Changeset 740 for vendor/current/source4/auth/sam.c

Timestamp:

Nov 14, 2012, 12:59:34 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to 3.6.0

File:

• vendor/current/source4/auth/sam.c (modified) (15 diffs)

vendor/current/source4/auth/sam.c

@@ -2 +2 @@
    Unix SMB/CIFS implementation.
    Password and authentication handling
-   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2004
+   Copyright (C) Andrew Bartlett <abartlet@samba.org> 2001-2010
    Copyright (C) Gerald Carter                             2003
    Copyright (C) Stefan Metzmacher                         2005
@@ -25 +25 @@
 #include "auth/auth.h"
 #include <ldb.h>
-#include "../lib/util/util_ldb.h"
 #include "dsdb/samdb/samdb.h"
 #include "libcli/security/security.h"
-#include "libcli/ldap/ldap.h"
-#include "../libcli/ldap/ldap_ndr.h"
-#include "librpc/gen_ndr/ndr_netlogon.h"
-#include "librpc/gen_ndr/ndr_security.h"
+#include "auth/auth_sam.h"
+#include "dsdb/common/util.h"
+#include "libcli/ldap/ldap_ndr.h"
 #include "param/param.h"
-#include "auth/auth_sam.h"
 
 #define KRBTGT_ATTRS \
@@ -42 +39 @@
         "servicePrincipalName",                 \
         "msDS-KeyVersionNumber",                \
+        "msDS-SecondaryKrbTgtNumber",           \
+        "msDS-SupportedEncryptionTypes",        \
         "supplementalCredentials",              \
                                                 \
@@ -52 +51 @@
                                                 \
         "pwdLastSet",                           \
-        "accountExpires"                        
+        "accountExpires"
 
 const char *krbtgt_attrs[] = {
-        KRBTGT_ATTRS
+        KRBTGT_ATTRS, NULL
 };
 
 const char *server_attrs[] = {
-        KRBTGT_ATTRS
+        KRBTGT_ATTRS, NULL
 };
 
@@ -70 +69 @@
         "userWorkstations",
                        
-        /* required for server_info, not access control: */
+        /* required for user_info_dc, not access control: */
         "displayName",
         "scriptPath",
@@ -149 +148 @@
 
 /****************************************************************************
- Do a specific test for a SAM_ACCOUNT being vaild for this connection 
+ Do a specific test for a SAM_ACCOUNT being valid for this connection
  (ie not disabled, expired and the like).
 ****************************************************************************/
@@ -179 +178 @@
                                                               domain_dn, msg);
 
-        workstation_list = samdb_result_string(msg, "userWorkstations", NULL);
+        workstation_list = ldb_msg_find_attr_as_string(msg, "userWorkstations", NULL);
 
         /* Quit if the account was disabled. */
         if (acct_flags & ACB_DISABLED) {
-                DEBUG(1,("authsam_account_ok: Account for user '%s' was disabled.\n", name_for_logs));
+                DEBUG(2,("authsam_account_ok: Account for user '%s' was disabled.\n", name_for_logs));
                 return NT_STATUS_ACCOUNT_DISABLED;
         }
@@ -189 +188 @@
         /* Quit if the account was locked out. */
         if (acct_flags & ACB_AUTOLOCK) {
-                DEBUG(1,("authsam_account_ok: Account for user %s was locked out.\n", name_for_logs));
+                DEBUG(2,("authsam_account_ok: Account for user %s was locked out.\n", name_for_logs));
                 return NT_STATUS_ACCOUNT_LOCKED_OUT;
         }
@@ -196 +195 @@
         unix_to_nt_time(&now, time(NULL));
         if (now > acct_expiry) {
-                DEBUG(1,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
+                DEBUG(2,("authsam_account_ok: Account for user '%s' has expired.\n", name_for_logs));
                 DEBUG(3,("authsam_account_ok: Account expired at '%s'.\n", 
                          nt_time_string(mem_ctx, acct_expiry)));
@@ -204 +203 @@
         /* check for immediate expiry "must change at next logon" (but not if this is a password change request) */
         if ((must_change_time == 0) && !password_change) {
-                DEBUG(1,("sam_account_ok: Account for user '%s' password must change!.\n", 
+                DEBUG(2,("sam_account_ok: Account for user '%s' password must change!.\n",
                          name_for_logs));
                 return NT_STATUS_PASSWORD_MUST_CHANGE;
@@ -211 +210 @@
         /* check for expired password (but not if this is a password change request) */
         if ((must_change_time < now) && !password_change) {
-                DEBUG(1,("sam_account_ok: Account for user '%s' password expired!.\n", 
+                DEBUG(2,("sam_account_ok: Account for user '%s' password expired!.\n",
                          name_for_logs));
-                DEBUG(1,("sam_account_ok: Password expired at '%s' unix time.\n", 
+                DEBUG(2,("sam_account_ok: Password expired at '%s' unix time.\n",
                          nt_time_string(mem_ctx, must_change_time)));
                 return NT_STATUS_PASSWORD_EXPIRED;
@@ -269 +268 @@
 }
 
-/* This function tests if a SID structure "sids" contains the SID "sid" */
-static bool sids_contains_sid(const struct dom_sid **sids, const int num_sids,
-        const struct dom_sid *sid)
-{
-        int i;
-
-        for (i = 0; i < num_sids; i++) {
-                if (dom_sid_equal(sids[i], sid))
-                        return true;
-        }
-        return false;
-}
-
-/*
- * This function generates the transitive closure of a given SID "sid" (it
- * basically expands nested groups of a SID).
- * If the SID isn't located in the "res_sids" structure yet and the
- * "only_childs" flag is negative, we add it to "res_sids".
- * Then we've always to consider the "memberOf" attributes. We invoke the
- * function recursively on each item of it with the "only_childs" flag set to
- * "false".
- * The "only_childs" flag is particularly useful if you have a user SID and
- * want to include all his groups (referenced with "memberOf") without his SID
- * itself.
- *
- * At the beginning "res_sids" should reference to a NULL pointer.
- */
-static NTSTATUS authsam_expand_nested_groups(struct ldb_context *sam_ctx,
-        const struct dom_sid *sid, const bool only_childs,
-        TALLOC_CTX *res_sids_ctx, struct dom_sid ***res_sids,
-        int *num_res_sids)
-{
-        const char * const attrs[] = { "memberOf", NULL };
-        int i, ret;
-        bool already_there;
-        struct ldb_dn *tmp_dn;
-        struct dom_sid *tmp_sid;
-        TALLOC_CTX *tmp_ctx;
-        struct ldb_message **res;
-        NTSTATUS status;
-
-        if (*res_sids == NULL) {
-                *num_res_sids = 0;
-        }
-
-        if (sid == NULL) {
-                return NT_STATUS_OK;
-        }
-
-        already_there = sids_contains_sid((const struct dom_sid**) *res_sids,
-                *num_res_sids, sid);
-        if (already_there) {
-                return NT_STATUS_OK;
-        }
-
-        if (!only_childs) {
-                tmp_sid = dom_sid_dup(res_sids_ctx, sid);
-                NT_STATUS_HAVE_NO_MEMORY(tmp_sid);
-                *res_sids = talloc_realloc(res_sids_ctx, *res_sids,
-                        struct dom_sid *, *num_res_sids + 1);
-                NT_STATUS_HAVE_NO_MEMORY(*res_sids);
-                (*res_sids)[*num_res_sids] = tmp_sid;
-                ++(*num_res_sids);
-        }
-
-        tmp_ctx = talloc_new(sam_ctx);
-
-        ret = gendb_search(sam_ctx, tmp_ctx, NULL, &res, attrs,
-                "objectSid=%s", ldap_encode_ndr_dom_sid(tmp_ctx, sid));
-        if (ret != 1) {
-                talloc_free(tmp_ctx);
-                return NT_STATUS_INTERNAL_DB_CORRUPTION;
-        }
-
-        if (res[0]->num_elements == 0) {
-                talloc_free(res);
-                talloc_free(tmp_ctx);
-                return NT_STATUS_OK;
-        }
-
-        for (i = 0; i < res[0]->elements[0].num_values; i++) {
-                tmp_dn = ldb_dn_from_ldb_val(tmp_ctx, sam_ctx,
-                        &res[0]->elements[0].values[i]);
-                tmp_sid = samdb_search_dom_sid(sam_ctx, tmp_ctx, tmp_dn,
-                        "objectSid", NULL);
-
-                status = authsam_expand_nested_groups(sam_ctx, tmp_sid,
-                        false, res_sids_ctx, res_sids, num_res_sids);
-                if (!NT_STATUS_IS_OK(status)) {
-                        talloc_free(res);
-                        talloc_free(tmp_ctx);
-                        return status;
-                }
-        }
-
-        talloc_free(res);
-        talloc_free(tmp_ctx);
-
-        return NT_STATUS_OK;
-}
-
-_PUBLIC_ NTSTATUS authsam_make_server_info(TALLOC_CTX *mem_ctx,
+_PUBLIC_ NTSTATUS authsam_make_user_info_dc(TALLOC_CTX *mem_ctx,
                                            struct ldb_context *sam_ctx,
                                            const char *netbios_name,
@@ -378 +276 @@
                                            DATA_BLOB user_sess_key,
                                            DATA_BLOB lm_sess_key,
-                                           struct auth_serversupplied_info
-                                                   **_server_info)
+                                           struct auth_user_info_dc **_user_info_dc)
 {
         NTSTATUS status;
-        struct auth_serversupplied_info *server_info;
-        const char *str;
-        struct dom_sid *tmp_sid;
+        struct auth_user_info_dc *user_info_dc;
+        struct auth_user_info *info;
+        const char *str, *filter;
         /* SIDs for the account and his primary group */
         struct dom_sid *account_sid;
-        struct dom_sid *primary_group_sid;
+        const char *primary_group_string;
+        const char *primary_group_dn;
+        DATA_BLOB primary_group_blob;
         /* SID structures for the expanded group memberships */
-        struct dom_sid **groupSIDs = NULL, **groupSIDs_2 = NULL;
-        int num_groupSIDs = 0, num_groupSIDs_2 = 0, i;
-        uint32_t userAccountControl;
-
-        server_info = talloc(mem_ctx, struct auth_serversupplied_info);
-        NT_STATUS_HAVE_NO_MEMORY(server_info);
-
-        account_sid = samdb_result_dom_sid(server_info, msg, "objectSid");
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(account_sid, server_info);
-
-        primary_group_sid = dom_sid_add_rid(server_info,
-                samdb_domain_sid(sam_ctx),
-                samdb_result_uint(msg, "primaryGroupID", ~0));
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_sid, server_info);
-
-        /* Expands the primary group */
-        status = authsam_expand_nested_groups(sam_ctx, primary_group_sid, false,
-                                              server_info, &groupSIDs, &num_groupSIDs);
+        struct dom_sid *sids = NULL;
+        unsigned int num_sids = 0, i;
+        struct dom_sid *domain_sid;
+        TALLOC_CTX *tmp_ctx;
+        struct ldb_message_element *el;
+
+        user_info_dc = talloc(mem_ctx, struct auth_user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc);
+
+        tmp_ctx = talloc_new(user_info_dc);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc, user_info_dc);
+
+        sids = talloc_array(user_info_dc, struct dom_sid, 2);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sids, user_info_dc);
+
+        num_sids = 2;
+
+        account_sid = samdb_result_dom_sid(user_info_dc, msg, "objectSid");
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(account_sid, user_info_dc);
+
+        status = dom_sid_split_rid(tmp_ctx, account_sid, &domain_sid, NULL);
         if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(server_info);
+                talloc_free(user_info_dc);
                 return status;
         }
 
+        sids[PRIMARY_USER_SID_INDEX] = *account_sid;
+        sids[PRIMARY_GROUP_SID_INDEX] = *domain_sid;
+        sid_append_rid(&sids[PRIMARY_GROUP_SID_INDEX], ldb_msg_find_attr_as_uint(msg, "primaryGroupID", ~0));
+
+        /* Filter out builtin groups from this token.  We will search
+         * for builtin groups later, and not include them in the PAC
+         * on SamLogon validation info */
+        filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(!(groupType:1.2.840.113556.1.4.803:=%u))(groupType:1.2.840.113556.1.4.803:=%u))", GROUP_TYPE_BUILTIN_LOCAL_GROUP, GROUP_TYPE_SECURITY_ENABLED);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(filter, user_info_dc);
+
+        primary_group_string = dom_sid_string(tmp_ctx, &sids[PRIMARY_GROUP_SID_INDEX]);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_string, user_info_dc);
+
+        primary_group_dn = talloc_asprintf(tmp_ctx, "<SID=%s>", primary_group_string);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(primary_group_dn, user_info_dc);
+
+        primary_group_blob = data_blob_string_const(primary_group_dn);
+
+        /* Expands the primary group - this function takes in
+         * memberOf-like values, so we fake one up with the
+         * <SID=S-...> format of DN and then let it expand
+         * them, as long as they meet the filter - so only
+         * domain groups, not builtin groups
+         *
+         * The primary group is still treated specially, so we set the
+         * 'only childs' flag to true
+         */
+        status = dsdb_expand_nested_groups(sam_ctx, &primary_group_blob, true, filter,
+                                           user_info_dc, &sids, &num_sids);
+        if (!NT_STATUS_IS_OK(status)) {
+                talloc_free(user_info_dc);
+                return status;
+        }
+
         /* Expands the additional groups */
-        status = authsam_expand_nested_groups(sam_ctx, account_sid, true,
-                server_info, &groupSIDs_2, &num_groupSIDs_2);
-        if (!NT_STATUS_IS_OK(status)) {
-                talloc_free(server_info);
-                return status;
-        }
-
-        /* Merge the two expanded structures (groupSIDs, groupSIDs_2) */
-        for (i = 0; i < num_groupSIDs_2; i++)
-                if (!sids_contains_sid((const struct dom_sid **) groupSIDs,
-                                num_groupSIDs, groupSIDs_2[i])) {
-                        tmp_sid = dom_sid_dup(server_info, groupSIDs_2[i]);
-                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(tmp_sid, server_info);
-                        groupSIDs = talloc_realloc(server_info, groupSIDs,
-                                struct dom_sid *, num_groupSIDs + 1);
-                        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(groupSIDs,
-                                server_info);
-                        groupSIDs[num_groupSIDs] = tmp_sid;
-                        ++num_groupSIDs;
-                }
-        talloc_free(groupSIDs_2);
-
-        server_info->account_sid = account_sid;
-        server_info->primary_group_sid = primary_group_sid;
-        
-        /* DCs also get SID_NT_ENTERPRISE_DCS */
-        userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
-        if (userAccountControl & UF_SERVER_TRUST_ACCOUNT) {
-                groupSIDs = talloc_realloc(server_info, groupSIDs, struct dom_sid *,
-                                           num_groupSIDs+1);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(groupSIDs, server_info);
-                groupSIDs[num_groupSIDs] = dom_sid_parse_talloc(groupSIDs, SID_NT_ENTERPRISE_DCS);
-                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(groupSIDs[num_groupSIDs], server_info);
-                num_groupSIDs++;
-        }
-
-        server_info->domain_groups = groupSIDs;
-        server_info->n_domain_groups = num_groupSIDs;
-
-        server_info->account_name = talloc_steal(server_info,
-                samdb_result_string(msg, "sAMAccountName", NULL));
-
-        server_info->domain_name = talloc_strdup(server_info, domain_name);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->domain_name,
-                server_info);
-
-        str = samdb_result_string(msg, "displayName", "");
-        server_info->full_name = talloc_strdup(server_info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->full_name, server_info);
-
-        str = samdb_result_string(msg, "scriptPath", "");
-        server_info->logon_script = talloc_strdup(server_info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->logon_script,
-                server_info);
-
-        str = samdb_result_string(msg, "profilePath", "");
-        server_info->profile_path = talloc_strdup(server_info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->profile_path,
-                server_info);
-
-        str = samdb_result_string(msg, "homeDirectory", "");
-        server_info->home_directory = talloc_strdup(server_info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->home_directory,
-                server_info);
-
-        str = samdb_result_string(msg, "homeDrive", "");
-        server_info->home_drive = talloc_strdup(server_info, str);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->home_drive, server_info);
-
-        server_info->logon_server = talloc_strdup(server_info, netbios_name);
-        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(server_info->logon_server,
-                server_info);
-
-        server_info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
-        server_info->last_logoff = samdb_result_last_logoff(msg);
-        server_info->acct_expiry = samdb_result_account_expires(msg);
-        server_info->last_password_change = samdb_result_nttime(msg,
+        el = ldb_msg_find_element(msg, "memberOf");
+        for (i = 0; el && i < el->num_values; i++) {
+                /* This function takes in memberOf values and expands
+                 * them, as long as they meet the filter - so only
+                 * domain groups, not builtin groups */
+                status = dsdb_expand_nested_groups(sam_ctx, &el->values[i], false, filter,
+                                                   user_info_dc, &sids, &num_sids);
+                if (!NT_STATUS_IS_OK(status)) {
+                        talloc_free(user_info_dc);
+                        return status;
+                }
+        }
+
+        user_info_dc->sids = sids;
+        user_info_dc->num_sids = num_sids;
+
+        user_info_dc->info = info = talloc_zero(user_info_dc, struct auth_user_info);
+        NT_STATUS_HAVE_NO_MEMORY(user_info_dc->info);
+
+        info->account_name = talloc_steal(info,
+                ldb_msg_find_attr_as_string(msg, "sAMAccountName", NULL));
+
+        info->domain_name = talloc_strdup(info, domain_name);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->domain_name,
+                user_info_dc);
+
+        str = ldb_msg_find_attr_as_string(msg, "displayName", "");
+        info->full_name = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->full_name, user_info_dc);
+
+        str = ldb_msg_find_attr_as_string(msg, "scriptPath", "");
+        info->logon_script = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_script,
+                user_info_dc);
+
+        str = ldb_msg_find_attr_as_string(msg, "profilePath", "");
+        info->profile_path = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->profile_path,
+                user_info_dc);
+
+        str = ldb_msg_find_attr_as_string(msg, "homeDirectory", "");
+        info->home_directory = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_directory,
+                user_info_dc);
+
+        str = ldb_msg_find_attr_as_string(msg, "homeDrive", "");
+        info->home_drive = talloc_strdup(info, str);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->home_drive, user_info_dc);
+
+        info->logon_server = talloc_strdup(info, netbios_name);
+        NT_STATUS_HAVE_NO_MEMORY_AND_FREE(info->logon_server,
+                user_info_dc);
+
+        info->last_logon = samdb_result_nttime(msg, "lastLogon", 0);
+        info->last_logoff = samdb_result_last_logoff(msg);
+        info->acct_expiry = samdb_result_account_expires(msg);
+        info->last_password_change = samdb_result_nttime(msg,
                 "pwdLastSet", 0);
-        server_info->allow_password_change
+        info->allow_password_change
                 = samdb_result_allow_password_change(sam_ctx, mem_ctx, 
                         domain_dn, msg, "pwdLastSet");
-        server_info->force_password_change
+        info->force_password_change
                 = samdb_result_force_password_change(sam_ctx, mem_ctx,
                         domain_dn, msg);
-        server_info->logon_count = samdb_result_uint(msg, "logonCount", 0);
-        server_info->bad_password_count = samdb_result_uint(msg, "badPwdCount",
+        info->logon_count = ldb_msg_find_attr_as_uint(msg, "logonCount", 0);
+        info->bad_password_count = ldb_msg_find_attr_as_uint(msg, "badPwdCount",
                 0);
 
-        server_info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx, 
+        info->acct_flags = samdb_result_acct_flags(sam_ctx, mem_ctx,
                                                           msg, domain_dn);
 
-        server_info->user_session_key = data_blob_talloc_reference(server_info,
-                &user_sess_key);
-        server_info->lm_session_key = data_blob_talloc_reference(server_info,
-                &lm_sess_key);
-
-        server_info->authenticated = true;
-
-        *_server_info = server_info;
+        user_info_dc->user_session_key = data_blob_talloc(user_info_dc,
+                                                         user_sess_key.data,
+                                                         user_sess_key.length);
+        if (user_sess_key.data) {
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->user_session_key.data,
+                                                  user_info_dc);
+        }
+        user_info_dc->lm_session_key = data_blob_talloc(user_info_dc,
+                                                       lm_sess_key.data,
+                                                       lm_sess_key.length);
+        if (lm_sess_key.data) {
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->lm_session_key.data,
+                                                  user_info_dc);
+        }
+
+        if (info->acct_flags & ACB_SVRTRUST) {
+                /* the SID_NT_ENTERPRISE_DCS SID gets added into the
+                   PAC */
+                user_info_dc->sids = talloc_realloc(user_info_dc,
+                                                   user_info_dc->sids,
+                                                   struct dom_sid,
+                                                   user_info_dc->num_sids+1);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->sids, user_info_dc);
+                user_info_dc->sids[user_info_dc->num_sids] = global_sid_Enterprise_DCs;
+                user_info_dc->num_sids++;
+        }
+
+        if ((info->acct_flags & (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) ==
+            (ACB_PARTIAL_SECRETS_ACCOUNT | ACB_WSTRUST)) {
+                /* the DOMAIN_RID_ENTERPRISE_READONLY_DCS PAC */
+                user_info_dc->sids = talloc_realloc(user_info_dc,
+                                                   user_info_dc->sids,
+                                                   struct dom_sid,
+                                                   user_info_dc->num_sids+1);
+                NT_STATUS_HAVE_NO_MEMORY_AND_FREE(user_info_dc->sids, user_info_dc);
+                user_info_dc->sids[user_info_dc->num_sids] = *domain_sid;
+                sid_append_rid(&user_info_dc->sids[user_info_dc->num_sids],
+                            DOMAIN_RID_ENTERPRISE_READONLY_DCS);
+                user_info_dc->num_sids++;
+        }
+
+        info->authenticated = true;
+
+        talloc_free(tmp_ctx);
+        *_user_info_dc = user_info_dc;
 
         return NT_STATUS_OK;
@@ -539 +492 @@
         
         /* pull the user attributes */
-        ret = gendb_search_single_extended_dn(sam_ctx, tmp_ctx, user_dn,
-                LDB_SCOPE_BASE, msg, attrs, "(objectClass=*)");
+        ret = dsdb_search_one(sam_ctx, tmp_ctx, msg, user_dn,
+                              LDB_SCOPE_BASE, attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
         if (ret != LDB_SUCCESS) {
                 talloc_free(tmp_ctx);
@@ -551 +504 @@
         return NT_STATUS_OK;
 }
+
+/* Used in the gensec_gssapi and gensec_krb5 server-side code, where the PAC isn't available, and for tokenGroups in the DSDB stack.
+
+ Supply either a principal or a DN
+*/
+NTSTATUS authsam_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
+                                           struct loadparm_context *lp_ctx,
+                                           struct ldb_context *sam_ctx,
+                                           const char *principal,
+                                           struct ldb_dn *user_dn,
+                                           struct auth_user_info_dc **user_info_dc)
+{
+        NTSTATUS nt_status;
+        DATA_BLOB user_sess_key = data_blob(NULL, 0);
+        DATA_BLOB lm_sess_key = data_blob(NULL, 0);
+
+        struct ldb_message *msg;
+        struct ldb_dn *domain_dn;
+
+        TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
+        if (!tmp_ctx) {
+                return NT_STATUS_NO_MEMORY;
+        }
+
+        if (principal) {
+                nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal,
+                                                      user_attrs, &domain_dn, &msg);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        talloc_free(tmp_ctx);
+                        return nt_status;
+                }
+        } else if (user_dn) {
+                struct dom_sid *user_sid, *domain_sid;
+                int ret;
+                /* pull the user attributes */
+                ret = dsdb_search_one(sam_ctx, tmp_ctx, &msg, user_dn,
+                                      LDB_SCOPE_BASE, user_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
+                if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_NO_SUCH_USER;
+                } else if (ret != LDB_SUCCESS) {
+                        talloc_free(tmp_ctx);
+                        return NT_STATUS_INTERNAL_DB_CORRUPTION;
+                }
+
+                user_sid = samdb_result_dom_sid(msg, msg, "objectSid");
+
+                nt_status = dom_sid_split_rid(tmp_ctx, user_sid, &domain_sid, NULL);
+                if (!NT_STATUS_IS_OK(nt_status)) {
+                        return nt_status;
+                }
+
+                domain_dn = samdb_search_dn(sam_ctx, mem_ctx, NULL,
+                                          "(&(objectSid=%s)(objectClass=domain))",
+                                            ldap_encode_ndr_dom_sid(tmp_ctx, domain_sid));
+                if (!domain_dn) {
+                        DEBUG(3, ("authsam_get_user_info_dc_principal: Failed to find domain with: SID %s\n",
+                                  dom_sid_string(tmp_ctx, domain_sid)));
+                        return NT_STATUS_NO_SUCH_USER;
+                }
+
+        } else {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+
+        nt_status = authsam_make_user_info_dc(tmp_ctx, sam_ctx,
+                                             lpcfg_netbios_name(lp_ctx),
+                                             lpcfg_workgroup(lp_ctx),
+                                             domain_dn,
+                                             msg,
+                                             user_sess_key, lm_sess_key,
+                                             user_info_dc);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                talloc_free(tmp_ctx);
+                return nt_status;
+        }
+
+        talloc_steal(mem_ctx, *user_info_dc);
+        talloc_free(tmp_ctx);
+
+        return NT_STATUS_OK;
+}