libds/common/flag_mapping.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    helper mapping functions for the UF and ACB flags
   4
   5    Copyright (C) Stefan (metze) Metzmacher 2002
   6    Copyright (C) Andrew Tridgell 2004
   7    Copyright (C) Matthias Dieter Wallnöfer 2010
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "replace.h"
  24 #include "lib/util/data_blob.h"
  25 #include "lib/util/time.h"
  26 #include "lib/util/debug.h"
  27 #include "librpc/gen_ndr/samr.h"
  28 #include "../libds/common/flags.h"
  29 #include "flag_mapping.h"
  30
  31 /*
  32 translated the ACB_CTRL Flags to UserFlags (userAccountControl)
  33 */
  34 /* mapping between ADS userAccountControl and SAMR acct_flags */
  35 static const struct {
  36         uint32_t uf;
  37         uint32_t acb;
  38 } acct_flags_map[] = {
  39         { UF_ACCOUNTDISABLE, ACB_DISABLED },
  40         { UF_HOMEDIR_REQUIRED, ACB_HOMDIRREQ },
  41         { UF_PASSWD_NOTREQD, ACB_PWNOTREQ },
  42         { UF_TEMP_DUPLICATE_ACCOUNT, ACB_TEMPDUP },
  43         { UF_NORMAL_ACCOUNT, ACB_NORMAL },
  44         { UF_MNS_LOGON_ACCOUNT, ACB_MNS },
  45         { UF_INTERDOMAIN_TRUST_ACCOUNT, ACB_DOMTRUST },
  46         { UF_WORKSTATION_TRUST_ACCOUNT, ACB_WSTRUST },
  47         { UF_SERVER_TRUST_ACCOUNT, ACB_SVRTRUST },
  48         { UF_DONT_EXPIRE_PASSWD, ACB_PWNOEXP },
  49         { UF_LOCKOUT, ACB_AUTOLOCK },
  50         { UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED, ACB_ENC_TXT_PWD_ALLOWED },
  51         { UF_SMARTCARD_REQUIRED, ACB_SMARTCARD_REQUIRED },
  52         { UF_TRUSTED_FOR_DELEGATION, ACB_TRUSTED_FOR_DELEGATION },
  53         { UF_NOT_DELEGATED, ACB_NOT_DELEGATED },
  54         { UF_USE_DES_KEY_ONLY, ACB_USE_DES_KEY_ONLY},
  55         { UF_DONT_REQUIRE_PREAUTH, ACB_DONT_REQUIRE_PREAUTH },
  56         { UF_PASSWORD_EXPIRED, ACB_PW_EXPIRED },
  57         { UF_NO_AUTH_DATA_REQUIRED, ACB_NO_AUTH_DATA_REQD },
  58         { UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION, ACB_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION },
  59         { UF_PARTIAL_SECRETS_ACCOUNT, ACB_PARTIAL_SECRETS_ACCOUNT },
  60         { UF_USE_AES_KEYS, ACB_USE_AES_KEYS }
  61 };
  62
  63 uint32_t ds_acb2uf(uint32_t acb)
  64 {
  65         unsigned int i;
  66         uint32_t ret = 0;
  67         for (i=0;i<ARRAY_SIZE(acct_flags_map);i++) {
  68                 if (acct_flags_map[i].acb & acb) {
  69                         ret |= acct_flags_map[i].uf;
  70                 }
  71         }
  72         return ret;
  73 }
  74
  75 /*
  76 translated the UserFlags (userAccountControl) to ACB_CTRL Flags
  77 */
  78 uint32_t ds_uf2acb(uint32_t uf)
  79 {
  80         unsigned int i;
  81         uint32_t ret = 0;
  82         for (i=0;i<ARRAY_SIZE(acct_flags_map);i++) {
  83                 if (acct_flags_map[i].uf & uf) {
  84                         ret |= acct_flags_map[i].acb;
  85                 }
  86         }
  87         return ret;
  88 }
  89
  90 /*
  91 get the accountType from the UserFlags
  92 */
  93 uint32_t ds_uf2atype(uint32_t uf)
  94 {
  95         uint32_t atype = 0x00000000;
  96
  97         if (uf & UF_NORMAL_ACCOUNT)                     atype = ATYPE_NORMAL_ACCOUNT;
  98         else if (uf & UF_TEMP_DUPLICATE_ACCOUNT)        atype = ATYPE_NORMAL_ACCOUNT;
  99         else if (uf & UF_SERVER_TRUST_ACCOUNT)          atype = ATYPE_WORKSTATION_TRUST;
 100         else if (uf & UF_WORKSTATION_TRUST_ACCOUNT)     atype = ATYPE_WORKSTATION_TRUST;
 101         else if (uf & UF_INTERDOMAIN_TRUST_ACCOUNT)     atype = ATYPE_INTERDOMAIN_TRUST;
 102
 103         return atype;
 104 }
 105
 106 /*
 107 get the accountType from the groupType
 108 */
 109 uint32_t ds_gtype2atype(uint32_t gtype)
 110 {
 111         uint32_t atype = 0x00000000;
 112
 113         switch(gtype) {
 114                 case GTYPE_SECURITY_BUILTIN_LOCAL_GROUP:
 115                         atype = ATYPE_SECURITY_LOCAL_GROUP;
 116                         break;
 117                 case GTYPE_SECURITY_GLOBAL_GROUP:
 118                         atype = ATYPE_SECURITY_GLOBAL_GROUP;
 119                         break;
 120                 case GTYPE_SECURITY_DOMAIN_LOCAL_GROUP:
 121                         atype = ATYPE_SECURITY_LOCAL_GROUP;
 122                         break;
 123                 case GTYPE_SECURITY_UNIVERSAL_GROUP:
 124                         atype = ATYPE_SECURITY_UNIVERSAL_GROUP;
 125                         break;
 126
 127                 case GTYPE_DISTRIBUTION_GLOBAL_GROUP:
 128                         atype = ATYPE_DISTRIBUTION_GLOBAL_GROUP;
 129                         break;
 130                 case GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP:
 131                         atype = ATYPE_DISTRIBUTION_LOCAL_GROUP;
 132                         break;
 133                 case GTYPE_DISTRIBUTION_UNIVERSAL_GROUP:
 134                         atype = ATYPE_DISTRIBUTION_UNIVERSAL_GROUP;
 135                         break;
 136         }
 137
 138         return atype;
 139 }
 140
 141 /* turn a sAMAccountType into a SID_NAME_USE */
 142 enum lsa_SidType ds_atype_map(uint32_t atype)
 143 {
 144         switch (atype & 0xF0000000) {
 145         case ATYPE_GLOBAL_GROUP:
 146                 return SID_NAME_DOM_GRP;
 147         case ATYPE_SECURITY_LOCAL_GROUP:
 148                 return SID_NAME_ALIAS;
 149         case ATYPE_ACCOUNT:
 150                 return SID_NAME_USER;
 151         default:
 152                 DEBUG(1,("hmm, need to map account type 0x%x\n", atype));
 153         }
 154         return SID_NAME_UNKNOWN;
 155 }
 156
 157 /* get the default primary group RID for a given userAccountControl
 158  * (information according to MS-SAMR 3.1.1.8.1) */
 159 uint32_t ds_uf2prim_group_rid(uint32_t uf)
 160 {
 161         uint32_t prim_group_rid = DOMAIN_RID_USERS;
 162
 163         if ((uf & UF_PARTIAL_SECRETS_ACCOUNT)
 164          && (uf & UF_WORKSTATION_TRUST_ACCOUNT))    prim_group_rid = DOMAIN_RID_READONLY_DCS;
 165         else if (uf & UF_SERVER_TRUST_ACCOUNT)      prim_group_rid = DOMAIN_RID_DCS;
 166         else if (uf & UF_WORKSTATION_TRUST_ACCOUNT) prim_group_rid = DOMAIN_RID_DOMAIN_MEMBERS;
 167
 168         return prim_group_rid;
 169 }
 170
 171 const char *dsdb_user_account_control_flag_bit_to_string(uint32_t uf)
 172 {
 173         switch (uf) {
 174         case UF_SCRIPT:
 175                 return "UF_SCRIPT";
 176         case UF_ACCOUNTDISABLE:
 177                 return "UF_ACCOUNTDISABLE";
 178         case UF_00000004:
 179                 return "UF_00000004";
 180         case UF_HOMEDIR_REQUIRED:
 181                 return "UF_HOMEDIR_REQUIRED";
 182         case UF_LOCKOUT:
 183                 return "UF_LOCKOUT";
 184         case UF_PASSWD_NOTREQD:
 185                 return "UF_PASSWD_NOTREQD";
 186         case UF_PASSWD_CANT_CHANGE:
 187                 return "UF_PASSWD_CANT_CHANGE";
 188         case UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED:
 189                 return "UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED";
 190
 191         case UF_TEMP_DUPLICATE_ACCOUNT:
 192                 return "UF_TEMP_DUPLICATE_ACCOUNT";
 193         case UF_NORMAL_ACCOUNT:
 194                 return "UF_NORMAL_ACCOUNT";
 195         case UF_00000400:
 196                 return "UF_00000400";
 197         case UF_INTERDOMAIN_TRUST_ACCOUNT:
 198                 return "UF_INTERDOMAIN_TRUST_ACCOUNT";
 199
 200         case UF_WORKSTATION_TRUST_ACCOUNT:
 201                 return "UF_WORKSTATION_TRUST_ACCOUNT";
 202         case UF_SERVER_TRUST_ACCOUNT:
 203                 return "UF_SERVER_TRUST_ACCOUNT";
 204         case UF_00004000:
 205                 return "UF_00004000";
 206         case UF_00008000:
 207                 return "UF_00008000";
 208
 209         case UF_DONT_EXPIRE_PASSWD:
 210                 return "UF_DONT_EXPIRE_PASSWD";
 211         case UF_MNS_LOGON_ACCOUNT:
 212                 return "UF_MNS_LOGON_ACCOUNT";
 213         case UF_SMARTCARD_REQUIRED:
 214                 return "UF_SMARTCARD_REQUIRED";
 215         case UF_TRUSTED_FOR_DELEGATION:
 216                 return "UF_TRUSTED_FOR_DELEGATION";
 217
 218         case UF_NOT_DELEGATED:
 219                 return "UF_NOT_DELEGATED";
 220         case UF_USE_DES_KEY_ONLY:
 221                 return "UF_USE_DES_KEY_ONLY";
 222         case UF_DONT_REQUIRE_PREAUTH:
 223                 return "UF_DONT_REQUIRE_PREAUTH";
 224         case UF_PASSWORD_EXPIRED:
 225                 return "UF_PASSWORD_EXPIRED";
 226         case UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION:
 227                 return "UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION";
 228         case UF_NO_AUTH_DATA_REQUIRED:
 229                 return "UF_NO_AUTH_DATA_REQUIRED";
 230         case UF_PARTIAL_SECRETS_ACCOUNT:
 231                 return "UF_PARTIAL_SECRETS_ACCOUNT";
 232         case UF_USE_AES_KEYS:
 233                 return "UF_USE_AES_KEYS";
 234         default:
 235                 break;
 236         }
 237         return NULL;
 238 }