2005-01-13 10:50:09 +03:00
/*
Unix SMB / CIFS implementation .
Copyright ( C ) Stefan Metzmacher 2004
Copyright ( C ) Andrew Bartlett < abartlet @ samba . org > 2005
2005-09-25 16:26:07 +04:00
Copyright ( C ) Brad Henry 2005
2005-01-13 10:50:09 +03:00
This program is free software ; you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
2007-07-10 06:07:03 +04:00
the Free Software Foundation ; either version 3 of the License , or
2005-01-13 10:50:09 +03:00
( at your option ) any later version .
This program is distributed in the hope that it will be useful ,
but WITHOUT ANY WARRANTY ; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE . See the
GNU General Public License for more details .
You should have received a copy of the GNU General Public License
2007-07-10 06:07:03 +04:00
along with this program . If not , see < http : //www.gnu.org/licenses/>.
2005-01-13 10:50:09 +03:00
*/
# include "includes.h"
# include "libnet/libnet.h"
2006-03-15 02:35:30 +03:00
# include "librpc/gen_ndr/ndr_drsuapi_c.h"
2005-01-16 01:13:18 +03:00
# include "lib/ldb/include/ldb.h"
2005-10-31 06:44:29 +03:00
# include "lib/ldb/include/ldb_errors.h"
2006-11-06 19:11:52 +03:00
# include "param/secrets.h"
2005-12-28 18:38:36 +03:00
# include "dsdb/samdb/samdb.h"
2007-11-16 22:12:00 +03:00
# include "ldb_wrap.h"
2008-10-11 23:31:42 +04:00
# include "../lib/util/util_ldb.h"
2006-04-02 16:02:01 +04:00
# include "libcli/security/security.h"
2006-03-14 04:29:56 +03:00
# include "auth/credentials/credentials.h"
2006-11-07 03:48:36 +03:00
# include "auth/credentials/credentials_krb5.h"
2006-03-15 02:35:30 +03:00
# include "librpc/gen_ndr/ndr_samr_c.h"
2007-09-08 16:42:09 +04:00
# include "param/param.h"
2009-09-21 03:27:24 +04:00
# include "param/provision.h"
2005-09-25 16:26:07 +04:00
/*
* complete a domain join , when joining to a AD domain :
* 1. ) connect and bind to the DRSUAPI pipe
* 2. ) do a DsCrackNames ( ) to find the machine account dn
* 3. ) connect to LDAP
* 4. ) do an ldap search to find the " msDS-KeyVersionNumber " of the machine account
* 5. ) set the servicePrincipalName ' s of the machine account via LDAP , ( maybe we should use DsWriteAccountSpn ( ) . . . )
* 6. ) do a DsCrackNames ( ) to find the domain dn
* 7. ) find out Site specific stuff , look at libnet_JoinSite ( ) for details
*/
static NTSTATUS libnet_JoinADSDomain ( struct libnet_context * ctx , struct libnet_JoinDomain * r )
{
NTSTATUS status ;
TALLOC_CTX * tmp_ctx ;
const char * realm = r - > out . realm ;
struct dcerpc_binding * samr_binding = r - > out . samr_binding ;
struct dcerpc_pipe * drsuapi_pipe ;
struct dcerpc_binding * drsuapi_binding ;
struct drsuapi_DsBind r_drsuapi_bind ;
struct drsuapi_DsCrackNames r_crack_names ;
struct drsuapi_DsNameString names [ 1 ] ;
struct policy_handle drsuapi_bind_handle ;
struct GUID drsuapi_bind_guid ;
struct ldb_context * remote_ldb ;
2006-11-22 03:59:34 +03:00
struct ldb_dn * account_dn ;
2005-09-25 16:26:07 +04:00
const char * account_dn_str ;
const char * remote_ldb_url ;
2005-11-08 03:11:45 +03:00
struct ldb_result * res ;
struct ldb_message * msg ;
2005-09-25 16:26:07 +04:00
2005-11-08 03:11:45 +03:00
int ret , rtn ;
2005-09-25 16:26:07 +04:00
const char * const attrs [ ] = {
" msDS-KeyVersionNumber " ,
" servicePrincipalName " ,
" dNSHostName " ,
2006-12-12 02:59:03 +03:00
" objectGUID " ,
2005-09-25 16:26:07 +04:00
NULL ,
} ;
r - > out . error_string = NULL ;
/* We need to convert between a samAccountName and domain to a
* DN in the directory . The correct way to do this is with
* DRSUAPI CrackNames */
/* Fiddle with the bindings, so get to DRSUAPI on
* NCACN_IP_TCP , sealed */
tmp_ctx = talloc_named ( r , 0 , " libnet_JoinADSDomain temp context " ) ;
if ( ! tmp_ctx ) {
r - > out . error_string = NULL ;
return NT_STATUS_NO_MEMORY ;
}
drsuapi_binding = talloc ( tmp_ctx , struct dcerpc_binding ) ;
if ( ! drsuapi_binding ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
* drsuapi_binding = * samr_binding ;
2005-10-25 16:14:08 +04:00
/* DRSUAPI is only available on IP_TCP, and locally on NCALRPC */
if ( drsuapi_binding - > transport ! = NCALRPC ) {
drsuapi_binding - > transport = NCACN_IP_TCP ;
}
2005-09-25 16:26:07 +04:00
drsuapi_binding - > endpoint = NULL ;
drsuapi_binding - > flags | = DCERPC_SEAL ;
status = dcerpc_pipe_connect_b ( tmp_ctx ,
& drsuapi_pipe ,
drsuapi_binding ,
2007-08-20 01:23:03 +04:00
& ndr_table_drsuapi ,
2005-09-25 16:26:07 +04:00
ctx - > cred ,
2007-12-07 04:37:04 +03:00
ctx - > event_ctx ,
ctx - > lp_ctx ) ;
2005-09-25 16:26:07 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
r - > out . error_string = talloc_asprintf ( r ,
" Connection to DRSUAPI pipe of PDC of domain '%s' failed: %s " ,
2007-01-23 04:33:31 +03:00
r - > out . domain_name ,
2005-09-25 16:26:07 +04:00
nt_errstr ( status ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
}
/* get a DRSUAPI pipe handle */
GUID_from_string ( DRSUAPI_DS_BIND_GUID , & drsuapi_bind_guid ) ;
r_drsuapi_bind . in . bind_guid = & drsuapi_bind_guid ;
r_drsuapi_bind . in . bind_info = NULL ;
r_drsuapi_bind . out . bind_handle = & drsuapi_bind_handle ;
status = dcerpc_drsuapi_DsBind ( drsuapi_pipe , tmp_ctx , & r_drsuapi_bind ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
if ( NT_STATUS_EQUAL ( status , NT_STATUS_NET_WRITE_FAULT ) ) {
r - > out . error_string
= talloc_asprintf ( r ,
2006-08-31 12:15:23 +04:00
" dcerpc_drsuapi_DsBind failed - %s " ,
2005-09-25 16:26:07 +04:00
dcerpc_errstr ( tmp_ctx , drsuapi_pipe - > last_fault_code ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
} else {
r - > out . error_string
= talloc_asprintf ( r ,
2006-08-31 12:15:23 +04:00
" dcerpc_drsuapi_DsBind failed - %s " ,
2005-09-25 16:26:07 +04:00
nt_errstr ( status ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
}
} else if ( ! W_ERROR_IS_OK ( r_drsuapi_bind . out . result ) ) {
r - > out . error_string
= talloc_asprintf ( r ,
2006-08-31 12:15:23 +04:00
" DsBind failed - %s " ,
2005-09-25 16:26:07 +04:00
win_errstr ( r_drsuapi_bind . out . result ) ) ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
}
/* Actually 'crack' the names */
ZERO_STRUCT ( r_crack_names ) ;
r_crack_names . in . bind_handle = & drsuapi_bind_handle ;
r_crack_names . in . level = 1 ;
2008-10-17 22:08:59 +04:00
r_crack_names . in . req = talloc ( r , union drsuapi_DsNameRequest ) ;
if ( ! r_crack_names . in . req ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
r_crack_names . in . req - > req1 . codepage = 1252 ; /* western european */
r_crack_names . in . req - > req1 . language = 0x00000407 ; /* german */
r_crack_names . in . req - > req1 . count = 1 ;
r_crack_names . in . req - > req1 . names = names ;
r_crack_names . in . req - > req1 . format_flags = DRSUAPI_DS_NAME_FLAG_NO_FLAGS ;
r_crack_names . in . req - > req1 . format_offered = DRSUAPI_DS_NAME_FORMAT_SID_OR_SID_HISTORY ;
r_crack_names . in . req - > req1 . format_desired = DRSUAPI_DS_NAME_FORMAT_FQDN_1779 ;
2005-09-25 16:26:07 +04:00
names [ 0 ] . str = dom_sid_string ( tmp_ctx , r - > out . account_sid ) ;
if ( ! names [ 0 ] . str ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
2008-10-17 22:08:59 +04:00
r_crack_names . out . ctr = talloc ( r , union drsuapi_DsNameCtr ) ;
r_crack_names . out . level_out = talloc ( r , int32_t ) ;
if ( ! r_crack_names . out . ctr | | ! r_crack_names . out . level_out ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
2005-09-25 16:26:07 +04:00
status = dcerpc_drsuapi_DsCrackNames ( drsuapi_pipe , tmp_ctx , & r_crack_names ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
if ( NT_STATUS_EQUAL ( status , NT_STATUS_NET_WRITE_FAULT ) ) {
r - > out . error_string
= talloc_asprintf ( r ,
2006-08-31 12:15:23 +04:00
" dcerpc_drsuapi_DsCrackNames for [%s] failed - %s " ,
2005-09-25 16:26:07 +04:00
names [ 0 ] . str ,
dcerpc_errstr ( tmp_ctx , drsuapi_pipe - > last_fault_code ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
} else {
r - > out . error_string
= talloc_asprintf ( r ,
2006-08-31 12:15:23 +04:00
" dcerpc_drsuapi_DsCrackNames for [%s] failed - %s " ,
2005-09-25 16:26:07 +04:00
names [ 0 ] . str ,
nt_errstr ( status ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
}
} else if ( ! W_ERROR_IS_OK ( r_crack_names . out . result ) ) {
r - > out . error_string
= talloc_asprintf ( r ,
2006-08-31 12:15:23 +04:00
" DsCrackNames failed - %s " , win_errstr ( r_crack_names . out . result ) ) ;
2005-09-25 16:26:07 +04:00
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
2008-10-17 22:08:59 +04:00
} else if ( * r_crack_names . out . level_out ! = 1
| | ! r_crack_names . out . ctr - > ctr1
| | r_crack_names . out . ctr - > ctr1 - > count ! = 1 ) {
2006-08-31 12:15:23 +04:00
r - > out . error_string = talloc_asprintf ( r , " DsCrackNames failed " ) ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_INVALID_PARAMETER ;
2008-10-17 22:08:59 +04:00
} else if ( r_crack_names . out . ctr - > ctr1 - > array [ 0 ] . status ! = DRSUAPI_DS_NAME_STATUS_OK ) {
r - > out . error_string = talloc_asprintf ( r , " DsCrackNames failed: %d " , r_crack_names . out . ctr - > ctr1 - > array [ 0 ] . status ) ;
2005-09-25 16:26:07 +04:00
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
2008-10-17 22:08:59 +04:00
} else if ( r_crack_names . out . ctr - > ctr1 - > array [ 0 ] . result_name = = NULL ) {
2006-08-31 12:15:23 +04:00
r - > out . error_string = talloc_asprintf ( r , " DsCrackNames failed: no result name " ) ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_INVALID_PARAMETER ;
2005-09-25 16:26:07 +04:00
}
/* Store the DN of our machine account. */
2008-10-17 22:08:59 +04:00
account_dn_str = r_crack_names . out . ctr - > ctr1 - > array [ 0 ] . result_name ;
2005-09-25 16:26:07 +04:00
/* Now we know the user's DN, open with LDAP, read and modify a few things */
remote_ldb_url = talloc_asprintf ( tmp_ctx , " ldap://%s " ,
2006-10-13 17:01:48 +04:00
drsuapi_binding - > target_hostname ) ;
2005-09-25 16:26:07 +04:00
if ( ! remote_ldb_url ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
2008-04-17 14:23:44 +04:00
remote_ldb = ldb_wrap_connect ( tmp_ctx , ctx - > event_ctx , ctx - > lp_ctx ,
2007-10-01 22:52:55 +04:00
remote_ldb_url ,
2009-10-23 07:27:00 +04:00
NULL , ctx - > cred , 0 ) ;
2005-09-25 16:26:07 +04:00
if ( ! remote_ldb ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
}
2006-12-11 02:28:36 +03:00
account_dn = ldb_dn_new ( tmp_ctx , remote_ldb , account_dn_str ) ;
if ( ! ldb_dn_validate ( account_dn ) ) {
r - > out . error_string = talloc_asprintf ( r , " Invalid account dn: %s " ,
account_dn_str ) ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
}
2005-09-25 16:26:07 +04:00
/* search for the user's record */
2008-09-23 22:30:06 +04:00
ret = ldb_search ( remote_ldb , tmp_ctx , & res ,
account_dn , LDB_SCOPE_BASE , attrs , NULL ) ;
2006-10-16 05:20:31 +04:00
if ( ret ! = LDB_SUCCESS ) {
2006-09-18 13:54:44 +04:00
r - > out . error_string = talloc_asprintf ( r , " ldb_search for %s failed - %s " ,
2005-09-25 16:26:07 +04:00
account_dn_str , ldb_errstring ( remote_ldb ) ) ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
}
2006-10-16 05:20:31 +04:00
if ( res - > count ! = 1 ) {
r - > out . error_string = talloc_asprintf ( r , " ldb_search for %s failed - found %d entries " ,
account_dn_str , res - > count ) ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
}
2005-09-25 16:26:07 +04:00
/* Prepare a new message, for the modify */
msg = ldb_msg_new ( tmp_ctx ) ;
if ( ! msg ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
2005-11-08 03:11:45 +03:00
msg - > dn = res - > msgs [ 0 ] - > dn ;
2005-09-25 16:26:07 +04:00
{
2005-10-28 06:09:35 +04:00
int i ;
const char * service_principal_name [ 6 ] ;
2005-09-25 16:26:07 +04:00
const char * dns_host_name = strlower_talloc ( tmp_ctx ,
talloc_asprintf ( tmp_ctx ,
" %s.%s " ,
r - > in . netbios_name ,
realm ) ) ;
if ( ! dns_host_name ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
service_principal_name [ 0 ] = talloc_asprintf ( tmp_ctx , " host/%s " , dns_host_name ) ;
service_principal_name [ 1 ] = talloc_asprintf ( tmp_ctx , " host/%s " , strlower_talloc ( tmp_ctx , r - > in . netbios_name ) ) ;
2005-10-28 06:09:35 +04:00
service_principal_name [ 2 ] = talloc_asprintf ( tmp_ctx , " host/%s/%s " , dns_host_name , realm ) ;
service_principal_name [ 3 ] = talloc_asprintf ( tmp_ctx , " host/%s/%s " , strlower_talloc ( tmp_ctx , r - > in . netbios_name ) , realm ) ;
service_principal_name [ 4 ] = talloc_asprintf ( tmp_ctx , " host/%s/%s " , dns_host_name , r - > out . domain_name ) ;
service_principal_name [ 5 ] = talloc_asprintf ( tmp_ctx , " host/%s/%s " , strlower_talloc ( tmp_ctx , r - > in . netbios_name ) , r - > out . domain_name ) ;
for ( i = 0 ; i < ARRAY_SIZE ( service_principal_name ) ; i + + ) {
if ( ! service_principal_name [ i ] ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
2005-10-28 06:13:14 +04:00
rtn = samdb_msg_add_string ( remote_ldb , tmp_ctx , msg , " servicePrincipalName " , service_principal_name [ i ] ) ;
if ( rtn = = - 1 ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
2005-09-25 16:26:07 +04:00
}
rtn = samdb_msg_add_string ( remote_ldb , tmp_ctx , msg , " dNSHostName " , dns_host_name ) ;
if ( rtn = = - 1 ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
rtn = samdb_replace ( remote_ldb , tmp_ctx , msg ) ;
if ( rtn ! = 0 ) {
r - > out . error_string
= talloc_asprintf ( r ,
2006-09-18 13:54:44 +04:00
" Failed to replace entries on %s " ,
2006-11-22 05:05:19 +03:00
ldb_dn_get_linearized ( msg - > dn ) ) ;
2005-09-25 16:26:07 +04:00
talloc_free ( tmp_ctx ) ;
return NT_STATUS_INTERNAL_DB_CORRUPTION ;
}
}
/* DsCrackNames to find out the DN of the domain. */
2008-10-17 22:08:59 +04:00
r_crack_names . in . req - > req1 . format_offered = DRSUAPI_DS_NAME_FORMAT_NT4_ACCOUNT ;
r_crack_names . in . req - > req1 . format_desired = DRSUAPI_DS_NAME_FORMAT_FQDN_1779 ;
2005-09-25 16:26:07 +04:00
names [ 0 ] . str = talloc_asprintf ( tmp_ctx , " %s \\ " , r - > out . domain_name ) ;
if ( ! names [ 0 ] . str ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
status = dcerpc_drsuapi_DsCrackNames ( drsuapi_pipe , tmp_ctx , & r_crack_names ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
if ( NT_STATUS_EQUAL ( status , NT_STATUS_NET_WRITE_FAULT ) ) {
r - > out . error_string
= talloc_asprintf ( r ,
2006-09-18 13:54:44 +04:00
" dcerpc_drsuapi_DsCrackNames for [%s] failed - %s " ,
2005-09-25 16:26:07 +04:00
r - > in . domain_name ,
dcerpc_errstr ( tmp_ctx , drsuapi_pipe - > last_fault_code ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
} else {
r - > out . error_string
= talloc_asprintf ( r ,
2006-09-18 13:54:44 +04:00
" dcerpc_drsuapi_DsCrackNames for [%s] failed - %s " ,
2005-09-25 16:26:07 +04:00
r - > in . domain_name ,
nt_errstr ( status ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
}
} else if ( ! W_ERROR_IS_OK ( r_crack_names . out . result ) ) {
r - > out . error_string
= talloc_asprintf ( r ,
2006-08-31 12:15:23 +04:00
" DsCrackNames failed - %s " , win_errstr ( r_crack_names . out . result ) ) ;
2005-09-25 16:26:07 +04:00
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
2008-10-17 22:08:59 +04:00
} else if ( * r_crack_names . out . level_out ! = 1
| | ! r_crack_names . out . ctr - > ctr1
| | r_crack_names . out . ctr - > ctr1 - > count ! = 1
| | ! r_crack_names . out . ctr - > ctr1 - > array [ 0 ] . result_name
| | r_crack_names . out . ctr - > ctr1 - > array [ 0 ] . status ! = DRSUAPI_DS_NAME_STATUS_OK ) {
2006-08-31 12:15:23 +04:00
r - > out . error_string = talloc_asprintf ( r , " DsCrackNames failed " ) ;
2005-09-25 16:26:07 +04:00
talloc_free ( tmp_ctx ) ;
return NT_STATUS_UNSUCCESSFUL ;
}
/* Store the account DN. */
r - > out . account_dn_str = account_dn_str ;
talloc_steal ( r , account_dn_str ) ;
/* Store the domain DN. */
2008-10-17 22:08:59 +04:00
r - > out . domain_dn_str = r_crack_names . out . ctr - > ctr1 - > array [ 0 ] . result_name ;
talloc_steal ( r , r_crack_names . out . ctr - > ctr1 - > array [ 0 ] . result_name ) ;
2005-09-25 16:26:07 +04:00
2006-12-12 02:59:03 +03:00
/* Store the KVNO of the account, critical for some kerberos
* operations */
r - > out . kvno = ldb_msg_find_attr_as_uint ( res - > msgs [ 0 ] , " msDS-KeyVersionNumber " , 0 ) ;
/* Store the account GUID. */
r - > out . account_guid = samdb_result_guid ( res - > msgs [ 0 ] , " objectGUID " ) ;
2005-09-25 16:26:07 +04:00
2006-01-17 06:44:37 +03:00
if ( r - > in . acct_type = = ACB_SVRTRUST ) {
2007-12-12 04:15:29 +03:00
status = libnet_JoinSite ( ctx , remote_ldb , r ) ;
2005-10-28 06:09:35 +04:00
}
2005-09-25 16:26:07 +04:00
talloc_free ( tmp_ctx ) ;
return status ;
}
2005-01-13 10:50:09 +03:00
/*
* do a domain join using DCERPC / SAMR calls
2006-01-13 15:52:56 +03:00
* - connect to the LSA pipe , to try and find out information about the domain
* - create a secondary connection to SAMR pipe
* - do a samr_Connect to get a policy handle
* - do a samr_LookupDomain to get the domain sid
* - do a samr_OpenDomain to get a domain handle
* - do a samr_CreateAccount to try and get a new account
2005-01-13 10:50:09 +03:00
*
* If that fails , do :
2006-01-13 15:52:56 +03:00
* - do a samr_LookupNames to get the users rid
* - do a samr_OpenUser to get a user handle
* - potentially delete and recreate the user
* - assert the account is of the right type with samrQueryUserInfo
2005-01-13 10:50:09 +03:00
*
2006-11-28 20:30:43 +03:00
* - call libnet_SetPassword_samr_handle to set the password ,
* and pass a samr_UserInfo21 struct to set full_name and the account flags
2005-01-13 10:50:09 +03:00
*
2006-01-13 15:52:56 +03:00
* - do some ADS specific things when we join as Domain Controller ,
2005-09-25 16:26:07 +04:00
* look at libnet_joinADSDomain ( ) for the details
2005-01-13 10:50:09 +03:00
*/
2005-07-29 14:58:05 +04:00
NTSTATUS libnet_JoinDomain ( struct libnet_context * ctx , TALLOC_CTX * mem_ctx , struct libnet_JoinDomain * r )
2005-01-13 10:50:09 +03:00
{
2005-07-29 14:58:05 +04:00
TALLOC_CTX * tmp_ctx ;
2005-09-25 16:26:07 +04:00
NTSTATUS status , cu_status ;
2006-01-13 15:52:56 +03:00
2006-05-04 18:52:03 +04:00
struct libnet_RpcConnect * connect_with_info ;
2005-07-29 14:58:05 +04:00
struct dcerpc_pipe * samr_pipe ;
2006-01-13 15:52:56 +03:00
2005-01-13 10:50:09 +03:00
struct samr_Connect sc ;
struct policy_handle p_handle ;
struct samr_OpenDomain od ;
struct policy_handle d_handle ;
struct samr_LookupNames ln ;
2008-11-05 16:28:17 +03:00
struct samr_Ids rids , types ;
2005-01-13 10:50:09 +03:00
struct samr_OpenUser ou ;
struct samr_CreateUser2 cu ;
2005-09-25 16:26:07 +04:00
struct policy_handle * u_handle = NULL ;
2005-01-16 01:13:18 +03:00
struct samr_QueryUserInfo qui ;
2008-11-10 16:42:27 +03:00
union samr_UserInfo * uinfo ;
2006-11-28 20:30:43 +03:00
struct samr_UserInfo21 u_info21 ;
2005-01-13 10:50:09 +03:00
union libnet_SetPassword r2 ;
struct samr_GetUserPwInfo pwp ;
2008-11-05 03:28:49 +03:00
struct samr_PwInfo info ;
2005-07-08 12:09:02 +04:00
struct lsa_String samr_account_name ;
2005-09-25 16:26:07 +04:00
2005-12-22 09:47:00 +03:00
uint32_t acct_flags , old_acct_flags ;
2005-02-10 08:09:35 +03:00
uint32_t rid , access_granted ;
2005-01-13 10:50:09 +03:00
int policy_min_pw_len = 0 ;
2005-09-25 16:26:07 +04:00
struct dom_sid * account_sid = NULL ;
const char * password_str = NULL ;
r - > out . error_string = NULL ;
r2 . samr_handle . out . error_string = NULL ;
2005-07-29 14:58:05 +04:00
tmp_ctx = talloc_named ( mem_ctx , 0 , " libnet_Join temp context " ) ;
if ( ! tmp_ctx ) {
r - > out . error_string = NULL ;
return NT_STATUS_NO_MEMORY ;
}
2005-09-25 16:26:07 +04:00
u_handle = talloc ( tmp_ctx , struct policy_handle ) ;
if ( ! u_handle ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
2009-06-18 06:33:46 +04:00
connect_with_info = talloc_zero ( tmp_ctx , struct libnet_RpcConnect ) ;
2006-01-13 15:52:56 +03:00
if ( ! connect_with_info ) {
2005-09-25 16:26:07 +04:00
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_NO_MEMORY ;
}
2006-01-13 15:52:56 +03:00
2006-12-11 01:21:20 +03:00
/* prepare connect to the SAMR pipe of PDC */
2005-09-25 16:26:07 +04:00
if ( r - > in . level = = LIBNET_JOINDOMAIN_AUTOMATIC ) {
2006-10-13 11:25:51 +04:00
connect_with_info - > in . binding = NULL ;
2006-01-13 15:52:56 +03:00
connect_with_info - > in . name = r - > in . domain_name ;
2005-09-25 16:26:07 +04:00
} else {
2006-01-13 15:52:56 +03:00
connect_with_info - > in . binding = r - > in . binding ;
2006-10-13 11:25:51 +04:00
connect_with_info - > in . name = NULL ;
2005-09-25 16:26:07 +04:00
}
2006-12-11 01:21:20 +03:00
/* This level makes a connection to the LSA pipe on the way,
* to get some useful bits of information about the domain */
2006-05-04 18:52:03 +04:00
connect_with_info - > level = LIBNET_RPC_CONNECT_DC_INFO ;
2007-08-20 01:23:03 +04:00
connect_with_info - > in . dcerpc_iface = & ndr_table_samr ;
2006-05-04 18:52:03 +04:00
2006-01-13 15:52:56 +03:00
/*
2006-12-11 01:21:20 +03:00
establish the SAMR connection
2006-01-13 15:52:56 +03:00
*/
2006-05-04 18:52:03 +04:00
status = libnet_RpcConnect ( ctx , tmp_ctx , connect_with_info ) ;
2005-07-29 14:58:05 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2006-01-13 15:52:56 +03:00
if ( r - > in . binding ) {
2005-09-28 09:38:20 +04:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2006-01-13 15:52:56 +03:00
" Connection to SAMR pipe of DC %s failed: %s " ,
r - > in . binding , connect_with_info - > out . error_string ) ;
2005-09-28 09:38:20 +04:00
} else {
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2006-01-13 15:52:56 +03:00
" Connection to SAMR pipe of PDC for %s failed: %s " ,
r - > in . domain_name , connect_with_info - > out . error_string ) ;
2005-10-25 16:14:08 +04:00
}
2005-07-29 14:58:05 +04:00
talloc_free ( tmp_ctx ) ;
return status ;
}
2006-05-04 14:03:41 +04:00
samr_pipe = connect_with_info - > out . dcerpc_pipe ;
2005-07-29 14:58:05 +04:00
2006-05-07 23:55:14 +04:00
status = dcerpc_pipe_auth ( tmp_ctx , & samr_pipe ,
2006-01-13 15:52:56 +03:00
connect_with_info - > out . dcerpc_pipe - > binding ,
2007-12-07 04:37:04 +03:00
& ndr_table_samr , ctx - > cred , ctx - > lp_ctx ) ;
2005-07-29 14:58:05 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2005-09-25 16:26:07 +04:00
" SAMR bind failed: %s " ,
nt_errstr ( status ) ) ;
2005-07-29 14:58:05 +04:00
talloc_free ( tmp_ctx ) ;
return status ;
2005-09-25 16:26:07 +04:00
}
2005-01-13 10:50:09 +03:00
/* prepare samr_Connect */
ZERO_STRUCT ( p_handle ) ;
sc . in . system_name = NULL ;
sc . in . access_mask = SEC_FLAG_MAXIMUM_ALLOWED ;
sc . out . connect_handle = & p_handle ;
/* 2. do a samr_Connect to get a policy handle */
2005-07-29 14:58:05 +04:00
status = dcerpc_samr_Connect ( samr_pipe , tmp_ctx , & sc ) ;
2005-01-13 10:50:09 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2005-07-29 14:58:05 +04:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2005-09-25 16:26:07 +04:00
" samr_Connect failed: %s " ,
2005-01-13 10:50:09 +03:00
nt_errstr ( status ) ) ;
2005-07-29 14:58:05 +04:00
talloc_free ( tmp_ctx ) ;
return status ;
2005-01-13 10:50:09 +03:00
}
2006-01-13 15:52:56 +03:00
/* If this is a connection on ncacn_ip_tcp to Win2k3 SP1, we don't get back this useful info */
if ( ! connect_with_info - > out . domain_name ) {
if ( r - > in . level = = LIBNET_JOINDOMAIN_AUTOMATIC ) {
connect_with_info - > out . domain_name = talloc_strdup ( tmp_ctx , r - > in . domain_name ) ;
} else {
/* Bugger, we just lost our way to automaticly find the domain name */
2007-12-07 04:37:13 +03:00
connect_with_info - > out . domain_name = talloc_strdup ( tmp_ctx , lp_workgroup ( ctx - > lp_ctx ) ) ;
connect_with_info - > out . realm = talloc_strdup ( tmp_ctx , lp_realm ( ctx - > lp_ctx ) ) ;
2006-01-13 15:52:56 +03:00
}
}
2005-10-25 16:14:08 +04:00
/* Perhaps we didn't get a SID above, because we are against ncacn_ip_tcp */
2006-01-13 15:52:56 +03:00
if ( ! connect_with_info - > out . domain_sid ) {
2005-10-25 16:14:08 +04:00
struct lsa_String name ;
struct samr_LookupDomain l ;
2008-11-07 04:42:45 +03:00
struct dom_sid2 * sid = NULL ;
2006-01-13 15:52:56 +03:00
name . string = connect_with_info - > out . domain_name ;
2005-10-25 16:14:08 +04:00
l . in . connect_handle = & p_handle ;
l . in . domain_name = & name ;
2008-11-07 04:42:45 +03:00
l . out . sid = & sid ;
2005-10-25 16:14:08 +04:00
status = dcerpc_samr_LookupDomain ( samr_pipe , tmp_ctx , & l ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
r - > out . error_string = talloc_asprintf ( mem_ctx ,
" SAMR LookupDomain failed: %s " ,
nt_errstr ( status ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
}
2008-11-07 04:42:45 +03:00
connect_with_info - > out . domain_sid = * l . out . sid ;
2005-01-13 10:50:09 +03:00
}
2005-10-25 16:14:08 +04:00
2005-01-13 10:50:09 +03:00
/* prepare samr_OpenDomain */
ZERO_STRUCT ( d_handle ) ;
od . in . connect_handle = & p_handle ;
od . in . access_mask = SEC_FLAG_MAXIMUM_ALLOWED ;
2006-01-13 15:52:56 +03:00
od . in . sid = connect_with_info - > out . domain_sid ;
2005-01-13 10:50:09 +03:00
od . out . domain_handle = & d_handle ;
2005-12-22 12:58:51 +03:00
/* do a samr_OpenDomain to get a domain handle */
2005-09-25 16:26:07 +04:00
status = dcerpc_samr_OpenDomain ( samr_pipe , tmp_ctx , & od ) ;
2005-01-13 10:50:09 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2005-07-29 14:58:05 +04:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2006-01-13 15:52:56 +03:00
" samr_OpenDomain for [%s] failed: %s " ,
dom_sid_string ( tmp_ctx , connect_with_info - > out . domain_sid ) ,
nt_errstr ( status ) ) ;
2005-07-29 14:58:05 +04:00
talloc_free ( tmp_ctx ) ;
return status ;
2005-01-13 10:50:09 +03:00
}
2005-09-25 16:26:07 +04:00
2005-01-13 10:50:09 +03:00
/* prepare samr_CreateUser2 */
2005-09-25 16:26:07 +04:00
ZERO_STRUCTP ( u_handle ) ;
2005-01-13 10:50:09 +03:00
cu . in . domain_handle = & d_handle ;
cu . in . access_mask = SEC_FLAG_MAXIMUM_ALLOWED ;
2005-07-29 14:58:05 +04:00
samr_account_name . string = r - > in . account_name ;
2005-01-13 10:50:09 +03:00
cu . in . account_name = & samr_account_name ;
2005-07-29 14:58:05 +04:00
cu . in . acct_flags = r - > in . acct_type ;
2005-09-25 16:26:07 +04:00
cu . out . user_handle = u_handle ;
2005-01-13 10:50:09 +03:00
cu . out . rid = & rid ;
cu . out . access_granted = & access_granted ;
2005-12-22 12:58:51 +03:00
/* do a samr_CreateUser2 to get an account handle, or an error */
2005-09-25 16:26:07 +04:00
cu_status = dcerpc_samr_CreateUser2 ( samr_pipe , tmp_ctx , & cu ) ;
status = cu_status ;
2005-12-22 12:58:51 +03:00
if ( NT_STATUS_EQUAL ( status , NT_STATUS_USER_EXISTS ) ) {
2005-01-13 10:50:09 +03:00
/* prepare samr_LookupNames */
ln . in . domain_handle = & d_handle ;
ln . in . num_names = 1 ;
2005-07-29 14:58:05 +04:00
ln . in . names = talloc_array ( tmp_ctx , struct lsa_String , 1 ) ;
2008-11-05 16:28:17 +03:00
ln . out . rids = & rids ;
ln . out . types = & types ;
2005-01-13 10:50:09 +03:00
if ( ! ln . in . names ) {
2005-07-29 14:58:05 +04:00
r - > out . error_string = NULL ;
talloc_free ( tmp_ctx ) ;
2005-01-13 10:50:09 +03:00
return NT_STATUS_NO_MEMORY ;
}
2005-07-29 14:58:05 +04:00
ln . in . names [ 0 ] . string = r - > in . account_name ;
2005-01-13 10:50:09 +03:00
/* 5. do a samr_LookupNames to get the users rid */
2005-07-29 14:58:05 +04:00
status = dcerpc_samr_LookupNames ( samr_pipe , tmp_ctx , & ln ) ;
2005-01-13 10:50:09 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2005-07-29 14:58:05 +04:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2005-09-25 16:26:07 +04:00
" samr_LookupNames for [%s] failed: %s " ,
r - > in . account_name ,
nt_errstr ( status ) ) ;
2005-07-29 14:58:05 +04:00
talloc_free ( tmp_ctx ) ;
return status ;
2005-01-13 10:50:09 +03:00
}
/* check if we got one RID for the user */
2008-11-05 16:28:17 +03:00
if ( ln . out . rids - > count ! = 1 ) {
2005-07-29 14:58:05 +04:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2006-09-18 13:54:44 +04:00
" samr_LookupNames for [%s] returns %d RIDs " ,
2008-11-05 16:28:17 +03:00
r - > in . account_name , ln . out . rids - > count ) ;
2005-07-29 14:58:05 +04:00
talloc_free ( tmp_ctx ) ;
2005-09-28 09:38:20 +04:00
return NT_STATUS_INVALID_PARAMETER ;
2005-01-13 10:50:09 +03:00
}
/* prepare samr_OpenUser */
2005-09-25 16:26:07 +04:00
ZERO_STRUCTP ( u_handle ) ;
2005-01-13 10:50:09 +03:00
ou . in . domain_handle = & d_handle ;
ou . in . access_mask = SEC_FLAG_MAXIMUM_ALLOWED ;
2008-11-05 16:28:17 +03:00
ou . in . rid = ln . out . rids - > ids [ 0 ] ;
2005-09-25 16:26:07 +04:00
rid = ou . in . rid ;
ou . out . user_handle = u_handle ;
2005-01-13 10:50:09 +03:00
/* 6. do a samr_OpenUser to get a user handle */
2005-09-25 16:26:07 +04:00
status = dcerpc_samr_OpenUser ( samr_pipe , tmp_ctx , & ou ) ;
2005-01-13 10:50:09 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2005-07-29 14:58:05 +04:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2005-09-25 16:26:07 +04:00
" samr_OpenUser for [%s] failed: %s " ,
r - > in . account_name ,
nt_errstr ( status ) ) ;
2005-07-29 14:58:05 +04:00
talloc_free ( tmp_ctx ) ;
return status ;
2005-01-13 10:50:09 +03:00
}
2005-10-31 06:03:32 +03:00
if ( r - > in . recreate_account ) {
struct samr_DeleteUser d ;
d . in . user_handle = u_handle ;
d . out . user_handle = u_handle ;
status = dcerpc_samr_DeleteUser ( samr_pipe , mem_ctx , & d ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
r - > out . error_string = talloc_asprintf ( mem_ctx ,
" samr_DeleteUser (for recreate) of [%s] failed: %s " ,
r - > in . account_name ,
nt_errstr ( status ) ) ;
talloc_free ( tmp_ctx ) ;
return status ;
}
/* We want to recreate, so delete and another samr_CreateUser2 */
/* &cu filled in above */
2005-12-22 09:47:00 +03:00
status = dcerpc_samr_CreateUser2 ( samr_pipe , tmp_ctx , & cu ) ;
2005-12-22 09:58:26 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2005-10-31 06:03:32 +03:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2006-09-18 13:54:44 +04:00
" samr_CreateUser2 (recreate) for [%s] failed: %s " ,
2006-06-14 20:08:43 +04:00
r - > in . account_name , nt_errstr ( status ) ) ;
2005-10-31 06:03:32 +03:00
talloc_free ( tmp_ctx ) ;
return status ;
}
}
2005-12-22 12:58:51 +03:00
} else if ( ! NT_STATUS_IS_OK ( status ) ) {
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2006-09-18 13:54:44 +04:00
" samr_CreateUser2 for [%s] failed: %s " ,
2006-06-14 20:08:43 +04:00
r - > in . account_name , nt_errstr ( status ) ) ;
2005-12-22 12:58:51 +03:00
talloc_free ( tmp_ctx ) ;
return status ;
2005-01-13 10:50:09 +03:00
}
2005-07-09 05:54:28 +04:00
/* prepare samr_QueryUserInfo (get flags) */
2005-09-25 16:26:07 +04:00
qui . in . user_handle = u_handle ;
2005-01-16 01:13:18 +03:00
qui . in . level = 16 ;
2008-11-10 16:42:27 +03:00
qui . out . info = & uinfo ;
2005-01-16 01:13:18 +03:00
2005-07-29 14:58:05 +04:00
status = dcerpc_samr_QueryUserInfo ( samr_pipe , tmp_ctx , & qui ) ;
2005-01-16 01:13:18 +03:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2005-09-25 16:26:07 +04:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
" samr_QueryUserInfo for [%s] failed: %s " ,
r - > in . account_name ,
nt_errstr ( status ) ) ;
talloc_free ( tmp_ctx ) ;
2005-07-29 14:58:05 +04:00
return status ;
2005-01-16 01:13:18 +03:00
}
2005-09-25 16:26:07 +04:00
2008-11-10 16:42:27 +03:00
if ( ! uinfo ) {
2005-01-16 01:13:18 +03:00
status = NT_STATUS_INVALID_PARAMETER ;
2005-07-29 14:58:05 +04:00
r - > out . error_string
2005-01-16 01:13:18 +03:00
= talloc_asprintf ( mem_ctx ,
2006-09-18 13:54:44 +04:00
" samr_QueryUserInfo failed to return qui.out.info for [%s]: %s " ,
2005-07-29 14:58:05 +04:00
r - > in . account_name , nt_errstr ( status ) ) ;
2005-09-25 16:26:07 +04:00
talloc_free ( tmp_ctx ) ;
2005-07-29 14:58:05 +04:00
return status ;
2005-01-16 01:13:18 +03:00
}
2005-07-09 05:54:28 +04:00
2008-11-10 16:42:27 +03:00
old_acct_flags = ( uinfo - > info16 . acct_flags & ( ACB_WSTRUST | ACB_SVRTRUST | ACB_DOMTRUST ) ) ;
2005-12-22 09:47:00 +03:00
/* Possibly bail if the account is of the wrong type */
if ( old_acct_flags
! = r - > in . acct_type ) {
const char * old_account_type , * new_account_type ;
switch ( old_acct_flags ) {
case ACB_WSTRUST :
old_account_type = " domain member (member) " ;
break ;
case ACB_SVRTRUST :
old_account_type = " domain controller (bdc) " ;
break ;
case ACB_DOMTRUST :
old_account_type = " trusted domain " ;
break ;
default :
return NT_STATUS_INVALID_PARAMETER ;
}
switch ( r - > in . acct_type ) {
case ACB_WSTRUST :
new_account_type = " domain member (member) " ;
break ;
case ACB_SVRTRUST :
new_account_type = " domain controller (bdc) " ;
break ;
case ACB_DOMTRUST :
new_account_type = " trusted domain " ;
break ;
default :
return NT_STATUS_INVALID_PARAMETER ;
}
if ( ! NT_STATUS_EQUAL ( cu_status , NT_STATUS_USER_EXISTS ) ) {
/* We created a new user, but they didn't come out the right type?!? */
r - > out . error_string
= talloc_asprintf ( mem_ctx ,
r12858: This moves the libnet_LookupPdc code to use a GetDC request to find
the remote server's name, or in the absence of a local nbt_server to
communicate with (or without root access), a node status request.
The result is that we are in a better position to use kerberos, as well
as to remove the 'password server' mandatory parameter for the samsync
and samdump commands. (I need this to put these into SWAT).
The only problem I have is that I must create a messaging context, which
requires a server ID. As a client process, I don't expect to get
messages, but it is currently required for replies, so I generate a
random() number. We probably need the servers to accept connections on
streamed sockets too, for client-only tasks that want IRPC.
Because I wanted to test this code, I have put the NET-API-* tests into
our test scripts, to ensure they pass and keep passing. They are good
frontends onto the libnet system, and I see no reason not to test them.
In doing so the NET-API-RPCCONNECT test was simplified to take a
binding string on the command line, removing duplicate code, and
testing the combinations in the scripts instead.
(I have done a bit of work on the list shares code in libnet_share.c
to make it pass 'make test')
In the future, I would like to extend the libcli/findds.c code (based
off volker's winbind/wb_async_helpers.c, which is why it shows up a bit
odd in the patch) to handle getting multiple name replies, sending a
getdc request to each in turn.
(posted to samba-technical for review, and I'll happily update with
any comments)
Andrew Bartlett
(This used to be commit 7ccddfd3515fc2c0d6f447c768ccbf7a220c3380)
2006-01-12 06:02:00 +03:00
" We asked to create a new machine account (%s) of type %s, "
" but we got an account of type %s. This is unexpected. "
2006-09-18 13:54:44 +04:00
" Perhaps delete the account and try again. " ,
2005-12-22 09:47:00 +03:00
r - > in . account_name , new_account_type , old_account_type ) ;
talloc_free ( tmp_ctx ) ;
return NT_STATUS_INVALID_PARAMETER ;
} else {
/* The account is of the wrong type, so bail */
/* TODO: We should allow a --force option to override, and redo this from the top setting r.in.recreate_account */
r - > out . error_string
= talloc_asprintf ( mem_ctx ,
r12858: This moves the libnet_LookupPdc code to use a GetDC request to find
the remote server's name, or in the absence of a local nbt_server to
communicate with (or without root access), a node status request.
The result is that we are in a better position to use kerberos, as well
as to remove the 'password server' mandatory parameter for the samsync
and samdump commands. (I need this to put these into SWAT).
The only problem I have is that I must create a messaging context, which
requires a server ID. As a client process, I don't expect to get
messages, but it is currently required for replies, so I generate a
random() number. We probably need the servers to accept connections on
streamed sockets too, for client-only tasks that want IRPC.
Because I wanted to test this code, I have put the NET-API-* tests into
our test scripts, to ensure they pass and keep passing. They are good
frontends onto the libnet system, and I see no reason not to test them.
In doing so the NET-API-RPCCONNECT test was simplified to take a
binding string on the command line, removing duplicate code, and
testing the combinations in the scripts instead.
(I have done a bit of work on the list shares code in libnet_share.c
to make it pass 'make test')
In the future, I would like to extend the libcli/findds.c code (based
off volker's winbind/wb_async_helpers.c, which is why it shows up a bit
odd in the patch) to handle getting multiple name replies, sending a
getdc request to each in turn.
(posted to samba-technical for review, and I'll happily update with
any comments)
Andrew Bartlett
(This used to be commit 7ccddfd3515fc2c0d6f447c768ccbf7a220c3380)
2006-01-12 06:02:00 +03:00
" The machine account (%s) already exists in the domain %s, "
" but is a %s. You asked to join as a %s. Please delete "
2006-09-18 13:54:44 +04:00
" the account and try again. " ,
2006-01-13 15:52:56 +03:00
r - > in . account_name , connect_with_info - > out . domain_name , old_account_type , new_account_type ) ;
2005-12-22 09:47:00 +03:00
talloc_free ( tmp_ctx ) ;
return NT_STATUS_USER_EXISTS ;
}
2005-01-16 01:13:18 +03:00
} else {
2008-11-10 16:42:27 +03:00
acct_flags = uinfo - > info16 . acct_flags ;
2005-01-16 01:13:18 +03:00
}
2006-11-28 20:30:43 +03:00
acct_flags = ( acct_flags & ~ ( ACB_DISABLED | ACB_PWNOTREQ ) ) ;
2005-01-16 01:13:18 +03:00
2005-12-22 09:47:00 +03:00
/* Find out what password policy this user has */
pwp . in . user_handle = u_handle ;
2008-11-05 03:28:49 +03:00
pwp . out . info = & info ;
2005-12-22 09:47:00 +03:00
status = dcerpc_samr_GetUserPwInfo ( samr_pipe , tmp_ctx , & pwp ) ;
if ( NT_STATUS_IS_OK ( status ) ) {
2008-11-05 03:28:49 +03:00
policy_min_pw_len = pwp . out . info - > min_password_length ;
2005-12-22 09:47:00 +03:00
}
/* Grab a password of that minimum length */
password_str = generate_random_str ( tmp_ctx , MAX ( 8 , policy_min_pw_len ) ) ;
2006-11-28 20:30:43 +03:00
/* set full_name and reset flags */
ZERO_STRUCT ( u_info21 ) ;
u_info21 . full_name . string = r - > in . account_name ;
u_info21 . acct_flags = acct_flags ;
u_info21 . fields_present = SAMR_FIELD_FULL_NAME | SAMR_FIELD_ACCT_FLAGS ;
2005-12-22 09:47:00 +03:00
r2 . samr_handle . level = LIBNET_SET_PASSWORD_SAMR_HANDLE ;
r2 . samr_handle . in . account_name = r - > in . account_name ;
r2 . samr_handle . in . newpassword = password_str ;
r2 . samr_handle . in . user_handle = u_handle ;
r2 . samr_handle . in . dcerpc_pipe = samr_pipe ;
2006-11-28 20:30:43 +03:00
r2 . samr_handle . in . info21 = & u_info21 ;
2005-12-22 09:47:00 +03:00
status = libnet_SetPassword ( ctx , tmp_ctx , & r2 ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
r - > out . error_string = talloc_steal ( mem_ctx , r2 . samr_handle . out . error_string ) ;
talloc_free ( tmp_ctx ) ;
return status ;
}
2006-01-13 15:52:56 +03:00
account_sid = dom_sid_add_rid ( mem_ctx , connect_with_info - > out . domain_sid , rid ) ;
2005-09-25 16:26:07 +04:00
if ( ! account_sid ) {
r - > out . error_string = NULL ;
2005-08-03 09:24:13 +04:00
talloc_free ( tmp_ctx ) ;
2005-08-03 04:59:35 +04:00
return NT_STATUS_NO_MEMORY ;
}
2005-12-22 12:58:51 +03:00
/* Finish out by pushing various bits of status data out for the caller to use */
2005-09-25 16:26:07 +04:00
r - > out . join_password = password_str ;
2006-01-13 15:52:56 +03:00
talloc_steal ( mem_ctx , r - > out . join_password ) ;
2005-09-25 16:26:07 +04:00
2006-01-13 15:52:56 +03:00
r - > out . domain_sid = connect_with_info - > out . domain_sid ;
talloc_steal ( mem_ctx , r - > out . domain_sid ) ;
2005-09-25 16:26:07 +04:00
r - > out . account_sid = account_sid ;
2006-01-13 15:52:56 +03:00
talloc_steal ( mem_ctx , r - > out . account_sid ) ;
r - > out . domain_name = connect_with_info - > out . domain_name ;
talloc_steal ( mem_ctx , r - > out . domain_name ) ;
r - > out . realm = connect_with_info - > out . realm ;
talloc_steal ( mem_ctx , r - > out . realm ) ;
2005-09-25 16:26:07 +04:00
r - > out . samr_pipe = samr_pipe ;
2009-07-01 08:53:32 +04:00
talloc_reparent ( tmp_ctx , mem_ctx , samr_pipe ) ;
2006-01-13 15:52:56 +03:00
r - > out . samr_binding = samr_pipe - > binding ;
talloc_steal ( mem_ctx , r - > out . samr_binding ) ;
2005-10-04 04:59:59 +04:00
r - > out . user_handle = u_handle ;
talloc_steal ( mem_ctx , u_handle ) ;
2005-09-25 16:26:07 +04:00
r - > out . error_string = r2 . samr_handle . out . error_string ;
talloc_steal ( mem_ctx , r2 . samr_handle . out . error_string ) ;
r - > out . kvno = 0 ;
r - > out . server_dn_str = NULL ;
talloc_free ( tmp_ctx ) ;
2005-08-03 04:59:35 +04:00
2005-09-25 16:26:07 +04:00
/* Now, if it was AD, then we want to start looking changing a
* few more things . Otherwise , we are done . */
2006-01-14 10:27:01 +03:00
if ( r - > out . realm ) {
2005-09-25 16:26:07 +04:00
status = libnet_JoinADSDomain ( ctx , r ) ;
return status ;
2005-08-03 04:59:35 +04:00
}
2005-10-16 02:01:15 +04:00
return status ;
2005-01-13 10:50:09 +03:00
}
2005-01-16 01:13:18 +03:00
2008-04-09 08:56:24 +04:00
static NTSTATUS libnet_Join_primary_domain ( struct libnet_context * ctx ,
TALLOC_CTX * mem_ctx ,
struct libnet_Join * r )
{
NTSTATUS status ;
TALLOC_CTX * tmp_mem ;
struct libnet_JoinDomain * r2 ;
2009-09-21 03:27:24 +04:00
struct provision_store_self_join_settings * set_secrets ;
2008-04-09 08:56:24 +04:00
uint32_t acct_type = 0 ;
const char * account_name ;
const char * netbios_name ;
2009-09-21 03:27:24 +04:00
const char * error_string ;
2008-04-09 08:56:24 +04:00
r - > out . error_string = NULL ;
tmp_mem = talloc_new ( mem_ctx ) ;
if ( ! tmp_mem ) {
return NT_STATUS_NO_MEMORY ;
}
r2 = talloc ( tmp_mem , struct libnet_JoinDomain ) ;
if ( ! r2 ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_mem ) ;
return NT_STATUS_NO_MEMORY ;
}
if ( r - > in . join_type = = SEC_CHAN_BDC ) {
acct_type = ACB_SVRTRUST ;
} else if ( r - > in . join_type = = SEC_CHAN_WKSTA ) {
acct_type = ACB_WSTRUST ;
} else {
r - > out . error_string = NULL ;
talloc_free ( tmp_mem ) ;
return NT_STATUS_INVALID_PARAMETER ;
}
if ( r - > in . netbios_name ! = NULL ) {
netbios_name = r - > in . netbios_name ;
} else {
2009-07-15 14:06:12 +04:00
netbios_name = talloc_strdup ( tmp_mem , lp_netbios_name ( ctx - > lp_ctx ) ) ;
2008-04-09 08:56:24 +04:00
if ( ! netbios_name ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_mem ) ;
return NT_STATUS_NO_MEMORY ;
}
}
account_name = talloc_asprintf ( tmp_mem , " %s$ " , netbios_name ) ;
if ( ! account_name ) {
r - > out . error_string = NULL ;
talloc_free ( tmp_mem ) ;
return NT_STATUS_NO_MEMORY ;
}
/*
* join the domain
*/
ZERO_STRUCTP ( r2 ) ;
r2 - > in . domain_name = r - > in . domain_name ;
r2 - > in . account_name = account_name ;
r2 - > in . netbios_name = netbios_name ;
r2 - > in . level = LIBNET_JOINDOMAIN_AUTOMATIC ;
r2 - > in . acct_type = acct_type ;
r2 - > in . recreate_account = false ;
status = libnet_JoinDomain ( ctx , r2 , r2 ) ;
if ( ! NT_STATUS_IS_OK ( status ) ) {
r - > out . error_string = talloc_steal ( mem_ctx , r2 - > out . error_string ) ;
talloc_free ( tmp_mem ) ;
return status ;
}
2009-09-21 03:27:24 +04:00
set_secrets = talloc ( tmp_mem , struct provision_store_self_join_settings ) ;
if ( ! set_secrets ) {
2008-04-09 08:56:24 +04:00
r - > out . error_string = NULL ;
talloc_free ( tmp_mem ) ;
return NT_STATUS_NO_MEMORY ;
}
2009-09-21 03:27:24 +04:00
ZERO_STRUCTP ( set_secrets ) ;
set_secrets - > domain_name = r2 - > out . domain_name ;
set_secrets - > realm = r2 - > out . realm ;
set_secrets - > account_name = account_name ;
set_secrets - > netbios_name = netbios_name ;
set_secrets - > secure_channel_type = r - > in . join_type ;
set_secrets - > machine_password = r2 - > out . join_password ;
set_secrets - > key_version_number = r2 - > out . kvno ;
set_secrets - > domain_sid = r2 - > out . domain_sid ;
2008-04-09 08:56:24 +04:00
2009-09-21 03:27:24 +04:00
status = provision_store_self_join ( ctx , ctx - > lp_ctx , ctx - > event_ctx , set_secrets , & error_string ) ;
2008-04-09 08:56:24 +04:00
if ( ! NT_STATUS_IS_OK ( status ) ) {
2009-09-21 03:27:24 +04:00
r - > out . error_string = talloc_steal ( mem_ctx , error_string ) ;
2008-04-09 08:56:24 +04:00
talloc_free ( tmp_mem ) ;
return status ;
}
2005-09-25 16:26:07 +04:00
/* move all out parameter to the callers TALLOC_CTX */
r - > out . error_string = NULL ;
r - > out . join_password = r2 - > out . join_password ;
2009-09-21 03:27:24 +04:00
talloc_reparent ( r2 , mem_ctx , r2 - > out . join_password ) ;
2005-09-25 16:26:07 +04:00
r - > out . domain_sid = r2 - > out . domain_sid ;
2009-09-21 03:27:24 +04:00
talloc_reparent ( r2 , mem_ctx , r2 - > out . domain_sid ) ;
2005-12-22 09:58:26 +03:00
r - > out . domain_name = r2 - > out . domain_name ;
2009-09-21 03:27:24 +04:00
talloc_reparent ( r2 , mem_ctx , r2 - > out . domain_name ) ;
2005-09-25 16:26:07 +04:00
talloc_free ( tmp_mem ) ;
2005-01-16 01:13:18 +03:00
return NT_STATUS_OK ;
}
2005-07-29 14:58:05 +04:00
NTSTATUS libnet_Join ( struct libnet_context * ctx , TALLOC_CTX * mem_ctx , struct libnet_Join * r )
2005-01-16 01:13:18 +03:00
{
2006-01-13 05:58:35 +03:00
switch ( r - > in . join_type ) {
2005-09-25 16:26:07 +04:00
case SEC_CHAN_WKSTA :
return libnet_Join_primary_domain ( ctx , mem_ctx , r ) ;
case SEC_CHAN_BDC :
return libnet_Join_primary_domain ( ctx , mem_ctx , r ) ;
case SEC_CHAN_DOMAIN :
2008-12-24 00:11:21 +03:00
case SEC_CHAN_DNS_DOMAIN :
case SEC_CHAN_NULL :
2005-09-25 16:26:07 +04:00
break ;
2005-01-16 01:13:18 +03:00
}
2005-09-25 16:26:07 +04:00
r - > out . error_string = talloc_asprintf ( mem_ctx ,
2006-01-13 05:58:35 +03:00
" Invalid join type specified (%08X) attempting to join domain %s " ,
r - > in . join_type , r - > in . domain_name ) ;
2005-09-25 16:26:07 +04:00
return NT_STATUS_INVALID_PARAMETER ;
2005-01-16 01:13:18 +03:00
}