windows-xp/Source/XPSP1/NT/ds/security/ntmarta/newsrc/member.cxx

//+------------------------------------------------------------------
//
// Copyright (C) Microsoft Corporation, 1994 - 1996.
//
// File:        member.cxx
//
// Classes:     CMemberCheck
//
// History:     Nov-94      DaveMont         Created.
//
//-------------------------------------------------------------------
#include <aclpch.hxx>
#pragma hdrstop

extern "C"
{
    #include <ntprov.hxx>
    #include <strings.h>
}

SID WORLD_SID = {SID_REVISION,
                 1,
                 SECURITY_WORLD_SID_AUTHORITY,
                 SECURITY_WORLD_RID};

#define MARTA_MAX_RECURSION_COUNT 256
//+---------------------------------------------------------------------------
//
//  Member:     CMemberCheck::Init, public
//
//  Synopsis:   initializes the class
//
//  Arguments:  none
//
//  Returns:    ERROR_SUCCESS           --      Success
//
//----------------------------------------------------------------------------
DWORD CMemberCheck::Init()
{
    acDebugOut((DEB_TRACE, "In CMemberCheck::Init\n"));
    DWORD   dwErr = ERROR_SUCCESS;

    //
    // get the local machine name
    //
    ULONG   cSize = MAX_COMPUTERNAME_LENGTH + 1;
    if(GetComputerName(_wszComputerName, &cSize) == FALSE)
    {
        dwErr = GetLastError();
    }

    acDebugOut((DEB_TRACE, "Out CMemberCheck::Init: %lu\n", dwErr));

    return(dwErr);
}




//+---------------------------------------------------------------------------
//
//  Member:     CMemberCheck::IsMemberOf, public
//
//  Synopsis:   Checks if the current sid is a member of the input sid.
//              The current sid is a part of our initialize TRUSTEE_NODE and
//              the input sid is in our passed in TRUSTEE_NODE
//
//  Arguments:  [IN  pTrusteeNode]          --  Input TRUSTEE_NODE
//              [OUT pfIsMemberOf]          --  Where the results are returned.
//                                              Is TRUE if the initialization
//                                              SID is a member of the input
//                                              SID.
//
//  Returns:    ERROR_SUCCESS               --  Success
//
//----------------------------------------------------------------------------
DWORD CMemberCheck::IsMemberOf(IN  PTRUSTEE_NODE  pTrusteeNode,
                               OUT PBOOL          pfIsMemberOf)
{
    acDebugOut((DEB_TRACE, "In CMemberCheck::IsMemberOf\n"));
    DWORD   dwErr = ERROR_SUCCESS;

    if(RtlEqualSid(pTrusteeNode->pSid, &WORLD_SID) == TRUE)
    {
        *pfIsMemberOf = TRUE;
    }
    else if(RtlEqualSid(_pCurrentNode->pSid, pTrusteeNode->pSid) == TRUE)
    {
        //
        // If they're the same sid, they're bound to be a member of eachother
        //
        *pfIsMemberOf = TRUE;
    }
    else if(pTrusteeNode->SidType == SidTypeGroup)
    {
        //
        // We'll have to look it up, and check for group membership
        //
        dwErr = CheckGroup(pTrusteeNode->pSid,
                           pfIsMemberOf, 
                           1);
    }
    else if(pTrusteeNode->SidType == SidTypeAlias)
    {
        //
        // We'll have to expand the alias and look
        //
        dwErr = CheckAlias(pTrusteeNode->pSid,
                           pfIsMemberOf, 
                           1);
    }
    else
    {
        //
        // Well, here's something we don't know how to handle
        //
        *pfIsMemberOf = FALSE;
    }

    acDebugOut((DEB_TRACE,
                "Out CMemberCheck::IsMemberOf(%lx)(%d)\n",
                dwErr,
                *pfIsMemberOf));
    return(dwErr);
}



//+---------------------------------------------------------------------------
//
//  Member:     GetDomainName, private
//
//  Synopsis:   gets the domain name for the given sid
//
//  Arguments:  [IN  pSid]             --  Input Sid
//              [OUT ppwszDomainName]  --  To return the domain name
//
//  Returns:    ERROR_SUCCESS               --  Success
//
//----------------------------------------------------------------------------

DWORD
GetDomainName(
    IN PSID pSid,
    OUT PWSTR *ppwszDomainName
    )
{
    LPWSTR Name = NULL;
    LPWSTR RefName = NULL;
    SID_NAME_USE SidType;

    //
    // Lookup the sid and get the name for the user.
    //

    DWORD dwErr = AccLookupAccountName(
                      NULL,
                      pSid,
                      ppwszDomainName,
                      &RefName,
                      &SidType
                      );

    if (dwErr == ERROR_SUCCESS) 
    {
        //
        // The returned string is of the type "Domain\\User". Strip off the 
        // backslash to get the name of the domain.
        //

        PWSTR pwszTmp = wcschr(*ppwszDomainName, L'\\');

        if(pwszTmp != NULL)
        {
            *pwszTmp = L'\0';
        }

        //
        // We do not need this one. Free it.
        //

        AccFree(RefName);
    }

    return dwErr;
}



//+---------------------------------------------------------------------------
//
//  Member:     CMemberCheck::GetDomainInfo, private
//
//  Synopsis:   gets the domain handle for the domain of the specified account
//
//  Arguments:  [IN  pSid]          --  Input Sid
//
//  Returns:    ERROR_SUCCESS               --  Success
//              ERROR_NOT_ENOUGH_MEMORY     --  A memory allocation failed
//
//----------------------------------------------------------------------------
DWORD CMemberCheck::GetDomainInfo(IN  PSID    pSid)
{
    acDebugOut((DEB_TRACE, "In CMemberCheck::GetDomainInfo\n"));

    NTSTATUS Status = STATUS_SUCCESS;
    BOOL     fSidMatched = FALSE;
    PISID    pCheckSid;


    DWORD dwErr = LoadDLLFuncTable();
    if(dwErr != ERROR_SUCCESS)
    {
        return(dwErr);
    }

    //
    // allocate a spare sid so we can grovel in it for the domain id
    //
    pCheckSid = (PISID)AccAlloc(RtlLengthSid(pSid));
    if(pCheckSid != NULL)
    {
        Status = RtlCopySid(RtlLengthSid(pSid),
                                         pCheckSid,
                                         pSid);
        if(NT_SUCCESS(Status))
        {

            //
            // make it the domain identifier 
            //
            if(pCheckSid->SubAuthorityCount > 1)
            {
                --(pCheckSid->SubAuthorityCount);
            }

            //
            // if we already have a domain sid, check it against the input sid
            //
            if(_pDomainSid != NULL)
            {
                if(RtlEqualSid(pCheckSid, _pDomainSid))
                {
                    //
                    // in this case we are all done.
                    //
                    AccFree(pCheckSid);
                    pCheckSid = NULL;
                    fSidMatched = TRUE;
                }
            }


            if ( fSidMatched == FALSE)
            {
                PDOMAIN_CONTROLLER_INFO DomainInfo = NULL;

                //
                // Free the current sid
                //
                AccFree(_pDomainSid);
                _pDomainSid = NULL;

                if(_hDomain)
                {
                    (*DLLFuncs.PSamCloseHandle)(_hDomain);
                    _hDomain = NULL;
                }

                SAM_HANDLE      hSam = NULL;

                PWSTR pwszDomainName = NULL;

                dwErr = GetDomainName(pSid, &pwszDomainName);

                if(dwErr == ERROR_SUCCESS)
                {
                    //
                    // If we know the domain name of the input sid, check for
                    // well known, and local names
                    //
                    if(pwszDomainName != NULL)
                    {
                        WCHAR wszStringBuffer[256];

                        if (!LoadString(ghDll,
                                   ACCPROV_BUILTIN,
                                   wszStringBuffer,
                                   sizeof( wszStringBuffer ) / sizeof( WCHAR ))
                                   ) {
                            wszStringBuffer[0] = L'\0';
                        }

                        if(_wcsicmp(pwszDomainName,
                                    wszStringBuffer) != 0)
                        {
                            if (!LoadString(ghDll,
                                       ACCPROV_NTAUTHORITY,
                                       wszStringBuffer,
                                       sizeof( wszStringBuffer ) / sizeof( WCHAR ))
                                       ) {
                                wszStringBuffer[0] = L'\0';
                            }

                            if(_wcsicmp(pwszDomainName,
                                        wszStringBuffer) != 0)
                            {
                                if(_wcsicmp(_wszComputerName,
                                          pwszDomainName) != 0)
                                {
                                    dwErr = DsGetDcName(NULL, pwszDomainName, NULL, NULL, 0, &DomainInfo);
                                }
                            }
                        }
                    }


                    if(dwErr == ERROR_SUCCESS)
                    {
                        UNICODE_STRING UnicodeString = {0};
                        
                        if (DomainInfo != NULL)
                        {
                            RtlInitUnicodeString(&UnicodeString, DomainInfo->DomainControllerName);
                        }

                        OBJECT_ATTRIBUTES ObjAttrib;
                        Status = (*DLLFuncs.PSamConnect)(
                                       DomainInfo ? &UnicodeString : NULL,
                                       &hSam,
                                       GENERIC_EXECUTE,
                                       &ObjAttrib);


                        if(NT_SUCCESS(Status))
                        {
                            //
                            // open the domain
                            //
                            Status = (*DLLFuncs.PSamOpenDomain)(
                                                hSam,
                                                GENERIC_READ | DOMAIN_LOOKUP,
                                                pCheckSid,
                                                &_hDomain);

                            (*DLLFuncs.PSamCloseHandle)(hSam);
                        }

                        dwErr = RtlNtStatusToDosError(Status);
                    }

                       
                    if (DomainInfo)
                    {
                        NetApiBufferFree(DomainInfo);
                        DomainInfo = NULL;
                    }

                    AccFree(pwszDomainName);

                    if(dwErr == ERROR_SUCCESS)
                    {
                        //
                        // We have a new DomainSid
                        //
                        _pDomainSid = pCheckSid;
                        pCheckSid = NULL;
                    }
                }
            }
        }
        else
        {
            dwErr = RtlNtStatusToDosError(Status);
        }
    }
    else
    {
        dwErr = ERROR_NOT_ENOUGH_MEMORY;
    }

    if (pCheckSid != NULL) 
    {
        AccFree(pCheckSid);
    }

    acDebugOut((DEB_TRACE, "Out CMemberCheck::_GetDomainInfo: %lu\n",
               dwErr));

    return(dwErr);
}
//+---------------------------------------------------------------------------
//
//  Member:     CMemberCheck::CheckDomainUsers, private
//
//  Synopsis:   Checks if the Group is Domain Users and if the Users Domain sid
//              is the same as that of the group.
//
//  Arguments:  [IN  pSid]          --  Input Sid
//              [OUT pfIsMemberOf]          --  Where the results are returned.
//                                              Is TRUE if the current SID
//                                              is a member of the input SID
//                                              group.
//              [OUT pbQuitEarly]          --  Is TRUE if the group is Domain Users
//
//  Returns:    ERROR_SUCCESS               --  Success
//
//----------------------------------------------------------------------------
DWORD CMemberCheck::CheckDomainUsers(IN  PSID  pSid,
                                     OUT PBOOL pfIsMemberOf, 
                                     OUT PBOOL pbQuitEarly)
{
    DWORD Rid = ((PISID) pSid)->SubAuthority[((PISID) pSid)->SubAuthorityCount-1];
    BOOL b = FALSE;
    BOOL bEqual = FALSE;
    SAM_HANDLE hUser = 0;
    PUCHAR Buffer = NULL;
    NTSTATUS status = STATUS_SUCCESS;

    if (Rid != DOMAIN_GROUP_RID_USERS)
    {
        //
        // No need to do anything. Just return.
        //

        return ERROR_SUCCESS;
    }

    //
    // Since it is domain users we will quit early.
    //

    *pbQuitEarly = TRUE;

    b = EqualDomainSid(pSid, _pCurrentNode->pSid, &bEqual);

    //
    // ERROR_NON_DOMAIN_SID is returned for wellknown sids.
    // It is ok to ignore this error and continue.
    //

    if ((b == FALSE) && (GetLastError() != ERROR_NON_DOMAIN_SID))
    {
        return GetLastError();
    }

    //
    // If the domains do not match, return FALSE.
    //

    if (!bEqual)
    {
        return ERROR_SUCCESS;
    }

    //
    // Get the Rid for the user.
    //

    DWORD dwRelativeId = *RtlSubAuthoritySid(
                             _pCurrentNode->pSid,
                             *RtlSubAuthorityCountSid(_pCurrentNode->pSid) - 1
                             );

    //
    // Open the user for read.
    //
    
    status = SamOpenUser(
                 _hDomain,
                 USER_READ_GENERAL,
                 dwRelativeId,
                 &hUser
                 );
    
    if (!NT_SUCCESS(status))
    {
        return RtlNtStatusToDosError(status);
    }
    
    //
    // Get the primary group information for the user.
    //
    
    status = SamQueryInformationUser(
                 hUser,
                 UserPrimaryGroupInformation,
                 (PVOID *) &Buffer
                 );

    SamCloseHandle(hUser);

    if (!NT_SUCCESS(status))
    {
        return RtlNtStatusToDosError(status);
    }

    //
    // If the primary group matched then return TRUE.
    //

    if (DOMAIN_GROUP_RID_USERS == ((USER_PRIMARY_GROUP_INFORMATION *) Buffer)->PrimaryGroupId)
    {
        *pfIsMemberOf = TRUE;
    }

    (VOID) SamFreeMemory(Buffer);

    return ERROR_SUCCESS;
}

//+---------------------------------------------------------------------------
//
//  Member:     CMemberCheck::CheckGroup, private
//
//  Synopsis:   Checks if the objects account is in the specifed group
//              account
//
//  Arguments:  [IN  pSid]                  --  Input Sid
//              [OUT pfIsMemberOf]          --  Where the results are returned.
//                                              Is TRUE if the current SID
//                                              is a member of the input SID
//                                              group.
//              [IN RecursionCount]         -- Recursion level 
//
//  Returns:    ERROR_SUCCESS               --  Success
//
//----------------------------------------------------------------------------
DWORD CMemberCheck::CheckGroup(IN  PSID  pSid,
                               OUT PBOOL pfIsMemberOf,
                               IN  DWORD RecursionCount)
{
    acDebugOut((DEB_TRACE, "In CMemberCheck::CheckGroup\n"));
    NTSTATUS    Status;
    SAM_HANDLE  hSam = NULL;
    ULONG       rid = ((PISID)(pSid))->SubAuthority[
                         ((PISID)(pSid))->SubAuthorityCount-1];
    BYTE LocalBuffer[8 + 4 * SID_MAX_SUB_AUTHORITIES];
    PISID LocalSid = (PISID) LocalBuffer;
    PULONG      attributes = NULL;
    PULONG      Members = NULL;
    ULONG       cMembers;
    DWORD       dwErr;
    BOOL bQuitEarly = FALSE;

    *pfIsMemberOf = FALSE;

    if (RecursionCount > MARTA_MAX_RECURSION_COUNT)
    {
        return ERROR_CIRCULAR_DEPENDENCY;
    }

    dwErr = LoadDLLFuncTable();
    if (dwErr != ERROR_SUCCESS)
    {
        acDebugOut((DEB_TRACE, "Out CMemberCheck::CheckGroup: %lu\n", dwErr));
        return(dwErr);
    }

    dwErr = GetDomainInfo(pSid);
    if(dwErr != ERROR_SUCCESS)
    {
        acDebugOut((DEB_TRACE, "Out CMemberCheck::CheckGroup: %lu\n", dwErr));
        return(dwErr);
    }

    Status = RtlCopySid(RtlLengthSid(_pDomainSid), LocalSid, _pDomainSid);

    if(!NT_SUCCESS(Status))
    {
        return RtlNtStatusToDosError(Status);
    }

    //
    // Special case the Domain Users sid.
    //

    dwErr = CheckDomainUsers(pSid, pfIsMemberOf, &bQuitEarly);
  
    if (dwErr != ERROR_SUCCESS)
    {
        return(dwErr);
    }
 
    if (bQuitEarly)
    {
        //
        // We are looking at Domain Users group. No need to enumerate this one.
        //

        return ERROR_SUCCESS;
    }             

    //
    // open the group
    //
    Status = (*DLLFuncs.PSamOpenGroup)(_hDomain,
                                       GENERIC_READ,
                                       rid,
                                       &hSam);
    if(NT_SUCCESS(Status))
    {
        //
        // Get the members
        //
        Status = (*DLLFuncs.PSamGetMembersInGroup)(hSam,
                                                   &Members,
                                                   &attributes,
                                                   &cMembers);
        if(NT_SUCCESS(Status) && cMembers )
        {
            //
            // ugly sid rid twiddling
            //
            ++(LocalSid->SubAuthorityCount);

            //
            // loop thru the members and check if the user sid is an immediate
            // member.
            //
            for (ULONG iIndex = 0; iIndex < cMembers; iIndex++ )
            {
                //
                // Plug the rid into the sid
                //
                LocalSid->SubAuthority[LocalSid->SubAuthorityCount-1] =
                        Members[iIndex];

                //
                // and compare
                //
                if(RtlEqualSid(_pCurrentNode->pSid,LocalSid) == TRUE)
                {
                    *pfIsMemberOf = TRUE;
                    break;
                }
            }

            //
            // If we did not match the sid, enumerate recursively.
            //

            if (*pfIsMemberOf == FALSE)
            {
                ULONG SidLength = RtlLengthSid(LocalSid);
                ULONG TotalSize = cMembers * (sizeof(PSID) + SidLength);
                PUCHAR Buffer = NULL;
                PSID *Sids = NULL;


                //
                // Allocate memory to hold the sid array.
                //

                Buffer = (PUCHAR) AccAlloc(TotalSize);
                Sids = (PSID *) Buffer; 

                if (Sids != NULL)
                {
                    PLSA_TRANSLATED_NAME Names = NULL;
                    Buffer += (sizeof(PSID) * cMembers);

                    //
                    // Copy the sids into the allocated array.
                    //

                    for (ULONG iIndex = 0; iIndex < cMembers; iIndex++ )
                    {
                        Sids[iIndex] = Buffer;
                        Buffer += SidLength;

                        LocalSid->SubAuthority[LocalSid->SubAuthorityCount-1] =
                                Members[iIndex];

                        Status = RtlCopySid(SidLength, Sids[iIndex], LocalSid);

                        if (!NT_SUCCESS( Status ))
                        {
                            break;
                        }

                    }

                    if (NT_SUCCESS( Status ))
                    {

                        //
                        // Do a single lookup and get the types of the sids 
                        // in the group.
                        //

                        dwErr = GetSidTypeMultiple(
                                     cMembers,
                                     Sids,
                                     &Names
                                     );

                        if (dwErr == ERROR_SUCCESS)
                        {
                            //
                            // Loop thru the sids and call the recursive routines
                            // if the sidtype is a group or alias.
                            // 

                            for (ULONG iIndex = 0; iIndex < cMembers; iIndex++ )
                            {
                                if (Names[iIndex].Use == SidTypeGroup)
                                {
                                    dwErr = CheckGroup(Sids[iIndex], pfIsMemberOf, RecursionCount+1);

                                    if (dwErr != ERROR_SUCCESS)
                                    {
                                        break;
                                    }

                                    if (*pfIsMemberOf == TRUE)
                                    {
                                        //
                                        // We have a match. There is no need to
                                        // enumerate any more.
                                        //

                                        break;
                                    }
                                }
                                else if (Names[iIndex].Use == SidTypeAlias)
                                {
                                    dwErr = CheckAlias(Sids[iIndex], pfIsMemberOf, RecursionCount+1);

                                    if (dwErr != ERROR_SUCCESS)
                                    {
                                        break;
                                    }

                                    if (*pfIsMemberOf == TRUE)
                                    {
                                        //
                                        // We have a match. There is no need to
                                        // enumerate any more.
                                        //

                                        break;
                                    }
                                }
                            }

                            (VOID) LsaFreeMemory(Names);
                        }
                    }

                    AccFree(Sids);
                }
                else
                {
                    Status = STATUS_NO_MEMORY;
                }
            }

        }

        if (attributes != NULL)
        {
            LocalFree(attributes);
            attributes = NULL;
        }

        if (Members != NULL)
        {
            LocalFree(Members);
            Members = NULL;
        }

        (*DLLFuncs.PSamCloseHandle)(hSam);
    }

    if(!NT_SUCCESS(Status))
    {
        dwErr = RtlNtStatusToDosError(Status);
    }

    acDebugOut((DEB_TRACE, "Out CMemberCheck::CheckGroup: %lu\n", dwErr));
    return(dwErr);
}

//+---------------------------------------------------------------------------
//
//  Member:     CMemberCheck::GetSidType, private
//
//  Synopsis:   Returns the type of the Sid
//
//  Arguments:  [IN  pSid]         --  Input Sid
//              [OUT pSidType]     --  Returns the type of Sid.
//
//  Returns:    ERROR_SUCCESS               --  Success
//
//----------------------------------------------------------------------------
DWORD CMemberCheck::GetSidType(
    IN PSID Sid,
    OUT SID_NAME_USE *pSidType)
{
    LPWSTR Name = NULL;
    LPWSTR DomainName = NULL;
    DWORD dwErr;

    dwErr = AccLookupAccountName(NULL,
                                 Sid,
                                 &Name,
                                 &DomainName,
                                 pSidType);

    if (dwErr == ERROR_SUCCESS)
    {
        AccFree(Name);
        AccFree(DomainName);
    }

    return dwErr;
    
}

//+---------------------------------------------------------------------------
//
//  Member:     CMemberCheck::GetSidTypeMultiple, private
//
//  Synopsis:   Returns the tanslated names of the Sids
//
//  Arguments:  [IN  Count]        --  Number of sids
//              [IN  pSid]         --  Input Sid
//              [OUT pNames]       --  Returns lsa names structure
//
//  Returns:    ERROR_SUCCESS               --  Success
//
//----------------------------------------------------------------------------
DWORD CMemberCheck::GetSidTypeMultiple(
    IN LONG Count,
    IN PSID *Sids,
    OUT PLSA_TRANSLATED_NAME *pNames
    )
{
    OBJECT_ATTRIBUTES ObjectAttributes;
    LSA_HANDLE PolicyHandle;
    PLSA_REFERENCED_DOMAIN_LIST ReferencedDomains;
    PLSA_TRANSLATED_NAME Names = NULL;
    SECURITY_QUALITY_OF_SERVICE SecurityQualityOfService;
    NTSTATUS Status;
    NTSTATUS TmpStatus;

    *pNames = NULL;

    SecurityQualityOfService.Length = sizeof(SECURITY_QUALITY_OF_SERVICE);
    SecurityQualityOfService.ImpersonationLevel = SecurityImpersonation;
    SecurityQualityOfService.ContextTrackingMode = SECURITY_DYNAMIC_TRACKING;
    SecurityQualityOfService.EffectiveOnly = FALSE;

    //
    // Set up the object attributes prior to opening the LSA.
    //

    InitializeObjectAttributes(
        &ObjectAttributes,
        NULL,
        0L,
        NULL,
        NULL
        );

    //
    // The InitializeObjectAttributes macro presently stores NULL for
    // the SecurityQualityOfService field, so we must manually copy that
    // structure for now.
    //

    ObjectAttributes.SecurityQualityOfService = &SecurityQualityOfService;

    Status = LsaOpenPolicy(
                 NULL,
                 &ObjectAttributes,
                 POLICY_LOOKUP_NAMES,
                 &PolicyHandle
                 );

    if ( !NT_SUCCESS( Status )) {
        return RtlNtStatusToDosError(Status);
    }

    Status = LsaLookupSids(
                 PolicyHandle,
                 Count,
                 Sids,
                 &ReferencedDomains,
                 &Names
                 );

    TmpStatus = LsaClose( PolicyHandle );

    //
    // If an error was returned, check specifically for STATUS_NONE_MAPPED.
    // In this case, we may need to dispose of the returned Referenced Domain
    // List and Names structures.  For all other errors, LsaLookupSids()
    // frees these structures prior to exit.
    //

    if ( !NT_SUCCESS( Status )) {

        if (Status == STATUS_NONE_MAPPED) {

            if (ReferencedDomains != NULL) {

                TmpStatus = LsaFreeMemory( ReferencedDomains );
                ASSERT( NT_SUCCESS( TmpStatus ));
            }

            if (Names != NULL) {

                TmpStatus = LsaFreeMemory( Names );
                ASSERT( NT_SUCCESS( TmpStatus ));
            }
        }


        return RtlNtStatusToDosError(Status);
    }

    if (ReferencedDomains != NULL) {

        Status = LsaFreeMemory( ReferencedDomains );
        ASSERT( NT_SUCCESS( Status ));
    }

    *pNames = Names;

    return ERROR_SUCCESS;
}

//+---------------------------------------------------------------------------
//
//  Member:     CMemberCheck::CheckAlias, private
//
//  Synopsis:   checks if the objects account is in the specifed alias account
//
//  Arguments:  [IN  pSid]                  --  Input Sid
//              [OUT pfIsMemberOf]          --  Where the results are returned.
//                                              Is TRUE if the current SID
//                                              is a member of the input SID
//                                              group.
//              [IN RecursionCount]         -- Recursion level 
//
//  Returns:    ERROR_SUCCESS               --  Success
//
//----------------------------------------------------------------------------
DWORD CMemberCheck::CheckAlias(IN  PSID  pSid,
                               OUT PBOOL          pfIsMemberOf,
                               IN DWORD RecursionCount)
{
    acDebugOut((DEB_TRACE, "In CMemberCheck::CheckAlias\n"));
    NTSTATUS    Status;
    SAM_HANDLE  hSam = NULL;
    ULONG       rid = ((PISID)(pSid))->SubAuthority[
                         ((PISID)(pSid))->SubAuthorityCount-1];
    ULONG_PTR * Members;
    ULONG       cMembers;
    DWORD       dwErr;

    *pfIsMemberOf = FALSE;

    if (RecursionCount > MARTA_MAX_RECURSION_COUNT)
    {
        return ERROR_CIRCULAR_DEPENDENCY;
    }

    dwErr = LoadDLLFuncTable();
    if (dwErr != ERROR_SUCCESS)
    {
        acDebugOut((DEB_TRACE, "Out CMemberCheck::CheckGroup: %lu\n", dwErr));
        return(dwErr);
    }

    dwErr = GetDomainInfo(pSid);
    if(dwErr != ERROR_SUCCESS)
    {
        acDebugOut((DEB_TRACE, "Out CMemberCheck::CheckGroup: %lu\n", dwErr));
        return(dwErr);
    }


    //
    // open the alias
    //
    Status = (*DLLFuncs.PSamOpenAlias)(_hDomain,
                                       GENERIC_READ,
                                       rid,
                                       &hSam);
    if(NT_SUCCESS(Status))
    {
        //
        // get the members
        //
        Status = (*DLLFuncs.PSamGetMembersInAlias)(hSam,
                                                  (void ***)&Members,
                                                  &cMembers);
        if(NT_SUCCESS(Status) && cMembers)
        {
            //
            // loop thru the members
            //
            for (ULONG iIndex = 0; iIndex < cMembers; iIndex++)
            {
                if(RtlEqualSid(_pCurrentNode->pSid,
                              ((SID **)(Members))[iIndex]) == TRUE)
                {
                    *pfIsMemberOf = TRUE;
                    break;
                }

            }

            //
            // If we did not match the sid, enumerate recursively.
            //

            if (*pfIsMemberOf == FALSE)
            {
                PLSA_TRANSLATED_NAME Names = NULL;

                //
                // Do a single lookup and get the types of the sids 
                // in the group.
                //

                dwErr = GetSidTypeMultiple(
                             cMembers,
                             (PSID *) Members,
                             &Names
                             );

                if (dwErr == ERROR_SUCCESS)
                {
                    //
                    // Loop thru the sids and call the recursive routines
                    // if the sidtype is a group or an alias.
                    // 

                    for (ULONG iIndex = 0; iIndex < cMembers; iIndex++ )
                    {
                        if (Names[iIndex].Use == SidTypeGroup)
                        {
                            dwErr = CheckGroup(((SID **) (Members))[iIndex], pfIsMemberOf, RecursionCount+1);

                            if (dwErr != ERROR_SUCCESS)
                            {
                                break;
                            }

                            if (*pfIsMemberOf == TRUE)
                            {
                                //
                                // We have a match. There is no need to
                                // enumerate any more.
                                //

                                break;
                            }
                        }
                        else if (Names[iIndex].Use == SidTypeAlias)
                        {
                            dwErr = CheckAlias(((SID **) (Members))[iIndex], pfIsMemberOf, RecursionCount+1);

                            if (dwErr != ERROR_SUCCESS)
                            {
                                break;
                            }

                            if (*pfIsMemberOf == TRUE)
                            {
                                //
                                // We have a match. There is no need to
                                // enumerate any more.
                                //

                                break;
                            }
                        }
                    }

                    (VOID) LsaFreeMemory(Names);
                }
            }

            if(cMembers > 0)
            {
                LocalFree(Members);
            }
        }

        (*DLLFuncs.PSamCloseHandle)(hSam);
    }

    if(!NT_SUCCESS(Status))
    {
        dwErr = RtlNtStatusToDosError(Status);
    }

    acDebugOut((DEB_TRACE, "Out CMemberCheck::CheckGroup: %lu\n", dwErr));
    return(dwErr);
}