_ctx, r,
1357                                 "failed to remove machine account from AD: %s",
1358                                 ads_errstr(ads_status));
1359                 }
1360         }
1361 #endif /* WITH_ADS */
1362
1363         libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
1364
1365         return WERR_OK;
1366 }
1367
1368 /****************************************************************
1369 ****************************************************************/
1370
1371 static WERROR libnet_unjoin_pre_processing(TALLOC_CTX *mem_ctx,
1372                                            struct libnet_UnjoinCtx *r)
1373 {
1374         if (r->in.modify_config && !lp_config_backend_is_registry()) {
1375                 return WERR_NOT_SUPPORTED;
1376         }
1377
1378         if (!secrets_init()) {
1379                 libnet_unjoin_set_error_string(mem_ctx, r,
1380                         "Unable to open secrets database");
1381                 return WERR_CAN_NOT_COMPLETE;
1382         }
1383
1384         return WERR_OK;
1385 }
1386
1387
1388 /****************************************************************
1389 ****************************************************************/
1390
1391 WERROR libnet_Unjoin(TALLOC_CTX *mem_ctx,
1392                      struct libnet_UnjoinCtx *r)
1393 {
1394         WERROR werr;
1395
1396         if (r->in.debug) {
1397                 LIBNET_UNJOIN_IN_DUMP_CTX(mem_ctx, r);
1398         }
1399
1400         werr = libnet_unjoin_pre_processing(mem_ctx, r);
1401         if (!W_ERROR_IS_OK(werr)) {
1402                 goto done;
1403         }
1404
1405         if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_JOIN_TYPE) {
1406                 werr = libnet_DomainUnjoin(mem_ctx, r);
1407                 if (!W_ERROR_IS_OK(werr)) {
1408                         goto done;
1409                 }
1410         }
1411
1412         werr = do_UnjoinConfig(r);
1413         if (!W_ERROR_IS_OK(werr)) {
1414                 goto done;
1415         }
1416
1417  done:
1418         r->out.result = werr;
1419
1420         if (r->in.debug) {
1421                 LIBNET_UNJOIN_OUT_DUMP_CTX(mem_ctx, r);
1422         }
1423
1424         return werr;
1425 }