source3/auth/server_info.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    Authentication utility functions
   4    Copyright (C) Volker Lendecke 2010
   5
   6    This program is free software; you can redistribute it and/or modify
   7    it under the terms of the GNU General Public License as published by
   8    the Free Software Foundation; either version 3 of the License, or
   9    (at your option) any later version.
  10
  11    This program is distributed in the hope that it will be useful,
  12    but WITHOUT ANY WARRANTY; without even the implied warranty of
  13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14    GNU General Public License for more details.
  15
  16    You should have received a copy of the GNU General Public License
  17    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  18 */
  19
  20 #include "includes.h"
  21 #include "auth.h"
  22 #include "lib/util_unixsids.h"
  23 #include "../lib/crypto/arcfour.h"
  24 #include "../librpc/gen_ndr/netlogon.h"
  25 #include "../libcli/security/security.h"
  26 #include "rpc_client/util_netlogon.h"
  27 #include "nsswitch/libwbclient/wbclient.h"
  28 #include "lib/winbind_util.h"
  29 #include "passdb.h"
  30
  31 #undef DBGC_CLASS
  32 #define DBGC_CLASS DBGC_AUTH
  33
  34 /***************************************************************************
  35  Make a server_info struct. Free with TALLOC_FREE().
  36 ***************************************************************************/
  37
  38 struct auth_serversupplied_info *make_server_info(TALLOC_CTX *mem_ctx)
  39 {
  40         struct auth_serversupplied_info *result;
  41
  42         result = talloc_zero(mem_ctx, struct auth_serversupplied_info);
  43         if (result == NULL) {
  44                 DEBUG(0, ("talloc failed\n"));
  45                 return NULL;
  46         }
  47
  48         /* Initialise the uid and gid values to something non-zero
  49            which may save us from giving away root access if there
  50            is a bug in allocating these fields. */
  51
  52         result->utok.uid = -1;
  53         result->utok.gid = -1;
  54
  55         return result;
  56 }
  57
  58 /****************************************************************************
  59  inits a netr_SamInfo2 structure from an auth_serversupplied_info. sam2 must
  60  already be initialized and is used as the talloc parent for its members.
  61 *****************************************************************************/
  62
  63 NTSTATUS serverinfo_to_SamInfo2(struct auth_serversupplied_info *server_info,
  64                                 struct netr_SamInfo2 *sam2)
  65 {
  66         struct netr_SamInfo3 *info3;
  67
  68         info3 = copy_netr_SamInfo3(sam2, server_info->info3);
  69         if (!info3) {
  70                 return NT_STATUS_NO_MEMORY;
  71         }
  72
  73         if (server_info->session_key.length) {
  74                 memcpy(info3->base.key.key,
  75                        server_info->session_key.data,
  76                        MIN(sizeof(info3->base.key.key),
  77                            server_info->session_key.length));
  78         }
  79         if (server_info->lm_session_key.length) {
  80                 memcpy(info3->base.LMSessKey.key,
  81                        server_info->lm_session_key.data,
  82                        MIN(sizeof(info3->base.LMSessKey.key),
  83                            server_info->lm_session_key.length));
  84         }
  85
  86         sam2->base = info3->base;
  87
  88         return NT_STATUS_OK;
  89 }
  90
  91 /****************************************************************************
  92  inits a netr_SamInfo3 structure from an auth_serversupplied_info. sam3 must
  93  already be initialized and is used as the talloc parent for its members.
  94 *****************************************************************************/
  95
  96 NTSTATUS serverinfo_to_SamInfo3(const struct auth_serversupplied_info *server_info,
  97                                 struct netr_SamInfo3 *sam3)
  98 {
  99         struct netr_SamInfo3 *info3;
 100
 101         info3 = copy_netr_SamInfo3(sam3, server_info->info3);
 102         if (!info3) {
 103                 return NT_STATUS_NO_MEMORY;
 104         }
 105
 106         if (server_info->session_key.length) {
 107                 memcpy(info3->base.key.key,
 108                        server_info->session_key.data,
 109                        MIN(sizeof(info3->base.key.key),
 110                            server_info->session_key.length));
 111         }
 112         if (server_info->lm_session_key.length) {
 113                 memcpy(info3->base.LMSessKey.key,
 114                        server_info->lm_session_key.data,
 115                        MIN(sizeof(info3->base.LMSessKey.key),
 116                            server_info->lm_session_key.length));
 117         }
 118
 119         sam3->base = info3->base;
 120
 121         sam3->sidcount          = 0;
 122         sam3->sids              = NULL;
 123
 124         return NT_STATUS_OK;
 125 }
 126
 127 /****************************************************************************
 128  inits a netr_SamInfo6 structure from an auth_serversupplied_info. sam6 must
 129  already be initialized and is used as the talloc parent for its members.
 130 *****************************************************************************/
 131
 132 NTSTATUS serverinfo_to_SamInfo6(struct auth_serversupplied_info *server_info,
 133                                 struct netr_SamInfo6 *sam6)
 134 {
 135         struct pdb_domain_info *dominfo;
 136         struct netr_SamInfo3 *info3;
 137
 138         if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
 139                 DEBUG(10,("Not adding validation info level 6 "
 140                            "without ADS passdb backend\n"));
 141                 return NT_STATUS_INVALID_INFO_CLASS;
 142         }
 143
 144         dominfo = pdb_get_domain_info(sam6);
 145         if (dominfo == NULL) {
 146                 return NT_STATUS_NO_MEMORY;
 147         }
 148
 149         info3 = copy_netr_SamInfo3(sam6, server_info->info3);
 150         if (!info3) {
 151                 return NT_STATUS_NO_MEMORY;
 152         }
 153
 154         if (server_info->session_key.length) {
 155                 memcpy(info3->base.key.key,
 156                        server_info->session_key.data,
 157                        MIN(sizeof(info3->base.key.key),
 158                            server_info->session_key.length));
 159         }
 160         if (server_info->lm_session_key.length) {
 161                 memcpy(info3->base.LMSessKey.key,
 162                        server_info->lm_session_key.data,
 163                        MIN(sizeof(info3->base.LMSessKey.key),
 164                            server_info->lm_session_key.length));
 165         }
 166
 167         sam6->base = info3->base;
 168
 169         sam6->sidcount          = 0;
 170         sam6->sids              = NULL;
 171
 172         sam6->dns_domainname.string = talloc_strdup(sam6, dominfo->dns_domain);
 173         if (sam6->dns_domainname.string == NULL) {
 174                 return NT_STATUS_NO_MEMORY;
 175         }
 176
 177         sam6->principal_name.string = talloc_asprintf(
 178                 sam6, "%s@%s", sam6->base.account_name.string,
 179                 sam6->dns_domainname.string);
 180         if (sam6->principal_name.string == NULL) {
 181                 return NT_STATUS_NO_MEMORY;
 182         }
 183
 184         return NT_STATUS_OK;
 185 }
 186
 187 static NTSTATUS append_netr_SidAttr(TALLOC_CTX *mem_ctx,
 188                                     struct netr_SidAttr **sids,
 189                                     uint32_t *count,
 190                                     const struct dom_sid2 *asid,
 191                                     uint32_t attributes)
 192 {
 193         uint32_t t = *count;
 194
 195         *sids = talloc_realloc(mem_ctx, *sids, struct netr_SidAttr, t + 1);
 196         if (*sids == NULL) {
 197                 return NT_STATUS_NO_MEMORY;
 198         }
 199         (*sids)[t].sid = dom_sid_dup(*sids, asid);
 200         if ((*sids)[t].sid == NULL) {
 201                 return NT_STATUS_NO_MEMORY;
 202         }
 203         (*sids)[t].attributes = attributes;
 204         *count = t + 1;
 205
 206         return NT_STATUS_OK;
 207 }
 208
 209 /* Fills the samr_RidWithAttributeArray with the provided sids.
 210  * If it happens that we have additional groups that do not belong
 211  * to the domain, add their sids as extra sids */
 212 static NTSTATUS group_sids_to_info3(struct netr_SamInfo3 *info3,
 213                                     const struct dom_sid *sids,
 214                                     size_t num_sids)
 215 {
 216         uint32_t attributes = SE_GROUP_MANDATORY |
 217                                 SE_GROUP_ENABLED_BY_DEFAULT |
 218                                 SE_GROUP_ENABLED;
 219         struct samr_RidWithAttributeArray *groups;
 220         struct dom_sid *domain_sid;
 221         unsigned int i;
 222         NTSTATUS status;
 223         uint32_t rid;
 224         bool ok;
 225
 226         domain_sid = info3->base.domain_sid;
 227         groups = &info3->base.groups;
 228
 229         groups->rids = talloc_array(info3,
 230                                     struct samr_RidWithAttribute, num_sids);
 231         if (!groups->rids) {
 232                 return NT_STATUS_NO_MEMORY;
 233         }
 234
 235         for (i = 0; i < num_sids; i++) {
 236                 ok = sid_peek_check_rid(domain_sid, &sids[i], &rid);
 237                 if (ok) {
 238                         /* store domain group rid */
 239                         groups->rids[groups->count].rid = rid;
 240                         groups->rids[groups->count].attributes = attributes;
 241                         groups->count++;
 242                         continue;
 243                 }
 244
 245                 /* if this wasn't a domain sid, add it as extra sid */
 246                 status = append_netr_SidAttr(info3, &info3->sids,
 247                                              &info3->sidcount,
 248                                              &sids[i], attributes);
 249                 if (!NT_STATUS_IS_OK(status)) {
 250                         return status;
 251                 }
 252         }
 253
 254         return NT_STATUS_OK;
 255 }
 256
 257 /*
 258  * Merge resource SIDs, if any, into the passed in info3 structure.
 259  */
 260
 261 static NTSTATUS merge_resource_sids(const struct PAC_LOGON_INFO *logon_info,
 262                                 struct netr_SamInfo3 *info3)
 263 {
 264         uint32_t i = 0;
 265         const struct PAC_DOMAIN_GROUP_MEMBERSHIP *rg = NULL;
 266
 267         if (logon_info->info3.base.user_flags & NETLOGON_RESOURCE_GROUPS) {
 268                 rg = &logon_info->resource_groups;
 269         }
 270
 271         if (rg == NULL) {
 272                 return NT_STATUS_OK;
 273         }
 274
 275         if (rg->domain_sid == NULL) {
 276                 DEBUG(10, ("Missing Resource Group Domain SID\n"));
 277                 return NT_STATUS_INVALID_PARAMETER;
 278         }
 279
 280         /* The IDL layer would be a better place to check this, but to
 281          * guard the integer addition below, we double-check */
 282         if (rg->groups.count > 65535) {
 283                 DEBUG(10, ("Too much Resource Group RIDs %u\n",
 284                           (unsigned)rg->groups.count));
 285                 return NT_STATUS_INVALID_PARAMETER;
 286         }
 287
 288         /*
 289          * If there are any resource groups (SID Compression) add
 290          * them to the extra sids portion of the info3 in the PAC.
 291          *
 292          * This makes the info3 look like it would if we got the info
 293          * from the DC rather than the PAC.
 294          */
 295
 296         /*
 297          * Construct a SID for each RID in the list and then append it
 298          * to the info3.
 299          */
 300         for (i = 0; i < rg->groups.count; i++) {
 301                 NTSTATUS status;
 302                 struct dom_sid new_sid;
 303                 uint32_t attributes = rg->groups.rids[i].attributes;
 304
 305                 sid_compose(&new_sid,
 306                             rg->domain_sid,
 307                             rg->groups.rids[i].rid);
 308
 309                 DEBUG(10, ("Adding SID %s to extra SIDS\n",
 310                         sid_string_dbg(&new_sid)));
 311
 312                 status = append_netr_SidAttr(info3, &info3->sids,
 313                                         &info3->sidcount,
 314                                         &new_sid,
 315                                         attributes);
 316                 if (!NT_STATUS_IS_OK(status)) {
 317                         DEBUG(1, ("failed to append SID %s to extra SIDS: %s\n",
 318                                 sid_string_dbg(&new_sid),
 319                                 nt_errstr(status)));
 320                         return status;
 321                 }
 322         }
 323
 324         return NT_STATUS_OK;
 325 }
 326
 327 /*
 328  * Create a copy of an info3 struct from the struct PAC_LOGON_INFO,
 329  * then merge resource SIDs, if any, into it. If successful return
 330  * the created info3 struct.
 331  */
 332
 333 NTSTATUS create_info3_from_pac_logon_info(TALLOC_CTX *mem_ctx,
 334                                         const struct PAC_LOGON_INFO *logon_info,
 335                                         struct netr_SamInfo3 **pp_info3)
 336 {
 337         NTSTATUS status;
 338         struct netr_SamInfo3 *info3 = copy_netr_SamInfo3(mem_ctx,
 339                                         &logon_info->info3);
 340         if (info3 == NULL) {
 341                 return NT_STATUS_NO_MEMORY;
 342         }
 343         status = merge_resource_sids(logon_info, info3);
 344         if (!NT_STATUS_IS_OK(status)) {
 345                 TALLOC_FREE(info3);
 346                 return status;
 347         }
 348         *pp_info3 = info3;
 349         return NT_STATUS_OK;
 350 }
 351
 352 /*
 353  * Check if this is a "Unix Users" domain user, or a
 354  * "Unix Groups" domain group, we need to handle it
 355  * in a special way if that's the case.
 356  */
 357
 358 static NTSTATUS SamInfo3_handle_sids(const char *username,
 359                         const struct dom_sid *user_sid,
 360                         const struct dom_sid *group_sid,
 361                         struct netr_SamInfo3 *info3,
 362                         struct dom_sid *domain_sid,
 363                         struct extra_auth_info *extra)
 364 {
 365         if (sid_check_is_in_unix_users(user_sid)) {
 366                 /* in info3 you can only set rids for the user and the
 367                  * primary group, and the domain sid must be that of
 368                  * the sam domain.
 369                  *
 370                  * Store a completely bogus value here.
 371                  * The real SID is stored in the extra sids.
 372                  * Other code will know to look there if (-1) is found
 373                  */
 374                 info3->base.rid = (uint32_t)(-1);
 375                 sid_copy(&extra->user_sid, user_sid);
 376
 377                 DEBUG(10, ("Unix User found. Rid marked as "
 378                         "special and sid (%s) saved as extra sid\n",
 379                         sid_string_dbg(user_sid)));
 380         } else {
 381                 sid_copy(domain_sid, user_sid);
 382                 sid_split_rid(domain_sid, &info3->base.rid);
 383         }
 384
 385         if (is_null_sid(domain_sid)) {
 386                 sid_copy(domain_sid, get_global_sam_sid());
 387         }
 388
 389         /* check if this is a "Unix Groups" domain group,
 390          * if so we need special handling */
 391         if (sid_check_is_in_unix_groups(group_sid)) {
 392                 /* in info3 you can only set rids for the user and the
 393                  * primary group, and the domain sid must be that of
 394                  * the sam domain.
 395                  *
 396                  * Store a completely bogus value here.
 397                  * The real SID is stored in the extra sids.
 398                  * Other code will know to look there if (-1) is found
 399                  */
 400                 info3->base.primary_gid = (uint32_t)(-1);
 401                 sid_copy(&extra->pgid_sid, group_sid);
 402
 403                 DEBUG(10, ("Unix Group found. Rid marked as "
 404                         "special and sid (%s) saved as extra sid\n",
 405                         sid_string_dbg(group_sid)));
 406         } else {
 407                 bool ok = sid_peek_check_rid(domain_sid, group_sid,
 408                                         &info3->base.primary_gid);
 409                 if (!ok) {
 410                         DEBUG(1, ("The primary group domain sid(%s) does not "
 411                                 "match the domain sid(%s) for %s(%s)\n",
 412                                 sid_string_dbg(group_sid),
 413                                 sid_string_dbg(domain_sid),
 414                                 username,
 415                                 sid_string_dbg(user_sid)));
 416                         return NT_STATUS_INVALID_SID;
 417                 }
 418         }
 419         return NT_STATUS_OK;
 420 }
 421
 422 #define RET_NOMEM(ptr) do { \
 423         if (!ptr) { \
 424                 TALLOC_FREE(info3); \
 425                 return NT_STATUS_NO_MEMORY; \
 426         } } while(0)
 427
 428 NTSTATUS samu_to_SamInfo3(TALLOC_CTX *mem_ctx,
 429                           struct samu *samu,
 430                           const char *login_server,
 431                           struct netr_SamInfo3 **_info3,
 432                           struct extra_auth_info *extra)
 433 {
 434         struct netr_SamInfo3 *info3;
 435         const struct dom_sid *user_sid;
 436         const struct dom_sid *group_sid;
 437         struct dom_sid domain_sid;
 438         struct dom_sid *group_sids;
 439         uint32_t num_group_sids = 0;
 440         const char *tmp;
 441         gid_t *gids;
 442         NTSTATUS status;
 443
 444         user_sid = pdb_get_user_sid(samu);
 445         group_sid = pdb_get_group_sid(samu);
 446
 447         if (!user_sid || !group_sid) {
 448                 DEBUG(1, ("Sam account is missing sids!\n"));
 449                 return NT_STATUS_UNSUCCESSFUL;
 450         }
 451
 452         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 453         if (!info3) {
 454                 return NT_STATUS_NO_MEMORY;
 455         }
 456
 457         ZERO_STRUCT(domain_sid);
 458
 459         status = SamInfo3_handle_sids(pdb_get_username(samu),
 460                                 user_sid,
 461                                 group_sid,
 462                                 info3,
 463                                 &domain_sid,
 464                                 extra);
 465
 466         if (!NT_STATUS_IS_OK(status)) {
 467                 TALLOC_FREE(info3);
 468                 return status;
 469         }
 470
 471         unix_to_nt_time(&info3->base.logon_time, pdb_get_logon_time(samu));
 472         unix_to_nt_time(&info3->base.logoff_time, get_time_t_max());
 473         unix_to_nt_time(&info3->base.kickoff_time, get_time_t_max());
 474         unix_to_nt_time(&info3->base.last_password_change,
 475                         pdb_get_pass_last_set_time(samu));
 476         unix_to_nt_time(&info3->base.allow_password_change,
 477                         pdb_get_pass_can_change_time(samu));
 478         unix_to_nt_time(&info3->base.force_password_change,
 479                         pdb_get_pass_must_change_time(samu));
 480
 481         tmp = pdb_get_username(samu);
 482         if (tmp) {
 483                 info3->base.account_name.string = talloc_strdup(info3, tmp);
 484                 RET_NOMEM(info3->base.account_name.string);
 485         }
 486         tmp = pdb_get_fullname(samu);
 487         if (tmp) {
 488                 info3->base.full_name.string = talloc_strdup(info3, tmp);
 489                 RET_NOMEM(info3->base.full_name.string);
 490         }
 491         tmp = pdb_get_logon_script(samu);
 492         if (tmp) {
 493                 info3->base.logon_script.string = talloc_strdup(info3, tmp);
 494                 RET_NOMEM(info3->base.logon_script.string);
 495         }
 496         tmp = pdb_get_profile_path(samu);
 497         if (tmp) {
 498                 info3->base.profile_path.string = talloc_strdup(info3, tmp);
 499                 RET_NOMEM(info3->base.profile_path.string);
 500         }
 501         tmp = pdb_get_homedir(samu);
 502         if (tmp) {
 503                 info3->base.home_directory.string = talloc_strdup(info3, tmp);
 504                 RET_NOMEM(info3->base.home_directory.string);
 505         }
 506         tmp = pdb_get_dir_drive(samu);
 507         if (tmp) {
 508                 info3->base.home_drive.string = talloc_strdup(info3, tmp);
 509                 RET_NOMEM(info3->base.home_drive.string);
 510         }
 511
 512         info3->base.logon_count = pdb_get_logon_count(samu);
 513         info3->base.bad_password_count = pdb_get_bad_password_count(samu);
 514
 515         info3->base.logon_domain.string = talloc_strdup(info3,
 516                                                   pdb_get_domain(samu));
 517         RET_NOMEM(info3->base.logon_domain.string);
 518
 519         info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
 520         RET_NOMEM(info3->base.domain_sid);
 521
 522         status = pdb_enum_group_memberships(mem_ctx, samu,
 523                                             &group_sids, &gids,
 524                                             &num_group_sids);
 525         if (!NT_STATUS_IS_OK(status)) {
 526                 DEBUG(1, ("Failed to get groups from sam account.\n"));
 527                 TALLOC_FREE(info3);
 528                 return status;
 529         }
 530
 531         if (num_group_sids) {
 532                 status = group_sids_to_info3(info3, group_sids, num_group_sids);
 533                 if (!NT_STATUS_IS_OK(status)) {
 534                         TALLOC_FREE(info3);
 535                         return status;
 536                 }
 537         }
 538
 539         /* We don't need sids and gids after the conversion */
 540         TALLOC_FREE(group_sids);
 541         TALLOC_FREE(gids);
 542         num_group_sids = 0;
 543
 544         /* FIXME: should we add other flags ? */
 545         info3->base.user_flags = NETLOGON_EXTRA_SIDS;
 546
 547         if (login_server) {
 548                 info3->base.logon_server.string = talloc_strdup(info3, login_server);
 549                 RET_NOMEM(info3->base.logon_server.string);
 550         }
 551
 552         info3->base.acct_flags = pdb_get_acct_ctrl(samu);
 553
 554         *_info3 = info3;
 555         return NT_STATUS_OK;
 556 }
 557
 558 NTSTATUS passwd_to_SamInfo3(TALLOC_CTX *mem_ctx,
 559                             const char *unix_username,
 560                             const struct passwd *pwd,
 561                             struct netr_SamInfo3 **pinfo3,
 562                             struct extra_auth_info *extra)
 563 {
 564         struct netr_SamInfo3 *info3;
 565         NTSTATUS status;
 566         TALLOC_CTX *tmp_ctx;
 567         const char *domain_name = NULL;
 568         const char *user_name = NULL;
 569         struct dom_sid domain_sid;
 570         struct dom_sid user_sid;
 571         struct dom_sid group_sid;
 572         enum lsa_SidType type;
 573         uint32_t num_sids = 0;
 574         struct dom_sid *user_sids = NULL;
 575         bool is_null;
 576         bool ok;
 577
 578         tmp_ctx = talloc_stackframe();
 579
 580         ok = lookup_name_smbconf(tmp_ctx,
 581                                  unix_username,
 582                                  LOOKUP_NAME_ALL,
 583                                  &domain_name,
 584                                  &user_name,
 585                                  &user_sid,
 586                                  &type);
 587         if (!ok) {
 588                 status = NT_STATUS_NO_SUCH_USER;
 589                 goto done;
 590         }
 591
 592         if (type != SID_NAME_USER) {
 593                 status = NT_STATUS_NO_SUCH_USER;
 594                 goto done;
 595         }
 596
 597         ok = winbind_lookup_usersids(tmp_ctx,
 598                                      &user_sid,
 599                                      &num_sids,
 600                                      &user_sids);
 601         /* Check if winbind is running */
 602         if (ok) {
 603                 /*
 604                  * Winbind is running and the first element of the user_sids
 605                  * is the primary group.
 606                  */
 607                 if (num_sids > 0) {
 608                         group_sid = user_sids[0];
 609                 }
 610         } else {
 611                 /*
 612                  * Winbind is not running, try to create the group_sid from the
 613                  * passwd group id.
 614                  */
 615
 616                 /*
 617                  * This can lead to a primary group of S-1-22-2-XX which
 618                  * will be rejected by other Samba code.
 619                  */
 620                 gid_to_sid(&group_sid, pwd->pw_gid);
 621         }
 622
 623         /*
 624          * If we are a unix group, or a wellknown/builtin alias,
 625          * set the group_sid to the
 626          * 'Domain Users' RID of 513 which will always resolve to a
 627          * name.
 628          */
 629         if (sid_check_is_in_unix_groups(&group_sid) ||
 630             sid_check_is_in_builtin(&group_sid) ||
 631             sid_check_is_in_wellknown_domain(&group_sid)) {
 632                 if (sid_check_is_in_unix_users(&user_sid)) {
 633                         sid_compose(&group_sid,
 634                                     get_global_sam_sid(),
 635                                     DOMAIN_RID_USERS);
 636                 } else {
 637                         sid_copy(&domain_sid, &user_sid);
 638                         sid_split_rid(&domain_sid, NULL);
 639                         sid_compose(&group_sid,
 640                                     &domain_sid,
 641                                     DOMAIN_RID_USERS);
 642                 }
 643         }
 644
 645         /* Make sure we have a valid group sid */
 646         is_null = is_null_sid(&group_sid);
 647         if (is_null) {
 648                 status = NT_STATUS_NO_SUCH_USER;
 649                 goto done;
 650         }
 651
 652         /* Construct a netr_SamInfo3 from the information we have */
 653         info3 = talloc_zero(tmp_ctx, struct netr_SamInfo3);
 654         if (!info3) {
 655                 status = NT_STATUS_NO_MEMORY;
 656                 goto done;
 657         }
 658
 659         info3->base.account_name.string = talloc_strdup(info3, unix_username);
 660         if (info3->base.account_name.string == NULL) {
 661                 status = NT_STATUS_NO_MEMORY;
 662                 goto done;
 663         }
 664
 665         ZERO_STRUCT(domain_sid);
 666
 667         status = SamInfo3_handle_sids(unix_username,
 668                                 &user_sid,
 669                                 &group_sid,
 670                                 info3,
 671                                 &domain_sid,
 672                                 extra);
 673
 674         if (!NT_STATUS_IS_OK(status)) {
 675                 goto done;
 676         }
 677
 678         info3->base.domain_sid = dom_sid_dup(info3, &domain_sid);
 679         if (info3->base.domain_sid == NULL) {
 680                 status = NT_STATUS_NO_MEMORY;
 681                 goto done;
 682         }
 683
 684         ok = sid_peek_check_rid(&domain_sid, &group_sid,
 685                                 &info3->base.primary_gid);
 686         if (!ok) {
 687                 DEBUG(1, ("The primary group domain sid(%s) does not "
 688                           "match the domain sid(%s) for %s(%s)\n",
 689                           sid_string_dbg(&group_sid),
 690                           sid_string_dbg(&domain_sid),
 691                           unix_username,
 692                           sid_string_dbg(&user_sid)));
 693                 status = NT_STATUS_INVALID_SID;
 694                 goto done;
 695         }
 696
 697         info3->base.acct_flags = ACB_NORMAL;
 698
 699         if (num_sids) {
 700                 status = group_sids_to_info3(info3, user_sids, num_sids);
 701                 if (!NT_STATUS_IS_OK(status)) {
 702                         goto done;
 703                 }
 704         }
 705
 706         *pinfo3 = talloc_steal(mem_ctx, info3);
 707
 708         status = NT_STATUS_OK;
 709 done:
 710         talloc_free(tmp_ctx);
 711
 712         return status;
 713 }
 714
 715 #undef RET_NOMEM
 716
 717 #define RET_NOMEM(ptr) do { \
 718         if (!ptr) { \
 719                 TALLOC_FREE(info3); \
 720                 return NULL; \
 721         } } while(0)
 722
 723 struct netr_SamInfo3 *copy_netr_SamInfo3(TALLOC_CTX *mem_ctx,
 724                                          const struct netr_SamInfo3 *orig)
 725 {
 726         struct netr_SamInfo3 *info3;
 727         unsigned int i;
 728         NTSTATUS status;
 729
 730         info3 = talloc_zero(mem_ctx, struct netr_SamInfo3);
 731         if (!info3) return NULL;
 732
 733         status = copy_netr_SamBaseInfo(info3, &orig->base, &info3->base);
 734         if (!NT_STATUS_IS_OK(status)) {
 735                 TALLOC_FREE(info3);
 736                 return NULL;
 737         }
 738
 739         if (orig->sidcount) {
 740                 info3->sidcount = orig->sidcount;
 741                 info3->sids = talloc_array(info3, struct netr_SidAttr,
 742                                            orig->sidcount);
 743                 RET_NOMEM(info3->sids);
 744                 for (i = 0; i < orig->sidcount; i++) {
 745                         info3->sids[i].sid = dom_sid_dup(info3->sids,
 746                                                             orig->sids[i].sid);
 747                         RET_NOMEM(info3->sids[i].sid);
 748                         info3->sids[i].attributes =
 749                                 orig->sids[i].attributes;
 750                 }
 751         }
 752
 753         return info3;
 754 }
 755