r17158: Add two new options to 'net ads join'

  * createupn=[host_upn@realm]
  * createcomputer=<ou path top to bottom> (this was previously
    the only arg)
(This used to be commit 75054e984e5ca7249b1327630db9d09da974a54e)

1 files changed, 114 insertions, 12 deletions

diff --git a/source3/utils/net_ads.c b/source3/utils/net_ads.c
index 54998592db..31a6b80912 100644
--- a/source3/utils/net_ads.c
+++ b/source3/utils/net_ads.c
@@ -928,7 +928,7 @@ done:
 static ADS_STATUS net_set_machine_spn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s )
 {
 	ADS_STATUS status = ADS_ERROR(LDAP_SERVER_DOWN);
-	char *host_upn, *new_dn;
+	char *new_dn;
 	ADS_MODLIST mods;
 	const char *servicePrincipalName[3] = {NULL, NULL, NULL};
 	char *psp;
@@ -964,9 +964,7 @@ static ADS_STATUS net_set_machine_spn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s )
 		return ADS_ERROR(LDAP_NO_MEMORY);
 	}
 
-	/* Windows only creates HOST/shortname & HOST/fqdn.  We create 
-	   the UPN as well so that 'kinit -k' will work.  You can only 
-	   request a TGT for entries with a UPN in AD. */
+	/* Windows only creates HOST/shortname & HOST/fqdn. */
 	   
 	if ( !(psp = talloc_asprintf(ctx, "HOST/%s", machine_name)) ) 
 		goto done;
@@ -979,9 +977,63 @@ static ADS_STATUS net_set_machine_spn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s )
 		goto done;
 	servicePrincipalName[1] = psp;
 	
-	if (!(host_upn = talloc_asprintf(ctx, "%s@%s", servicePrincipalName[0], ads_s->config.realm)))
+	if (!(mods = ads_init_mods(ctx))) {
 		goto done;
+	}
+	
+	/* fields of primary importance */
+	
+	ads_mod_str(ctx, &mods, "dNSHostName", my_fqdn);
+	ads_mod_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName);
+
+	status = ads_gen_mod(ads_s, new_dn, mods);
+
+done:
+	ads_msgfree(ads_s, res);
+	
+	return status;
+}
+
+/*******************************************************************
+ Set a machines dNSHostName and servicePrincipalName attributes
+ ********************************************************************/
 
+static ADS_STATUS net_set_machine_upn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s, const char *upn )
+{
+	ADS_STATUS status = ADS_ERROR(LDAP_SERVER_DOWN);
+	char *new_dn;
+	ADS_MODLIST mods;
+	LDAPMessage *res = NULL;
+	char *dn_string = NULL;
+	const char *machine_name = global_myname();
+	int count;
+	
+	if ( !machine_name ) {
+		return ADS_ERROR(LDAP_NO_MEMORY);
+	}
+	
+	/* Find our DN */
+	
+	status = ads_find_machine_acct(ads_s, (void **)(void *)&res, machine_name);
+	if (!ADS_ERR_OK(status)) 
+		return status;
+		
+	if ( (count = ads_count_replies(ads_s, res)) != 1 ) {
+		DEBUG(1,("net_set_machine_spn: %d entries returned!\n", count));
+		return ADS_ERROR(LDAP_NO_MEMORY);	
+	}
+	
+	if ( (dn_string = ads_get_dn(ads_s, res)) == NULL ) {
+		DEBUG(1, ("ads_add_machine_acct: ads_get_dn returned NULL (malloc failure?)\n"));
+		goto done;
+	}
+	
+	new_dn = talloc_strdup(ctx, dn_string);
+	ads_memfree(ads_s, dn_string);
+	if (!new_dn) {
+		return ADS_ERROR(LDAP_NO_MEMORY);
+	}
+	
 	/* now do the mods */
 	
 	if (!(mods = ads_init_mods(ctx))) {
@@ -990,8 +1042,7 @@ static ADS_STATUS net_set_machine_spn(TALLOC_CTX *ctx, ADS_STRUCT *ads_s )
 	
 	/* fields of primary importance */
 	
-	ads_mod_str(ctx, &mods, "dNSHostName", my_fqdn);
-	ads_mod_strlist(ctx, &mods, "servicePrincipalName", servicePrincipalName);
+	ads_mod_str(ctx, &mods, "userPrincipalName", upn);
 
 	status = ads_gen_mod(ads_s, new_dn, mods);
 
@@ -1001,7 +1052,6 @@ done:
 	return status;
 }
 
-
 /*******************************************************************
   join a domain using ADS (LDAP mods)
  ********************************************************************/
@@ -1089,6 +1139,19 @@ static BOOL net_derive_salting_principal( TALLOC_CTX *ctx, ADS_STRUCT *ads )
 	return kerberos_secrets_store_des_salt( salt );
 }
 
+/*********************************************************
+ utility function to parse an integer parameter from 
+ "parameter = value"
+**********************************************************/
+static char* get_string_param( const char* param )
+{
+	char *p;
+	
+	if ( (p = strchr( param, '=' )) == NULL )
+		return NULL;
+		
+	return (p+1);
+}
 /*******************************************************************
   join a domain using ADS (LDAP mods)
  ********************************************************************/
@@ -1103,6 +1166,10 @@ int net_ads_join(int argc, const char **argv)
 	struct cldap_netlogon_reply cldap_reply;
 	TALLOC_CTX *ctx;
 	DOM_SID *domain_sid = NULL;
+	BOOL createupn = False;
+	const char *machineupn = NULL;
+	const char *create_in_ou = NULL;
+	int i;
 	
 	if ( check_ads_config() != 0 ) {
 		d_fprintf(stderr, "Invalid configuration.  Exiting....\n");
@@ -1126,11 +1193,30 @@ int net_ads_join(int argc, const char **argv)
 		return -1;
 	}
 
-	/* If we were given an OU, try to create the machine in the OU account 
-	   first and then do the normal RPC join */
+	/* process additional command line args */
+	
+	for ( i=0; i<argc; i++ ) {
+		if ( !StrnCaseCmp(argv[i], "createupn", strlen("createupn")) ) {
+			createupn = True;
+			machineupn = get_string_param(argv[i]);
+		}
+		else if ( !StrnCaseCmp(argv[i], "createcomputer", strlen("createcomputer")) ) {
+			if ( (create_in_ou = get_string_param(argv[i])) == NULL ) {
+				d_fprintf(stderr, "Please supply a valid OU path\n");
+				return -1;
+			}		
+		}
+		else {
+			d_fprintf(stderr, "Bad option: %s\n", argv[i]);
+			return -1;
+		}
+	}
+
+	/* If we were given an OU, try to create the machine in 
+	   the OU account first and then do the normal RPC join */
 
-	if ( argc > 0 ) {
-		status = net_precreate_machine_acct( ads, argv[0] );
+	if  ( create_in_ou ) {
+		status = net_precreate_machine_acct( ads, create_in_ou );
 		if ( !ADS_ERR_OK(status) ) {
 			d_fprintf( stderr, "Failed to pre-create the machine object "
 				"in OU %s.\n", argv[0]);
@@ -1218,6 +1304,22 @@ int net_ads_join(int argc, const char **argv)
 		return -1;
 	}
 
+	if ( createupn ) {
+		pstring upn;
+		
+		/* default to using the short UPN name */
+		if ( !machineupn ) {
+			snprintf( upn, sizeof(upn), "host/%s@%s", global_myname(), 
+				ads->config.realm );
+			machineupn = upn;
+		}
+		
+		status = net_set_machine_upn( ctx, ads, machineupn );
+		if ( !ADS_ERR_OK(status) )  {
+			d_fprintf(stderr, "Failed to set userPrincipalName.  Are you a Domain Admin?\n");
+		}
+	}
+
 	/* Now build the keytab, using the same ADS connection */
 	if (lp_use_kerberos_keytab() && ads_keytab_create_default(ads)) {
 		DEBUG(1,("Error creating host keytab!\n"));