source4/dsdb/samdb/cracknames.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    endpoint server for the drsuapi pipe
   5    DsCrackNames()
   6
   7    Copyright (C) Stefan Metzmacher 2004
   8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 2 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program; if not, write to the Free Software
  22    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23 */
  24
  25 #include "includes.h"
  26 #include "librpc/gen_ndr/drsuapi.h"
  27 #include "rpc_server/common/common.h"
  28 #include "lib/ldb/include/ldb_errors.h"
  29 #include "system/kerberos.h"
  30 #include "auth/kerberos/kerberos.h"
  31 #include "libcli/ldap/ldap.h"
  32 #include "libcli/security/security.h"
  33 #include "librpc/gen_ndr/ndr_misc.h"
  34 #include "auth/auth.h"
  35 #include "db_wrap.h"
  36 #include "dsdb/samdb/samdb.h"
  37
  38 static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
  39                                    struct smb_krb5_context *smb_krb5_context,
  40                                    uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
  41                                    struct ldb_dn *name_dn, const char *name,
  42                                    const char *domain_filter, const char *result_filter,
  43                                    struct drsuapi_DsNameInfo1 *info1);
  44 static WERROR DsCrackNameOneSyntactical(TALLOC_CTX *mem_ctx,
  45                                         uint32_t format_offered, uint32_t format_desired,
  46                                         struct ldb_dn *name_dn, const char *name,
  47                                         struct drsuapi_DsNameInfo1 *info1);
  48
  49 static WERROR dns_domain_from_principal(struct smb_krb5_context *smb_krb5_context,
  50                                         const char *name,
  51                                         struct drsuapi_DsNameInfo1 *info1)
  52 {
  53         krb5_error_code ret;
  54         krb5_principal principal;
  55         /* perhaps it's a principal with a realm, so return the right 'domain only' response */
  56         char **realm;
  57         ret = krb5_parse_name_flags(smb_krb5_context->krb5_context, name,
  58                                     KRB5_PRINCIPAL_PARSE_MUST_REALM, &principal);
  59         if (ret) {
  60                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
  61                 return WERR_OK;
  62         }
  63
  64         /* This isn't an allocation assignemnt, so it is free'ed with the krb5_free_principal */
  65         realm = krb5_princ_realm(smb_krb5_context->krb5_context, principal);
  66
  67         info1->dns_domain_name  = talloc_strdup(info1, *realm);
  68         krb5_free_principal(smb_krb5_context->krb5_context, principal);
  69
  70         W_ERROR_HAVE_NO_MEMORY(info1->dns_domain_name);
  71
  72         info1->status = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
  73         return WERR_OK;
  74 }
  75
  76 static enum drsuapi_DsNameStatus LDB_lookup_spn_alias(krb5_context context, struct ldb_context *ldb_ctx,
  77                                                       TALLOC_CTX *mem_ctx,
  78                                                       const char *alias_from,
  79                                                       char **alias_to)
  80 {
  81         int i;
  82         int ret;
  83         struct ldb_result *res;
  84         struct ldb_message_element *spnmappings;
  85         TALLOC_CTX *tmp_ctx;
  86         struct ldb_dn *service_dn;
  87         char *service_dn_str;
  88
  89         const char *directory_attrs[] = {
  90                 "sPNMappings",
  91                 NULL
  92         };
  93
  94         tmp_ctx = talloc_new(mem_ctx);
  95         if (!tmp_ctx) {
  96                 return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
  97         }
  98
  99         service_dn = ldb_dn_new(tmp_ctx, ldb_ctx, "CN=Directory Service,CN=Windows NT,CN=Services");
 100         if ( ! ldb_dn_add_base(service_dn, samdb_config_dn(ldb_ctx))) {
 101                 return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 102         }
 103         service_dn_str = ldb_dn_alloc_linearized(tmp_ctx, service_dn);
 104         if ( ! service_dn_str) {
 105                 return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 106         }
 107
 108         ret = ldb_search(ldb_ctx, service_dn, LDB_SCOPE_BASE, "(objectClass=nTDSService)",
 109                          directory_attrs, &res);
 110
 111         if (ret != LDB_SUCCESS) {
 112                 DEBUG(1, ("ldb_search: dn: %s not found: %s", service_dn_str, ldb_errstring(ldb_ctx)));
 113                 return DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 114         } else if (res->count != 1) {
 115                 talloc_free(res);
 116                 DEBUG(1, ("ldb_search: dn: %s found %d times!", service_dn_str, res->count));
 117                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 118         }
 119         talloc_steal(tmp_ctx, res);
 120
 121         spnmappings = ldb_msg_find_element(res->msgs[0], "sPNMappings");
 122         if (!spnmappings || spnmappings->num_values == 0) {
 123                 DEBUG(1, ("ldb_search: dn: %s no sPNMappings attribute", service_dn_str));
 124                 talloc_free(tmp_ctx);
 125                 return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 126         }
 127
 128         for (i = 0; i < spnmappings->num_values; i++) {
 129                 char *mapping, *p, *str;
 130                 mapping = talloc_strdup(tmp_ctx,
 131                                         (const char *)spnmappings->values[i].data);
 132                 if (!mapping) {
 133                         DEBUG(1, ("LDB_lookup_spn_alias: ldb_search: dn: %s did not have an sPNMapping\n", service_dn_str));
 134                         talloc_free(tmp_ctx);
 135                         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 136                 }
 137
 138                 /* C string manipulation sucks */
 139
 140                 p = strchr(mapping, '=');
 141                 if (!p) {
 142                         DEBUG(1, ("ldb_search: dn: %s sPNMapping malformed: %s\n",
 143                                   service_dn_str, mapping));
 144                         talloc_free(tmp_ctx);
 145                         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 146                 }
 147                 p[0] = '\0';
 148                 p++;
 149                 do {
 150                         str = p;
 151                         p = strchr(p, ',');
 152                         if (p) {
 153                                 p[0] = '\0';
 154                                 p++;
 155                         }
 156                         if (strcasecmp(str, alias_from) == 0) {
 157                                 *alias_to = mapping;
 158                                 talloc_steal(mem_ctx, mapping);
 159                                 talloc_free(tmp_ctx);
 160                                 return DRSUAPI_DS_NAME_STATUS_OK;
 161                         }
 162                 } while (p);
 163         }
 164         DEBUG(4, ("LDB_lookup_spn_alias: no alias for service %s applicable\n", alias_from));
 165         talloc_free(tmp_ctx);
 166         return DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 167 }
 168
 169 /* When cracking a ServicePrincipalName, many services may be served
 170  * by the host/ servicePrincipalName.  The incoming query is for cifs/
 171  * but we translate it here, and search on host/.  This is done after
 172  * the cifs/ entry has been searched for, making this a fallback */
 173
 174 static WERROR DsCrackNameSPNAlias(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 175                                   struct smb_krb5_context *smb_krb5_context,
 176                                   uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 177                                   const char *name, struct drsuapi_DsNameInfo1 *info1)
 178 {
 179         WERROR wret;
 180         krb5_error_code ret;
 181         krb5_principal principal;
 182         const char *service, *dns_name;
 183         char *new_service;
 184         char *new_princ;
 185         enum drsuapi_DsNameStatus namestatus;
 186
 187         /* parse principal */
 188         ret = krb5_parse_name_flags(smb_krb5_context->krb5_context,
 189                                     name, KRB5_PRINCIPAL_PARSE_NO_REALM, &principal);
 190         if (ret) {
 191                 DEBUG(2, ("Could not parse principal: %s: %s",
 192                           name, smb_get_krb5_error_message(smb_krb5_context->krb5_context,
 193                                                            ret, mem_ctx)));
 194                 return WERR_NOMEM;
 195         }
 196
 197         /* grab cifs/, http/ etc */
 198
 199         /* This is checked for in callers, but be safe */
 200         if (principal->name.name_string.len < 2) {
 201                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 202                 return WERR_OK;
 203         }
 204         service = principal->name.name_string.val[0];
 205         dns_name = principal->name.name_string.val[1];
 206
 207         /* MAP it */
 208         namestatus = LDB_lookup_spn_alias(smb_krb5_context->krb5_context,
 209                                           sam_ctx, mem_ctx,
 210                                           service, &new_service);
 211
 212         if (namestatus == DRSUAPI_DS_NAME_STATUS_NOT_FOUND) {
 213                 info1->status           = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
 214                 info1->dns_domain_name  = talloc_strdup(mem_ctx, dns_name);
 215                 if (!info1->dns_domain_name) {
 216                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 217                         return WERR_NOMEM;
 218                 }
 219                 return WERR_OK;
 220         } else if (namestatus != DRSUAPI_DS_NAME_STATUS_OK) {
 221                 info1->status = namestatus;
 222                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 223                 return WERR_OK;
 224         }
 225
 226         /* ooh, very nasty playing around in the Principal... */
 227         free(principal->name.name_string.val[0]);
 228         principal->name.name_string.val[0] = strdup(new_service);
 229         if (!principal->name.name_string.val[0]) {
 230                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 231                 return WERR_NOMEM;
 232         }
 233
 234         /* reform principal */
 235         ret = krb5_unparse_name_flags(smb_krb5_context->krb5_context, principal,
 236                                       KRB5_PRINCIPAL_UNPARSE_NO_REALM, &new_princ);
 237
 238         if (ret) {
 239                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 240                 return WERR_NOMEM;
 241         }
 242
 243         wret = DsCrackNameOneName(sam_ctx, mem_ctx, format_flags, format_offered, format_desired,
 244                                   new_princ, info1);
 245         free(new_princ);
 246         if (W_ERROR_IS_OK(wret) && (info1->status == DRSUAPI_DS_NAME_STATUS_NOT_FOUND)) {
 247                 info1->status           = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
 248                 info1->dns_domain_name  = talloc_strdup(mem_ctx, dns_name);
 249                 if (!info1->dns_domain_name) {
 250                         wret = WERR_NOMEM;
 251                 }
 252         }
 253         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 254         return wret;
 255 }
 256
 257 /* Subcase of CrackNames, for the userPrincipalName */
 258
 259 static WERROR DsCrackNameUPN(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 260                              struct smb_krb5_context *smb_krb5_context,
 261                              uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 262                              const char *name, struct drsuapi_DsNameInfo1 *info1)
 263 {
 264         int ldb_ret;
 265         WERROR status;
 266         const char *domain_filter = NULL;
 267         const char *result_filter = NULL;
 268         krb5_error_code ret;
 269         krb5_principal principal;
 270         char **realm;
 271         char *unparsed_name_short;
 272         const char *domain_attrs[] = { NULL };
 273         struct ldb_message **domain_res = NULL;
 274
 275         /* Prevent recursion */
 276         if (!name) {
 277                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 278                 return WERR_OK;
 279         }
 280
 281         ret = krb5_parse_name_flags(smb_krb5_context->krb5_context, name,
 282                                     KRB5_PRINCIPAL_PARSE_MUST_REALM, &principal);
 283         if (ret) {
 284                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 285                 return WERR_OK;
 286         }
 287
 288         domain_filter = NULL;
 289         realm = krb5_princ_realm(smb_krb5_context->krb5_context, principal);
 290         domain_filter = talloc_asprintf(mem_ctx,
 291                                         "(&(&(|(&(dnsRoot=%s)(nETBIOSName=*))(nETBIOSName=%s))(objectclass=crossRef))(ncName=*))",
 292                                         ldb_binary_encode_string(mem_ctx, *realm),
 293                                         ldb_binary_encode_string(mem_ctx, *realm));
 294
 295         ldb_ret = gendb_search(sam_ctx, mem_ctx, samdb_partitions_dn(sam_ctx, mem_ctx),
 296                                &domain_res, domain_attrs,
 297                                "%s", domain_filter);
 298         switch (ldb_ret) {
 299         case 1:
 300                 break;
 301         case 0:
 302                 return dns_domain_from_principal(smb_krb5_context,
 303                                                  name, info1);
 304         case -1:
 305                 DEBUG(2, ("DsCrackNameUPN domain ref search failed: %s", ldb_errstring(sam_ctx)));
 306                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 307                 return WERR_OK;
 308         default:
 309                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
 310                 return WERR_OK;
 311         }
 312
 313         ret = krb5_unparse_name_flags(smb_krb5_context->krb5_context, principal,
 314                                       KRB5_PRINCIPAL_UNPARSE_NO_REALM, &unparsed_name_short);
 315         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 316
 317         if (ret) {
 318                 free(unparsed_name_short);
 319                 return WERR_NOMEM;
 320         }
 321
 322         /* This may need to be extended for more userPrincipalName variations */
 323         result_filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(samAccountName=%s))",
 324                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short));
 325         if (!result_filter || !domain_filter) {
 326                 free(unparsed_name_short);
 327                 return WERR_NOMEM;
 328         }
 329         status = DsCrackNameOneFilter(sam_ctx, mem_ctx,
 330                                       smb_krb5_context,
 331                                       format_flags, format_offered, format_desired,
 332                                       NULL, unparsed_name_short, domain_filter, result_filter,
 333                                       info1);
 334         free(unparsed_name_short);
 335
 336         return status;
 337 }
 338
 339 /* Crack a single 'name', from format_offered into format_desired, returning the result in info1 */
 340
 341 WERROR DsCrackNameOneName(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 342                           uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 343                           const char *name, struct drsuapi_DsNameInfo1 *info1)
 344 {
 345         krb5_error_code ret;
 346         const char *domain_filter = NULL;
 347         const char *result_filter = NULL;
 348         struct ldb_dn *name_dn = NULL;
 349
 350         struct smb_krb5_context *smb_krb5_context;
 351         ret = smb_krb5_init_context(mem_ctx, &smb_krb5_context);
 352
 353         if (ret) {
 354                 return WERR_NOMEM;
 355         }
 356
 357         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 358         info1->dns_domain_name = NULL;
 359         info1->result_name = NULL;
 360
 361         if (!name) {
 362                 return WERR_INVALID_PARAM;
 363         }
 364
 365         /* TODO: - fill the correct names in all cases!
 366          *       - handle format_flags
 367          */
 368
 369         /* here we need to set the domain_filter and/or the result_filter */
 370         switch (format_offered) {
 371         case DRSUAPI_DS_NAME_FORMAT_CANONICAL:
 372         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX:
 373         {
 374                 char *str, *s, *account;
 375
 376                 if (strlen(name) == 0) {
 377                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 378                         return WERR_OK;
 379                 }
 380
 381                 str = talloc_strdup(mem_ctx, name);
 382                 W_ERROR_HAVE_NO_MEMORY(str);
 383
 384                 if (format_offered == DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX) {
 385                         /* Look backwards for the \n, and replace it with / */
 386                         s = strrchr(str, '\n');
 387                         if (!s) {
 388                                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 389                                 return WERR_OK;
 390                         }
 391                         s[0] = '/';
 392                 }
 393
 394                 s = strchr(str, '/');
 395                 if (!s) {
 396                         /* there must be at least one / */
 397                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 398                         return WERR_OK;
 399                 }
 400
 401                 s[0] = '\0';
 402                 s++;
 403
 404                 domain_filter = talloc_asprintf(mem_ctx, "(&(objectClass=crossRef)(ncName=%s))",
 405                                                 ldb_dn_get_linearized(samdb_dns_domain_to_dn(sam_ctx, mem_ctx, str)));
 406                 W_ERROR_HAVE_NO_MEMORY(domain_filter);
 407
 408                 /* There may not be anything after the domain component (search for the domain itself) */
 409                 if (s[0]) {
 410
 411                         account = strrchr(s, '/');
 412                         if (!account) {
 413                                 account = s;
 414                         } else {
 415                                 account++;
 416                         }
 417                         account = ldb_binary_encode_string(mem_ctx, account);
 418                         W_ERROR_HAVE_NO_MEMORY(account);
 419                         result_filter = talloc_asprintf(mem_ctx, "(name=%s)",
 420                                                         account);
 421                         W_ERROR_HAVE_NO_MEMORY(result_filter);
 422                 }
 423                 break;
 424         }
 425         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT: {
 426                 char *p;
 427                 char *domain;
 428                 const char *account = NULL;
 429
 430                 domain = talloc_strdup(mem_ctx, name);
 431                 W_ERROR_HAVE_NO_MEMORY(domain);
 432
 433                 p = strchr(domain, '\\');
 434                 if (!p) {
 435                         /* invalid input format */
 436                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 437                         return WERR_OK;
 438                 }
 439                 p[0] = '\0';
 440
 441                 if (p[1]) {
 442                         account = &p[1];
 443                 }
 444
 445                 domain_filter = talloc_asprintf(mem_ctx,
 446                                                 "(&(&(nETBIOSName=%s)(objectclass=crossRef))(ncName=*))",
 447                                                 ldb_binary_encode_string(mem_ctx, domain));
 448                 W_ERROR_HAVE_NO_MEMORY(domain_filter);
 449                 if (account) {
 450                         result_filter = talloc_asprintf(mem_ctx, "(sAMAccountName=%s)",
 451                                                         ldb_binary_encode_string(mem_ctx, account));
 452                         W_ERROR_HAVE_NO_MEMORY(result_filter);
 453                 }
 454
 455                 talloc_free(domain);
 456                 break;
 457         }
 458
 459                 /* A LDAP DN as a string */
 460         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779: {
 461                 domain_filter = NULL;
 462                 name_dn = ldb_dn_new(mem_ctx, sam_ctx, name);
 463                 if (! ldb_dn_validate(name_dn)) {
 464                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 465                         return WERR_OK;
 466                 }
 467                 break;
 468         }
 469
 470                 /* A GUID as a string */
 471         case DRSUAPI_DS_NAME_FORMAT_GUID: {
 472                 struct GUID guid;
 473                 char *ldap_guid;
 474                 NTSTATUS nt_status;
 475                 domain_filter = NULL;
 476
 477                 nt_status = GUID_from_string(name, &guid);
 478                 if (!NT_STATUS_IS_OK(nt_status)) {
 479                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 480                         return WERR_OK;
 481                 }
 482
 483                 ldap_guid = ldap_encode_ndr_GUID(mem_ctx, &guid);
 484                 if (!ldap_guid) {
 485                         return WERR_NOMEM;
 486                 }
 487                 result_filter = talloc_asprintf(mem_ctx, "(objectGUID=%s)",
 488                                                 ldap_guid);
 489                 W_ERROR_HAVE_NO_MEMORY(result_filter);
 490                 break;
 491         }
 492         case DRSUAPI_DS_NAME_FORMAT_DISPLAY: {
 493                 domain_filter = NULL;
 494
 495                 result_filter = talloc_asprintf(mem_ctx, "(|(displayName=%s)(samAccountName=%s))",
 496                                                 ldb_binary_encode_string(mem_ctx, name),
 497                                                 ldb_binary_encode_string(mem_ctx, name));
 498                 W_ERROR_HAVE_NO_MEMORY(result_filter);
 499                 break;
 500         }
 501
 502                 /* A S-1234-5678 style string */
 503         case DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY: {
 504                 struct dom_sid *sid = dom_sid_parse_talloc(mem_ctx, name);
 505                 char *ldap_sid;
 506
 507                 domain_filter = NULL;
 508                 if (!sid) {
 509                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 510                         return WERR_OK;
 511                 }
 512                 ldap_sid = ldap_encode_ndr_dom_sid(mem_ctx,
 513                                                    sid);
 514                 if (!ldap_sid) {
 515                         return WERR_NOMEM;
 516                 }
 517                 result_filter = talloc_asprintf(mem_ctx, "(objectSid=%s)",
 518                                                 ldap_sid);
 519                 W_ERROR_HAVE_NO_MEMORY(result_filter);
 520                 break;
 521         }
 522         case DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL: {
 523                 krb5_principal principal;
 524                 char *unparsed_name;
 525                 ret = krb5_parse_name(smb_krb5_context->krb5_context, name, &principal);
 526                 if (ret) {
 527                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 528                         return WERR_OK;
 529                 }
 530
 531                 domain_filter = NULL;
 532
 533                 ret = krb5_unparse_name(smb_krb5_context->krb5_context, principal, &unparsed_name);
 534                 if (ret) {
 535                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 536                         return WERR_NOMEM;
 537                 }
 538
 539                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 540                 result_filter = talloc_asprintf(mem_ctx, "(&(objectClass=user)(userPrincipalName=%s))",
 541                                                 ldb_binary_encode_string(mem_ctx, unparsed_name));
 542
 543                 free(unparsed_name);
 544                 W_ERROR_HAVE_NO_MEMORY(result_filter);
 545                 break;
 546         }
 547         case DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL: {
 548                 krb5_principal principal;
 549                 char *unparsed_name_short;
 550                 char *service;
 551                 ret = krb5_parse_name(smb_krb5_context->krb5_context, name, &principal);
 552                 if (ret == 0 && principal->name.name_string.len < 2) {
 553                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 554                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 555                         return WERR_OK;
 556                 }
 557                 ret = krb5_parse_name_flags(smb_krb5_context->krb5_context, name,
 558                                             KRB5_PRINCIPAL_PARSE_NO_REALM, &principal);
 559                 if (ret) {
 560                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 561
 562                         return dns_domain_from_principal(smb_krb5_context,
 563                                                          name, info1);
 564                 }
 565
 566                 domain_filter = NULL;
 567
 568                 ret = krb5_unparse_name_flags(smb_krb5_context->krb5_context, principal,
 569                                               KRB5_PRINCIPAL_UNPARSE_NO_REALM, &unparsed_name_short);
 570                 if (ret) {
 571                         krb5_free_principal(smb_krb5_context->krb5_context, principal);
 572                         return WERR_NOMEM;
 573                 }
 574
 575                 service = principal->name.name_string.val[0];
 576                 if ((principal->name.name_string.len == 2) && (strcasecmp(service, "host") == 0)) {
 577                         /* the 'cn' attribute is just the leading part of the name */
 578                         char *computer_name;
 579                         computer_name = talloc_strndup(mem_ctx, principal->name.name_string.val[1],
 580                                                       strcspn(principal->name.name_string.val[1], "."));
 581                         if (computer_name == NULL) {
 582                                 return WERR_NOMEM;
 583                         }
 584
 585                         result_filter = talloc_asprintf(mem_ctx, "(|(&(servicePrincipalName=%s)(objectClass=user))(&(cn=%s)(objectClass=computer)))",
 586                                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short),
 587                                                         ldb_binary_encode_string(mem_ctx, computer_name));
 588                 } else {
 589                         result_filter = talloc_asprintf(mem_ctx, "(&(servicePrincipalName=%s)(objectClass=user))",
 590                                                         ldb_binary_encode_string(mem_ctx, unparsed_name_short));
 591                 }
 592                 krb5_free_principal(smb_krb5_context->krb5_context, principal);
 593                 free(unparsed_name_short);
 594                 W_ERROR_HAVE_NO_MEMORY(result_filter);
 595
 596                 break;
 597         }
 598         default: {
 599                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 600                 return WERR_OK;
 601         }
 602
 603         }
 604
 605         if (format_flags & DRSUAPI_DS_NAME_FLAG_SYNTACTICAL_ONLY) {
 606                 return DsCrackNameOneSyntactical(mem_ctx, format_offered, format_desired,
 607                                                  name_dn, name, info1);
 608         }
 609
 610         return DsCrackNameOneFilter(sam_ctx, mem_ctx,
 611                                     smb_krb5_context,
 612                                     format_flags, format_offered, format_desired,
 613                                     name_dn, name,
 614                                     domain_filter, result_filter,
 615                                     info1);
 616 }
 617
 618 /* Subcase of CrackNames.  It is possible to translate a LDAP-style DN
 619  * (FQDN_1779) into a canoical name without actually searching the
 620  * database */
 621
 622 static WERROR DsCrackNameOneSyntactical(TALLOC_CTX *mem_ctx,
 623                                         uint32_t format_offered, uint32_t format_desired,
 624                                         struct ldb_dn *name_dn, const char *name,
 625                                         struct drsuapi_DsNameInfo1 *info1)
 626 {
 627         char *cracked;
 628         if (format_offered != DRSUAPI_DS_NAME_FORMAT_FQDN_1779) {
 629                 info1->status = DRSUAPI_DS_NAME_STATUS_NO_SYNTACTICAL_MAPPING;
 630                 return WERR_OK;
 631         }
 632
 633         switch (format_desired) {
 634         case DRSUAPI_DS_NAME_FORMAT_CANONICAL:
 635                 cracked = ldb_dn_canonical_string(mem_ctx, name_dn);
 636                 break;
 637         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX:
 638                 cracked = ldb_dn_canonical_ex_string(mem_ctx, name_dn);
 639                 break;
 640         default:
 641                 info1->status = DRSUAPI_DS_NAME_STATUS_NO_SYNTACTICAL_MAPPING;
 642                 return WERR_OK;
 643         }
 644         info1->status = DRSUAPI_DS_NAME_STATUS_OK;
 645         info1->result_name      = cracked;
 646         if (!cracked) {
 647                 return WERR_NOMEM;
 648         }
 649
 650         return WERR_OK;
 651 }
 652
 653 /* Given a filter for the domain, and one for the result, perform the
 654  * ldb search. The format offered and desired flags change the
 655  * behaviours, including what attributes to return.
 656  *
 657  * The smb_krb5_context is required because we use the krb5 libs for principal parsing
 658  */
 659
 660 static WERROR DsCrackNameOneFilter(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
 661                                    struct smb_krb5_context *smb_krb5_context,
 662                                    uint32_t format_flags, uint32_t format_offered, uint32_t format_desired,
 663                                    struct ldb_dn *name_dn, const char *name,
 664                                    const char *domain_filter, const char *result_filter,
 665                                    struct drsuapi_DsNameInfo1 *info1)
 666 {
 667         int ldb_ret;
 668         struct ldb_message **domain_res = NULL;
 669         const char * const *domain_attrs;
 670         const char * const *result_attrs;
 671         struct ldb_message **result_res = NULL;
 672         struct ldb_message *result = NULL;
 673         struct ldb_dn *result_basedn = NULL;
 674         struct ldb_dn *partitions_basedn = samdb_partitions_dn(sam_ctx, mem_ctx);
 675         int i;
 676         char *p;
 677
 678         const char * const _domain_attrs_1779[] = { "ncName", "dnsRoot", NULL};
 679         const char * const _result_attrs_null[] = { NULL };
 680
 681         const char * const _domain_attrs_canonical[] = { "ncName", "dnsRoot", NULL};
 682         const char * const _result_attrs_canonical[] = { "canonicalName", NULL };
 683
 684         const char * const _domain_attrs_nt4[] = { "ncName", "dnsRoot", "nETBIOSName", NULL};
 685         const char * const _result_attrs_nt4[] = { "sAMAccountName", "objectSid", "objectClass", NULL};
 686
 687         const char * const _domain_attrs_guid[] = { "ncName", "dnsRoot", NULL};
 688         const char * const _result_attrs_guid[] = { "objectGUID", NULL};
 689
 690         const char * const _domain_attrs_display[] = { "ncName", "dnsRoot", NULL};
 691         const char * const _result_attrs_display[] = { "displayName", "samAccountName", NULL};
 692
 693         const char * const _domain_attrs_none[] = { "ncName", "dnsRoot" };
 694         const char * const _result_attrs_none[] = { NULL};
 695
 696         /* here we need to set the attrs lists for domain and result lookups */
 697         switch (format_desired) {
 698         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779:
 699         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX:
 700                 domain_attrs = _domain_attrs_1779;
 701                 result_attrs = _result_attrs_null;
 702                 break;
 703         case DRSUAPI_DS_NAME_FORMAT_CANONICAL:
 704                 domain_attrs = _domain_attrs_canonical;
 705                 result_attrs = _result_attrs_canonical;
 706                 break;
 707         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT:
 708                 domain_attrs = _domain_attrs_nt4;
 709                 result_attrs = _result_attrs_nt4;
 710                 break;
 711         case DRSUAPI_DS_NAME_FORMAT_GUID:
 712                 domain_attrs = _domain_attrs_guid;
 713                 result_attrs = _result_attrs_guid;
 714                 break;
 715         case DRSUAPI_DS_NAME_FORMAT_DISPLAY:
 716                 domain_attrs = _domain_attrs_display;
 717                 result_attrs = _result_attrs_display;
 718                 break;
 719         default:
 720                 domain_attrs = _domain_attrs_none;
 721                 result_attrs = _result_attrs_none;
 722                 break;
 723         }
 724
 725         if (domain_filter) {
 726                 /* if we have a domain_filter look it up and set the result_basedn and the dns_domain_name */
 727                 ldb_ret = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &domain_res, domain_attrs,
 728                                        "%s", domain_filter);
 729                 switch (ldb_ret) {
 730                 case 1:
 731                         break;
 732                 case 0:
 733                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 734                         return WERR_OK;
 735                 case -1:
 736                         DEBUG(2, ("DsCrackNameOneFilter domain ref search failed: %s", ldb_errstring(sam_ctx)));
 737                         info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 738                         return WERR_OK;
 739                 default:
 740                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
 741                         return WERR_OK;
 742                 }
 743
 744                 info1->dns_domain_name  = samdb_result_string(domain_res[0], "dnsRoot", NULL);
 745                 W_ERROR_HAVE_NO_MEMORY(info1->dns_domain_name);
 746                 info1->status           = DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY;
 747         } else {
 748                 info1->dns_domain_name  = NULL;
 749                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 750         }
 751
 752         if (result_filter) {
 753                 if (domain_res) {
 754                         result_basedn = samdb_result_dn(sam_ctx, mem_ctx, domain_res[0], "ncName", NULL);
 755
 756                         ldb_ret = gendb_search(sam_ctx, mem_ctx, result_basedn, &result_res,
 757                                                result_attrs, "%s", result_filter);
 758                 } else {
 759                         /* search with the 'phantom root' flag */
 760                         struct ldb_request *req;
 761                         int ret;
 762                         struct ldb_result *res;
 763
 764                         res = talloc_zero(mem_ctx, struct ldb_result);
 765                         W_ERROR_HAVE_NO_MEMORY(res);
 766
 767                         ret = ldb_build_search_req(&req, sam_ctx, mem_ctx,
 768                                                    ldb_get_root_basedn(sam_ctx),
 769                                                    LDB_SCOPE_SUBTREE,
 770                                                    result_filter,
 771                                                    result_attrs,
 772                                                    NULL,
 773                                                    res,
 774                                                    ldb_search_default_callback);
 775                         if (ret == LDB_SUCCESS) {
 776                                 struct ldb_search_options_control *search_options;
 777                                 search_options = talloc(req, struct ldb_search_options_control);
 778                                 W_ERROR_HAVE_NO_MEMORY(search_options);
 779                                 search_options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
 780
 781                                 ret = ldb_request_add_control(req, LDB_CONTROL_SEARCH_OPTIONS_OID, false, search_options);
 782                         }
 783                         if (ret != LDB_SUCCESS) {
 784                                 talloc_free(res);
 785                                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 786                                 return WERR_OK;
 787                         }
 788
 789                         ldb_set_timeout(sam_ctx, req, 0); /* use default timeout */
 790
 791                         ret = ldb_request(sam_ctx, req);
 792
 793                         if (ret == LDB_SUCCESS) {
 794                                 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
 795                         }
 796
 797                         talloc_free(req);
 798
 799                         if (ret != LDB_SUCCESS) {
 800                                 DEBUG(2, ("DsCrackNameOneFilter phantom root search failed: %s",
 801                                           ldb_errstring(sam_ctx)));
 802                                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 803                                 return WERR_OK;
 804                         }
 805                         ldb_ret = res->count;
 806                         result_res = res->msgs;
 807                 }
 808         } else if (format_offered == DRSUAPI_DS_NAME_FORMAT_FQDN_1779) {
 809                 ldb_ret = gendb_search_dn(sam_ctx, mem_ctx, name_dn, &result_res,
 810                                           result_attrs);
 811         } else if (domain_res) {
 812                 name_dn = samdb_result_dn(sam_ctx, mem_ctx, domain_res[0], "ncName", NULL);
 813                 ldb_ret = gendb_search_dn(sam_ctx, mem_ctx, name_dn, &result_res,
 814                                           result_attrs);
 815         } else {
 816                 /* Can't happen */
 817                 DEBUG(0, ("LOGIC ERROR: DsCrackNameOneFilter domain ref search not availible: This can't happen..."));
 818                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 819                 return WERR_OK;
 820         }
 821
 822         switch (ldb_ret) {
 823         case 1:
 824                 result = result_res[0];
 825                 break;
 826         case 0:
 827                 switch (format_offered) {
 828                 case DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL:
 829                         return DsCrackNameSPNAlias(sam_ctx, mem_ctx,
 830                                                    smb_krb5_context,
 831                                                    format_flags, format_offered, format_desired,
 832                                                    name, info1);
 833
 834                 case DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL:
 835                         return DsCrackNameUPN(sam_ctx, mem_ctx, smb_krb5_context,
 836                                               format_flags, format_offered, format_desired,
 837                                               name, info1);
 838                 }
 839                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 840                 return WERR_OK;
 841         case -1:
 842                 DEBUG(2, ("DsCrackNameOneFilter result search failed: %s", ldb_errstring(sam_ctx)));
 843                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 844                 return WERR_OK;
 845         default:
 846                 switch (format_offered) {
 847                 case DRSUAPI_DS_NAME_FORMAT_CANONICAL:
 848                 case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX:
 849                 {
 850                         const char *canonical_name = NULL; /* Not required, but we get warnings... */
 851                         /* We may need to manually filter further */
 852                         for (i = 0; i < ldb_ret; i++) {
 853                                 switch (format_offered) {
 854                                 case DRSUAPI_DS_NAME_FORMAT_CANONICAL:
 855                                         canonical_name = ldb_dn_canonical_string(mem_ctx, result_res[i]->dn);
 856                                         break;
 857                                 case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX:
 858                                         canonical_name = ldb_dn_canonical_ex_string(mem_ctx, result_res[i]->dn);
 859                                         break;
 860                                 }
 861                                 if (strcasecmp_m(canonical_name, name) == 0) {
 862                                         result = result_res[i];
 863                                         break;
 864                                 }
 865                         }
 866                         if (!result) {
 867                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 868                                 return WERR_OK;
 869                         }
 870                 }
 871                 default:
 872                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
 873                         return WERR_OK;
 874                 }
 875         }
 876
 877         info1->dns_domain_name = ldb_dn_canonical_string(mem_ctx, result->dn);
 878         W_ERROR_HAVE_NO_MEMORY(info1->dns_domain_name);
 879         p = strchr(info1->dns_domain_name, '/');
 880         if (p) {
 881                 p[0] = '\0';
 882         }
 883
 884         /* here we can use result and domain_res[0] */
 885         switch (format_desired) {
 886         case DRSUAPI_DS_NAME_FORMAT_FQDN_1779: {
 887                 info1->result_name      = ldb_dn_alloc_linearized(mem_ctx, result->dn);
 888                 W_ERROR_HAVE_NO_MEMORY(info1->result_name);
 889
 890                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 891                 return WERR_OK;
 892         }
 893         case DRSUAPI_DS_NAME_FORMAT_CANONICAL: {
 894                 info1->result_name      = samdb_result_string(result, "canonicalName", NULL);
 895                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 896                 return WERR_OK;
 897         }
 898         case DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX: {
 899                 /* Not in the virtual ldb attribute */
 900                 return DsCrackNameOneSyntactical(mem_ctx,
 901                                                  DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
 902                                                  DRSUAPI_DS_NAME_FORMAT_CANONICAL_EX,
 903                                                  result->dn, name, info1);
 904         }
 905         case DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT: {
 906
 907                 const struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, result, "objectSid");
 908                 const char *_acc = "", *_dom = "";
 909
 910                 if (samdb_find_attribute(sam_ctx, result, "objectClass", "domain")) {
 911                         ldb_ret = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &domain_res, domain_attrs,
 912                                                "(ncName=%s)", ldb_dn_get_linearized(result->dn));
 913                         if (ldb_ret != 1) {
 914                                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 915                                 return WERR_OK;
 916                         }
 917                         _dom = samdb_result_string(domain_res[0], "nETBIOSName", NULL);
 918                         W_ERROR_HAVE_NO_MEMORY(_dom);
 919                 } else {
 920                         _acc = samdb_result_string(result, "sAMAccountName", NULL);
 921                         if (!_acc) {
 922                                 info1->status = DRSUAPI_DS_NAME_STATUS_NO_MAPPING;
 923                                 return WERR_OK;
 924                         }
 925                         if (dom_sid_in_domain(dom_sid_parse_talloc(mem_ctx, SID_BUILTIN), sid)) {
 926                                 _dom = "BUILTIN";
 927                         } else {
 928                                 const char *attrs[] = { NULL };
 929                                 struct ldb_message **domain_res2;
 930                                 struct dom_sid *dom_sid = dom_sid_dup(mem_ctx, sid);
 931                                 if (!dom_sid) {
 932                                         return WERR_OK;
 933                                 }
 934                                 dom_sid->num_auths--;
 935                                 ldb_ret = gendb_search(sam_ctx, mem_ctx, NULL, &domain_res, attrs,
 936                                                        "(&(objectSid=%s)(objectClass=domain))", ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
 937                                 if (ldb_ret != 1) {
 938                                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 939                                         return WERR_OK;
 940                                 }
 941                                 ldb_ret = gendb_search(sam_ctx, mem_ctx, partitions_basedn, &domain_res2, domain_attrs,
 942                                                        "(ncName=%s)", ldb_dn_get_linearized(domain_res[0]->dn));
 943                                 if (ldb_ret != 1) {
 944                                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 945                                         return WERR_OK;
 946                                 }
 947
 948                                 _dom = samdb_result_string(domain_res2[0], "nETBIOSName", NULL);
 949                                 W_ERROR_HAVE_NO_MEMORY(_dom);
 950                         }
 951                 }
 952
 953                 info1->result_name      = talloc_asprintf(mem_ctx, "%s\\%s", _dom, _acc);
 954                 W_ERROR_HAVE_NO_MEMORY(info1->result_name);
 955
 956                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 957                 return WERR_OK;
 958         }
 959         case DRSUAPI_DS_NAME_FORMAT_GUID: {
 960                 struct GUID guid;
 961
 962                 guid = samdb_result_guid(result, "objectGUID");
 963
 964                 info1->result_name      = GUID_string2(mem_ctx, &guid);
 965                 W_ERROR_HAVE_NO_MEMORY(info1->result_name);
 966
 967                 info1->status           = DRSUAPI_DS_NAME_STATUS_OK;
 968                 return WERR_OK;
 969         }
 970         case DRSUAPI_DS_NAME_FORMAT_DISPLAY: {
 971                 info1->result_name      = samdb_result_string(result, "displayName", NULL);
 972                 if (!info1->result_name) {
 973                         info1->result_name      = samdb_result_string(result, "sAMAccountName", NULL);
 974                 }
 975                 if (!info1->result_name) {
 976                         info1->status = DRSUAPI_DS_NAME_STATUS_NOT_FOUND;
 977                 } else {
 978                         info1->status = DRSUAPI_DS_NAME_STATUS_OK;
 979                 }
 980                 return WERR_OK;
 981         }
 982         case DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL: {
 983                 info1->status = DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE;
 984                 return WERR_OK;
 985         }
 986         case DRSUAPI_DS_NAME_FORMAT_DNS_DOMAIN:
 987         case DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY: {
 988                 info1->status = DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR;
 989                 return WERR_OK;
 990         }
 991         default:
 992                 info1->status = DRSUAPI_DS_NAME_STATUS_NO_MAPPING;
 993                 return WERR_OK;
 994         }
 995 }
 996
 997 /* Given a user Principal Name (such as foo@bar.com),
 998  * return the user and domain DNs.  This is used in the KDC to then
 999  * return the Keys and evaluate policy */
1000
1001 NTSTATUS crack_user_principal_name(struct ldb_context *sam_ctx,
1002                                    TALLOC_CTX *mem_ctx,
1003                                    const char *user_principal_name,
1004                                    struct ldb_dn **user_dn,
1005                                    struct ldb_dn **domain_dn)
1006 {
1007         WERROR werr;
1008         struct drsuapi_DsNameInfo1 info1;
1009         werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
1010                                   DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL,
1011                                   DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
1012                                   user_principal_name,
1013                                   &info1);
1014         if (!W_ERROR_IS_OK(werr)) {
1015                 return werror_to_ntstatus(werr);
1016         }
1017         switch (info1.status) {
1018         case DRSUAPI_DS_NAME_STATUS_OK:
1019                 break;
1020         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
1021         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
1022         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
1023                 return NT_STATUS_NO_SUCH_USER;
1024         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
1025         default:
1026                 return NT_STATUS_UNSUCCESSFUL;
1027         }
1028
1029         *user_dn = ldb_dn_new(mem_ctx, sam_ctx, info1.result_name);
1030
1031         if (domain_dn) {
1032                 werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
1033                                           DRSUAPI_DS_NAME_FORMAT_CANONICAL,
1034                                           DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
1035                                           talloc_asprintf(mem_ctx, "%s/",
1036                                                           info1.dns_domain_name),
1037                                           &info1);
1038                 if (!W_ERROR_IS_OK(werr)) {
1039                         return werror_to_ntstatus(werr);
1040                 }
1041                 switch (info1.status) {
1042                 case DRSUAPI_DS_NAME_STATUS_OK:
1043                         break;
1044                 case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
1045                 case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
1046                 case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
1047                         return NT_STATUS_NO_SUCH_USER;
1048                 case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
1049                 default:
1050                         return NT_STATUS_UNSUCCESSFUL;
1051                 }
1052
1053                 *domain_dn = ldb_dn_new(mem_ctx, sam_ctx, info1.result_name);
1054         }
1055
1056         return NT_STATUS_OK;
1057
1058 }
1059
1060 /* Given a Service Principal Name (such as host/foo.bar.com@BAR.COM),
1061  * return the user and domain DNs.  This is used in the KDC to then
1062  * return the Keys and evaluate policy */
1063
1064 NTSTATUS crack_service_principal_name(struct ldb_context *sam_ctx,
1065                                       TALLOC_CTX *mem_ctx,
1066                                       const char *service_principal_name,
1067                                       struct ldb_dn **user_dn,
1068                                       struct ldb_dn **domain_dn)
1069 {
1070         WERROR werr;
1071         struct drsuapi_DsNameInfo1 info1;
1072         werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
1073                                   DRSUAPI_DS_NAME_FORMAT_SERVICE_PRINCIPAL,
1074                                   DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
1075                                   service_principal_name,
1076                                   &info1);
1077         if (!W_ERROR_IS_OK(werr)) {
1078                 return werror_to_ntstatus(werr);
1079         }
1080         switch (info1.status) {
1081         case DRSUAPI_DS_NAME_STATUS_OK:
1082                 break;
1083         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
1084         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
1085         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
1086                 return NT_STATUS_NO_SUCH_USER;
1087         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
1088         default:
1089                 return NT_STATUS_UNSUCCESSFUL;
1090         }
1091
1092         *user_dn = ldb_dn_new(mem_ctx, sam_ctx, info1.result_name);
1093
1094         if (domain_dn) {
1095                 werr = DsCrackNameOneName(sam_ctx, mem_ctx, 0,
1096                                           DRSUAPI_DS_NAME_FORMAT_CANONICAL,
1097                                           DRSUAPI_DS_NAME_FORMAT_FQDN_1779,
1098                                           talloc_asprintf(mem_ctx, "%s/",
1099                                                           info1.dns_domain_name),
1100                                           &info1);
1101                 if (!W_ERROR_IS_OK(werr)) {
1102                         return werror_to_ntstatus(werr);
1103                 }
1104                 switch (info1.status) {
1105                 case DRSUAPI_DS_NAME_STATUS_OK:
1106                         break;
1107                 case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
1108                 case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
1109                 case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
1110                         return NT_STATUS_NO_SUCH_USER;
1111                 case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
1112                 default:
1113                         return NT_STATUS_UNSUCCESSFUL;
1114                 }
1115
1116                 *domain_dn = ldb_dn_new(mem_ctx, sam_ctx, info1.result_name);
1117         }
1118
1119         return NT_STATUS_OK;
1120
1121 }
1122
1123 NTSTATUS crack_name_to_nt4_name(TALLOC_CTX *mem_ctx,
1124                                 uint32_t format_offered,
1125                                 const char *name,
1126                                 const char **nt4_domain, const char **nt4_account)
1127 {
1128         WERROR werr;
1129         struct drsuapi_DsNameInfo1 info1;
1130         struct ldb_context *ldb;
1131         char *p;
1132
1133         /* Handle anonymous bind */
1134         if (!name || !*name) {
1135                 *nt4_domain = "";
1136                 *nt4_account = "";
1137                 return NT_STATUS_OK;
1138         }
1139
1140         ldb = samdb_connect(mem_ctx, system_session(mem_ctx));
1141         if (ldb == NULL) {
1142                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1143         }
1144
1145         werr = DsCrackNameOneName(ldb, mem_ctx, 0,
1146                                   format_offered,
1147                                   DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT,
1148                                   name,
1149                                   &info1);
1150         if (!W_ERROR_IS_OK(werr)) {
1151                 return werror_to_ntstatus(werr);
1152         }
1153         switch (info1.status) {
1154         case DRSUAPI_DS_NAME_STATUS_OK:
1155                 break;
1156         case DRSUAPI_DS_NAME_STATUS_NOT_FOUND:
1157         case DRSUAPI_DS_NAME_STATUS_DOMAIN_ONLY:
1158         case DRSUAPI_DS_NAME_STATUS_NOT_UNIQUE:
1159                 return NT_STATUS_NO_SUCH_USER;
1160         case DRSUAPI_DS_NAME_STATUS_RESOLVE_ERROR:
1161         default:
1162                 return NT_STATUS_UNSUCCESSFUL;
1163         }
1164
1165         *nt4_domain = talloc_strdup(mem_ctx, info1.result_name);
1166
1167         p = strchr(*nt4_domain, '\\');
1168         if (!p) {
1169                 return NT_STATUS_INVALID_PARAMETER;
1170         }
1171         p[0] = '\0';
1172
1173         if (p[1]) {
1174                 *nt4_account = talloc_strdup(mem_ctx, &p[1]);
1175         }
1176
1177         if (!*nt4_account || !*nt4_domain) {
1178                 return NT_STATUS_NO_MEMORY;
1179         }
1180
1181         return NT_STATUS_OK;
1182 }
1183
1184 NTSTATUS crack_auto_name_to_nt4_name(TALLOC_CTX *mem_ctx,
1185                                      const char *name,
1186                                      const char **nt4_domain,
1187                                      const char **nt4_account)
1188 {
1189         uint32_t format_offered = DRSUAPI_DS_NAME_FORMAT_UKNOWN;
1190
1191         /* Handle anonymous bind */
1192         if (!name || !*name) {
1193                 *nt4_domain = "";
1194                 *nt4_account = "";
1195                 return NT_STATUS_OK;
1196         }
1197
1198         if (strchr_m(name, '=')) {
1199                 format_offered = DRSUAPI_DS_NAME_FORMAT_FQDN_1779;
1200         } else if (strchr_m(name, '@')) {
1201                 format_offered = DRSUAPI_DS_NAME_FORMAT_USER_PRINCIPAL;
1202         } else if (strchr_m(name, '\\')) {
1203                 format_offered = DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT;
1204         } else if (strchr_m(name, '/')) {
1205                 format_offered = DRSUAPI_DS_NAME_FORMAT_CANONICAL;
1206         }
1207
1208         return crack_name_to_nt4_name(mem_ctx, format_offered, name, nt4_domain, nt4_account);
1209 }