source3/libnet/libnet_dssync_keytab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Guenther Deschner <gd@samba.org> 2008
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "libnet/libnet.h"
  22 #include "librpc/gen_ndr/ndr_drsblobs.h"
  23
  24 #if defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC)
  25
  26 static NTSTATUS add_to_keytab_entries(TALLOC_CTX *mem_ctx,
  27                                       struct libnet_keytab_context *ctx,
  28                                       uint32_t kvno,
  29                                       const char *name,
  30                                       const char *prefix,
  31                                       const krb5_enctype enctype,
  32                                       DATA_BLOB blob)
  33 {
  34         struct libnet_keytab_entry entry;
  35
  36         entry.kvno = kvno;
  37         entry.name = talloc_strdup(mem_ctx, name);
  38         entry.principal = talloc_asprintf(mem_ctx, "%s%s%s@%s",
  39                                           prefix ? prefix : "",
  40                                           prefix ? "/" : "",
  41                                           name, ctx->dns_domain_name);
  42         entry.enctype = enctype;
  43         entry.password = blob;
  44         NT_STATUS_HAVE_NO_MEMORY(entry.name);
  45         NT_STATUS_HAVE_NO_MEMORY(entry.principal);
  46         NT_STATUS_HAVE_NO_MEMORY(entry.password.data);
  47
  48         ADD_TO_ARRAY(mem_ctx, struct libnet_keytab_entry, entry,
  49                      &ctx->entries, &ctx->count);
  50         NT_STATUS_HAVE_NO_MEMORY(ctx->entries);
  51
  52         return NT_STATUS_OK;
  53 }
  54
  55 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
  56                                struct replUpToDateVectorBlob **pold_utdv)
  57 {
  58         krb5_error_code ret = 0;
  59         struct libnet_keytab_context *keytab_ctx;
  60         struct libnet_keytab_entry *entry;
  61         struct replUpToDateVectorBlob *old_utdv = NULL;
  62         char *principal;
  63
  64         ret = libnet_keytab_init(mem_ctx, ctx->output_filename, &keytab_ctx);
  65         if (ret) {
  66                 return krb5_to_nt_status(ret);
  67         }
  68
  69         keytab_ctx->dns_domain_name = ctx->dns_domain_name;
  70         keytab_ctx->clean_old_entries = ctx->clean_old_entries;
  71         ctx->private_data = keytab_ctx;
  72
  73         principal = talloc_asprintf(mem_ctx, "UTDV/%s@%s",
  74                                     ctx->nc_dn, ctx->dns_domain_name);
  75         NT_STATUS_HAVE_NO_MEMORY(principal);
  76
  77         entry = libnet_keytab_search(keytab_ctx, principal, 0, ENCTYPE_NULL,
  78                                      mem_ctx);
  79         if (entry) {
  80                 enum ndr_err_code ndr_err;
  81                 old_utdv = talloc(mem_ctx, struct replUpToDateVectorBlob);
  82
  83                 ndr_err = ndr_pull_struct_blob(&entry->password, old_utdv,
  84                                 old_utdv,
  85                                 (ndr_pull_flags_fn_t)ndr_pull_replUpToDateVectorBlob);
  86                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
  87                         NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
  88                         ctx->error_message = talloc_asprintf(mem_ctx,
  89                                         "Failed to pull UpToDateVector: %s",
  90                                         nt_errstr(status));
  91                         return status;
  92                 }
  93
  94                 if (DEBUGLEVEL >= 10) {
  95                         NDR_PRINT_DEBUG(replUpToDateVectorBlob, old_utdv);
  96                 }
  97         }
  98
  99         if (pold_utdv) {
 100                 *pold_utdv = old_utdv;
 101         }
 102
 103         return NT_STATUS_OK;
 104 }
 105
 106 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 107                               struct replUpToDateVectorBlob *new_utdv)
 108 {
 109         NTSTATUS status = NT_STATUS_OK;
 110         krb5_error_code ret = 0;
 111         struct libnet_keytab_context *keytab_ctx =
 112                 (struct libnet_keytab_context *)ctx->private_data;
 113
 114         if (new_utdv) {
 115                 enum ndr_err_code ndr_err;
 116                 DATA_BLOB blob;
 117
 118                 if (DEBUGLEVEL >= 10) {
 119                         NDR_PRINT_DEBUG(replUpToDateVectorBlob, new_utdv);
 120                 }
 121
 122                 ndr_err = ndr_push_struct_blob(&blob, mem_ctx, new_utdv,
 123                                 (ndr_push_flags_fn_t)ndr_push_replUpToDateVectorBlob);
 124                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 125                         status = ndr_map_error2ntstatus(ndr_err);
 126                         ctx->error_message = talloc_asprintf(mem_ctx,
 127                                         "Failed to push UpToDateVector: %s",
 128                                         nt_errstr(status));
 129                         goto done;
 130                 }
 131
 132                 status = add_to_keytab_entries(mem_ctx, keytab_ctx, 0,
 133                                                ctx->nc_dn, "UTDV",
 134                                                ENCTYPE_NULL,
 135                                                blob);
 136                 if (!NT_STATUS_IS_OK(status)) {
 137                         goto done;
 138                 }
 139         }
 140
 141         ret = libnet_keytab_add(keytab_ctx);
 142         if (ret) {
 143                 status = krb5_to_nt_status(ret);
 144                 ctx->error_message = talloc_asprintf(mem_ctx,
 145                         "Failed to add entries to keytab %s: %s",
 146                         keytab_ctx->keytab_name, error_message(ret));
 147                 goto done;
 148         }
 149
 150         ctx->result_message = talloc_asprintf(mem_ctx,
 151                 "Vampired %d accounts to keytab %s",
 152                 keytab_ctx->count,
 153                 keytab_ctx->keytab_name);
 154
 155 done:
 156         TALLOC_FREE(keytab_ctx);
 157         return status;
 158 }
 159
 160 /****************************************************************
 161 ****************************************************************/
 162
 163 static  NTSTATUS parse_supplemental_credentials(TALLOC_CTX *mem_ctx,
 164                         const DATA_BLOB *blob,
 165                         struct package_PrimaryKerberosCtr3 **pkb3,
 166                         struct package_PrimaryKerberosCtr4 **pkb4)
 167 {
 168         NTSTATUS status;
 169         enum ndr_err_code ndr_err;
 170         struct supplementalCredentialsBlob scb;
 171         struct supplementalCredentialsPackage *scpk = NULL;
 172         DATA_BLOB scpk_blob;
 173         struct package_PrimaryKerberosBlob *pkb;
 174         bool newer_keys = false;
 175         uint32_t j;
 176
 177         ndr_err = ndr_pull_struct_blob_all(blob, mem_ctx, &scb,
 178                         (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
 179         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 180                 status = ndr_map_error2ntstatus(ndr_err);
 181                 goto done;
 182         }
 183         if (scb.sub.signature !=
 184             SUPPLEMENTAL_CREDENTIALS_SIGNATURE)
 185         {
 186                 if (DEBUGLEVEL >= 10) {
 187                         NDR_PRINT_DEBUG(supplementalCredentialsBlob, &scb);
 188                 }
 189                 status = NT_STATUS_INVALID_PARAMETER;
 190                 goto done;
 191         }
 192         for (j=0; j < scb.sub.num_packages; j++) {
 193                 if (strcmp("Primary:Kerberos-Newer-Keys",
 194                     scb.sub.packages[j].name) == 0)
 195                 {
 196                         scpk = &scb.sub.packages[j];
 197                         if (!scpk->data || !scpk->data[0]) {
 198                                 scpk = NULL;
 199                                 continue;
 200                         }
 201                         newer_keys = true;
 202                         break;
 203                 } else  if (strcmp("Primary:Kerberos",
 204                                    scb.sub.packages[j].name) == 0)
 205                 {
 206                         /*
 207                          * grab this but don't break here:
 208                          * there might still be newer-keys ...
 209                          */
 210                         scpk = &scb.sub.packages[j];
 211                         if (!scpk->data || !scpk->data[0]) {
 212                                 scpk = NULL;
 213                         }
 214                 }
 215         }
 216
 217         if (!scpk) {
 218                 /* no data */
 219                 status = NT_STATUS_OK;
 220                 goto done;
 221         }
 222
 223         scpk_blob = strhex_to_data_blob(mem_ctx, scpk->data);
 224         if (!scpk_blob.data) {
 225                 status = NT_STATUS_NO_MEMORY;
 226                 goto done;
 227         }
 228
 229         pkb = TALLOC_ZERO_P(mem_ctx, struct package_PrimaryKerberosBlob);
 230         if (!pkb) {
 231                 status = NT_STATUS_NO_MEMORY;
 232                 goto done;
 233         }
 234         ndr_err = ndr_pull_struct_blob(&scpk_blob, mem_ctx, pkb,
 235                         (ndr_pull_flags_fn_t)ndr_pull_package_PrimaryKerberosBlob);
 236         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 237                 status = ndr_map_error2ntstatus(ndr_err);
 238                 goto done;
 239         }
 240
 241         if (!newer_keys && pkb->version != 3) {
 242                 status = NT_STATUS_INVALID_PARAMETER;
 243                 goto done;
 244         }
 245
 246         if (newer_keys && pkb->version != 4) {
 247                 status = NT_STATUS_INVALID_PARAMETER;
 248                 goto done;
 249         }
 250
 251         if (pkb->version == 4 && pkb4) {
 252                 *pkb4 = &pkb->ctr.ctr4;
 253         } else if (pkb->version == 3 && pkb3) {
 254                 *pkb3 = &pkb->ctr.ctr3;
 255         }
 256
 257         status = NT_STATUS_OK;
 258
 259 done:
 260         return status;
 261 }
 262
 263 static NTSTATUS parse_object(TALLOC_CTX *mem_ctx,
 264                              struct libnet_keytab_context *ctx,
 265                              struct drsuapi_DsReplicaObjectListItemEx *cur)
 266 {
 267         NTSTATUS status = NT_STATUS_OK;
 268         uchar nt_passwd[16];
 269         DATA_BLOB *blob;
 270         int i = 0;
 271         struct drsuapi_DsReplicaAttribute *attr;
 272         bool got_pwd = false;
 273
 274         struct package_PrimaryKerberosCtr3 *pkb3 = NULL;
 275         struct package_PrimaryKerberosCtr4 *pkb4 = NULL;
 276
 277         char *object_dn = NULL;
 278         char *upn = NULL;
 279         char **spn = NULL;
 280         uint32_t num_spns = 0;
 281         char *name = NULL;
 282         uint32_t kvno = 0;
 283         uint32_t uacc = 0;
 284         uint32_t sam_type = 0;
 285
 286         uint32_t pwd_history_len = 0;
 287         uint8_t *pwd_history = NULL;
 288
 289         ZERO_STRUCT(nt_passwd);
 290
 291         object_dn = talloc_strdup(mem_ctx, cur->object.identifier->dn);
 292         if (!object_dn) {
 293                 return NT_STATUS_NO_MEMORY;
 294         }
 295
 296         DEBUG(3, ("parsing object '%s'\n", object_dn));
 297
 298         for (i=0; i < cur->object.attribute_ctr.num_attributes; i++) {
 299
 300                 attr = &cur->object.attribute_ctr.attributes[i];
 301
 302                 if (attr->attid == DRSUAPI_ATTRIBUTE_servicePrincipalName) {
 303                         uint32_t count;
 304                         num_spns = attr->value_ctr.num_values;
 305                         spn = TALLOC_ARRAY(mem_ctx, char *, num_spns);
 306                         for (count = 0; count < num_spns; count++) {
 307                                 blob = attr->value_ctr.values[count].blob;
 308                                 pull_string_talloc(spn, NULL, 0,
 309                                                    &spn[count],
 310                                                    blob->data, blob->length,
 311                                                    STR_UNICODE);
 312                         }
 313                 }
 314
 315                 if (attr->value_ctr.num_values != 1) {
 316                         continue;
 317                 }
 318
 319                 if (!attr->value_ctr.values[0].blob) {
 320                         continue;
 321                 }
 322
 323                 blob = attr->value_ctr.values[0].blob;
 324
 325                 switch (attr->attid) {
 326                         case DRSUAPI_ATTRIBUTE_unicodePwd:
 327
 328                                 if (blob->length != 16) {
 329                                         break;
 330                                 }
 331
 332                                 memcpy(&nt_passwd, blob->data, 16);
 333                                 got_pwd = true;
 334
 335                                 /* pick the kvno from the meta_data version,
 336                                  * thanks, metze, for explaining this */
 337
 338                                 if (!cur->meta_data_ctr) {
 339                                         break;
 340                                 }
 341                                 if (cur->meta_data_ctr->count !=
 342                                     cur->object.attribute_ctr.num_attributes) {
 343                                         break;
 344                                 }
 345                                 kvno = cur->meta_data_ctr->meta_data[i].version;
 346                                 break;
 347                         case DRSUAPI_ATTRIBUTE_ntPwdHistory:
 348                                 pwd_history_len = blob->length / 16;
 349                                 pwd_history = blob->data;
 350                                 break;
 351                         case DRSUAPI_ATTRIBUTE_userPrincipalName:
 352                                 pull_string_talloc(mem_ctx, NULL, 0, &upn,
 353                                                    blob->data, blob->length,
 354                                                    STR_UNICODE);
 355                                 break;
 356                         case DRSUAPI_ATTRIBUTE_sAMAccountName:
 357                                 pull_string_talloc(mem_ctx, NULL, 0, &name,
 358                                                    blob->data, blob->length,
 359                                                    STR_UNICODE);
 360                                 break;
 361                         case DRSUAPI_ATTRIBUTE_sAMAccountType:
 362                                 sam_type = IVAL(blob->data, 0);
 363                                 break;
 364                         case DRSUAPI_ATTRIBUTE_userAccountControl:
 365                                 uacc = IVAL(blob->data, 0);
 366                                 break;
 367                         case DRSUAPI_ATTRIBUTE_supplementalCredentials:
 368                                 status = parse_supplemental_credentials(mem_ctx,
 369                                                                         blob,
 370                                                                         &pkb3,
 371                                                                         &pkb4);
 372                                 if (!NT_STATUS_IS_OK(status)) {
 373                                         DEBUG(2, ("parsing of supplemental "
 374                                                   "credentials failed: %s\n",
 375                                                   nt_errstr(status)));
 376                                 }
 377                                 break;
 378                         default:
 379                                 break;
 380                 }
 381         }
 382
 383         if (!got_pwd) {
 384                 DEBUG(10, ("no password (unicodePwd) found - skipping.\n"));
 385                 return NT_STATUS_OK;
 386         }
 387
 388         if (name) {
 389                 status = add_to_keytab_entries(mem_ctx, ctx, 0, object_dn,
 390                                                "SAMACCOUNTNAME",
 391                                                ENCTYPE_NULL,
 392                                                data_blob_talloc(mem_ctx, name,
 393                                                         strlen(name) + 1));
 394                 if (!NT_STATUS_IS_OK(status)) {
 395                         return status;
 396                 }
 397         } else {
 398                 /* look into keytab ... */
 399                 struct libnet_keytab_entry *entry = NULL;
 400                 char *principal = NULL;
 401
 402                 DEBUG(10, ("looking for SAMACCOUNTNAME/%s@%s in keytayb...\n",
 403                            object_dn, ctx->dns_domain_name));
 404
 405                 principal = talloc_asprintf(mem_ctx, "%s/%s@%s",
 406                                             "SAMACCOUNTNAME",
 407                                             object_dn,
 408                                             ctx->dns_domain_name);
 409                 if (!principal) {
 410                         DEBUG(1, ("talloc failed\n"));
 411                         return NT_STATUS_NO_MEMORY;
 412                 }
 413                 entry = libnet_keytab_search(ctx, principal, 0, ENCTYPE_NULL,
 414                                              mem_ctx);
 415                 if (entry) {
 416                         name = (char *)TALLOC_MEMDUP(mem_ctx,
 417                                                      entry->password.data,
 418                                                      entry->password.length);
 419                         if (!name) {
 420                                 DEBUG(1, ("talloc failed!"));
 421                                 return NT_STATUS_NO_MEMORY;
 422                         } else {
 423                                 DEBUG(10, ("found name %s\n", name));
 424                         }
 425                         TALLOC_FREE(entry);
 426                 } else {
 427                         DEBUG(10, ("entry not found\n"));
 428                 }
 429                 TALLOC_FREE(principal);
 430         }
 431
 432         if (!name) {
 433                 DEBUG(10, ("no name (sAMAccountName) found - skipping.\n"));
 434                 return NT_STATUS_OK;
 435         }
 436
 437         DEBUG(1,("#%02d: %s:%d, ", ctx->count, name, kvno));
 438         DEBUGADD(1,("sAMAccountType: 0x%08x, userAccountControl: 0x%08x",
 439                 sam_type, uacc));
 440         if (upn) {
 441                 DEBUGADD(1,(", upn: %s", upn));
 442         }
 443         if (num_spns > 0) {
 444                 DEBUGADD(1, (", spns: ["));
 445                 for (i = 0; i < num_spns; i++) {
 446                         DEBUGADD(1, ("%s%s", spn[i],
 447                                      (i+1 == num_spns)?"]":", "));
 448                 }
 449         }
 450         DEBUGADD(1,("\n"));
 451
 452         status = add_to_keytab_entries(mem_ctx, ctx, kvno, name, NULL,
 453                                        ENCTYPE_ARCFOUR_HMAC,
 454                                        data_blob_talloc(mem_ctx, nt_passwd, 16));
 455
 456         if (!NT_STATUS_IS_OK(status)) {
 457                 return status;
 458         }
 459
 460         /* add kerberos keys (if any) */
 461
 462         if (pkb4) {
 463                 for (i=0; i < pkb4->num_keys; i++) {
 464                         if (!pkb4->keys[i].value) {
 465                                 continue;
 466                         }
 467                         status = add_to_keytab_entries(mem_ctx, ctx, kvno,
 468                                                        name,
 469                                                        NULL,
 470                                                        pkb4->keys[i].keytype,
 471                                                        *pkb4->keys[i].value);
 472                         if (!NT_STATUS_IS_OK(status)) {
 473                                 return status;
 474                         }
 475                 }
 476                 for (i=0; i < pkb4->num_old_keys; i++) {
 477                         if (!pkb4->old_keys[i].value) {
 478                                 continue;
 479                         }
 480                         status = add_to_keytab_entries(mem_ctx, ctx, kvno - 1,
 481                                                        name,
 482                                                        NULL,
 483                                                        pkb4->old_keys[i].keytype,
 484                                                        *pkb4->old_keys[i].value);
 485                         if (!NT_STATUS_IS_OK(status)) {
 486                                 return status;
 487                         }
 488                 }
 489                 for (i=0; i < pkb4->num_older_keys; i++) {
 490                         if (!pkb4->older_keys[i].value) {
 491                                 continue;
 492                         }
 493                         status = add_to_keytab_entries(mem_ctx, ctx, kvno - 2,
 494                                                        name,
 495                                                        NULL,
 496                                                        pkb4->older_keys[i].keytype,
 497                                                        *pkb4->older_keys[i].value);
 498                         if (!NT_STATUS_IS_OK(status)) {
 499                                 return status;
 500                         }
 501                 }
 502         }
 503
 504         if (pkb3) {
 505                 for (i=0; i < pkb3->num_keys; i++) {
 506                         if (!pkb3->keys[i].value) {
 507                                 continue;
 508                         }
 509                         status = add_to_keytab_entries(mem_ctx, ctx, kvno, name,
 510                                                        NULL,
 511                                                        pkb3->keys[i].keytype,
 512                                                        *pkb3->keys[i].value);
 513                         if (!NT_STATUS_IS_OK(status)) {
 514                                 return status;
 515                         }
 516                 }
 517                 for (i=0; i < pkb3->num_old_keys; i++) {
 518                         if (!pkb3->old_keys[i].value) {
 519                                 continue;
 520                         }
 521                         status = add_to_keytab_entries(mem_ctx, ctx, kvno - 1,
 522                                                        name,
 523                                                        NULL,
 524                                                        pkb3->old_keys[i].keytype,
 525                                                        *pkb3->old_keys[i].value);
 526                         if (!NT_STATUS_IS_OK(status)) {
 527                                 return status;
 528                         }
 529                 }
 530         }
 531
 532         if ((kvno < 0) && (kvno < pwd_history_len)) {
 533                 return status;
 534         }
 535
 536         /* add password history */
 537
 538         /* skip first entry */
 539         if (got_pwd) {
 540                 kvno--;
 541                 i = 1;
 542         } else {
 543                 i = 0;
 544         }
 545
 546         for (; i<pwd_history_len; i++) {
 547                 status = add_to_keytab_entries(mem_ctx, ctx, kvno--, name, NULL,
 548                                 ENCTYPE_ARCFOUR_HMAC,
 549                                 data_blob_talloc(mem_ctx, &pwd_history[i*16], 16));
 550                 if (!NT_STATUS_IS_OK(status)) {
 551                         break;
 552                 }
 553         }
 554
 555         return status;
 556 }
 557
 558 static bool dn_is_in_object_list(struct dssync_context *ctx,
 559                                  const char *dn)
 560 {
 561         uint32_t count;
 562
 563         if (ctx->object_count == 0) {
 564                 return true;
 565         }
 566
 567         for (count = 0; count < ctx->object_count; count++) {
 568                 if (strequal(ctx->object_dns[count], dn)) {
 569                         return true;
 570                 }
 571         }
 572
 573         return false;
 574 }
 575
 576 /****************************************************************
 577 ****************************************************************/
 578
 579 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
 580                                        TALLOC_CTX *mem_ctx,
 581                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
 582                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
 583 {
 584         NTSTATUS status = NT_STATUS_OK;
 585         struct libnet_keytab_context *keytab_ctx =
 586                 (struct libnet_keytab_context *)ctx->private_data;
 587
 588         for (; cur; cur = cur->next_object) {
 589                 /*
 590                  * When not in single object replication mode,
 591                  * the object_dn list is used as a positive write filter.
 592                  */
 593                 if (!ctx->single_object_replication &&
 594                     !dn_is_in_object_list(ctx, cur->object.identifier->dn))
 595                 {
 596                         continue;
 597                 }
 598
 599                 status = parse_object(mem_ctx, keytab_ctx, cur);
 600                 if (!NT_STATUS_IS_OK(status)) {
 601                         goto out;
 602                 }
 603         }
 604
 605  out:
 606         return status;
 607 }
 608
 609 #else
 610
 611 static NTSTATUS keytab_startup(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 612                                struct replUpToDateVectorBlob **pold_utdv)
 613 {
 614         return NT_STATUS_NOT_SUPPORTED;
 615 }
 616
 617 static NTSTATUS keytab_finish(struct dssync_context *ctx, TALLOC_CTX *mem_ctx,
 618                               struct replUpToDateVectorBlob *new_utdv)
 619 {
 620         return NT_STATUS_NOT_SUPPORTED;
 621 }
 622
 623 static NTSTATUS keytab_process_objects(struct dssync_context *ctx,
 624                                        TALLOC_CTX *mem_ctx,
 625                                        struct drsuapi_DsReplicaObjectListItemEx *cur,
 626                                        struct drsuapi_DsReplicaOIDMapping_Ctr *mapping_ctr)
 627 {
 628         return NT_STATUS_NOT_SUPPORTED;
 629 }
 630 #endif /* defined(HAVE_ADS) && defined(ENCTYPE_ARCFOUR_HMAC) */
 631
 632 const struct dssync_ops libnet_dssync_keytab_ops = {
 633         .startup                = keytab_startup,
 634         .process_objects        = keytab_process_objects,
 635         .finish                 = keytab_finish,
 636 };