lsalib.c revision b3700b074e637f8c6991b70754c88a2cfffb246b
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * CDDL HEADER START
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * The contents of this file are subject to the terms of the
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Common Development and Distribution License (the "License").
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * You may not use this file except in compliance with the License.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * See the License for the specific language governing permissions
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * and limitations under the License.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * When distributing Covered Code, include this CDDL HEADER in each
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * If applicable, add the following below this CDDL HEADER, with the
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * fields enclosed by brackets "[]" replaced with your own identifying
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * information: Portions Copyright [yyyy] [name of copyright owner]
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * CDDL HEADER END
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Copyright 2015 Nexenta Systems, Inc. All rights reserved.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * This module provides the high level interface to the LSA RPC functions.
7f667e74610492ddbce8ce60f52ece95d2401949jose borregostatic uint32_t lsa_lookup_name_builtin(char *, char *, smb_account_t *);
7f667e74610492ddbce8ce60f52ece95d2401949jose borregostatic uint32_t lsa_lookup_name_domain(char *, smb_account_t *);
7f667e74610492ddbce8ce60f52ece95d2401949jose borregostatic uint32_t lsa_lookup_sid_builtin(smb_sid_t *, smb_account_t *);
7f667e74610492ddbce8ce60f52ece95d2401949jose borregostatic uint32_t lsa_lookup_sid_domain(smb_sid_t *, smb_account_t *);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Rossstatic uint32_t lsa_list_accounts(mlsvc_handle_t *);
dc20a3024900c47dd2ee44b9707e6df38f7d62a5as * Lookup the given account and returns the account information
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego * in the passed smb_account_t structure.
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * The lookup is performed in the following order:
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * well known accounts
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * local accounts
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * domain accounts
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * If it's established the given account is well know or local
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * but the lookup fails for some reason, the next step(s) won't be
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * performed.
dc20a3024900c47dd2ee44b9707e6df38f7d62a5as * If the name is a domain account, it may refer to a user, group or
dc20a3024900c47dd2ee44b9707e6df38f7d62a5as * alias. If it is a local account, its type should be specified
dc20a3024900c47dd2ee44b9707e6df38f7d62a5as * in the sid_type parameter. In case the account type is unknown
dc20a3024900c47dd2ee44b9707e6df38f7d62a5as * sid_type should be set to SidTypeUnknown.
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * account argument could be either [domain\]name or [domain/]name.
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * Return status:
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * NT_STATUS_SUCCESS Account is successfully translated
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * NT_STATUS_NONE_MAPPED Couldn't translate the account
7f667e74610492ddbce8ce60f52ece95d2401949jose borregolsa_lookup_name(char *account, uint16_t type, smb_account_t *info)
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego /* \john -> john */
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego (void) strlcpy(dombuf, account, sizeof (dombuf));
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego (void) strlcpy(nambuf, slash + 1, sizeof (nambuf));
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego status = lsa_lookup_name_builtin(domain, name, info);
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego status = smb_sam_lookup_name(domain, name, type, info);
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego if ((domain == NULL) || (status == NT_STATUS_NOT_FOUND))
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego status = lsa_lookup_name_domain(account, info);
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego return ((status == NT_STATUS_SUCCESS) ? status : NT_STATUS_NONE_MAPPED);
7f667e74610492ddbce8ce60f52ece95d2401949jose borregolsa_lookup_sid(smb_sid_t *sid, smb_account_t *info)
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego return ((status == NT_STATUS_SUCCESS) ? status : NT_STATUS_NONE_MAPPED);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Obtains the primary domain SID and name from the specified server
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * (domain controller).
8d7e41661dc4633488e93b13363137523ce59977jose borrego * The requested information will be returned via 'info' argument.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (Raw, not LSA-ized)
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wrightlsa_query_primary_domain_info(char *server, char *domain,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(server, domain, user, &domain_handle);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Obtains the account domain SID and name from the current server
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * (domain controller).
8d7e41661dc4633488e93b13363137523ce59977jose borrego * The requested information will be returned via 'info' argument.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (Raw, not LSA-ized)
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wrightlsa_query_account_domain_info(char *server, char *domain,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(server, domain, user, &domain_handle);
8d7e41661dc4633488e93b13363137523ce59977jose borrego * lsa_query_dns_domain_info
8d7e41661dc4633488e93b13363137523ce59977jose borrego * Obtains the DNS domain info from the specified server
8d7e41661dc4633488e93b13363137523ce59977jose borrego * (domain controller).
8d7e41661dc4633488e93b13363137523ce59977jose borrego * The requested information will be returned via 'info' argument.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (Raw, not LSA-ized)
a0aa776e20803c84edd153d9cb584fd67163aef3Alan Wrightlsa_query_dns_domain_info(char *server, char *domain, smb_domain_t *info)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(server, domain, user, &domain_handle);
8d7e41661dc4633488e93b13363137523ce59977jose borrego status = lsar_query_info_policy(&domain_handle,
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * Enumerate the trusted domains of primary domain.
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * This is the basic enumaration call which only returns the
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * NetBIOS name of the domain and its SID.
8d7e41661dc4633488e93b13363137523ce59977jose borrego * The requested information will be returned via 'info' argument.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (Raw, not LSA-ized)
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wrightlsa_enum_trusted_domains(char *server, char *domain,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(server, domain, user, &domain_handle);
8d7e41661dc4633488e93b13363137523ce59977jose borrego status = lsar_enum_trusted_domains(&domain_handle, &enum_context, info);
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * STATUS_NO_MORE_ENTRIES indicates that we
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * have all of the available information.
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * Enumerate the trusted domains of the primary domain.
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * This is the extended enumaration call which besides
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * NetBIOS name of the domain and its SID, it will return
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * the FQDN plus some trust information which is not used.
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * The requested information will be returned via 'info' argument.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (Raw, not LSA-ized)
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wrightlsa_enum_trusted_domains_ex(char *server, char *domain,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(server, domain, user, &domain_handle);
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright status = lsar_enum_trusted_domains_ex(&domain_handle, &enum_context,
148c5f43199ca0b43fc8e3b643aab11cd66ea327Alan Wright * STATUS_NO_MORE_ENTRIES indicates that we
29bd28862cfb8abbd3a0f0a4b17e08bbc3652836Alan Wright * have all of the available information.
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * Lookup well known accounts table
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * Return status:
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * NT_STATUS_SUCCESS Account is translated successfully
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * NT_STATUS_NOT_FOUND This is not a well known account
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * NT_STATUS_NONE_MAPPED Account is found but domains don't match
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * NT_STATUS_NO_MEMORY Memory shortage
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * NT_STATUS_INTERNAL_ERROR Internal error/unexpected failure
7f667e74610492ddbce8ce60f52ece95d2401949jose borregolsa_lookup_name_builtin(char *domain, char *name, smb_account_t *info)
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego if ((wkadom = smb_wka_get_domain(wka->wka_domidx)) == NULL)
bbf6f00c25b6a2bed23c35eac6d62998ecdb338cJordan Brown if ((domain != NULL) && (smb_strcasecmp(domain, wkadom, 0) != 0))
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego info->a_domsid = smb_sid_split(wka->wka_binsid, &info->a_rid);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Lookup a domain account by its name.
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * The information is returned in the user_info structure.
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * The caller is responsible for allocating and releasing
89dc44ce9705974a8bc4a39f1e878a0491a5be61jose borrego * this structure.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (LSA-ized)
7f667e74610492ddbce8ce60f52ece95d2401949jose borregolsa_lookup_name_domain(char *account_name, smb_account_t *info)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(dinfo.d_dci.dc_name, dinfo.d_primary.di_nbname,
fe1c642d06e14b412cd83ae2179303186ab08972Bill Krier status = lsar_lookup_names(&domain_handle, account_name, info);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * lsa_lookup_privs
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * Request the privileges associated with the specified account. In
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * order to get the privileges, we first have to lookup the name on
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * the specified domain controller and obtain the appropriate SID.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * The SID can then be used to open the account and obtain the
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * account privileges. The results from both the name lookup and the
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * privileges are returned in the user_info structure. The caller is
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * responsible for allocating and releasing this structure.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (LSA-ized)
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw/*ARGSUSED*/
7f667e74610492ddbce8ce60f52ece95d2401949jose borregolsa_lookup_privs(char *account_name, char *target_name, smb_account_t *ainfo)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(dinfo.d_dci.dc_name, dinfo.d_primary.di_nbname,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * lsa_list_privs
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * List the privileges supported by the specified server.
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * This function is only intended for diagnostics.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (LSA-ized)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(server, domain, user, &domain_handle);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw for (i = 0; i < 30; ++i) {
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw rc = lsar_lookup_priv_name(&domain_handle, &luid, name, 128);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (void) lsar_lookup_priv_value(&domain_handle, name, &luid);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw (void) lsar_lookup_priv_display_name(&domain_handle, name,
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * lsa_list_accounts
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * This function can be used to list the accounts in the specified
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw * domain. For now the SIDs are just listed in the system log.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_enum_accounts(domain_handle, &enum_context,
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross } while (status == 0 && accounts.entries_read != 0);
da6c28aaf62fa55f0fdb8004aa40f88f23bf53f0amw return (0);
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego * Lookup well known accounts table for the given SID
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego * Return status:
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego * NT_STATUS_SUCCESS Account is translated successfully
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego * NT_STATUS_NOT_FOUND This is not a well known account
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego * NT_STATUS_NO_MEMORY Memory shortage
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego * NT_STATUS_INTERNAL_ERROR Internal error/unexpected failure
7f667e74610492ddbce8ce60f52ece95d2401949jose borregolsa_lookup_sid_builtin(smb_sid_t *sid, smb_account_t *ainfo)
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego if ((wkadom = smb_wka_get_domain(wka->wka_domidx)) == NULL)
7f667e74610492ddbce8ce60f52ece95d2401949jose borrego ainfo->a_domsid = smb_sid_split(ainfo->a_sid, &ainfo->a_rid);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Lookup a domain account by its SID.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * The information is returned in the user_info structure.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * The caller is responsible for allocating and releasing
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * this structure.
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Returns NT status codes. (LSA-ized)
7f667e74610492ddbce8ce60f52ece95d2401949jose borregolsa_lookup_sid_domain(smb_sid_t *sid, smb_account_t *ainfo)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross status = lsar_open(dinfo.d_dci.dc_name, dinfo.d_primary.di_nbname,
fe1c642d06e14b412cd83ae2179303186ab08972Bill Krier status = lsar_lookup_sids(&domain_handle, sid, ainfo);
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * Most functions that call the local security authority expect
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * only a limited set of status returns. This function maps the
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * status we get from talking to our domain controller into one
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * that LSA functions can return. Most common errors become:
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross * NT_STATUS_CANT_ACCESS_DOMAIN_INFO (when no DC etc.)
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross case NT_STATUS_INVALID_PARAMETER: /* rpc bind */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross case NT_STATUS_BAD_NETWORK_PATH: /* get server addr */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross case NT_STATUS_NETWORK_ACCESS_DENIED: /* authentication */
b3700b074e637f8c6991b70754c88a2cfffb246bGordon Ross case NT_STATUS_BAD_NETWORK_NAME: /* tree connect */