2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Copyright (C) Andrew Tridgell 1992-1997,
5 * Copyright (C) Luke Kenneth Casson Leighton 1996-1997,
6 * Copyright (C) Paul Ashton 1997,
7 * Copyright (C) Marc Jacobsen 1999,
8 * Copyright (C) Jeremy Allison 2001-2008,
9 * Copyright (C) Jean François Micouleau 1998-2001,
10 * Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002,
11 * Copyright (C) Gerald (Jerry) Carter 2003-2004,
12 * Copyright (C) Simo Sorce 2003.
13 * Copyright (C) Volker Lendecke 2005.
14 * Copyright (C) Guenther Deschner 2008.
16 * This program is free software; you can redistribute it and/or modify
17 * it under the terms of the GNU General Public License as published by
18 * the Free Software Foundation; either version 3 of the License, or
19 * (at your option) any later version.
21 * This program is distributed in the hope that it will be useful,
22 * but WITHOUT ANY WARRANTY; without even the implied warranty of
23 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
24 * GNU General Public License for more details.
26 * You should have received a copy of the GNU General Public License
27 * along with this program; if not, see <http://www.gnu.org/licenses/>.
31 * This is the implementation of the SAMR code.
37 #define DBGC_CLASS DBGC_RPC_SRV
39 #define SAMR_USR_RIGHTS_WRITE_PW \
40 ( READ_CONTROL_ACCESS | \
41 SAMR_USER_ACCESS_CHANGE_PASSWORD | \
42 SAMR_USER_ACCESS_SET_LOC_COM)
43 #define SAMR_USR_RIGHTS_CANT_WRITE_PW \
44 ( READ_CONTROL_ACCESS | SAMR_USER_ACCESS_SET_LOC_COM )
46 #define DISP_INFO_CACHE_TIMEOUT 10
48 typedef struct disp_info {
49 DOM_SID sid; /* identify which domain this is. */
50 bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
51 struct pdb_search *users; /* querydispinfo 1 and 4 */
52 struct pdb_search *machines; /* querydispinfo 2 */
53 struct pdb_search *groups; /* querydispinfo 3 and 5, enumgroups */
54 struct pdb_search *aliases; /* enumaliases */
57 struct pdb_search *enum_users; /* enumusers with a mask */
59 struct timed_event *cache_timeout_event; /* cache idle timeout
63 /* We keep a static list of these by SID as modern clients close down
64 all resources between each request in a complete enumeration. */
67 /* for use by the \PIPE\samr policy */
69 bool builtin_domain; /* Quick flag to check if this is the builtin domain. */
70 uint32 status; /* some sort of flag. best to record it. comes from opnum 0x39 */
76 static const struct generic_mapping sam_generic_mapping = {
77 GENERIC_RIGHTS_SAM_READ,
78 GENERIC_RIGHTS_SAM_WRITE,
79 GENERIC_RIGHTS_SAM_EXECUTE,
80 GENERIC_RIGHTS_SAM_ALL_ACCESS};
81 static const struct generic_mapping dom_generic_mapping = {
82 GENERIC_RIGHTS_DOMAIN_READ,
83 GENERIC_RIGHTS_DOMAIN_WRITE,
84 GENERIC_RIGHTS_DOMAIN_EXECUTE,
85 GENERIC_RIGHTS_DOMAIN_ALL_ACCESS};
86 static const struct generic_mapping usr_generic_mapping = {
87 GENERIC_RIGHTS_USER_READ,
88 GENERIC_RIGHTS_USER_WRITE,
89 GENERIC_RIGHTS_USER_EXECUTE,
90 GENERIC_RIGHTS_USER_ALL_ACCESS};
91 static const struct generic_mapping usr_nopwchange_generic_mapping = {
92 GENERIC_RIGHTS_USER_READ,
93 GENERIC_RIGHTS_USER_WRITE,
94 GENERIC_RIGHTS_USER_EXECUTE & ~SAMR_USER_ACCESS_CHANGE_PASSWORD,
95 GENERIC_RIGHTS_USER_ALL_ACCESS};
96 static const struct generic_mapping grp_generic_mapping = {
97 GENERIC_RIGHTS_GROUP_READ,
98 GENERIC_RIGHTS_GROUP_WRITE,
99 GENERIC_RIGHTS_GROUP_EXECUTE,
100 GENERIC_RIGHTS_GROUP_ALL_ACCESS};
101 static const struct generic_mapping ali_generic_mapping = {
102 GENERIC_RIGHTS_ALIAS_READ,
103 GENERIC_RIGHTS_ALIAS_WRITE,
104 GENERIC_RIGHTS_ALIAS_EXECUTE,
105 GENERIC_RIGHTS_ALIAS_ALL_ACCESS};
107 /*******************************************************************
108 *******************************************************************/
110 static NTSTATUS make_samr_object_sd( TALLOC_CTX *ctx, SEC_DESC **psd, size_t *sd_size,
111 const struct generic_mapping *map,
112 DOM_SID *sid, uint32 sid_access )
114 DOM_SID domadmin_sid;
115 SEC_ACE ace[5]; /* at most 5 entries */
120 /* basic access for Everyone */
122 init_sec_ace(&ace[i++], &global_sid_World, SEC_ACE_TYPE_ACCESS_ALLOWED,
123 map->generic_execute | map->generic_read, 0);
125 /* add Full Access 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
127 init_sec_ace(&ace[i++], &global_sid_Builtin_Administrators,
128 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
129 init_sec_ace(&ace[i++], &global_sid_Builtin_Account_Operators,
130 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
132 /* Add Full Access for Domain Admins if we are a DC */
135 sid_copy( &domadmin_sid, get_global_sam_sid() );
136 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
137 init_sec_ace(&ace[i++], &domadmin_sid,
138 SEC_ACE_TYPE_ACCESS_ALLOWED, map->generic_all, 0);
141 /* if we have a sid, give it some special access */
144 init_sec_ace(&ace[i++], sid, SEC_ACE_TYPE_ACCESS_ALLOWED, sid_access, 0);
147 /* create the security descriptor */
149 if ((psa = make_sec_acl(ctx, NT4_ACL_REVISION, i, ace)) == NULL)
150 return NT_STATUS_NO_MEMORY;
152 if ((*psd = make_sec_desc(ctx, SECURITY_DESCRIPTOR_REVISION_1,
153 SEC_DESC_SELF_RELATIVE, NULL, NULL, NULL,
154 psa, sd_size)) == NULL)
155 return NT_STATUS_NO_MEMORY;
160 /*******************************************************************
161 Checks if access to an object should be granted, and returns that
162 level of access for further checks.
163 ********************************************************************/
165 static NTSTATUS access_check_samr_object( SEC_DESC *psd, NT_USER_TOKEN *token,
166 SE_PRIV *rights, uint32 rights_mask,
167 uint32 des_access, uint32 *acc_granted,
170 NTSTATUS status = NT_STATUS_ACCESS_DENIED;
171 uint32 saved_mask = 0;
173 /* check privileges; certain SAM access bits should be overridden
174 by privileges (mostly having to do with creating/modifying/deleting
177 if ( rights && user_has_any_privilege( token, rights ) ) {
179 saved_mask = (des_access & rights_mask);
180 des_access &= ~saved_mask;
182 DEBUG(4,("access_check_samr_object: user rights access mask [0x%x]\n",
187 /* check the security descriptor first */
189 status = se_access_check(psd, token, des_access, acc_granted);
190 if (NT_STATUS_IS_OK(status)) {
194 /* give root a free pass */
196 if ( geteuid() == sec_initial_uid() ) {
198 DEBUG(4,("%s: ACCESS should be DENIED (requested: %#010x)\n", debug, des_access));
199 DEBUGADD(4,("but overritten by euid == sec_initial_uid()\n"));
201 *acc_granted = des_access;
203 status = NT_STATUS_OK;
209 /* add in any bits saved during the privilege check (only
210 matters is status is ok) */
212 *acc_granted |= rights_mask;
214 DEBUG(4,("%s: access %s (requested: 0x%08x, granted: 0x%08x)\n",
215 debug, NT_STATUS_IS_OK(status) ? "GRANTED" : "DENIED",
216 des_access, *acc_granted));
221 /*******************************************************************
222 Checks if access to a function can be granted
223 ********************************************************************/
225 static NTSTATUS access_check_samr_function(uint32 acc_granted, uint32 acc_required, const char *debug)
227 DEBUG(5,("%s: access check ((granted: %#010x; required: %#010x)\n",
228 debug, acc_granted, acc_required));
230 /* check the security descriptor first */
232 if ( (acc_granted&acc_required) == acc_required )
235 /* give root a free pass */
237 if (geteuid() == sec_initial_uid()) {
239 DEBUG(4,("%s: ACCESS should be DENIED (granted: %#010x; required: %#010x)\n",
240 debug, acc_granted, acc_required));
241 DEBUGADD(4,("but overwritten by euid == 0\n"));
246 DEBUG(2,("%s: ACCESS DENIED (granted: %#010x; required: %#010x)\n",
247 debug, acc_granted, acc_required));
249 return NT_STATUS_ACCESS_DENIED;
252 /*******************************************************************
253 Map any MAXIMUM_ALLOWED_ACCESS request to a valid access set.
254 ********************************************************************/
256 static void map_max_allowed_access(const NT_USER_TOKEN *token,
257 uint32_t *pacc_requested)
259 if (!((*pacc_requested) & MAXIMUM_ALLOWED_ACCESS)) {
262 *pacc_requested &= ~MAXIMUM_ALLOWED_ACCESS;
264 /* At least try for generic read. */
265 *pacc_requested = GENERIC_READ_ACCESS;
267 /* root gets anything. */
268 if (geteuid() == sec_initial_uid()) {
269 *pacc_requested |= GENERIC_ALL_ACCESS;
273 /* Full Access for 'BUILTIN\Administrators' and 'BUILTIN\Account Operators */
275 if (is_sid_in_token(token, &global_sid_Builtin_Administrators) ||
276 is_sid_in_token(token, &global_sid_Builtin_Account_Operators)) {
277 *pacc_requested |= GENERIC_ALL_ACCESS;
281 /* Full access for DOMAIN\Domain Admins. */
283 DOM_SID domadmin_sid;
284 sid_copy( &domadmin_sid, get_global_sam_sid() );
285 sid_append_rid( &domadmin_sid, DOMAIN_GROUP_RID_ADMINS );
286 if (is_sid_in_token(token, &domadmin_sid)) {
287 *pacc_requested |= GENERIC_ALL_ACCESS;
291 /* TODO ! Check privileges. */
294 /*******************************************************************
295 Fetch or create a dispinfo struct.
296 ********************************************************************/
298 static DISP_INFO *get_samr_dispinfo_by_sid(DOM_SID *psid)
301 * We do a static cache for DISP_INFO's here. Explanation can be found
302 * in Jeremy's checkin message to r11793:
304 * Fix the SAMR cache so it works across completely insane
305 * client behaviour (ie.:
306 * open pipe/open SAMR handle/enumerate 0 - 1024
307 * close SAMR handle, close pipe.
308 * open pipe/open SAMR handle/enumerate 1024 - 2048...
309 * close SAMR handle, close pipe.
310 * And on ad-nausium. Amazing.... probably object-oriented
311 * client side programming in action yet again.
312 * This change should *massively* improve performance when
313 * enumerating users from an LDAP database.
316 * "Our" and the builtin domain are the only ones where we ever
317 * enumerate stuff, so just cache 2 entries.
320 static struct disp_info builtin_dispinfo;
321 static struct disp_info domain_dispinfo;
323 /* There are two cases to consider here:
324 1) The SID is a domain SID and we look for an equality match, or
325 2) This is an account SID and so we return the DISP_INFO* for our
332 if (sid_check_is_builtin(psid) || sid_check_is_in_builtin(psid)) {
334 * Necessary only once, but it does not really hurt.
336 sid_copy(&builtin_dispinfo.sid, &global_sid_Builtin);
338 return &builtin_dispinfo;
341 if (sid_check_is_domain(psid) || sid_check_is_in_our_domain(psid)) {
343 * Necessary only once, but it does not really hurt.
345 sid_copy(&domain_dispinfo.sid, get_global_sam_sid());
347 return &domain_dispinfo;
353 /*******************************************************************
354 Create a samr_info struct.
355 ********************************************************************/
357 static struct samr_info *get_samr_info_by_sid(DOM_SID *psid)
359 struct samr_info *info;
364 sid_to_fstring(sid_str, psid);
366 fstrcpy(sid_str,"(NULL)");
369 mem_ctx = talloc_init("samr_info for domain sid %s", sid_str);
371 if ((info = TALLOC_ZERO_P(mem_ctx, struct samr_info)) == NULL)
374 DEBUG(10,("get_samr_info_by_sid: created new info for sid %s\n", sid_str));
376 sid_copy( &info->sid, psid);
377 info->builtin_domain = sid_check_is_builtin(psid);
379 DEBUG(10,("get_samr_info_by_sid: created new info for NULL sid.\n"));
380 info->builtin_domain = False;
382 info->mem_ctx = mem_ctx;
384 info->disp_info = get_samr_dispinfo_by_sid(psid);
389 /*******************************************************************
390 Function to free the per SID data.
391 ********************************************************************/
393 static void free_samr_cache(DISP_INFO *disp_info)
395 DEBUG(10, ("free_samr_cache: deleting cache for SID %s\n",
396 sid_string_dbg(&disp_info->sid)));
398 /* We need to become root here because the paged search might have to
399 * tell the LDAP server we're not interested in the rest anymore. */
403 if (disp_info->users) {
404 DEBUG(10,("free_samr_cache: deleting users cache\n"));
405 pdb_search_destroy(disp_info->users);
406 disp_info->users = NULL;
408 if (disp_info->machines) {
409 DEBUG(10,("free_samr_cache: deleting machines cache\n"));
410 pdb_search_destroy(disp_info->machines);
411 disp_info->machines = NULL;
413 if (disp_info->groups) {
414 DEBUG(10,("free_samr_cache: deleting groups cache\n"));
415 pdb_search_destroy(disp_info->groups);
416 disp_info->groups = NULL;
418 if (disp_info->aliases) {
419 DEBUG(10,("free_samr_cache: deleting aliases cache\n"));
420 pdb_search_destroy(disp_info->aliases);
421 disp_info->aliases = NULL;
423 if (disp_info->enum_users) {
424 DEBUG(10,("free_samr_cache: deleting enum_users cache\n"));
425 pdb_search_destroy(disp_info->enum_users);
426 disp_info->enum_users = NULL;
428 disp_info->enum_acb_mask = 0;
433 /*******************************************************************
434 Function to free the per handle data.
435 ********************************************************************/
437 static void free_samr_info(void *ptr)
439 struct samr_info *info=(struct samr_info *) ptr;
441 /* Only free the dispinfo cache if no one bothered to set up
444 if (info->disp_info && info->disp_info->cache_timeout_event == NULL) {
445 free_samr_cache(info->disp_info);
448 talloc_destroy(info->mem_ctx);
451 /*******************************************************************
452 Idle event handler. Throw away the disp info cache.
453 ********************************************************************/
455 static void disp_info_cache_idle_timeout_handler(struct event_context *ev_ctx,
456 struct timed_event *te,
460 DISP_INFO *disp_info = (DISP_INFO *)private_data;
462 TALLOC_FREE(disp_info->cache_timeout_event);
464 DEBUG(10, ("disp_info_cache_idle_timeout_handler: caching timed "
466 free_samr_cache(disp_info);
469 /*******************************************************************
470 Setup cache removal idle event handler.
471 ********************************************************************/
473 static void set_disp_info_cache_timeout(DISP_INFO *disp_info, time_t secs_fromnow)
475 /* Remove any pending timeout and update. */
477 TALLOC_FREE(disp_info->cache_timeout_event);
479 DEBUG(10,("set_disp_info_cache_timeout: caching enumeration for "
480 "SID %s for %u seconds\n", sid_string_dbg(&disp_info->sid),
481 (unsigned int)secs_fromnow ));
483 disp_info->cache_timeout_event = event_add_timed(
484 smbd_event_context(), NULL,
485 timeval_current_ofs(secs_fromnow, 0),
486 disp_info_cache_idle_timeout_handler, (void *)disp_info);
489 /*******************************************************************
490 Force flush any cache. We do this on any samr_set_xxx call.
491 We must also remove the timeout handler.
492 ********************************************************************/
494 static void force_flush_samr_cache(DISP_INFO *disp_info)
496 if ((disp_info == NULL) || (disp_info->cache_timeout_event == NULL)) {
500 DEBUG(10,("force_flush_samr_cache: clearing idle event\n"));
501 TALLOC_FREE(disp_info->cache_timeout_event);
502 free_samr_cache(disp_info);
505 /*******************************************************************
506 Ensure password info is never given out. Paranioa... JRA.
507 ********************************************************************/
509 static void samr_clear_sam_passwd(struct samu *sam_pass)
515 /* These now zero out the old password */
517 pdb_set_lanman_passwd(sam_pass, NULL, PDB_DEFAULT);
518 pdb_set_nt_passwd(sam_pass, NULL, PDB_DEFAULT);
521 static uint32 count_sam_users(struct disp_info *info, uint32 acct_flags)
523 struct samr_displayentry *entry;
525 if (info->builtin_domain) {
526 /* No users in builtin. */
530 if (info->users == NULL) {
531 info->users = pdb_search_users(acct_flags);
532 if (info->users == NULL) {
536 /* Fetch the last possible entry, thus trigger an enumeration */
537 pdb_search_entries(info->users, 0xffffffff, 1, &entry);
539 /* Ensure we cache this enumeration. */
540 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
542 return info->users->num_entries;
545 static uint32 count_sam_groups(struct disp_info *info)
547 struct samr_displayentry *entry;
549 if (info->builtin_domain) {
550 /* No groups in builtin. */
554 if (info->groups == NULL) {
555 info->groups = pdb_search_groups();
556 if (info->groups == NULL) {
560 /* Fetch the last possible entry, thus trigger an enumeration */
561 pdb_search_entries(info->groups, 0xffffffff, 1, &entry);
563 /* Ensure we cache this enumeration. */
564 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
566 return info->groups->num_entries;
569 static uint32 count_sam_aliases(struct disp_info *info)
571 struct samr_displayentry *entry;
573 if (info->aliases == NULL) {
574 info->aliases = pdb_search_aliases(&info->sid);
575 if (info->aliases == NULL) {
579 /* Fetch the last possible entry, thus trigger an enumeration */
580 pdb_search_entries(info->aliases, 0xffffffff, 1, &entry);
582 /* Ensure we cache this enumeration. */
583 set_disp_info_cache_timeout(info, DISP_INFO_CACHE_TIMEOUT);
585 return info->aliases->num_entries;
588 /*******************************************************************
590 ********************************************************************/
592 NTSTATUS _samr_Close(pipes_struct *p, struct samr_Close *r)
594 if (!close_policy_hnd(p, r->in.handle)) {
595 return NT_STATUS_INVALID_HANDLE;
598 ZERO_STRUCTP(r->out.handle);
603 /*******************************************************************
605 ********************************************************************/
607 NTSTATUS _samr_OpenDomain(pipes_struct *p,
608 struct samr_OpenDomain *r)
610 struct samr_info *info;
611 SEC_DESC *psd = NULL;
613 uint32 des_access = r->in.access_mask;
618 /* find the connection policy handle. */
620 if ( !find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info) )
621 return NT_STATUS_INVALID_HANDLE;
623 /*check if access can be granted as requested by client. */
624 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
626 make_samr_object_sd( p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0 );
627 se_map_generic( &des_access, &dom_generic_mapping );
629 se_priv_copy( &se_rights, &se_machine_account );
630 se_priv_add( &se_rights, &se_add_users );
632 status = access_check_samr_object( psd, p->pipe_user.nt_user_token,
633 &se_rights, GENERIC_RIGHTS_DOMAIN_WRITE, des_access,
634 &acc_granted, "_samr_OpenDomain" );
636 if ( !NT_STATUS_IS_OK(status) )
639 if (!sid_check_is_domain(r->in.sid) &&
640 !sid_check_is_builtin(r->in.sid)) {
641 return NT_STATUS_NO_SUCH_DOMAIN;
644 /* associate the domain SID with the (unique) handle. */
645 if ((info = get_samr_info_by_sid(r->in.sid))==NULL)
646 return NT_STATUS_NO_MEMORY;
647 info->acc_granted = acc_granted;
649 /* get a (unique) handle. open a policy on it. */
650 if (!create_policy_hnd(p, r->out.domain_handle, free_samr_info, (void *)info))
651 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
653 DEBUG(5,("_samr_OpenDomain: %d\n", __LINE__));
658 /*******************************************************************
660 ********************************************************************/
662 NTSTATUS _samr_GetUserPwInfo(pipes_struct *p,
663 struct samr_GetUserPwInfo *r)
665 struct samr_info *info = NULL;
666 enum lsa_SidType sid_type;
667 uint32_t min_password_length = 0;
668 uint32_t password_properties = 0;
672 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
674 /* find the policy handle. open a policy on it. */
675 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info)) {
676 return NT_STATUS_INVALID_HANDLE;
679 status = access_check_samr_function(info->acc_granted,
680 SAMR_USER_ACCESS_GET_ATTRIBUTES,
681 "_samr_GetUserPwInfo" );
682 if (!NT_STATUS_IS_OK(status)) {
686 if (!sid_check_is_in_our_domain(&info->sid)) {
687 return NT_STATUS_OBJECT_TYPE_MISMATCH;
691 ret = lookup_sid(p->mem_ctx, &info->sid, NULL, NULL, &sid_type);
694 return NT_STATUS_NO_SUCH_USER;
700 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
701 &min_password_length);
702 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
703 &password_properties);
706 if (lp_check_password_script() && *lp_check_password_script()) {
707 password_properties |= DOMAIN_PASSWORD_COMPLEX;
715 r->out.info->min_password_length = min_password_length;
716 r->out.info->password_properties = password_properties;
718 DEBUG(5,("_samr_GetUserPwInfo: %d\n", __LINE__));
723 /*******************************************************************
724 ********************************************************************/
726 static bool get_lsa_policy_samr_sid( pipes_struct *p, POLICY_HND *pol,
727 DOM_SID *sid, uint32 *acc_granted,
728 DISP_INFO **ppdisp_info)
730 struct samr_info *info = NULL;
732 /* find the policy handle. open a policy on it. */
733 if (!find_policy_by_hnd(p, pol, (void **)(void *)&info))
740 *acc_granted = info->acc_granted;
742 *ppdisp_info = info->disp_info;
748 /*******************************************************************
750 ********************************************************************/
752 NTSTATUS _samr_SetSecurity(pipes_struct *p,
753 struct samr_SetSecurity *r)
756 uint32 acc_granted, i;
759 struct samu *sampass=NULL;
762 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
763 return NT_STATUS_INVALID_HANDLE;
765 if (!(sampass = samu_new( p->mem_ctx))) {
766 DEBUG(0,("No memory!\n"));
767 return NT_STATUS_NO_MEMORY;
770 /* get the user record */
772 ret = pdb_getsampwsid(sampass, &pol_sid);
776 DEBUG(4, ("User %s not found\n", sid_string_dbg(&pol_sid)));
777 TALLOC_FREE(sampass);
778 return NT_STATUS_INVALID_HANDLE;
781 dacl = r->in.sdbuf->sd->dacl;
782 for (i=0; i < dacl->num_aces; i++) {
783 if (sid_equal(&pol_sid, &dacl->aces[i].trustee)) {
784 ret = pdb_set_pass_can_change(sampass,
785 (dacl->aces[i].access_mask &
786 SAMR_USER_ACCESS_CHANGE_PASSWORD) ?
793 TALLOC_FREE(sampass);
794 return NT_STATUS_ACCESS_DENIED;
797 status = access_check_samr_function(acc_granted,
798 SAMR_USER_ACCESS_SET_ATTRIBUTES,
799 "_samr_SetSecurity");
800 if (NT_STATUS_IS_OK(status)) {
802 status = pdb_update_sam_account(sampass);
806 TALLOC_FREE(sampass);
811 /*******************************************************************
812 build correct perms based on policies and password times for _samr_query_sec_obj
813 *******************************************************************/
814 static bool check_change_pw_access(TALLOC_CTX *mem_ctx, DOM_SID *user_sid)
816 struct samu *sampass=NULL;
819 if ( !(sampass = samu_new( mem_ctx )) ) {
820 DEBUG(0,("No memory!\n"));
825 ret = pdb_getsampwsid(sampass, user_sid);
829 DEBUG(4,("User %s not found\n", sid_string_dbg(user_sid)));
830 TALLOC_FREE(sampass);
834 DEBUG(3,("User:[%s]\n", pdb_get_username(sampass) ));
836 if (pdb_get_pass_can_change(sampass)) {
837 TALLOC_FREE(sampass);
840 TALLOC_FREE(sampass);
845 /*******************************************************************
847 ********************************************************************/
849 NTSTATUS _samr_QuerySecurity(pipes_struct *p,
850 struct samr_QuerySecurity *r)
854 SEC_DESC * psd = NULL;
859 if (!get_lsa_policy_samr_sid(p, r->in.handle, &pol_sid, &acc_granted, NULL))
860 return NT_STATUS_INVALID_HANDLE;
862 DEBUG(10,("_samr_QuerySecurity: querying security on SID: %s\n",
863 sid_string_dbg(&pol_sid)));
865 status = access_check_samr_function(acc_granted,
866 STD_RIGHT_READ_CONTROL_ACCESS,
867 "_samr_QuerySecurity");
868 if (!NT_STATUS_IS_OK(status)) {
872 /* Check what typ of SID is beeing queried (e.g Domain SID, User SID, Group SID) */
874 /* To query the security of the SAM it self an invalid SID with S-0-0 is passed to this function */
875 if (pol_sid.sid_rev_num == 0) {
876 DEBUG(5,("_samr_QuerySecurity: querying security on SAM\n"));
877 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
878 } else if (sid_equal(&pol_sid,get_global_sam_sid())) {
879 /* check if it is our domain SID */
880 DEBUG(5,("_samr_QuerySecurity: querying security on Domain "
881 "with SID: %s\n", sid_string_dbg(&pol_sid)));
882 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
883 } else if (sid_equal(&pol_sid,&global_sid_Builtin)) {
884 /* check if it is the Builtin Domain */
885 /* TODO: Builtin probably needs a different SD with restricted write access*/
886 DEBUG(5,("_samr_QuerySecurity: querying security on Builtin "
887 "Domain with SID: %s\n", sid_string_dbg(&pol_sid)));
888 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &dom_generic_mapping, NULL, 0);
889 } else if (sid_check_is_in_our_domain(&pol_sid) ||
890 sid_check_is_in_builtin(&pol_sid)) {
891 /* TODO: different SDs have to be generated for aliases groups and users.
892 Currently all three get a default user SD */
893 DEBUG(10,("_samr_QuerySecurity: querying security on Object "
894 "with SID: %s\n", sid_string_dbg(&pol_sid)));
895 if (check_change_pw_access(p->mem_ctx, &pol_sid)) {
896 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
897 &pol_sid, SAMR_USR_RIGHTS_WRITE_PW);
899 status = make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_nopwchange_generic_mapping,
900 &pol_sid, SAMR_USR_RIGHTS_CANT_WRITE_PW);
903 return NT_STATUS_OBJECT_TYPE_MISMATCH;
906 if ((*r->out.sdbuf = make_sec_desc_buf(p->mem_ctx, sd_size, psd)) == NULL)
907 return NT_STATUS_NO_MEMORY;
912 /*******************************************************************
913 makes a SAM_ENTRY / UNISTR2* structure from a user list.
914 ********************************************************************/
916 static NTSTATUS make_user_sam_entry_list(TALLOC_CTX *ctx,
917 struct samr_SamEntry **sam_pp,
918 uint32_t num_entries,
920 struct samr_displayentry *entries)
923 struct samr_SamEntry *sam;
927 if (num_entries == 0) {
931 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_entries);
933 DEBUG(0, ("make_user_sam_entry_list: TALLOC_ZERO failed!\n"));
934 return NT_STATUS_NO_MEMORY;
937 for (i = 0; i < num_entries; i++) {
940 * usrmgr expects a non-NULL terminated string with
941 * trust relationships
943 if (entries[i].acct_flags & ACB_DOMTRUST) {
944 init_unistr2(&uni_temp_name, entries[i].account_name,
947 init_unistr2(&uni_temp_name, entries[i].account_name,
951 init_lsa_String(&sam[i].name, entries[i].account_name);
952 sam[i].idx = entries[i].rid;
960 #define MAX_SAM_ENTRIES MAX_SAM_ENTRIES_W2K
962 /*******************************************************************
963 _samr_EnumDomainUsers
964 ********************************************************************/
966 NTSTATUS _samr_EnumDomainUsers(pipes_struct *p,
967 struct samr_EnumDomainUsers *r)
970 struct samr_info *info = NULL;
972 uint32 enum_context = *r->in.resume_handle;
973 enum remote_arch_types ra_type = get_remote_arch();
974 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
975 uint32 max_entries = max_sam_entries;
976 struct samr_displayentry *entries = NULL;
977 struct samr_SamArray *samr_array = NULL;
978 struct samr_SamEntry *samr_entries = NULL;
980 /* find the policy handle. open a policy on it. */
981 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
982 return NT_STATUS_INVALID_HANDLE;
984 status = access_check_samr_function(info->acc_granted,
985 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
986 "_samr_EnumDomainUsers");
987 if (!NT_STATUS_IS_OK(status)) {
991 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
993 if (info->builtin_domain) {
994 /* No users in builtin. */
995 *r->out.resume_handle = *r->in.resume_handle;
996 DEBUG(5,("_samr_EnumDomainUsers: No users in BUILTIN\n"));
1000 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1002 return NT_STATUS_NO_MEMORY;
1004 *r->out.sam = samr_array;
1010 if ((info->disp_info->enum_users != NULL) &&
1011 (info->disp_info->enum_acb_mask != r->in.acct_flags)) {
1012 pdb_search_destroy(info->disp_info->enum_users);
1013 info->disp_info->enum_users = NULL;
1016 if (info->disp_info->enum_users == NULL) {
1017 info->disp_info->enum_users = pdb_search_users(r->in.acct_flags);
1018 info->disp_info->enum_acb_mask = r->in.acct_flags;
1021 if (info->disp_info->enum_users == NULL) {
1022 /* END AS ROOT !!!! */
1024 return NT_STATUS_ACCESS_DENIED;
1027 num_account = pdb_search_entries(info->disp_info->enum_users,
1028 enum_context, max_entries,
1031 /* END AS ROOT !!!! */
1035 if (num_account == 0) {
1036 DEBUG(5, ("_samr_EnumDomainUsers: enumeration handle over "
1037 "total entries\n"));
1038 *r->out.resume_handle = *r->in.resume_handle;
1039 return NT_STATUS_OK;
1042 status = make_user_sam_entry_list(p->mem_ctx, &samr_entries,
1043 num_account, enum_context,
1045 if (!NT_STATUS_IS_OK(status)) {
1049 if (max_entries <= num_account) {
1050 status = STATUS_MORE_ENTRIES;
1052 status = NT_STATUS_OK;
1055 /* Ensure we cache this enumeration. */
1056 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1058 DEBUG(5, ("_samr_EnumDomainUsers: %d\n", __LINE__));
1060 samr_array->count = num_account;
1061 samr_array->entries = samr_entries;
1063 *r->out.resume_handle = *r->in.resume_handle + num_account;
1064 *r->out.num_entries = num_account;
1066 DEBUG(5,("_samr_EnumDomainUsers: %d\n", __LINE__));
1071 /*******************************************************************
1072 makes a SAM_ENTRY / UNISTR2* structure from a group list.
1073 ********************************************************************/
1075 static void make_group_sam_entry_list(TALLOC_CTX *ctx,
1076 struct samr_SamEntry **sam_pp,
1077 uint32_t num_sam_entries,
1078 struct samr_displayentry *entries)
1080 struct samr_SamEntry *sam;
1085 if (num_sam_entries == 0) {
1089 sam = TALLOC_ZERO_ARRAY(ctx, struct samr_SamEntry, num_sam_entries);
1094 for (i = 0; i < num_sam_entries; i++) {
1096 * JRA. I think this should include the null. TNG does not.
1098 init_lsa_String(&sam[i].name, entries[i].account_name);
1099 sam[i].idx = entries[i].rid;
1105 /*******************************************************************
1106 _samr_EnumDomainGroups
1107 ********************************************************************/
1109 NTSTATUS _samr_EnumDomainGroups(pipes_struct *p,
1110 struct samr_EnumDomainGroups *r)
1113 struct samr_info *info = NULL;
1114 struct samr_displayentry *groups;
1116 struct samr_SamArray *samr_array = NULL;
1117 struct samr_SamEntry *samr_entries = NULL;
1119 /* find the policy handle. open a policy on it. */
1120 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1121 return NT_STATUS_INVALID_HANDLE;
1123 status = access_check_samr_function(info->acc_granted,
1124 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1125 "_samr_EnumDomainGroups");
1126 if (!NT_STATUS_IS_OK(status)) {
1130 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1132 if (info->builtin_domain) {
1133 /* No groups in builtin. */
1134 *r->out.resume_handle = *r->in.resume_handle;
1135 DEBUG(5,("_samr_EnumDomainGroups: No groups in BUILTIN\n"));
1139 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1141 return NT_STATUS_NO_MEMORY;
1144 /* the domain group array is being allocated in the function below */
1148 if (info->disp_info->groups == NULL) {
1149 info->disp_info->groups = pdb_search_groups();
1151 if (info->disp_info->groups == NULL) {
1153 return NT_STATUS_ACCESS_DENIED;
1157 num_groups = pdb_search_entries(info->disp_info->groups,
1158 *r->in.resume_handle,
1159 MAX_SAM_ENTRIES, &groups);
1162 /* Ensure we cache this enumeration. */
1163 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1165 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1166 num_groups, groups);
1168 samr_array->count = num_groups;
1169 samr_array->entries = samr_entries;
1171 *r->out.sam = samr_array;
1172 *r->out.num_entries = num_groups;
1173 *r->out.resume_handle = num_groups + *r->in.resume_handle;
1175 DEBUG(5,("_samr_EnumDomainGroups: %d\n", __LINE__));
1180 /*******************************************************************
1181 _samr_EnumDomainAliases
1182 ********************************************************************/
1184 NTSTATUS _samr_EnumDomainAliases(pipes_struct *p,
1185 struct samr_EnumDomainAliases *r)
1188 struct samr_info *info;
1189 struct samr_displayentry *aliases;
1190 uint32 num_aliases = 0;
1191 struct samr_SamArray *samr_array = NULL;
1192 struct samr_SamEntry *samr_entries = NULL;
1194 /* find the policy handle. open a policy on it. */
1195 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1196 return NT_STATUS_INVALID_HANDLE;
1198 DEBUG(5,("_samr_EnumDomainAliases: sid %s\n",
1199 sid_string_dbg(&info->sid)));
1201 status = access_check_samr_function(info->acc_granted,
1202 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1203 "_samr_EnumDomainAliases");
1204 if (!NT_STATUS_IS_OK(status)) {
1208 samr_array = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
1210 return NT_STATUS_NO_MEMORY;
1215 if (info->disp_info->aliases == NULL) {
1216 info->disp_info->aliases = pdb_search_aliases(&info->sid);
1217 if (info->disp_info->aliases == NULL) {
1219 return NT_STATUS_ACCESS_DENIED;
1223 num_aliases = pdb_search_entries(info->disp_info->aliases,
1224 *r->in.resume_handle,
1225 MAX_SAM_ENTRIES, &aliases);
1228 /* Ensure we cache this enumeration. */
1229 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1231 make_group_sam_entry_list(p->mem_ctx, &samr_entries,
1232 num_aliases, aliases);
1234 DEBUG(5,("_samr_EnumDomainAliases: %d\n", __LINE__));
1236 samr_array->count = num_aliases;
1237 samr_array->entries = samr_entries;
1239 *r->out.sam = samr_array;
1240 *r->out.num_entries = num_aliases;
1241 *r->out.resume_handle = num_aliases + *r->in.resume_handle;
1246 /*******************************************************************
1247 inits a samr_DispInfoGeneral structure.
1248 ********************************************************************/
1250 static NTSTATUS init_samr_dispinfo_1(TALLOC_CTX *ctx,
1251 struct samr_DispInfoGeneral *r,
1252 uint32_t num_entries,
1254 struct samr_displayentry *entries)
1258 DEBUG(10, ("init_samr_dispinfo_1: num_entries: %d\n", num_entries));
1260 if (num_entries == 0) {
1261 return NT_STATUS_OK;
1264 r->count = num_entries;
1266 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryGeneral, num_entries);
1268 return NT_STATUS_NO_MEMORY;
1271 for (i = 0; i < num_entries ; i++) {
1273 init_lsa_String(&r->entries[i].account_name,
1274 entries[i].account_name);
1276 init_lsa_String(&r->entries[i].description,
1277 entries[i].description);
1279 init_lsa_String(&r->entries[i].full_name,
1280 entries[i].fullname);
1282 r->entries[i].rid = entries[i].rid;
1283 r->entries[i].acct_flags = entries[i].acct_flags;
1284 r->entries[i].idx = start_idx+i+1;
1287 return NT_STATUS_OK;
1290 /*******************************************************************
1291 inits a samr_DispInfoFull structure.
1292 ********************************************************************/
1294 static NTSTATUS init_samr_dispinfo_2(TALLOC_CTX *ctx,
1295 struct samr_DispInfoFull *r,
1296 uint32_t num_entries,
1298 struct samr_displayentry *entries)
1302 DEBUG(10, ("init_samr_dispinfo_2: num_entries: %d\n", num_entries));
1304 if (num_entries == 0) {
1305 return NT_STATUS_OK;
1308 r->count = num_entries;
1310 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFull, num_entries);
1312 return NT_STATUS_NO_MEMORY;
1315 for (i = 0; i < num_entries ; i++) {
1317 init_lsa_String(&r->entries[i].account_name,
1318 entries[i].account_name);
1320 init_lsa_String(&r->entries[i].description,
1321 entries[i].description);
1323 r->entries[i].rid = entries[i].rid;
1324 r->entries[i].acct_flags = entries[i].acct_flags;
1325 r->entries[i].idx = start_idx+i+1;
1328 return NT_STATUS_OK;
1331 /*******************************************************************
1332 inits a samr_DispInfoFullGroups structure.
1333 ********************************************************************/
1335 static NTSTATUS init_samr_dispinfo_3(TALLOC_CTX *ctx,
1336 struct samr_DispInfoFullGroups *r,
1337 uint32_t num_entries,
1339 struct samr_displayentry *entries)
1343 DEBUG(5, ("init_samr_dispinfo_3: num_entries: %d\n", num_entries));
1345 if (num_entries == 0) {
1346 return NT_STATUS_OK;
1349 r->count = num_entries;
1351 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryFullGroup, num_entries);
1353 return NT_STATUS_NO_MEMORY;
1356 for (i = 0; i < num_entries ; i++) {
1358 init_lsa_String(&r->entries[i].account_name,
1359 entries[i].account_name);
1361 init_lsa_String(&r->entries[i].description,
1362 entries[i].description);
1364 r->entries[i].rid = entries[i].rid;
1365 r->entries[i].acct_flags = entries[i].acct_flags;
1366 r->entries[i].idx = start_idx+i+1;
1369 return NT_STATUS_OK;
1372 /*******************************************************************
1373 inits a samr_DispInfoAscii structure.
1374 ********************************************************************/
1376 static NTSTATUS init_samr_dispinfo_4(TALLOC_CTX *ctx,
1377 struct samr_DispInfoAscii *r,
1378 uint32_t num_entries,
1380 struct samr_displayentry *entries)
1384 DEBUG(5, ("init_samr_dispinfo_4: num_entries: %d\n", num_entries));
1386 if (num_entries == 0) {
1387 return NT_STATUS_OK;
1390 r->count = num_entries;
1392 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1394 return NT_STATUS_NO_MEMORY;
1397 for (i = 0; i < num_entries ; i++) {
1399 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1400 entries[i].account_name);
1402 r->entries[i].idx = start_idx+i+1;
1405 return NT_STATUS_OK;
1408 /*******************************************************************
1409 inits a samr_DispInfoAscii structure.
1410 ********************************************************************/
1412 static NTSTATUS init_samr_dispinfo_5(TALLOC_CTX *ctx,
1413 struct samr_DispInfoAscii *r,
1414 uint32_t num_entries,
1416 struct samr_displayentry *entries)
1420 DEBUG(5, ("init_samr_dispinfo_5: num_entries: %d\n", num_entries));
1422 if (num_entries == 0) {
1423 return NT_STATUS_OK;
1426 r->count = num_entries;
1428 r->entries = TALLOC_ZERO_ARRAY(ctx, struct samr_DispEntryAscii, num_entries);
1430 return NT_STATUS_NO_MEMORY;
1433 for (i = 0; i < num_entries ; i++) {
1435 init_lsa_AsciiStringLarge(&r->entries[i].account_name,
1436 entries[i].account_name);
1438 r->entries[i].idx = start_idx+i+1;
1441 return NT_STATUS_OK;
1444 /*******************************************************************
1445 _samr_QueryDisplayInfo
1446 ********************************************************************/
1448 NTSTATUS _samr_QueryDisplayInfo(pipes_struct *p,
1449 struct samr_QueryDisplayInfo *r)
1452 struct samr_info *info = NULL;
1453 uint32 struct_size=0x20; /* W2K always reply that, client doesn't care */
1455 uint32 max_entries = r->in.max_entries;
1456 uint32 enum_context = r->in.start_idx;
1457 uint32 max_size = r->in.buf_size;
1459 union samr_DispInfo *disp_info = r->out.info;
1461 uint32 temp_size=0, total_data_size=0;
1462 NTSTATUS disp_ret = NT_STATUS_UNSUCCESSFUL;
1463 uint32 num_account = 0;
1464 enum remote_arch_types ra_type = get_remote_arch();
1465 int max_sam_entries = (ra_type == RA_WIN95) ? MAX_SAM_ENTRIES_W95 : MAX_SAM_ENTRIES_W2K;
1466 struct samr_displayentry *entries = NULL;
1468 DEBUG(5,("_samr_QueryDisplayInfo: %d\n", __LINE__));
1470 /* find the policy handle. open a policy on it. */
1471 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
1472 return NT_STATUS_INVALID_HANDLE;
1474 if (info->builtin_domain) {
1475 DEBUG(5,("_samr_QueryDisplayInfo: Nothing in BUILTIN\n"));
1476 return NT_STATUS_OK;
1479 status = access_check_samr_function(info->acc_granted,
1480 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
1481 "_samr_QueryDisplayInfo");
1482 if (!NT_STATUS_IS_OK(status)) {
1487 * calculate how many entries we will return.
1489 * - the number of entries the client asked
1490 * - our limit on that
1491 * - the starting point (enumeration context)
1492 * - the buffer size the client will accept
1496 * We are a lot more like W2K. Instead of reading the SAM
1497 * each time to find the records we need to send back,
1498 * we read it once and link that copy to the sam handle.
1499 * For large user list (over the MAX_SAM_ENTRIES)
1500 * it's a definitive win.
1501 * second point to notice: between enumerations
1502 * our sam is now the same as it's a snapshoot.
1503 * third point: got rid of the static SAM_USER_21 struct
1504 * no more intermediate.
1505 * con: it uses much more memory, as a full copy is stored
1508 * If you want to change it, think twice and think
1509 * of the second point , that's really important.
1514 if ((r->in.level < 1) || (r->in.level > 5)) {
1515 DEBUG(0,("_samr_QueryDisplayInfo: Unknown info level (%u)\n",
1516 (unsigned int)r->in.level ));
1517 return NT_STATUS_INVALID_INFO_CLASS;
1520 /* first limit the number of entries we will return */
1521 if(max_entries > max_sam_entries) {
1522 DEBUG(5, ("_samr_QueryDisplayInfo: client requested %d "
1523 "entries, limiting to %d\n", max_entries,
1525 max_entries = max_sam_entries;
1528 /* calculate the size and limit on the number of entries we will
1531 temp_size=max_entries*struct_size;
1533 if (temp_size>max_size) {
1534 max_entries=MIN((max_size/struct_size),max_entries);;
1535 DEBUG(5, ("_samr_QueryDisplayInfo: buffer size limits to "
1536 "only %d entries\n", max_entries));
1541 /* THe following done as ROOT. Don't return without unbecome_root(). */
1543 switch (r->in.level) {
1546 if (info->disp_info->users == NULL) {
1547 info->disp_info->users = pdb_search_users(ACB_NORMAL);
1548 if (info->disp_info->users == NULL) {
1550 return NT_STATUS_ACCESS_DENIED;
1552 DEBUG(10,("_samr_QueryDisplayInfo: starting user enumeration at index %u\n",
1553 (unsigned int)enum_context ));
1555 DEBUG(10,("_samr_QueryDisplayInfo: using cached user enumeration at index %u\n",
1556 (unsigned int)enum_context ));
1559 num_account = pdb_search_entries(info->disp_info->users,
1560 enum_context, max_entries,
1564 if (info->disp_info->machines == NULL) {
1565 info->disp_info->machines =
1566 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
1567 if (info->disp_info->machines == NULL) {
1569 return NT_STATUS_ACCESS_DENIED;
1571 DEBUG(10,("_samr_QueryDisplayInfo: starting machine enumeration at index %u\n",
1572 (unsigned int)enum_context ));
1574 DEBUG(10,("_samr_QueryDisplayInfo: using cached machine enumeration at index %u\n",
1575 (unsigned int)enum_context ));
1578 num_account = pdb_search_entries(info->disp_info->machines,
1579 enum_context, max_entries,
1584 if (info->disp_info->groups == NULL) {
1585 info->disp_info->groups = pdb_search_groups();
1586 if (info->disp_info->groups == NULL) {
1588 return NT_STATUS_ACCESS_DENIED;
1590 DEBUG(10,("_samr_QueryDisplayInfo: starting group enumeration at index %u\n",
1591 (unsigned int)enum_context ));
1593 DEBUG(10,("_samr_QueryDisplayInfo: using cached group enumeration at index %u\n",
1594 (unsigned int)enum_context ));
1597 num_account = pdb_search_entries(info->disp_info->groups,
1598 enum_context, max_entries,
1603 smb_panic("info class changed");
1609 /* Now create reply structure */
1610 switch (r->in.level) {
1612 disp_ret = init_samr_dispinfo_1(p->mem_ctx, &disp_info->info1,
1613 num_account, enum_context,
1617 disp_ret = init_samr_dispinfo_2(p->mem_ctx, &disp_info->info2,
1618 num_account, enum_context,
1622 disp_ret = init_samr_dispinfo_3(p->mem_ctx, &disp_info->info3,
1623 num_account, enum_context,
1627 disp_ret = init_samr_dispinfo_4(p->mem_ctx, &disp_info->info4,
1628 num_account, enum_context,
1632 disp_ret = init_samr_dispinfo_5(p->mem_ctx, &disp_info->info5,
1633 num_account, enum_context,
1637 smb_panic("info class changed");
1641 if (!NT_STATUS_IS_OK(disp_ret))
1644 /* calculate the total size */
1645 total_data_size=num_account*struct_size;
1647 if (max_entries <= num_account) {
1648 status = STATUS_MORE_ENTRIES;
1650 status = NT_STATUS_OK;
1653 /* Ensure we cache this enumeration. */
1654 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
1656 DEBUG(5, ("_samr_QueryDisplayInfo: %d\n", __LINE__));
1658 *r->out.total_size = total_data_size;
1659 *r->out.returned_size = temp_size;
1664 /****************************************************************
1665 _samr_QueryDisplayInfo2
1666 ****************************************************************/
1668 NTSTATUS _samr_QueryDisplayInfo2(pipes_struct *p,
1669 struct samr_QueryDisplayInfo2 *r)
1671 struct samr_QueryDisplayInfo q;
1673 q.in.domain_handle = r->in.domain_handle;
1674 q.in.level = r->in.level;
1675 q.in.start_idx = r->in.start_idx;
1676 q.in.max_entries = r->in.max_entries;
1677 q.in.buf_size = r->in.buf_size;
1679 q.out.total_size = r->out.total_size;
1680 q.out.returned_size = r->out.returned_size;
1681 q.out.info = r->out.info;
1683 return _samr_QueryDisplayInfo(p, &q);
1686 /****************************************************************
1687 _samr_QueryDisplayInfo3
1688 ****************************************************************/
1690 NTSTATUS _samr_QueryDisplayInfo3(pipes_struct *p,
1691 struct samr_QueryDisplayInfo3 *r)
1693 struct samr_QueryDisplayInfo q;
1695 q.in.domain_handle = r->in.domain_handle;
1696 q.in.level = r->in.level;
1697 q.in.start_idx = r->in.start_idx;
1698 q.in.max_entries = r->in.max_entries;
1699 q.in.buf_size = r->in.buf_size;
1701 q.out.total_size = r->out.total_size;
1702 q.out.returned_size = r->out.returned_size;
1703 q.out.info = r->out.info;
1705 return _samr_QueryDisplayInfo(p, &q);
1708 /*******************************************************************
1709 _samr_QueryAliasInfo
1710 ********************************************************************/
1712 NTSTATUS _samr_QueryAliasInfo(pipes_struct *p,
1713 struct samr_QueryAliasInfo *r)
1716 struct acct_info info;
1719 union samr_AliasInfo *alias_info = NULL;
1720 const char *alias_name = NULL;
1721 const char *alias_description = NULL;
1723 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1725 alias_info = TALLOC_ZERO_P(p->mem_ctx, union samr_AliasInfo);
1727 return NT_STATUS_NO_MEMORY;
1730 /* find the policy handle. open a policy on it. */
1731 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &sid, &acc_granted, NULL))
1732 return NT_STATUS_INVALID_HANDLE;
1734 status = access_check_samr_function(acc_granted,
1735 SAMR_ALIAS_ACCESS_LOOKUP_INFO,
1736 "_samr_QueryAliasInfo");
1737 if (!NT_STATUS_IS_OK(status)) {
1742 status = pdb_get_aliasinfo(&sid, &info);
1745 if ( !NT_STATUS_IS_OK(status))
1748 /* FIXME: info contains fstrings */
1749 alias_name = talloc_strdup(r, info.acct_name);
1750 alias_description = talloc_strdup(r, info.acct_desc);
1752 switch (r->in.level) {
1754 init_samr_alias_info1(&alias_info->all,
1759 case ALIASINFODESCRIPTION:
1760 init_samr_alias_info3(&alias_info->description,
1764 return NT_STATUS_INVALID_INFO_CLASS;
1767 *r->out.info = alias_info;
1769 DEBUG(5,("_samr_QueryAliasInfo: %d\n", __LINE__));
1771 return NT_STATUS_OK;
1774 /*******************************************************************
1776 ********************************************************************/
1778 NTSTATUS _samr_LookupNames(pipes_struct *p,
1779 struct samr_LookupNames *r)
1783 enum lsa_SidType *type;
1785 int num_rids = r->in.num_names;
1788 struct samr_Ids rids, types;
1789 uint32_t num_mapped = 0;
1791 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1793 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL)) {
1794 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1797 status = access_check_samr_function(acc_granted,
1798 0, /* Don't know the acc_bits yet */
1799 "_samr_LookupNames");
1800 if (!NT_STATUS_IS_OK(status)) {
1804 if (num_rids > MAX_SAM_ENTRIES) {
1805 num_rids = MAX_SAM_ENTRIES;
1806 DEBUG(5,("_samr_LookupNames: truncating entries to %d\n", num_rids));
1809 rid = talloc_array(p->mem_ctx, uint32, num_rids);
1810 NT_STATUS_HAVE_NO_MEMORY(rid);
1812 type = talloc_array(p->mem_ctx, enum lsa_SidType, num_rids);
1813 NT_STATUS_HAVE_NO_MEMORY(type);
1815 DEBUG(5,("_samr_LookupNames: looking name on SID %s\n",
1816 sid_string_dbg(&pol_sid)));
1818 for (i = 0; i < num_rids; i++) {
1820 status = NT_STATUS_NONE_MAPPED;
1821 type[i] = SID_NAME_UNKNOWN;
1823 rid[i] = 0xffffffff;
1825 if (sid_check_is_builtin(&pol_sid)) {
1826 if (lookup_builtin_name(r->in.names[i].string,
1829 type[i] = SID_NAME_ALIAS;
1832 lookup_global_sam_name(r->in.names[i].string, 0,
1836 if (type[i] != SID_NAME_UNKNOWN) {
1841 if (num_mapped == num_rids) {
1842 status = NT_STATUS_OK;
1843 } else if (num_mapped == 0) {
1844 status = NT_STATUS_NONE_MAPPED;
1846 status = STATUS_SOME_UNMAPPED;
1849 rids.count = num_rids;
1852 types.count = num_rids;
1855 *r->out.rids = rids;
1856 *r->out.types = types;
1858 DEBUG(5,("_samr_LookupNames: %d\n", __LINE__));
1863 /*******************************************************************
1864 _samr_ChangePasswordUser2
1865 ********************************************************************/
1867 NTSTATUS _samr_ChangePasswordUser2(pipes_struct *p,
1868 struct samr_ChangePasswordUser2 *r)
1874 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1876 fstrcpy(user_name, r->in.account->string);
1877 fstrcpy(wks, r->in.server->string);
1879 DEBUG(5,("_samr_ChangePasswordUser2: user: %s wks: %s\n", user_name, wks));
1882 * Pass the user through the NT -> unix user mapping
1886 (void)map_username(user_name);
1889 * UNIX username case mangling not required, pass_oem_change
1890 * is case insensitive.
1893 status = pass_oem_change(user_name,
1894 r->in.lm_password->data,
1895 r->in.lm_verifier->hash,
1896 r->in.nt_password->data,
1897 r->in.nt_verifier->hash,
1900 DEBUG(5,("_samr_ChangePasswordUser2: %d\n", __LINE__));
1905 /*******************************************************************
1906 _samr_ChangePasswordUser3
1907 ********************************************************************/
1909 NTSTATUS _samr_ChangePasswordUser3(pipes_struct *p,
1910 struct samr_ChangePasswordUser3 *r)
1914 const char *wks = NULL;
1915 uint32 reject_reason;
1916 struct samr_DomInfo1 *dominfo = NULL;
1917 struct samr_ChangeReject *reject = NULL;
1919 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
1921 fstrcpy(user_name, r->in.account->string);
1922 if (r->in.server && r->in.server->string) {
1923 wks = r->in.server->string;
1926 DEBUG(5,("_samr_ChangePasswordUser3: user: %s wks: %s\n", user_name, wks));
1929 * Pass the user through the NT -> unix user mapping
1933 (void)map_username(user_name);
1936 * UNIX username case mangling not required, pass_oem_change
1937 * is case insensitive.
1940 status = pass_oem_change(user_name,
1941 r->in.lm_password->data,
1942 r->in.lm_verifier->hash,
1943 r->in.nt_password->data,
1944 r->in.nt_verifier->hash,
1947 if (NT_STATUS_EQUAL(status, NT_STATUS_PASSWORD_RESTRICTION) ||
1948 NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_RESTRICTION)) {
1950 uint32 min_pass_len,pass_hist,password_properties;
1951 time_t u_expire, u_min_age;
1952 NTTIME nt_expire, nt_min_age;
1953 uint32 account_policy_temp;
1955 dominfo = TALLOC_ZERO_P(p->mem_ctx, struct samr_DomInfo1);
1957 return NT_STATUS_NO_MEMORY;
1960 reject = TALLOC_ZERO_P(p->mem_ctx, struct samr_ChangeReject);
1962 return NT_STATUS_NO_MEMORY;
1969 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
1970 min_pass_len = account_policy_temp;
1972 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
1973 pass_hist = account_policy_temp;
1975 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
1976 password_properties = account_policy_temp;
1978 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
1979 u_expire = account_policy_temp;
1981 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
1982 u_min_age = account_policy_temp;
1988 unix_to_nt_time_abs(&nt_expire, u_expire);
1989 unix_to_nt_time_abs(&nt_min_age, u_min_age);
1991 if (lp_check_password_script() && *lp_check_password_script()) {
1992 password_properties |= DOMAIN_PASSWORD_COMPLEX;
1995 init_samr_DomInfo1(dominfo,
1998 password_properties,
2002 reject->reason = reject_reason;
2004 *r->out.dominfo = dominfo;
2005 *r->out.reject = reject;
2008 DEBUG(5,("_samr_ChangePasswordUser3: %d\n", __LINE__));
2013 /*******************************************************************
2014 makes a SAMR_R_LOOKUP_RIDS structure.
2015 ********************************************************************/
2017 static bool make_samr_lookup_rids(TALLOC_CTX *ctx, uint32 num_names,
2019 struct lsa_String **lsa_name_array_p)
2021 struct lsa_String *lsa_name_array = NULL;
2024 *lsa_name_array_p = NULL;
2026 if (num_names != 0) {
2027 lsa_name_array = TALLOC_ZERO_ARRAY(ctx, struct lsa_String, num_names);
2028 if (!lsa_name_array) {
2033 for (i = 0; i < num_names; i++) {
2034 DEBUG(10, ("names[%d]:%s\n", i, names[i] && *names[i] ? names[i] : ""));
2035 init_lsa_String(&lsa_name_array[i], names[i]);
2038 *lsa_name_array_p = lsa_name_array;
2043 /*******************************************************************
2045 ********************************************************************/
2047 NTSTATUS _samr_LookupRids(pipes_struct *p,
2048 struct samr_LookupRids *r)
2052 enum lsa_SidType *attrs = NULL;
2053 uint32 *wire_attrs = NULL;
2055 int num_rids = (int)r->in.num_rids;
2058 struct lsa_Strings names_array;
2059 struct samr_Ids types_array;
2060 struct lsa_String *lsa_names = NULL;
2062 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2064 /* find the policy handle. open a policy on it. */
2065 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &pol_sid, &acc_granted, NULL))
2066 return NT_STATUS_INVALID_HANDLE;
2068 status = access_check_samr_function(acc_granted,
2069 0, /* Don't know the acc_bits yet */
2070 "_samr_LookupRids");
2071 if (!NT_STATUS_IS_OK(status)) {
2075 if (num_rids > 1000) {
2076 DEBUG(0, ("Got asked for %d rids (more than 1000) -- according "
2077 "to samba4 idl this is not possible\n", num_rids));
2078 return NT_STATUS_UNSUCCESSFUL;
2082 names = TALLOC_ZERO_ARRAY(p->mem_ctx, const char *, num_rids);
2083 attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, enum lsa_SidType, num_rids);
2084 wire_attrs = TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_rids);
2086 if ((names == NULL) || (attrs == NULL) || (wire_attrs==NULL))
2087 return NT_STATUS_NO_MEMORY;
2094 become_root(); /* lookup_sid can require root privs */
2095 status = pdb_lookup_rids(&pol_sid, num_rids, r->in.rids,
2099 if (NT_STATUS_EQUAL(status, NT_STATUS_NONE_MAPPED) && (num_rids == 0)) {
2100 status = NT_STATUS_OK;
2103 if (!make_samr_lookup_rids(p->mem_ctx, num_rids, names,
2105 return NT_STATUS_NO_MEMORY;
2108 /* Convert from enum lsa_SidType to uint32 for wire format. */
2109 for (i = 0; i < num_rids; i++) {
2110 wire_attrs[i] = (uint32)attrs[i];
2113 names_array.count = num_rids;
2114 names_array.names = lsa_names;
2116 types_array.count = num_rids;
2117 types_array.ids = wire_attrs;
2119 *r->out.names = names_array;
2120 *r->out.types = types_array;
2122 DEBUG(5,("_samr_LookupRids: %d\n", __LINE__));
2127 /*******************************************************************
2129 ********************************************************************/
2131 NTSTATUS _samr_OpenUser(pipes_struct *p,
2132 struct samr_OpenUser *r)
2134 struct samu *sampass=NULL;
2136 POLICY_HND domain_pol = *r->in.domain_handle;
2137 POLICY_HND *user_pol = r->out.user_handle;
2138 struct samr_info *info = NULL;
2139 SEC_DESC *psd = NULL;
2141 uint32 des_access = r->in.access_mask;
2147 /* find the domain policy handle and get domain SID / access bits in the domain policy. */
2149 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
2150 return NT_STATUS_INVALID_HANDLE;
2152 nt_status = access_check_samr_function(acc_granted,
2153 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
2156 if ( !NT_STATUS_IS_OK(nt_status) )
2159 if ( !(sampass = samu_new( p->mem_ctx )) ) {
2160 return NT_STATUS_NO_MEMORY;
2163 /* append the user's RID to it */
2165 if (!sid_append_rid(&sid, r->in.rid))
2166 return NT_STATUS_NO_SUCH_USER;
2168 /* check if access can be granted as requested by client. */
2170 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
2172 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping, &sid, SAMR_USR_RIGHTS_WRITE_PW);
2173 se_map_generic(&des_access, &usr_generic_mapping);
2175 se_priv_copy( &se_rights, &se_machine_account );
2176 se_priv_add( &se_rights, &se_add_users );
2178 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
2179 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
2180 &acc_granted, "_samr_OpenUser");
2182 if ( !NT_STATUS_IS_OK(nt_status) )
2186 ret=pdb_getsampwsid(sampass, &sid);
2189 /* check that the SID exists in our domain. */
2191 return NT_STATUS_NO_SUCH_USER;
2194 TALLOC_FREE(sampass);
2196 /* associate the user's SID and access bits with the new handle. */
2197 if ((info = get_samr_info_by_sid(&sid)) == NULL)
2198 return NT_STATUS_NO_MEMORY;
2199 info->acc_granted = acc_granted;
2201 /* get a (unique) handle. open a policy on it. */
2202 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info))
2203 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2205 return NT_STATUS_OK;
2208 /*************************************************************************
2209 *************************************************************************/
2211 static NTSTATUS init_samr_parameters_string(TALLOC_CTX *mem_ctx,
2213 struct lsa_BinaryString **_r)
2215 struct lsa_BinaryString *r;
2218 return NT_STATUS_INVALID_PARAMETER;
2221 r = TALLOC_ZERO_P(mem_ctx, struct lsa_BinaryString);
2223 return NT_STATUS_NO_MEMORY;
2226 r->array = TALLOC_ZERO_ARRAY(mem_ctx, uint16_t, blob->length/2);
2228 return NT_STATUS_NO_MEMORY;
2230 memcpy(r->array, blob->data, blob->length);
2231 r->size = blob->length;
2232 r->length = blob->length;
2235 return NT_STATUS_NO_MEMORY;
2240 return NT_STATUS_OK;
2243 static NTSTATUS get_user_info_5(TALLOC_CTX *mem_ctx,
2244 struct samr_UserInfo5 *r,
2246 DOM_SID *domain_sid)
2248 const DOM_SID *sid_user, *sid_group;
2249 uint32_t rid, primary_gid;
2250 NTTIME last_logon, last_logoff, last_password_change,
2252 const char *account_name, *full_name, *home_directory, *home_drive,
2253 *logon_script, *profile_path, *description,
2254 *workstations, *comment;
2255 struct samr_LogonHours logon_hours;
2259 sid_user = pdb_get_user_sid(pw);
2261 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2262 DEBUG(0, ("get_user_info_5: User %s has SID %s, \nwhich conflicts with "
2263 "the domain sid %s. Failing operation.\n",
2264 pdb_get_username(pw), sid_string_dbg(sid_user),
2265 sid_string_dbg(domain_sid)));
2266 return NT_STATUS_UNSUCCESSFUL;
2270 sid_group = pdb_get_group_sid(pw);
2273 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2274 DEBUG(0, ("get_user_info_5: User %s has Primary Group SID %s, \n"
2275 "which conflicts with the domain sid %s. Failing operation.\n",
2276 pdb_get_username(pw), sid_string_dbg(sid_group),
2277 sid_string_dbg(domain_sid)));
2278 return NT_STATUS_UNSUCCESSFUL;
2281 unix_to_nt_time(&last_logon, pdb_get_logon_time(pw));
2282 unix_to_nt_time(&last_logoff, pdb_get_logoff_time(pw));
2283 unix_to_nt_time(&acct_expiry, pdb_get_kickoff_time(pw));
2284 unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(pw));
2286 account_name = talloc_strdup(mem_ctx, pdb_get_username(pw));
2287 full_name = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2288 home_directory = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2289 home_drive = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2290 logon_script = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2291 profile_path = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2292 description = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2293 workstations = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2294 comment = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2296 logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2298 init_samr_user_info5(r,
2312 pdb_get_bad_password_count(pw),
2313 pdb_get_logon_count(pw),
2314 last_password_change,
2316 pdb_get_acct_ctrl(pw));
2318 return NT_STATUS_OK;
2321 /*************************************************************************
2322 get_user_info_7. Safe. Only gives out account_name.
2323 *************************************************************************/
2325 static NTSTATUS get_user_info_7(TALLOC_CTX *mem_ctx,
2326 struct samr_UserInfo7 *r,
2327 struct samu *smbpass)
2329 const char *account_name = NULL;
2333 account_name = talloc_strdup(mem_ctx, pdb_get_username(smbpass));
2334 if (!account_name) {
2335 return NT_STATUS_NO_MEMORY;
2338 init_samr_user_info7(r, account_name);
2340 return NT_STATUS_OK;
2343 /*************************************************************************
2344 get_user_info_9. Only gives out primary group SID.
2345 *************************************************************************/
2347 static NTSTATUS get_user_info_9(TALLOC_CTX *mem_ctx,
2348 struct samr_UserInfo9 *r,
2349 struct samu *smbpass)
2353 init_samr_user_info9(r, pdb_get_group_rid(smbpass));
2355 return NT_STATUS_OK;
2358 /*************************************************************************
2359 get_user_info_16. Safe. Only gives out acb bits.
2360 *************************************************************************/
2362 static NTSTATUS get_user_info_16(TALLOC_CTX *mem_ctx,
2363 struct samr_UserInfo16 *r,
2364 struct samu *smbpass)
2368 init_samr_user_info16(r, pdb_get_acct_ctrl(smbpass));
2370 return NT_STATUS_OK;
2373 /*************************************************************************
2374 get_user_info_18. OK - this is the killer as it gives out password info.
2375 Ensure that this is only allowed on an encrypted connection with a root
2377 *************************************************************************/
2379 static NTSTATUS get_user_info_18(pipes_struct *p,
2380 TALLOC_CTX *mem_ctx,
2381 struct samr_UserInfo18 *r,
2384 struct samu *smbpass=NULL;
2389 if (p->auth.auth_type != PIPE_AUTH_TYPE_NTLMSSP || p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
2390 return NT_STATUS_ACCESS_DENIED;
2393 if (p->auth.auth_level != PIPE_AUTH_LEVEL_PRIVACY) {
2394 return NT_STATUS_ACCESS_DENIED;
2398 * Do *NOT* do become_root()/unbecome_root() here ! JRA.
2401 if ( !(smbpass = samu_new( mem_ctx )) ) {
2402 return NT_STATUS_NO_MEMORY;
2405 ret = pdb_getsampwsid(smbpass, user_sid);
2408 DEBUG(4, ("User %s not found\n", sid_string_dbg(user_sid)));
2409 TALLOC_FREE(smbpass);
2410 return (geteuid() == (uid_t)0) ? NT_STATUS_NO_SUCH_USER : NT_STATUS_ACCESS_DENIED;
2413 DEBUG(3,("User:[%s] 0x%x\n", pdb_get_username(smbpass), pdb_get_acct_ctrl(smbpass) ));
2415 if ( pdb_get_acct_ctrl(smbpass) & ACB_DISABLED) {
2416 TALLOC_FREE(smbpass);
2417 return NT_STATUS_ACCOUNT_DISABLED;
2420 init_samr_user_info18(r,
2421 pdb_get_lanman_passwd(smbpass),
2422 pdb_get_nt_passwd(smbpass),
2425 TALLOC_FREE(smbpass);
2427 return NT_STATUS_OK;
2430 /*************************************************************************
2432 *************************************************************************/
2434 static NTSTATUS get_user_info_20(TALLOC_CTX *mem_ctx,
2435 struct samr_UserInfo20 *r,
2436 struct samu *sampass)
2438 const char *munged_dial = NULL;
2441 struct lsa_BinaryString *parameters = NULL;
2445 munged_dial = pdb_get_munged_dial(sampass);
2447 DEBUG(3,("User:[%s] has [%s] (length: %d)\n", pdb_get_username(sampass),
2448 munged_dial, (int)strlen(munged_dial)));
2451 blob = base64_decode_data_blob(munged_dial);
2453 blob = data_blob_string_const("");
2456 status = init_samr_parameters_string(mem_ctx, &blob, ¶meters);
2457 data_blob_free(&blob);
2458 if (!NT_STATUS_IS_OK(status)) {
2462 init_samr_user_info20(r, parameters);
2464 return NT_STATUS_OK;
2468 /*************************************************************************
2470 *************************************************************************/
2472 static NTSTATUS get_user_info_21(TALLOC_CTX *mem_ctx,
2473 struct samr_UserInfo21 *r,
2475 DOM_SID *domain_sid)
2478 const DOM_SID *sid_user, *sid_group;
2479 uint32_t rid, primary_gid;
2480 NTTIME last_logon, last_logoff, last_password_change,
2481 acct_expiry, allow_password_change, force_password_change;
2482 time_t must_change_time;
2483 uint8_t password_expired;
2484 const char *account_name, *full_name, *home_directory, *home_drive,
2485 *logon_script, *profile_path, *description,
2486 *workstations, *comment;
2487 struct samr_LogonHours logon_hours;
2488 struct lsa_BinaryString *parameters = NULL;
2489 const char *munged_dial = NULL;
2494 sid_user = pdb_get_user_sid(pw);
2496 if (!sid_peek_check_rid(domain_sid, sid_user, &rid)) {
2497 DEBUG(0, ("get_user_info_21: User %s has SID %s, \nwhich conflicts with "
2498 "the domain sid %s. Failing operation.\n",
2499 pdb_get_username(pw), sid_string_dbg(sid_user),
2500 sid_string_dbg(domain_sid)));
2501 return NT_STATUS_UNSUCCESSFUL;
2505 sid_group = pdb_get_group_sid(pw);
2508 if (!sid_peek_check_rid(domain_sid, sid_group, &primary_gid)) {
2509 DEBUG(0, ("get_user_info_21: User %s has Primary Group SID %s, \n"
2510 "which conflicts with the domain sid %s. Failing operation.\n",
2511 pdb_get_username(pw), sid_string_dbg(sid_group),
2512 sid_string_dbg(domain_sid)));
2513 return NT_STATUS_UNSUCCESSFUL;
2516 unix_to_nt_time(&last_logon, pdb_get_logon_time(pw));
2517 unix_to_nt_time(&last_logoff, pdb_get_logoff_time(pw));
2518 unix_to_nt_time(&acct_expiry, pdb_get_kickoff_time(pw));
2519 unix_to_nt_time(&last_password_change, pdb_get_pass_last_set_time(pw));
2520 unix_to_nt_time(&allow_password_change, pdb_get_pass_can_change_time(pw));
2522 must_change_time = pdb_get_pass_must_change_time(pw);
2523 if (must_change_time == get_time_t_max()) {
2524 unix_to_nt_time_abs(&force_password_change, must_change_time);
2526 unix_to_nt_time(&force_password_change, must_change_time);
2529 if (pdb_get_pass_must_change_time(pw) == 0) {
2530 password_expired = PASS_MUST_CHANGE_AT_NEXT_LOGON;
2532 password_expired = 0;
2535 munged_dial = pdb_get_munged_dial(pw);
2537 blob = base64_decode_data_blob(munged_dial);
2539 blob = data_blob_string_const("");
2542 status = init_samr_parameters_string(mem_ctx, &blob, ¶meters);
2543 data_blob_free(&blob);
2544 if (!NT_STATUS_IS_OK(status)) {
2548 account_name = talloc_strdup(mem_ctx, pdb_get_username(pw));
2549 full_name = talloc_strdup(mem_ctx, pdb_get_fullname(pw));
2550 home_directory = talloc_strdup(mem_ctx, pdb_get_homedir(pw));
2551 home_drive = talloc_strdup(mem_ctx, pdb_get_dir_drive(pw));
2552 logon_script = talloc_strdup(mem_ctx, pdb_get_logon_script(pw));
2553 profile_path = talloc_strdup(mem_ctx, pdb_get_profile_path(pw));
2554 description = talloc_strdup(mem_ctx, pdb_get_acct_desc(pw));
2555 workstations = talloc_strdup(mem_ctx, pdb_get_workstations(pw));
2556 comment = talloc_strdup(mem_ctx, pdb_get_comment(pw));
2558 logon_hours = get_logon_hours_from_pdb(mem_ctx, pw);
2562 Look at a user on a real NT4 PDC with usrmgr, press
2563 'ok'. Then you will see that fields_present is set to
2564 0x08f827fa. Look at the user immediately after that again,
2565 and you will see that 0x00fffff is returned. This solves
2566 the problem that you get access denied after having looked
2573 init_samr_user_info21(r,
2576 last_password_change,
2578 allow_password_change,
2579 force_password_change,
2592 pdb_get_acct_ctrl(pw),
2593 pdb_build_fields_present(pw),
2595 pdb_get_bad_password_count(pw),
2596 pdb_get_logon_count(pw),
2597 0, /* country_code */
2599 0, /* lm_password_set */
2600 0, /* nt_password_set */
2603 return NT_STATUS_OK;
2606 /*******************************************************************
2608 ********************************************************************/
2610 NTSTATUS _samr_QueryUserInfo(pipes_struct *p,
2611 struct samr_QueryUserInfo *r)
2614 union samr_UserInfo *user_info = NULL;
2615 struct samr_info *info = NULL;
2619 struct samu *pwd = NULL;
2621 /* search for the handle */
2622 if (!find_policy_by_hnd(p, r->in.user_handle, (void **)(void *)&info))
2623 return NT_STATUS_INVALID_HANDLE;
2625 status = access_check_samr_function(info->acc_granted,
2626 SAMR_USER_ACCESS_GET_ATTRIBUTES,
2627 "_samr_QueryUserInfo");
2628 if (!NT_STATUS_IS_OK(status)) {
2632 domain_sid = info->sid;
2634 sid_split_rid(&domain_sid, &rid);
2636 if (!sid_check_is_in_our_domain(&info->sid))
2637 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2639 DEBUG(5,("_samr_QueryUserInfo: sid:%s\n",
2640 sid_string_dbg(&info->sid)));
2642 user_info = TALLOC_ZERO_P(p->mem_ctx, union samr_UserInfo);
2644 return NT_STATUS_NO_MEMORY;
2647 DEBUG(5,("_samr_QueryUserInfo: user info level: %d\n", r->in.level));
2649 if (!(pwd = samu_new(p->mem_ctx))) {
2650 return NT_STATUS_NO_MEMORY;
2654 ret = pdb_getsampwsid(pwd, &info->sid);
2658 DEBUG(4,("User %s not found\n", sid_string_dbg(&info->sid)));
2660 return NT_STATUS_NO_SUCH_USER;
2663 DEBUG(3,("User:[%s]\n", pdb_get_username(pwd)));
2665 samr_clear_sam_passwd(pwd);
2667 switch (r->in.level) {
2669 status = get_user_info_5(p->mem_ctx, &user_info->info5, pwd, &domain_sid);
2672 status = get_user_info_7(p->mem_ctx, &user_info->info7, pwd);
2675 status = get_user_info_9(p->mem_ctx, &user_info->info9, pwd);
2678 status = get_user_info_16(p->mem_ctx, &user_info->info16, pwd);
2681 /* level 18 is special */
2682 status = get_user_info_18(p, p->mem_ctx, &user_info->info18, &info->sid);
2685 status = get_user_info_20(p->mem_ctx, &user_info->info20, pwd);
2688 status = get_user_info_21(p->mem_ctx, &user_info->info21, pwd, &domain_sid);
2691 status = NT_STATUS_INVALID_INFO_CLASS;
2697 *r->out.info = user_info;
2699 DEBUG(5,("_samr_QueryUserInfo: %d\n", __LINE__));
2704 /****************************************************************
2705 ****************************************************************/
2707 NTSTATUS _samr_QueryUserInfo2(pipes_struct *p,
2708 struct samr_QueryUserInfo2 *r)
2710 struct samr_QueryUserInfo u;
2712 u.in.user_handle = r->in.user_handle;
2713 u.in.level = r->in.level;
2714 u.out.info = r->out.info;
2716 return _samr_QueryUserInfo(p, &u);
2719 /*******************************************************************
2720 _samr_GetGroupsForUser
2721 ********************************************************************/
2723 NTSTATUS _samr_GetGroupsForUser(pipes_struct *p,
2724 struct samr_GetGroupsForUser *r)
2726 struct samu *sam_pass=NULL;
2729 struct samr_RidWithAttribute dom_gid;
2730 struct samr_RidWithAttribute *gids = NULL;
2731 uint32 primary_group_rid;
2732 size_t num_groups = 0;
2738 bool success = False;
2740 struct samr_RidWithAttributeArray *rids = NULL;
2743 * from the SID in the request:
2744 * we should send back the list of DOMAIN GROUPS
2745 * the user is a member of
2747 * and only the DOMAIN GROUPS
2748 * no ALIASES !!! neither aliases of the domain
2749 * nor aliases of the builtin SID
2754 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2756 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidWithAttributeArray);
2758 return NT_STATUS_NO_MEMORY;
2761 /* find the policy handle. open a policy on it. */
2762 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &sid, &acc_granted, NULL))
2763 return NT_STATUS_INVALID_HANDLE;
2765 result = access_check_samr_function(acc_granted,
2766 SAMR_USER_ACCESS_GET_GROUPS,
2767 "_samr_GetGroupsForUser");
2768 if (!NT_STATUS_IS_OK(result)) {
2772 if (!sid_check_is_in_our_domain(&sid))
2773 return NT_STATUS_OBJECT_TYPE_MISMATCH;
2775 if ( !(sam_pass = samu_new( p->mem_ctx )) ) {
2776 return NT_STATUS_NO_MEMORY;
2780 ret = pdb_getsampwsid(sam_pass, &sid);
2784 DEBUG(10, ("pdb_getsampwsid failed for %s\n",
2785 sid_string_dbg(&sid)));
2786 return NT_STATUS_NO_SUCH_USER;
2791 /* make both calls inside the root block */
2793 result = pdb_enum_group_memberships(p->mem_ctx, sam_pass,
2794 &sids, &unix_gids, &num_groups);
2795 if ( NT_STATUS_IS_OK(result) ) {
2796 success = sid_peek_check_rid(get_global_sam_sid(),
2797 pdb_get_group_sid(sam_pass),
2798 &primary_group_rid);
2802 if (!NT_STATUS_IS_OK(result)) {
2803 DEBUG(10, ("pdb_enum_group_memberships failed for %s\n",
2804 sid_string_dbg(&sid)));
2809 DEBUG(5, ("Group sid %s for user %s not in our domain\n",
2810 sid_string_dbg(pdb_get_group_sid(sam_pass)),
2811 pdb_get_username(sam_pass)));
2812 TALLOC_FREE(sam_pass);
2813 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2819 dom_gid.attributes = (SE_GROUP_MANDATORY|SE_GROUP_ENABLED_BY_DEFAULT|
2821 dom_gid.rid = primary_group_rid;
2822 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2824 for (i=0; i<num_groups; i++) {
2826 if (!sid_peek_check_rid(get_global_sam_sid(),
2827 &(sids[i]), &dom_gid.rid)) {
2828 DEBUG(10, ("Found sid %s not in our domain\n",
2829 sid_string_dbg(&sids[i])));
2833 if (dom_gid.rid == primary_group_rid) {
2834 /* We added the primary group directly from the
2835 * sam_account. The other SIDs are unique from
2836 * enum_group_memberships */
2840 ADD_TO_ARRAY(p->mem_ctx, struct samr_RidWithAttribute, dom_gid, &gids, &num_gids);
2843 rids->count = num_gids;
2846 *r->out.rids = rids;
2848 DEBUG(5,("_samr_GetGroupsForUser: %d\n", __LINE__));
2853 /*******************************************************************
2854 _samr_QueryDomainInfo
2855 ********************************************************************/
2857 NTSTATUS _samr_QueryDomainInfo(pipes_struct *p,
2858 struct samr_QueryDomainInfo *r)
2860 NTSTATUS status = NT_STATUS_OK;
2861 struct samr_info *info = NULL;
2862 union samr_DomainInfo *dom_info;
2863 uint32 min_pass_len,pass_hist,password_properties;
2864 time_t u_expire, u_min_age;
2865 NTTIME nt_expire, nt_min_age;
2867 time_t u_lock_duration, u_reset_time;
2868 NTTIME nt_lock_duration, nt_reset_time;
2873 uint32 account_policy_temp;
2878 uint32 num_users=0, num_groups=0, num_aliases=0;
2880 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
2882 dom_info = TALLOC_ZERO_P(p->mem_ctx, union samr_DomainInfo);
2884 return NT_STATUS_NO_MEMORY;
2887 /* find the policy handle. open a policy on it. */
2888 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
2889 return NT_STATUS_INVALID_HANDLE;
2892 status = access_check_samr_function(info->acc_granted,
2893 SAMR_ACCESS_LOOKUP_DOMAIN,
2894 "_samr_QueryDomainInfo" );
2896 if ( !NT_STATUS_IS_OK(status) )
2899 switch (r->in.level) {
2906 pdb_get_account_policy(AP_MIN_PASSWORD_LEN, &account_policy_temp);
2907 min_pass_len = account_policy_temp;
2909 pdb_get_account_policy(AP_PASSWORD_HISTORY, &account_policy_temp);
2910 pass_hist = account_policy_temp;
2912 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, &account_policy_temp);
2913 password_properties = account_policy_temp;
2915 pdb_get_account_policy(AP_MAX_PASSWORD_AGE, &account_policy_temp);
2916 u_expire = account_policy_temp;
2918 pdb_get_account_policy(AP_MIN_PASSWORD_AGE, &account_policy_temp);
2919 u_min_age = account_policy_temp;
2925 unix_to_nt_time_abs(&nt_expire, u_expire);
2926 unix_to_nt_time_abs(&nt_min_age, u_min_age);
2928 if (lp_check_password_script() && *lp_check_password_script()) {
2929 password_properties |= DOMAIN_PASSWORD_COMPLEX;
2932 init_samr_DomInfo1(&dom_info->info1,
2933 (uint16)min_pass_len,
2935 password_properties,
2945 num_users = count_sam_users(info->disp_info, ACB_NORMAL);
2946 num_groups = count_sam_groups(info->disp_info);
2947 num_aliases = count_sam_aliases(info->disp_info);
2949 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &account_policy_temp);
2950 u_logout = account_policy_temp;
2952 unix_to_nt_time_abs(&nt_logout, u_logout);
2954 if (!pdb_get_seq_num(&seq_num))
2955 seq_num = time(NULL);
2961 server_role = ROLE_DOMAIN_PDC;
2962 if (lp_server_role() == ROLE_DOMAIN_BDC)
2963 server_role = ROLE_DOMAIN_BDC;
2965 init_samr_DomInfo2(&dom_info->info2,
2986 pdb_get_account_policy(AP_TIME_TO_LOGOUT, &ul);
2987 u_logout = (time_t)ul;
2994 unix_to_nt_time_abs(&nt_logout, u_logout);
2996 init_samr_DomInfo3(&dom_info->info3,
3001 init_samr_DomInfo4(&dom_info->info4,
3005 init_samr_DomInfo5(&dom_info->info5,
3006 get_global_sam_name());
3009 /* NT returns its own name when a PDC. win2k and later
3010 * only the name of the PDC if itself is a BDC (samba4
3012 init_samr_DomInfo6(&dom_info->info6,
3016 server_role = ROLE_DOMAIN_PDC;
3017 if (lp_server_role() == ROLE_DOMAIN_BDC)
3018 server_role = ROLE_DOMAIN_BDC;
3020 init_samr_DomInfo7(&dom_info->info7,
3029 if (!pdb_get_seq_num(&seq_num)) {
3030 seq_num = time(NULL);
3037 init_samr_DomInfo8(&dom_info->info8,
3047 pdb_get_account_policy(AP_LOCK_ACCOUNT_DURATION, &account_policy_temp);
3048 u_lock_duration = account_policy_temp;
3049 if (u_lock_duration != -1) {
3050 u_lock_duration *= 60;
3053 pdb_get_account_policy(AP_RESET_COUNT_TIME, &account_policy_temp);
3054 u_reset_time = account_policy_temp * 60;
3056 pdb_get_account_policy(AP_BAD_ATTEMPT_LOCKOUT, &account_policy_temp);
3057 lockout = account_policy_temp;
3063 unix_to_nt_time_abs(&nt_lock_duration, u_lock_duration);
3064 unix_to_nt_time_abs(&nt_reset_time, u_reset_time);
3066 init_samr_DomInfo12(&dom_info->info12,
3072 return NT_STATUS_INVALID_INFO_CLASS;
3075 *r->out.info = dom_info;
3077 DEBUG(5,("_samr_QueryDomainInfo: %d\n", __LINE__));
3082 /* W2k3 seems to use the same check for all 3 objects that can be created via
3083 * SAMR, if you try to create for example "Dialup" as an alias it says
3084 * "NT_STATUS_USER_EXISTS". This is racy, but we can't really lock the user
3087 static NTSTATUS can_create(TALLOC_CTX *mem_ctx, const char *new_name)
3089 enum lsa_SidType type;
3092 DEBUG(10, ("Checking whether [%s] can be created\n", new_name));
3095 /* Lookup in our local databases (LOOKUP_NAME_REMOTE not set)
3096 * whether the name already exists */
3097 result = lookup_name(mem_ctx, new_name, LOOKUP_NAME_LOCAL,
3098 NULL, NULL, NULL, &type);
3102 DEBUG(10, ("%s does not exist, can create it\n", new_name));
3103 return NT_STATUS_OK;
3106 DEBUG(5, ("trying to create %s, exists as %s\n",
3107 new_name, sid_type_lookup(type)));
3109 if (type == SID_NAME_DOM_GRP) {
3110 return NT_STATUS_GROUP_EXISTS;
3112 if (type == SID_NAME_ALIAS) {
3113 return NT_STATUS_ALIAS_EXISTS;
3116 /* Yes, the default is NT_STATUS_USER_EXISTS */
3117 return NT_STATUS_USER_EXISTS;
3120 /*******************************************************************
3122 ********************************************************************/
3124 NTSTATUS _samr_CreateUser2(pipes_struct *p,
3125 struct samr_CreateUser2 *r)
3127 const char *account = NULL;
3129 POLICY_HND dom_pol = *r->in.domain_handle;
3130 uint32_t acb_info = r->in.acct_flags;
3131 POLICY_HND *user_pol = r->out.user_handle;
3132 struct samr_info *info = NULL;
3137 /* check this, when giving away 'add computer to domain' privs */
3138 uint32 des_access = GENERIC_RIGHTS_USER_ALL_ACCESS;
3139 bool can_add_account = False;
3141 DISP_INFO *disp_info = NULL;
3143 /* Get the domain SID stored in the domain policy */
3144 if (!get_lsa_policy_samr_sid(p, &dom_pol, &sid, &acc_granted,
3146 return NT_STATUS_INVALID_HANDLE;
3148 if (disp_info->builtin_domain) {
3149 DEBUG(5,("_samr_CreateUser2: Refusing user create in BUILTIN\n"));
3150 return NT_STATUS_ACCESS_DENIED;
3153 nt_status = access_check_samr_function(acc_granted,
3154 SAMR_DOMAIN_ACCESS_CREATE_USER,
3155 "_samr_CreateUser2");
3156 if (!NT_STATUS_IS_OK(nt_status)) {
3160 if (!(acb_info == ACB_NORMAL || acb_info == ACB_DOMTRUST ||
3161 acb_info == ACB_WSTRUST || acb_info == ACB_SVRTRUST)) {
3162 /* Match Win2k, and return NT_STATUS_INVALID_PARAMETER if
3163 this parameter is not an account type */
3164 return NT_STATUS_INVALID_PARAMETER;
3167 account = r->in.account_name->string;
3168 if (account == NULL) {
3169 return NT_STATUS_NO_MEMORY;
3172 nt_status = can_create(p->mem_ctx, account);
3173 if (!NT_STATUS_IS_OK(nt_status)) {
3177 /* determine which user right we need to check based on the acb_info */
3179 if ( acb_info & ACB_WSTRUST )
3181 se_priv_copy( &se_rights, &se_machine_account );
3182 can_add_account = user_has_privileges(
3183 p->pipe_user.nt_user_token, &se_rights );
3185 /* usrmgr.exe (and net rpc trustdom grant) creates a normal user
3186 account for domain trusts and changes the ACB flags later */
3187 else if ( acb_info & ACB_NORMAL &&
3188 (account[strlen(account)-1] != '$') )
3190 se_priv_copy( &se_rights, &se_add_users );
3191 can_add_account = user_has_privileges(
3192 p->pipe_user.nt_user_token, &se_rights );
3194 else /* implicit assumption of a BDC or domain trust account here
3195 * (we already check the flags earlier) */
3197 if ( lp_enable_privileges() ) {
3198 /* only Domain Admins can add a BDC or domain trust */
3199 se_priv_copy( &se_rights, &se_priv_none );
3200 can_add_account = nt_token_check_domain_rid(
3201 p->pipe_user.nt_user_token,
3202 DOMAIN_GROUP_RID_ADMINS );
3206 DEBUG(5, ("_samr_CreateUser2: %s can add this account : %s\n",
3207 uidtoname(p->pipe_user.ut.uid),
3208 can_add_account ? "True":"False" ));
3210 /********** BEGIN Admin BLOCK **********/
3212 if ( can_add_account )
3215 nt_status = pdb_create_user(p->mem_ctx, account, acb_info,
3218 if ( can_add_account )
3221 /********** END Admin BLOCK **********/
3223 /* now check for failure */
3225 if ( !NT_STATUS_IS_OK(nt_status) )
3228 /* Get the user's SID */
3230 sid_compose(&sid, get_global_sam_sid(), *r->out.rid);
3232 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3234 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &usr_generic_mapping,
3235 &sid, SAMR_USR_RIGHTS_WRITE_PW);
3236 se_map_generic(&des_access, &usr_generic_mapping);
3238 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3239 &se_rights, GENERIC_RIGHTS_USER_WRITE, des_access,
3240 &acc_granted, "_samr_CreateUser2");
3242 if ( !NT_STATUS_IS_OK(nt_status) ) {
3246 /* associate the user's SID with the new handle. */
3247 if ((info = get_samr_info_by_sid(&sid)) == NULL) {
3248 return NT_STATUS_NO_MEMORY;
3253 info->acc_granted = acc_granted;
3255 /* get a (unique) handle. open a policy on it. */
3256 if (!create_policy_hnd(p, user_pol, free_samr_info, (void *)info)) {
3257 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3260 /* After a "set" ensure we have no cached display info. */
3261 force_flush_samr_cache(info->disp_info);
3263 *r->out.access_granted = acc_granted;
3265 return NT_STATUS_OK;
3268 /****************************************************************
3269 ****************************************************************/
3271 NTSTATUS _samr_CreateUser(pipes_struct *p,
3272 struct samr_CreateUser *r)
3274 struct samr_CreateUser2 c;
3275 uint32_t access_granted;
3277 c.in.domain_handle = r->in.domain_handle;
3278 c.in.account_name = r->in.account_name;
3279 c.in.acct_flags = ACB_NORMAL;
3280 c.in.access_mask = r->in.access_mask;
3281 c.out.user_handle = r->out.user_handle;
3282 c.out.access_granted = &access_granted;
3283 c.out.rid = r->out.rid;
3285 return _samr_CreateUser2(p, &c);
3288 /*******************************************************************
3290 ********************************************************************/
3292 NTSTATUS _samr_Connect(pipes_struct *p,
3293 struct samr_Connect *r)
3295 struct samr_info *info = NULL;
3296 uint32 des_access = r->in.access_mask;
3300 if (!pipe_access_check(p)) {
3301 DEBUG(3, ("access denied to _samr_Connect\n"));
3302 return NT_STATUS_ACCESS_DENIED;
3305 /* set up the SAMR connect_anon response */
3307 /* associate the user's SID with the new handle. */
3308 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3309 return NT_STATUS_NO_MEMORY;
3311 /* don't give away the farm but this is probably ok. The SAMR_ACCESS_ENUM_DOMAINS
3312 was observed from a win98 client trying to enumerate users (when configured
3313 user level access control on shares) --jerry */
3315 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3317 se_map_generic( &des_access, &sam_generic_mapping );
3318 info->acc_granted = des_access & (SAMR_ACCESS_ENUM_DOMAINS|SAMR_ACCESS_LOOKUP_DOMAIN);
3320 /* get a (unique) handle. open a policy on it. */
3321 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3322 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3324 return NT_STATUS_OK;
3327 /*******************************************************************
3329 ********************************************************************/
3331 NTSTATUS _samr_Connect2(pipes_struct *p,
3332 struct samr_Connect2 *r)
3334 struct samr_info *info = NULL;
3335 SEC_DESC *psd = NULL;
3337 uint32 des_access = r->in.access_mask;
3340 const char *fn = "_samr_Connect2";
3342 switch (p->hdr_req.opnum) {
3343 case NDR_SAMR_CONNECT2:
3344 fn = "_samr_Connect2";
3346 case NDR_SAMR_CONNECT4:
3347 fn = "_samr_Connect4";
3349 case NDR_SAMR_CONNECT5:
3350 fn = "_samr_Connect5";
3354 DEBUG(5,("%s: %d\n", fn, __LINE__));
3358 if (!pipe_access_check(p)) {
3359 DEBUG(3, ("access denied to %s\n", fn));
3360 return NT_STATUS_ACCESS_DENIED;
3363 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3365 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &sam_generic_mapping, NULL, 0);
3366 se_map_generic(&des_access, &sam_generic_mapping);
3368 nt_status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3369 NULL, 0, des_access, &acc_granted, fn);
3371 if ( !NT_STATUS_IS_OK(nt_status) )
3374 /* associate the user's SID and access granted with the new handle. */
3375 if ((info = get_samr_info_by_sid(NULL)) == NULL)
3376 return NT_STATUS_NO_MEMORY;
3378 info->acc_granted = acc_granted;
3379 info->status = r->in.access_mask; /* this looks so wrong... - gd */
3381 /* get a (unique) handle. open a policy on it. */
3382 if (!create_policy_hnd(p, r->out.connect_handle, free_samr_info, (void *)info))
3383 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3385 DEBUG(5,("%s: %d\n", fn, __LINE__));
3390 /*******************************************************************
3392 ********************************************************************/
3394 NTSTATUS _samr_Connect4(pipes_struct *p,
3395 struct samr_Connect4 *r)
3397 struct samr_Connect2 c;
3399 c.in.system_name = r->in.system_name;
3400 c.in.access_mask = r->in.access_mask;
3401 c.out.connect_handle = r->out.connect_handle;
3403 return _samr_Connect2(p, &c);
3406 /*******************************************************************
3408 ********************************************************************/
3410 NTSTATUS _samr_Connect5(pipes_struct *p,
3411 struct samr_Connect5 *r)
3414 struct samr_Connect2 c;
3415 struct samr_ConnectInfo1 info1;
3417 info1.client_version = SAMR_CONNECT_AFTER_W2K;
3420 c.in.system_name = r->in.system_name;
3421 c.in.access_mask = r->in.access_mask;
3422 c.out.connect_handle = r->out.connect_handle;
3424 status = _samr_Connect2(p, &c);
3425 if (!NT_STATUS_IS_OK(status)) {
3429 *r->out.level_out = 1;
3430 r->out.info_out->info1 = info1;
3432 return NT_STATUS_OK;
3435 /**********************************************************************
3437 **********************************************************************/
3439 NTSTATUS _samr_LookupDomain(pipes_struct *p,
3440 struct samr_LookupDomain *r)
3442 NTSTATUS status = NT_STATUS_OK;
3443 struct samr_info *info;
3444 const char *domain_name;
3445 DOM_SID *sid = NULL;
3447 if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
3448 return NT_STATUS_INVALID_HANDLE;
3450 /* win9x user manager likes to use SAMR_ACCESS_ENUM_DOMAINS here.
3451 Reverted that change so we will work with RAS servers again */
3453 status = access_check_samr_function(info->acc_granted,
3454 SAMR_ACCESS_LOOKUP_DOMAIN,
3455 "_samr_LookupDomain");
3456 if (!NT_STATUS_IS_OK(status)) {
3460 domain_name = r->in.domain_name->string;
3462 return NT_STATUS_INVALID_PARAMETER;
3465 sid = TALLOC_ZERO_P(p->mem_ctx, struct dom_sid2);
3467 return NT_STATUS_NO_MEMORY;
3470 if (strequal(domain_name, builtin_domain_name())) {
3471 sid_copy(sid, &global_sid_Builtin);
3473 if (!secrets_fetch_domain_sid(domain_name, sid)) {
3474 status = NT_STATUS_NO_SUCH_DOMAIN;
3478 DEBUG(2,("Returning domain sid for domain %s -> %s\n", domain_name,
3479 sid_string_dbg(sid)));
3486 /**********************************************************************
3488 **********************************************************************/
3490 NTSTATUS _samr_EnumDomains(pipes_struct *p,
3491 struct samr_EnumDomains *r)
3494 struct samr_info *info;
3495 uint32_t num_entries = 2;
3496 struct samr_SamEntry *entry_array = NULL;
3497 struct samr_SamArray *sam;
3499 if (!find_policy_by_hnd(p, r->in.connect_handle, (void**)(void *)&info))
3500 return NT_STATUS_INVALID_HANDLE;
3502 status = access_check_samr_function(info->acc_granted,
3503 SAMR_ACCESS_ENUM_DOMAINS,
3504 "_samr_EnumDomains");
3505 if (!NT_STATUS_IS_OK(status)) {
3509 sam = TALLOC_ZERO_P(p->mem_ctx, struct samr_SamArray);
3511 return NT_STATUS_NO_MEMORY;
3514 entry_array = TALLOC_ZERO_ARRAY(p->mem_ctx,
3515 struct samr_SamEntry,
3518 return NT_STATUS_NO_MEMORY;
3521 entry_array[0].idx = 0;
3522 init_lsa_String(&entry_array[0].name, get_global_sam_name());
3524 entry_array[1].idx = 1;
3525 init_lsa_String(&entry_array[1].name, "Builtin");
3527 sam->count = num_entries;
3528 sam->entries = entry_array;
3531 *r->out.num_entries = num_entries;
3536 /*******************************************************************
3538 ********************************************************************/
3540 NTSTATUS _samr_OpenAlias(pipes_struct *p,
3541 struct samr_OpenAlias *r)
3544 POLICY_HND domain_pol = *r->in.domain_handle;
3545 uint32 alias_rid = r->in.rid;
3546 POLICY_HND *alias_pol = r->out.alias_handle;
3547 struct samr_info *info = NULL;
3548 SEC_DESC *psd = NULL;
3550 uint32 des_access = r->in.access_mask;
3555 /* find the domain policy and get the SID / access bits stored in the domain policy */
3557 if ( !get_lsa_policy_samr_sid(p, &domain_pol, &sid, &acc_granted, NULL) )
3558 return NT_STATUS_INVALID_HANDLE;
3560 status = access_check_samr_function(acc_granted,
3561 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
3564 if ( !NT_STATUS_IS_OK(status) )
3567 /* append the alias' RID to it */
3569 if (!sid_append_rid(&sid, alias_rid))
3570 return NT_STATUS_NO_SUCH_ALIAS;
3572 /*check if access can be granted as requested by client. */
3574 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
3576 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &ali_generic_mapping, NULL, 0);
3577 se_map_generic(&des_access,&ali_generic_mapping);
3579 se_priv_copy( &se_rights, &se_add_users );
3582 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
3583 &se_rights, GENERIC_RIGHTS_ALIAS_WRITE, des_access,
3584 &acc_granted, "_samr_OpenAlias");
3586 if ( !NT_STATUS_IS_OK(status) )
3590 /* Check we actually have the requested alias */
3591 enum lsa_SidType type;
3596 result = lookup_sid(NULL, &sid, NULL, NULL, &type);
3599 if (!result || (type != SID_NAME_ALIAS)) {
3600 return NT_STATUS_NO_SUCH_ALIAS;
3603 /* make sure there is a mapping */
3605 if ( !sid_to_gid( &sid, &gid ) ) {
3606 return NT_STATUS_NO_SUCH_ALIAS;
3611 /* associate the alias SID with the new handle. */
3612 if ((info = get_samr_info_by_sid(&sid)) == NULL)
3613 return NT_STATUS_NO_MEMORY;
3615 info->acc_granted = acc_granted;
3617 /* get a (unique) handle. open a policy on it. */
3618 if (!create_policy_hnd(p, alias_pol, free_samr_info, (void *)info))
3619 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
3621 return NT_STATUS_OK;
3624 /*******************************************************************
3626 ********************************************************************/
3628 static NTSTATUS set_user_info_7(TALLOC_CTX *mem_ctx,
3629 struct samr_UserInfo7 *id7,
3635 DEBUG(5, ("set_user_info_7: NULL id7\n"));
3636 return NT_STATUS_ACCESS_DENIED;
3639 if (!id7->account_name.string) {
3640 DEBUG(5, ("set_user_info_7: failed to get new username\n"));
3641 return NT_STATUS_ACCESS_DENIED;
3644 /* check to see if the new username already exists. Note: we can't
3645 reliably lock all backends, so there is potentially the
3646 possibility that a user can be created in between this check and
3647 the rename. The rename should fail, but may not get the
3648 exact same failure status code. I think this is small enough
3649 of a window for this type of operation and the results are
3650 simply that the rename fails with a slightly different status
3651 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3653 rc = can_create(mem_ctx, id7->account_name.string);
3654 if (!NT_STATUS_IS_OK(rc)) {
3658 rc = pdb_rename_sam_account(pwd, id7->account_name.string);
3663 /*******************************************************************
3665 ********************************************************************/
3667 static bool set_user_info_16(struct samr_UserInfo16 *id16,
3671 DEBUG(5, ("set_user_info_16: NULL id16\n"));
3675 /* FIX ME: check if the value is really changed --metze */
3676 if (!pdb_set_acct_ctrl(pwd, id16->acct_flags, PDB_CHANGED)) {
3680 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3687 /*******************************************************************
3689 ********************************************************************/
3691 static NTSTATUS set_user_info_18(struct samr_UserInfo18 *id18,
3692 TALLOC_CTX *mem_ctx,
3693 DATA_BLOB *session_key,
3697 DEBUG(2, ("set_user_info_18: id18 is NULL\n"));
3698 return NT_STATUS_INVALID_PARAMETER;
3701 if (id18->nt_pwd_active || id18->lm_pwd_active) {
3702 if (!session_key->length) {
3703 return NT_STATUS_NO_USER_SESSION_KEY;
3707 if (id18->nt_pwd_active) {
3711 in = data_blob_const(id18->nt_pwd.hash, 16);
3712 out = data_blob_talloc_zero(mem_ctx, 16);
3714 sess_crypt_blob(&out, &in, session_key, false);
3716 if (!pdb_set_nt_passwd(pwd, out.data, PDB_CHANGED)) {
3717 return NT_STATUS_ACCESS_DENIED;
3720 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
3723 if (id18->lm_pwd_active) {
3727 in = data_blob_const(id18->lm_pwd.hash, 16);
3728 out = data_blob_talloc_zero(mem_ctx, 16);
3730 sess_crypt_blob(&out, &in, session_key, false);
3732 if (!pdb_set_lanman_passwd(pwd, out.data, PDB_CHANGED)) {
3733 return NT_STATUS_ACCESS_DENIED;
3736 pdb_set_pass_last_set_time(pwd, time(NULL), PDB_CHANGED);
3739 copy_id18_to_sam_passwd(pwd, id18);
3741 return pdb_update_sam_account(pwd);
3744 /*******************************************************************
3746 ********************************************************************/
3748 static bool set_user_info_20(struct samr_UserInfo20 *id20,
3752 DEBUG(5, ("set_user_info_20: NULL id20\n"));
3756 copy_id20_to_sam_passwd(pwd, id20);
3758 /* write the change out */
3759 if(!NT_STATUS_IS_OK(pdb_update_sam_account(pwd))) {
3766 /*******************************************************************
3768 ********************************************************************/
3770 static NTSTATUS set_user_info_21(TALLOC_CTX *mem_ctx,
3771 struct samr_UserInfo21 *id21,
3777 DEBUG(5, ("set_user_info_21: NULL id21\n"));
3778 return NT_STATUS_INVALID_PARAMETER;
3781 if (id21->fields_present == 0) {
3782 return NT_STATUS_INVALID_PARAMETER;
3785 if (id21->fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
3786 return NT_STATUS_ACCESS_DENIED;
3789 /* we need to separately check for an account rename first */
3791 if (id21->account_name.string &&
3792 (!strequal(id21->account_name.string, pdb_get_username(pwd))))
3795 /* check to see if the new username already exists. Note: we can't
3796 reliably lock all backends, so there is potentially the
3797 possibility that a user can be created in between this check and
3798 the rename. The rename should fail, but may not get the
3799 exact same failure status code. I think this is small enough
3800 of a window for this type of operation and the results are
3801 simply that the rename fails with a slightly different status
3802 code (like UNSUCCESSFUL instead of ALREADY_EXISTS). */
3804 status = can_create(mem_ctx, id21->account_name.string);
3805 if (!NT_STATUS_IS_OK(status)) {
3809 status = pdb_rename_sam_account(pwd, id21->account_name.string);
3811 if (!NT_STATUS_IS_OK(status)) {
3812 DEBUG(0,("set_user_info_21: failed to rename account: %s\n",
3813 nt_errstr(status)));
3817 /* set the new username so that later
3818 functions can work on the new account */
3819 pdb_set_username(pwd, id21->account_name.string, PDB_SET);
3822 copy_id21_to_sam_passwd("INFO_21", pwd, id21);
3825 * The funny part about the previous two calls is
3826 * that pwd still has the password hashes from the
3827 * passdb entry. These have not been updated from
3828 * id21. I don't know if they need to be set. --jerry
3831 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
3832 status = pdb_set_unix_primary_group(mem_ctx, pwd);
3833 if ( !NT_STATUS_IS_OK(status) ) {
3838 /* Don't worry about writing out the user account since the
3839 primary group SID is generated solely from the user's Unix
3842 /* write the change out */
3843 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3847 return NT_STATUS_OK;
3850 /*******************************************************************
3852 ********************************************************************/
3854 static NTSTATUS set_user_info_23(TALLOC_CTX *mem_ctx,
3855 struct samr_UserInfo23 *id23,
3858 char *plaintext_buf = NULL;
3864 DEBUG(5, ("set_user_info_23: NULL id23\n"));
3865 return NT_STATUS_INVALID_PARAMETER;
3868 if (id23->info.fields_present == 0) {
3869 return NT_STATUS_INVALID_PARAMETER;
3872 if (id23->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
3873 return NT_STATUS_ACCESS_DENIED;
3876 if ((id23->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
3877 (id23->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
3879 DEBUG(5, ("Attempting administrator password change (level 23) for user %s\n",
3880 pdb_get_username(pwd)));
3882 if (!decode_pw_buffer(mem_ctx,
3883 id23->password.data,
3887 return NT_STATUS_WRONG_PASSWORD;
3890 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3891 return NT_STATUS_ACCESS_DENIED;
3895 copy_id23_to_sam_passwd(pwd, id23);
3897 acct_ctrl = pdb_get_acct_ctrl(pwd);
3899 /* if it's a trust account, don't update /etc/passwd */
3900 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3901 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3902 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3903 DEBUG(5, ("Changing trust account. Not updating /etc/passwd\n"));
3904 } else if (plaintext_buf) {
3905 /* update the UNIX password */
3906 if (lp_unix_password_sync() ) {
3907 struct passwd *passwd;
3908 if (pdb_get_username(pwd) == NULL) {
3909 DEBUG(1, ("chgpasswd: User without name???\n"));
3910 return NT_STATUS_ACCESS_DENIED;
3913 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3914 if (passwd == NULL) {
3915 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3918 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3919 return NT_STATUS_ACCESS_DENIED;
3921 TALLOC_FREE(passwd);
3925 if (plaintext_buf) {
3926 memset(plaintext_buf, '\0', strlen(plaintext_buf));
3929 if (IS_SAM_CHANGED(pwd, PDB_GROUPSID) &&
3930 (!NT_STATUS_IS_OK(status = pdb_set_unix_primary_group(mem_ctx,
3935 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
3939 return NT_STATUS_OK;
3942 /*******************************************************************
3944 ********************************************************************/
3946 static bool set_user_info_pw(uint8 *pass, struct samu *pwd)
3949 char *plaintext_buf = NULL;
3952 DEBUG(5, ("Attempting administrator password change for user %s\n",
3953 pdb_get_username(pwd)));
3955 acct_ctrl = pdb_get_acct_ctrl(pwd);
3957 if (!decode_pw_buffer(talloc_tos(),
3965 if (!pdb_set_plaintext_passwd (pwd, plaintext_buf)) {
3969 /* if it's a trust account, don't update /etc/passwd */
3970 if ( ( (acct_ctrl & ACB_DOMTRUST) == ACB_DOMTRUST ) ||
3971 ( (acct_ctrl & ACB_WSTRUST) == ACB_WSTRUST) ||
3972 ( (acct_ctrl & ACB_SVRTRUST) == ACB_SVRTRUST) ) {
3973 DEBUG(5, ("Changing trust account or non-unix-user password, not updating /etc/passwd\n"));
3975 /* update the UNIX password */
3976 if (lp_unix_password_sync()) {
3977 struct passwd *passwd;
3979 if (pdb_get_username(pwd) == NULL) {
3980 DEBUG(1, ("chgpasswd: User without name???\n"));
3984 passwd = Get_Pwnam_alloc(pwd, pdb_get_username(pwd));
3985 if (passwd == NULL) {
3986 DEBUG(1, ("chgpasswd: Username does not exist in system !?!\n"));
3989 if(!chgpasswd(pdb_get_username(pwd), passwd, "", plaintext_buf, True)) {
3992 TALLOC_FREE(passwd);
3996 memset(plaintext_buf, '\0', strlen(plaintext_buf));
3998 DEBUG(5,("set_user_info_pw: pdb_update_pwd()\n"));
4003 /*******************************************************************
4005 ********************************************************************/
4007 static NTSTATUS set_user_info_24(TALLOC_CTX *mem_ctx,
4008 struct samr_UserInfo24 *id24,
4014 DEBUG(5, ("set_user_info_24: NULL id24\n"));
4015 return NT_STATUS_INVALID_PARAMETER;
4018 if (!set_user_info_pw(id24->password.data, pwd)) {
4019 return NT_STATUS_WRONG_PASSWORD;
4022 copy_id24_to_sam_passwd(pwd, id24);
4024 status = pdb_update_sam_account(pwd);
4025 if (!NT_STATUS_IS_OK(status)) {
4029 return NT_STATUS_OK;
4032 /*******************************************************************
4034 ********************************************************************/
4036 static NTSTATUS set_user_info_25(TALLOC_CTX *mem_ctx,
4037 struct samr_UserInfo25 *id25,
4043 DEBUG(5, ("set_user_info_25: NULL id25\n"));
4044 return NT_STATUS_INVALID_PARAMETER;
4047 if (id25->info.fields_present == 0) {
4048 return NT_STATUS_INVALID_PARAMETER;
4051 if (id25->info.fields_present & SAMR_FIELD_LAST_PWD_CHANGE) {
4052 return NT_STATUS_ACCESS_DENIED;
4055 if ((id25->info.fields_present & SAMR_FIELD_NT_PASSWORD_PRESENT) ||
4056 (id25->info.fields_present & SAMR_FIELD_LM_PASSWORD_PRESENT)) {
4058 if (!set_user_info_pw(id25->password.data, pwd)) {
4059 return NT_STATUS_WRONG_PASSWORD;
4063 copy_id25_to_sam_passwd(pwd, id25);
4065 /* write the change out */
4066 if(!NT_STATUS_IS_OK(status = pdb_update_sam_account(pwd))) {
4071 * We need to "pdb_update_sam_account" before the unix primary group
4072 * is set, because the idealx scripts would also change the
4073 * sambaPrimaryGroupSid using the ldap replace method. pdb_ldap uses
4074 * the delete explicit / add explicit, which would then fail to find
4075 * the previous primaryGroupSid value.
4078 if ( IS_SAM_CHANGED(pwd, PDB_GROUPSID) ) {
4079 status = pdb_set_unix_primary_group(mem_ctx, pwd);
4080 if ( !NT_STATUS_IS_OK(status) ) {
4085 return NT_STATUS_OK;
4088 /*******************************************************************
4090 ********************************************************************/
4092 static NTSTATUS set_user_info_26(TALLOC_CTX *mem_ctx,
4093 struct samr_UserInfo26 *id26,
4099 DEBUG(5, ("set_user_info_26: NULL id26\n"));
4100 return NT_STATUS_INVALID_PARAMETER;
4103 if (!set_user_info_pw(id26->password.data, pwd)) {
4104 return NT_STATUS_WRONG_PASSWORD;
4107 copy_id26_to_sam_passwd(pwd, id26);
4109 status = pdb_update_sam_account(pwd);
4110 if (!NT_STATUS_IS_OK(status)) {
4114 return NT_STATUS_OK;
4118 /*******************************************************************
4120 ********************************************************************/
4122 NTSTATUS _samr_SetUserInfo(pipes_struct *p,
4123 struct samr_SetUserInfo *r)
4126 struct samu *pwd = NULL;
4128 POLICY_HND *pol = r->in.user_handle;
4129 union samr_UserInfo *info = r->in.info;
4130 uint16_t switch_value = r->in.level;
4131 uint32_t acc_granted;
4132 uint32_t acc_required;
4134 bool has_enough_rights = False;
4136 DISP_INFO *disp_info = NULL;
4138 DEBUG(5,("_samr_SetUserInfo: %d\n", __LINE__));
4140 /* find the policy handle. open a policy on it. */
4141 if (!get_lsa_policy_samr_sid(p, pol, &sid, &acc_granted, &disp_info)) {
4142 return NT_STATUS_INVALID_HANDLE;
4145 /* This is tricky. A WinXP domain join sets
4146 (SAMR_USER_ACCESS_SET_PASSWORD|SAMR_USER_ACCESS_SET_ATTRIBUTES|SAMR_USER_ACCESS_GET_ATTRIBUTES)
4147 The MMC lusrmgr plugin includes these perms and more in the SamrOpenUser(). But the
4148 standard Win32 API calls just ask for SAMR_USER_ACCESS_SET_PASSWORD in the SamrOpenUser().
4149 This should be enough for levels 18, 24, 25,& 26. Info level 23 can set more so
4150 we'll use the set from the WinXP join as the basis. */
4152 switch (switch_value) {
4157 acc_required = SAMR_USER_ACCESS_SET_PASSWORD;
4160 acc_required = SAMR_USER_ACCESS_SET_PASSWORD |
4161 SAMR_USER_ACCESS_SET_ATTRIBUTES |
4162 SAMR_USER_ACCESS_GET_ATTRIBUTES;
4166 status = access_check_samr_function(acc_granted,
4168 "_samr_SetUserInfo");
4169 if (!NT_STATUS_IS_OK(status)) {
4173 DEBUG(5, ("_samr_SetUserInfo: sid:%s, level:%d\n",
4174 sid_string_dbg(&sid), switch_value));
4177 DEBUG(5, ("_samr_SetUserInfo: NULL info level\n"));
4178 return NT_STATUS_INVALID_INFO_CLASS;
4181 if (!(pwd = samu_new(NULL))) {
4182 return NT_STATUS_NO_MEMORY;
4186 ret = pdb_getsampwsid(pwd, &sid);
4191 return NT_STATUS_NO_SUCH_USER;
4194 /* deal with machine password changes differently from userinfo changes */
4195 /* check to see if we have the sufficient rights */
4197 acb_info = pdb_get_acct_ctrl(pwd);
4198 if (acb_info & ACB_WSTRUST)
4199 has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
4200 &se_machine_account);
4201 else if (acb_info & ACB_NORMAL)
4202 has_enough_rights = user_has_privileges(p->pipe_user.nt_user_token,
4204 else if (acb_info & (ACB_SVRTRUST|ACB_DOMTRUST)) {
4205 if (lp_enable_privileges()) {
4206 has_enough_rights = nt_token_check_domain_rid(p->pipe_user.nt_user_token,
4207 DOMAIN_GROUP_RID_ADMINS);
4211 DEBUG(5, ("_samr_SetUserInfo: %s does%s possess sufficient rights\n",
4212 uidtoname(p->pipe_user.ut.uid),
4213 has_enough_rights ? "" : " not"));
4215 /* ================ BEGIN SeMachineAccountPrivilege BLOCK ================ */
4217 if (has_enough_rights) {
4221 /* ok! user info levels (lots: see MSDEV help), off we go... */
4223 switch (switch_value) {
4226 status = set_user_info_7(p->mem_ctx,
4231 if (!set_user_info_16(&info->info16, pwd)) {
4232 status = NT_STATUS_ACCESS_DENIED;
4237 /* Used by AS/U JRA. */
4238 status = set_user_info_18(&info->info18,
4240 &p->server_info->user_session_key,
4245 if (!set_user_info_20(&info->info20, pwd)) {
4246 status = NT_STATUS_ACCESS_DENIED;
4251 status = set_user_info_21(p->mem_ctx,
4252 &info->info21, pwd);
4256 if (!p->server_info->user_session_key.length) {
4257 status = NT_STATUS_NO_USER_SESSION_KEY;
4259 SamOEMhashBlob(info->info23.password.data, 516,
4260 &p->server_info->user_session_key);
4262 dump_data(100, info->info23.password.data, 516);
4264 status = set_user_info_23(p->mem_ctx,
4265 &info->info23, pwd);
4269 if (!p->server_info->user_session_key.length) {
4270 status = NT_STATUS_NO_USER_SESSION_KEY;
4272 SamOEMhashBlob(info->info24.password.data,
4274 &p->server_info->user_session_key);
4276 dump_data(100, info->info24.password.data, 516);
4278 status = set_user_info_24(p->mem_ctx,
4279 &info->info24, pwd);
4283 if (!p->server_info->user_session_key.length) {
4284 status = NT_STATUS_NO_USER_SESSION_KEY;
4286 encode_or_decode_arc4_passwd_buffer(
4287 info->info25.password.data,
4288 &p->server_info->user_session_key);
4290 dump_data(100, info->info25.password.data, 532);
4292 status = set_user_info_25(p->mem_ctx,
4293 &info->info25, pwd);
4297 if (!p->server_info->user_session_key.length) {
4298 status = NT_STATUS_NO_USER_SESSION_KEY;
4300 encode_or_decode_arc4_passwd_buffer(
4301 info->info26.password.data,
4302 &p->server_info->user_session_key);
4304 dump_data(100, info->info26.password.data, 516);
4306 status = set_user_info_26(p->mem_ctx,
4307 &info->info26, pwd);
4311 status = NT_STATUS_INVALID_INFO_CLASS;
4316 if (has_enough_rights) {
4320 /* ================ END SeMachineAccountPrivilege BLOCK ================ */
4322 if (NT_STATUS_IS_OK(status)) {
4323 force_flush_samr_cache(disp_info);
4329 /*******************************************************************
4331 ********************************************************************/
4333 NTSTATUS _samr_SetUserInfo2(pipes_struct *p,
4334 struct samr_SetUserInfo2 *r)
4336 struct samr_SetUserInfo q;
4338 q.in.user_handle = r->in.user_handle;
4339 q.in.level = r->in.level;
4340 q.in.info = r->in.info;
4342 return _samr_SetUserInfo(p, &q);
4345 /*********************************************************************
4346 _samr_GetAliasMembership
4347 *********************************************************************/
4349 NTSTATUS _samr_GetAliasMembership(pipes_struct *p,
4350 struct samr_GetAliasMembership *r)
4352 size_t num_alias_rids;
4354 struct samr_info *info = NULL;
4362 DEBUG(5,("_samr_GetAliasMembership: %d\n", __LINE__));
4364 /* find the policy handle. open a policy on it. */
4365 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
4366 return NT_STATUS_INVALID_HANDLE;
4368 ntstatus1 = access_check_samr_function(info->acc_granted,
4369 SAMR_DOMAIN_ACCESS_LOOKUP_ALIAS,
4370 "_samr_GetAliasMembership");
4371 ntstatus2 = access_check_samr_function(info->acc_granted,
4372 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
4373 "_samr_GetAliasMembership");
4375 if (!NT_STATUS_IS_OK(ntstatus1) || !NT_STATUS_IS_OK(ntstatus2)) {
4376 if (!(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus2)) &&
4377 !(NT_STATUS_EQUAL(ntstatus1,NT_STATUS_ACCESS_DENIED) && NT_STATUS_IS_OK(ntstatus1))) {
4378 return (NT_STATUS_IS_OK(ntstatus1)) ? ntstatus2 : ntstatus1;
4382 if (!sid_check_is_domain(&info->sid) &&
4383 !sid_check_is_builtin(&info->sid))
4384 return NT_STATUS_OBJECT_TYPE_MISMATCH;
4386 if (r->in.sids->num_sids) {
4387 members = TALLOC_ARRAY(p->mem_ctx, DOM_SID, r->in.sids->num_sids);
4389 if (members == NULL)
4390 return NT_STATUS_NO_MEMORY;
4395 for (i=0; i<r->in.sids->num_sids; i++)
4396 sid_copy(&members[i], r->in.sids->sids[i].sid);
4402 ntstatus1 = pdb_enum_alias_memberships(p->mem_ctx, &info->sid, members,
4403 r->in.sids->num_sids,
4404 &alias_rids, &num_alias_rids);
4407 if (!NT_STATUS_IS_OK(ntstatus1)) {
4411 r->out.rids->count = num_alias_rids;
4412 r->out.rids->ids = alias_rids;
4414 return NT_STATUS_OK;
4417 /*********************************************************************
4418 _samr_GetMembersInAlias
4419 *********************************************************************/
4421 NTSTATUS _samr_GetMembersInAlias(pipes_struct *p,
4422 struct samr_GetMembersInAlias *r)
4426 size_t num_sids = 0;
4427 struct lsa_SidPtr *sids = NULL;
4428 DOM_SID *pdb_sids = NULL;
4434 /* find the policy handle. open a policy on it. */
4435 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, NULL))
4436 return NT_STATUS_INVALID_HANDLE;
4438 status = access_check_samr_function(acc_granted,
4439 SAMR_ALIAS_ACCESS_GET_MEMBERS,
4440 "_samr_GetMembersInAlias");
4441 if (!NT_STATUS_IS_OK(status)) {
4445 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4448 status = pdb_enum_aliasmem(&alias_sid, &pdb_sids, &num_sids);
4451 if (!NT_STATUS_IS_OK(status)) {
4456 sids = TALLOC_ZERO_ARRAY(p->mem_ctx, struct lsa_SidPtr, num_sids);
4458 TALLOC_FREE(pdb_sids);
4459 return NT_STATUS_NO_MEMORY;
4463 for (i = 0; i < num_sids; i++) {
4464 sids[i].sid = sid_dup_talloc(p->mem_ctx, &pdb_sids[i]);
4466 TALLOC_FREE(pdb_sids);
4467 return NT_STATUS_NO_MEMORY;
4471 r->out.sids->num_sids = num_sids;
4472 r->out.sids->sids = sids;
4474 TALLOC_FREE(pdb_sids);
4476 return NT_STATUS_OK;
4479 /*********************************************************************
4480 _samr_QueryGroupMember
4481 *********************************************************************/
4483 NTSTATUS _samr_QueryGroupMember(pipes_struct *p,
4484 struct samr_QueryGroupMember *r)
4487 size_t i, num_members;
4495 struct samr_RidTypeArray *rids = NULL;
4497 rids = TALLOC_ZERO_P(p->mem_ctx, struct samr_RidTypeArray);
4499 return NT_STATUS_NO_MEMORY;
4502 /* find the policy handle. open a policy on it. */
4503 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
4504 return NT_STATUS_INVALID_HANDLE;
4506 status = access_check_samr_function(acc_granted,
4507 SAMR_GROUP_ACCESS_GET_MEMBERS,
4508 "_samr_QueryGroupMember");
4509 if (!NT_STATUS_IS_OK(status)) {
4513 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4515 if (!sid_check_is_in_our_domain(&group_sid)) {
4516 DEBUG(3, ("sid %s is not in our domain\n",
4517 sid_string_dbg(&group_sid)));
4518 return NT_STATUS_NO_SUCH_GROUP;
4521 DEBUG(10, ("lookup on Domain SID\n"));
4524 status = pdb_enum_group_members(p->mem_ctx, &group_sid,
4525 &rid, &num_members);
4528 if (!NT_STATUS_IS_OK(status))
4532 attr=TALLOC_ZERO_ARRAY(p->mem_ctx, uint32, num_members);
4534 return NT_STATUS_NO_MEMORY;
4540 for (i=0; i<num_members; i++)
4541 attr[i] = SID_NAME_USER;
4543 rids->count = num_members;
4547 *r->out.rids = rids;
4549 return NT_STATUS_OK;
4552 /*********************************************************************
4553 _samr_AddAliasMember
4554 *********************************************************************/
4556 NTSTATUS _samr_AddAliasMember(pipes_struct *p,
4557 struct samr_AddAliasMember *r)
4562 bool can_add_accounts;
4564 DISP_INFO *disp_info = NULL;
4566 /* Find the policy handle. Open a policy on it. */
4567 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4568 return NT_STATUS_INVALID_HANDLE;
4570 status = access_check_samr_function(acc_granted,
4571 SAMR_ALIAS_ACCESS_ADD_MEMBER,
4572 "_samr_AddAliasMember");
4573 if (!NT_STATUS_IS_OK(status)) {
4577 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4579 se_priv_copy( &se_rights, &se_add_users );
4580 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4582 /******** BEGIN SeAddUsers BLOCK *********/
4584 if ( can_add_accounts )
4587 status = pdb_add_aliasmem(&alias_sid, r->in.sid);
4589 if ( can_add_accounts )
4592 /******** END SeAddUsers BLOCK *********/
4594 if (NT_STATUS_IS_OK(status)) {
4595 force_flush_samr_cache(disp_info);
4601 /*********************************************************************
4602 _samr_DeleteAliasMember
4603 *********************************************************************/
4605 NTSTATUS _samr_DeleteAliasMember(pipes_struct *p,
4606 struct samr_DeleteAliasMember *r)
4611 bool can_add_accounts;
4613 DISP_INFO *disp_info = NULL;
4615 /* Find the policy handle. Open a policy on it. */
4616 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4617 return NT_STATUS_INVALID_HANDLE;
4619 status = access_check_samr_function(acc_granted,
4620 SAMR_ALIAS_ACCESS_REMOVE_MEMBER,
4621 "_samr_DeleteAliasMember");
4622 if (!NT_STATUS_IS_OK(status)) {
4626 DEBUG(10, ("_samr_del_aliasmem:sid is %s\n",
4627 sid_string_dbg(&alias_sid)));
4629 se_priv_copy( &se_rights, &se_add_users );
4630 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4632 /******** BEGIN SeAddUsers BLOCK *********/
4634 if ( can_add_accounts )
4637 status = pdb_del_aliasmem(&alias_sid, r->in.sid);
4639 if ( can_add_accounts )
4642 /******** END SeAddUsers BLOCK *********/
4644 if (NT_STATUS_IS_OK(status)) {
4645 force_flush_samr_cache(disp_info);
4651 /*********************************************************************
4652 _samr_AddGroupMember
4653 *********************************************************************/
4655 NTSTATUS _samr_AddGroupMember(pipes_struct *p,
4656 struct samr_AddGroupMember *r)
4663 bool can_add_accounts;
4664 DISP_INFO *disp_info = NULL;
4666 /* Find the policy handle. Open a policy on it. */
4667 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4668 return NT_STATUS_INVALID_HANDLE;
4670 status = access_check_samr_function(acc_granted,
4671 SAMR_GROUP_ACCESS_ADD_MEMBER,
4672 "_samr_AddGroupMember");
4673 if (!NT_STATUS_IS_OK(status)) {
4677 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4679 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4681 return NT_STATUS_INVALID_HANDLE;
4684 se_priv_copy( &se_rights, &se_add_users );
4685 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4687 /******** BEGIN SeAddUsers BLOCK *********/
4689 if ( can_add_accounts )
4692 status = pdb_add_groupmem(p->mem_ctx, group_rid, r->in.rid);
4694 if ( can_add_accounts )
4697 /******** END SeAddUsers BLOCK *********/
4699 force_flush_samr_cache(disp_info);
4704 /*********************************************************************
4705 _samr_DeleteGroupMember
4706 *********************************************************************/
4708 NTSTATUS _samr_DeleteGroupMember(pipes_struct *p,
4709 struct samr_DeleteGroupMember *r)
4717 bool can_add_accounts;
4718 DISP_INFO *disp_info = NULL;
4721 * delete the group member named r->in.rid
4722 * who is a member of the sid associated with the handle
4723 * the rid is a user's rid as the group is a domain group.
4726 /* Find the policy handle. Open a policy on it. */
4727 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4728 return NT_STATUS_INVALID_HANDLE;
4730 status = access_check_samr_function(acc_granted,
4731 SAMR_GROUP_ACCESS_REMOVE_MEMBER,
4732 "_samr_DeleteGroupMember");
4733 if (!NT_STATUS_IS_OK(status)) {
4737 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4739 return NT_STATUS_INVALID_HANDLE;
4742 se_priv_copy( &se_rights, &se_add_users );
4743 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4745 /******** BEGIN SeAddUsers BLOCK *********/
4747 if ( can_add_accounts )
4750 status = pdb_del_groupmem(p->mem_ctx, group_rid, r->in.rid);
4752 if ( can_add_accounts )
4755 /******** END SeAddUsers BLOCK *********/
4757 force_flush_samr_cache(disp_info);
4762 /*********************************************************************
4764 *********************************************************************/
4766 NTSTATUS _samr_DeleteUser(pipes_struct *p,
4767 struct samr_DeleteUser *r)
4771 struct samu *sam_pass=NULL;
4773 bool can_add_accounts;
4775 DISP_INFO *disp_info = NULL;
4778 DEBUG(5, ("_samr_DeleteUser: %d\n", __LINE__));
4780 /* Find the policy handle. Open a policy on it. */
4781 if (!get_lsa_policy_samr_sid(p, r->in.user_handle, &user_sid, &acc_granted, &disp_info))
4782 return NT_STATUS_INVALID_HANDLE;
4784 status = access_check_samr_function(acc_granted,
4785 STD_RIGHT_DELETE_ACCESS,
4786 "_samr_DeleteUser");
4787 if (!NT_STATUS_IS_OK(status)) {
4791 if (!sid_check_is_in_our_domain(&user_sid))
4792 return NT_STATUS_CANNOT_DELETE;
4794 /* check if the user exists before trying to delete */
4795 if ( !(sam_pass = samu_new( NULL )) ) {
4796 return NT_STATUS_NO_MEMORY;
4800 ret = pdb_getsampwsid(sam_pass, &user_sid);
4804 DEBUG(5,("_samr_DeleteUser: User %s doesn't exist.\n",
4805 sid_string_dbg(&user_sid)));
4806 TALLOC_FREE(sam_pass);
4807 return NT_STATUS_NO_SUCH_USER;
4810 acb_info = pdb_get_acct_ctrl(sam_pass);
4812 /* For machine accounts it's the SeMachineAccountPrivilege that counts. */
4813 if ( acb_info & ACB_WSTRUST ) {
4814 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_machine_account );
4816 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
4819 /******** BEGIN SeAddUsers BLOCK *********/
4821 if ( can_add_accounts )
4824 status = pdb_delete_user(p->mem_ctx, sam_pass);
4826 if ( can_add_accounts )
4829 /******** END SeAddUsers BLOCK *********/
4831 if ( !NT_STATUS_IS_OK(status) ) {
4832 DEBUG(5,("_samr_DeleteUser: Failed to delete entry for "
4833 "user %s: %s.\n", pdb_get_username(sam_pass),
4834 nt_errstr(status)));
4835 TALLOC_FREE(sam_pass);
4840 TALLOC_FREE(sam_pass);
4842 if (!close_policy_hnd(p, r->in.user_handle))
4843 return NT_STATUS_OBJECT_NAME_INVALID;
4845 ZERO_STRUCTP(r->out.user_handle);
4847 force_flush_samr_cache(disp_info);
4849 return NT_STATUS_OK;
4852 /*********************************************************************
4853 _samr_DeleteDomainGroup
4854 *********************************************************************/
4856 NTSTATUS _samr_DeleteDomainGroup(pipes_struct *p,
4857 struct samr_DeleteDomainGroup *r)
4864 bool can_add_accounts;
4865 DISP_INFO *disp_info = NULL;
4867 DEBUG(5, ("samr_DeleteDomainGroup: %d\n", __LINE__));
4869 /* Find the policy handle. Open a policy on it. */
4870 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
4871 return NT_STATUS_INVALID_HANDLE;
4873 status = access_check_samr_function(acc_granted,
4874 STD_RIGHT_DELETE_ACCESS,
4875 "_samr_DeleteDomainGroup");
4876 if (!NT_STATUS_IS_OK(status)) {
4880 DEBUG(10, ("sid is %s\n", sid_string_dbg(&group_sid)));
4882 if (!sid_peek_check_rid(get_global_sam_sid(), &group_sid,
4884 return NT_STATUS_NO_SUCH_GROUP;
4887 se_priv_copy( &se_rights, &se_add_users );
4888 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4890 /******** BEGIN SeAddUsers BLOCK *********/
4892 if ( can_add_accounts )
4895 status = pdb_delete_dom_group(p->mem_ctx, group_rid);
4897 if ( can_add_accounts )
4900 /******** END SeAddUsers BLOCK *********/
4902 if ( !NT_STATUS_IS_OK(status) ) {
4903 DEBUG(5,("_samr_DeleteDomainGroup: Failed to delete mapping "
4904 "entry for group %s: %s\n",
4905 sid_string_dbg(&group_sid),
4906 nt_errstr(status)));
4910 if (!close_policy_hnd(p, r->in.group_handle))
4911 return NT_STATUS_OBJECT_NAME_INVALID;
4913 force_flush_samr_cache(disp_info);
4915 return NT_STATUS_OK;
4918 /*********************************************************************
4919 _samr_DeleteDomAlias
4920 *********************************************************************/
4922 NTSTATUS _samr_DeleteDomAlias(pipes_struct *p,
4923 struct samr_DeleteDomAlias *r)
4928 bool can_add_accounts;
4930 DISP_INFO *disp_info = NULL;
4932 DEBUG(5, ("_samr_DeleteDomAlias: %d\n", __LINE__));
4934 /* Find the policy handle. Open a policy on it. */
4935 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &alias_sid, &acc_granted, &disp_info))
4936 return NT_STATUS_INVALID_HANDLE;
4938 /* copy the handle to the outgoing reply */
4940 memcpy(r->out.alias_handle, r->in.alias_handle, sizeof(r->out.alias_handle));
4942 status = access_check_samr_function(acc_granted,
4943 STD_RIGHT_DELETE_ACCESS,
4944 "_samr_DeleteDomAlias");
4945 if (!NT_STATUS_IS_OK(status)) {
4949 DEBUG(10, ("sid is %s\n", sid_string_dbg(&alias_sid)));
4951 /* Don't let Windows delete builtin groups */
4953 if ( sid_check_is_in_builtin( &alias_sid ) ) {
4954 return NT_STATUS_SPECIAL_ACCOUNT;
4957 if (!sid_check_is_in_our_domain(&alias_sid))
4958 return NT_STATUS_NO_SUCH_ALIAS;
4960 DEBUG(10, ("lookup on Local SID\n"));
4962 se_priv_copy( &se_rights, &se_add_users );
4963 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
4965 /******** BEGIN SeAddUsers BLOCK *********/
4967 if ( can_add_accounts )
4970 /* Have passdb delete the alias */
4971 status = pdb_delete_alias(&alias_sid);
4973 if ( can_add_accounts )
4976 /******** END SeAddUsers BLOCK *********/
4978 if ( !NT_STATUS_IS_OK(status))
4981 if (!close_policy_hnd(p, r->in.alias_handle))
4982 return NT_STATUS_OBJECT_NAME_INVALID;
4984 force_flush_samr_cache(disp_info);
4986 return NT_STATUS_OK;
4989 /*********************************************************************
4990 _samr_CreateDomainGroup
4991 *********************************************************************/
4993 NTSTATUS _samr_CreateDomainGroup(pipes_struct *p,
4994 struct samr_CreateDomainGroup *r)
5001 struct samr_info *info;
5004 bool can_add_accounts;
5005 DISP_INFO *disp_info = NULL;
5007 /* Find the policy handle. Open a policy on it. */
5008 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
5009 return NT_STATUS_INVALID_HANDLE;
5011 status = access_check_samr_function(acc_granted,
5012 SAMR_DOMAIN_ACCESS_CREATE_GROUP,
5013 "_samr_CreateDomainGroup");
5014 if (!NT_STATUS_IS_OK(status)) {
5018 if (!sid_equal(&dom_sid, get_global_sam_sid()))
5019 return NT_STATUS_ACCESS_DENIED;
5021 name = r->in.name->string;
5023 return NT_STATUS_NO_MEMORY;
5026 status = can_create(p->mem_ctx, name);
5027 if (!NT_STATUS_IS_OK(status)) {
5031 se_priv_copy( &se_rights, &se_add_users );
5032 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5034 /******** BEGIN SeAddUsers BLOCK *********/
5036 if ( can_add_accounts )
5039 /* check that we successfully create the UNIX group */
5041 status = pdb_create_dom_group(p->mem_ctx, name, r->out.rid);
5043 if ( can_add_accounts )
5046 /******** END SeAddUsers BLOCK *********/
5048 /* check if we should bail out here */
5050 if ( !NT_STATUS_IS_OK(status) )
5053 sid_compose(&info_sid, get_global_sam_sid(), *r->out.rid);
5055 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5056 return NT_STATUS_NO_MEMORY;
5058 /* they created it; let the user do what he wants with it */
5060 info->acc_granted = GENERIC_RIGHTS_GROUP_ALL_ACCESS;
5062 /* get a (unique) handle. open a policy on it. */
5063 if (!create_policy_hnd(p, r->out.group_handle, free_samr_info, (void *)info))
5064 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5066 force_flush_samr_cache(disp_info);
5068 return NT_STATUS_OK;
5071 /*********************************************************************
5072 _samr_CreateDomAlias
5073 *********************************************************************/
5075 NTSTATUS _samr_CreateDomAlias(pipes_struct *p,
5076 struct samr_CreateDomAlias *r)
5080 const char *name = NULL;
5081 struct samr_info *info;
5086 bool can_add_accounts;
5087 DISP_INFO *disp_info = NULL;
5089 /* Find the policy handle. Open a policy on it. */
5090 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &dom_sid, &acc_granted, &disp_info))
5091 return NT_STATUS_INVALID_HANDLE;
5093 result = access_check_samr_function(acc_granted,
5094 SAMR_DOMAIN_ACCESS_CREATE_ALIAS,
5095 "_samr_CreateDomAlias");
5096 if (!NT_STATUS_IS_OK(result)) {
5100 if (!sid_equal(&dom_sid, get_global_sam_sid()))
5101 return NT_STATUS_ACCESS_DENIED;
5103 name = r->in.alias_name->string;
5105 se_priv_copy( &se_rights, &se_add_users );
5106 can_add_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
5108 result = can_create(p->mem_ctx, name);
5109 if (!NT_STATUS_IS_OK(result)) {
5113 /******** BEGIN SeAddUsers BLOCK *********/
5115 if ( can_add_accounts )
5118 /* Have passdb create the alias */
5119 result = pdb_create_alias(name, r->out.rid);
5121 if ( can_add_accounts )
5124 /******** END SeAddUsers BLOCK *********/
5126 if (!NT_STATUS_IS_OK(result)) {
5127 DEBUG(10, ("pdb_create_alias failed: %s\n",
5128 nt_errstr(result)));
5132 sid_copy(&info_sid, get_global_sam_sid());
5133 sid_append_rid(&info_sid, *r->out.rid);
5135 if (!sid_to_gid(&info_sid, &gid)) {
5136 DEBUG(10, ("Could not find alias just created\n"));
5137 return NT_STATUS_ACCESS_DENIED;
5140 /* check if the group has been successfully created */
5141 if ( getgrgid(gid) == NULL ) {
5142 DEBUG(10, ("getgrgid(%d) of just created alias failed\n",
5144 return NT_STATUS_ACCESS_DENIED;
5147 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5148 return NT_STATUS_NO_MEMORY;
5150 /* they created it; let the user do what he wants with it */
5152 info->acc_granted = GENERIC_RIGHTS_ALIAS_ALL_ACCESS;
5154 /* get a (unique) handle. open a policy on it. */
5155 if (!create_policy_hnd(p, r->out.alias_handle, free_samr_info, (void *)info))
5156 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5158 force_flush_samr_cache(disp_info);
5160 return NT_STATUS_OK;
5163 /*********************************************************************
5164 _samr_QueryGroupInfo
5165 *********************************************************************/
5167 NTSTATUS _samr_QueryGroupInfo(pipes_struct *p,
5168 struct samr_QueryGroupInfo *r)
5173 union samr_GroupInfo *info = NULL;
5176 uint32_t attributes = SE_GROUP_MANDATORY |
5177 SE_GROUP_ENABLED_BY_DEFAULT |
5179 const char *group_name = NULL;
5180 const char *group_description = NULL;
5182 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, NULL))
5183 return NT_STATUS_INVALID_HANDLE;
5185 status = access_check_samr_function(acc_granted,
5186 SAMR_GROUP_ACCESS_LOOKUP_INFO,
5187 "_samr_QueryGroupInfo");
5188 if (!NT_STATUS_IS_OK(status)) {
5193 ret = get_domain_group_from_sid(group_sid, &map);
5196 return NT_STATUS_INVALID_HANDLE;
5198 /* FIXME: map contains fstrings */
5199 group_name = talloc_strdup(r, map.nt_name);
5200 group_description = talloc_strdup(r, map.comment);
5202 info = TALLOC_ZERO_P(p->mem_ctx, union samr_GroupInfo);
5204 return NT_STATUS_NO_MEMORY;
5207 switch (r->in.level) {
5213 status = pdb_enum_group_members(
5214 p->mem_ctx, &group_sid, &members, &num_members);
5217 if (!NT_STATUS_IS_OK(status)) {
5221 init_samr_group_info1(&info->all,
5229 init_samr_group_info2(&info->name,
5233 init_samr_group_info3(&info->attributes,
5237 init_samr_group_info4(&info->description,
5248 status = pdb_enum_group_members(
5249 p->mem_ctx, &group_sid, &members, &num_members);
5252 if (!NT_STATUS_IS_OK(status)) {
5256 init_samr_group_info5(&info->all2,
5259 0, /* num_members - in w2k3 this is always 0 */
5265 return NT_STATUS_INVALID_INFO_CLASS;
5268 *r->out.info = info;
5270 return NT_STATUS_OK;
5273 /*********************************************************************
5275 *********************************************************************/
5277 NTSTATUS _samr_SetGroupInfo(pipes_struct *p,
5278 struct samr_SetGroupInfo *r)
5285 bool can_mod_accounts;
5286 DISP_INFO *disp_info = NULL;
5288 if (!get_lsa_policy_samr_sid(p, r->in.group_handle, &group_sid, &acc_granted, &disp_info))
5289 return NT_STATUS_INVALID_HANDLE;
5291 status = access_check_samr_function(acc_granted,
5292 SAMR_GROUP_ACCESS_SET_INFO,
5293 "_samr_SetGroupInfo");
5294 if (!NT_STATUS_IS_OK(status)) {
5299 ret = get_domain_group_from_sid(group_sid, &map);
5302 return NT_STATUS_NO_SUCH_GROUP;
5304 switch (r->in.level) {
5306 fstrcpy(map.comment, r->in.info->all.description.string);
5309 fstrcpy(map.comment, r->in.info->description.string);
5312 return NT_STATUS_INVALID_INFO_CLASS;
5315 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
5317 /******** BEGIN SeAddUsers BLOCK *********/
5319 if ( can_mod_accounts )
5322 status = pdb_update_group_mapping_entry(&map);
5324 if ( can_mod_accounts )
5327 /******** End SeAddUsers BLOCK *********/
5329 if (NT_STATUS_IS_OK(status)) {
5330 force_flush_samr_cache(disp_info);
5336 /*********************************************************************
5338 *********************************************************************/
5340 NTSTATUS _samr_SetAliasInfo(pipes_struct *p,
5341 struct samr_SetAliasInfo *r)
5344 struct acct_info info;
5346 bool can_mod_accounts;
5348 DISP_INFO *disp_info = NULL;
5350 if (!get_lsa_policy_samr_sid(p, r->in.alias_handle, &group_sid, &acc_granted, &disp_info))
5351 return NT_STATUS_INVALID_HANDLE;
5353 status = access_check_samr_function(acc_granted,
5354 SAMR_ALIAS_ACCESS_SET_INFO,
5355 "_samr_SetAliasInfo");
5356 if (!NT_STATUS_IS_OK(status)) {
5360 /* get the current group information */
5363 status = pdb_get_aliasinfo( &group_sid, &info );
5366 if ( !NT_STATUS_IS_OK(status))
5369 switch (r->in.level) {
5374 /* We currently do not support renaming groups in the
5375 the BUILTIN domain. Refer to util_builtin.c to understand
5376 why. The eventually needs to be fixed to be like Windows
5377 where you can rename builtin groups, just not delete them */
5379 if ( sid_check_is_in_builtin( &group_sid ) ) {
5380 return NT_STATUS_SPECIAL_ACCOUNT;
5383 /* There has to be a valid name (and it has to be different) */
5385 if ( !r->in.info->name.string )
5386 return NT_STATUS_INVALID_PARAMETER;
5388 /* If the name is the same just reply "ok". Yes this
5389 doesn't allow you to change the case of a group name. */
5391 if ( strequal( r->in.info->name.string, info.acct_name ) )
5392 return NT_STATUS_OK;
5394 fstrcpy( info.acct_name, r->in.info->name.string);
5396 /* make sure the name doesn't already exist as a user
5399 fstr_sprintf( group_name, "%s\\%s", global_myname(), info.acct_name );
5400 status = can_create( p->mem_ctx, group_name );
5401 if ( !NT_STATUS_IS_OK( status ) )
5405 case ALIASINFODESCRIPTION:
5406 if (r->in.info->description.string) {
5407 fstrcpy(info.acct_desc,
5408 r->in.info->description.string);
5410 fstrcpy( info.acct_desc, "" );
5414 return NT_STATUS_INVALID_INFO_CLASS;
5417 can_mod_accounts = user_has_privileges( p->pipe_user.nt_user_token, &se_add_users );
5419 /******** BEGIN SeAddUsers BLOCK *********/
5421 if ( can_mod_accounts )
5424 status = pdb_set_aliasinfo( &group_sid, &info );
5426 if ( can_mod_accounts )
5429 /******** End SeAddUsers BLOCK *********/
5431 if (NT_STATUS_IS_OK(status))
5432 force_flush_samr_cache(disp_info);
5437 /****************************************************************
5439 ****************************************************************/
5441 NTSTATUS _samr_GetDomPwInfo(pipes_struct *p,
5442 struct samr_GetDomPwInfo *r)
5444 uint32_t min_password_length = 0;
5445 uint32_t password_properties = 0;
5447 /* Perform access check. Since this rpc does not require a
5448 policy handle it will not be caught by the access checks on
5449 SAMR_CONNECT or SAMR_CONNECT_ANON. */
5451 if (!pipe_access_check(p)) {
5452 DEBUG(3, ("access denied to _samr_GetDomPwInfo\n"));
5453 return NT_STATUS_ACCESS_DENIED;
5457 pdb_get_account_policy(AP_MIN_PASSWORD_LEN,
5458 &min_password_length);
5459 pdb_get_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS,
5460 &password_properties);
5463 if (lp_check_password_script() && *lp_check_password_script()) {
5464 password_properties |= DOMAIN_PASSWORD_COMPLEX;
5467 r->out.info->min_password_length = min_password_length;
5468 r->out.info->password_properties = password_properties;
5470 return NT_STATUS_OK;
5473 /*********************************************************************
5475 *********************************************************************/
5477 NTSTATUS _samr_OpenGroup(pipes_struct *p,
5478 struct samr_OpenGroup *r)
5484 struct samr_info *info;
5485 SEC_DESC *psd = NULL;
5487 uint32 des_access = r->in.access_mask;
5494 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &sid, &acc_granted, NULL))
5495 return NT_STATUS_INVALID_HANDLE;
5497 status = access_check_samr_function(acc_granted,
5498 SAMR_DOMAIN_ACCESS_OPEN_ACCOUNT,
5501 if ( !NT_STATUS_IS_OK(status) )
5504 /*check if access can be granted as requested by client. */
5505 map_max_allowed_access(p->pipe_user.nt_user_token, &des_access);
5507 make_samr_object_sd(p->mem_ctx, &psd, &sd_size, &grp_generic_mapping, NULL, 0);
5508 se_map_generic(&des_access,&grp_generic_mapping);
5510 se_priv_copy( &se_rights, &se_add_users );
5512 status = access_check_samr_object(psd, p->pipe_user.nt_user_token,
5513 &se_rights, GENERIC_RIGHTS_GROUP_WRITE, des_access,
5514 &acc_granted, "_samr_OpenGroup");
5516 if ( !NT_STATUS_IS_OK(status) )
5519 /* this should not be hard-coded like this */
5521 if (!sid_equal(&sid, get_global_sam_sid()))
5522 return NT_STATUS_ACCESS_DENIED;
5524 sid_copy(&info_sid, get_global_sam_sid());
5525 sid_append_rid(&info_sid, r->in.rid);
5526 sid_to_fstring(sid_string, &info_sid);
5528 if ((info = get_samr_info_by_sid(&info_sid)) == NULL)
5529 return NT_STATUS_NO_MEMORY;
5531 info->acc_granted = acc_granted;
5533 DEBUG(10, ("_samr_OpenGroup:Opening SID: %s\n", sid_string));
5535 /* check if that group really exists */
5537 ret = get_domain_group_from_sid(info->sid, &map);
5540 return NT_STATUS_NO_SUCH_GROUP;
5542 /* get a (unique) handle. open a policy on it. */
5543 if (!create_policy_hnd(p, r->out.group_handle, free_samr_info, (void *)info))
5544 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
5546 return NT_STATUS_OK;
5549 /*********************************************************************
5550 _samr_RemoveMemberFromForeignDomain
5551 *********************************************************************/
5553 NTSTATUS _samr_RemoveMemberFromForeignDomain(pipes_struct *p,
5554 struct samr_RemoveMemberFromForeignDomain *r)
5556 DOM_SID delete_sid, domain_sid;
5559 DISP_INFO *disp_info = NULL;
5561 sid_copy( &delete_sid, r->in.sid );
5563 DEBUG(5,("_samr_RemoveMemberFromForeignDomain: removing SID [%s]\n",
5564 sid_string_dbg(&delete_sid)));
5566 /* Find the policy handle. Open a policy on it. */
5568 if (!get_lsa_policy_samr_sid(p, r->in.domain_handle, &domain_sid,
5569 &acc_granted, &disp_info))
5570 return NT_STATUS_INVALID_HANDLE;
5572 result = access_check_samr_function(acc_granted,
5573 STD_RIGHT_DELETE_ACCESS,
5574 "_samr_RemoveMemberFromForeignDomain");
5576 if (!NT_STATUS_IS_OK(result))
5579 DEBUG(8, ("_samr_RemoveMemberFromForeignDomain: sid is %s\n",
5580 sid_string_dbg(&domain_sid)));
5582 /* we can only delete a user from a group since we don't have
5583 nested groups anyways. So in the latter case, just say OK */
5585 /* TODO: The above comment nowadays is bogus. Since we have nested
5586 * groups now, and aliases members are never reported out of the unix
5587 * group membership, the "just say OK" makes this call a no-op. For
5588 * us. This needs fixing however. */
5590 /* I've only ever seen this in the wild when deleting a user from
5591 * usrmgr.exe. domain_sid is the builtin domain, and the sid to delete
5592 * is the user about to be deleted. I very much suspect this is the
5593 * only application of this call. To verify this, let people report
5596 if (!sid_check_is_builtin(&domain_sid)) {
5597 DEBUG(1,("_samr_RemoveMemberFromForeignDomain: domain_sid = %s, "
5598 "global_sam_sid() = %s\n",
5599 sid_string_dbg(&domain_sid),
5600 sid_string_dbg(get_global_sam_sid())));
5601 DEBUGADD(1,("please report to samba-technical@samba.org!\n"));
5602 return NT_STATUS_OK;
5605 force_flush_samr_cache(disp_info);
5607 result = NT_STATUS_OK;
5612 /*******************************************************************
5613 _samr_QueryDomainInfo2
5614 ********************************************************************/
5616 NTSTATUS _samr_QueryDomainInfo2(pipes_struct *p,
5617 struct samr_QueryDomainInfo2 *r)
5619 struct samr_QueryDomainInfo q;
5621 q.in.domain_handle = r->in.domain_handle;
5622 q.in.level = r->in.level;
5624 q.out.info = r->out.info;
5626 return _samr_QueryDomainInfo(p, &q);
5629 /*******************************************************************
5631 ********************************************************************/
5633 NTSTATUS _samr_SetDomainInfo(pipes_struct *p,
5634 struct samr_SetDomainInfo *r)
5636 struct samr_info *info = NULL;
5637 time_t u_expire, u_min_age;
5639 time_t u_lock_duration, u_reset_time;
5642 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5644 /* find the policy handle. open a policy on it. */
5645 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info))
5646 return NT_STATUS_INVALID_HANDLE;
5648 /* We do have different access bits for info
5649 * levels here, but we're really just looking for
5650 * GENERIC_RIGHTS_DOMAIN_WRITE access. Unfortunately
5651 * this maps to different specific bits. So
5652 * assume if we have SAMR_DOMAIN_ACCESS_SET_INFO_1
5655 result = access_check_samr_function(info->acc_granted,
5656 SAMR_DOMAIN_ACCESS_SET_INFO_1,
5657 "_samr_SetDomainInfo");
5659 if (!NT_STATUS_IS_OK(result))
5662 DEBUG(5,("_samr_SetDomainInfo: level: %d\n", r->in.level));
5664 switch (r->in.level) {
5666 u_expire=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.max_password_age);
5667 u_min_age=nt_time_to_unix_abs((NTTIME *)&r->in.info->info1.min_password_age);
5668 pdb_set_account_policy(AP_MIN_PASSWORD_LEN, (uint32)r->in.info->info1.min_password_length);
5669 pdb_set_account_policy(AP_PASSWORD_HISTORY, (uint32)r->in.info->info1.password_history_length);
5670 pdb_set_account_policy(AP_USER_MUST_LOGON_TO_CHG_PASS, (uint32)r->in.info->info1.password_properties);
5671 pdb_set_account_policy(AP_MAX_PASSWORD_AGE, (int)u_expire);
5672 pdb_set_account_policy(AP_MIN_PASSWORD_AGE, (int)u_min_age);
5677 u_logout=nt_time_to_unix_abs((NTTIME *)&r->in.info->info3.force_logoff_time);
5678 pdb_set_account_policy(AP_TIME_TO_LOGOUT, (int)u_logout);
5687 u_lock_duration=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_duration);
5688 if (u_lock_duration != -1)
5689 u_lock_duration /= 60;
5691 u_reset_time=nt_time_to_unix_abs((NTTIME *)&r->in.info->info12.lockout_window)/60;
5693 pdb_set_account_policy(AP_LOCK_ACCOUNT_DURATION, (int)u_lock_duration);
5694 pdb_set_account_policy(AP_RESET_COUNT_TIME, (int)u_reset_time);
5695 pdb_set_account_policy(AP_BAD_ATTEMPT_LOCKOUT, (uint32)r->in.info->info12.lockout_threshold);
5698 return NT_STATUS_INVALID_INFO_CLASS;
5701 DEBUG(5,("_samr_SetDomainInfo: %d\n", __LINE__));
5703 return NT_STATUS_OK;
5706 /****************************************************************
5707 _samr_GetDisplayEnumerationIndex
5708 ****************************************************************/
5710 NTSTATUS _samr_GetDisplayEnumerationIndex(pipes_struct *p,
5711 struct samr_GetDisplayEnumerationIndex *r)
5713 struct samr_info *info = NULL;
5714 uint32_t max_entries = (uint32_t) -1;
5715 uint32_t enum_context = 0;
5717 uint32_t num_account = 0;
5718 struct samr_displayentry *entries = NULL;
5721 DEBUG(5,("_samr_GetDisplayEnumerationIndex: %d\n", __LINE__));
5723 /* find the policy handle. open a policy on it. */
5724 if (!find_policy_by_hnd(p, r->in.domain_handle, (void **)(void *)&info)) {
5725 return NT_STATUS_INVALID_HANDLE;
5728 status = access_check_samr_function(info->acc_granted,
5729 SAMR_DOMAIN_ACCESS_ENUM_ACCOUNTS,
5730 "_samr_GetDisplayEnumerationIndex");
5731 if (!NT_STATUS_IS_OK(status)) {
5735 if ((r->in.level < 1) || (r->in.level > 3)) {
5736 DEBUG(0,("_samr_GetDisplayEnumerationIndex: "
5737 "Unknown info level (%u)\n",
5739 return NT_STATUS_INVALID_INFO_CLASS;
5744 /* The following done as ROOT. Don't return without unbecome_root(). */
5746 switch (r->in.level) {
5748 if (info->disp_info->users == NULL) {
5749 info->disp_info->users = pdb_search_users(ACB_NORMAL);
5750 if (info->disp_info->users == NULL) {
5752 return NT_STATUS_ACCESS_DENIED;
5754 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5755 "starting user enumeration at index %u\n",
5756 (unsigned int)enum_context));
5758 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5759 "using cached user enumeration at index %u\n",
5760 (unsigned int)enum_context));
5762 num_account = pdb_search_entries(info->disp_info->users,
5763 enum_context, max_entries,
5767 if (info->disp_info->machines == NULL) {
5768 info->disp_info->machines =
5769 pdb_search_users(ACB_WSTRUST|ACB_SVRTRUST);
5770 if (info->disp_info->machines == NULL) {
5772 return NT_STATUS_ACCESS_DENIED;
5774 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5775 "starting machine enumeration at index %u\n",
5776 (unsigned int)enum_context));
5778 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5779 "using cached machine enumeration at index %u\n",
5780 (unsigned int)enum_context));
5782 num_account = pdb_search_entries(info->disp_info->machines,
5783 enum_context, max_entries,
5787 if (info->disp_info->groups == NULL) {
5788 info->disp_info->groups = pdb_search_groups();
5789 if (info->disp_info->groups == NULL) {
5791 return NT_STATUS_ACCESS_DENIED;
5793 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5794 "starting group enumeration at index %u\n",
5795 (unsigned int)enum_context));
5797 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5798 "using cached group enumeration at index %u\n",
5799 (unsigned int)enum_context));
5801 num_account = pdb_search_entries(info->disp_info->groups,
5802 enum_context, max_entries,
5807 smb_panic("info class changed");
5813 /* Ensure we cache this enumeration. */
5814 set_disp_info_cache_timeout(info->disp_info, DISP_INFO_CACHE_TIMEOUT);
5816 DEBUG(10,("_samr_GetDisplayEnumerationIndex: looking for :%s\n",
5817 r->in.name->string));
5819 for (i=0; i<num_account; i++) {
5820 if (strequal(entries[i].account_name, r->in.name->string)) {
5821 DEBUG(10,("_samr_GetDisplayEnumerationIndex: "
5822 "found %s at idx %d\n",
5823 r->in.name->string, i));
5825 return NT_STATUS_OK;
5829 /* assuming account_name lives at the very end */
5830 *r->out.idx = num_account;
5832 return NT_STATUS_NO_MORE_ENTRIES;
5835 /****************************************************************
5836 _samr_GetDisplayEnumerationIndex2
5837 ****************************************************************/
5839 NTSTATUS _samr_GetDisplayEnumerationIndex2(pipes_struct *p,
5840 struct samr_GetDisplayEnumerationIndex2 *r)
5842 struct samr_GetDisplayEnumerationIndex q;
5844 q.in.domain_handle = r->in.domain_handle;
5845 q.in.level = r->in.level;
5846 q.in.name = r->in.name;
5848 q.out.idx = r->out.idx;
5850 return _samr_GetDisplayEnumerationIndex(p, &q);
5853 /****************************************************************
5854 ****************************************************************/
5856 NTSTATUS _samr_Shutdown(pipes_struct *p,
5857 struct samr_Shutdown *r)
5859 p->rng_fault_state = true;
5860 return NT_STATUS_NOT_IMPLEMENTED;
5863 /****************************************************************
5864 ****************************************************************/
5866 NTSTATUS _samr_SetMemberAttributesOfGroup(pipes_struct *p,
5867 struct samr_SetMemberAttributesOfGroup *r)
5869 p->rng_fault_state = true;
5870 return NT_STATUS_NOT_IMPLEMENTED;
5873 /****************************************************************
5874 ****************************************************************/
5876 NTSTATUS _samr_ChangePasswordUser(pipes_struct *p,
5877 struct samr_ChangePasswordUser *r)
5879 p->rng_fault_state = true;
5880 return NT_STATUS_NOT_IMPLEMENTED;
5883 /****************************************************************
5884 ****************************************************************/
5886 NTSTATUS _samr_TestPrivateFunctionsDomain(pipes_struct *p,
5887 struct samr_TestPrivateFunctionsDomain *r)
5889 p->rng_fault_state = true;
5890 return NT_STATUS_NOT_IMPLEMENTED;
5893 /****************************************************************
5894 ****************************************************************/
5896 NTSTATUS _samr_TestPrivateFunctionsUser(pipes_struct *p,
5897 struct samr_TestPrivateFunctionsUser *r)
5899 p->rng_fault_state = true;
5900 return NT_STATUS_NOT_IMPLEMENTED;
5903 /****************************************************************
5904 ****************************************************************/
5906 NTSTATUS _samr_AddMultipleMembersToAlias(pipes_struct *p,
5907 struct samr_AddMultipleMembersToAlias *r)
5909 p->rng_fault_state = true;
5910 return NT_STATUS_NOT_IMPLEMENTED;
5913 /****************************************************************
5914 ****************************************************************/
5916 NTSTATUS _samr_RemoveMultipleMembersFromAlias(pipes_struct *p,
5917 struct samr_RemoveMultipleMembersFromAlias *r)
5919 p->rng_fault_state = true;
5920 return NT_STATUS_NOT_IMPLEMENTED;
5923 /****************************************************************
5924 ****************************************************************/
5926 NTSTATUS _samr_OemChangePasswordUser2(pipes_struct *p,
5927 struct samr_OemChangePasswordUser2 *r)
5929 p->rng_fault_state = true;
5930 return NT_STATUS_NOT_IMPLEMENTED;
5933 /****************************************************************
5934 ****************************************************************/
5936 NTSTATUS _samr_SetBootKeyInformation(pipes_struct *p,
5937 struct samr_SetBootKeyInformation *r)
5939 p->rng_fault_state = true;
5940 return NT_STATUS_NOT_IMPLEMENTED;
5943 /****************************************************************
5944 ****************************************************************/
5946 NTSTATUS _samr_GetBootKeyInformation(pipes_struct *p,
5947 struct samr_GetBootKeyInformation *r)
5949 p->rng_fault_state = true;
5950 return NT_STATUS_NOT_IMPLEMENTED;
5953 /****************************************************************
5954 ****************************************************************/
5956 NTSTATUS _samr_Connect3(pipes_struct *p,
5957 struct samr_Connect3 *r)
5959 p->rng_fault_state = true;
5960 return NT_STATUS_NOT_IMPLEMENTED;
5963 /****************************************************************
5964 ****************************************************************/
5966 NTSTATUS _samr_RidToSid(pipes_struct *p,
5967 struct samr_RidToSid *r)
5969 p->rng_fault_state = true;
5970 return NT_STATUS_NOT_IMPLEMENTED;
5973 /****************************************************************
5974 ****************************************************************/
5976 NTSTATUS _samr_SetDsrmPassword(pipes_struct *p,
5977 struct samr_SetDsrmPassword *r)
5979 p->rng_fault_state = true;
5980 return NT_STATUS_NOT_IMPLEMENTED;
5983 /****************************************************************
5984 ****************************************************************/
5986 NTSTATUS _samr_ValidatePassword(pipes_struct *p,
5987 struct samr_ValidatePassword *r)
5989 p->rng_fault_state = true;
5990 return NT_STATUS_NOT_IMPLEMENTED;