source: trunk/server/source4/auth/sam.c

Last change on this file was 745, checked in by Silvan Scherrer, 13 years ago

Samba Server: updated trunk to 3.6.0
File size: 19.0 KB
RevLine 
[745]1/*
2 Unix SMB/CIFS implementation.
3 Password and authentication handling
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2010
5 Copyright (C) Gerald Carter 2003
6 Copyright (C) Stefan Metzmacher 2005
7 Copyright (C) Matthias Dieter Wallnöfer 2009
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21*/
22
23#include "includes.h"
24#include "system/time.h"
25#include "auth/auth.h"
26#include <ldb.h>
27#include "dsdb/samdb/samdb.h"
28#include "libcli/security/security.h"
29#include "auth/auth_sam.h"
30#include "dsdb/common/util.h"
31#include "libcli/ldap/ldap_ndr.h"
32#include "param/param.h"
33
34#define KRBTGT_ATTRS \
35 /* required for the krb5 kdc */ \
36 "objectClass", \
37 "sAMAccountName", \
38 "userPrincipalName", \
39 "servicePrincipalName", \
40 "msDS-KeyVersionNumber", \
41 "msDS-SecondaryKrbTgtNumber", \
42 "msDS-SupportedEncryptionTypes", \
43 "supplementalCredentials", \
44 \
45 /* passwords */ \
46 "dBCSPwd", \
47 "unicodePwd", \
48 \
49 "userAccountControl", \
50 "objectSid", \
51 \
52 "pwdLastSet", \
53 "accountExpires"
54
55const char *krbtgt_attrs[] = {
56 KRBTGT_ATTRS, NULL
57};
58
59const char *server_attrs[] = {
60 KRBTGT_ATTRS, NULL
61};
62
63const char *user_attrs[] = {
64 KRBTGT_ATTRS,
65
66 "logonHours",
67
68 /* check 'allowed workstations' */
69 "userWorkstations",
70
71 /* required for user_info_dc, not access control: */
72 "displayName",
73 "scriptPath",
74 "profilePath",
75 "homeDirectory",
76 "homeDrive",
77 "lastLogon",
78 "lastLogoff",
79 "accountExpires",
80 "badPwdCount",
81 "logonCount",
82 "primaryGroupID",
83 "memberOf",
84 NULL,
85};
86
87/****************************************************************************
88 Check if a user is allowed to logon at this time. Note this is the
89 servers local time, as logon hours are just specified as a weekly
90 bitmask.
91****************************************************************************/
92
93static bool logon_hours_ok(struct ldb_message *msg, const char *name_for_logs)
94{
95 /* In logon hours first bit is Sunday from 12AM to 1AM */
96 const struct ldb_val *hours;
97 struct tm *utctime;
98 time_t lasttime;
99 const char *asct;
100 uint8_t bitmask, bitpos;
101
102 hours = ldb_msg_find_ldb_val(msg, "logonHours");
103 if (!hours) {
104 DEBUG(5,("logon_hours_ok: No hours restrictions for user %s\n", name_for_logs));
105 return true;
106 }
107
108 if (hours->length != 168/8) {
109 DEBUG(5,("logon_hours_ok: malformed logon hours restrictions for user %s\n", name_for_logs));
110 return true;
111 }
112
113 lasttime = time(NULL);
114 utctime = gmtime(&lasttime);
115 if (!utctime) {
116 DEBUG(1, ("logon_hours_ok: failed to get gmtime. Failing logon for user %s\n",
117 name_for_logs));
118 return false;
119 }
120
121 /* find the corresponding byte and bit */
122 bitpos = (utctime->tm_wday * 24 + utctime->tm_hour) % 168;
123 bitmask = 1 << (bitpos % 8);
124
125 if (! (hours->data[bitpos/8] & bitmask)) {
126 struct tm *t = localtime(&lasttime);
127 if (!t) {
128 asct = "INVALID TIME";
129 } else {
130 asct = asctime(t);
131 if (!asct) {
132 asct = "INVALID TIME";
133 }
134 }
135
136 DEBUG(1, ("logon_hours_ok: Account for user %s not allowed to "
137 "logon at this time (%s).\n",
138 name_for_logs, asct ));
139 return false;
140 }
141
142 asct = asctime(utctime);
143 DEBUG(5,("logon_hours_ok: user %s allowed to logon at this time (%s)\n",
144 name_for_logs, asct ? asct : "UNKNOWN TIME" ));
145
146 return true;
147}
148
149/****************************************************************************
150 Do a specific test for a SAM_ACCOUNT being valid for this connection
151 (ie not disabled, expired and the like).
152****************************************************************************/
153_PUBLIC_ NTSTATUS authsam_account_ok(TALLOC_CTX *mem_ctx,
154 struct ldb_context *sam_ctx,
155 uint32_t logon_parameters,
156 struct ldb_dn *domain_dn,
157 struct ldb_message *msg,
158 const char *logon_workstation,
159 const char *name_for_logs,
160 bool allow_domain_trust,
161 bool password_change)
162{
163 uint16_t acct_flags;
164 const char *workstation_list;
165 NTTIME acct_expiry;
166 NTTIME must_change_time;
167
168 NTTIME now;
169 DEBUG(4,("authsam_account_ok: Checking SMB password for user %s\n", name_for_logs));
170
171 acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, msg, domain_dn);
172
173 acct_expiry = samdb_result_account_expires(msg);
174
175 /* Check for when we must change this password, taking the
176 * userAccountControl flags into account */
177 must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx,
178 domain_dn, msg);
179
180 workstation_list = ldb_msg_find_attr_as_string(msg, "userWorkstations", NULL);
181
182 /* Quit if the account was disabled. */
183 if (acct_flags & ACB_DISABLED) {
184 DEBUG(2,("authsam_account_ok: Account for user '%s' was disabled.\n", name_for_logs));
185 return NT_STATUS_ACCOUNT_DISABLED;
186 }
187
188 /* Quit if the account was locked out. */
189 if (acct_flags & ACB_AUTOLOCK) {
190 DEBUG(2,("authsam_account_ok: Account for user %s was locked out.\n", name_for_logs));
191 return NT_STATUS_ACCOUNT_LOCKED_OUT;
192 }
193
194 /* Test account expire time */
195 unix_to_nt_time(&now, time(NULL));
196 if (now > acct_expiry) {
197 DEBUG(2,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
198 DEBUG(3,("authsam_account_ok: Account expired at '%s'.\n",
199 nt_time_string(mem_ctx, acct_expiry)));
200 return NT_STATUS_ACCOUNT_EXPIRED;
201 }
202
203 /* check for immediate expiry "must change at next logon" (but not if this is a password change request) */
204 if ((must_change_time == 0) && !password_change) {
205 DEBUG(2,("sam_account_ok: Account for user '%s' password must change!.\n",
206 name_for_logs));
207 return NT_STATUS_PASSWORD_MUST_CHANGE;
208 }
209
210 /* check for expired password (but not if this is a password change request) */
211 if ((must_change_time < now) && !password_change) {
212 DEBUG(2,("sam_account_ok: Account for user '%s' password expired!.\n",
213 name_for_logs));
214 DEBUG(2,("sam_account_ok: Password expired at '%s' unix time.\n",
215 nt_time_string(mem_ctx, must_change_time)));
216 return NT_STATUS_PASSWORD_EXPIRED;
217 }
218
219 /* Test workstation. Workstation list is comma separated. */
220 if (logon_workstation && workstation_list && *workstation_list) {
221 bool invalid_ws = true;
222 int i;
223 const char **workstations = (const char **)str_list_make(mem_ctx, workstation_list, ",");
224
225 for (i = 0; workstations && workstations[i]; i++) {
226 DEBUG(10,("sam_account_ok: checking for workstation match '%s' and '%s'\n",
227 workstations[i], logon_workstation));
228
229 if (strequal(workstations[i], logon_workstation)) {
230 invalid_ws = false;
231 break;
232 }
233 }
234
235 talloc_free(workstations);
236
237 if (invalid_ws) {
238 return NT_STATUS_INVALID_WORKSTATION;
239 }
240 }
241
242 if (!logon_hours_ok(msg, name_for_logs)) {
243 return NT_STATUS_INVALID_LOGON_HOURS;
244 }
245
246 if (!allow_domain_trust) {
247 if (acct_flags & ACB_DOMTRUST) {
248 DEBUG(2,("sam_account_ok: Domain trust account %s denied by server\n", name_for_logs));
249 return NT_STATUS_NOLOGON_INTERDOMAIN_TRUST_ACCOUNT;
250 }
251 }
252 if (!(logon_parameters & MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT)) {
253 if (acct_flags & ACB_SVRTRUST) {
254 DEBUG(2,("sam_account_ok: Server trust account %s denied by server\n", name_for_logs));
255 return NT_STATUS_NOLOGON_SERVER_TRUST_ACCOUNT;
256 }
257 }
258 if (!(logon_parameters & MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT)) {
259 /* TODO: this fails with current solaris client. We
260 need to work with Gordon to work out why */
261 if (acct_flags & ACB_WSTRUST) {
262 DEBUG(4,("sam_account_ok: Wksta trust account %s denied by server\n", name_for_logs));
263 return NT_STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT;
264 }
265 }
266
267 return NT_STATUS_OK;
268}
269
270_PUBLIC_ NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx,
271 struct ldb_context *sam_ctx,
272 const char *netbios_name,
273 const char *domain_name,
274 struct ldb_dn *domain_dn,
275 struct ldb_message *msg,
276 DATA_BLOB user_sess_key,
277 DATA_BLOB lm_sess_key,
278 struct auth_user_info_dc **_user_info_dc)
279{
280 NTSTATUS status;
281 struct auth_user_info_dc *user_info_dc;
282 struct auth_user_info *info;
283 const char *str, *filter;
284 /* SIDs for the account and his primary group */
285 struct dom_sid *account_sid;
286 const char *primary_group_string;
287 const char *primary_group_dn;
288 DATA_BLOB primary_group_blob;
289 /* SID structures for the expanded group memberships */
290 struct dom_sid *sids = NULL;
291 unsigned int num_sids = 0, i;
292 struct dom_sid *domain_sid;
293 TALLOC_CTX *tmp_ctx;
294 struct ldb_message_element *el;
295
296 user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
297 NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
298
299 tmp_ctx = talloc_new(user_info_dc);
300 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc, user_info_dc);
301
302 sids = talloc_array(user_info_dc, struct dom_sid, 2);
303 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sids, user_info_dc);
304
305 num_sids = 2;
306
307 account_sid = samdb_result_dom_sid(user_info_dc, msg, "objectSid");
308 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(account_sid, user_info_dc);
309
310 status = dom_sid_split_rid(tmp_ctx, account_sid, &domain_sid, NULL);
311 if (!NT_STATUS_IS_OK(status)) {
312 talloc_free(user_info_dc);
313 return status;
314 }
315
316 sids[PRIMARY_USER_SID_INDEX] = *account_sid;
317 sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
318 sid_append_rid(&sids[PRIMARY_GROUP_SID_INDEX], ldb_msg_find_attr_as_uint(msg, "primaryGroupID", ~0));
319
320 /* Filter out builtin groups from this token. We will search
321 * for builtin groups later, and not include them in the PAC
322 * on SamLogon validation info */
323 filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(!(groupType:1.2.840.113556.1.4.803:=%u))(groupType:1.2.840.113556.1.4.803:=%u))", GROUP_TYPE_BUILTIN_LOCAL_GROUP, GROUP_TYPE_SECURITY_ENABLED);
324 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(filter, user_info_dc);
325
326 primary_group_string = dom_sid_string(tmp_ctx, &sids[PRIMARY_GROUP_SID_INDEX]);
327 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_string, user_info_dc);
328
329 primary_group_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", primary_group_string);
330 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_dn, user_info_dc);
331
332 primary_group_blob = data_blob_string_const(primary_group_dn);
333
334 /* Expands the primary group - this function takes in
335 * memberOf-like values, so we fake one up with the
336 * <SID=S-...> format of DN and then let it expand
337 * them, as long as they meet the filter - so only
338 * domain groups, not builtin groups
339 *
340 * The primary group is still treated specially, so we set the
341 * 'only childs' flag to true
342 */
343 status = dsdb_expand_nested_groups(sam_ctx, &primary_group_blob, true, filter,
344 user_info_dc, &sids, &num_sids);
345 if (!NT_STATUS_IS_OK(status)) {
346 talloc_free(user_info_dc);
347 return status;
348 }
349
350 /* Expands the additional groups */
351 el = ldb_msg_find_element(msg, "memberOf");
352 for (i = 0; el && i < el->num_values; i++) {
353 /* This function takes in memberOf values and expands
354 * them, as long as they meet the filter - so only
355 * domain groups, not builtin groups */
356 status = dsdb_expand_nested_groups(sam_ctx, &el->values[i], false, filter,
357 user_info_dc, &sids, &num_sids);
358 if (!NT_STATUS_IS_OK(status)) {
359 talloc_free(user_info_dc);
360 return status;
361 }
362 }
363
364 user_info_dc->sids = sids;
365 user_info_dc->num_sids = num_sids;
366
367 user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
368 NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
369
370 info->account_name = talloc_steal(info,
371 ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL));
372
373 info->domain_name = talloc_strdup(info, domain_name);
374 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->domain_name,
375 user_info_dc);
376
377 str = ldb_msg_find_attr_as_string(msg, "displayName", "");
378 info->full_name = talloc_strdup(info, str);
379 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->full_name, user_info_dc);
380
381 str = ldb_msg_find_attr_as_string(msg, "scriptPath", "");
382 info->logon_script = talloc_strdup(info, str);
383 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_script,
384 user_info_dc);
385
386 str = ldb_msg_find_attr_as_string(msg, "profilePath", "");
387 info->profile_path = talloc_strdup(info, str);
388 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->profile_path,
389 user_info_dc);
390
391 str = ldb_msg_find_attr_as_string(msg, "homeDirectory", "");
392 info->home_directory = talloc_strdup(info, str);
393 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_directory,
394 user_info_dc);
395
396 str = ldb_msg_find_attr_as_string(msg, "homeDrive", "");
397 info->home_drive = talloc_strdup(info, str);
398 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_drive, user_info_dc);
399
400 info->logon_server = talloc_strdup(info, netbios_name);
401 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_server,
402 user_info_dc);
403
404 info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
405 info->last_logoff = samdb_result_last_logoff(msg);
406 info->acct_expiry = samdb_result_account_expires(msg);
407 info->last_password_change = samdb_result_nttime(msg,
408 "pwdLastSet", 0);
409 info->allow_password_change
410 = samdb_result_allow_password_change(sam_ctx, mem_ctx,
411 domain_dn, msg, "pwdLastSet");
412 info->force_password_change
413 = samdb_result_force_password_change(sam_ctx, mem_ctx,
414 domain_dn, msg);
415 info->logon_count = ldb_msg_find_attr_as_uint(msg, "logonCount", 0);
416 info->bad_password_count = ldb_msg_find_attr_as_uint(msg, "badPwdCount",
417 0);
418
419 info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx,
420 msg, domain_dn);
421
422 user_info_dc->user_session_key = data_blob_talloc(user_info_dc,
423 user_sess_key.data,
424 user_sess_key.length);
425 if (user_sess_key.data) {
426 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->user_session_key.data,
427 user_info_dc);
428 }
429 user_info_dc->lm_session_key = data_blob_talloc(user_info_dc,
430 lm_sess_key.data,
431 lm_sess_key.length);
432 if (lm_sess_key.data) {
433 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->lm_session_key.data,
434 user_info_dc);
435 }
436
437 if (info->acct_flags & ACB_SVRTRUST) {
438 /* the SID_NT_ENTERPRISE_DCS SID gets added into the
439 PAC */
440 user_info_dc->sids = talloc_realloc(user_info_dc,
441 user_info_dc->sids,
442 struct dom_sid,
443 user_info_dc->num_sids+1);
444 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->sids, user_info_dc);
445 user_info_dc->sids[user_info_dc->num_sids] = global_sid_Enterprise_DCs;
446 user_info_dc->num_sids++;
447 }
448
449 if ((info->acct_flags & (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) ==
450 (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) {
451 /* the DOMAIN_RID_ENTERPRISE_READONLY_DCS PAC */
452 user_info_dc->sids = talloc_realloc(user_info_dc,
453 user_info_dc->sids,
454 struct dom_sid,
455 user_info_dc->num_sids+1);
456 NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->sids, user_info_dc);
457 user_info_dc->sids[user_info_dc->num_sids] = *domain_sid;
458 sid_append_rid(&user_info_dc->sids[user_info_dc->num_sids],
459 DOMAIN_RID_ENTERPRISE_READONLY_DCS);
460 user_info_dc->num_sids++;
461 }
462
463 info->authenticated = true;
464
465 talloc_free(tmp_ctx);
466 *_user_info_dc = user_info_dc;
467
468 return NT_STATUS_OK;
469}
470
471NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
472 TALLOC_CTX *mem_ctx, const char *principal,
473 const char **attrs,
474 struct ldb_dn **domain_dn,
475 struct ldb_message **msg)
476{
477 struct ldb_dn *user_dn;
478 NTSTATUS nt_status;
479 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
480 int ret;
481
482 if (!tmp_ctx) {
483 return NT_STATUS_NO_MEMORY;
484 }
485
486 nt_status = crack_user_principal_name(sam_ctx, tmp_ctx, principal,
487 &user_dn, domain_dn);
488 if (!NT_STATUS_IS_OK(nt_status)) {
489 talloc_free(tmp_ctx);
490 return nt_status;
491 }
492
493 /* pull the user attributes */
494 ret = dsdb_search_one(sam_ctx, tmp_ctx, msg, user_dn,
495 LDB_SCOPE_BASE, attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
496 if (ret != LDB_SUCCESS) {
497 talloc_free(tmp_ctx);
498 return NT_STATUS_INTERNAL_DB_CORRUPTION;
499 }
500 talloc_steal(mem_ctx, *msg);
501 talloc_steal(mem_ctx, *domain_dn);
502 talloc_free(tmp_ctx);
503
504 return NT_STATUS_OK;
505}
506
507/* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available, and for tokenGroups in the DSDB stack.
508
509 Supply either a principal or a DN
510*/
511NTSTATUS authsam_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
512 struct loadparm_context *lp_ctx,
513 struct ldb_context *sam_ctx,
514 const char *principal,
515 struct ldb_dn *user_dn,
516 struct auth_user_info_dc **user_info_dc)
517{
518 NTSTATUS nt_status;
519 DATA_BLOB user_sess_key = data_blob(NULL, 0);
520 DATA_BLOB lm_sess_key = data_blob(NULL, 0);
521
522 struct ldb_message *msg;
523 struct ldb_dn *domain_dn;
524
525 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
526 if (!tmp_ctx) {
527 return NT_STATUS_NO_MEMORY;
528 }
529
530 if (principal) {
531 nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal,
532 user_attrs, &domain_dn, &msg);
533 if (!NT_STATUS_IS_OK(nt_status)) {
534 talloc_free(tmp_ctx);
535 return nt_status;
536 }
537 } else if (user_dn) {
538 struct dom_sid *user_sid, *domain_sid;
539 int ret;
540 /* pull the user attributes */
541 ret = dsdb_search_one(sam_ctx, tmp_ctx, &msg, user_dn,
542 LDB_SCOPE_BASE, user_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
543 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
544 talloc_free(tmp_ctx);
545 return NT_STATUS_NO_SUCH_USER;
546 } else if (ret != LDB_SUCCESS) {
547 talloc_free(tmp_ctx);
548 return NT_STATUS_INTERNAL_DB_CORRUPTION;
549 }
550
551 user_sid = samdb_result_dom_sid(msg, msg, "objectSid");
552
553 nt_status = dom_sid_split_rid(tmp_ctx, user_sid, &domain_sid, NULL);
554 if (!NT_STATUS_IS_OK(nt_status)) {
555 return nt_status;
556 }
557
558 domain_dn = samdb_search_dn(sam_ctx, mem_ctx, NULL,
559 "(&(objectSid=%s)(objectClass=domain))",
560 ldap_encode_ndr_dom_sid(tmp_ctx, domain_sid));
561 if (!domain_dn) {
562 DEBUG(3, ("authsam_get_user_info_dc_principal: Failed to find domain with: SID %s\n",
563 dom_sid_string(tmp_ctx, domain_sid)));
564 return NT_STATUS_NO_SUCH_USER;
565 }
566
567 } else {
568 return NT_STATUS_INVALID_PARAMETER;
569 }
570
571 nt_status = authsam_make_user_info_dc(tmp_ctx, sam_ctx,
572 lpcfg_netbios_name(lp_ctx),
573 lpcfg_workgroup(lp_ctx),
574 domain_dn,
575 msg,
576 user_sess_key, lm_sess_key,
577 user_info_dc);
578 if (!NT_STATUS_IS_OK(nt_status)) {
579 talloc_free(tmp_ctx);
580 return nt_status;
581 }
582
583 talloc_steal(mem_ctx, *user_info_dc);
584 talloc_free(tmp_ctx);
585
586 return NT_STATUS_OK;
587}
Note: See TracBrowser for help on using the repository browser.