Microsoft/WindowsXP-SP1
Microsoft/WindowsXP-SP1
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity
master
WindowsXP-SP1/ds/netapi/access/userp.c
Microsoft f7ca35dddd First commit
2020-09-30 16:53:49 +02:00

3514 lines
99 KiB
C
Raw Permalink Blame History

This file contains invisible Unicode characters

This file contains invisible Unicode characters that are indistinguishable to humans but may be processed differently by a computer. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

/*++
Copyright (c) 1991 Microsoft Corporation
Module Name:
userp.c
Abstract:
Internal routines for supporting the NetUser API functions
Author:
Cliff Van Dyke (cliffv) 26-Mar-1991
Environment:
User mode only.
Contains NT-specific code.
Requires ANSI C extensions: slash-slash comments, long external names.
Revision History:
17-Apr-1991 (cliffv)
Incorporated review comments.
17-Jan-1992 (madana)
Added a new entry in the UserpUasSamTable to support account
rename.
20-Jan-1992 (madana)
Sundry API changes.
--*/
#include <nt.h>
#include <ntrtl.h>
#include <nturtl.h>
#undef DOMAIN_ALL_ACCESS // defined in both ntsam.h and ntwinapi.h
#include <ntsam.h>
#include <ntsamp.h>
#include <ntlsa.h>
#include <windef.h>
#include <winbase.h>
#include <lmcons.h>
#include <access.h>
#include <accessp.h>
#include <align.h>
#include <limits.h>
#include <lmapibuf.h>
#include <lmaccess.h>
#include <lmerr.h>
#include <netdebug.h>
#include <netlib.h>
#include <netlibnt.h>
#include <secobj.h>
#include <stddef.h>
#include <uasp.h>
/*lint -e614 */ /* Auto aggregate initializers need not be constant */
// Lint complains about casts of one structure type to another.
// That is done frequently in the code below.
/*lint -e740 */ /* don't complain about unusual cast */
ULONG
UserpSizeOfLogonHours(
IN DWORD UnitsPerWeek
)
/*++
Routine Description:
This routine calculates the size in bytes of a logon hours string
given the number of Units per Week.
Parameters:
UnitsPerWeek - The number of bits in the logon hours string.
Return Values:
None.
--*/
{
//
// Calculate the number of bytes in the array, rounding up to the
// nearest number of UCHARs needed to store that many bits.
//
return((UnitsPerWeek + 8 * sizeof(UCHAR) - 1) / (8 * sizeof(UCHAR)));
} // UserpSizeOfLogonHours
NET_API_STATUS
UserpGetUserPriv(
IN SAM_HANDLE BuiltinDomainHandle,
IN SAM_HANDLE UserHandle,
IN ULONG UserRelativeId,
IN PSID DomainId,
OUT LPDWORD Priv,
OUT LPDWORD AuthFlags
)
/*++
Routine Description:
Determines the Priv and AuthFlags for the specified user.
Arguments:
BuiltinDomainHandle - A Handle to the Builtin Domain. This handle
must grant DOMAIN_GET_ALIAS_MEMBERSHIP access.
UserHandle - A handle to the user. This handle must grant
USER_LIST_GROUPS access.
UserRelativeId - Relative ID of the user to query.
DomainId - Domain Sid of the Domain this user belongs to
Priv - Returns the Lanman 2.0 Privilege level for the specified user.
AuthFlags - Returns the Lanman 2.0 Authflags for the specified user.
Return Value:
Status of the operation.
--*/
{
NET_API_STATUS NetStatus;
NTSTATUS Status;
PGROUP_MEMBERSHIP GroupMembership = NULL;
ULONG GroupCount;
ULONG GroupIndex;
PSID *UserSids = NULL;
ULONG UserSidCount = 0;
ULONG AliasCount;
PULONG Aliases = NULL;
//
// Determine all the groups this user is a member of
//
Status = SamGetGroupsForUser( UserHandle,
&GroupMembership,
&GroupCount);
if ( !NT_SUCCESS(Status) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpGetUserPriv: SamGetGroupsForUser returns %lX\n",
Status ));
}
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
//
// Allocate a buffer to point to the SIDs we're interested in
// alias membership for.
//
UserSids = (PSID *) NetpMemoryAllocate( (GroupCount+1) * sizeof(PSID) );
if ( UserSids == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
//
// Add the User's Sid to the Array of Sids.
//
NetStatus = NetpSamRidToSid( UserHandle,
UserRelativeId,
&UserSids[0] );
if ( NetStatus != NERR_Success ) {
goto Cleanup;
}
UserSidCount ++;
//
// Add each group the user is a member of to the array of Sids.
//
for ( GroupIndex = 0; GroupIndex < GroupCount; GroupIndex ++ ) {
NetStatus = NetpSamRidToSid( UserHandle,
GroupMembership[GroupIndex].RelativeId,
&UserSids[GroupIndex+1] );
if ( NetStatus != NERR_Success ) {
goto Cleanup;
}
UserSidCount ++;
}
//
// Find out which aliases in the builtin domain this user is a member of.
//
Status = SamGetAliasMembership( BuiltinDomainHandle,
UserSidCount,
UserSids,
&AliasCount,
&Aliases );
if ( !NT_SUCCESS(Status) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpGetUserPriv: SamGetAliasMembership returns %lX\n",
Status ));
}
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
//
// Convert the alias membership to priv and auth flags
//
NetpAliasMemberToPriv(
AliasCount,
Aliases,
Priv,
AuthFlags );
NetStatus = NERR_Success;
//
// Free Locally used resources.
//
Cleanup:
if ( Aliases != NULL ) {
Status = SamFreeMemory( Aliases );
NetpAssert( NT_SUCCESS(Status) );
}
if ( GroupMembership != NULL ) {
Status = SamFreeMemory( GroupMembership );
NetpAssert( NT_SUCCESS(Status) );
}
if ( UserSids != NULL ) {
for ( GroupIndex = 0; GroupIndex < UserSidCount; GroupIndex ++ ) {
NetpMemoryFree( UserSids[GroupIndex] );
}
NetpMemoryFree( UserSids );
}
return NetStatus;
}
NET_API_STATUS
UserpGetDacl(
IN SAM_HANDLE UserHandle,
OUT PACL *UserDacl,
OUT LPDWORD UserDaclSize OPTIONAL
)
/*++
Routine Description:
Get the DACL for a particular user record in SAM.
Arguments:
UserHandle - A Handle to the particular user.
UserDacl - Returns a pointer to the DACL for the user. The caller
should free this buffer using NetpMemoryFree.
Will return NULL if there is no DACL for this user.
UserDaclSize - Returns the size (in bytes) of the UserDacl.
Return Value:
Status of the operation.
--*/
{
NET_API_STATUS NetStatus;
NTSTATUS Status;
PSECURITY_DESCRIPTOR SecurityDescriptor = NULL;
BOOLEAN DaclPresent;
PACL Dacl;
BOOLEAN DaclDefaulted;
ACL_SIZE_INFORMATION AclSize;
//
// Get the Discretionary ACL (DACL) for the user
//
Status = SamQuerySecurityObject(
UserHandle,
DACL_SECURITY_INFORMATION,
&SecurityDescriptor );
if ( ! NT_SUCCESS( Status ) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpGetDacl: SamQuerySecurityObject returns %lX\n",
Status ));
}
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
Status = RtlGetDaclSecurityDescriptor(
SecurityDescriptor,
&DaclPresent,
&Dacl,
&DaclDefaulted );
if ( ! NT_SUCCESS( Status ) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpGetDacl: RtlGetDaclSecurityObject returns %lX\n",
Status ));
}
NetStatus = NERR_InternalError;
goto Cleanup;
}
//
// If there is no DACL, simply tell the caller
//
if ( !DaclPresent || Dacl == NULL ) {
NetStatus = NERR_Success;
*UserDacl = NULL;
if ( UserDaclSize != NULL ) {
*UserDaclSize = 0;
}
goto Cleanup;
}
//
// Determine the size of the DACL so we can copy it
//
Status = RtlQueryInformationAcl(
Dacl,
&AclSize,
sizeof(AclSize),
AclSizeInformation );
if ( ! NT_SUCCESS( Status ) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpGetDacl: RtlQueryInformationAcl returns %lX\n",
Status ));
}
NetStatus = NERR_InternalError;
goto Cleanup;
}
//
// Copy the DACL to an allocated buffer.
//
*UserDacl = NetpMemoryAllocate( AclSize.AclBytesInUse );
if ( *UserDacl == NULL ) {
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
NetpMoveMemory( *UserDacl, Dacl, AclSize.AclBytesInUse );
if ( UserDaclSize != NULL ) {
*UserDaclSize = AclSize.AclBytesInUse;
}
NetStatus = NERR_Success;
//
// Cleanup
//
Cleanup:
if ( SecurityDescriptor != NULL ) {
Status = SamFreeMemory( SecurityDescriptor );
NetpAssert( NT_SUCCESS(Status) );
}
return NetStatus;
}
NET_API_STATUS
UserpSetDacl(
IN SAM_HANDLE UserHandle,
IN PACL Dacl
)
/*++
Routine Description:
Set the specified Dacl on the specified SAM user record.
Arguments:
UserHandle - A handle to the user to modify.
Dacl - The DACL to set on the user.
Return Value:
Status code.
--*/
{
NTSTATUS Status;
PUCHAR SecurityDescriptor[SECURITY_DESCRIPTOR_MIN_LENGTH];
//
// Initialize a security descriptor to contain a pointer to the
// DACL.
//
Status = RtlCreateSecurityDescriptor(
SecurityDescriptor,
SECURITY_DESCRIPTOR_REVISION );
if (!NT_SUCCESS(Status) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetDacl: RtlCreateSecurityDescriptor rets %lX\n",
Status ));
}
return NetpNtStatusToApiStatus( Status );
}
Status = RtlSetDaclSecurityDescriptor(
(PSECURITY_DESCRIPTOR) SecurityDescriptor,
(BOOLEAN) TRUE, // Dacl is present
Dacl,
(BOOLEAN) FALSE ); // Dacl wasn't defaulted
if (!NT_SUCCESS(Status) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetDacl: RtlSetDaclSecurityDescriptor rets %lX\n",
Status ));
}
return NetpNtStatusToApiStatus( Status );
}
//
// Set this new security descriptor on the user
//
Status = SamSetSecurityObject(
UserHandle,
DACL_SECURITY_INFORMATION,
SecurityDescriptor );
if ( !NT_SUCCESS(Status) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "NetUserAdd: SamSetSecurityObject rets %lX\n",
Status ));
}
return NetpNtStatusToApiStatus( Status );
}
return NERR_Success;
}
NET_API_STATUS
UserpOpenUser(
IN SAM_HANDLE DomainHandle,
IN ACCESS_MASK DesiredAccess,
IN LPCWSTR UserName,
OUT PSAM_HANDLE UserHandle OPTIONAL,
OUT PULONG RelativeId OPTIONAL
)
/*++
Routine Description:
Open a Sam User by Name
Arguments:
DomainHandle - Supplies the Domain Handle.
DesiredAccess - Supplies access mask indicating desired access to user.
UserName - User name of the user.
UserHandle - Returns a handle to the user. If NULL, user is not
actually opened (merely the relative ID is returned).
RelativeId - Returns the relative ID of the user. If NULL the relative
Id is not returned.
Return Value:
Error code for the operation.
--*/
{
NTSTATUS Status;
NET_API_STATUS NetStatus;
//
// Variables for converting names to relative IDs
//
UNICODE_STRING NameString;
PSID_NAME_USE NameUse = NULL;
PULONG LocalRelativeId = NULL;
//
// Convert user name to relative ID.
//
RtlInitUnicodeString( &NameString, UserName );
Status = SamLookupNamesInDomain( DomainHandle,
1,
&NameString,
&LocalRelativeId,
&NameUse );
if ( !NT_SUCCESS(Status) ) {
if ( Status == STATUS_NONE_MAPPED ) {
NetStatus = NERR_UserNotFound;
} else {
NetStatus = NetpNtStatusToApiStatus( Status );
}
goto Cleanup;
}
if ( *NameUse != SidTypeUser ) {
NetStatus = NERR_UserNotFound;
goto Cleanup;
}
//
// Open the user
//
if ( UserHandle != NULL ) {
Status = SamOpenUser( DomainHandle,
DesiredAccess,
*LocalRelativeId,
UserHandle);
if ( !NT_SUCCESS(Status) ) {
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
}
//
// Return the relative Id if it's wanted.
//
if ( RelativeId != NULL ) {
*RelativeId = *LocalRelativeId;
}
NetStatus = NERR_Success;
//
// Cleanup
//
Cleanup:
if ( LocalRelativeId != NULL ) {
Status = SamFreeMemory( LocalRelativeId );
NetpAssert( NT_SUCCESS(Status) );
}
if ( NameUse != NULL ) {
Status = SamFreeMemory( NameUse );
NetpAssert( NT_SUCCESS(Status) );
}
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpOpenUser: %wZ: returns %ld\n",
&NameString, NetStatus ));
}
return NetStatus;
} // UserpOpenUser
VOID
UserpRelocationRoutine(
IN DWORD Level,
IN OUT PBUFFER_DESCRIPTOR BufferDescriptor,
IN PTRDIFF_T Offset
)
/*++
Routine Description:
Routine to relocate the pointers from the fixed portion of an enumeration
buffer to the string portion of an enumeration buffer. It is called
as a callback routine from NetpAllocateEnumBuffer when it re-allocates
such a buffer. NetpAllocateEnumBuffer copied the fixed portion and
string portion into the new buffer before calling this routine.
Arguments:
Level - Level of information in the buffer.
BufferDescriptor - Description of the new buffer.
Offset - Offset to add to each pointer in the fixed portion.
Return Value:
Returns the error code for the operation.
--*/
{
DWORD EntryCount;
DWORD EntryNumber;
DWORD FixedSize;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpRelocationRoutine: entering\n" ));
}
//
// Compute the number of fixed size entries
//
switch (Level) {
case 0:
FixedSize = sizeof(USER_INFO_0);
break;
case 1:
FixedSize = sizeof(USER_INFO_1);
break;
case 2:
FixedSize = sizeof(USER_INFO_2);
break;
case 3:
FixedSize = sizeof(USER_INFO_3);
break;
case 10:
FixedSize = sizeof(USER_INFO_10);
break;
case 11:
FixedSize = sizeof(USER_INFO_11);
break;
case 20:
FixedSize = sizeof(USER_INFO_20);
break;
default:
NetpAssert( FALSE );
return;
}
EntryCount =
(DWORD)((BufferDescriptor->FixedDataEnd - BufferDescriptor->Buffer)) /
FixedSize;
//
// Loop relocating each field in each fixed size structure
//
#define DO_ONE( _type, _fieldname ) \
RELOCATE_ONE( ((_type)TheStruct)->_fieldname, Offset)
for ( EntryNumber=0; EntryNumber<EntryCount; EntryNumber++ ) {
LPBYTE TheStruct = BufferDescriptor->Buffer + FixedSize * EntryNumber;
switch ( Level ) {
case 3:
DO_ONE( PUSER_INFO_3, usri3_profile );
DO_ONE( PUSER_INFO_3, usri3_home_dir_drive );
/* Drop through to case 2 */
case 2:
DO_ONE( PUSER_INFO_2, usri2_full_name );
DO_ONE( PUSER_INFO_2, usri2_usr_comment );
DO_ONE( PUSER_INFO_2, usri2_parms );
DO_ONE( PUSER_INFO_2, usri2_workstations );
DO_ONE( PUSER_INFO_2, usri2_logon_hours );
DO_ONE( PUSER_INFO_2, usri2_logon_server );
/* Drop through to case 1 */
case 1:
DO_ONE( PUSER_INFO_1, usri1_home_dir );
DO_ONE( PUSER_INFO_1, usri1_comment );
DO_ONE( PUSER_INFO_1, usri1_script_path );
/* Drop through to case 0 */
case 0:
DO_ONE( PUSER_INFO_0, usri0_name );
break;
case 11:
DO_ONE( PUSER_INFO_11, usri11_home_dir );
DO_ONE( PUSER_INFO_11, usri11_parms );
DO_ONE( PUSER_INFO_11, usri11_logon_server );
DO_ONE( PUSER_INFO_11, usri11_workstations );
DO_ONE( PUSER_INFO_11, usri11_home_dir );
DO_ONE( PUSER_INFO_11, usri11_logon_hours );
/* Drop through to case 10 */
case 10:
DO_ONE( PUSER_INFO_10, usri10_name );
DO_ONE( PUSER_INFO_10, usri10_comment );
DO_ONE( PUSER_INFO_10, usri10_usr_comment );
DO_ONE( PUSER_INFO_10, usri10_full_name );
break;
case 20:
DO_ONE( PUSER_INFO_20, usri20_name );
DO_ONE( PUSER_INFO_20, usri20_full_name );
DO_ONE( PUSER_INFO_20, usri20_comment );
break;
default:
NetpAssert( FALSE );
return;
}
}
return;
} // UserpRelocationRoutine
NET_API_STATUS
UserpGetInfo(
IN SAM_HANDLE DomainHandle,
IN PSID DomainId,
IN SAM_HANDLE BuiltinDomainHandle OPTIONAL,
IN UNICODE_STRING UserName,
IN ULONG UserRelativeId,
IN DWORD Level,
IN DWORD PrefMaxLen,
IN OUT PBUFFER_DESCRIPTOR BufferDescriptor,
IN BOOL IsGet,
IN DWORD SamFilter
)
/*++
Routine Description:
Get the information on one user and fill that information into an
allocated buffer.
Arguments:
DomainHandle - Domain Handle for the Account domain.
DomainId - Domain Id corresponding to DomainHandle
BuiltinDomainHandle - Domain Handle for the builtin domain. Need only be
specified for info level 1, 2, 3, and 11.
UserName - User name of the user to query.
UserRelativeId - Relative ID of the user to query.
Level - Level of information required. level 0, 1, 2, 3, 10, 11 and 20
are valid.
PrefMaxLen - Callers prefered maximum length
BufferDescriptor - Points to a structure which describes the allocated
buffer. On the first call, pass in BufferDescriptor->Buffer set
to NULL. On subsequent calls (in the 'enum' case), pass in the
structure just as it was passed back on a previous call.
The caller must deallocate the BufferDescriptor->Buffer using
MIDL_user_free if it is non-null.
IsGet - True iff this is a 'get' call and not an 'enum' call.
Return Value:
Error code for the operation.
If this is an Enum call, the status can be ERROR_MORE_DATA implying that
the Buffer has grown to PrefMaxLen and that this much data should
be returned to the caller.
--*/
{
NET_API_STATUS NetStatus;
NTSTATUS Status;
SAM_HANDLE UserHandle = NULL;
USER_ALL_INFORMATION *UserAll = NULL;
UNICODE_STRING LogonServer;
ACCESS_MASK DesiredAccess;
ULONG RequiredFields;
PACL UserDacl = NULL;
ULONG RidToReturn = UserRelativeId;
DWORD Size; // The size of the info returned for this user
DWORD FixedSize; // The size of the info returned for this user
LPBYTE NewStruct; // Pointer to fixed portion of new structure
PSID UserSid = NULL; // sid of the user
DWORD password_expired;
//
// Variables describes membership in the special groups.
//
DWORD Priv;
DWORD AuthFlags;
//
// Validate Level parameter and remember the fixed size of each returned
// array entry.
//
RtlInitUnicodeString( &LogonServer, L"\\\\*" );
switch (Level) {
case 0:
FixedSize = sizeof(USER_INFO_0);
DesiredAccess = 0;
RequiredFields = 0;
break;
case 1:
FixedSize = sizeof(USER_INFO_1);
DesiredAccess = USER_LIST_GROUPS | USER_READ_GENERAL |
USER_READ_LOGON | USER_READ_ACCOUNT | READ_CONTROL;
RequiredFields = USER_ALL_USERNAME |
USER_ALL_PASSWORDLASTSET |
USER_ALL_HOMEDIRECTORY |
USER_ALL_ADMINCOMMENT |
USER_ALL_USERACCOUNTCONTROL |
USER_ALL_SCRIPTPATH ;
break;
case 2:
FixedSize = sizeof(USER_INFO_2);
DesiredAccess = USER_LIST_GROUPS | USER_READ_GENERAL |
USER_READ_LOGON | USER_READ_ACCOUNT | READ_CONTROL |
USER_READ_PREFERENCES;
RequiredFields = USER_ALL_FULLNAME |
USER_ALL_USERCOMMENT |
USER_ALL_PARAMETERS |
USER_ALL_WORKSTATIONS |
USER_ALL_LASTLOGON |
USER_ALL_LASTLOGOFF |
USER_ALL_ACCOUNTEXPIRES |
USER_ALL_LOGONHOURS |
USER_ALL_BADPASSWORDCOUNT |
USER_ALL_LOGONCOUNT |
USER_ALL_COUNTRYCODE |
USER_ALL_CODEPAGE |
USER_ALL_USERNAME |
USER_ALL_PASSWORDLASTSET |
USER_ALL_HOMEDIRECTORY |
USER_ALL_ADMINCOMMENT |
USER_ALL_USERACCOUNTCONTROL |
USER_ALL_SCRIPTPATH ;
break;
case 3:
FixedSize = sizeof(USER_INFO_3);
DesiredAccess = USER_LIST_GROUPS | USER_READ_GENERAL |
USER_READ_LOGON | USER_READ_ACCOUNT | READ_CONTROL |
USER_READ_PREFERENCES;
RequiredFields = USER_ALL_USERID |
USER_ALL_PRIMARYGROUPID |
USER_ALL_PROFILEPATH |
USER_ALL_HOMEDIRECTORYDRIVE |
USER_ALL_PASSWORDMUSTCHANGE |
USER_ALL_FULLNAME |
USER_ALL_USERCOMMENT |
USER_ALL_PARAMETERS |
USER_ALL_WORKSTATIONS |
USER_ALL_LASTLOGON |
USER_ALL_LASTLOGOFF |
USER_ALL_ACCOUNTEXPIRES |
USER_ALL_LOGONHOURS |
USER_ALL_BADPASSWORDCOUNT |
USER_ALL_LOGONCOUNT |
USER_ALL_COUNTRYCODE |
USER_ALL_CODEPAGE |
USER_ALL_USERNAME |
USER_ALL_PASSWORDLASTSET |
USER_ALL_HOMEDIRECTORY |
USER_ALL_ADMINCOMMENT |
USER_ALL_USERACCOUNTCONTROL |
USER_ALL_SCRIPTPATH ;
break;
case 4:
FixedSize = sizeof(USER_INFO_4);
DesiredAccess = USER_LIST_GROUPS | USER_READ_GENERAL |
USER_READ_LOGON | USER_READ_ACCOUNT | READ_CONTROL |
USER_READ_PREFERENCES;
RequiredFields = USER_ALL_USERID |
USER_ALL_PRIMARYGROUPID |
USER_ALL_PROFILEPATH |
USER_ALL_HOMEDIRECTORYDRIVE |
USER_ALL_PASSWORDMUSTCHANGE |
USER_ALL_FULLNAME |
USER_ALL_USERCOMMENT |
USER_ALL_PARAMETERS |
USER_ALL_WORKSTATIONS |
USER_ALL_LASTLOGON |
USER_ALL_LASTLOGOFF |
USER_ALL_ACCOUNTEXPIRES |
USER_ALL_LOGONHOURS |
USER_ALL_BADPASSWORDCOUNT |
USER_ALL_LOGONCOUNT |
USER_ALL_COUNTRYCODE |
USER_ALL_CODEPAGE |
USER_ALL_USERNAME |
USER_ALL_PASSWORDLASTSET |
USER_ALL_HOMEDIRECTORY |
USER_ALL_ADMINCOMMENT |
USER_ALL_USERACCOUNTCONTROL |
USER_ALL_SCRIPTPATH ;
break;
case 10:
FixedSize = sizeof(USER_INFO_10);
DesiredAccess = USER_READ_GENERAL;
RequiredFields = USER_ALL_USERNAME |
USER_ALL_ADMINCOMMENT |
USER_ALL_USERCOMMENT |
USER_ALL_FULLNAME ;
break;
case 11:
FixedSize = sizeof(USER_INFO_11);
DesiredAccess = USER_LIST_GROUPS | USER_READ_GENERAL | USER_READ_LOGON |
USER_READ_ACCOUNT | USER_READ_PREFERENCES;
RequiredFields = USER_ALL_USERNAME |
USER_ALL_ADMINCOMMENT |
USER_ALL_USERCOMMENT |
USER_ALL_FULLNAME |
USER_ALL_PASSWORDLASTSET |
USER_ALL_HOMEDIRECTORY |
USER_ALL_PARAMETERS |
USER_ALL_LASTLOGON |
USER_ALL_LASTLOGOFF |
USER_ALL_BADPASSWORDCOUNT |
USER_ALL_LOGONCOUNT |
USER_ALL_COUNTRYCODE |
USER_ALL_WORKSTATIONS |
USER_ALL_LOGONHOURS |
USER_ALL_CODEPAGE ;
break;
case 20:
FixedSize = sizeof(USER_INFO_20);
DesiredAccess = USER_READ_GENERAL | USER_READ_ACCOUNT | READ_CONTROL;
RequiredFields = USER_ALL_USERNAME |
USER_ALL_FULLNAME |
USER_ALL_ADMINCOMMENT |
USER_ALL_USERACCOUNTCONTROL;
break;
case 23:
FixedSize = sizeof(USER_INFO_23);
DesiredAccess = USER_READ_GENERAL | USER_READ_ACCOUNT | READ_CONTROL;
RequiredFields = USER_ALL_USERNAME |
USER_ALL_FULLNAME |
USER_ALL_ADMINCOMMENT |
USER_ALL_USERACCOUNTCONTROL;
break;
default:
NetStatus = ERROR_INVALID_LEVEL;
goto Cleanup;
}
//
// Validate that the level is supported
//
if ( Level == 3 || Level == 20 ) {
ULONG Mode;
Status = SamGetCompatibilityMode(DomainHandle, &Mode);
if (!NT_SUCCESS(Status)) {
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
switch (Mode) {
case SAM_SID_COMPATIBILITY_STRICT:
NetStatus = ERROR_NOT_SUPPORTED;
goto Cleanup;
case SAM_SID_COMPATIBILITY_LAX:
RidToReturn = 0;
break;
}
}
//
// if we need to filter this account then query
// USER_ALL_USERACCOUNTCONTROL also.
//
if( SamFilter ) {
DesiredAccess |= USER_READ_ACCOUNT;
RequiredFields |= USER_ALL_USERACCOUNTCONTROL;
}
//
// Open the User account if need be
//
if ( DesiredAccess != 0 ) {
Status = SamOpenUser( DomainHandle,
DesiredAccess,
UserRelativeId,
&UserHandle);
if ( !NT_SUCCESS(Status) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpGetInfo: SamOpenUser returns %lX\n",
Status ));
}
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
}
//
// Get all the information we need about the user
//
if ( RequiredFields != 0 ) {
Status = SamQueryInformationUser( UserHandle,
UserAllInformation,
(PVOID *)&UserAll );
if ( ! NT_SUCCESS( Status ) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpGetInfo: SamQueryInformationUser returns %lX\n",
Status ));
}
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
if ( (UserAll->WhichFields & RequiredFields) != RequiredFields ) {
#if DBG
NetpKdPrint(( "UserpGetInfo: WhichFields: %lX RequireFields: %lX\n",
UserAll->WhichFields,
RequiredFields ));
#endif // DBG
NetStatus = ERROR_ACCESS_DENIED;
goto Cleanup;
}
//
// check the account type to filter this account.
//
if( (SamFilter != 0) &&
((UserAll->UserAccountControl & SamFilter) == 0)) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpGetInfo: %wZ is skipped \n", &UserName ));
}
NetStatus = NERR_Success ;
goto Cleanup;
}
}
//
// Level 1, 2 and 3 use the User's DACL to figure out the usriX_flags field.
//
if ((Level == 1) ||
(Level == 2) ||
(Level == 3) ||
(Level == 4) ||
(Level == 20) ||
(Level == 23) ) {
//
// Get the DACL for this user.
//
NetStatus = UserpGetDacl( UserHandle, &UserDacl, NULL );
if ( NetStatus != NERR_Success ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpGetInfo: UserpGetDacl returns %ld\n",
NetStatus ));
}
goto Cleanup;
}
}
//
// Determine the Priv and AuthFlags
//
if (Level == 1 || Level == 2 || Level == 3 || Level == 4 || Level == 11 ) {
//
//
NetStatus = UserpGetUserPriv(
BuiltinDomainHandle,
UserHandle,
UserRelativeId,
DomainId,
&Priv,
&AuthFlags );
if ( NetStatus != NERR_Success ) {
goto Cleanup;
}
}
//
// Construct the user's SID if necessary
//
if ( (Level == 4)
|| (Level == 23) ) {
NetStatus = NetpSamRidToSid(UserHandle,
UserRelativeId,
&UserSid);
if ( NetStatus != NERR_Success ) {
goto Cleanup;
}
}
//
// Determine if the account has expired
//
if ( (Level == 3)
|| (Level == 4) ) {
//
// If the password is currently expired,
// indicate so.
//
LARGE_INTEGER CurrentTime;
(VOID) NtQuerySystemTime( &CurrentTime );
if ( CurrentTime.QuadPart
>= UserAll->PasswordMustChange.QuadPart ) {
password_expired = TRUE;
} else {
password_expired = FALSE;
}
}
//
// Determine the total size of the return information.
//
Size = FixedSize;
switch (Level) {
case 0:
Size += UserName.Length + sizeof(WCHAR);
break;
case 4:
NetpAssert( NULL != UserSid );
Size += RtlLengthSid(UserSid);
/* Drop through to case 3 */
case 3:
Size += UserAll->ProfilePath.Length + sizeof(WCHAR) +
UserAll->HomeDirectoryDrive.Length + sizeof(WCHAR);
/* Drop through to case 2 */
case 2:
Size += UserAll->FullName.Length + sizeof(WCHAR) +
UserAll->UserComment.Length + sizeof(WCHAR) +
UserAll->Parameters.Length + sizeof(WCHAR) +
UserAll->WorkStations.Length + sizeof(WCHAR) +
LogonServer.Length + sizeof(WCHAR) +
UserpSizeOfLogonHours( UserAll->LogonHours.UnitsPerWeek );
/* Drop through to case 1 */
case 1:
Size += UserAll->UserName.Length + sizeof(WCHAR) +
UserAll->HomeDirectory.Length + sizeof(WCHAR) +
UserAll->AdminComment.Length + sizeof(WCHAR) +
UserAll->ScriptPath.Length + sizeof(WCHAR);
break;
case 10:
Size += UserAll->UserName.Length + sizeof(WCHAR) +
UserAll->AdminComment.Length + sizeof(WCHAR) +
UserAll->UserComment.Length + sizeof(WCHAR) +
UserAll->FullName.Length + sizeof(WCHAR);
break;
case 11:
Size += UserAll->UserName.Length + sizeof(WCHAR) +
UserAll->AdminComment.Length + sizeof(WCHAR) +
UserAll->UserComment.Length + sizeof(WCHAR) +
UserAll->FullName.Length + sizeof(WCHAR) +
UserAll->HomeDirectory.Length + sizeof(WCHAR) +
UserAll->Parameters.Length + sizeof(WCHAR) +
UserAll->WorkStations.Length + sizeof(WCHAR) +
LogonServer.Length + sizeof(WCHAR) +
UserpSizeOfLogonHours( UserAll->LogonHours.UnitsPerWeek );
break;
case 23:
NetpAssert( NULL != UserSid );
Size += RtlLengthSid(UserSid);
/* Drop through to case 20 */
case 20:
Size += UserAll->UserName.Length + sizeof(WCHAR) +
UserAll->FullName.Length + sizeof(WCHAR) +
UserAll->AdminComment.Length + sizeof(WCHAR);
break;
default:
NetStatus = ERROR_INVALID_LEVEL;
goto Cleanup;
}
//
// Ensure there is buffer space for this information.
//
Size = ROUND_UP_COUNT( Size, ALIGN_DWORD );
NetStatus = NetpAllocateEnumBuffer(
BufferDescriptor,
IsGet,
PrefMaxLen,
Size,
UserpRelocationRoutine,
Level );
if (NetStatus != NERR_Success) {
//
// NetpAllocateEnumBuffer returns ERROR_MORE_DATA if this
// entry doesn't fit into the buffer.
//
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpGetInfo: NetpAllocateEnumBuffer returns %ld\n",
NetStatus ));
}
goto Cleanup;
}
//
// Define macros to make copying bytes and zero terminated strings less
// repetitive.
//
#define COPY_BYTES( _type, _fieldname, _inptr, _length, _align ) \
if ( !NetpCopyDataToBuffer( \
(_inptr), \
(_length), \
BufferDescriptor->FixedDataEnd, \
&BufferDescriptor->EndOfVariableData, \
(LPBYTE*)&((_type)NewStruct)->_fieldname, \
_align ) ){ \
\
NetStatus = NERR_InternalError; \
IF_DEBUG( UAS_DEBUG_USER ) { \
NetpKdPrint(( "UserpGetInfo: NetpCopyData returns %ld\n", \
NetStatus )); \
} \
goto Cleanup; \
}
#define COPY_STRING( _type, _fieldname, _string ) \
if ( !NetpCopyStringToBuffer( \
(_string).Buffer, \
(_string).Length/sizeof(WCHAR), \
BufferDescriptor->FixedDataEnd, \
(LPWSTR *)&BufferDescriptor->EndOfVariableData, \
&((_type)NewStruct)->_fieldname) ) { \
\
NetStatus = NERR_InternalError; \
IF_DEBUG( UAS_DEBUG_USER ) { \
NetpKdPrint(( "UserpGetInfo: NetpCopyString returns %ld\n", \
NetStatus )); \
} \
goto Cleanup; \
}
//
// Place this entry into the return buffer.
//
// Fill in the information. The array of fixed entries is
// placed at the beginning of the allocated buffer. The strings
// pointed to by these fixed entries are allocated starting at
// the end of the allocate buffer.
//
NewStruct = BufferDescriptor->FixedDataEnd;
BufferDescriptor->FixedDataEnd += FixedSize;
switch ( Level ) {
case 4:
{
//
// USER_INFO_2, below, is a subset of USER_INFO_4, so fill in our
// structures here and then fall through
//
PUSER_INFO_4 usri4 = (PUSER_INFO_4) NewStruct;
NetpAssert( NULL != UserSid );
COPY_BYTES( PUSER_INFO_4,
usri4_user_sid,
UserSid,
RtlLengthSid(UserSid),
ALIGN_DWORD );
usri4->usri4_primary_group_id = UserAll->PrimaryGroupId;
COPY_STRING( PUSER_INFO_4, usri4_profile, UserAll->ProfilePath );
COPY_STRING( PUSER_INFO_4,
usri4_home_dir_drive,
UserAll->HomeDirectoryDrive );
NetpAssert( (password_expired == TRUE)
|| (password_expired == FALSE));
usri4->usri4_password_expired = password_expired;
//
// Fall through the level 3
//
}
case 3:
{
//
// since _USER_INFO_2 structure is subset of _USER_INFO_3,
// full-up the _USER_INFO_3 only fields first and then fall
// through for the common fields.
//
if ( Level == 3 ) {
PUSER_INFO_3 usri3 = (PUSER_INFO_3) NewStruct;
NetpAssert( UserRelativeId == UserAll->UserId );
usri3->usri3_user_id = RidToReturn;
usri3->usri3_primary_group_id = UserAll->PrimaryGroupId;
COPY_STRING( PUSER_INFO_3, usri3_profile, UserAll->ProfilePath );
COPY_STRING( PUSER_INFO_3,
usri3_home_dir_drive,
UserAll->HomeDirectoryDrive );
NetpAssert( (password_expired == TRUE)
|| (password_expired == FALSE));
usri3->usri3_password_expired = password_expired;
}
}
//
// FALL THROUGH FOR OTHER _USER_INFO_3 FIELDS
//
case 2:
{
PUSER_INFO_2 usri2 = (PUSER_INFO_2) NewStruct;
usri2->usri2_auth_flags = AuthFlags;
COPY_STRING( PUSER_INFO_2,
usri2_full_name,
UserAll->FullName );
COPY_STRING( PUSER_INFO_2,
usri2_usr_comment,
UserAll->UserComment);
COPY_STRING( PUSER_INFO_2,
usri2_parms,
UserAll->Parameters );
COPY_STRING( PUSER_INFO_2,
usri2_workstations,
UserAll->WorkStations);
if ( !RtlTimeToSecondsSince1970( &UserAll->LastLogon,
&usri2->usri2_last_logon) ) {
usri2->usri2_last_logon = 0;
}
if ( !RtlTimeToSecondsSince1970( &UserAll->LastLogoff,
&usri2->usri2_last_logoff) ) {
usri2->usri2_last_logoff = 0;
}
if ( !RtlTimeToSecondsSince1970( &UserAll->AccountExpires,
&usri2->usri2_acct_expires) ) {
usri2->usri2_acct_expires = TIMEQ_FOREVER;
}
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpGetInfo: Account Expries %lx %lx %lx\n",
UserAll->AccountExpires.HighPart,
UserAll->AccountExpires.LowPart,
usri2->usri2_acct_expires));
}
usri2->usri2_max_storage = USER_MAXSTORAGE_UNLIMITED;
usri2->usri2_units_per_week = UserAll->LogonHours.UnitsPerWeek;
IF_DEBUG( UAS_DEBUG_USER ) {
DWORD k;
NetpDbgDisplayDword( "UserpGetInfo: units_per_week",
usri2->usri2_units_per_week );
NetpKdPrint(( "UserpGetInfo: LogonHours %lx\n",
UserAll->LogonHours.LogonHours));
for ( k=0;
k<UserpSizeOfLogonHours(
UserAll->LogonHours.UnitsPerWeek);
k++ ) {
NetpKdPrint(( "%d ",
UserAll->LogonHours.LogonHours[k] ));
}
NetpKdPrint(( "\n" ));
}
COPY_BYTES( PUSER_INFO_2,
usri2_logon_hours,
UserAll->LogonHours.LogonHours,
UserpSizeOfLogonHours(
UserAll->LogonHours.UnitsPerWeek ),
sizeof(UCHAR) );
BufferDescriptor->EndOfVariableData =
ROUND_DOWN_POINTER( BufferDescriptor->EndOfVariableData,
ALIGN_WCHAR );
usri2->usri2_bad_pw_count = UserAll->BadPasswordCount;
usri2->usri2_num_logons = UserAll->LogonCount;
COPY_STRING( PUSER_INFO_2,
usri2_logon_server,
LogonServer );
usri2->usri2_country_code = UserAll->CountryCode;
usri2->usri2_code_page = UserAll->CodePage;
/* Drop through to case 1 */
}
case 1:
{
PUSER_INFO_1 usri1 = (PUSER_INFO_1) NewStruct;
COPY_STRING( PUSER_INFO_1, usri1_name, UserAll->UserName );
usri1->usri1_password = NULL;
usri1->usri1_password_age =
NetpGetElapsedSeconds( &UserAll->PasswordLastSet );
usri1->usri1_priv = Priv;
COPY_STRING( PUSER_INFO_1, usri1_home_dir, UserAll->HomeDirectory );
COPY_STRING( PUSER_INFO_1, usri1_comment, UserAll->AdminComment);
usri1->usri1_flags = NetpAccountControlToFlags(
UserAll->UserAccountControl,
UserDacl );
COPY_STRING( PUSER_INFO_1, usri1_script_path, UserAll->ScriptPath);
break;
}
case 0:
COPY_STRING( PUSER_INFO_0, usri0_name, UserName );
break;
case 10:
COPY_STRING( PUSER_INFO_10, usri10_name, UserAll->UserName );
COPY_STRING( PUSER_INFO_10, usri10_comment, UserAll->AdminComment );
COPY_STRING( PUSER_INFO_10, usri10_usr_comment, UserAll->UserComment );
COPY_STRING( PUSER_INFO_10, usri10_full_name, UserAll->FullName );
break;
case 11:
{
PUSER_INFO_11 usri11 = (PUSER_INFO_11) NewStruct;
COPY_STRING( PUSER_INFO_11, usri11_name, UserAll->UserName );
COPY_STRING( PUSER_INFO_11, usri11_comment, UserAll->AdminComment );
COPY_STRING(PUSER_INFO_11, usri11_usr_comment,UserAll->UserComment);
COPY_STRING( PUSER_INFO_11, usri11_full_name, UserAll->FullName );
usri11->usri11_priv = Priv;
usri11->usri11_auth_flags = AuthFlags;
usri11->usri11_password_age =
NetpGetElapsedSeconds( &UserAll->PasswordLastSet );
COPY_STRING(PUSER_INFO_11, usri11_home_dir, UserAll->HomeDirectory);
COPY_STRING( PUSER_INFO_11, usri11_parms, UserAll->Parameters );
if ( !RtlTimeToSecondsSince1970( &UserAll->LastLogon,
&usri11->usri11_last_logon) ) {
usri11->usri11_last_logon = 0;
}
if ( !RtlTimeToSecondsSince1970( &UserAll->LastLogoff,
&usri11->usri11_last_logoff) ) {
usri11->usri11_last_logoff = 0;
}
usri11->usri11_bad_pw_count = UserAll->BadPasswordCount;
usri11->usri11_num_logons = UserAll->LogonCount;
COPY_STRING( PUSER_INFO_11, usri11_logon_server, LogonServer );
usri11->usri11_country_code = UserAll->CountryCode;
COPY_STRING( PUSER_INFO_11,
usri11_workstations,
UserAll->WorkStations );
usri11->usri11_max_storage = USER_MAXSTORAGE_UNLIMITED;
usri11->usri11_units_per_week = UserAll->LogonHours.UnitsPerWeek;
COPY_BYTES( PUSER_INFO_11,
usri11_logon_hours,
UserAll->LogonHours.LogonHours,
UserpSizeOfLogonHours(
UserAll->LogonHours.UnitsPerWeek ),
sizeof(UCHAR) );
BufferDescriptor->EndOfVariableData =
ROUND_DOWN_POINTER( BufferDescriptor->EndOfVariableData,
ALIGN_WCHAR );
usri11->usri11_code_page = UserAll->CodePage;
break;
}
case 23:
{
//
// Since USER_INFO_23 has the same fields as USER_INFO_20 with the
// exception of the RID and SID fields, copy in the SID here and
// then fall through for the rest of the fields
//
PUSER_INFO_23 usri23 = (PUSER_INFO_23) NewStruct;
NetpAssert( NULL != UserSid );
COPY_BYTES( PUSER_INFO_23,
usri23_user_sid,
UserSid,
RtlLengthSid(UserSid),
ALIGN_DWORD );
//
// Fall through the level 20
//
}
case 20:
{
PUSER_INFO_20 usri20 = (PUSER_INFO_20) NewStruct;
COPY_STRING( PUSER_INFO_20, usri20_name, UserAll->UserName );
COPY_STRING( PUSER_INFO_20, usri20_full_name, UserAll->FullName );
COPY_STRING( PUSER_INFO_20, usri20_comment, UserAll->AdminComment );
if ( Level == 20 ) {
usri20->usri20_user_id = RidToReturn;
}
usri20->usri20_flags = NetpAccountControlToFlags(
UserAll->UserAccountControl,
UserDacl );
break;
}
default:
NetStatus = ERROR_INVALID_LEVEL;
goto Cleanup;
}
NetStatus = NERR_Success ;
//
// Clean up.
//
Cleanup:
//
// Free Sam information buffers
//
if ( UserAll != NULL ) {
Status = SamFreeMemory( UserAll );
NetpAssert( NT_SUCCESS(Status) );
}
if ( UserHandle != NULL ) {
(VOID) SamCloseHandle( UserHandle );
}
if ( UserDacl != NULL ) {
NetpMemoryFree( UserDacl );
}
if ( UserSid ) {
NetpMemoryFree( UserSid );
}
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpGetInfo: returning %ld\n", NetStatus ));
}
return NetStatus;
} // UserpGetInfo
//
// Each field in the SAM USER_ALL_INFORMATION structure (and each pseudo field)
// is described here.
struct _SAM_FIELD_DESCRIPTION {
//
// Non-zero to indicate which field in the SAM USER_ALL_INFORMATION
// structure is being set.
DWORD WhichField;
//
// Define the value to return in ParmError if this field is bad.
//
DWORD UasParmNum;
//
// Describe the byte offset of the field in the SAM USER_ALL_INFORMATION
// structure.
//
DWORD SamOffset;
//
// The DesiredAccess mask includes both the access to read and the
// access to write the appropriate field in the USER_ALL_INFORMATION
//
ACCESS_MASK DesiredAccess;
} SamFieldDescription[] =
{
#define SAM_UserNameField 0
{ USER_ALL_USERNAME, USER_NAME_PARMNUM,
offsetof(USER_ALL_INFORMATION, UserName),
USER_WRITE_ACCOUNT
},
#define SAM_FullNameField 1
{ USER_ALL_FULLNAME, USER_FULL_NAME_PARMNUM,
offsetof(USER_ALL_INFORMATION, FullName),
USER_WRITE_ACCOUNT
},
#define SAM_PrimaryGroupIdField 2
{ USER_ALL_PRIMARYGROUPID, USER_PRIMARY_GROUP_PARMNUM,
offsetof(USER_ALL_INFORMATION, PrimaryGroupId),
USER_LIST_GROUPS | READ_CONTROL | WRITE_DAC |
USER_WRITE_ACCOUNT
},
#define SAM_AdminCommentField 3
{ USER_ALL_ADMINCOMMENT, USER_COMMENT_PARMNUM,
offsetof(USER_ALL_INFORMATION, AdminComment),
USER_WRITE_ACCOUNT
},
#define SAM_UserCommentField 4
{ USER_ALL_USERCOMMENT, USER_USR_COMMENT_PARMNUM,
offsetof(USER_ALL_INFORMATION, UserComment),
USER_WRITE_PREFERENCES
},
#define SAM_HomeDirectoryField 5
{ USER_ALL_HOMEDIRECTORY, USER_HOME_DIR_PARMNUM,
offsetof(USER_ALL_INFORMATION, HomeDirectory),
USER_WRITE_ACCOUNT
},
#define SAM_HomeDirectoryDriveField 6
{ USER_ALL_HOMEDIRECTORYDRIVE, USER_HOME_DIR_DRIVE_PARMNUM,
offsetof(USER_ALL_INFORMATION, HomeDirectoryDrive),
USER_WRITE_ACCOUNT
},
#define SAM_ScriptPathField 7
{ USER_ALL_SCRIPTPATH, USER_SCRIPT_PATH_PARMNUM,
offsetof(USER_ALL_INFORMATION, ScriptPath),
USER_WRITE_ACCOUNT
},
#define SAM_ProfilePathField 8
{ USER_ALL_PROFILEPATH, USER_PROFILE_PARMNUM,
offsetof(USER_ALL_INFORMATION, ProfilePath),
USER_WRITE_ACCOUNT
},
#define SAM_WorkstationsField 9
{ USER_ALL_WORKSTATIONS, USER_WORKSTATIONS_PARMNUM,
offsetof(USER_ALL_INFORMATION, WorkStations),
USER_WRITE_ACCOUNT
},
#define SAM_LogonHoursField 10
{ USER_ALL_LOGONHOURS, USER_LOGON_HOURS_PARMNUM,
offsetof(USER_ALL_INFORMATION, LogonHours.LogonHours),
USER_WRITE_ACCOUNT
},
#define SAM_UnitsPerWeekField 11
{ USER_ALL_LOGONHOURS, USER_UNITS_PER_WEEK_PARMNUM,
offsetof(USER_ALL_INFORMATION, LogonHours.UnitsPerWeek),
USER_WRITE_ACCOUNT
},
#define SAM_AccountExpiresField 12
{ USER_ALL_ACCOUNTEXPIRES, USER_ACCT_EXPIRES_PARMNUM,
offsetof(USER_ALL_INFORMATION, AccountExpires),
USER_WRITE_ACCOUNT
},
#define SAM_UserAccountControlField 13
{ USER_ALL_USERACCOUNTCONTROL, USER_FLAGS_PARMNUM,
offsetof(USER_ALL_INFORMATION, UserAccountControl),
USER_WRITE_ACCOUNT | USER_READ_ACCOUNT | READ_CONTROL | WRITE_DAC
},
#define SAM_ParametersField 14
{ USER_ALL_PARAMETERS, USER_PARMS_PARMNUM,
offsetof(USER_ALL_INFORMATION, Parameters),
USER_WRITE_ACCOUNT
},
#define SAM_CountryCodeField 15
{ USER_ALL_COUNTRYCODE, USER_COUNTRY_CODE_PARMNUM,
offsetof(USER_ALL_INFORMATION, CountryCode),
USER_WRITE_PREFERENCES
},
#define SAM_CodePageField 16
{ USER_ALL_CODEPAGE, USER_CODE_PAGE_PARMNUM,
offsetof(USER_ALL_INFORMATION, CodePage),
USER_WRITE_PREFERENCES
},
#define SAM_ClearTextPasswordField 17
{ USER_ALL_NTPASSWORDPRESENT, USER_PASSWORD_PARMNUM,
offsetof(USER_ALL_INFORMATION, NtPassword),
USER_FORCE_PASSWORD_CHANGE
},
#define SAM_PasswordExpiredField 18
{ USER_ALL_PASSWORDEXPIRED, PARM_ERROR_UNKNOWN,
offsetof(USER_ALL_INFORMATION, PasswordExpired),
USER_FORCE_PASSWORD_CHANGE
},
#define SAM_OwfPasswordField 19
{ USER_ALL_LMPASSWORDPRESENT | USER_ALL_OWFPASSWORD,
USER_PASSWORD_PARMNUM,
offsetof(USER_ALL_INFORMATION, LmPassword),
USER_FORCE_PASSWORD_CHANGE
},
//
// The following levels are pseudo levels which merely define the
// access required to set a particuler UAS field.
#define SAM_AuthFlagsField 20
{ 0, PARM_ERROR_UNKNOWN,
0,
USER_LIST_GROUPS
},
#define SAM_MaxStorageField 21
{ 0, USER_MAX_STORAGE_PARMNUM,
0,
USER_READ_GENERAL
},
};
//
// Relate the NetUser API fields to the SAM API fields.
//
// This table contains as much information as possible to describe the
// relationship between fields in the NetUser API and the SAM API.
//
struct _UAS_SAM_TABLE {
//
// Describe the field types for UAS and SAM.
//
enum {
UT_STRING, // UAS is LPWSTR. SAM is UNICODE_STRING.
UT_BOOLEAN, // UAS is DWORD. SAM is BOOLEAN.
UT_USHORT, // UAS is DWORD. SAM is USHORT.
UT_ULONG, // UAS is DWORD. SAM is ULONG.
UT_TIME, // UAS is seconds since 1970. SAM is LARGE_INTEGER.
UT_PRIV, // Special case
UT_ACCOUNT_CONTROL, // Special case
UT_AUTH_FLAGS, // Special case
UT_MAX_STORAGE, // Special case
UT_OWF_PASSWORD, // Special case
UT_LOGON_HOURS, // Special case
UT_UNITS_PER_WEEK, // Special case
UT_CREATE_FULLNAME // Special case
} FieldType;
//
// The NetUser API detail level this field is in.
//
DWORD UasLevel;
//
// Index to the structure describing the Sam Field being changed.
//
DWORD SamField;
//
// Describe the byte offset of the field in the appropriate UAS
// and SAM structures.
//
DWORD UasOffset;
} UserpUasSamTable[] =
{
// Rename an account at info level 0 only.
{ UT_STRING, 0, SAM_UserNameField,
offsetof(USER_INFO_1, usri1_name) },
{ UT_STRING, 1, SAM_ClearTextPasswordField,
offsetof(USER_INFO_1, usri1_password) },
{ UT_STRING, 2, SAM_ClearTextPasswordField,
offsetof(USER_INFO_2, usri2_password) },
{ UT_STRING, 3, SAM_ClearTextPasswordField,
offsetof(USER_INFO_3, usri3_password) },
{ UT_STRING, 4, SAM_ClearTextPasswordField,
offsetof(USER_INFO_4, usri4_password) },
{ UT_STRING, 1003, SAM_ClearTextPasswordField,
offsetof(USER_INFO_1003, usri1003_password) },
{ UT_OWF_PASSWORD, 21, SAM_OwfPasswordField,
offsetof(USER_INFO_21, usri21_password[0]) },
{ UT_OWF_PASSWORD, 22, SAM_OwfPasswordField,
offsetof(USER_INFO_22, usri22_password[0]) },
{ UT_PRIV, 1, SAM_AuthFlagsField,
offsetof(USER_INFO_1, usri1_priv) },
{ UT_PRIV, 2, SAM_AuthFlagsField,
offsetof(USER_INFO_2, usri2_priv) },
{ UT_PRIV, 22, SAM_AuthFlagsField,
offsetof(USER_INFO_22, usri22_priv) },
#ifdef notdef
//
// usri3_priv is totally ignored for info level three. The field is
// supplied for compatibility with LM 2.x only and LM 2.x never uses
// info level 3.
//
{ UT_PRIV, 3, SAM_AuthFlagsField,
offsetof(USER_INFO_3, usri3_priv) },
#endif // notdef
{ UT_PRIV, 1005, SAM_AuthFlagsField,
offsetof(USER_INFO_1005, usri1005_priv) },
{ UT_STRING, 1, SAM_HomeDirectoryField,
offsetof(USER_INFO_1, usri1_home_dir) },
{ UT_STRING, 2, SAM_HomeDirectoryField,
offsetof(USER_INFO_2, usri2_home_dir) },
{ UT_STRING, 22, SAM_HomeDirectoryField,
offsetof(USER_INFO_22, usri22_home_dir) },
{ UT_STRING, 3, SAM_HomeDirectoryField,
offsetof(USER_INFO_3, usri3_home_dir) },
{ UT_STRING, 4, SAM_HomeDirectoryField,
offsetof(USER_INFO_4, usri4_home_dir) },
{ UT_STRING, 1006, SAM_HomeDirectoryField,
offsetof(USER_INFO_1006, usri1006_home_dir) },
{ UT_STRING, 1, SAM_AdminCommentField,
offsetof(USER_INFO_1, usri1_comment) },
{ UT_STRING, 2, SAM_AdminCommentField,
offsetof(USER_INFO_2, usri2_comment) },
{ UT_STRING, 22, SAM_AdminCommentField,
offsetof(USER_INFO_22, usri22_comment) },
{ UT_STRING, 3, SAM_AdminCommentField,
offsetof(USER_INFO_3, usri3_comment) },
{ UT_STRING, 4, SAM_AdminCommentField,
offsetof(USER_INFO_4, usri4_comment) },
{ UT_STRING, 1007, SAM_AdminCommentField,
offsetof(USER_INFO_1007, usri1007_comment) },
{ UT_ACCOUNT_CONTROL, 1, SAM_UserAccountControlField,
offsetof(USER_INFO_1, usri1_flags) },
{ UT_ACCOUNT_CONTROL, 2, SAM_UserAccountControlField,
offsetof(USER_INFO_2, usri2_flags) },
{ UT_ACCOUNT_CONTROL, 22, SAM_UserAccountControlField,
offsetof(USER_INFO_22, usri22_flags) },
{ UT_ACCOUNT_CONTROL, 3, SAM_UserAccountControlField,
offsetof(USER_INFO_3, usri3_flags) },
{ UT_ACCOUNT_CONTROL, 4, SAM_UserAccountControlField,
offsetof(USER_INFO_4, usri4_flags) },
{ UT_ACCOUNT_CONTROL, 1008, SAM_UserAccountControlField,
offsetof(USER_INFO_1008, usri1008_flags) },
{ UT_STRING, 1, SAM_ScriptPathField,
offsetof(USER_INFO_1, usri1_script_path) },
{ UT_STRING, 2, SAM_ScriptPathField,
offsetof(USER_INFO_2, usri2_script_path) },
{ UT_STRING, 22, SAM_ScriptPathField,
offsetof(USER_INFO_22, usri22_script_path) },
{ UT_STRING, 3, SAM_ScriptPathField,
offsetof(USER_INFO_3, usri3_script_path) },
{ UT_STRING, 4, SAM_ScriptPathField,
offsetof(USER_INFO_4, usri4_script_path) },
{ UT_STRING, 1009, SAM_ScriptPathField,
offsetof(USER_INFO_1009, usri1009_script_path) },
{ UT_AUTH_FLAGS, 2, SAM_AuthFlagsField,
offsetof(USER_INFO_2, usri2_auth_flags) },
{ UT_AUTH_FLAGS, 22, SAM_AuthFlagsField,
offsetof(USER_INFO_22, usri22_auth_flags) },
#ifdef notdef
//
// usri3_auth_flags is totally ignored for info level three. The field is
// supplied for compatibility with LM 2.x only and LM 2.x never uses
// info level 3.
//
{ UT_AUTH_FLAGS, 3, SAM_AuthFlagsField,
offsetof(USER_INFO_3, usri3_auth_flags) },
{ UT_AUTH_FLAGS, 4, SAM_AuthFlagsField,
offsetof(USER_INFO_4, usri4_auth_flags) },
#endif // notdef
{ UT_AUTH_FLAGS, 1010, SAM_AuthFlagsField,
offsetof(USER_INFO_1010, usri1010_auth_flags) },
{ UT_CREATE_FULLNAME, 1, SAM_FullNameField,
offsetof(USER_INFO_1, usri1_name) },
{ UT_STRING, 2, SAM_FullNameField,
offsetof(USER_INFO_2, usri2_full_name) },
{ UT_STRING, 22, SAM_FullNameField,
offsetof(USER_INFO_22, usri22_full_name) },
{ UT_STRING, 3, SAM_FullNameField,
offsetof(USER_INFO_3, usri3_full_name) },
{ UT_STRING, 4, SAM_FullNameField,
offsetof(USER_INFO_4, usri4_full_name) },
{ UT_STRING, 1011, SAM_FullNameField,
offsetof(USER_INFO_1011, usri1011_full_name) },
{ UT_STRING, 2, SAM_UserCommentField,
offsetof(USER_INFO_2, usri2_usr_comment) },
{ UT_STRING, 22, SAM_UserCommentField,
offsetof(USER_INFO_22, usri22_usr_comment) },
{ UT_STRING, 3, SAM_UserCommentField,
offsetof(USER_INFO_3, usri3_usr_comment) },
{ UT_STRING, 4, SAM_UserCommentField,
offsetof(USER_INFO_4, usri4_usr_comment) },
{ UT_STRING, 1012, SAM_UserCommentField,
offsetof(USER_INFO_1012, usri1012_usr_comment) },
{ UT_STRING, 2, SAM_ParametersField,
offsetof(USER_INFO_2, usri2_parms) },
{ UT_STRING, 22, SAM_ParametersField,
offsetof(USER_INFO_22, usri22_parms) },
{ UT_STRING, 3, SAM_ParametersField,
offsetof(USER_INFO_3, usri3_parms) },
{ UT_STRING, 4, SAM_ParametersField,
offsetof(USER_INFO_4, usri4_parms) },
{ UT_STRING, 1013, SAM_ParametersField,
offsetof(USER_INFO_1013, usri1013_parms) },
{ UT_STRING, 2, SAM_WorkstationsField,
offsetof(USER_INFO_2, usri2_workstations) },
{ UT_STRING, 22, SAM_WorkstationsField,
offsetof(USER_INFO_22, usri22_workstations) },
{ UT_STRING, 3, SAM_WorkstationsField,
offsetof(USER_INFO_3, usri3_workstations) },
{ UT_STRING, 4, SAM_WorkstationsField,
offsetof(USER_INFO_4, usri4_workstations) },
{ UT_STRING, 1014, SAM_WorkstationsField,
offsetof(USER_INFO_1014, usri1014_workstations) },
{ UT_TIME, 2, SAM_AccountExpiresField,
offsetof(USER_INFO_2, usri2_acct_expires) },
{ UT_TIME, 22, SAM_AccountExpiresField,
offsetof(USER_INFO_22, usri22_acct_expires) },
{ UT_TIME, 3, SAM_AccountExpiresField,
offsetof(USER_INFO_3, usri3_acct_expires) },
{ UT_TIME, 4, SAM_AccountExpiresField,
offsetof(USER_INFO_4, usri4_acct_expires) },
{ UT_TIME, 1017, SAM_AccountExpiresField,
offsetof(USER_INFO_1017, usri1017_acct_expires) },
#ifdef notdef // lm 2.1 gets this wrong when adding BDC accounts
{ UT_MAX_STORAGE, 2, SAM_MaxStorageField,
offsetof(USER_INFO_2, usri2_max_storage) },
{ UT_MAX_STORAGE, 22, SAM_MaxStorageField,
offsetof(USER_INFO_22, usri22_max_storage) },
{ UT_MAX_STORAGE, 3, SAM_MaxStorageField,
offsetof(USER_INFO_3, usri3_max_storage) },
{ UT_MAX_STORAGE, 4, SAM_MaxStorageField,
offsetof(USER_INFO_4, usri4_max_storage) },
#endif // notdef
{ UT_MAX_STORAGE, 1018, SAM_MaxStorageField,
offsetof(USER_INFO_1018, usri1018_max_storage) },
{ UT_UNITS_PER_WEEK, 2, SAM_UnitsPerWeekField,
offsetof(USER_INFO_2, usri2_units_per_week) },
{ UT_UNITS_PER_WEEK, 22, SAM_UnitsPerWeekField,
offsetof(USER_INFO_22, usri22_units_per_week) },
{ UT_UNITS_PER_WEEK, 3, SAM_UnitsPerWeekField,
offsetof(USER_INFO_3, usri3_units_per_week) },
{ UT_UNITS_PER_WEEK, 4, SAM_UnitsPerWeekField,
offsetof(USER_INFO_4, usri4_units_per_week) },
{ UT_UNITS_PER_WEEK, 1020, SAM_UnitsPerWeekField,
offsetof(USER_INFO_1020, usri1020_units_per_week) },
{ UT_LOGON_HOURS, 2, SAM_LogonHoursField,
offsetof(USER_INFO_2, usri2_logon_hours) },
{ UT_LOGON_HOURS, 22, SAM_LogonHoursField,
offsetof(USER_INFO_22, usri22_logon_hours) },
{ UT_LOGON_HOURS, 3, SAM_LogonHoursField,
offsetof(USER_INFO_3, usri3_logon_hours) },
{ UT_LOGON_HOURS, 4, SAM_LogonHoursField,
offsetof(USER_INFO_4, usri4_logon_hours) },
{ UT_LOGON_HOURS, 1020, SAM_LogonHoursField,
offsetof(USER_INFO_1020, usri1020_logon_hours) },
{ UT_USHORT, 2, SAM_CountryCodeField,
offsetof(USER_INFO_2, usri2_country_code) },
{ UT_USHORT, 22, SAM_CountryCodeField,
offsetof(USER_INFO_22, usri22_country_code) },
{ UT_USHORT, 3, SAM_CountryCodeField,
offsetof(USER_INFO_3, usri3_country_code) },
{ UT_USHORT, 4, SAM_CountryCodeField,
offsetof(USER_INFO_4, usri4_country_code) },
{ UT_USHORT, 1024, SAM_CountryCodeField,
offsetof(USER_INFO_1024, usri1024_country_code) },
{ UT_USHORT, 2, SAM_CodePageField,
offsetof(USER_INFO_2, usri2_code_page) },
{ UT_USHORT, 22, SAM_CodePageField,
offsetof(USER_INFO_22, usri22_code_page) },
{ UT_USHORT, 3, SAM_CodePageField,
offsetof(USER_INFO_3, usri3_code_page) },
{ UT_USHORT, 4, SAM_CodePageField,
offsetof(USER_INFO_4, usri4_code_page) },
{ UT_USHORT, 1025, SAM_CodePageField,
offsetof(USER_INFO_1025, usri1025_code_page) },
{ UT_ULONG, 3, SAM_PrimaryGroupIdField,
offsetof(USER_INFO_3, usri3_primary_group_id) },
{ UT_ULONG, 4, SAM_PrimaryGroupIdField,
offsetof(USER_INFO_4, usri4_primary_group_id) },
{ UT_ULONG, 1051, SAM_PrimaryGroupIdField,
offsetof(USER_INFO_1051, usri1051_primary_group_id) },
{ UT_STRING, 3, SAM_ProfilePathField,
offsetof(USER_INFO_3, usri3_profile) },
{ UT_STRING, 4, SAM_ProfilePathField,
offsetof(USER_INFO_4, usri4_profile) },
{ UT_STRING, 1052, SAM_ProfilePathField,
offsetof(USER_INFO_1052, usri1052_profile) },
{ UT_STRING, 3, SAM_HomeDirectoryDriveField,
offsetof(USER_INFO_3, usri3_home_dir_drive) },
{ UT_STRING, 4, SAM_HomeDirectoryDriveField,
offsetof(USER_INFO_4, usri4_home_dir_drive) },
{ UT_STRING, 1053, SAM_HomeDirectoryDriveField,
offsetof(USER_INFO_1053, usri1053_home_dir_drive) },
{ UT_BOOLEAN, 3, SAM_PasswordExpiredField,
offsetof(USER_INFO_3, usri3_password_expired) },
{ UT_BOOLEAN, 4, SAM_PasswordExpiredField,
offsetof(USER_INFO_4, usri4_password_expired) },
};
NET_API_STATUS
UserpSetInfo(
IN SAM_HANDLE DomainHandle,
IN PSID DomainId,
IN SAM_HANDLE UserHandle OPTIONAL,
IN SAM_HANDLE BuiltinDomainHandle OPTIONAL,
IN ULONG UserRelativeId,
IN LPCWSTR UserName,
IN DWORD Level,
IN LPBYTE Buffer,
IN ULONG WhichFieldsMask,
OUT LPDWORD ParmError OPTIONAL // Name required by NetpSetParmError
)
/*++
Routine Description:
Set the parameters on a user account in the user accounts database.
Arguments:
DomainHandle - Domain Handle for the domain.
PSID DomainId - Domain Sid for DomainHandle
UserHandle - User Handle of the already open group. If one is not
specified, one will be openned then closed. If one is specified,
it must be open with adequate access.
BuiltinDomainHandle - Domain Handle for the builtin domain. Need only be
specified for info level 1, 2, 3, 22, 1005 and 1010. Need not
be specified when a user is created.
UserRelativeId - Relative Id of the user.
UserName - Name of the user to set.
Level - Level of information provided.
Buffer - A pointer to the buffer containing the user information
structure.
ParmError - Optional pointer to a DWORD to return the index of the
first parameter in error when ERROR_INVALID_PARAMETER is returned.
If NULL, the parameter is not returned on error.
Return Value:
Error code for the operation.
NOTE: LogonServer field that is passed in UAS set structure is never
used or validated. It is simply ignored.
--*/
{
NET_API_STATUS NetStatus;
NTSTATUS Status;
SAM_HANDLE LocalUserHandle = NULL;
ACCESS_MASK DesiredAccess;
DWORD UasSamIndex;
USER_ALL_INFORMATION UserAll;
//
// Value of Fields from UAS structure (used for validation)
//
DWORD UasUserFlags;
DWORD NewPriv;
DWORD NewAuthFlags;
BOOL ValidatePriv = FALSE;
BOOL ValidateAuthFlags = FALSE;
USHORT UasUnitsPerWeek;
//
// Variables for changing the DACL on the user.
//
PACL OldUserDacl = NULL;
PACL NewUserDacl = NULL;
BOOL UserDaclChanged = FALSE;
BOOL HandleUserDacl = FALSE;
USHORT AceIndex;
PSID UserSid = NULL;
//
// Define several macros for accessing the various fields of the UAS
// structure. Each macro takes an index into the UserpUasSamTable
// array and returns the value.
//
#define GET_UAS_STRING_POINTER( _i ) \
(*((LPWSTR *)(Buffer + UserpUasSamTable[_i].UasOffset)))
#define GET_UAS_DWORD( _i ) \
(*((DWORD *)(Buffer + UserpUasSamTable[_i].UasOffset)))
#define GET_UAS_FIELD_ADDRESS( _i ) \
(Buffer + UserpUasSamTable[_i].UasOffset)
//
// Define a macro which returns a pointer the appropriate
// SamFieldDescription structure given an index into the UserpUasSamTable.
//
#define SAM_FIELD( _i ) \
SamFieldDescription[ UserpUasSamTable[_i].SamField ]
//
// Initialize
//
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: entered \n" ));
}
NetpSetParmError( PARM_ERROR_NONE );
RtlZeroMemory( &UserAll, sizeof(UserAll) );
//
// Go through the list of valid info levels determining if the info level
// is valid and computing the desired access to the user and copying the
// UAS information into the SAM structure.
//
DesiredAccess = 0;
for ( UasSamIndex=0 ;
UasSamIndex<sizeof(UserpUasSamTable)/sizeof(UserpUasSamTable[0]);
UasSamIndex++ ){
LPBYTE SamField;
//
// If this field isn't one we're changing, just skip to the next one
//
if ( Level != UserpUasSamTable[UasSamIndex].UasLevel ) {
continue;
}
//
// Set up a pointer to the appropriate field in SAM's structure.
//
if ( SAM_FIELD(UasSamIndex).WhichField != 0 ) {
SamField = ((LPBYTE)(&UserAll)) + SAM_FIELD(UasSamIndex).SamOffset;
} else {
SamField = NULL;
}
//
// Validate the UAS field based on the field type.
//
switch ( UserpUasSamTable[UasSamIndex].FieldType ) {
//
// Default the fullname of the account to be the user name when
// the user is created using level 1.
//
// Ignore this entry if not a "create" operation.
//
case UT_CREATE_FULLNAME:
if ( UserHandle == NULL ) {
continue;
}
/* DROP THROUGH to the UT_STRING case */
//
// If this is a PARMNUM_ALL and the caller passed in a
// NULL pointer to a string, he doesn't want to change the string.
//
case UT_STRING:
if ( GET_UAS_STRING_POINTER( UasSamIndex ) == NULL ) {
continue;
}
RtlInitUnicodeString(
(PUNICODE_STRING) SamField,
GET_UAS_STRING_POINTER(UasSamIndex) );
break;
//
// Just save the UnitsPerWeek until UT_LOGON_HOURS can handle
// both fields at once.
//
// Sam gets confused if we pass in one field without the other.
//
case UT_UNITS_PER_WEEK:
UasUnitsPerWeek = (USHORT) GET_UAS_DWORD(UasSamIndex);
//
// If this is a create at info level 2 (e.g., dowlevel client),
// assume the caller specified UNITS_PER_WEEK.
//
// We don't special case SetInfo at level 2 because we don't
// want to corrupt the value assuming he did a query followed
// by a set.
//
if ( Level == 2 && UserHandle != NULL ) {
UasUnitsPerWeek = UNITS_PER_WEEK;
}
if ( UasUnitsPerWeek > USHRT_MAX ) {
NetpSetParmError( SAM_FIELD(UasSamIndex).UasParmNum );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Ushort too big Index:%ld Value:%ld\n",
UasSamIndex,
UasUnitsPerWeek ));
}
goto Cleanup;
}
//
// Ignore this field completely for now.
// Let UT_LOGON_HOURS define the desired access and Whichfields.
continue;
//
// If the caller passed in a NULL pointer to the logon hours
// he doesn't want to change the logon hours.
//
case UT_LOGON_HOURS:
if ( GET_UAS_STRING_POINTER( UasSamIndex ) == NULL ) {
continue;
}
*((PUCHAR *)SamField) = (PUCHAR)GET_UAS_STRING_POINTER(UasSamIndex);
UserAll.LogonHours.UnitsPerWeek = UasUnitsPerWeek;
break;
//
// If the user is setting max storage, require him to set
// it to USER_MAXSTORAGE_UNLIMITED since SAM doesn't support
// max storage.
//
case UT_MAX_STORAGE:
if ( GET_UAS_DWORD(UasSamIndex) != USER_MAXSTORAGE_UNLIMITED ) {
NetpSetParmError( USER_MAX_STORAGE_PARMNUM );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: Max storage is invalid\n" ));
}
goto Cleanup;
}
// 'break' to make sure the user exists.
break;
//
// Handle Account control
//
// Ensure all the required bits are on and only valid bits
// are on.
//
case UT_ACCOUNT_CONTROL: {
UasUserFlags = GET_UAS_DWORD(UasSamIndex);
if ((UasUserFlags & ~UF_SETTABLE_BITS) != 0 ) {
NetpSetParmError( USER_FLAGS_PARMNUM );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Invalid account control bits (1) \n" ));
}
goto Cleanup;
}
//
// If none of the account type bit is set in the usri_flag,
// means that the caller does not want to change its account type.
// break out now, and we will set the appropriate account
// bit when we set the usri_flag.
//
if ( UasUserFlags & UF_ACCOUNT_TYPE_MASK ) {
//
// Account Types bits are exclusive, so make sure that
// precisely one Account Type bit is set.
//
if ( !JUST_ONE_BIT( UasUserFlags & UF_ACCOUNT_TYPE_MASK )) {
NetpSetParmError( USER_FLAGS_PARMNUM );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Invalid account control bits (2) \n" ));
}
goto Cleanup;
}
}
//
// If this is a 'create' operation,
// and the user has asked for the SAM defaults.
// we have no reason to change the DACL
//
if ( UserHandle != NULL &&
(UasUserFlags & UF_PASSWD_CANT_CHANGE) == 0 ) {
break;
}
//
// In all other cases, update the DACL to match the callers request.
//
HandleUserDacl = TRUE;
break;
}
//
// Copy a boolean to the SAM structure.
//
case UT_BOOLEAN:
*((PBOOLEAN)SamField) = (BOOLEAN)
(GET_UAS_DWORD(UasSamIndex)) ? TRUE : FALSE;
break;
//
// Ensure unsigned shorts are really in range and
// copy it to the SAM structure.
//
case UT_USHORT:
if ( GET_UAS_DWORD(UasSamIndex) > USHRT_MAX ) {
NetpSetParmError( SAM_FIELD(UasSamIndex).UasParmNum );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Ushort too big Index:%ld Value:%ld\n",
UasSamIndex,
GET_UAS_DWORD(UasSamIndex) ));
}
goto Cleanup;
}
*((PUSHORT)SamField) = (USHORT) GET_UAS_DWORD(UasSamIndex);
break;
//
// Copy the unsigned long to the SAM structure
//
case UT_ULONG:
*((PULONG)SamField) = (ULONG)GET_UAS_DWORD(UasSamIndex);
break;
//
// Convert time to its SAM counterpart
//
case UT_TIME:
//
// PREFIX: SamField can only be NULL due to a programming error
// by setting the UserpUasSamTable table incorrectly. This
// assert catches the problem.
//
NetpAssert(NULL != SamField);
if ( GET_UAS_DWORD(UasSamIndex) == TIMEQ_FOREVER ) {
((PLARGE_INTEGER) SamField)->LowPart = 0;
((PLARGE_INTEGER) SamField)->HighPart = 0;
} else {
RtlSecondsSince1970ToTime(
GET_UAS_DWORD(UasSamIndex),
(PLARGE_INTEGER) SamField );
}
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: Index: %ld Time %lx %lx %lx\n",
UasSamIndex,
((PLARGE_INTEGER) SamField)->HighPart,
((PLARGE_INTEGER) SamField)->LowPart,
GET_UAS_DWORD(UasSamIndex) ));
}
break;
//
// Copy the OWF password to the SAM structure.
//
case UT_OWF_PASSWORD:
((PUNICODE_STRING) SamField)->Buffer =
(LPWSTR) (GET_UAS_FIELD_ADDRESS( UasSamIndex ));
((PUNICODE_STRING) SamField)->Length =
((PUNICODE_STRING) SamField)->MaximumLength =
LM_OWF_PASSWORD_LENGTH;
//
// set that the LmPasswordField field to TRUE to indicate
// that we filled LmPassword field.
//
UserAll.LmPasswordPresent = TRUE;
UserAll.NtPasswordPresent = FALSE;
break;
//
// Ensure the specified privilege is valid.
//
case UT_PRIV:
NewPriv = GET_UAS_DWORD(UasSamIndex);
if ( (NewPriv & ~USER_PRIV_MASK) != 0 ) {
NetpSetParmError( SAM_FIELD(UasSamIndex).UasParmNum );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: Invalid priv %ld\n", NewPriv ));
}
goto Cleanup;
}
ValidatePriv = TRUE;
break;
//
// Ensure the specified operator flags is valid.
//
case UT_AUTH_FLAGS:
NewAuthFlags = GET_UAS_DWORD(UasSamIndex);
if ( (NewAuthFlags & ~AF_SETTABLE_BITS) != 0 ) {
NetpSetParmError( SAM_FIELD(UasSamIndex).UasParmNum );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: Invalid auth_flag %lx\n",
NewAuthFlags ));
}
goto Cleanup;
}
ValidateAuthFlags = TRUE;
break;
//
// All valid cases were explicitly checked above.
//
default:
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Invalid field type on initial scan."
" Index:%ld\n", UasSamIndex ));
}
NetStatus = NERR_InternalError;
goto Cleanup;
}
//
//
// Accumulate the desired access to do all this functionality.
DesiredAccess |= SAM_FIELD(UasSamIndex).DesiredAccess;
//
// Accumalate which fields are being changed in the
// USER_ALL_INFORMATION structure.
UserAll.WhichFields |= SAM_FIELD(UasSamIndex).WhichField;
}
//
// Check to be sure the user specified a valid Level.
//
// The search of the UserpUasSamTable should have resulted in
// at least one match if the arguments are valid.
//
if ( DesiredAccess == 0 ) {
NetpSetParmError( PARM_ERROR_UNKNOWN );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: Desired Access == 0\n" ));
}
goto Cleanup;
}
//
// Open the user asking for accumulated desired access
//
// If a UserHandle was passed in, use it.
//
if ( ARGUMENT_PRESENT( UserHandle ) ) {
LocalUserHandle = UserHandle;
} else {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: Desired Access %lX\n", DesiredAccess ));
}
NetStatus = UserpOpenUser( DomainHandle,
DesiredAccess,
UserName,
&LocalUserHandle,
&UserRelativeId );
if ( NetStatus != NERR_Success ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: UserpOpenUser returns %ld\n",
NetStatus ));
}
goto Cleanup;
}
}
//
// If an ordinary user created this user (SamCreateUser2InDomain),
// we must mask off the fields which a user cannot set.
//
UserAll.WhichFields &= WhichFieldsMask;
//
// Handle Account control
//
// Set the individual bits. Notice that I don't change any of
// the bits which aren't defined by the UAS API.
//
if ( UserAll.WhichFields & USER_ALL_USERACCOUNTCONTROL ) {
USER_CONTROL_INFORMATION *UserControl = NULL;
//
// Use the current value of UserAccountControl as the proposed
// new value of UserAccountControl.
//
Status = SamQueryInformationUser( LocalUserHandle,
UserControlInformation,
(PVOID *)&UserControl);
if ( ! NT_SUCCESS( Status ) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpGetInfo: SamQueryInformationUser returns %lX\n",
Status ));
}
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
UserAll.UserAccountControl = UserControl->UserAccountControl;
Status = SamFreeMemory( UserControl );
NetpAssert( NT_SUCCESS(Status) );
//
// Leave all bits not defined by the UAS API alone,
// including account type bits.
//
UserAll.UserAccountControl &= ~(USER_ACCOUNT_DISABLED |
USER_HOME_DIRECTORY_REQUIRED |
USER_PASSWORD_NOT_REQUIRED |
USER_DONT_EXPIRE_PASSWORD |
USER_ACCOUNT_AUTO_LOCKED |
USER_MNS_LOGON_ACCOUNT |
USER_ENCRYPTED_TEXT_PASSWORD_ALLOWED |
USER_SMARTCARD_REQUIRED |
USER_TRUSTED_FOR_DELEGATION |
USER_NOT_DELEGATED |
USER_USE_DES_KEY_ONLY |
USER_DONT_REQUIRE_PREAUTH |
USER_PASSWORD_EXPIRED
);
if (UasUserFlags & UF_ACCOUNTDISABLE) {
UserAll.UserAccountControl |= USER_ACCOUNT_DISABLED;
}
if (UasUserFlags & UF_HOMEDIR_REQUIRED) {
UserAll.UserAccountControl |= USER_HOME_DIRECTORY_REQUIRED;
}
if (UasUserFlags & UF_PASSWD_NOTREQD) {
UserAll.UserAccountControl |= USER_PASSWORD_NOT_REQUIRED;
}
if (UasUserFlags & UF_DONT_EXPIRE_PASSWD) {
UserAll.UserAccountControl |= USER_DONT_EXPIRE_PASSWORD;
}
if (UasUserFlags & UF_LOCKOUT) {
UserAll.UserAccountControl |= USER_ACCOUNT_AUTO_LOCKED;
}
if (UasUserFlags & UF_MNS_LOGON_ACCOUNT) {
UserAll.UserAccountControl |= USER_MNS_LOGON_ACCOUNT;
}
if (UasUserFlags & UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED) {
(UserAll.UserAccountControl) |= USER_ENCRYPTED_TEXT_PASSWORD_ALLOWED;
}
if (UasUserFlags & UF_SMARTCARD_REQUIRED) {
(UserAll.UserAccountControl) |= USER_SMARTCARD_REQUIRED;
}
if (UasUserFlags & UF_TRUSTED_FOR_DELEGATION) {
(UserAll.UserAccountControl) |= USER_TRUSTED_FOR_DELEGATION;
}
if (UasUserFlags & UF_NOT_DELEGATED) {
(UserAll.UserAccountControl) |= USER_NOT_DELEGATED;
}
if (UasUserFlags & UF_USE_DES_KEY_ONLY) {
(UserAll.UserAccountControl) |= USER_USE_DES_KEY_ONLY;
}
if (UasUserFlags & UF_DONT_REQUIRE_PREAUTH) {
(UserAll.UserAccountControl) |= USER_DONT_REQUIRE_PREAUTH;
}
if (UasUserFlags & UF_PASSWORD_EXPIRED) {
(UserAll.UserAccountControl) |= USER_PASSWORD_EXPIRED;
}
if (UasUserFlags & UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION) {
(UserAll.UserAccountControl) |= USER_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION;
}
//
// Set the account type bit.
//
// If no account type bit is set in user specified flag,
// then leave this bit as it is.
//
if( UasUserFlags & UF_ACCOUNT_TYPE_MASK ) {
ULONG NewSamAccountType;
ULONG OldSamAccountType;
OldSamAccountType =
(UserAll.UserAccountControl) & USER_ACCOUNT_TYPE_MASK;
//
// Determine what the new account type should be.
//
if ( UasUserFlags & UF_TEMP_DUPLICATE_ACCOUNT ) {
NewSamAccountType = USER_TEMP_DUPLICATE_ACCOUNT;
} else if ( UasUserFlags & UF_NORMAL_ACCOUNT ) {
NewSamAccountType = USER_NORMAL_ACCOUNT;
} else if (UasUserFlags & UF_INTERDOMAIN_TRUST_ACCOUNT){
NewSamAccountType = USER_INTERDOMAIN_TRUST_ACCOUNT;
} else if (UasUserFlags & UF_WORKSTATION_TRUST_ACCOUNT){
NewSamAccountType = USER_WORKSTATION_TRUST_ACCOUNT;
} else if ( UasUserFlags & UF_SERVER_TRUST_ACCOUNT ) {
NewSamAccountType = USER_SERVER_TRUST_ACCOUNT;
} else {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Invalid account type (3)\n"));
}
NetStatus = NERR_InternalError;
goto Cleanup;
}
#ifdef notdef
//
// If we are not creating this user,
// and either the old or the new account type is a machine account,
// don't allow the account type to change.
//
// Allow changes between 'normal' and 'temp_duplicate'
//
if ( UserHandle == NULL &&
NewSamAccountType != OldSamAccountType &&
((OldSamAccountType & USER_MACHINE_ACCOUNT_MASK) ||
(NewSamAccountType & USER_MACHINE_ACCOUNT_MASK))) {
NetpSetParmError( USER_FLAGS_PARMNUM );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Attempt to change account "
" type Old: %lx New: %lx\n",
OldSamAccountType,
NewSamAccountType ));
}
goto Cleanup;
}
#endif // notdef
//
// Use the new Account Type.
//
UserAll.UserAccountControl &= ~USER_ACCOUNT_TYPE_MASK;
UserAll.UserAccountControl |= NewSamAccountType;
//
// If SAM has none of its bits set,
// set USER_NORMAL_ACCOUNT.
//
} else if ((UserAll.UserAccountControl & USER_ACCOUNT_TYPE_MASK) == 0 ){
UserAll.UserAccountControl |= USER_NORMAL_ACCOUNT;
}
}
//
// Validate the usriX_priv and usrix_auth_flags fields
//
if ( ValidatePriv || ValidateAuthFlags ) {
DWORD OldPriv, OldAuthFlags;
//
// If this is a 'create' operation, just mandate that
// the values be reasonable. These reasonable values
// are what UserpGetUserPriv probably would return, unless
// of course someone puts the 'user' group in one of the
// aliases.
//
if ( UserHandle != NULL ) {
OldPriv = USER_PRIV_USER;
OldAuthFlags = 0;
//
// On a 'set' operation, just get the previous values.
//
} else {
NetStatus = UserpGetUserPriv(
BuiltinDomainHandle,
LocalUserHandle,
UserRelativeId,
DomainId,
&OldPriv,
&OldAuthFlags
);
if ( NetStatus != NERR_Success ) {
goto Cleanup;
}
}
//
// Ensure AUTH_FLAGS isn't being changed.
//
if ( ValidateAuthFlags ) {
if ( NewAuthFlags != OldAuthFlags ) {
NetpSetParmError( USER_AUTH_FLAGS_PARMNUM );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Old AuthFlag %ld New AuthFlag %ld\n",
OldAuthFlags,
NewAuthFlags ));
}
goto Cleanup;
}
}
//
// Ensure PRIV isn't being changed.
//
if ( ValidatePriv ) {
if ( NewPriv != OldPriv ) {
NetpSetParmError( USER_PRIV_PARMNUM );
NetStatus = ERROR_INVALID_PARAMETER;
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: Old Priv %ld New Priv %ld\n",
OldPriv,
NewPriv ));
}
goto Cleanup;
}
}
}
//
// Handle changes to the User Dacl
//
if ( HandleUserDacl ) {
DWORD DaclSize;
PACCESS_ALLOWED_ACE Ace;
SID_IDENTIFIER_AUTHORITY WorldAuthority = SECURITY_WORLD_SID_AUTHORITY;
//
// Build the sid for the user
//
NetStatus = NetpSamRidToSid(
LocalUserHandle,
UserRelativeId,
&UserSid
);
if (NetStatus != NERR_Success) {
goto Cleanup;
}
//
// Get the DACL for the user record.
//
NetStatus = UserpGetDacl( LocalUserHandle,
&OldUserDacl,
&DaclSize );
if ( NetStatus != NERR_Success ) {
goto Cleanup;
}
//
// If there is no DACL, just ignore that fact.
//
if ( OldUserDacl != NULL ) {
SID_IDENTIFIER_AUTHORITY WorldSidAuthority = SECURITY_WORLD_SID_AUTHORITY;
DWORD WorldSid[sizeof(SID)/sizeof(DWORD) + SID_MAX_SUB_AUTHORITIES ];
//
// Build a copy of the world SID for later comparison.
//
RtlInitializeSid( (PSID) WorldSid, &WorldSidAuthority, 1 );
*(RtlSubAuthoritySid( (PSID)WorldSid, 0 )) = SECURITY_WORLD_RID;
//
// Make a copy of the DACL that reflect the new UAS field.
//
NewUserDacl = NetpMemoryAllocate( DaclSize );
if ( NewUserDacl == NULL ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: no DACL memory %ld\n",
DaclSize ));
}
NetStatus = ERROR_NOT_ENOUGH_MEMORY;
goto Cleanup;
}
NetpMoveMemory( NewUserDacl, OldUserDacl, DaclSize );
//
// The UF_PASSWD_CANT_CHANGE bit is implemented by the
// ACL on the user object in SAM. When
// UF_PASSWD_CANT_CHANGE is on, the ACL doesn't allow
// World or the user himself USER_CHANGE_PASSWORD access.
// We set/clear the USER_CHANGE_PASSWORD access
// bit in the ACEs for the user and for World. This leaves
// Administrators and Account Operators with
// USER_ALL_ACCESS access.
//
// If the DACL for the user has been set by anyone
// other than the NetUser APIs, this action may
// not accurately reflect whether the password can
// be changed. We silently ignore ACLs we don't
// recognize.
//
//
// Point Ace to the first ACE.
//
for ( AceIndex = 0;
AceIndex < NewUserDacl->AceCount;
AceIndex++ ) {
Status = RtlGetAce(
NewUserDacl,
AceIndex,
(PVOID) &Ace
);
if ( !NT_SUCCESS(Status) ) {
break;
}
//
// If the sid in the ACE matches either the world SID
// or the User's SID, modify the access mask.
//
if ( RtlEqualSid(
&Ace->SidStart,
(PSID)WorldSid) ||
RtlEqualSid(
&Ace->SidStart,
UserSid) ) {
//
// Twiddle the USER_CHANGE_PASSWORD access bit.
//
if ( Ace->Mask & USER_CHANGE_PASSWORD ) {
if ( UasUserFlags & UF_PASSWD_CANT_CHANGE ) {
Ace->Mask &= ~USER_CHANGE_PASSWORD;
UserDaclChanged = TRUE;
}
} else {
if ( (UasUserFlags & UF_PASSWD_CANT_CHANGE) == 0 ) {
Ace->Mask |= USER_CHANGE_PASSWORD;
UserDaclChanged = TRUE;
}
}
}
}
//
// Set the DACL if it needs to be.
//
if ( UserDaclChanged ) {
NetStatus = UserpSetDacl( LocalUserHandle, NewUserDacl );
if ( NetStatus != NERR_Success ) {
goto Cleanup;
}
}
}
}
//
// If there is anything changed in the 'UserAll' structure,
// tell SAM about the changes.
//
//
// N.B. Because some of the NET fields are not treated as SAM fields
// (UT_PRIV and UT_MAX_STORAGE), there may be nothing to change. However,
// for app compat, continue to call SamSetInformationUser
//
Status = SamSetInformationUser(
LocalUserHandle,
UserAllInformation,
&UserAll );
if ( !NT_SUCCESS(Status) ) {
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint((
"UserpSetInfo: SamSetInformationUser returns %lX\n",
Status ));
}
NetpSetParmError( PARM_ERROR_UNKNOWN );
NetStatus = NetpNtStatusToApiStatus( Status );
goto Cleanup;
}
NetStatus = NERR_Success;
//
// Clean up.
//
Cleanup:
//
// If we've changed the DACL on the user and we've not been able
// to change everything, put the DACL back as we found it.
//
if ( NetStatus != NERR_Success && UserDaclChanged ) {
NET_API_STATUS NetStatus2;
NetStatus2 = UserpSetDacl( LocalUserHandle, OldUserDacl );
ASSERT( NetStatus2 == NERR_Success );
}
//
// If a handle to the user was opened by this routine,
// close it.
//
if (!ARGUMENT_PRESENT( UserHandle ) && LocalUserHandle != NULL) {
(VOID) SamCloseHandle( LocalUserHandle );
}
//
// Free any locally used recources.
//
if ( NewUserDacl != NULL ) {
NetpMemoryFree( NewUserDacl );
}
if ( OldUserDacl != NULL ) {
NetpMemoryFree( OldUserDacl );
}
if ( UserSid != NULL ) {
NetpMemoryFree( UserSid );
}
IF_DEBUG( UAS_DEBUG_USER ) {
NetpKdPrint(( "UserpSetInfo: returning %ld\n", NetStatus ));
}
return NetStatus;
} // UserpSetInfo
NET_API_STATUS
NetpSamRidToSid(
IN SAM_HANDLE SamHandle,
IN ULONG RelativeId,
OUT PSID *Sid
)
/*++
Routine Description:
Given a Rid returned from a Sam Handle, return the SID for that account.
Arguments:
SamHandle - a valid SAM handle
RelativeId - a RID obtained from a SAM call that used SamHandle
Sid - Returns a pointer to an allocated buffer containing the resultant
Sid. Free this buffer using NetpMemoryFree.
Return Value:
0 - if successful
NERR_UserNotFound if the Rid could not be mapped to a SID
a resource error, otherwise
--*/
{
NTSTATUS NtStatus = STATUS_SUCCESS;
PSID SamSid;
DWORD err = 0;
NtStatus = SamRidToSid(SamHandle,
RelativeId,
&SamSid);
if (NT_SUCCESS(NtStatus)) {
ULONG Length = RtlLengthSid(SamSid);
(*Sid) = NetpMemoryAllocate(Length);
if ((*Sid)) {
RtlCopySid(Length, (*Sid), SamSid);
} else {
err = ERROR_NOT_ENOUGH_MEMORY;
}
SamFreeMemory(SamSid);
} else if ( STATUS_NOT_FOUND == NtStatus ) {
// This is unexpected -- the user RID could not be
// found
err = NERR_UserNotFound;
} else {
// a resource error occurred
err = RtlNtStatusToDosError(NtStatus);
}
return err;
}
/*lint +e614 */
/*lint +e740 */
Reference in New Issue View Git Blame Copy Permalink