source/utils/net_ads.c

   1 /*
   2    Samba Unix/Linux SMB client library
   3    net ads commands
   4    Copyright (C) 2001 Andrew Tridgell (tridge@samba.org)
   5    Copyright (C) 2001 Remus Koos (remuskoos@yahoo.com)
   6    Copyright (C) 2002 Jim McDonough (jmcd@us.ibm.com)
   7    Copyright (C) 2006 Gerald (Jerry) Carter (jerry@samba.org)
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "utils/net.h"
  25
  26 #ifdef HAVE_ADS
  27
  28 /* when we do not have sufficient input parameters to contact a remote domain
  29  * we always fall back to our own realm - Guenther*/
  30
  31 static const char *assume_own_realm(struct net_context *c)
  32 {
  33         if (!c->opt_host && strequal(lp_workgroup(), c->opt_target_workgroup)) {
  34                 return lp_realm();
  35         }
  36
  37         return NULL;
  38 }
  39
  40 /*
  41   do a cldap netlogon query
  42 */
  43 static int net_ads_cldap_netlogon(struct net_context *c, ADS_STRUCT *ads)
  44 {
  45         char addr[INET6_ADDRSTRLEN];
  46         struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
  47
  48         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
  49         if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
  50                 d_fprintf(stderr, "CLDAP query failed!\n");
  51                 return -1;
  52         }
  53
  54         d_printf("Information for Domain Controller: %s\n\n",
  55                 addr);
  56
  57         d_printf("Response Type: ");
  58         switch (reply.command) {
  59         case LOGON_SAM_LOGON_USER_UNKNOWN_EX:
  60                 d_printf("LOGON_SAM_LOGON_USER_UNKNOWN_EX\n");
  61                 break;
  62         case LOGON_SAM_LOGON_RESPONSE_EX:
  63                 d_printf("LOGON_SAM_LOGON_RESPONSE_EX\n");
  64                 break;
  65         default:
  66                 d_printf("0x%x\n", reply.command);
  67                 break;
  68         }
  69
  70         d_printf("GUID: %s\n", smb_uuid_string(talloc_tos(), reply.domain_uuid));
  71
  72         d_printf("Flags:\n"
  73                  "\tIs a PDC:                                   %s\n"
  74                  "\tIs a GC of the forest:                      %s\n"
  75                  "\tIs an LDAP server:                          %s\n"
  76                  "\tSupports DS:                                %s\n"
  77                  "\tIs running a KDC:                           %s\n"
  78                  "\tIs running time services:                   %s\n"
  79                  "\tIs the closest DC:                          %s\n"
  80                  "\tIs writable:                                %s\n"
  81                  "\tHas a hardware clock:                       %s\n"
  82                  "\tIs a non-domain NC serviced by LDAP server: %s\n"
  83                  "\tIs NT6 DC that has some secrets:            %s\n"
  84                  "\tIs NT6 DC that has all secrets:             %s\n",
  85                  (reply.server_type & NBT_SERVER_PDC) ? "yes" : "no",
  86                  (reply.server_type & NBT_SERVER_GC) ? "yes" : "no",
  87                  (reply.server_type & NBT_SERVER_LDAP) ? "yes" : "no",
  88                  (reply.server_type & NBT_SERVER_DS) ? "yes" : "no",
  89                  (reply.server_type & NBT_SERVER_KDC) ? "yes" : "no",
  90                  (reply.server_type & NBT_SERVER_TIMESERV) ? "yes" : "no",
  91                  (reply.server_type & NBT_SERVER_CLOSEST) ? "yes" : "no",
  92                  (reply.server_type & NBT_SERVER_WRITABLE) ? "yes" : "no",
  93                  (reply.server_type & NBT_SERVER_GOOD_TIMESERV) ? "yes" : "no",
  94                  (reply.server_type & NBT_SERVER_NDNC) ? "yes" : "no",
  95                  (reply.server_type & NBT_SERVER_SELECT_SECRET_DOMAIN_6) ? "yes" : "no",
  96                  (reply.server_type & NBT_SERVER_FULL_SECRET_DOMAIN_6) ? "yes" : "no");
  97
  98
  99         printf("Forest:\t\t\t%s\n", reply.forest);
 100         printf("Domain:\t\t\t%s\n", reply.dns_domain);
 101         printf("Domain Controller:\t%s\n", reply.pdc_dns_name);
 102
 103         printf("Pre-Win2k Domain:\t%s\n", reply.domain);
 104         printf("Pre-Win2k Hostname:\t%s\n", reply.pdc_name);
 105
 106         if (*reply.user_name) printf("User name:\t%s\n", reply.user_name);
 107
 108         printf("Server Site Name :\t\t%s\n", reply.server_site);
 109         printf("Client Site Name :\t\t%s\n", reply.client_site);
 110
 111         d_printf("NT Version: %d\n", reply.nt_version);
 112         d_printf("LMNT Token: %.2x\n", reply.lmnt_token);
 113         d_printf("LM20 Token: %.2x\n", reply.lm20_token);
 114
 115         return 0;
 116 }
 117
 118 /*
 119   this implements the CLDAP based netlogon lookup requests
 120   for finding the domain controller of a ADS domain
 121 */
 122 static int net_ads_lookup(struct net_context *c, int argc, const char **argv)
 123 {
 124         ADS_STRUCT *ads;
 125
 126         if (c->display_usage) {
 127                 d_printf("Usage:\n"
 128                          "net ads lookup\n"
 129                          "    Find the ADS DC using CLDAP lookup.\n");
 130                 return 0;
 131         }
 132
 133         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
 134                 d_fprintf(stderr, "Didn't find the cldap server!\n");
 135                 return -1;
 136         }
 137
 138         if (!ads->config.realm) {
 139                 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
 140                 ads->ldap.port = 389;
 141         }
 142
 143         return net_ads_cldap_netlogon(c, ads);
 144 }
 145
 146
 147
 148 static int net_ads_info(struct net_context *c, int argc, const char **argv)
 149 {
 150         ADS_STRUCT *ads;
 151         char addr[INET6_ADDRSTRLEN];
 152
 153         if (c->display_usage) {
 154                 d_printf("Usage:\n"
 155                          "net ads info\n"
 156                          "    Display information about an Active Directory "
 157                          "server.\n");
 158                 return 0;
 159         }
 160
 161         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
 162                 d_fprintf(stderr, "Didn't find the ldap server!\n");
 163                 return -1;
 164         }
 165
 166         if (!ads || !ads->config.realm) {
 167                 d_fprintf(stderr, "Didn't find the ldap server!\n");
 168                 return -1;
 169         }
 170
 171         /* Try to set the server's current time since we didn't do a full
 172            TCP LDAP session initially */
 173
 174         if ( !ADS_ERR_OK(ads_current_time( ads )) ) {
 175                 d_fprintf( stderr, "Failed to get server's current time!\n");
 176         }
 177
 178         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
 179
 180         d_printf("LDAP server: %s\n", addr);
 181         d_printf("LDAP server name: %s\n", ads->config.ldap_server_name);
 182         d_printf("Realm: %s\n", ads->config.realm);
 183         d_printf("Bind Path: %s\n", ads->config.bind_path);
 184         d_printf("LDAP port: %d\n", ads->ldap.port);
 185         d_printf("Server time: %s\n", http_timestring(ads->config.current_time));
 186
 187         d_printf("KDC server: %s\n", ads->auth.kdc_server );
 188         d_printf("Server time offset: %d\n", ads->auth.time_offset );
 189
 190         return 0;
 191 }
 192
 193 static void use_in_memory_ccache(void) {
 194         /* Use in-memory credentials cache so we do not interfere with
 195          * existing credentials */
 196         setenv(KRB5_ENV_CCNAME, "MEMORY:net_ads", 1);
 197 }
 198
 199 static ADS_STATUS ads_startup_int(struct net_context *c, bool only_own_domain,
 200                                   uint32 auth_flags, ADS_STRUCT **ads_ret)
 201 {
 202         ADS_STRUCT *ads = NULL;
 203         ADS_STATUS status;
 204         bool need_password = false;
 205         bool second_time = false;
 206         char *cp;
 207         const char *realm = NULL;
 208         bool tried_closest_dc = false;
 209
 210         /* lp_realm() should be handled by a command line param,
 211            However, the join requires that realm be set in smb.conf
 212            and compares our realm with the remote server's so this is
 213            ok until someone needs more flexibility */
 214
 215         *ads_ret = NULL;
 216
 217 retry_connect:
 218         if (only_own_domain) {
 219                 realm = lp_realm();
 220         } else {
 221                 realm = assume_own_realm(c);
 222         }
 223
 224         ads = ads_init(realm, c->opt_target_workgroup, c->opt_host);
 225
 226         if (!c->opt_user_name) {
 227                 c->opt_user_name = "administrator";
 228         }
 229
 230         if (c->opt_user_specified) {
 231                 need_password = true;
 232         }
 233
 234 retry:
 235         if (!c->opt_password && need_password && !c->opt_machine_pass) {
 236                 c->opt_password = net_prompt_pass(c, c->opt_user_name);
 237                 if (!c->opt_password) {
 238                         ads_destroy(&ads);
 239                         return ADS_ERROR(LDAP_NO_MEMORY);
 240                 }
 241         }
 242
 243         if (c->opt_password) {
 244                 use_in_memory_ccache();
 245                 SAFE_FREE(ads->auth.password);
 246                 ads->auth.password = smb_xstrdup(c->opt_password);
 247         }
 248
 249         ads->auth.flags |= auth_flags;
 250         SAFE_FREE(ads->auth.user_name);
 251         ads->auth.user_name = smb_xstrdup(c->opt_user_name);
 252
 253        /*
 254         * If the username is of the form "name@realm",
 255         * extract the realm and convert to upper case.
 256         * This is only used to establish the connection.
 257         */
 258        if ((cp = strchr_m(ads->auth.user_name, '@'))!=0) {
 259                 *cp++ = '\0';
 260                 SAFE_FREE(ads->auth.realm);
 261                 ads->auth.realm = smb_xstrdup(cp);
 262                 strupper_m(ads->auth.realm);
 263        }
 264
 265         status = ads_connect(ads);
 266
 267         if (!ADS_ERR_OK(status)) {
 268
 269                 if (NT_STATUS_EQUAL(ads_ntstatus(status),
 270                                     NT_STATUS_NO_LOGON_SERVERS)) {
 271                         DEBUG(0,("ads_connect: %s\n", ads_errstr(status)));
 272                         ads_destroy(&ads);
 273                         return status;
 274                 }
 275
 276                 if (!need_password && !second_time && !(auth_flags & ADS_AUTH_NO_BIND)) {
 277                         need_password = true;
 278                         second_time = true;
 279                         goto retry;
 280                 } else {
 281                         ads_destroy(&ads);
 282                         return status;
 283                 }
 284         }
 285
 286         /* when contacting our own domain, make sure we use the closest DC.
 287          * This is done by reconnecting to ADS because only the first call to
 288          * ads_connect will give us our own sitename */
 289
 290         if ((only_own_domain || !c->opt_host) && !tried_closest_dc) {
 291
 292                 tried_closest_dc = true; /* avoid loop */
 293
 294                 if (!ads_closest_dc(ads)) {
 295
 296                         namecache_delete(ads->server.realm, 0x1C);
 297                         namecache_delete(ads->server.workgroup, 0x1C);
 298
 299                         ads_destroy(&ads);
 300                         ads = NULL;
 301
 302                         goto retry_connect;
 303                 }
 304         }
 305
 306         *ads_ret = ads;
 307         return status;
 308 }
 309
 310 ADS_STATUS ads_startup(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
 311 {
 312         return ads_startup_int(c, only_own_domain, 0, ads);
 313 }
 314
 315 ADS_STATUS ads_startup_nobind(struct net_context *c, bool only_own_domain, ADS_STRUCT **ads)
 316 {
 317         return ads_startup_int(c, only_own_domain, ADS_AUTH_NO_BIND, ads);
 318 }
 319
 320 /*
 321   Check to see if connection can be made via ads.
 322   ads_startup() stores the password in opt_password if it needs to so
 323   that rpc or rap can use it without re-prompting.
 324 */
 325 static int net_ads_check_int(const char *realm, const char *workgroup, const char *host)
 326 {
 327         ADS_STRUCT *ads;
 328         ADS_STATUS status;
 329
 330         if ( (ads = ads_init( realm, workgroup, host )) == NULL ) {
 331                 return -1;
 332         }
 333
 334         ads->auth.flags |= ADS_AUTH_NO_BIND;
 335
 336         status = ads_connect(ads);
 337         if ( !ADS_ERR_OK(status) ) {
 338                 return -1;
 339         }
 340
 341         ads_destroy(&ads);
 342         return 0;
 343 }
 344
 345 int net_ads_check_our_domain(struct net_context *c)
 346 {
 347         return net_ads_check_int(lp_realm(), lp_workgroup(), NULL);
 348 }
 349
 350 int net_ads_check(struct net_context *c)
 351 {
 352         return net_ads_check_int(NULL, c->opt_workgroup, c->opt_host);
 353 }
 354
 355 /*
 356    determine the netbios workgroup name for a domain
 357  */
 358 static int net_ads_workgroup(struct net_context *c, int argc, const char **argv)
 359 {
 360         ADS_STRUCT *ads;
 361         char addr[INET6_ADDRSTRLEN];
 362         struct NETLOGON_SAM_LOGON_RESPONSE_EX reply;
 363
 364         if (c->display_usage) {
 365                 d_printf("Usage:\n"
 366                          "net ads workgroup\n"
 367                          "    Print the workgroup name\n");
 368                 return 0;
 369         }
 370
 371         if (!ADS_ERR_OK(ads_startup_nobind(c, false, &ads))) {
 372                 d_fprintf(stderr, "Didn't find the cldap server!\n");
 373                 return -1;
 374         }
 375
 376         if (!ads->config.realm) {
 377                 ads->config.realm = CONST_DISCARD(char *, c->opt_target_workgroup);
 378                 ads->ldap.port = 389;
 379         }
 380
 381         print_sockaddr(addr, sizeof(addr), &ads->ldap.ss);
 382         if ( !ads_cldap_netlogon_5(talloc_tos(), addr, ads->server.realm, &reply ) ) {
 383                 d_fprintf(stderr, "CLDAP query failed!\n");
 384                 return -1;
 385         }
 386
 387         d_printf("Workgroup: %s\n", reply.domain);
 388
 389         ads_destroy(&ads);
 390
 391         return 0;
 392 }
 393
 394
 395
 396 static bool usergrp_display(ADS_STRUCT *ads, char *field, void **values, void *data_area)
 397 {
 398         char **disp_fields = (char **) data_area;
 399
 400         if (!field) { /* must be end of record */
 401                 if (disp_fields[0]) {
 402                         if (!strchr_m(disp_fields[0], '$')) {
 403                                 if (disp_fields[1])
 404                                         d_printf("%-21.21s %s\n",
 405                                                disp_fields[0], disp_fields[1]);
 406                                 else
 407                                         d_printf("%s\n", disp_fields[0]);
 408                         }
 409                 }
 410                 SAFE_FREE(disp_fields[0]);
 411                 SAFE_FREE(disp_fields[1]);
 412                 return true;
 413         }
 414         if (!values) /* must be new field, indicate string field */
 415                 return true;
 416         if (StrCaseCmp(field, "sAMAccountName") == 0) {
 417                 disp_fields[0] = SMB_STRDUP((char *) values[0]);
 418         }
 419         if (StrCaseCmp(field, "description") == 0)
 420                 disp_fields[1] = SMB_STRDUP((char *) values[0]);
 421         return true;
 422 }
 423
 424 static int net_ads_user_usage(struct net_context *c, int argc, const char **argv)
 425 {
 426         return net_user_usage(c, argc, argv);
 427 }
 428
 429 static int ads_user_add(struct net_context *c, int argc, const char **argv)
 430 {
 431         ADS_STRUCT *ads;
 432         ADS_STATUS status;
 433         char *upn, *userdn;
 434         LDAPMessage *res=NULL;
 435         int rc = -1;
 436         char *ou_str = NULL;
 437
 438         if (argc < 1 || c->display_usage)
 439                 return net_ads_user_usage(c, argc, argv);
 440
 441         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 442                 return -1;
 443         }
 444
 445         status = ads_find_user_acct(ads, &res, argv[0]);
 446
 447         if (!ADS_ERR_OK(status)) {
 448                 d_fprintf(stderr, "ads_user_add: %s\n", ads_errstr(status));
 449                 goto done;
 450         }
 451
 452         if (ads_count_replies(ads, res)) {
 453                 d_fprintf(stderr, "ads_user_add: User %s already exists\n", argv[0]);
 454                 goto done;
 455         }
 456
 457         if (c->opt_container) {
 458                 ou_str = SMB_STRDUP(c->opt_container);
 459         } else {
 460                 ou_str = ads_default_ou_string(ads, WELL_KNOWN_GUID_USERS);
 461         }
 462
 463         status = ads_add_user_acct(ads, argv[0], ou_str, c->opt_comment);
 464
 465         if (!ADS_ERR_OK(status)) {
 466                 d_fprintf(stderr, "Could not add user %s: %s\n", argv[0],
 467                          ads_errstr(status));
 468                 goto done;
 469         }
 470
 471         /* if no password is to be set, we're done */
 472         if (argc == 1) {
 473                 d_printf("User %s added\n", argv[0]);
 474                 rc = 0;
 475                 goto done;
 476         }
 477
 478         /* try setting the password */
 479         if (asprintf(&upn, "%s@%s", argv[0], ads->config.realm) == -1) {
 480                 goto done;
 481         }
 482         status = ads_krb5_set_password(ads->auth.kdc_server, upn, argv[1],
 483                                        ads->auth.time_offset);
 484         safe_free(upn);
 485         if (ADS_ERR_OK(status)) {
 486                 d_printf("User %s added\n", argv[0]);
 487                 rc = 0;
 488                 goto done;
 489         }
 490
 491         /* password didn't set, delete account */
 492         d_fprintf(stderr, "Could not add user %s.  Error setting password %s\n",
 493                  argv[0], ads_errstr(status));
 494         ads_msgfree(ads, res);
 495         status=ads_find_user_acct(ads, &res, argv[0]);
 496         if (ADS_ERR_OK(status)) {
 497                 userdn = ads_get_dn(ads, res);
 498                 ads_del_dn(ads, userdn);
 499                 ads_memfree(ads, userdn);
 500         }
 501
 502  done:
 503         if (res)
 504                 ads_msgfree(ads, res);
 505         ads_destroy(&ads);
 506         SAFE_FREE(ou_str);
 507         return rc;
 508 }
 509
 510 static int ads_user_info(struct net_context *c, int argc, const char **argv)
 511 {
 512         ADS_STRUCT *ads;
 513         ADS_STATUS rc;
 514         LDAPMessage *res;
 515         const char *attrs[] = {"memberOf", NULL};
 516         char *searchstring=NULL;
 517         char **grouplist;
 518         char *escaped_user;
 519
 520         if (argc < 1 || c->display_usage) {
 521                 return net_ads_user_usage(c, argc, argv);
 522         }
 523
 524         escaped_user = escape_ldap_string_alloc(argv[0]);
 525
 526         if (!escaped_user) {
 527                 d_fprintf(stderr, "ads_user_info: failed to escape user %s\n", argv[0]);
 528                 return -1;
 529         }
 530
 531         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 532                 SAFE_FREE(escaped_user);
 533                 return -1;
 534         }
 535
 536         if (asprintf(&searchstring, "(sAMAccountName=%s)", escaped_user) == -1) {
 537                 SAFE_FREE(escaped_user);
 538                 return -1;
 539         }
 540         rc = ads_search(ads, &res, searchstring, attrs);
 541         safe_free(searchstring);
 542
 543         if (!ADS_ERR_OK(rc)) {
 544                 d_fprintf(stderr, "ads_search: %s\n", ads_errstr(rc));
 545                 ads_destroy(&ads);
 546                 SAFE_FREE(escaped_user);
 547                 return -1;
 548         }
 549
 550         grouplist = ldap_get_values((LDAP *)ads->ldap.ld,
 551                                     (LDAPMessage *)res, "memberOf");
 552
 553         if (grouplist) {
 554                 int i;
 555                 char **groupname;
 556                 for (i=0;grouplist[i];i++) {
 557                         groupname = ldap_explode_dn(grouplist[i], 1);
 558                         d_printf("%s\n", groupname[0]);
 559                         ldap_value_free(groupname);
 560                 }
 561                 ldap_value_free(grouplist);
 562         }
 563
 564         ads_msgfree(ads, res);
 565         ads_destroy(&ads);
 566         SAFE_FREE(escaped_user);
 567         return 0;
 568 }
 569
 570 static int ads_user_delete(struct net_context *c, int argc, const char **argv)
 571 {
 572         ADS_STRUCT *ads;
 573         ADS_STATUS rc;
 574         LDAPMessage *res = NULL;
 575         char *userdn;
 576
 577         if (argc < 1) {
 578                 return net_ads_user_usage(c, argc, argv);
 579         }
 580
 581         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 582                 return -1;
 583         }
 584
 585         rc = ads_find_user_acct(ads, &res, argv[0]);
 586         if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
 587                 d_printf("User %s does not exist.\n", argv[0]);
 588                 ads_msgfree(ads, res);
 589                 ads_destroy(&ads);
 590                 return -1;
 591         }
 592         userdn = ads_get_dn(ads, res);
 593         ads_msgfree(ads, res);
 594         rc = ads_del_dn(ads, userdn);
 595         ads_memfree(ads, userdn);
 596         if (ADS_ERR_OK(rc)) {
 597                 d_printf("User %s deleted\n", argv[0]);
 598                 ads_destroy(&ads);
 599                 return 0;
 600         }
 601         d_fprintf(stderr, "Error deleting user %s: %s\n", argv[0],
 602                  ads_errstr(rc));
 603         ads_destroy(&ads);
 604         return -1;
 605 }
 606
 607 int net_ads_user(struct net_context *c, int argc, const char **argv)
 608 {
 609         struct functable func[] = {
 610                 {
 611                         "add",
 612                         ads_user_add,
 613                         NET_TRANSPORT_ADS,
 614                         "Add an AD user",
 615                         "net ads user add\n"
 616                         "    Add an AD user"
 617                 },
 618                 {
 619                         "info",
 620                         ads_user_info,
 621                         NET_TRANSPORT_ADS,
 622                         "Display information about an AD user",
 623                         "net ads user info\n"
 624                         "    Display information about an AD user"
 625                 },
 626                 {
 627                         "delete",
 628                         ads_user_delete,
 629                         NET_TRANSPORT_ADS,
 630                         "Delete an AD user",
 631                         "net ads user delete\n"
 632                         "    Delete an AD user"
 633                 },
 634                 {NULL, NULL, 0, NULL, NULL}
 635         };
 636         ADS_STRUCT *ads;
 637         ADS_STATUS rc;
 638         const char *shortattrs[] = {"sAMAccountName", NULL};
 639         const char *longattrs[] = {"sAMAccountName", "description", NULL};
 640         char *disp_fields[2] = {NULL, NULL};
 641
 642         if (argc == 0) {
 643                 if (c->display_usage) {
 644                         d_printf("Usage:\n");
 645                         d_printf("net ads user\n"
 646                                  "    List AD users\n");
 647                         net_display_usage_from_functable(func);
 648                         return 0;
 649                 }
 650
 651                 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 652                         return -1;
 653                 }
 654
 655                 if (c->opt_long_list_entries)
 656                         d_printf("\nUser name             Comment"
 657                                  "\n-----------------------------\n");
 658
 659                 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
 660                                           LDAP_SCOPE_SUBTREE,
 661                                           "(objectCategory=user)",
 662                                           c->opt_long_list_entries ? longattrs :
 663                                           shortattrs, usergrp_display,
 664                                           disp_fields);
 665                 ads_destroy(&ads);
 666                 return ADS_ERR_OK(rc) ? 0 : -1;
 667         }
 668
 669         return net_run_function(c, argc, argv, "net ads user", func);
 670 }
 671
 672 static int net_ads_group_usage(struct net_context *c, int argc, const char **argv)
 673 {
 674         return net_group_usage(c, argc, argv);
 675 }
 676
 677 static int ads_group_add(struct net_context *c, int argc, const char **argv)
 678 {
 679         ADS_STRUCT *ads;
 680         ADS_STATUS status;
 681         LDAPMessage *res=NULL;
 682         int rc = -1;
 683         char *ou_str = NULL;
 684
 685         if (argc < 1 || c->display_usage) {
 686                 return net_ads_group_usage(c, argc, argv);
 687         }
 688
 689         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 690                 return -1;
 691         }
 692
 693         status = ads_find_user_acct(ads, &res, argv[0]);
 694
 695         if (!ADS_ERR_OK(status)) {
 696                 d_fprintf(stderr, "ads_group_add: %s\n", ads_errstr(status));
 697                 goto done;
 698         }
 699
 700         if (ads_count_replies(ads, res)) {
 701                 d_fprintf(stderr, "ads_group_add: Group %s already exists\n", argv[0]);
 702                 goto done;
 703         }
 704
 705         if (c->opt_container) {
 706                 ou_str = SMB_STRDUP(c->opt_container);
 707         } else {
 708                 ou_str = ads_default_ou_string(ads, WELL_KNOWN_GUID_USERS);
 709         }
 710
 711         status = ads_add_group_acct(ads, argv[0], ou_str, c->opt_comment);
 712
 713         if (ADS_ERR_OK(status)) {
 714                 d_printf("Group %s added\n", argv[0]);
 715                 rc = 0;
 716         } else {
 717                 d_fprintf(stderr, "Could not add group %s: %s\n", argv[0],
 718                          ads_errstr(status));
 719         }
 720
 721  done:
 722         if (res)
 723                 ads_msgfree(ads, res);
 724         ads_destroy(&ads);
 725         SAFE_FREE(ou_str);
 726         return rc;
 727 }
 728
 729 static int ads_group_delete(struct net_context *c, int argc, const char **argv)
 730 {
 731         ADS_STRUCT *ads;
 732         ADS_STATUS rc;
 733         LDAPMessage *res = NULL;
 734         char *groupdn;
 735
 736         if (argc < 1 || c->display_usage) {
 737                 return net_ads_group_usage(c, argc, argv);
 738         }
 739
 740         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 741                 return -1;
 742         }
 743
 744         rc = ads_find_user_acct(ads, &res, argv[0]);
 745         if (!ADS_ERR_OK(rc) || ads_count_replies(ads, res) != 1) {
 746                 d_printf("Group %s does not exist.\n", argv[0]);
 747                 ads_msgfree(ads, res);
 748                 ads_destroy(&ads);
 749                 return -1;
 750         }
 751         groupdn = ads_get_dn(ads, res);
 752         ads_msgfree(ads, res);
 753         rc = ads_del_dn(ads, groupdn);
 754         ads_memfree(ads, groupdn);
 755         if (ADS_ERR_OK(rc)) {
 756                 d_printf("Group %s deleted\n", argv[0]);
 757                 ads_destroy(&ads);
 758                 return 0;
 759         }
 760         d_fprintf(stderr, "Error deleting group %s: %s\n", argv[0],
 761                  ads_errstr(rc));
 762         ads_destroy(&ads);
 763         return -1;
 764 }
 765
 766 int net_ads_group(struct net_context *c, int argc, const char **argv)
 767 {
 768         struct functable func[] = {
 769                 {
 770                         "add",
 771                         ads_group_add,
 772                         NET_TRANSPORT_ADS,
 773                         "Add an AD group",
 774                         "net ads group add\n"
 775                         "    Add an AD group"
 776                 },
 777                 {
 778                         "delete",
 779                         ads_group_delete,
 780                         NET_TRANSPORT_ADS,
 781                         "Delete an AD group",
 782                         "net ads group delete\n"
 783                         "    Delete an AD group"
 784                 },
 785                 {NULL, NULL, 0, NULL, NULL}
 786         };
 787         ADS_STRUCT *ads;
 788         ADS_STATUS rc;
 789         const char *shortattrs[] = {"sAMAccountName", NULL};
 790         const char *longattrs[] = {"sAMAccountName", "description", NULL};
 791         char *disp_fields[2] = {NULL, NULL};
 792
 793         if (argc == 0) {
 794                 if (c->display_usage) {
 795                         d_printf("Usage:\n");
 796                         d_printf("net ads group\n"
 797                                  "    List AD groups\n");
 798                         net_display_usage_from_functable(func);
 799                         return 0;
 800                 }
 801
 802                 if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
 803                         return -1;
 804                 }
 805
 806                 if (c->opt_long_list_entries)
 807                         d_printf("\nGroup name            Comment"
 808                                  "\n-----------------------------\n");
 809                 rc = ads_do_search_all_fn(ads, ads->config.bind_path,
 810                                           LDAP_SCOPE_SUBTREE,
 811                                           "(objectCategory=group)",
 812                                           c->opt_long_list_entries ? longattrs :
 813                                           shortattrs, usergrp_display,
 814                                           disp_fields);
 815
 816                 ads_destroy(&ads);
 817                 return ADS_ERR_OK(rc) ? 0 : -1;
 818         }
 819         return net_run_function(c, argc, argv, "net ads group", func);
 820 }
 821
 822 static int net_ads_status(struct net_context *c, int argc, const char **argv)
 823 {
 824         ADS_STRUCT *ads;
 825         ADS_STATUS rc;
 826         LDAPMessage *res;
 827
 828         if (c->display_usage) {
 829                 d_printf("Usage:\n"
 830                          "net ads status\n"
 831                          "    Display machine account details\n");
 832                 return 0;
 833         }
 834
 835         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
 836                 return -1;
 837         }
 838
 839         rc = ads_find_machine_acct(ads, &res, global_myname());
 840         if (!ADS_ERR_OK(rc)) {
 841                 d_fprintf(stderr, "ads_find_machine_acct: %s\n", ads_errstr(rc));
 842                 ads_destroy(&ads);
 843                 return -1;
 844         }
 845
 846         if (ads_count_replies(ads, res) == 0) {
 847                 d_fprintf(stderr, "No machine account for '%s' found\n", global_myname());
 848                 ads_destroy(&ads);
 849                 return -1;
 850         }
 851
 852         ads_dump(ads, res);
 853         ads_destroy(&ads);
 854         return 0;
 855 }
 856
 857 /*******************************************************************
 858  Leave an AD domain.  Windows XP disables the machine account.
 859  We'll try the same.  The old code would do an LDAP delete.
 860  That only worked using the machine creds because added the machine
 861  with full control to the computer object's ACL.
 862 *******************************************************************/
 863
 864 static int net_ads_leave(struct net_context *c, int argc, const char **argv)
 865 {
 866         TALLOC_CTX *ctx;
 867         struct libnet_UnjoinCtx *r = NULL;
 868         WERROR werr;
 869
 870         if (c->display_usage) {
 871                 d_printf("Usage:\n"
 872                          "net ads leave\n"
 873                          "    Leave an AD domain\n");
 874                 return 0;
 875         }
 876
 877         if (!*lp_realm()) {
 878                 d_fprintf(stderr, "No realm set, are we joined ?\n");
 879                 return -1;
 880         }
 881
 882         if (!(ctx = talloc_init("net_ads_leave"))) {
 883                 d_fprintf(stderr, "Could not initialise talloc context.\n");
 884                 return -1;
 885         }
 886
 887         if (!c->opt_kerberos) {
 888                 use_in_memory_ccache();
 889         }
 890
 891         werr = libnet_init_UnjoinCtx(ctx, &r);
 892         if (!W_ERROR_IS_OK(werr)) {
 893                 d_fprintf(stderr, "Could not initialise unjoin context.\n");
 894                 return -1;
 895         }
 896
 897         r->in.debug             = true;
 898         r->in.use_kerberos      = c->opt_kerberos;
 899         r->in.dc_name           = c->opt_host;
 900         r->in.domain_name       = lp_realm();
 901         r->in.admin_account     = c->opt_user_name;
 902         r->in.admin_password    = net_prompt_pass(c, c->opt_user_name);
 903         r->in.modify_config     = lp_config_backend_is_registry();
 904         r->in.unjoin_flags      = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
 905                                   WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
 906
 907         werr = libnet_Unjoin(ctx, r);
 908         if (!W_ERROR_IS_OK(werr)) {
 909                 d_printf("Failed to leave domain: %s\n",
 910                          r->out.error_string ? r->out.error_string :
 911                          get_friendly_werror_msg(werr));
 912                 goto done;
 913         }
 914
 915         if (W_ERROR_IS_OK(werr)) {
 916                 d_printf("Deleted account for '%s' in realm '%s'\n",
 917                         r->in.machine_name, r->out.dns_domain_name);
 918                 goto done;
 919         }
 920
 921         /* We couldn't delete it - see if the disable succeeded. */
 922         if (r->out.disabled_machine_account) {
 923                 d_printf("Disabled account for '%s' in realm '%s'\n",
 924                         r->in.machine_name, r->out.dns_domain_name);
 925                 werr = WERR_OK;
 926                 goto done;
 927         }
 928
 929         d_fprintf(stderr, "Failed to disable machine account for '%s' in realm '%s'\n",
 930                   r->in.machine_name, r->out.dns_domain_name);
 931
 932  done:
 933         TALLOC_FREE(r);
 934         TALLOC_FREE(ctx);
 935
 936         if (W_ERROR_IS_OK(werr)) {
 937                 return 0;
 938         }
 939
 940         return -1;
 941 }
 942
 943 static NTSTATUS net_ads_join_ok(struct net_context *c)
 944 {
 945         ADS_STRUCT *ads = NULL;
 946         ADS_STATUS status;
 947
 948         if (!secrets_init()) {
 949                 DEBUG(1,("Failed to initialise secrets database\n"));
 950                 return NT_STATUS_ACCESS_DENIED;
 951         }
 952
 953         net_use_krb_machine_account(c);
 954
 955         status = ads_startup(c, true, &ads);
 956         if (!ADS_ERR_OK(status)) {
 957                 return ads_ntstatus(status);
 958         }
 959
 960         ads_destroy(&ads);
 961         return NT_STATUS_OK;
 962 }
 963
 964 /*
 965   check that an existing join is OK
 966  */
 967 int net_ads_testjoin(struct net_context *c, int argc, const char **argv)
 968 {
 969         NTSTATUS status;
 970         use_in_memory_ccache();
 971
 972         if (c->display_usage) {
 973                 d_printf("Usage:\n"
 974                          "net ads testjoin\n"
 975                          "    Test if the existing join is ok\n");
 976                 return 0;
 977         }
 978
 979         /* Display success or failure */
 980         status = net_ads_join_ok(c);
 981         if (!NT_STATUS_IS_OK(status)) {
 982                 fprintf(stderr,"Join to domain is not valid: %s\n",
 983                         get_friendly_nt_error_msg(status));
 984                 return -1;
 985         }
 986
 987         printf("Join is OK\n");
 988         return 0;
 989 }
 990
 991 /*******************************************************************
 992   Simple configu checks before beginning the join
 993  ********************************************************************/
 994
 995 static WERROR check_ads_config( void )
 996 {
 997         if (lp_server_role() != ROLE_DOMAIN_MEMBER ) {
 998                 d_printf("Host is not configured as a member server.\n");
 999                 return WERR_INVALID_DOMAIN_ROLE;
1000         }
1001
1002         if (strlen(global_myname()) > 15) {
1003                 d_printf("Our netbios name can be at most 15 chars long, "
1004                          "\"%s\" is %u chars long\n", global_myname(),
1005                          (unsigned int)strlen(global_myname()));
1006                 return WERR_INVALID_COMPUTER_NAME;
1007         }
1008
1009         if ( lp_security() == SEC_ADS && !*lp_realm()) {
1010                 d_fprintf(stderr, "realm must be set in in %s for ADS "
1011                         "join to succeed.\n", get_dyn_CONFIGFILE());
1012                 return WERR_INVALID_PARAM;
1013         }
1014
1015         return WERR_OK;
1016 }
1017
1018 /*******************************************************************
1019  Send a DNS update request
1020 *******************************************************************/
1021
1022 #if defined(WITH_DNS_UPDATES)
1023 #include "dns.h"
1024 DNS_ERROR DoDNSUpdate(char *pszServerName,
1025                       const char *pszDomainName, const char *pszHostName,
1026                       const struct sockaddr_storage *sslist,
1027                       size_t num_addrs );
1028
1029 static NTSTATUS net_update_dns_internal(TALLOC_CTX *ctx, ADS_STRUCT *ads,
1030                                         const char *machine_name,
1031                                         const struct sockaddr_storage *addrs,
1032                                         int num_addrs)
1033 {
1034         struct dns_rr_ns *nameservers = NULL;
1035         int ns_count = 0;
1036         NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
1037         DNS_ERROR dns_err;
1038         fstring dns_server;
1039         const char *dnsdomain = NULL;
1040         char *root_domain = NULL;
1041
1042         if ( (dnsdomain = strchr_m( machine_name, '.')) == NULL ) {
1043                 d_printf("No DNS domain configured for %s. "
1044                          "Unable to perform DNS Update.\n", machine_name);
1045                 status = NT_STATUS_INVALID_PARAMETER;
1046                 goto done;
1047         }
1048         dnsdomain++;
1049
1050         status = ads_dns_lookup_ns( ctx, dnsdomain, &nameservers, &ns_count );
1051         if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1052                 /* Child domains often do not have NS records.  Look
1053                    for the NS record for the forest root domain
1054                    (rootDomainNamingContext in therootDSE) */
1055
1056                 const char *rootname_attrs[] =  { "rootDomainNamingContext", NULL };
1057                 LDAPMessage *msg = NULL;
1058                 char *root_dn;
1059                 ADS_STATUS ads_status;
1060
1061                 if ( !ads->ldap.ld ) {
1062                         ads_status = ads_connect( ads );
1063                         if ( !ADS_ERR_OK(ads_status) ) {
1064                                 DEBUG(0,("net_update_dns_internal: Failed to connect to our DC!\n"));
1065                                 goto done;
1066                         }
1067                 }
1068
1069                 ads_status = ads_do_search(ads, "", LDAP_SCOPE_BASE,
1070                                        "(objectclass=*)", rootname_attrs, &msg);
1071                 if (!ADS_ERR_OK(ads_status)) {
1072                         goto done;
1073                 }
1074
1075                 root_dn = ads_pull_string(ads, ctx, msg,  "rootDomainNamingContext");
1076                 if ( !root_dn ) {
1077                         ads_msgfree( ads, msg );
1078                         goto done;
1079                 }
1080
1081                 root_domain = ads_build_domain( root_dn );
1082
1083                 /* cleanup */
1084                 ads_msgfree( ads, msg );
1085
1086                 /* try again for NS servers */
1087
1088                 status = ads_dns_lookup_ns( ctx, root_domain, &nameservers, &ns_count );
1089
1090                 if ( !NT_STATUS_IS_OK(status) || (ns_count == 0)) {
1091                         DEBUG(3,("net_ads_join: Failed to find name server for the %s "
1092                          "realm\n", ads->config.realm));
1093                         goto done;
1094                 }
1095
1096                 dnsdomain = root_domain;
1097
1098         }
1099
1100         /* Now perform the dns update - we'll try non-secure and if we fail,
1101            we'll follow it up with a secure update */
1102
1103         fstrcpy( dns_server, nameservers[0].hostname );
1104
1105         dns_err = DoDNSUpdate(dns_server, dnsdomain, machine_name, addrs, num_addrs);
1106         if (!ERR_DNS_IS_OK(dns_err)) {
1107                 status = NT_STATUS_UNSUCCESSFUL;
1108         }
1109
1110 done:
1111
1112         SAFE_FREE( root_domain );
1113
1114         return status;
1115 }
1116
1117 static NTSTATUS net_update_dns(TALLOC_CTX *mem_ctx, ADS_STRUCT *ads)
1118 {
1119         int num_addrs;
1120         struct sockaddr_storage *iplist = NULL;
1121         fstring machine_name;
1122         NTSTATUS status;
1123
1124         name_to_fqdn( machine_name, global_myname() );
1125         strlower_m( machine_name );
1126
1127         /* Get our ip address (not the 127.0.0.x address but a real ip
1128          * address) */
1129
1130         num_addrs = get_my_ip_address( &iplist );
1131         if ( num_addrs <= 0 ) {
1132                 DEBUG(4,("net_update_dns: Failed to find my non-loopback IP "
1133                          "addresses!\n"));
1134                 return NT_STATUS_INVALID_PARAMETER;
1135         }
1136
1137         status = net_update_dns_internal(mem_ctx, ads, machine_name,
1138                                          iplist, num_addrs);
1139         SAFE_FREE( iplist );
1140         return status;
1141 }
1142 #endif
1143
1144
1145 /*******************************************************************
1146  ********************************************************************/
1147
1148 static int net_ads_join_usage(struct net_context *c, int argc, const char **argv)
1149 {
1150         d_printf("net ads join [options]\n");
1151         d_printf("Valid options:\n");
1152         d_printf("   createupn[=UPN]    Set the userPrincipalName attribute during the join.\n");
1153         d_printf("                      The deault UPN is in the form host/netbiosname@REALM.\n");
1154         d_printf("   createcomputer=OU  Precreate the computer account in a specific OU.\n");
1155         d_printf("                      The OU string read from top to bottom without RDNs and delimited by a '/'.\n");
1156         d_printf("                      E.g. \"createcomputer=Computers/Servers/Unix\"\n");
1157         d_printf("                      NB: A backslash '\\' is used as escape at multiple levels and may\n");
1158         d_printf("                          need to be doubled or even quadrupled.  It is not used as a separator.\n");
1159         d_printf("   osName=string      Set the operatingSystem attribute during the join.\n");
1160         d_printf("   osVer=string       Set the operatingSystemVersion attribute during the join.\n");
1161         d_printf("                      NB: osName and osVer must be specified together for either to take effect.\n");
1162         d_printf("                          Also, the operatingSystemService attribute is also set when along with\n");
1163         d_printf("                          the two other attributes.\n");
1164
1165         return -1;
1166 }
1167
1168 /*******************************************************************
1169  ********************************************************************/
1170
1171 int net_ads_join(struct net_context *c, int argc, const char **argv)
1172 {
1173         TALLOC_CTX *ctx = NULL;
1174         struct libnet_JoinCtx *r = NULL;
1175         const char *domain = lp_realm();
1176         WERROR werr = WERR_SETUP_NOT_JOINED;
1177         bool createupn = false;
1178         const char *machineupn = NULL;
1179         const char *create_in_ou = NULL;
1180         int i;
1181         const char *os_name = NULL;
1182         const char *os_version = NULL;
1183         bool modify_config = lp_config_backend_is_registry();
1184
1185         if (c->display_usage)
1186                 return net_ads_join_usage(c, argc, argv);
1187
1188         if (!modify_config) {
1189
1190                 werr = check_ads_config();
1191                 if (!W_ERROR_IS_OK(werr)) {
1192                         d_fprintf(stderr, "Invalid configuration.  Exiting....\n");
1193                         goto fail;
1194                 }
1195         }
1196
1197         if (!(ctx = talloc_init("net_ads_join"))) {
1198                 d_fprintf(stderr, "Could not initialise talloc context.\n");
1199                 werr = WERR_NOMEM;
1200                 goto fail;
1201         }
1202
1203         if (!c->opt_kerberos) {
1204                 use_in_memory_ccache();
1205         }
1206
1207         werr = libnet_init_JoinCtx(ctx, &r);
1208         if (!W_ERROR_IS_OK(werr)) {
1209                 goto fail;
1210         }
1211
1212         /* process additional command line args */
1213
1214         for ( i=0; i<argc; i++ ) {
1215                 if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
1216                         createupn = true;
1217                         machineupn = get_string_param(argv[i]);
1218                 }
1219                 else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
1220                         if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
1221                                 d_fprintf(stderr, "Please supply a valid OU path.\n");
1222                                 werr = WERR_INVALID_PARAM;
1223                                 goto fail;
1224                         }
1225                 }
1226                 else if ( !StrnCaseCmp(argv[i], "osName", strlen("osName")) ) {
1227                         if ( (os_name = get_string_param(argv[i])) == NULL ) {
1228                                 d_fprintf(stderr, "Please supply a operating system name.\n");
1229                                 werr = WERR_INVALID_PARAM;
1230                                 goto fail;
1231                         }
1232                 }
1233                 else if ( !StrnCaseCmp(argv[i], "osVer", strlen("osVer")) ) {
1234                         if ( (os_version = get_string_param(argv[i])) == NULL ) {
1235                                 d_fprintf(stderr, "Please supply a valid operating system version.\n");
1236                                 werr = WERR_INVALID_PARAM;
1237                                 goto fail;
1238                         }
1239                 }
1240                 else {
1241                         domain = argv[i];
1242                 }
1243         }
1244
1245         if (!*domain) {
1246                 d_fprintf(stderr, "Please supply a valid domain name\n");
1247                 werr = WERR_INVALID_PARAM;
1248                 goto fail;
1249         }
1250
1251         /* Do the domain join here */
1252
1253         r->in.domain_name       = domain;
1254         r->in.create_upn        = createupn;
1255         r->in.upn               = machineupn;
1256         r->in.account_ou        = create_in_ou;
1257         r->in.os_name           = os_name;
1258         r->in.os_version        = os_version;
1259         r->in.dc_name           = c->opt_host;
1260         r->in.admin_account     = c->opt_user_name;
1261         r->in.admin_password    = net_prompt_pass(c, c->opt_user_name);
1262         r->in.debug             = true;
1263         r->in.use_kerberos      = c->opt_kerberos;
1264         r->in.modify_config     = modify_config;
1265         r->in.join_flags        = WKSSVC_JOIN_FLAGS_JOIN_TYPE |
1266                                   WKSSVC_JOIN_FLAGS_ACCOUNT_CREATE |
1267                                   WKSSVC_JOIN_FLAGS_DOMAIN_JOIN_IF_JOINED;
1268
1269         werr = libnet_Join(ctx, r);
1270         if (!W_ERROR_IS_OK(werr)) {
1271                 goto fail;
1272         }
1273
1274         /* Check the short name of the domain */
1275
1276         if (!modify_config && !strequal(lp_workgroup(), r->out.netbios_domain_name)) {
1277                 d_printf("The workgroup in %s does not match the short\n", get_dyn_CONFIGFILE());
1278                 d_printf("domain name obtained from the server.\n");
1279                 d_printf("Using the name [%s] from the server.\n", r->out.netbios_domain_name);
1280                 d_printf("You should set \"workgroup = %s\" in %s.\n",
1281                          r->out.netbios_domain_name, get_dyn_CONFIGFILE());
1282         }
1283
1284         d_printf("Using short domain name -- %s\n", r->out.netbios_domain_name);
1285
1286         if (r->out.dns_domain_name) {
1287                 d_printf("Joined '%s' to realm '%s'\n", r->in.machine_name,
1288                         r->out.dns_domain_name);
1289         } else {
1290                 d_printf("Joined '%s' to domain '%s'\n", r->in.machine_name,
1291                         r->out.netbios_domain_name);
1292         }
1293
1294 #if defined(WITH_DNS_UPDATES)
1295         if (r->out.domain_is_ad) {
1296                 /* We enter this block with user creds */
1297                 ADS_STRUCT *ads_dns = NULL;
1298
1299                 if ( (ads_dns = ads_init( lp_realm(), NULL, NULL )) != NULL ) {
1300                         /* kinit with the machine password */
1301
1302                         use_in_memory_ccache();
1303                         if (asprintf( &ads_dns->auth.user_name, "%s$", global_myname()) == -1) {
1304                                 goto fail;
1305                         }
1306                         ads_dns->auth.password = secrets_fetch_machine_password(
1307                                 r->out.netbios_domain_name, NULL, NULL );
1308                         ads_dns->auth.realm = SMB_STRDUP( r->out.dns_domain_name );
1309                         strupper_m(ads_dns->auth.realm );
1310                         ads_kinit_password( ads_dns );
1311                 }
1312
1313                 if ( !ads_dns || !NT_STATUS_IS_OK(net_update_dns( ctx, ads_dns )) ) {
1314                         d_fprintf( stderr, "DNS update failed!\n" );
1315                 }
1316
1317                 /* exit from this block using machine creds */
1318                 ads_destroy(&ads_dns);
1319         }
1320 #endif
1321         TALLOC_FREE(r);
1322         TALLOC_FREE( ctx );
1323
1324         return 0;
1325
1326 fail:
1327         /* issue an overall failure message at the end. */
1328         d_printf("Failed to join domain: %s\n",
1329                 r && r->out.error_string ? r->out.error_string :
1330                 get_friendly_werror_msg(werr));
1331         TALLOC_FREE( ctx );
1332
1333         return -1;
1334 }
1335
1336 /*******************************************************************
1337  ********************************************************************/
1338
1339 static int net_ads_dns_register(struct net_context *c, int argc, const char **argv)
1340 {
1341 #if defined(WITH_DNS_UPDATES)
1342         ADS_STRUCT *ads;
1343         ADS_STATUS status;
1344         TALLOC_CTX *ctx;
1345
1346 #ifdef DEVELOPER
1347         talloc_enable_leak_report();
1348 #endif
1349
1350         if (argc > 0 || c->display_usage) {
1351                 d_printf("Usage:\n"
1352                          "net ads dns register\n"
1353                          "    Register hostname with DNS\n");
1354                 return -1;
1355         }
1356
1357         if (!(ctx = talloc_init("net_ads_dns"))) {
1358                 d_fprintf(stderr, "Could not initialise talloc context\n");
1359                 return -1;
1360         }
1361
1362         status = ads_startup(c, true, &ads);
1363         if ( !ADS_ERR_OK(status) ) {
1364                 DEBUG(1, ("error on ads_startup: %s\n", ads_errstr(status)));
1365                 TALLOC_FREE(ctx);
1366                 return -1;
1367         }
1368
1369         if ( !NT_STATUS_IS_OK(net_update_dns(ctx, ads)) ) {
1370                 d_fprintf( stderr, "DNS update failed!\n" );
1371                 ads_destroy( &ads );
1372                 TALLOC_FREE( ctx );
1373                 return -1;
1374         }
1375
1376         d_fprintf( stderr, "Successfully registered hostname with DNS\n" );
1377
1378         ads_destroy(&ads);
1379         TALLOC_FREE( ctx );
1380
1381         return 0;
1382 #else
1383         d_fprintf(stderr, "DNS update support not enabled at compile time!\n");
1384         return -1;
1385 #endif
1386 }
1387
1388 #if defined(WITH_DNS_UPDATES)
1389 DNS_ERROR do_gethostbyname(const char *server, const char *host);
1390 #endif
1391
1392 static int net_ads_dns_gethostbyname(struct net_context *c, int argc, const char **argv)
1393 {
1394 #if defined(WITH_DNS_UPDATES)
1395         DNS_ERROR err;
1396
1397 #ifdef DEVELOPER
1398         talloc_enable_leak_report();
1399 #endif
1400
1401         if (argc != 2 || c->display_usage) {
1402                 d_printf("Usage:\n"
1403                          "net ads dns gethostbyname <server> <name>\n"
1404                          "  Look up hostname from the AD\n"
1405                          "    server\tName server to use\n"
1406                          "    name\tName to look up\n");
1407                 return -1;
1408         }
1409
1410         err = do_gethostbyname(argv[0], argv[1]);
1411
1412         d_printf("do_gethostbyname returned %d\n", ERROR_DNS_V(err));
1413 #endif
1414         return 0;
1415 }
1416
1417 static int net_ads_dns(struct net_context *c, int argc, const char *argv[])
1418 {
1419         struct functable func[] = {
1420                 {
1421                         "register",
1422                         net_ads_dns_register,
1423                         NET_TRANSPORT_ADS,
1424                         "Add host dns entry to AD",
1425                         "net ads dns register\n"
1426                         "    Add host dns entry to AD"
1427                 },
1428                 {
1429                         "gethostbyname",
1430                         net_ads_dns_gethostbyname,
1431                         NET_TRANSPORT_ADS,
1432                         "Look up host",
1433                         "net ads dns gethostbyname\n"
1434                         "    Look up host"
1435                 },
1436                 {NULL, NULL, 0, NULL, NULL}
1437         };
1438
1439         return net_run_function(c, argc, argv, "net ads dns", func);
1440 }
1441
1442 /*******************************************************************
1443  ********************************************************************/
1444
1445 int net_ads_printer_usage(struct net_context *c, int argc, const char **argv)
1446 {
1447         d_printf(
1448 "\nnet ads printer search <printer>"
1449 "\n\tsearch for a printer in the directory\n"
1450 "\nnet ads printer info <printer> <server>"
1451 "\n\tlookup info in directory for printer on server"
1452 "\n\t(note: printer defaults to \"*\", server defaults to local)\n"
1453 "\nnet ads printer publish <printername>"
1454 "\n\tpublish printer in directory"
1455 "\n\t(note: printer name is required)\n"
1456 "\nnet ads printer remove <printername>"
1457 "\n\tremove printer from directory"
1458 "\n\t(note: printer name is required)\n");
1459         return -1;
1460 }
1461
1462 /*******************************************************************
1463  ********************************************************************/
1464
1465 static int net_ads_printer_search(struct net_context *c, int argc, const char **argv)
1466 {
1467         ADS_STRUCT *ads;
1468         ADS_STATUS rc;
1469         LDAPMessage *res = NULL;
1470
1471         if (c->display_usage) {
1472                 d_printf("Usage:\n"
1473                          "net ads printer search\n"
1474                          "    List printers in the AD\n");
1475                 return 0;
1476         }
1477
1478         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1479                 return -1;
1480         }
1481
1482         rc = ads_find_printers(ads, &res);
1483
1484         if (!ADS_ERR_OK(rc)) {
1485                 d_fprintf(stderr, "ads_find_printer: %s\n", ads_errstr(rc));
1486                 ads_msgfree(ads, res);
1487                 ads_destroy(&ads);
1488                 return -1;
1489         }
1490
1491         if (ads_count_replies(ads, res) == 0) {
1492                 d_fprintf(stderr, "No results found\n");
1493                 ads_msgfree(ads, res);
1494                 ads_destroy(&ads);
1495                 return -1;
1496         }
1497
1498         ads_dump(ads, res);
1499         ads_msgfree(ads, res);
1500         ads_destroy(&ads);
1501         return 0;
1502 }
1503
1504 static int net_ads_printer_info(struct net_context *c, int argc, const char **argv)
1505 {
1506         ADS_STRUCT *ads;
1507         ADS_STATUS rc;
1508         const char *servername, *printername;
1509         LDAPMessage *res = NULL;
1510
1511         if (c->display_usage) {
1512                 d_printf("Usage:\n"
1513                          "net ads printer info [printername [servername]]\n"
1514                          "  Display printer info from AD\n"
1515                          "    printername\tPrinter name or wildcard\n"
1516                          "    servername\tName of the print server\n");
1517                 return 0;
1518         }
1519
1520         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1521                 return -1;
1522         }
1523
1524         if (argc > 0) {
1525                 printername = argv[0];
1526         } else {
1527                 printername = "*";
1528         }
1529
1530         if (argc > 1) {
1531                 servername =  argv[1];
1532         } else {
1533                 servername = global_myname();
1534         }
1535
1536         rc = ads_find_printer_on_server(ads, &res, printername, servername);
1537
1538         if (!ADS_ERR_OK(rc)) {
1539                 d_fprintf(stderr, "Server '%s' not found: %s\n",
1540                         servername, ads_errstr(rc));
1541                 ads_msgfree(ads, res);
1542                 ads_destroy(&ads);
1543                 return -1;
1544         }
1545
1546         if (ads_count_replies(ads, res) == 0) {
1547                 d_fprintf(stderr, "Printer '%s' not found\n", printername);
1548                 ads_msgfree(ads, res);
1549                 ads_destroy(&ads);
1550                 return -1;
1551         }
1552
1553         ads_dump(ads, res);
1554         ads_msgfree(ads, res);
1555         ads_destroy(&ads);
1556
1557         return 0;
1558 }
1559
1560 static int net_ads_printer_publish(struct net_context *c, int argc, const char **argv)
1561 {
1562         ADS_STRUCT *ads;
1563         ADS_STATUS rc;
1564         const char *servername, *printername;
1565         struct cli_state *cli;
1566         struct rpc_pipe_client *pipe_hnd;
1567         struct sockaddr_storage server_ss;
1568         NTSTATUS nt_status;
1569         TALLOC_CTX *mem_ctx = talloc_init("net_ads_printer_publish");
1570         ADS_MODLIST mods = ads_init_mods(mem_ctx);
1571         char *prt_dn, *srv_dn, **srv_cn;
1572         char *srv_cn_escaped = NULL, *printername_escaped = NULL;
1573         LDAPMessage *res = NULL;
1574
1575         if (argc < 1 || c->display_usage) {
1576                 d_printf("Usage:\n"
1577                          "net ads printer publish <printername> [servername]\n"
1578                          "  Publish printer in AD\n"
1579                          "    printername\tName of the printer\n"
1580                          "    servername\tName of the print server\n");
1581                 talloc_destroy(mem_ctx);
1582                 return -1;
1583         }
1584
1585         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1586                 talloc_destroy(mem_ctx);
1587                 return -1;
1588         }
1589
1590         printername = argv[0];
1591
1592         if (argc == 2) {
1593                 servername = argv[1];
1594         } else {
1595                 servername = global_myname();
1596         }
1597
1598         /* Get printer data from SPOOLSS */
1599
1600         resolve_name(servername, &server_ss, 0x20);
1601
1602         nt_status = cli_full_connection(&cli, global_myname(), servername,
1603                                         &server_ss, 0,
1604                                         "IPC$", "IPC",
1605                                         c->opt_user_name, c->opt_workgroup,
1606                                         c->opt_password ? c->opt_password : "",
1607                                         CLI_FULL_CONNECTION_USE_KERBEROS,
1608                                         Undefined, NULL);
1609
1610         if (NT_STATUS_IS_ERR(nt_status)) {
1611                 d_fprintf(stderr, "Unable to open a connnection to %s to obtain data "
1612                          "for %s\n", servername, printername);
1613                 ads_destroy(&ads);
1614                 talloc_destroy(mem_ctx);
1615                 return -1;
1616         }
1617
1618         /* Publish on AD server */
1619
1620         ads_find_machine_acct(ads, &res, servername);
1621
1622         if (ads_count_replies(ads, res) == 0) {
1623                 d_fprintf(stderr, "Could not find machine account for server %s\n",
1624                          servername);
1625                 ads_destroy(&ads);
1626                 talloc_destroy(mem_ctx);
1627                 return -1;
1628         }
1629
1630         srv_dn = ldap_get_dn((LDAP *)ads->ldap.ld, (LDAPMessage *)res);
1631         srv_cn = ldap_explode_dn(srv_dn, 1);
1632
1633         srv_cn_escaped = escape_rdn_val_string_alloc(srv_cn[0]);
1634         printername_escaped = escape_rdn_val_string_alloc(printername);
1635         if (!srv_cn_escaped || !printername_escaped) {
1636                 SAFE_FREE(srv_cn_escaped);
1637                 SAFE_FREE(printername_escaped);
1638                 d_fprintf(stderr, "Internal error, out of memory!");
1639                 ads_destroy(&ads);
1640                 talloc_destroy(mem_ctx);
1641                 return -1;
1642         }
1643
1644         if (asprintf(&prt_dn, "cn=%s-%s,%s", srv_cn_escaped, printername_escaped, srv_dn) == -1) {
1645                 SAFE_FREE(srv_cn_escaped);
1646                 SAFE_FREE(printername_escaped);
1647                 d_fprintf(stderr, "Internal error, out of memory!");
1648                 ads_destroy(&ads);
1649                 talloc_destroy(mem_ctx);
1650                 return -1;
1651         }
1652
1653         SAFE_FREE(srv_cn_escaped);
1654         SAFE_FREE(printername_escaped);
1655
1656         nt_status = cli_rpc_pipe_open_noauth(cli, &syntax_spoolss, &pipe_hnd);
1657         if (!NT_STATUS_IS_OK(nt_status)) {
1658                 d_fprintf(stderr, "Unable to open a connnection to the spoolss pipe on %s\n",
1659                          servername);
1660                 SAFE_FREE(prt_dn);
1661                 ads_destroy(&ads);
1662                 talloc_destroy(mem_ctx);
1663                 return -1;
1664         }
1665
1666         if (!W_ERROR_IS_OK(get_remote_printer_publishing_data(pipe_hnd, mem_ctx, &mods,
1667                                                               printername))) {
1668                 SAFE_FREE(prt_dn);
1669                 ads_destroy(&ads);
1670                 talloc_destroy(mem_ctx);
1671                 return -1;
1672         }
1673
1674         rc = ads_add_printer_entry(ads, prt_dn, mem_ctx, &mods);
1675         if (!ADS_ERR_OK(rc)) {
1676                 d_fprintf(stderr, "ads_publish_printer: %s\n", ads_errstr(rc));
1677                 SAFE_FREE(prt_dn);
1678                 ads_destroy(&ads);
1679                 talloc_destroy(mem_ctx);
1680                 return -1;
1681         }
1682
1683         d_printf("published printer\n");
1684         SAFE_FREE(prt_dn);
1685         ads_destroy(&ads);
1686         talloc_destroy(mem_ctx);
1687
1688         return 0;
1689 }
1690
1691 static int net_ads_printer_remove(struct net_context *c, int argc, const char **argv)
1692 {
1693         ADS_STRUCT *ads;
1694         ADS_STATUS rc;
1695         const char *servername;
1696         char *prt_dn;
1697         LDAPMessage *res = NULL;
1698
1699         if (argc < 1 || c->display_usage) {
1700                 d_printf("Usage:\n"
1701                          "net ads printer remove <printername> [servername]\n"
1702                          "  Remove a printer from the AD\n"
1703                          "    printername\tName of the printer\n"
1704                          "    servername\tName of the print server\n");
1705                 return -1;
1706         }
1707
1708         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1709                 return -1;
1710         }
1711
1712         if (argc > 1) {
1713                 servername = argv[1];
1714         } else {
1715                 servername = global_myname();
1716         }
1717
1718         rc = ads_find_printer_on_server(ads, &res, argv[0], servername);
1719
1720         if (!ADS_ERR_OK(rc)) {
1721                 d_fprintf(stderr, "ads_find_printer_on_server: %s\n", ads_errstr(rc));
1722                 ads_msgfree(ads, res);
1723                 ads_destroy(&ads);
1724                 return -1;
1725         }
1726
1727         if (ads_count_replies(ads, res) == 0) {
1728                 d_fprintf(stderr, "Printer '%s' not found\n", argv[1]);
1729                 ads_msgfree(ads, res);
1730                 ads_destroy(&ads);
1731                 return -1;
1732         }
1733
1734         prt_dn = ads_get_dn(ads, res);
1735         ads_msgfree(ads, res);
1736         rc = ads_del_dn(ads, prt_dn);
1737         ads_memfree(ads, prt_dn);
1738
1739         if (!ADS_ERR_OK(rc)) {
1740                 d_fprintf(stderr, "ads_del_dn: %s\n", ads_errstr(rc));
1741                 ads_destroy(&ads);
1742                 return -1;
1743         }
1744
1745         ads_destroy(&ads);
1746         return 0;
1747 }
1748
1749 static int net_ads_printer(struct net_context *c, int argc, const char **argv)
1750 {
1751         struct functable func[] = {
1752                 {
1753                         "search",
1754                         net_ads_printer_search,
1755                         NET_TRANSPORT_ADS,
1756                         "Search for a printer",
1757                         "net ads printer search\n"
1758                         "    Search for a printer"
1759                 },
1760                 {
1761                         "info",
1762                         net_ads_printer_info,
1763                         NET_TRANSPORT_ADS,
1764                         "Display printer information",
1765                         "net ads printer info\n"
1766                         "    Display printer information"
1767                 },
1768                 {
1769                         "publish",
1770                         net_ads_printer_publish,
1771                         NET_TRANSPORT_ADS,
1772                         "Publish a printer",
1773                         "net ads printer publish\n"
1774                         "    Publish a printer"
1775                 },
1776                 {
1777                         "remove",
1778                         net_ads_printer_remove,
1779                         NET_TRANSPORT_ADS,
1780                         "Delete a printer",
1781                         "net ads printer remove\n"
1782                         "    Delete a printer"
1783                 },
1784                 {NULL, NULL, 0, NULL, NULL}
1785         };
1786
1787         return net_run_function(c, argc, argv, "net ads printer", func);
1788 }
1789
1790
1791 static int net_ads_password(struct net_context *c, int argc, const char **argv)
1792 {
1793         ADS_STRUCT *ads;
1794         const char *auth_principal = c->opt_user_name;
1795         const char *auth_password = c->opt_password;
1796         char *realm = NULL;
1797         char *new_password = NULL;
1798         char *chr, *prompt;
1799         const char *user;
1800         ADS_STATUS ret;
1801
1802         if (c->display_usage) {
1803                 d_printf("Usage:\n"
1804                          "net ads password <username>\n"
1805                          "  Change password for user\n"
1806                          "    username\tName of user to change password for\n");
1807                 return 0;
1808         }
1809
1810         if (c->opt_user_name == NULL || c->opt_password == NULL) {
1811                 d_fprintf(stderr, "You must supply an administrator username/password\n");
1812                 return -1;
1813         }
1814
1815         if (argc < 1) {
1816                 d_fprintf(stderr, "ERROR: You must say which username to change password for\n");
1817                 return -1;
1818         }
1819
1820         user = argv[0];
1821         if (!strchr_m(user, '@')) {
1822                 if (asprintf(&chr, "%s@%s", argv[0], lp_realm()) == -1) {
1823                         return -1;
1824                 }
1825                 user = chr;
1826         }
1827
1828         use_in_memory_ccache();
1829         chr = strchr_m(auth_principal, '@');
1830         if (chr) {
1831                 realm = ++chr;
1832         } else {
1833                 realm = lp_realm();
1834         }
1835
1836         /* use the realm so we can eventually change passwords for users
1837         in realms other than default */
1838         if (!(ads = ads_init(realm, c->opt_workgroup, c->opt_host))) {
1839                 return -1;
1840         }
1841
1842         /* we don't actually need a full connect, but it's the easy way to
1843                 fill in the KDC's addresss */
1844         ads_connect(ads);
1845
1846         if (!ads->config.realm) {
1847                 d_fprintf(stderr, "Didn't find the kerberos server!\n");
1848                 return -1;
1849         }
1850
1851         if (argv[1]) {
1852                 new_password = (char *)argv[1];
1853         } else {
1854                 if (asprintf(&prompt, "Enter new password for %s:", user) == -1) {
1855                         return -1;
1856                 }
1857                 new_password = getpass(prompt);
1858                 free(prompt);
1859         }
1860
1861         ret = kerberos_set_password(ads->auth.kdc_server, auth_principal,
1862                                 auth_password, user, new_password, ads->auth.time_offset);
1863         if (!ADS_ERR_OK(ret)) {
1864                 d_fprintf(stderr, "Password change failed: %s\n", ads_errstr(ret));
1865                 ads_destroy(&ads);
1866                 return -1;
1867         }
1868
1869         d_printf("Password change for %s completed.\n", user);
1870         ads_destroy(&ads);
1871
1872         return 0;
1873 }
1874
1875 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
1876 {
1877         ADS_STRUCT *ads;
1878         char *host_principal;
1879         fstring my_name;
1880         ADS_STATUS ret;
1881
1882         if (c->display_usage) {
1883                 d_printf("Usage:\n"
1884                          "net ads changetrustpw\n"
1885                          "    Change the machine account's trust password\n");
1886                 return 0;
1887         }
1888
1889         if (!secrets_init()) {
1890                 DEBUG(1,("Failed to initialise secrets database\n"));
1891                 return -1;
1892         }
1893
1894         net_use_krb_machine_account(c);
1895
1896         use_in_memory_ccache();
1897
1898         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
1899                 return -1;
1900         }
1901
1902         fstrcpy(my_name, global_myname());
1903         strlower_m(my_name);
1904         if (asprintf(&host_principal, "%s$@%s", my_name, ads->config.realm) == -1) {
1905                 ads_destroy(&ads);
1906                 return -1;
1907         }
1908         d_printf("Changing password for principal: %s\n", host_principal);
1909
1910         ret = ads_change_trust_account_password(ads, host_principal);
1911
1912         if (!ADS_ERR_OK(ret)) {
1913                 d_fprintf(stderr, "Password change failed: %s\n", ads_errstr(ret));
1914                 ads_destroy(&ads);
1915                 SAFE_FREE(host_principal);
1916                 return -1;
1917         }
1918
1919         d_printf("Password change for principal %s succeeded.\n", host_principal);
1920
1921         if (lp_use_kerberos_keytab()) {
1922                 d_printf("Attempting to update system keytab with new password.\n");
1923                 if (ads_keytab_create_default(ads)) {
1924                         d_printf("Failed to update system keytab.\n");
1925                 }
1926         }
1927
1928         ads_destroy(&ads);
1929         SAFE_FREE(host_principal);
1930
1931         return 0;
1932 }
1933
1934 /*
1935   help for net ads search
1936 */
1937 static int net_ads_search_usage(struct net_context *c, int argc, const char **argv)
1938 {
1939         d_printf(
1940                 "\nnet ads search <expression> <attributes...>\n"
1941                 "\nPerform a raw LDAP search on a ADS server and dump the results.\n"
1942                 "The expression is a standard LDAP search expression, and the\n"
1943                 "attributes are a list of LDAP fields to show in the results.\n\n"
1944                 "Example: net ads search '(objectCategory=group)' sAMAccountName\n\n"
1945                 );
1946         net_common_flags_usage(c, argc, argv);
1947         return -1;
1948 }
1949
1950
1951 /*
1952   general ADS search function. Useful in diagnosing problems in ADS
1953 */
1954 static int net_ads_search(struct net_context *c, int argc, const char **argv)
1955 {
1956         ADS_STRUCT *ads;
1957         ADS_STATUS rc;
1958         const char *ldap_exp;
1959         const char **attrs;
1960         LDAPMessage *res = NULL;
1961
1962         if (argc < 1 || c->display_usage) {
1963                 return net_ads_search_usage(c, argc, argv);
1964         }
1965
1966         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
1967                 return -1;
1968         }
1969
1970         ldap_exp = argv[0];
1971         attrs = (argv + 1);
1972
1973         rc = ads_do_search_all(ads, ads->config.bind_path,
1974                                LDAP_SCOPE_SUBTREE,
1975                                ldap_exp, attrs, &res);
1976         if (!ADS_ERR_OK(rc)) {
1977                 d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
1978                 ads_destroy(&ads);
1979                 return -1;
1980         }
1981
1982         d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
1983
1984         /* dump the results */
1985         ads_dump(ads, res);
1986
1987         ads_msgfree(ads, res);
1988         ads_destroy(&ads);
1989
1990         return 0;
1991 }
1992
1993
1994 /*
1995   help for net ads search
1996 */
1997 static int net_ads_dn_usage(struct net_context *c, int argc, const char **argv)
1998 {
1999         d_printf(
2000                 "\nnet ads dn <dn> <attributes...>\n"
2001                 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2002                 "The DN standard LDAP DN, and the attributes are a list of LDAP fields \n"
2003                 "to show in the results\n\n"
2004                 "Example: net ads dn 'CN=administrator,CN=Users,DC=my,DC=domain' sAMAccountName\n\n"
2005                 "Note: the DN must be provided properly escaped. See RFC 4514 for details\n\n"
2006                 );
2007         net_common_flags_usage(c, argc, argv);
2008         return -1;
2009 }
2010
2011
2012 /*
2013   general ADS search function. Useful in diagnosing problems in ADS
2014 */
2015 static int net_ads_dn(struct net_context *c, int argc, const char **argv)
2016 {
2017         ADS_STRUCT *ads;
2018         ADS_STATUS rc;
2019         const char *dn;
2020         const char **attrs;
2021         LDAPMessage *res = NULL;
2022
2023         if (argc < 1 || c->display_usage) {
2024                 return net_ads_dn_usage(c, argc, argv);
2025         }
2026
2027         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2028                 return -1;
2029         }
2030
2031         dn = argv[0];
2032         attrs = (argv + 1);
2033
2034         rc = ads_do_search_all(ads, dn,
2035                                LDAP_SCOPE_BASE,
2036                                "(objectclass=*)", attrs, &res);
2037         if (!ADS_ERR_OK(rc)) {
2038                 d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
2039                 ads_destroy(&ads);
2040                 return -1;
2041         }
2042
2043         d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2044
2045         /* dump the results */
2046         ads_dump(ads, res);
2047
2048         ads_msgfree(ads, res);
2049         ads_destroy(&ads);
2050
2051         return 0;
2052 }
2053
2054 /*
2055   help for net ads sid search
2056 */
2057 static int net_ads_sid_usage(struct net_context *c, int argc, const char **argv)
2058 {
2059         d_printf(
2060                 "\nnet ads sid <sid> <attributes...>\n"
2061                 "\nperform a raw LDAP search on a ADS server and dump the results\n"
2062                 "The SID is in string format, and the attributes are a list of LDAP fields \n"
2063                 "to show in the results\n\n"
2064                 "Example: net ads sid 'S-1-5-32' distinguishedName\n\n"
2065                 );
2066         net_common_flags_usage(c, argc, argv);
2067         return -1;
2068 }
2069
2070
2071 /*
2072   general ADS search function. Useful in diagnosing problems in ADS
2073 */
2074 static int net_ads_sid(struct net_context *c, int argc, const char **argv)
2075 {
2076         ADS_STRUCT *ads;
2077         ADS_STATUS rc;
2078         const char *sid_string;
2079         const char **attrs;
2080         LDAPMessage *res = NULL;
2081         DOM_SID sid;
2082
2083         if (argc < 1 || c->display_usage) {
2084                 return net_ads_sid_usage(c, argc, argv);
2085         }
2086
2087         if (!ADS_ERR_OK(ads_startup(c, false, &ads))) {
2088                 return -1;
2089         }
2090
2091         sid_string = argv[0];
2092         attrs = (argv + 1);
2093
2094         if (!string_to_sid(&sid, sid_string)) {
2095                 d_fprintf(stderr, "could not convert sid\n");
2096                 ads_destroy(&ads);
2097                 return -1;
2098         }
2099
2100         rc = ads_search_retry_sid(ads, &res, &sid, attrs);
2101         if (!ADS_ERR_OK(rc)) {
2102                 d_fprintf(stderr, "search failed: %s\n", ads_errstr(rc));
2103                 ads_destroy(&ads);
2104                 return -1;
2105         }
2106
2107         d_printf("Got %d replies\n\n", ads_count_replies(ads, res));
2108
2109         /* dump the results */
2110         ads_dump(ads, res);
2111
2112         ads_msgfree(ads, res);
2113         ads_destroy(&ads);
2114
2115         return 0;
2116 }
2117
2118 static int net_ads_keytab_flush(struct net_context *c, int argc, const char **argv)
2119 {
2120         int ret;
2121         ADS_STRUCT *ads;
2122
2123         if (c->display_usage) {
2124                 d_printf("Usage:\n"
2125                          "net ads keytab flush\n"
2126                          "    Delete the whole keytab\n");
2127                 return 0;
2128         }
2129
2130         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2131                 return -1;
2132         }
2133         ret = ads_keytab_flush(ads);
2134         ads_destroy(&ads);
2135         return ret;
2136 }
2137
2138 static int net_ads_keytab_add(struct net_context *c, int argc, const char **argv)
2139 {
2140         int i;
2141         int ret = 0;
2142         ADS_STRUCT *ads;
2143
2144         if (c->display_usage) {
2145                 d_printf("Usage:\n"
2146                          "net ads keytab add <principal> [principal ...]\n"
2147                          "  Add principals to local keytab\n"
2148                          "    principal\tKerberos principal to add to "
2149                          "keytab\n");
2150                 return 0;
2151         }
2152
2153         d_printf("Processing principals to add...\n");
2154         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2155                 return -1;
2156         }
2157         for (i = 0; i < argc; i++) {
2158                 ret |= ads_keytab_add_entry(ads, argv[i]);
2159         }
2160         ads_destroy(&ads);
2161         return ret;
2162 }
2163
2164 static int net_ads_keytab_create(struct net_context *c, int argc, const char **argv)
2165 {
2166         ADS_STRUCT *ads;
2167         int ret;
2168
2169         if (c->display_usage) {
2170                 d_printf("Usage:\n"
2171                          "net ads keytab create\n"
2172                          "    Create new default keytab\n");
2173                 return 0;
2174         }
2175
2176         if (!ADS_ERR_OK(ads_startup(c, true, &ads))) {
2177                 return -1;
2178         }
2179         ret = ads_keytab_create_default(ads);
2180         ads_destroy(&ads);
2181         return ret;
2182 }
2183
2184 static int net_ads_keytab_list(struct net_context *c, int argc, const char **argv)
2185 {
2186         const char *keytab = NULL;
2187
2188         if (c->display_usage) {
2189                 d_printf("Usage:\n"
2190                          "net ads keytab list [keytab]\n"
2191                          "  List a local keytab\n"
2192                          "    keytab\tKeytab to list\n");
2193                 return 0;
2194         }
2195
2196         if (argc >= 1) {
2197                 keytab = argv[0];
2198         }
2199
2200         return ads_keytab_list(keytab);
2201 }
2202
2203
2204 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2205 {
2206         struct functable func[] = {
2207                 {
2208                         "add",
2209                         net_ads_keytab_add,
2210                         NET_TRANSPORT_ADS,
2211                         "Add a service principal",
2212                         "net ads keytab add\n"
2213                         "    Add a service principal"
2214                 },
2215                 {
2216                         "create",
2217                         net_ads_keytab_create,
2218                         NET_TRANSPORT_ADS,
2219                         "Create a fresh keytab",
2220                         "net ads keytab create\n"
2221                         "    Create a fresh keytab"
2222                 },
2223                 {
2224                         "flush",
2225                         net_ads_keytab_flush,
2226                         NET_TRANSPORT_ADS,
2227                         "Remove all keytab entries",
2228                         "net ads keytab flush\n"
2229                         "    Remove all keytab entries"
2230                 },
2231                 {
2232                         "list",
2233                         net_ads_keytab_list,
2234                         NET_TRANSPORT_ADS,
2235                         "List a keytab",
2236                         "net ads keytab list\n"
2237                         "    List a keytab"
2238                 },
2239                 {NULL, NULL, 0, NULL, NULL}
2240         };
2241
2242         if (!lp_use_kerberos_keytab()) {
2243                 d_printf("\nWarning: \"use kerberos keytab\" must be set to \"true\" in order to \
2244 use keytab functions.\n");
2245         }
2246
2247         return net_run_function(c, argc, argv, "net ads keytab", func);
2248 }
2249
2250 static int net_ads_kerberos_renew(struct net_context *c, int argc, const char **argv)
2251 {
2252         int ret = -1;
2253
2254         if (c->display_usage) {
2255                 d_printf("Usage:\n"
2256                          "net ads kerberos renew\n"
2257                          "    Renew TGT from existing credential cache\n");
2258                 return 0;
2259         }
2260
2261         ret = smb_krb5_renew_ticket(NULL, NULL, NULL, NULL);
2262         if (ret) {
2263                 d_printf("failed to renew kerberos ticket: %s\n",
2264                         error_message(ret));
2265         }
2266         return ret;
2267 }
2268
2269 static int net_ads_kerberos_pac(struct net_context *c, int argc, const char **argv)
2270 {
2271         struct PAC_DATA *pac = NULL;
2272         struct PAC_LOGON_INFO *info = NULL;
2273         TALLOC_CTX *mem_ctx = NULL;
2274         NTSTATUS status;
2275         int ret = -1;
2276
2277         if (c->display_usage) {
2278                 d_printf("Usage:\n"
2279                          "net ads kerberos pac\n"
2280                          "    Dump the Kerberos PAC\n");
2281                 return 0;
2282         }
2283
2284         mem_ctx = talloc_init("net_ads_kerberos_pac");
2285         if (!mem_ctx) {
2286                 goto out;
2287         }
2288
2289         c->opt_password = net_prompt_pass(c, c->opt_user_name);
2290
2291         status = kerberos_return_pac(mem_ctx,
2292                                      c->opt_user_name,
2293                                      c->opt_password,
2294                                      0,
2295                                      NULL,
2296                                      NULL,
2297                                      NULL,
2298                                      true,
2299                                      true,
2300                                      2592000, /* one month */
2301                                      &pac);
2302         if (!NT_STATUS_IS_OK(status)) {
2303                 d_printf("failed to query kerberos PAC: %s\n",
2304                         nt_errstr(status));
2305                 goto out;
2306         }
2307
2308         info = get_logon_info_from_pac(pac);
2309         if (info) {
2310                 const char *s;
2311                 s = NDR_PRINT_STRUCT_STRING(mem_ctx, PAC_LOGON_INFO, info);
2312                 d_printf("The Pac: %s\n", s);
2313         }
2314
2315         ret = 0;
2316  out:
2317         TALLOC_FREE(mem_ctx);
2318         return ret;
2319 }
2320
2321 static int net_ads_kerberos_kinit(struct net_context *c, int argc, const char **argv)
2322 {
2323         TALLOC_CTX *mem_ctx = NULL;
2324         int ret = -1;
2325         NTSTATUS status;
2326
2327         if (c->display_usage) {
2328                 d_printf("Usage:\n"
2329                          "net ads kerberos kinit\n"
2330                          "    Get Ticket Granting Ticket (TGT) for the user\n");
2331                 return 0;
2332         }
2333
2334         mem_ctx = talloc_init("net_ads_kerberos_kinit");
2335         if (!mem_ctx) {
2336                 goto out;
2337         }
2338
2339         c->opt_password = net_prompt_pass(c, c->opt_user_name);
2340
2341         ret = kerberos_kinit_password_ext(c->opt_user_name,
2342                                           c->opt_password,
2343                                           0,
2344                                           NULL,
2345                                           NULL,
2346                                           NULL,
2347                                           true,
2348                                           true,
2349                                           2592000, /* one month */
2350                                           &status);
2351         if (ret) {
2352                 d_printf("failed to kinit password: %s\n",
2353                         nt_errstr(status));
2354         }
2355  out:
2356         return ret;
2357 }
2358
2359 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2360 {
2361         struct functable func[] = {
2362                 {
2363                         "kinit",
2364                         net_ads_kerberos_kinit,
2365                         NET_TRANSPORT_ADS,
2366                         "Retrieve Ticket Granting Ticket (TGT)",
2367                         "net ads kerberos kinit\n"
2368                         "    Receive Ticket Granting Ticket (TGT)"
2369                 },
2370                 {
2371                         "renew",
2372                         net_ads_kerberos_renew,
2373                         NET_TRANSPORT_ADS,
2374                         "Renew Ticket Granting Ticket from credential cache"
2375                         "net ads kerberos renew\n"
2376                         "    Renew Ticket Granting Ticket from credential cache"
2377                 },
2378                 {
2379                         "pac",
2380                         net_ads_kerberos_pac,
2381                         NET_TRANSPORT_ADS,
2382                         "Dump Kerberos PAC",
2383                         "net ads kerberos pac\n"
2384                         "    Dump Kerberos PAC"
2385                 },
2386                 {NULL, NULL, 0, NULL, NULL}
2387         };
2388
2389         return net_run_function(c, argc, argv, "net ads kerberos", func);
2390 }
2391
2392 int net_ads(struct net_context *c, int argc, const char **argv)
2393 {
2394         struct functable func[] = {
2395                 {
2396                         "info",
2397                         net_ads_info,
2398                         NET_TRANSPORT_ADS,
2399                         "Display details on remote ADS server",
2400                         "net ads info\n"
2401                         "    Display details on remote ADS server"
2402                 },
2403                 {
2404                         "join",
2405                         net_ads_join,
2406                         NET_TRANSPORT_ADS,
2407                         "Join the local machine to ADS realm",
2408                         "net ads join\n"
2409                         "    Join the local machine to ADS realm"
2410                 },
2411                 {
2412                         "testjoin",
2413                         net_ads_testjoin,
2414                         NET_TRANSPORT_ADS,
2415                         "Validate machine account",
2416                         "net ads testjoin\n"
2417                         "    Validate machine account"
2418                 },
2419                 {
2420                         "leave",
2421                         net_ads_leave,
2422                         NET_TRANSPORT_ADS,
2423                         "Remove the local machine from ADS",
2424                         "net ads leave\n"
2425                         "    Remove the local machine from ADS"
2426                 },
2427                 {
2428                         "status",
2429                         net_ads_status,
2430                         NET_TRANSPORT_ADS,
2431                         "Display machine account details",
2432                         "net ads status\n"
2433                         "    Display machine account details"
2434                 },
2435                 {
2436                         "user",
2437                         net_ads_user,
2438                         NET_TRANSPORT_ADS,
2439                         "List/modify users",
2440                         "net ads user\n"
2441                         "    List/modify users"
2442                 },
2443                 {
2444                         "group",
2445                         net_ads_group,
2446                         NET_TRANSPORT_ADS,
2447                         "List/modify groups",
2448                         "net ads group\n"
2449                         "    List/modify groups"
2450                 },
2451                 {
2452                         "dns",
2453                         net_ads_dns,
2454                         NET_TRANSPORT_ADS,
2455                         "Issue dynamic DNS update",
2456                         "net ads dns\n"
2457                         "    Issue dynamic DNS update"
2458                 },
2459                 {
2460                         "password",
2461                         net_ads_password,
2462                         NET_TRANSPORT_ADS,
2463                         "Change user passwords",
2464                         "net ads password\n"
2465                         "    Change user passwords"
2466                 },
2467                 {
2468                         "changetrustpw",
2469                         net_ads_changetrustpw,
2470                         NET_TRANSPORT_ADS,
2471                         "Change trust account password",
2472                         "net ads changetrustpw\n"
2473                         "    Change trust account password"
2474                 },
2475                 {
2476                         "printer",
2477                         net_ads_printer,
2478                         NET_TRANSPORT_ADS,
2479                         "List/modify printer entries",
2480                         "net ads printer\n"
2481                         "    List/modify printer entries"
2482                 },
2483                 {
2484                         "search",
2485                         net_ads_search,
2486                         NET_TRANSPORT_ADS,
2487                         "Issue LDAP search using filter",
2488                         "net ads search\n"
2489                         "    Issue LDAP search using filter"
2490                 },
2491                 {
2492                         "dn",
2493                         net_ads_dn,
2494                         NET_TRANSPORT_ADS,
2495                         "Issue LDAP search by DN",
2496                         "net ads dn\n"
2497                         "    Issue LDAP search by DN"
2498                 },
2499                 {
2500                         "sid",
2501                         net_ads_sid,
2502                         NET_TRANSPORT_ADS,
2503                         "Issue LDAP search by SID",
2504                         "net ads sid\n"
2505                         "    Issue LDAP search by SID"
2506                 },
2507                 {
2508                         "workgroup",
2509                         net_ads_workgroup,
2510                         NET_TRANSPORT_ADS,
2511                         "Display workgroup name",
2512                         "net ads workgroup\n"
2513                         "    Display the workgroup name"
2514                 },
2515                 {
2516                         "lookup",
2517                         net_ads_lookup,
2518                         NET_TRANSPORT_ADS,
2519                         "Perfom CLDAP query on DC",
2520                         "net ads lookup\n"
2521                         "    Find the ADS DC using CLDAP lookups"
2522                 },
2523                 {
2524                         "keytab",
2525                         net_ads_keytab,
2526                         NET_TRANSPORT_ADS,
2527                         "Manage local keytab file",
2528                         "net ads keytab\n"
2529                         "    Manage local keytab file"
2530                 },
2531                 {
2532                         "gpo",
2533                         net_ads_gpo,
2534                         NET_TRANSPORT_ADS,
2535                         "Manage group policy objects",
2536                         "net ads gpo\n"
2537                         "    Manage group policy objects"
2538                 },
2539                 {
2540                         "kerberos",
2541                         net_ads_kerberos,
2542                         NET_TRANSPORT_ADS,
2543                         "Manage kerberos keytab",
2544                         "net ads kerberos\n"
2545                         "    Manage kerberos keytab"
2546                 },
2547                 {NULL, NULL, 0, NULL, NULL}
2548         };
2549
2550         return net_run_function(c, argc, argv, "net ads", func);
2551 }
2552
2553 #else
2554
2555 static int net_ads_noads(void)
2556 {
2557         d_fprintf(stderr, "ADS support not compiled in\n");
2558         return -1;
2559 }
2560
2561 int net_ads_keytab(struct net_context *c, int argc, const char **argv)
2562 {
2563         return net_ads_noads();
2564 }
2565
2566 int net_ads_kerberos(struct net_context *c, int argc, const char **argv)
2567 {
2568         return net_ads_noads();
2569 }
2570
2571 int net_ads_changetrustpw(struct net_context *c, int argc, const char **argv)
2572 {
2573         return net_ads_noads();
2574 }
2575
2576 int net_ads_join(struct net_context *c, int argc, const char **argv)
2577 {
2578         return net_ads_noads();
2579 }
2580
2581 int net_ads_user(struct net_context *c, int argc, const char **argv)
2582 {
2583         return net_ads_noads();
2584 }
2585
2586 int net_ads_group(struct net_context *c, int argc, const char **argv)
2587 {
2588         return net_ads_noads();
2589 }
2590
2591 /* this one shouldn't display a message */
2592 int net_ads_check(struct net_context *c)
2593 {
2594         return -1;
2595 }
2596
2597 int net_ads_check_our_domain(struct net_context *c)
2598 {
2599         return -1;
2600 }
2601
2602 int net_ads(struct net_context *c, int argc, const char **argv)
2603 {
2604         return net_ads_noads();
2605 }
2606
2607 #endif  /* WITH_ADS */