2 Unix SMB/CIFS implementation.
4 Winbind rpc backend functions
6 Copyright (C) Tim Potter 2000-2001,2003
7 Copyright (C) Andrew Tridgell 2001
8 Copyright (C) Volker Lendecke 2005
9 Copyright (C) Guenther Deschner 2008 (pidl conversion)
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
27 #include "winbindd_rpc.h"
29 #include "../librpc/gen_ndr/ndr_samr_c.h"
30 #include "rpc_client/cli_pipe.h"
31 #include "rpc_client/cli_samr.h"
32 #include "rpc_client/cli_lsarpc.h"
33 #include "../libcli/security/security.h"
36 #define DBGC_CLASS DBGC_WINBIND
39 /* Query display info for a domain. This returns enough information plus a
40 bit extra to give an overview of domain users for the User Manager
42 static NTSTATUS msrpc_query_user_list(struct winbindd_domain *domain,
45 struct wbint_userinfo **pinfo)
47 struct rpc_pipe_client *samr_pipe = NULL;
48 struct policy_handle dom_pol;
49 struct wbint_userinfo *info = NULL;
50 uint32_t num_info = 0;
54 DEBUG(3, ("msrpc_query_user_list\n"));
60 tmp_ctx = talloc_stackframe();
61 if (tmp_ctx == NULL) {
62 return NT_STATUS_NO_MEMORY;
65 if ( !winbindd_can_contact_domain( domain ) ) {
66 DEBUG(10,("query_user_list: No incoming trust for domain %s\n",
68 status = NT_STATUS_OK;
72 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
73 if (!NT_STATUS_IS_OK(status)) {
77 status = rpc_query_user_list(tmp_ctx,
83 if (!NT_STATUS_IS_OK(status)) {
88 *pnum_info = num_info;
92 *pinfo = talloc_move(mem_ctx, &info);
100 /* list all domain groups */
101 static NTSTATUS msrpc_enum_dom_groups(struct winbindd_domain *domain,
104 struct wb_acct_info **pinfo)
106 struct rpc_pipe_client *samr_pipe;
107 struct policy_handle dom_pol;
108 struct wb_acct_info *info = NULL;
109 uint32_t num_info = 0;
113 DEBUG(3,("msrpc_enum_dom_groups\n"));
119 tmp_ctx = talloc_stackframe();
120 if (tmp_ctx == NULL) {
121 return NT_STATUS_NO_MEMORY;
124 if ( !winbindd_can_contact_domain( domain ) ) {
125 DEBUG(10,("enum_domain_groups: No incoming trust for domain %s\n",
127 status = NT_STATUS_OK;
131 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
132 if (!NT_STATUS_IS_OK(status)) {
136 status = rpc_enum_dom_groups(tmp_ctx,
141 if (!NT_STATUS_IS_OK(status)) {
146 *pnum_info = num_info;
150 *pinfo = talloc_move(mem_ctx, &info);
154 TALLOC_FREE(tmp_ctx);
158 /* List all domain groups */
160 static NTSTATUS msrpc_enum_local_groups(struct winbindd_domain *domain,
163 struct wb_acct_info **pinfo)
165 struct rpc_pipe_client *samr_pipe;
166 struct policy_handle dom_pol;
167 struct wb_acct_info *info = NULL;
168 uint32_t num_info = 0;
172 DEBUG(3,("msrpc_enum_local_groups\n"));
178 tmp_ctx = talloc_stackframe();
179 if (tmp_ctx == NULL) {
180 return NT_STATUS_NO_MEMORY;
183 if ( !winbindd_can_contact_domain( domain ) ) {
184 DEBUG(10,("enum_local_groups: No incoming trust for domain %s\n",
186 status = NT_STATUS_OK;
190 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
191 if (!NT_STATUS_IS_OK(status)) {
195 status = rpc_enum_local_groups(mem_ctx,
200 if (!NT_STATUS_IS_OK(status)) {
205 *pnum_info = num_info;
209 *pinfo = talloc_move(mem_ctx, &info);
213 TALLOC_FREE(tmp_ctx);
217 /* convert a single name to a sid in a domain */
218 static NTSTATUS msrpc_name_to_sid(struct winbindd_domain *domain,
220 const char *domain_name,
224 enum lsa_SidType *type)
227 struct dom_sid *sids = NULL;
228 enum lsa_SidType *types = NULL;
229 char *full_name = NULL;
230 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
231 char *mapped_name = NULL;
233 if (name == NULL || *name=='\0') {
234 full_name = talloc_asprintf(mem_ctx, "%s", domain_name);
235 } else if (domain_name == NULL || *domain_name == '\0') {
236 full_name = talloc_asprintf(mem_ctx, "%s", name);
238 full_name = talloc_asprintf(mem_ctx, "%s\\%s", domain_name, name);
241 DEBUG(0, ("talloc_asprintf failed!\n"));
242 return NT_STATUS_NO_MEMORY;
245 DEBUG(3, ("msrpc_name_to_sid: name=%s\n", full_name));
247 name_map_status = normalize_name_unmap(mem_ctx, full_name,
250 /* Reset the full_name pointer if we mapped anytthing */
252 if (NT_STATUS_IS_OK(name_map_status) ||
253 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
255 full_name = mapped_name;
258 DEBUG(3,("name_to_sid [rpc] %s for domain %s\n",
259 full_name?full_name:"", domain_name ));
261 result = winbindd_lookup_names(mem_ctx, domain, 1,
262 (const char **)&full_name, NULL,
264 if (!NT_STATUS_IS_OK(result))
267 /* Return rid and type if lookup successful */
269 sid_copy(sid, &sids[0]);
276 convert a domain SID to a user or group name
278 static NTSTATUS msrpc_sid_to_name(struct winbindd_domain *domain,
280 const struct dom_sid *sid,
283 enum lsa_SidType *type)
287 enum lsa_SidType *types = NULL;
289 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
290 char *mapped_name = NULL;
292 DEBUG(3, ("msrpc_sid_to_name: %s for domain %s\n", sid_string_dbg(sid),
295 result = winbindd_lookup_sids(mem_ctx,
302 if (!NT_STATUS_IS_OK(result)) {
303 DEBUG(2,("msrpc_sid_to_name: failed to lookup sids: %s\n",
309 *type = (enum lsa_SidType)types[0];
310 *domain_name = domains[0];
313 DEBUG(5,("Mapped sid to [%s]\\[%s]\n", domains[0], *name));
315 name_map_status = normalize_name_map(mem_ctx, domain, *name,
317 if (NT_STATUS_IS_OK(name_map_status) ||
318 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
321 DEBUG(5,("returning mapped name -- %s\n", *name));
327 static NTSTATUS msrpc_rids_to_names(struct winbindd_domain *domain,
329 const struct dom_sid *sid,
334 enum lsa_SidType **types)
338 struct dom_sid *sids;
342 DEBUG(3, ("msrpc_rids_to_names: domain %s\n", domain->name ));
345 sids = TALLOC_ARRAY(mem_ctx, struct dom_sid, num_rids);
347 return NT_STATUS_NO_MEMORY;
353 for (i=0; i<num_rids; i++) {
354 if (!sid_compose(&sids[i], sid, rids[i])) {
355 return NT_STATUS_INTERNAL_ERROR;
359 result = winbindd_lookup_sids(mem_ctx,
367 if (!NT_STATUS_IS_OK(result) &&
368 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED)) {
373 for (i=0; i<num_rids; i++) {
374 NTSTATUS name_map_status = NT_STATUS_UNSUCCESSFUL;
375 char *mapped_name = NULL;
377 if ((*types)[i] != SID_NAME_UNKNOWN) {
378 name_map_status = normalize_name_map(mem_ctx,
382 if (NT_STATUS_IS_OK(name_map_status) ||
383 NT_STATUS_EQUAL(name_map_status, NT_STATUS_FILE_RENAMED))
385 ret_names[i] = mapped_name;
388 *domain_name = domains[i];
395 /* Lookup user information from a rid or username. */
396 static NTSTATUS msrpc_query_user(struct winbindd_domain *domain,
398 const struct dom_sid *user_sid,
399 struct wbint_userinfo *user_info)
401 struct rpc_pipe_client *samr_pipe;
402 struct policy_handle dom_pol;
403 struct netr_SamInfo3 *user;
407 DEBUG(3,("msrpc_query_user sid=%s\n", sid_string_dbg(user_sid)));
409 tmp_ctx = talloc_stackframe();
410 if (tmp_ctx == NULL) {
411 return NT_STATUS_NO_MEMORY;
415 user_info->homedir = NULL;
416 user_info->shell = NULL;
417 user_info->primary_gid = (gid_t)-1;
420 /* try netsamlogon cache first */
421 user = netsamlogon_cache_get(tmp_ctx, user_sid);
423 DEBUG(5,("msrpc_query_user: Cache lookup succeeded for %s\n",
424 sid_string_dbg(user_sid)));
426 sid_compose(&user_info->user_sid, &domain->sid, user->base.rid);
427 sid_compose(&user_info->group_sid, &domain->sid,
428 user->base.primary_gid);
430 user_info->acct_name = talloc_strdup(user_info,
431 user->base.account_name.string);
432 user_info->full_name = talloc_strdup(user_info,
433 user->base.full_name.string);
435 status = NT_STATUS_OK;
439 if ( !winbindd_can_contact_domain( domain ) ) {
440 DEBUG(10,("query_user: No incoming trust for domain %s\n",
442 /* Tell the cache manager not to remember this one */
443 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
447 /* no cache; hit the wire */
448 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
449 if (!NT_STATUS_IS_OK(status)) {
453 status = rpc_query_user(tmp_ctx,
461 TALLOC_FREE(tmp_ctx);
465 /* Lookup groups a user is a member of. I wish Unix had a call like this! */
466 static NTSTATUS msrpc_lookup_usergroups(struct winbindd_domain *domain,
468 const struct dom_sid *user_sid,
469 uint32_t *pnum_groups,
470 struct dom_sid **puser_grpsids)
472 struct rpc_pipe_client *samr_pipe;
473 struct policy_handle dom_pol;
474 struct dom_sid *user_grpsids = NULL;
475 uint32_t num_groups = 0;
479 DEBUG(3,("msrpc_lookup_usergroups sid=%s\n", sid_string_dbg(user_sid)));
483 tmp_ctx = talloc_stackframe();
484 if (tmp_ctx == NULL) {
485 return NT_STATUS_NO_MEMORY;
488 /* Check if we have a cached user_info_3 */
489 status = lookup_usergroups_cached(domain,
494 if (NT_STATUS_IS_OK(status)) {
498 if ( !winbindd_can_contact_domain( domain ) ) {
499 DEBUG(10,("lookup_usergroups: No incoming trust for domain %s\n",
502 /* Tell the cache manager not to remember this one */
503 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
507 /* no cache; hit the wire */
508 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
509 if (!NT_STATUS_IS_OK(status)) {
513 status = rpc_lookup_usergroups(tmp_ctx,
520 if (!NT_STATUS_IS_OK(status)) {
525 *pnum_groups = num_groups;
528 *puser_grpsids = talloc_move(mem_ctx, &user_grpsids);
532 TALLOC_FREE(tmp_ctx);
537 #define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
539 static NTSTATUS msrpc_lookup_useraliases(struct winbindd_domain *domain,
541 uint32 num_sids, const struct dom_sid *sids,
542 uint32 *pnum_aliases,
543 uint32 **palias_rids)
545 struct rpc_pipe_client *samr_pipe;
546 struct policy_handle dom_pol;
547 uint32_t num_aliases = 0;
548 uint32_t *alias_rids = NULL;
552 DEBUG(3,("msrpc_lookup_useraliases\n"));
558 tmp_ctx = talloc_stackframe();
559 if (tmp_ctx == NULL) {
560 return NT_STATUS_NO_MEMORY;
563 if (!winbindd_can_contact_domain(domain)) {
564 DEBUG(10,("msrpc_lookup_useraliases: No incoming trust for domain %s\n",
566 /* Tell the cache manager not to remember this one */
567 status = NT_STATUS_SYNCHRONIZATION_REQUIRED;
571 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
572 if (!NT_STATUS_IS_OK(status)) {
576 status = rpc_lookup_useraliases(tmp_ctx,
583 if (!NT_STATUS_IS_OK(status)) {
588 *pnum_aliases = num_aliases;
592 *palias_rids = talloc_move(mem_ctx, &alias_rids);
596 TALLOC_FREE(tmp_ctx);
601 /* Lookup group membership given a rid. */
602 static NTSTATUS msrpc_lookup_groupmem(struct winbindd_domain *domain,
604 const struct dom_sid *group_sid,
605 enum lsa_SidType type,
607 struct dom_sid **sid_mem,
609 uint32_t **name_types)
611 NTSTATUS status, result;
612 uint32 i, total_names = 0;
613 struct policy_handle dom_pol, group_pol;
614 uint32 des_access = SEC_FLAG_MAXIMUM_ALLOWED;
615 uint32 *rid_mem = NULL;
618 struct rpc_pipe_client *cli;
619 unsigned int orig_timeout;
620 struct samr_RidAttrArray *rids = NULL;
621 struct dcerpc_binding_handle *b;
623 DEBUG(3,("msrpc_lookup_groupmem: %s sid=%s\n", domain->name,
624 sid_string_dbg(group_sid)));
626 if ( !winbindd_can_contact_domain( domain ) ) {
627 DEBUG(10,("lookup_groupmem: No incoming trust for domain %s\n",
632 if (!sid_peek_check_rid(&domain->sid, group_sid, &group_rid))
633 return NT_STATUS_UNSUCCESSFUL;
637 result = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
638 if (!NT_STATUS_IS_OK(result))
641 b = cli->binding_handle;
643 status = dcerpc_samr_OpenGroup(b, mem_ctx,
649 if (!NT_STATUS_IS_OK(status)) {
652 if (!NT_STATUS_IS_OK(result)) {
656 /* Step #1: Get a list of user rids that are the members of the
659 /* This call can take a long time - allow the server to time out.
660 35 seconds should do it. */
662 orig_timeout = rpccli_set_timeout(cli, 35000);
664 status = dcerpc_samr_QueryGroupMember(b, mem_ctx,
669 /* And restore our original timeout. */
670 rpccli_set_timeout(cli, orig_timeout);
674 dcerpc_samr_Close(b, mem_ctx, &group_pol, &_result);
677 if (!NT_STATUS_IS_OK(status)) {
681 if (!NT_STATUS_IS_OK(result)) {
685 if (!rids || !rids->count) {
692 *num_names = rids->count;
693 rid_mem = rids->rids;
695 /* Step #2: Convert list of rids into list of usernames. Do this
696 in bunches of ~1000 to avoid crashing NT4. It looks like there
697 is a buffer overflow or something like that lurking around
700 #define MAX_LOOKUP_RIDS 900
702 *names = TALLOC_ZERO_ARRAY(mem_ctx, char *, *num_names);
703 *name_types = TALLOC_ZERO_ARRAY(mem_ctx, uint32, *num_names);
704 *sid_mem = TALLOC_ZERO_ARRAY(mem_ctx, struct dom_sid, *num_names);
706 for (j=0;j<(*num_names);j++)
707 sid_compose(&(*sid_mem)[j], &domain->sid, rid_mem[j]);
709 if (*num_names>0 && (!*names || !*name_types))
710 return NT_STATUS_NO_MEMORY;
712 for (i = 0; i < *num_names; i += MAX_LOOKUP_RIDS) {
713 int num_lookup_rids = MIN(*num_names - i, MAX_LOOKUP_RIDS);
714 struct lsa_Strings tmp_names;
715 struct samr_Ids tmp_types;
717 /* Lookup a chunk of rids */
719 status = dcerpc_samr_LookupRids(b, mem_ctx,
726 if (!NT_STATUS_IS_OK(status)) {
730 /* see if we have a real error (and yes the
731 STATUS_SOME_UNMAPPED is the one returned from 2k) */
733 if (!NT_STATUS_IS_OK(result) &&
734 !NT_STATUS_EQUAL(result, STATUS_SOME_UNMAPPED))
737 /* Copy result into array. The talloc system will take
738 care of freeing the temporary arrays later on. */
740 if (tmp_names.count != tmp_types.count) {
741 return NT_STATUS_UNSUCCESSFUL;
744 for (r=0; r<tmp_names.count; r++) {
745 if (tmp_types.ids[r] == SID_NAME_UNKNOWN) {
748 (*names)[total_names] = fill_domain_username_talloc(
749 mem_ctx, domain->name,
750 tmp_names.names[r].string, true);
751 (*name_types)[total_names] = tmp_types.ids[r];
756 *num_names = total_names;
765 static int get_ldap_seq(const char *server, int port, uint32 *seq)
769 const char *attrs[] = {"highestCommittedUSN", NULL};
770 LDAPMessage *res = NULL;
771 char **values = NULL;
774 *seq = DOM_SEQUENCE_NONE;
777 * Parameterised (5) second timeout on open. This is needed as the
778 * search timeout doesn't seem to apply to doing an open as well. JRA.
781 ldp = ldap_open_with_timeout(server, port, lp_ldap_timeout());
785 /* Timeout if no response within 20 seconds. */
789 if (ldap_search_st(ldp, "", LDAP_SCOPE_BASE, "(objectclass=*)",
790 CONST_DISCARD(char **, attrs), 0, &to, &res))
793 if (ldap_count_entries(ldp, res) != 1)
796 values = ldap_get_values(ldp, res, "highestCommittedUSN");
797 if (!values || !values[0])
800 *seq = atoi(values[0]);
806 ldap_value_free(values);
814 /**********************************************************************
815 Get the sequence number for a Windows AD native mode domain using
817 **********************************************************************/
819 static int get_ldap_sequence_number(struct winbindd_domain *domain, uint32 *seq)
822 char addr[INET6_ADDRSTRLEN];
824 print_sockaddr(addr, sizeof(addr), &domain->dcaddr);
825 if ((ret = get_ldap_seq(addr, LDAP_PORT, seq)) == 0) {
826 DEBUG(3, ("get_ldap_sequence_number: Retrieved sequence "
827 "number for Domain (%s) from DC (%s)\n",
828 domain->name, addr));
833 #endif /* HAVE_LDAP */
835 /* find the sequence number for a domain */
836 static NTSTATUS msrpc_sequence_number(struct winbindd_domain *domain,
839 struct rpc_pipe_client *samr_pipe;
840 struct policy_handle dom_pol;
845 DEBUG(3, ("msrpc_sequence_number: fetch sequence_number for %s\n", domain->name));
848 *pseq = DOM_SEQUENCE_NONE;
851 tmp_ctx = talloc_stackframe();
852 if (tmp_ctx == NULL) {
853 return NT_STATUS_NO_MEMORY;
856 if ( !winbindd_can_contact_domain( domain ) ) {
857 DEBUG(10,("sequence_number: No incoming trust for domain %s\n",
862 status = NT_STATUS_OK;
867 if (domain->active_directory) {
870 DEBUG(8,("using get_ldap_seq() to retrieve the "
871 "sequence number\n"));
873 rc = get_ldap_sequence_number(domain, &seq);
875 DEBUG(10,("domain_sequence_number: LDAP for "
883 status = NT_STATUS_OK;
887 DEBUG(10,("domain_sequence_number: failed to get LDAP "
888 "sequence number for domain %s\n",
891 #endif /* HAVE_LDAP */
893 status = cm_connect_sam(domain, tmp_ctx, &samr_pipe, &dom_pol);
894 if (!NT_STATUS_IS_OK(status)) {
898 status = rpc_sequence_number(tmp_ctx,
903 if (!NT_STATUS_IS_OK(status)) {
912 TALLOC_FREE(tmp_ctx);
916 /* get a list of trusted domains */
917 static NTSTATUS msrpc_trusted_domains(struct winbindd_domain *domain,
919 struct netr_DomainTrustList *ptrust_list)
921 struct rpc_pipe_client *lsa_pipe;
922 struct policy_handle lsa_policy;
923 struct netr_DomainTrust *trusts = NULL;
924 uint32_t num_trusts = 0;
928 DEBUG(3,("msrpc_trusted_domains\n"));
931 ZERO_STRUCTP(ptrust_list);
934 tmp_ctx = talloc_stackframe();
935 if (tmp_ctx == NULL) {
936 return NT_STATUS_NO_MEMORY;
939 status = cm_connect_lsa(domain, tmp_ctx, &lsa_pipe, &lsa_policy);
940 if (!NT_STATUS_IS_OK(status))
943 status = rpc_trusted_domains(tmp_ctx,
948 if (!NT_STATUS_IS_OK(status)) {
953 ptrust_list->count = num_trusts;
954 ptrust_list->array = talloc_move(mem_ctx, &trusts);
958 TALLOC_FREE(tmp_ctx);
962 /* find the lockout policy for a domain */
963 static NTSTATUS msrpc_lockout_policy(struct winbindd_domain *domain,
965 struct samr_DomInfo12 *lockout_policy)
967 NTSTATUS status, result;
968 struct rpc_pipe_client *cli;
969 struct policy_handle dom_pol;
970 union samr_DomainInfo *info = NULL;
971 struct dcerpc_binding_handle *b;
973 DEBUG(3, ("msrpc_lockout_policy: fetch lockout policy for %s\n", domain->name));
975 if ( !winbindd_can_contact_domain( domain ) ) {
976 DEBUG(10,("msrpc_lockout_policy: No incoming trust for domain %s\n",
978 return NT_STATUS_NOT_SUPPORTED;
981 status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
982 if (!NT_STATUS_IS_OK(status)) {
986 b = cli->binding_handle;
988 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
990 DomainLockoutInformation,
993 if (!NT_STATUS_IS_OK(status)) {
996 if (!NT_STATUS_IS_OK(result)) {
1001 *lockout_policy = info->info12;
1003 DEBUG(10,("msrpc_lockout_policy: lockout_threshold %d\n",
1004 info->info12.lockout_threshold));
1011 /* find the password policy for a domain */
1012 static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
1013 TALLOC_CTX *mem_ctx,
1014 struct samr_DomInfo1 *password_policy)
1016 NTSTATUS status, result;
1017 struct rpc_pipe_client *cli;
1018 struct policy_handle dom_pol;
1019 union samr_DomainInfo *info = NULL;
1020 struct dcerpc_binding_handle *b;
1022 DEBUG(3, ("msrpc_password_policy: fetch password policy for %s\n",
1025 if ( !winbindd_can_contact_domain( domain ) ) {
1026 DEBUG(10,("msrpc_password_policy: No incoming trust for domain %s\n",
1028 return NT_STATUS_NOT_SUPPORTED;
1031 status = cm_connect_sam(domain, mem_ctx, &cli, &dom_pol);
1032 if (!NT_STATUS_IS_OK(status)) {
1036 b = cli->binding_handle;
1038 status = dcerpc_samr_QueryDomainInfo(b, mem_ctx,
1040 DomainPasswordInformation,
1043 if (!NT_STATUS_IS_OK(status)) {
1046 if (!NT_STATUS_IS_OK(result)) {
1050 *password_policy = info->info1;
1052 DEBUG(10,("msrpc_password_policy: min_length_password %d\n",
1053 info->info1.min_password_length));
1060 typedef NTSTATUS (*lookup_sids_fn_t)(struct dcerpc_binding_handle *h,
1061 TALLOC_CTX *mem_ctx,
1062 struct policy_handle *pol,
1064 const struct dom_sid *sids,
1067 enum lsa_SidType **ptypes,
1070 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
1071 struct winbindd_domain *domain,
1073 const struct dom_sid *sids,
1076 enum lsa_SidType **types)
1080 struct rpc_pipe_client *cli = NULL;
1081 struct dcerpc_binding_handle *b = NULL;
1082 struct policy_handle lsa_policy;
1083 unsigned int orig_timeout;
1084 lookup_sids_fn_t lookup_sids_fn = dcerpc_lsa_lookup_sids;
1086 if (domain->can_do_ncacn_ip_tcp) {
1087 status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
1088 if (NT_STATUS_IS_OK(status)) {
1089 lookup_sids_fn = dcerpc_lsa_lookup_sids3;
1092 domain->can_do_ncacn_ip_tcp = false;
1094 status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
1096 if (!NT_STATUS_IS_OK(status)) {
1101 b = cli->binding_handle;
1104 * This call can take a long time
1105 * allow the server to time out.
1106 * 35 seconds should do it.
1108 orig_timeout = dcerpc_binding_handle_set_timeout(b, 35000);
1110 status = lookup_sids_fn(b,
1120 /* And restore our original timeout. */
1121 dcerpc_binding_handle_set_timeout(b, orig_timeout);
1123 if (NT_STATUS_V(status) == DCERPC_FAULT_ACCESS_DENIED ||
1124 NT_STATUS_V(status) == DCERPC_FAULT_SEC_PKG_ERROR) {
1126 * This can happen if the schannel key is not
1127 * valid anymore, we need to invalidate the
1128 * all connections to the dc and reestablish
1129 * a netlogon connection first.
1131 invalidate_cm_connection(&domain->conn);
1132 status = NT_STATUS_ACCESS_DENIED;
1135 if (!NT_STATUS_IS_OK(status)) {
1139 if (!NT_STATUS_IS_OK(result)) {
1143 return NT_STATUS_OK;
1146 typedef NTSTATUS (*lookup_names_fn_t)(struct rpc_pipe_client *cli,
1147 TALLOC_CTX *mem_ctx,
1148 struct policy_handle *pol,
1151 const char ***dom_names,
1153 struct dom_sid **sids,
1154 enum lsa_SidType **types);
1156 NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
1157 struct winbindd_domain *domain,
1160 const char ***domains,
1161 struct dom_sid **sids,
1162 enum lsa_SidType **types)
1165 struct rpc_pipe_client *cli = NULL;
1166 struct policy_handle lsa_policy;
1167 unsigned int orig_timeout = 0;
1168 lookup_names_fn_t lookup_names_fn = rpccli_lsa_lookup_names;
1170 if (domain->can_do_ncacn_ip_tcp) {
1171 status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
1172 if (NT_STATUS_IS_OK(status)) {
1173 lookup_names_fn = rpccli_lsa_lookup_names4;
1176 domain->can_do_ncacn_ip_tcp = false;
1178 status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
1180 if (!NT_STATUS_IS_OK(status)) {
1187 * This call can take a long time
1188 * allow the server to time out.
1189 * 35 seconds should do it.
1191 orig_timeout = rpccli_set_timeout(cli, 35000);
1193 status = lookup_names_fn(cli,
1197 (const char **) names,
1203 /* And restore our original timeout. */
1204 rpccli_set_timeout(cli, orig_timeout);
1206 if (NT_STATUS_V(status) == DCERPC_FAULT_ACCESS_DENIED ||
1207 NT_STATUS_V(status) == DCERPC_FAULT_SEC_PKG_ERROR) {
1209 * This can happen if the schannel key is not
1210 * valid anymore, we need to invalidate the
1211 * all connections to the dc and reestablish
1212 * a netlogon connection first.
1214 invalidate_cm_connection(&domain->conn);
1215 status = NT_STATUS_ACCESS_DENIED;
1218 if (!NT_STATUS_IS_OK(status)) {
1225 /* the rpc backend methods are exposed via this structure */
1226 struct winbindd_methods msrpc_methods = {
1228 msrpc_query_user_list,
1229 msrpc_enum_dom_groups,
1230 msrpc_enum_local_groups,
1233 msrpc_rids_to_names,
1235 msrpc_lookup_usergroups,
1236 msrpc_lookup_useraliases,
1237 msrpc_lookup_groupmem,
1238 msrpc_sequence_number,
1239 msrpc_lockout_policy,
1240 msrpc_password_policy,
1241 msrpc_trusted_domains,