Attachment 4361 Details for Bug 6481 – updated backport to 3.4

[patch] updated backport to 3.4

v3-4-Don-t-require-Modify-property-perms-to-unjoin-bug-64.patch (text/plain), 8.10 KB, created by Jim McDonough on 2009-06-29 08:08:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Jim McDonough

Created: 2009-06-29 08:08:58 UTC

Size: 8.10 KB

patch

obsolete

>From d1eab1b6e2b4a0620f82a22bdd83187c3a382092 Mon Sep 17 00:00:00 2001
>From: Jim McDonough <jmcd@samba.org>
>Date: Fri, 19 Jun 2009 13:46:07 -0400
>Subject: [PATCH] Don't require "Modify property" perms to unjoin bug #6481)
> "net ads leave" stopped working when "modify properties"
> permissions were not granted (meaning you had to be allowed
> to disable the account that you were about to delete).
>
>Libnetapi should not delete machine accounts, as this does not
>happen on win32.  The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag
>really means "disable" (both in practice and docs).
>
>However, to keep the functionality in "net ads leave", we
>will still try to do the delete.  If this fails, we try
>to do the disable.
>
>Additionally, it is possible in windows to not disable or
>delete the account, but just tell the local machine that it
>is no longer in the account.  libnet can now do this as well.
>
>Don't use ads realm name for non-ads case.  #6481
>
>Also check that the connection to ads worked.
>---
> source3/lib/netapi/joindomain.c          |    1 +
> source3/libnet/libnet_join.c             |   61 ++++++++++++++++++++---------
> source3/librpc/gen_ndr/libnet_join.h     |    5 +-
> source3/librpc/gen_ndr/ndr_libnet_join.c |    1 +
> source3/librpc/idl/libnet_join.idl       |    1 +
> source3/utils/net_ads.c                  |   11 ++++-
> 6 files changed, 57 insertions(+), 23 deletions(-)
>
>diff --git a/source3/lib/netapi/joindomain.c b/source3/lib/netapi/joindomain.c
>index 9eedc5d..9066d9b 100644
>--- a/source3/lib/netapi/joindomain.c
>+++ b/source3/lib/netapi/joindomain.c
>@@ -203,6 +203,7 @@ WERROR NetUnjoinDomain_l(struct libnetapi_ctx *mem_ctx,
> 
> 	u->in.domain_name = domain;
> 	u->in.unjoin_flags = r->in.unjoin_flags;
>+	u->in.delete_machine_account = false;
> 	u->in.modify_config = true;
> 	u->in.debug = true;
> 
>diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
>index 376befe..0867365 100644
>--- a/source3/libnet/libnet_join.c
>+++ b/source3/libnet/libnet_join.c
>@@ -1923,6 +1923,12 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
> 		W_ERROR_HAVE_NO_MEMORY(r->in.domain_sid);
> 	}
> 
>+	if (!(r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) && 
>+	    !r->in.delete_machine_account) {
>+		libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
>+		return WERR_OK;
>+	}
>+
> 	if (!r->in.dc_name) {
> 		struct netr_DsRGetDCNameInfo *info;
> 		const char *dc;
>@@ -1948,38 +1954,55 @@ static WERROR libnet_DomainUnjoin(TALLOC_CTX *mem_ctx,
> 		W_ERROR_HAVE_NO_MEMORY(r->in.dc_name);
> 	}
> 
>-	status = libnet_join_unjoindomain_rpc(mem_ctx, r);
>-	if (!NT_STATUS_IS_OK(status)) {
>-		libnet_unjoin_set_error_string(mem_ctx, r,
>-			"failed to disable machine account via rpc: %s",
>-			get_friendly_nt_error_msg(status));
>-		if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
>-			return WERR_SETUP_NOT_JOINED;
>-		}
>-		return ntstatus_to_werror(status);
>-	}
>-
>-	r->out.disabled_machine_account = true;
>-
> #ifdef WITH_ADS
>-	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
>+	/* for net ads leave, try to delete the account.  If it works, 
>+	   no sense in disabling.  If it fails, we can still try to 
>+	   disable it. jmcd */
>+	   
>+	if (r->in.delete_machine_account) {
> 		ADS_STATUS ads_status;
>-		libnet_unjoin_connect_ads(mem_ctx, r);
>-		ads_status = libnet_unjoin_remove_machine_acct(mem_ctx, r);
>+		ads_status = libnet_unjoin_connect_ads(mem_ctx, r);
>+		if (ADS_ERR_OK(ads_status)) {
>+			/* dirty hack */
>+			r->out.dns_domain_name = 
>+				talloc_strdup(mem_ctx,
>+					      r->in.ads->server.realm);
>+			ads_status = 
>+				libnet_unjoin_remove_machine_acct(mem_ctx, r);
>+		}
> 		if (!ADS_ERR_OK(ads_status)) {
> 			libnet_unjoin_set_error_string(mem_ctx, r,
> 				"failed to remove machine account from AD: %s",
> 				ads_errstr(ads_status));
> 		} else {
> 			r->out.deleted_machine_account = true;
>-			/* dirty hack */
>-			r->out.dns_domain_name = talloc_strdup(mem_ctx,
>-							       r->in.ads->server.realm);
> 			W_ERROR_HAVE_NO_MEMORY(r->out.dns_domain_name);
>+			libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
>+			return WERR_OK;
> 		}
> 	}
> #endif /* WITH_ADS */
> 
>+	/* The WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE flag really means 
>+	   "disable".  */
>+	if (r->in.unjoin_flags & WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE) {
>+		status = libnet_join_unjoindomain_rpc(mem_ctx, r);
>+		if (!NT_STATUS_IS_OK(status)) {
>+			libnet_unjoin_set_error_string(mem_ctx, r,
>+				"failed to disable machine account via rpc: %s",
>+				get_friendly_nt_error_msg(status));
>+			if (NT_STATUS_EQUAL(status, NT_STATUS_NO_SUCH_USER)) {
>+				return WERR_SETUP_NOT_JOINED;
>+			}
>+			return ntstatus_to_werror(status);
>+		}
>+		
>+		r->out.disabled_machine_account = true;
>+	}
>+
>+	/* If disable succeeded or was not requested at all, we 
>+	   should be getting rid of our end of things */
>+
> 	libnet_join_unjoindomain_remove_secrets(mem_ctx, r);
> 
> 	return WERR_OK;
>diff --git a/source3/librpc/gen_ndr/libnet_join.h b/source3/librpc/gen_ndr/libnet_join.h
>index ed49062..cf915cb 100644
>--- a/source3/librpc/gen_ndr/libnet_join.h
>+++ b/source3/librpc/gen_ndr/libnet_join.h
>@@ -2,13 +2,13 @@
> 
> #include <stdint.h>
> 
>+#include "libcli/util/ntstatus.h"
>+
> #include "librpc/gen_ndr/wkssvc.h"
> #include "librpc/gen_ndr/security.h"
> #ifndef _HEADER_libnetjoin
> #define _HEADER_libnetjoin
> 
>-enum netr_SchannelType;
>-
> 
> struct libnet_JoinCtx {
> 	struct {
>@@ -58,6 +58,7 @@ struct libnet_UnjoinCtx {
> 		const char * admin_password;
> 		const char * machine_password;
> 		uint32_t unjoin_flags;
>+		uint8_t delete_machine_account;
> 		uint8_t modify_config;
> 		struct dom_sid *domain_sid;/* [ref] */
> 		struct ads_struct *ads;/* [ref] */
>diff --git a/source3/librpc/gen_ndr/ndr_libnet_join.c b/source3/librpc/gen_ndr/ndr_libnet_join.c
>index 79fcd16..ba31ea6 100644
>--- a/source3/librpc/gen_ndr/ndr_libnet_join.c
>+++ b/source3/librpc/gen_ndr/ndr_libnet_join.c
>@@ -89,6 +89,7 @@ _PUBLIC_ void ndr_print_libnet_UnjoinCtx(struct ndr_print *ndr, const char *name
> 		ndr_print_ptr(ndr, "machine_password", r->in.machine_password);
> #endif
> 		ndr_print_wkssvc_joinflags(ndr, "unjoin_flags", r->in.unjoin_flags);
>+		ndr_print_uint8(ndr, "delete_machine_account", r->in.delete_machine_account);
> 		ndr_print_uint8(ndr, "modify_config", r->in.modify_config);
> 		ndr_print_ptr(ndr, "domain_sid", r->in.domain_sid);
> 		ndr->depth++;
>diff --git a/source3/librpc/idl/libnet_join.idl b/source3/librpc/idl/libnet_join.idl
>index c600ea0..80429dc 100644
>--- a/source3/librpc/idl/libnet_join.idl
>+++ b/source3/librpc/idl/libnet_join.idl
>@@ -53,6 +53,7 @@ interface libnetjoin
> 		[in] string admin_password,
> 		[in] string machine_password,
> 		[in] wkssvc_joinflags unjoin_flags,
>+		[in] boolean8 delete_machine_account,
> 		[in] boolean8 modify_config,
> 		[in] dom_sid *domain_sid,
> 		[in] ads_struct *ads,
>diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
>index 8e927be..c5b1a3b 100644
>--- a/source3/utils/net_ads.c
>+++ b/source3/utils/net_ads.c
>@@ -910,8 +910,12 @@ static int net_ads_leave(struct net_context *c, int argc, const char **argv)
> 	r->in.admin_account	= c->opt_user_name;
> 	r->in.admin_password	= net_prompt_pass(c, c->opt_user_name);
> 	r->in.modify_config	= lp_config_backend_is_registry();
>+
>+	/* Try to delete it, but if that fails, disable it.  The 
>+	   WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE really means "disable */
> 	r->in.unjoin_flags	= WKSSVC_JOIN_FLAGS_JOIN_TYPE |
> 				  WKSSVC_JOIN_FLAGS_ACCOUNT_DELETE;
>+	r->in.delete_machine_account = true;
> 
> 	werr = libnet_Unjoin(ctx, r);
> 	if (!W_ERROR_IS_OK(werr)) {
>@@ -921,7 +925,7 @@ static int net_ads_leave(struct net_context *c, int argc, const char **argv)
> 		goto done;
> 	}
> 
>-	if (W_ERROR_IS_OK(werr)) {
>+	if (r->out.deleted_machine_account) {
> 		d_printf("Deleted account for '%s' in realm '%s'\n",
> 			r->in.machine_name, r->out.dns_domain_name);
> 		goto done;
>@@ -935,7 +939,10 @@ static int net_ads_leave(struct net_context *c, int argc, const char **argv)
> 		goto done;
> 	}
> 
>-	d_fprintf(stderr, "Failed to disable machine account for '%s' in realm '%s'\n",
>+	/* Based on what we requseted, we shouldn't get here, but if
>+	   we did, it means the secrets were removed, and therefore
>+	   we have left the domain */
>+	d_fprintf(stderr, "Machine '%s' Left domain '%s'\n",
> 		  r->in.machine_name, r->out.dns_domain_name);
> 
>  done:
>-- 
>1.6.3.2
>

Flags:

gd: review+

Actions: View

Attachments on bug 6481: 4335 | 4338 | 4339 | 4361 | 4362 | 4363