#define SAMR_USR_RIGHTS_WRITE_PW \
( READ_CONTROL_ACCESS | \
- SA_RIGHT_USER_CHANGE_PASSWORD | \
- SA_RIGHT_USER_SET_LOC_COM )
+ SAMR_USER_ACCESS_CHANGE_PASSWORD | \
+ SAMR_USER_ACCESS_SET_LOC_COM)
#define SAMR_USR_RIGHTS_CANT_WRITE_PW \
- ( READ_CONTROL_ACCESS | SA_RIGHT_USER_SET_LOC_COM )
+ ( READ_CONTROL_ACCESS | SAMR_USER_ACCESS_SET_LOC_COM )
#define DISP_INFO_CACHE_TIMEOUT 10
+#define MAX_SAM_ENTRIES_W2K 0x400 /* 1024 */
+#define MAX_SAM_ENTRIES_W95 50
+
typedef struct disp_info {
DOM_SID sid; /* identify which domain this is. */
bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
static const struct generic_mapping usr_nopwchange_generic_mapping = {
GENERIC_RIGHTS_USER_READ,
GENERIC_RIGHTS_USER_WRITE,
- GENERIC_RIGHTS_USER_EXECUTE & ~SA_RIGHT_USER_CHANGE_PASSWORD,
+ GENERIC_RIGHTS_USER_EXECUTE & ~SAMR_USER_ACCESS_CHANGE_PASSWORD,
GENERIC_RIGHTS_USER_ALL_ACCESS};
static const struct generic_mapping grp_generic_mapping = {
GENERIC_RIGHTS_GROUP_READ,
/* check the security descriptor first */
- if ( se_access_check(psd, token, des_access, acc_granted, &status) )
+ status = se_access_check(psd, token, des_access, acc_granted);
+ if (NT_STATUS_IS_OK(status)) {
goto done;
+ }
/* give root a free pass */
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_SAM_OPEN_DOMAIN,
+ SAMR_ACCESS_OPEN_DOMAIN,
"_samr_OpenDomain" );
if ( !NT_STATUS_IS_OK(status) )
return status;
/*check if access can be granted as requested by client. */
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
se_map_generic( &des_access, &dom_generic_mapping );
se_priv_copy( &se_rights, &se_machine_account );
se_priv_add( &se_rights, &se_add_users );
- status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
+ status = access_check_samr_object( psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
&acc_granted, "_samr_OpenDomain" );
if (sid_equal(&pol_sid, &dacl->aces[i].trustee)) {
ret = pdb_set_pass_can_change(sampass,
(dacl->aces[i].access_mask &
- SA_RIGHT_USER_CHANGE_PASSWORD) ?
+ SAMR_USER_ACCESS_CHANGE_PASSWORD) ?
True: False);
break;
}
}
status = access_check_samr_function(acc_granted,
- SA_RIGHT_USER_SET_ATTRIBUTES,
+ SAMR_USER_ACCESS_SET_ATTRIBUTES,
"_samr_SetSecurity");
if (NT_STATUS_IS_OK(status)) {
become_root();
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+ SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_EnumDomainUsers");
if (!NT_STATUS_IS_OK(status)) {
return status;
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+ SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_EnumDomainGroups");
if (!NT_STATUS_IS_OK(status)) {
return status;
sid_string_dbg(&info->sid)));
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+ SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_EnumDomainAliases");
if (!NT_STATUS_IS_OK(status)) {
return status;
if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
return NT_STATUS_INVALID_HANDLE;
+ if (info->builtin_domain) {
+ DEBUG(5,("_samr_QueryDisplayInfo: Nothing in BUILTIN\n"));
+ return NT_STATUS_OK;
+ }
+
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+ SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_QueryDisplayInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
/* calculate the total size */
total_data_size=num_account*struct_size;
- if (num_account) {
+ if (max_entries <= num_account) {
status = STATUS_MORE_ENTRIES;
} else {
status = NT_STATUS_OK;
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_ALIAS_LOOKUP_INFO,
+ SAMR_ALIAS_ACCESS_LOOKUP_INFO,
"_samr_QueryAliasInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
return NT_STATUS_OK;
}
-#if 0
-/*******************************************************************
- samr_reply_lookup_ids
- ********************************************************************/
-
- uint32 _samr_lookup_ids(pipes_struct *p, SAMR_Q_LOOKUP_IDS *q_u, SAMR_R_LOOKUP_IDS *r_u)
-{
- uint32 rid[MAX_SAM_ENTRIES];
- int num_rids = q_u->num_sids1;
-
- r_u->status = NT_STATUS_OK;
-
- DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
-
- if (num_rids > MAX_SAM_ENTRIES) {
- num_rids = MAX_SAM_ENTRIES;
- DEBUG(5,("_samr_lookup_ids: truncating entries to %d\n", num_rids));
- }
-
-#if 0
- int i;
- SMB_ASSERT_ARRAY(q_u->uni_user_name, num_rids);
-
- for (i = 0; i < num_rids && status == 0; i++)
- {
- struct sam_passwd *sam_pass;
- fstring user_name;
-
-
- fstrcpy(user_name, unistrn2(q_u->uni_user_name[i].buffer,
- q_u->uni_user_name[i].uni_str_len));
-
- /* find the user account */
- become_root();
- sam_pass = get_smb21pwd_entry(user_name, 0);
- unbecome_root();
-
- if (sam_pass == NULL)
- {
- status = 0xC0000000 | NT_STATUS_NO_SUCH_USER;
- rid[i] = 0;
- }
- else
- {
- rid[i] = sam_pass->user_rid;
- }
- }
-#endif
-
- num_rids = 1;
- rid[0] = BUILTIN_ALIAS_RID_USERS;
-
- init_samr_r_lookup_ids(&r_u, num_rids, rid, NT_STATUS_OK);
-
- DEBUG(5,("_samr_lookup_ids: %d\n", __LINE__));
-
- return r_u->status;
-}
-#endif
-
/*******************************************************************
_samr_LookupNames
********************************************************************/
DOM_SID pol_sid;
uint32 acc_granted;
struct samr_Ids rids, types;
+ uint32_t num_mapped = 0;
DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
}
if (type[i] != SID_NAME_UNKNOWN) {
- status = NT_STATUS_OK;
+ num_mapped++;
}
}
+ if (num_mapped == num_rids) {
+ status = NT_STATUS_OK;
+ } else if (num_mapped == 0) {
+ status = NT_STATUS_NONE_MAPPED;
+ } else {
+ status = STATUS_SOME_UNMAPPED;
+ }
+
rids.count = num_rids;
rids.ids = rid;
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
- "_samr__LookupRids");
+ SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
+ "_samr_LookupRids");
if (!NT_STATUS_IS_OK(status)) {
return status;
}
return NT_STATUS_INVALID_HANDLE;
nt_status = access_check_samr_function(acc_granted,
- SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+ SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_OpenUser" );
if ( !NT_STATUS_IS_OK(nt_status) )
/* check if access can be granted as requested by client. */
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
se_map_generic(&des_access, &usr_generic_mapping);
se_priv_copy( &se_rights, &se_machine_account );
se_priv_add( &se_rights, &se_add_users );
- nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ nt_status = access_check_samr_object(psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
&acc_granted, "_samr_OpenUser");
return NT_STATUS_OK;
}
+static NTSTATUS get_user_info_5(TALLOC_CTX *mem_ctx,
+ struct samr_UserInfo5 *r,
+ DOM_SID *user_sid,
+ DOM_SID *domain_sid)
+{
+ struct samu *pw = NULL;
+ bool ret;
+ const DOM_SID *sid_user, *sid_group;
+ uint32_t rid, primary_gid;
+ NTTIME last_logon, last_logoff, last_password_change,
+ acct_expiry;
+ const char *account_name, *full_name, *home_directory, *home_drive,
+ *logon_script, *profile_path, *description,
+ *workstations, *comment;
+ struct samr_LogonHours logon_hours;
+
+ ZERO_STRUCTP(r);
+
+ if (!(pw = samu_new(mem_ctx))) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ become_root();
+ ret = pdb_getsampwsid(pw, user_sid);
+ unbecome_root();
+
+ if (ret == False) {
+ DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
+ TALLOC_FREE(pw);
+ return NT_STATUS_NO_SUCH_USER;
+ }
+
+ samr_clear_sam_passwd(pw);
+
+ DEBUG(3,("User:[%s]\n", pdb_get_username(pw)));
+
+ sid_user = pdb_get_user_sid(pw);
+
+ if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
+ DEBUG(0, ("get_user_info_5: User %s has SID %s, \nwhich conflicts with "
+ "the domain sid %s. Failing operation.\n",
+ pdb_get_username(pw), sid_string_dbg(sid_user),
+ sid_string_dbg(domain_sid)));
+ TALLOC_FREE(pw);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ become_root();
+ sid_group = pdb_get_group_sid(pw);
+ unbecome_root();
+
+ if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
+ DEBUG(0, ("get_user_info_5: User %s has Primary Group SID %s, \n"
+ "which conflicts with the domain sid %s. Failing operation.\n",
+ pdb_get_username(pw), sid_string_dbg(sid_group),
+ sid_string_dbg(domain_sid)));
+ TALLOC_FREE(pw);
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ unix_to_nt_time(&last_logon, pdb_get_logon_time(pw));
+ unix_to_nt_time(&last_logoff, pdb_get_logoff_time(pw));
+ unix_to_nt_time(&acct_expiry, pdb_get_kickoff_time(pw));
+ unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(pw));
+
+ account_name = talloc_strdup(mem_ctx, pdb_get_username(pw));
+ full_name = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
+ home_directory = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
+ home_drive = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
+ logon_script = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
+ profile_path = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
+ description = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
+ workstations = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
+ comment = talloc_strdup(mem_ctx, pdb_get_comment(pw));
+
+ logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
+
+ init_samr_user_info5(r,
+ account_name,
+ full_name,
+ rid,
+ primary_gid,
+ home_directory,
+ home_drive,
+ logon_script,
+ profile_path,
+ description,
+ workstations,
+ last_logon,
+ last_logoff,
+ logon_hours,
+ pdb_get_bad_password_count(pw),
+ pdb_get_logon_count(pw),
+ last_password_change,
+ acct_expiry,
+ pdb_get_acct_ctrl(pw));
+
+ TALLOC_FREE(pw);
+
+ return NT_STATUS_OK;
+}
+
/*************************************************************************
get_user_info_7. Safe. Only gives out account_name.
*************************************************************************/
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+ SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_QueryUserInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
switch (r->in.level) {
+ case 5:
+ status = get_user_info_5(p->mem_ctx, &user_info->info5, &info->sid, &domain_sid);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ break;
case 7:
status = get_user_info_7(p->mem_ctx, &user_info->info7, &info->sid);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
+ struct samr_QueryUserInfo2 *r)
+{
+ struct samr_QueryUserInfo u;
+
+ u.in.user_handle = r->in.user_handle;
+ u.in.level = r->in.level;
+ u.out.info = r->out.info;
+
+ return _samr_QueryUserInfo(p, &u);
+}
+
/*******************************************************************
_samr_GetGroupsForUser
********************************************************************/
return NT_STATUS_INVALID_HANDLE;
result = access_check_samr_function(acc_granted,
- SA_RIGHT_USER_GET_GROUPS,
+ SAMR_USER_ACCESS_GET_GROUPS,
"_samr_GetGroupsForUser");
if (!NT_STATUS_IS_OK(result)) {
return result;
}
/*******************************************************************
- samr_QueryDomainInfo_internal
+ _samr_QueryDomainInfo
********************************************************************/
-static NTSTATUS samr_QueryDomainInfo_internal(const char *fn_name,
- pipes_struct *p,
- struct policy_handle *handle,
- uint32_t level,
- union samr_DomainInfo **dom_info_ptr)
+NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
+ struct samr_QueryDomainInfo *r)
{
NTSTATUS status = NT_STATUS_OK;
struct samr_info *info = NULL;
uint32 num_users=0, num_groups=0, num_aliases=0;
- DEBUG(5,("%s: %d\n", fn_name, __LINE__));
+ DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
if (!dom_info) {
return NT_STATUS_NO_MEMORY;
}
- *dom_info_ptr = dom_info;
-
/* find the policy handle. open a policy on it. */
- if (!find_policy_by_hnd(p, handle, (void **)(void *)&info)) {
+ if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
return NT_STATUS_INVALID_HANDLE;
}
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_SAM_OPEN_DOMAIN,
- "_samr_QueryDomainInfo_internal" );
+ SAMR_ACCESS_OPEN_DOMAIN,
+ "_samr_QueryDomainInfo" );
if ( !NT_STATUS_IS_OK(status) )
return status;
- switch (level) {
+ switch (r->in.level) {
case 0x01:
become_root();
return NT_STATUS_INVALID_INFO_CLASS;
}
- DEBUG(5,("%s: %d\n", fn_name, __LINE__));
+ *r->out.info = dom_info;
- return status;
-}
+ DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
-/*******************************************************************
- _samr_QueryDomainInfo
- ********************************************************************/
-
-NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
- struct samr_QueryDomainInfo *r)
-{
- return samr_QueryDomainInfo_internal("_samr_QueryDomainInfo",
- p,
- r->in.domain_handle,
- r->in.level,
- r->out.info);
+ return status;
}
/* W2k3 seems to use the same check for all 3 objects that can be created via
&disp_info))
return NT_STATUS_INVALID_HANDLE;
+ if (disp_info->builtin_domain) {
+ DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
nt_status = access_check_samr_function(acc_granted,
- SA_RIGHT_DOMAIN_CREATE_USER,
+ SAMR_DOMAIN_ACCESS_CREATE_USER,
"_samr_CreateUser2");
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
{
se_priv_copy( &se_rights, &se_machine_account );
can_add_account = user_has_privileges(
- p->pipe_user.nt_user_token, &se_rights );
+ p->server_info->ptok, &se_rights );
}
/* usrmgr.exe (and net rpc trustdom grant) creates a normal user
account for domain trusts and changes the ACB flags later */
{
se_priv_copy( &se_rights, &se_add_users );
can_add_account = user_has_privileges(
- p->pipe_user.nt_user_token, &se_rights );
+ p->server_info->ptok, &se_rights );
}
else /* implicit assumption of a BDC or domain trust account here
* (we already check the flags earlier) */
/* only Domain Admins can add a BDC or domain trust */
se_priv_copy( &se_rights, &se_priv_none );
can_add_account = nt_token_check_domain_rid(
- p->pipe_user.nt_user_token,
+ p->server_info->ptok,
DOMAIN_GROUP_RID_ADMINS );
}
}
DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
- uidtoname(p->pipe_user.ut.uid),
+ uidtoname(p->server_info->utok.uid),
can_add_account ? "True":"False" ));
/********** BEGIN Admin BLOCK **********/
sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
&sid, SAMR_USR_RIGHTS_WRITE_PW);
se_map_generic(&des_access, &usr_generic_mapping);
- nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ nt_status = access_check_samr_object(psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
&acc_granted, "_samr_CreateUser2");
return NT_STATUS_OK;
}
+/****************************************************************
+****************************************************************/
+
+NTSTATUS _samr_CreateUser(pipes_struct *p,
+ struct samr_CreateUser *r)
+{
+ struct samr_CreateUser2 c;
+ uint32_t access_granted;
+
+ c.in.domain_handle = r->in.domain_handle;
+ c.in.account_name = r->in.account_name;
+ c.in.acct_flags = ACB_NORMAL;
+ c.in.access_mask = r->in.access_mask;
+ c.out.user_handle = r->out.user_handle;
+ c.out.access_granted = &access_granted;
+ c.out.rid = r->out.rid;
+
+ return _samr_CreateUser2(p, &c);
+}
+
/*******************************************************************
_samr_Connect
********************************************************************/
if ((info = get_samr_info_by_sid(NULL)) == NULL)
return NT_STATUS_NO_MEMORY;
- /* don't give away the farm but this is probably ok. The SA_RIGHT_SAM_ENUM_DOMAINS
+ /* don't give away the farm but this is probably ok. The SAMR_ACCESS_ENUM_DOMAINS
was observed from a win98 client trying to enumerate users (when configured
user level access control on shares) --jerry */
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
se_map_generic( &des_access, &sam_generic_mapping );
- info->acc_granted = des_access & (SA_RIGHT_SAM_ENUM_DOMAINS|SA_RIGHT_SAM_OPEN_DOMAIN);
+ info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_OPEN_DOMAIN);
/* get a (unique) handle. open a policy on it. */
if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
return NT_STATUS_ACCESS_DENIED;
}
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
se_map_generic(&des_access, &sam_generic_mapping);
- nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ nt_status = access_check_samr_object(psd, p->server_info->ptok,
NULL, 0, des_access, &acc_granted, "_samr_Connect2");
if ( !NT_STATUS_IS_OK(nt_status) )
return NT_STATUS_ACCESS_DENIED;
}
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
se_map_generic(&des_access, &sam_generic_mapping);
- nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ nt_status = access_check_samr_object(psd, p->server_info->ptok,
NULL, 0, des_access, &acc_granted, "_samr_Connect4");
if ( !NT_STATUS_IS_OK(nt_status) )
return NT_STATUS_ACCESS_DENIED;
}
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
se_map_generic(&des_access, &sam_generic_mapping);
- nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ nt_status = access_check_samr_object(psd, p->server_info->ptok,
NULL, 0, des_access, &acc_granted, "_samr_Connect5");
if ( !NT_STATUS_IS_OK(nt_status) )
if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
return NT_STATUS_INVALID_HANDLE;
- /* win9x user manager likes to use SA_RIGHT_SAM_ENUM_DOMAINS here.
+ /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
Reverted that change so we will work with RAS servers again */
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_SAM_OPEN_DOMAIN,
+ SAMR_ACCESS_OPEN_DOMAIN,
"_samr_LookupDomain");
if (!NT_STATUS_IS_OK(status)) {
return status;
}
domain_name = r->in.domain_name->string;
+ if (!domain_name) {
+ return NT_STATUS_INVALID_PARAMETER;
+ }
sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
if (!sid) {
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_SAM_ENUM_DOMAINS,
+ SAMR_ACCESS_ENUM_DOMAINS,
"_samr_EnumDomains");
if (!NT_STATUS_IS_OK(status)) {
return status;
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+ SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_OpenAlias");
if ( !NT_STATUS_IS_OK(status) )
/*check if access can be granted as requested by client. */
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
se_map_generic(&des_access,&ali_generic_mapping);
se_priv_copy( &se_rights, &se_add_users );
- status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ status = access_check_samr_object(psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
&acc_granted, "_samr_OpenAlias");
return NT_STATUS_INVALID_PARAMETER;
}
+ if (id21->fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
+ TALLOC_FREE(pwd);
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
/* we need to separately check for an account rename first */
if (id21->account_name.string &&
return NT_STATUS_INVALID_PARAMETER;
}
+ if (id23->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
+ TALLOC_FREE(pwd);
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+
DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
pdb_get_username(pwd)));
&len,
STR_UNICODE)) {
TALLOC_FREE(pwd);
- return NT_STATUS_INVALID_PARAMETER;
+ return NT_STATUS_WRONG_PASSWORD;
}
if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
return NT_STATUS_INVALID_PARAMETER;
}
+ if (id25->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
+ TALLOC_FREE(pwd);
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
copy_id25_to_sam_passwd(pwd, id25);
/* write the change out */
}
/*******************************************************************
- samr_SetUserInfo_internal
+ samr_SetUserInfo
********************************************************************/
-static NTSTATUS samr_SetUserInfo_internal(const char *fn_name,
- pipes_struct *p,
- struct policy_handle *user_handle,
- uint16_t level,
- union samr_UserInfo *info)
+NTSTATUS _samr_SetUserInfo(pipes_struct *p,
+ struct samr_SetUserInfo *r)
{
NTSTATUS status;
struct samu *pwd = NULL;
DOM_SID sid;
- POLICY_HND *pol = user_handle;
- uint16_t switch_value = level;
+ POLICY_HND *pol = r->in.user_handle;
+ union samr_UserInfo *info = r->in.info;
+ uint16_t switch_value = r->in.level;
uint32_t acc_granted;
uint32_t acc_required;
bool ret;
uint32_t acb_info;
DISP_INFO *disp_info = NULL;
- DEBUG(5,("%s: %d\n", fn_name, __LINE__));
+ DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
/* find the policy handle. open a policy on it. */
if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info)) {
}
/* This is tricky. A WinXP domain join sets
- (SA_RIGHT_USER_SET_PASSWORD|SA_RIGHT_USER_SET_ATTRIBUTES|SA_RIGHT_USER_ACCT_FLAGS_EXPIRY)
+ (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
- standard Win32 API calls just ask for SA_RIGHT_USER_SET_PASSWORD in the SamrOpenUser().
+ standard Win32 API calls just ask for SAMR_USER_ACCESS_SET_PASSWORD in the SamrOpenUser().
This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
we'll use the set from the WinXP join as the basis. */
case 24:
case 25:
case 26:
- acc_required = SA_RIGHT_USER_SET_PASSWORD;
+ acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
break;
default:
- acc_required = SA_RIGHT_USER_SET_PASSWORD |
- SA_RIGHT_USER_SET_ATTRIBUTES |
- SA_RIGHT_USER_ACCT_FLAGS_EXPIRY;
+ acc_required = SAMR_USER_ACCESS_SET_PASSWORD |
+ SAMR_USER_ACCESS_SET_ATTRIBUTES |
+ SAMR_USER_ACCESS_GET_ATTRIBUTES;
break;
}
status = access_check_samr_function(acc_granted,
acc_required,
- fn_name);
+ "_samr_SetUserInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
}
- DEBUG(5, ("%s: sid:%s, level:%d\n",
- fn_name, sid_string_dbg(&sid), switch_value));
+ DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
+ sid_string_dbg(&sid), switch_value));
if (info == NULL) {
- DEBUG(5, ("%s: NULL info level\n", fn_name));
+ DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
return NT_STATUS_INVALID_INFO_CLASS;
}
acb_info = pdb_get_acct_ctrl(pwd);
if (acb_info & ACB_WSTRUST)
- has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
+ has_enough_rights = user_has_privileges(p->server_info->ptok,
&se_machine_account);
else if (acb_info & ACB_NORMAL)
- has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
+ has_enough_rights = user_has_privileges(p->server_info->ptok,
&se_add_users);
else if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
if (lp_enable_privileges()) {
- has_enough_rights = nt_token_check_domain_rid(p->pipe_user.nt_user_token,
+ has_enough_rights = nt_token_check_domain_rid(p->server_info->ptok,
DOMAIN_GROUP_RID_ADMINS);
}
}
- DEBUG(5, ("%s: %s does%s possess sufficient rights\n",
- fn_name,
- uidtoname(p->pipe_user.ut.uid),
+ DEBUG(5, ("_samr_SetUserInfo: %s does%s possess sufficient rights\n",
+ uidtoname(p->server_info->utok.uid),
has_enough_rights ? "" : " not"));
/* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
if (!set_user_info_pw(info->info24.password.data, pwd,
switch_value)) {
- status = NT_STATUS_ACCESS_DENIED;
+ status = NT_STATUS_WRONG_PASSWORD;
}
break;
}
if (!set_user_info_pw(info->info25.password.data, pwd,
switch_value)) {
- status = NT_STATUS_ACCESS_DENIED;
+ status = NT_STATUS_WRONG_PASSWORD;
}
break;
if (!set_user_info_pw(info->info26.password.data, pwd,
switch_value)) {
- status = NT_STATUS_ACCESS_DENIED;
+ status = NT_STATUS_WRONG_PASSWORD;
}
break;
return status;
}
-/*******************************************************************
- _samr_SetUserInfo
- ********************************************************************/
-
-NTSTATUS _samr_SetUserInfo(pipes_struct *p,
- struct samr_SetUserInfo *r)
-{
- return samr_SetUserInfo_internal("_samr_SetUserInfo",
- p,
- r->in.user_handle,
- r->in.level,
- r->in.info);
-}
-
/*******************************************************************
_samr_SetUserInfo2
********************************************************************/
NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
struct samr_SetUserInfo2 *r)
{
- return samr_SetUserInfo_internal("_samr_SetUserInfo2",
- p,
- r->in.user_handle,
- r->in.level,
- r->in.info);
+ struct samr_SetUserInfo q;
+
+ q.in.user_handle = r->in.user_handle;
+ q.in.level = r->in.level;
+ q.in.info = r->in.info;
+
+ return _samr_SetUserInfo(p, &q);
}
/*********************************************************************
return NT_STATUS_INVALID_HANDLE;
ntstatus1 = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_LOOKUP_ALIAS_BY_MEM,
+ SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
"_samr_GetAliasMembership");
ntstatus2 = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+ SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_GetAliasMembership");
if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_ALIAS_GET_MEMBERS,
+ SAMR_ALIAS_ACCESS_GET_MEMBERS,
"_samr_GetMembersInAlias");
if (!NT_STATUS_IS_OK(status)) {
return status;
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_GROUP_GET_MEMBERS,
+ SAMR_GROUP_ACCESS_GET_MEMBERS,
"_samr_QueryGroupMember");
if (!NT_STATUS_IS_OK(status)) {
return status;
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_ALIAS_ADD_MEMBER,
+ SAMR_ALIAS_ACCESS_ADD_MEMBER,
"_samr_AddAliasMember");
if (!NT_STATUS_IS_OK(status)) {
return status;
DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
se_priv_copy( &se_rights, &se_add_users );
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
/******** BEGIN SeAddUsers BLOCK *********/
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_ALIAS_REMOVE_MEMBER,
+ SAMR_ALIAS_ACCESS_REMOVE_MEMBER,
"_samr_DeleteAliasMember");
if (!NT_STATUS_IS_OK(status)) {
return status;
sid_string_dbg(&alias_sid)));
se_priv_copy( &se_rights, &se_add_users );
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
/******** BEGIN SeAddUsers BLOCK *********/
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_GROUP_ADD_MEMBER,
+ SAMR_GROUP_ACCESS_ADD_MEMBER,
"_samr_AddGroupMember");
if (!NT_STATUS_IS_OK(status)) {
return status;
}
se_priv_copy( &se_rights, &se_add_users );
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
/******** BEGIN SeAddUsers BLOCK *********/
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_GROUP_REMOVE_MEMBER,
+ SAMR_GROUP_ACCESS_REMOVE_MEMBER,
"_samr_DeleteGroupMember");
if (!NT_STATUS_IS_OK(status)) {
return status;
}
se_priv_copy( &se_rights, &se_add_users );
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
/******** BEGIN SeAddUsers BLOCK *********/
/* For machine accounts it's the SeMachineAccountPrivilege that counts. */
if ( acb_info & ACB_WSTRUST ) {
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_machine_account );
} else {
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
}
/******** BEGIN SeAddUsers BLOCK *********/
}
se_priv_copy( &se_rights, &se_add_users );
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
/******** BEGIN SeAddUsers BLOCK *********/
DEBUG(10, ("lookup on Local SID\n"));
se_priv_copy( &se_rights, &se_add_users );
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
/******** BEGIN SeAddUsers BLOCK *********/
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_DOMAIN_CREATE_GROUP,
+ SAMR_DOMAIN_ACCESS_CREATE_GROUP,
"_samr_CreateDomainGroup");
if (!NT_STATUS_IS_OK(status)) {
return status;
}
se_priv_copy( &se_rights, &se_add_users );
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
/******** BEGIN SeAddUsers BLOCK *********/
return NT_STATUS_INVALID_HANDLE;
result = access_check_samr_function(acc_granted,
- SA_RIGHT_DOMAIN_CREATE_ALIAS,
+ SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
"_samr_CreateDomAlias");
if (!NT_STATUS_IS_OK(result)) {
return result;
name = r->in.alias_name->string;
se_priv_copy( &se_rights, &se_add_users );
- can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
+ can_add_accounts = user_has_privileges( p->server_info->ptok, &se_rights );
result = can_create(p->mem_ctx, name);
if (!NT_STATUS_IS_OK(result)) {
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_GROUP_LOOKUP_INFO,
+ SAMR_GROUP_ACCESS_LOOKUP_INFO,
"_samr_QueryGroupInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_GROUP_SET_INFO,
+ SAMR_GROUP_ACCESS_SET_INFO,
"_samr_SetGroupInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
case 1:
fstrcpy(map.comment, r->in.info->all.description.string);
break;
+ case 2:
+ /* group rename is not supported yet */
+ return NT_STATUS_NOT_SUPPORTED;
case 4:
fstrcpy(map.comment, r->in.info->description.string);
break;
return NT_STATUS_INVALID_INFO_CLASS;
}
- can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
+ can_mod_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
/******** BEGIN SeAddUsers BLOCK *********/
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_ALIAS_SET_INFO,
+ SAMR_ALIAS_ACCESS_SET_INFO,
"_samr_SetAliasInfo");
if (!NT_STATUS_IS_OK(status)) {
return status;
return NT_STATUS_INVALID_INFO_CLASS;
}
- can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
+ can_mod_accounts = user_has_privileges( p->server_info->ptok, &se_add_users );
/******** BEGIN SeAddUsers BLOCK *********/
return NT_STATUS_INVALID_HANDLE;
status = access_check_samr_function(acc_granted,
- SA_RIGHT_DOMAIN_OPEN_ACCOUNT,
+ SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
"_samr_OpenGroup");
if ( !NT_STATUS_IS_OK(status) )
return status;
/*check if access can be granted as requested by client. */
- map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
+ map_max_allowed_access(p->server_info->ptok, &des_access);
make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
se_map_generic(&des_access,&grp_generic_mapping);
se_priv_copy( &se_rights, &se_add_users );
- status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
+ status = access_check_samr_object(psd, p->server_info->ptok,
&se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
&acc_granted, "_samr_OpenGroup");
NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
struct samr_QueryDomainInfo2 *r)
{
- return samr_QueryDomainInfo_internal("_samr_QueryDomainInfo2",
- p,
- r->in.domain_handle,
- r->in.level,
- r->out.info);
+ struct samr_QueryDomainInfo q;
+
+ q.in.domain_handle = r->in.domain_handle;
+ q.in.level = r->in.level;
+
+ q.out.info = r->out.info;
+
+ return _samr_QueryDomainInfo(p, &q);
}
/*******************************************************************
* levels here, but we're really just looking for
* GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
* this maps to different specific bits. So
- * assume if we have SA_RIGHT_DOMAIN_SET_INFO_1
+ * assume if we have SAMR_DOMAIN_ACCESS_SET_INFO_1
* set we are ok. */
result = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_SET_INFO_1,
+ SAMR_DOMAIN_ACCESS_SET_INFO_1,
"_samr_SetDomainInfo");
if (!NT_STATUS_IS_OK(result))
}
status = access_check_samr_function(info->acc_granted,
- SA_RIGHT_DOMAIN_ENUM_ACCOUNTS,
+ SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
"_samr_GetDisplayEnumerationIndex");
if (!NT_STATUS_IS_OK(status)) {
return status;
/****************************************************************
****************************************************************/
-NTSTATUS _samr_CreateUser(pipes_struct *p,
- struct samr_CreateUser *r)
-{
- p->rng_fault_state = true;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-/****************************************************************
-****************************************************************/
-
NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
struct samr_SetMemberAttributesOfGroup *r)
{
/****************************************************************
****************************************************************/
-NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
- struct samr_QueryUserInfo2 *r)
-{
- p->rng_fault_state = true;
- return NT_STATUS_NOT_IMPLEMENTED;
-}
-
-/****************************************************************
-****************************************************************/
-
NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
struct samr_AddMultipleMembersToAlias *r)
{
git.samba.org / kai / samba.git / blobdiff