Enabled domain groups to be added to builtin groups at domain join time

Previously this was done at token creation time if the Administrators and Users
builtins hadn't been created yet.  A major drawback to this approach is that if
a customer is joined to a domain and decides they want to join a different
domain, the domain groups from this new domain will not be added to the
builtins.

It would be ideal if these groups could be added exclusively at domain join
time, but we can't rely solely on that because there are cases where winbindd
must be running to allocate new gids for the builtins.  In the future if there
is a way to allocate gids for builtins without running winbindd, this code
can be removed from create_local_nt_token.

- Made create_builtin_users and create_builtin_administrators non-static so
they can be called from libnet
- Added a new function to libnet_join that will make a best effort to add
domain administrators and domain users to BUILTIN\Administrators and
BUILTIN\Users, respectively.  If the builtins don't exist yet, winbindd must be
running to allocate new gids, but if the builtins already exist, the domain
groups will be added even if winbindd is not running.  In the case of a
failure the error will be logged, but the join will not be failed.
- Plumbed libnet_join_add_dom_rids_to_builtins into the join post processing.
(This used to be commit e92faf5996cadac480deb60a4f6232eea90b00f6)

3 files changed, 37 insertions, 2 deletions

diff --git a/source3/auth/token_util.c b/source3/auth/token_util.c
index 281741298a..e5b9e1b531 100644
--- a/source3/auth/token_util.c
+++ b/source3/auth/token_util.c
@@ -262,7 +262,7 @@ static NTSTATUS add_sid_to_builtin(const DOM_SID *builtin_sid,
 /*******************************************************************
 *******************************************************************/
 
-static NTSTATUS create_builtin_users(const DOM_SID *dom_sid)
+NTSTATUS create_builtin_users(const DOM_SID *dom_sid)
 {
 	NTSTATUS status;
 	DOM_SID dom_users;
@@ -292,7 +292,7 @@ static NTSTATUS create_builtin_users(const DOM_SID *dom_sid)
 /*******************************************************************
 *******************************************************************/
 
-static NTSTATUS create_builtin_administrators(const DOM_SID *dom_sid)
+NTSTATUS create_builtin_administrators(const DOM_SID *dom_sid)
 {
 	NTSTATUS status;
 	DOM_SID dom_admins, root_sid;
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 7e70f3ced3..01b7a354e2 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -171,6 +171,8 @@ bool nt_token_check_domain_rid( NT_USER_TOKEN *token, uint32 rid );
 NT_USER_TOKEN *get_root_nt_token( void );
 NTSTATUS add_aliases(const DOM_SID *domain_sid,
 		     struct nt_user_token *token);
+NTSTATUS create_builtin_users(const DOM_SID *sid);
+NTSTATUS create_builtin_administrators(const DOM_SID *sid);
 struct nt_user_token *create_local_nt_token(TALLOC_CTX *mem_ctx,
 					    const DOM_SID *user_sid,
 					    bool is_guest,
diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index 814eebafd0..59dec1a6c3 100644
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -1447,6 +1447,37 @@ static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
 /****************************************************************
 ****************************************************************/
 
+static void libnet_join_add_dom_rids_to_builtins(struct dom_sid *domain_sid)
+{
+	NTSTATUS status;
+
+	/* Try adding dom admins to builtin\admins. Only log failures. */
+	status = create_builtin_administrators(domain_sid);
+	if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
+		DEBUG(10,("Unable to auto-add domain administrators to "
+			  "BUILTIN\\Administrators during join because "
+			  "winbindd must be running."));
+	} else if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(5, ("Failed to auto-add domain administrators to "
+			  "BUILTIN\\Administrators during join: %s\n",
+			  nt_errstr(status)));
+	}
+
+	/* Try adding dom users to builtin\users. Only log failures. */
+	status = create_builtin_users(domain_sid);
+	if (NT_STATUS_EQUAL(status, NT_STATUS_PROTOCOL_UNREACHABLE)) {
+		DEBUG(10,("Unable to auto-add domain users to BUILTIN\\users "
+			  "during join because winbindd must be running."));
+	} else if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(5, ("Failed to auto-add domain administrators to "
+			  "BUILTIN\\Administrators during join: %s\n",
+			  nt_errstr(status)));
+	}
+}
+
+/****************************************************************
+****************************************************************/
+
 static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
 					  struct libnet_JoinCtx *r)
 {
@@ -1465,6 +1496,8 @@ static WERROR libnet_join_post_processing(TALLOC_CTX *mem_ctx,
 		saf_store(r->in.domain_name, r->in.dc_name);
 	}
 
+	libnet_join_add_dom_rids_to_builtins(r->out.domain_sid);
+
 	return WERR_OK;
 }