|
|
/**********************************************************************//** Microsoft Windows NT **//** Copyright(c) Microsoft Corp., 1992 **//**********************************************************************/
/*
* This module contains the wrappers for SAM objects. * * Two Hierarchies are presented in this file. * * The first is the SAM_MEMORY hierarchy. These are a set of classes * used to wrap the various structures returned by SAM Apis. This * allows easy access to the members of each of the array of structures * which SAM returns. Also, it gives automatic freeing of the memory * allocated by SAM when the MEM object is destructed. Clients will * generally create the appropriate MEM object, and pass a pointer to * it into the appropriate method of the desired SAM_OBJECT class. * * BASE * | * NT_MEMORY * | * SAM_MEMORY * | * +---------+--------+--------------------+ * | | | | * SAM_RID_MEM | SAM_SID_MEM SAM_RID_ENUMERATION_MEM * | * SAM_PASSWORD_MEM * * * Second, the SAM_OBJECT hierarchy is a thin wrapper around the * SAM apis. These classes store the appropriate SAM handle, and * provide access to the SAM apis which operate on that handle. * * BASE * | * SAM_OBJECT * | * +------------------------------------------------------+ * | | | | | * SAM_SERVER SAM_DOMAIN SAM_ALIAS SAM_USER SAM_GROUP * * One more class is presented in this file, ADMIN_AUTHORITY. This * class creates and contains a SAM_SERVER, two SAM_DOMAINS corresponding * to the BuiltIn domain and Account domain on the server, and an LSA_OBJECT. * Thus, the User Manager (for example) can create a single object to * access all SAM and LSA functions. * * * * History * jonn 01/17/92 Created * thomaspa 02/22/92 Split int hxx/cxx * thomaspa 03/03/92 Split out ntlsa.hxx * jonn 07/07/92 Added SAM_USER */
#ifndef _UINTSAM_HXX_
#define _UINTSAM_HXX_
#include "uiassert.hxx"
#include "uintmem.hxx"
#include "uintlsa.hxx"
#include "security.hxx"
#include "apisess.hxx"
// Forward declaration
DLL_CLASS ALIAS_ENUM;
#define DEF_SAM_SERVER_ACCESS SAM_SERVER_LOOKUP_DOMAIN
#define DEF_SAM_DOMAIN_ACCESS GENERIC_EXECUTE
#define DEF_SAM_ALIAS_ACCESS ALIAS_ALL_ACCESS
#define DEF_SAM_USER_ACCESS USER_ALL_ACCESS
#define DEF_SAM_GROUP_ACCESS GROUP_ALL_ACCESS
#define DEF_REQ_ENUM_BUFFSIZE 0x10000
/**********************************************************\
NAME: SAM_MEMORY
SYNOPSIS: Specialized buffer object for storing data returned from SAM APIs.
INTERFACE: SAM_MEMORY(): constructor ~SAM_MEMORY(): destructor
NOTES: This is a base class for specialized wrapper classes which wrap structures returned by SAM APIs. This class provides a framework for accessing and freeing these buffers.
PARENT: NT_MEMORY
HISTORY: thomaspa 03/03/92 Created
\**********************************************************/
DLL_CLASS SAM_MEMORY : public NT_MEMORY{
private: BOOL _fOwnerAlloc;
protected: SAM_MEMORY( BOOL fOwnerAlloc = FALSE );
/*
* Frees an SAM allocated buffer */ inline virtual void FreeBuffer() { if ( QueryBuffer() != NULL ) { REQUIRE( ::SamFreeMemory( QueryBuffer() ) == STATUS_SUCCESS ); } }
public: ~SAM_MEMORY();
/*
* Frees the existing buffer and sets a new buffer and count of items */ inline virtual void Set( VOID * pvBuffer, ULONG cItems ) { if ( !_fOwnerAlloc ) FreeBuffer(); NT_MEMORY::Set( pvBuffer, cItems ); }
};
/**********************************************************\
NAME: SAM_RID_MEM (samrm)
SYNOPSIS: Wrapper buffer for arrays of RIDs.
INTERFACE: SAM_RID_MEM(): constructor ~SAM_RID_MEM(): destructor QueryRID(): Query Rid
PARENT: SAM_MEMORY
HISTORY: jonn 01/17/92 Created
\**********************************************************/DLL_CLASS SAM_RID_MEM : public SAM_MEMORY{
private: /*
* Return a properly casted pointer to the buffer */ inline const ULONG * QueryPtr() const { return (ULONG *)QueryBuffer(); }
public: SAM_RID_MEM( BOOL fOwnerAlloc = FALSE ); ~SAM_RID_MEM();
/*
* return the RID for the ith entry in the buffer */ inline ULONG QueryRID( ULONG i ) const { ASSERT( IsInRange( i ) ); return QueryPtr()[i]; }
};
/**********************************************************\
NAME: SAM_SID_MEM (samsm)
SYNOPSIS: Wrapper buffer for arrays of PSIDs.
INTERFACE: SAM_SID_MEM(): constructor ~SAM_SID_MEM(): destructor QueryPSID(): Query PSID
PARENT: SAM_MEMORY
HISTORY: jonn 01/17/92 Created
\**********************************************************/DLL_CLASS SAM_SID_MEM : public SAM_MEMORY{
public: SAM_SID_MEM( BOOL fOwnerAlloc = FALSE ); ~SAM_SID_MEM();
/*
* Return the PSID for the ith entry in the buffer */ inline PSID QueryPSID( ULONG i ) const { ASSERT( IsInRange( i ) ); return QueryPtr()[i]; } /*
* Return a properly casted pointer to the buffer */ inline PSID * QueryPtr() const { return (PSID *)QueryBuffer(); }
};
/**********************************************************\
NAME: SAM_RID_ENUMERATION_MEM (samrem)
SYNOPSIS: Specialized buffer object for storing data returned from SAM APIs, specifically SAM_RID_ENUMERATION structs.
INTERFACE: SAM_RID_ENUMERATION_MEM(): constructor ~SAM_RID_ENUMERATION_MEM(): destructor QueryRID(): query a RID from the buffer QueryName(): Query a name from the buffer
PARENT: SAM_MEMORY
HISTORY: thomaspa 02/20/92 Created
\**********************************************************/DLL_CLASS SAM_RID_ENUMERATION_MEM : public SAM_MEMORY{public: SAM_RID_ENUMERATION_MEM( BOOL fOwnerAlloc = FALSE ); ~SAM_RID_ENUMERATION_MEM();
/*
* Return a properly casted pointer to the buffer */ inline const SAM_RID_ENUMERATION * QueryPtr() const { return (SAM_RID_ENUMERATION *)QueryBuffer(); } /*
* return the UNICODE_STRING name for the ith entry in the buffer */ inline const UNICODE_STRING * QueryUnicodeName( ULONG i ) const { ASSERT( IsInRange( i ) ); return &(QueryPtr()[i].Name); }
/*
* Return the RID for the ith entry in the buffer */ inline ULONG QueryRID( ULONG i ) const { ASSERT( IsInRange( i ) ); return QueryPtr()[i].RelativeId; } /*
* Return the NLS_STR name for the ith entry in the buffer */ inline APIERR QueryName( ULONG i, NLS_STR * pnlsName ) const { ASSERT( pnlsName != NULL ); return pnlsName->MapCopyFrom( QueryUnicodeName( i )->Buffer, QueryUnicodeName( i )->Length ); }
} ;
/**********************************************************\
NAME: SAM_SID_NAME_USE_MEM (samsnum)
SYNOPSIS: Specialized buffer object for storing data returned from SAM APIs, specifically SID_NAME_USE structs.
INTERFACE: SAM_SID_NAME_USE_MEM(): constructor ~SAM_SID_NAME_USE_MEM(): destructor QueryUse(): query a Name Use from the buffer
PARENT: SAM_MEMORY
HISTORY: thomaspa 02/20/92 Created
\**********************************************************/DLL_CLASS SAM_SID_NAME_USE_MEM : public SAM_MEMORY{
private: /*
* Return a properly casted pointer to the buffer */ inline const SID_NAME_USE * QueryPtr() const { return (SID_NAME_USE *)QueryBuffer(); }
public: SAM_SID_NAME_USE_MEM( BOOL fOwnerAlloc = FALSE ); ~SAM_SID_NAME_USE_MEM();
/*
* return the SID_NAME_USE for the ith entry in the buffer */ inline SID_NAME_USE QueryUse( ULONG i ) const { ASSERT( IsInRange( i ) ); return QueryPtr()[i]; }
} ;
/**********************************************************\
NAME: SAM_PSWD_DOM_INFO_MEM (sampswdinfo)
SYNOPSIS: Wrapper for DOMAIN_PASSWORD_INFORMATION
INTERFACE: SAM_PSWD_DOM_INFO_MEM(): constructor ~SAM_PSWD_DOM_INFO_MEM(): destructor QueryNoAnonChange(): Query whether anonymous password change allowed SetNoAnonChange()
PARENT: SAM_MEMORY
NOTES: Accessors not created for other fields, create if needed
HISTORY: JonN 12/23/93 Created
\**********************************************************/
DLL_CLASS SAM_PSWD_DOM_INFO_MEM : public SAM_MEMORY{private: DOMAIN_PASSWORD_INFORMATION * QueryUpdatePtr () const { return (DOMAIN_PASSWORD_INFORMATION *) QueryBuffer() ; }
public:
/*
* Returns a properly casted pointer the the buffer */ const DOMAIN_PASSWORD_INFORMATION * QueryPtr () const { return (DOMAIN_PASSWORD_INFORMATION *) QueryBuffer(); }
SAM_PSWD_DOM_INFO_MEM( BOOL fOwnerAlloc = FALSE ); ~SAM_PSWD_DOM_INFO_MEM();
BOOL QueryNoAnonChange(); void SetNoAnonChange( BOOL fNoAnonChange );
};
/**********************************************************\
NAME: SAM_OBJECT
SYNOPSIS: Wrapper for SAM-handle-based C++ objects. This class is a pure virtual parent class for SAM_SERVER, SAM_DOMAIN and SAM_ALIAS. Its only function at present is to remember the SAM_HANDLE and to free it when done.
INTERFACE: (protected) SAM_OBJECT(): constructor SetHandle(): Store handle to object. SetHandle() should be called at most once, by the subclass constructor. QueryHandle(): Query handle to object
PARENT: BASE
HISTORY: jonn 01/17/92 Created thomaspa 04/17/92 Improved handle handling
\**********************************************************/
DLL_CLASS SAM_OBJECT : public BASE{
private: SAM_HANDLE _hsam; BOOL _fHandleValid ;
protected: SAM_OBJECT(); ~SAM_OBJECT();
/*
* Sets the handle for a SAM_OBJECT. Should only be * called once for any object */ inline void SetHandle( SAM_HANDLE hsam ) { ASSERT( !_fHandleValid ); ASSERT( hsam != NULL ); _hsam = hsam; _fHandleValid = TRUE ; } inline void ResetHandle ( ) { _fHandleValid = FALSE ; _hsam = NULL ; }
public:
// Returns TRUE if handle is present and valid
inline BOOL IsHandleValid () const { return _fHandleValid ; }
// Returns the SAM_HANDLE for this object
inline SAM_HANDLE QueryHandle() const { return _fHandleValid ? _hsam : NULL ; }
// Close the handle and invalidate it.
APIERR CloseHandle ( ) ;
} ;
/**********************************************************\
NAME: SAM_SERVER (samsrv)
SYNOPSIS: Wrapper for SAM server APIs. This class provides access to the SAM APIs relating to ServerHandles. At present, this only includes creating and deleting these handles.
INTERFACE: (public) SAM_SERVER(): constructor ~SAM_SERVER(): destructor
PARENT: SAM_OBJECT
HISTORY: jonn 01/17/92 Created
\**********************************************************/
DLL_CLASS SAM_SERVER : public SAM_OBJECT{
private: NLS_STR _nlsServerName;
public: SAM_SERVER( const TCHAR * pszServerName, ACCESS_MASK accessDesired = DEF_SAM_SERVER_ACCESS ); ~SAM_SERVER();
const TCHAR * QueryServerName( void ) const { return (_nlsServerName.strlen() != 0) ? _nlsServerName.QueryPch() : NULL; }
} ;
/**********************************************************\
NAME: SAM_DOMAIN (samdom)
SYNOPSIS: Wrapper for SAM domain APIs. This class provides access to the SAM APIs relating to DomainHandles.
Default access DOMAIN_ALL_ACCESS is required to enumerate aliases and create new aliases.
INTERFACE: (public) SAM_DOMAIN(): constructor ~SAM_DOMAIN(): destructor
EnumerateAliases(): EnumerateUsers(): EnumerateAliasesForUser(): TranslateNamesToRids(): RemoveMemberFromAliases():
PARENT: SAM_OBJECT
HISTORY: jonn 01/17/92 Created thomaspa 02/22/92 Many changes jonn 07/27/92 RemoveMemberFromAliases
\**********************************************************/
DLL_CLASS SAM_DOMAIN : public SAM_OBJECT{
private: OS_SID _ossidDomain;
APIERR OpenDomain( const SAM_SERVER & server, PSID psidDomain, ACCESS_MASK accessDesired );
public: SAM_DOMAIN( const SAM_SERVER & server, PSID psidDomain, ACCESS_MASK accessDesired = DEF_SAM_DOMAIN_ACCESS ); ~SAM_DOMAIN();
// Get/Set the server role
APIERR GetPasswordInfo ( SAM_PSWD_DOM_INFO_MEM * psampswdinfo ) const ; APIERR SetPasswordInfo ( const SAM_PSWD_DOM_INFO_MEM * psampswdinfo ) ;
APIERR TranslateNamesToRids( const TCHAR * const * ppszNames, ULONG cNames, SAM_RID_MEM *psamrm, SAM_SID_NAME_USE_MEM *psamsnum) const; APIERR EnumerateAliases( SAM_RID_ENUMERATION_MEM * psamrem, PSAM_ENUMERATE_HANDLE psamenumh, ULONG cbRequested = DEF_REQ_ENUM_BUFFSIZE ) const;
APIERR EnumerateGroups( SAM_RID_ENUMERATION_MEM * psamrem, PSAM_ENUMERATE_HANDLE psamenumh, ULONG cbRequested = DEF_REQ_ENUM_BUFFSIZE ) const;
APIERR EnumerateUsers( SAM_RID_ENUMERATION_MEM * psamrem, PSAM_ENUMERATE_HANDLE psamenumh, ULONG fAccountControl, ULONG cbRequested = DEF_REQ_ENUM_BUFFSIZE ) const; APIERR EnumerateAliasesForUser( PSID psidUser, SAM_RID_MEM * psamrm ) const;
APIERR RemoveMemberFromAliases( PSID psidMember );
PSID QueryPSID( void ) const { return _ossidDomain.QuerySid(); }
const OS_SID * QueryOSSID( void ) const { return &_ossidDomain; }
} ;
/**********************************************************\
NAME: SAM_ALIAS (samalias)
SYNOPSIS: Wrapper for SAM alias APIs. This class provides access to the SAM APIs relating to AliasHandles. This includes creating and deleting these handles, querying alias membership, and modifying alias membership.
INTERFACE: (public) SAM_ALIAS(): constructor ~SAM_ALIAS(): destructor Delete(): deletes alias. Do not use object after a successful call to Delete(). GetMembers(); AddMember(): RemoveMember(): GetComment(): SetComment(): QueryRid();
PARENT: SAM_OBJECT
HISTORY: jonn 01/17/92 Created
\**********************************************************/
DLL_CLASS SAM_ALIAS : public SAM_OBJECT{
private: ULONG _ulRid;
public: // Constructor for Opening an existing alias
SAM_ALIAS( const SAM_DOMAIN & samdom, ULONG ulAliasRid, ACCESS_MASK accessDesired = DEF_SAM_ALIAS_ACCESS );
// Constructor for Creating a new alias
SAM_ALIAS( const SAM_DOMAIN & samdom, const TCHAR *pszName, ACCESS_MASK accessDesired = DEF_SAM_ALIAS_ACCESS );
~SAM_ALIAS();
APIERR Delete();
APIERR GetMembers( SAM_SID_MEM * psamsm );
APIERR AddMember( PSID psidMemberID );
APIERR RemoveMember( PSID psidMemberID );
APIERR AddMembers( PSID * apsidMemberIDs, UINT cSidCount );
APIERR RemoveMembers( PSID * apsidMemberIDs, UINT cSidCount );
APIERR GetComment( NLS_STR * pnlsComment );
APIERR SetComment( const NLS_STR * pnlsComment );
ULONG QueryRID();
} ;
/**********************************************************\
NAME: SAM_USER (samuser)
SYNOPSIS: Wrapper for SAM user APIs. This class provides access to the SAM APIs relating to UserHandles. This includes creating and deleting these handles. This class does not provide all functionality relating to UserHandles, since the USER_x APIs are available for that purpose. It is intended to test creating UserHandles with specific access masks, to test what USER_x operations can be performed on a user without actually performing them. It also supports renaming a user.
INTERFACE: (public) SAM_USER(): constructor ~SAM_USER(): destructor SetUsername(): rename user account
PARENT: SAM_OBJECT
HISTORY: jonn 07/07/92 Created
\**********************************************************/
DLL_CLASS SAM_USER : public SAM_OBJECT{
private: ULONG _ulRid;
public: // Constructor for Opening an existing user
SAM_USER( const SAM_DOMAIN & samdom, ULONG ulUserRid, ACCESS_MASK accessDesired = DEF_SAM_USER_ACCESS );
~SAM_USER();
APIERR SetUsername( const NLS_STR * pnlsUsername );
// Perform SamChangePasswordUser()
APIERR SetPassword ( const NLS_STR & nlsOldPassword, const NLS_STR & nlsNewPassword ) ;
// Perform SamSetInformationUser() with just a password
APIERR SetPassword ( const NLS_STR & nlsPassword, BOOL fPasswordExpired = FALSE ) ;
ULONG QueryRID();
} ;
/**********************************************************\
NAME: SAM_GROUP (samgroup)
SYNOPSIS: Wrapper for SAM (global) group APIs. This class provides access to the SAM APIs relating to GroupHandles. This includes creating and deleting these handles. This class does not provide all functionality relating to GROUPHandles, since the GROUP_x APIs are available for that purpose. It is intended to test creating GroupHandles with specific access masks, to test what GROUP_x operations can be performed on a group without actually performing them.
INTERFACE: (public) SAM_GROUP(): constructor ~SAM_GROUP(): destructor SetGroupname(): rename global group account
PARENT: SAM_OBJECT
HISTORY: jonn 07/07/92 Created
\**********************************************************/
DLL_CLASS SAM_GROUP : public SAM_OBJECT{
private: ULONG _ulRid;
public: // Constructor for Opening an existing group
SAM_GROUP( const SAM_DOMAIN & samdom, ULONG ulGroupRid, ACCESS_MASK accessDesired = DEF_SAM_GROUP_ACCESS );
~SAM_GROUP();
APIERR SetGroupname( const NLS_STR * pnlsGroupname );
APIERR GetComment( NLS_STR * pnlsComment );
APIERR GetMembers( SAM_RID_MEM * psamrm );
APIERR AddMember( ULONG ridMemberID );
APIERR RemoveMember( ULONG ridMemberID );
APIERR AddMembers( ULONG * aridMemberIDs, UINT cRidCount );
APIERR RemoveMembers( ULONG * aridMemberIDs, UINT cRidCount );
ULONG QueryRID();
} ;
/**********************************************************\
NAME: ADMIN_AUTHORITY (adminauth)
SYNOPSIS: This class creates and contains a SAM_SERVER, two SAM_DOMAINS corresponding to the BuiltIn domain and Account domain on the server, and an LSA_OBJECT. Thus, the User Manager (for example) can create a single object to access all SAM and LSA functions.
INTERFACE: (public) ADMIN_AUTHORITY(): constructor ~ADMIN_AUTHORITY(): destructor
ReplaceSamServer(): ReplaceLSAPolicy(): ReplaceBuiltinDomain(): ReplaceAccountDomain(): Replace the current handle with one with the specified authority. If this fails, the old handle is intact and the ADMIN_AUTHORITY is still valid.
QuerySamServer(): QueryLSAPolicy(): QueryBuiltinDomain(): QueryAccountDomain(): Query the current handle
QueryAccessSamServer(): QueryAccessLSAPolicy(): QueryAccessBuiltinDomain(): QueryAccessAccountDomain(): Query the access requested for the current handle. Note that this is not necessarily the actual access, e.g. if you request MAXIMUM_ALLOWED this will return MAXIMUM_ALLOWED and not the actual access.
UpgradeSamServer: UpgradeLSAPolicy: UpgradeBuiltinDomain: UpgradeAccountDomain: Upgrade the current handle to one with at least the requested access. If the handle already has that access this is a no-op. If this fails, the old handle is left intact and the ADMIN_AUTHORITY is still valid. Note that the current and requested access levels are combined with a simple-minded OR, thus the caller should be careful when the previous or current request includes MAXIMUM_ALLOWED, GENERIC_xxx or the like.
QueryApiSession: Returns a pointer to the API_SESSION established. This will be NULL if the ADMIN_AUTHORITY was created for the local machine.
QueryServer Returns pointer to constructing server
PARENT: BASE
HISTORY: thomaspa 02/27/92 Created jonn 07/06/92 Added Replace* Johnl 09/10/92 Added QueryServer
\**********************************************************/
DLL_CLASS ADMIN_AUTHORITY : public BASE{private: NLS_STR _nlsServerName; SAM_SERVER * _psamsrv; SAM_DOMAIN * _psamdomAccount; SAM_DOMAIN * _psamdomBuiltin; LSA_POLICY * _plsapol;
API_SESSION * _papisess;
// CODEWORK These access levels should probably be stored with the
// repective handles, not with the ADMIN_AUTHORITY.
ACCESS_MASK _accessSamServer; ACCESS_MASK _accessLSAPolicy; ACCESS_MASK _accessBuiltinDomain; ACCESS_MASK _accessAccountDomain;
public: ADMIN_AUTHORITY( const TCHAR * pszServerName, ACCESS_MASK accessAccountDomain = DEF_SAM_DOMAIN_ACCESS, ACCESS_MASK accessBuiltinDomain = DEF_SAM_DOMAIN_ACCESS, ACCESS_MASK accessLSA = DEF_LSA_POLICY_ACCESS, ACCESS_MASK accessServer = DEF_SAM_SERVER_ACCESS, BOOL fNullSessionOk = FALSE );
~ADMIN_AUTHORITY();
APIERR ReplaceSamServer( ACCESS_MASK accessServer = DEF_SAM_SERVER_ACCESS ); APIERR ReplaceLSAPolicy( ACCESS_MASK accessLSA = DEF_LSA_POLICY_ACCESS ); APIERR ReplaceBuiltinDomain( ACCESS_MASK accessBuiltinDomain = DEF_SAM_DOMAIN_ACCESS ); APIERR ReplaceAccountDomain( ACCESS_MASK accessAccountDomain = DEF_SAM_DOMAIN_ACCESS );
SAM_SERVER * QuerySamServer() const; LSA_POLICY * QueryLSAPolicy() const; SAM_DOMAIN * QueryBuiltinDomain() const; SAM_DOMAIN * QueryAccountDomain() const;
ACCESS_MASK QueryAccessSamServer() const; ACCESS_MASK QueryAccessLSAPolicy() const; ACCESS_MASK QueryAccessBuiltinDomain() const; ACCESS_MASK QueryAccessAccountDomain() const;
APIERR UpgradeSamServer( ACCESS_MASK accessServer = DEF_SAM_SERVER_ACCESS ); APIERR UpgradeLSAPolicy( ACCESS_MASK accessLSA = DEF_LSA_POLICY_ACCESS ); APIERR UpgradeBuiltinDomain( ACCESS_MASK accessBuiltinDomain = DEF_SAM_DOMAIN_ACCESS ); APIERR UpgradeAccountDomain( ACCESS_MASK accessAccountDomain = DEF_SAM_DOMAIN_ACCESS );
const TCHAR * QueryServer( void ) const { return _nlsServerName.strlen() ? _nlsServerName.QueryPch() : NULL ; }
const API_SESSION * QueryApiSession() { return (const API_SESSION *)_papisess; }
};
#endif // _UINTSAM_HXX_
|
