/*

 * adcli

 *

 * Copyright (C) 2012 Red Hat Inc.

 *

 * This program is free software; you can redistribute it and/or modify

 * it under the terms of the GNU Lesser General Public License as

 * published by the Free Software Foundation; either version 2.1 of

 * the License, or (at your option) any later version.

 *

 * This program is distributed in the hope that it will be useful, but

 * WITHOUT ANY WARRANTY; without even the implied warranty of

 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

 * Lesser General Public License for more details.

 *

 * You should have received a copy of the GNU Lesser General Public

 * License along with this program; if not, write to the Free Software

 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston,

 * MA 02110-1301 USA

 *

 * Author: Stef Walter <stefw@gnome.org>

 */

#include "config.h"

#include "adenroll.h"

#include "adprivate.h"

#include "seq.h"

#include <gssapi/gssapi_krb5.h>

#include <krb5/krb5.h>

#include <ldap.h>

#include <sasl/sasl.h>

#include <sys/types.h>

#include <sys/socket.h>

#include <assert.h>

#include <ctype.h>

#include <errno.h>

#include <netdb.h>

#include <stdio.h>

#include <unistd.h>

#include <sys/stat.h>

#include <fcntl.h>

#ifndef SAMBA_DATA_TOOL

#define SAMBA_DATA_TOOL "/usr/bin/net"

#endif

static krb5_enctype v60_later_enctypes_fips[] = {

	ENCTYPE_AES256_CTS_HMAC_SHA1_96,

	ENCTYPE_AES128_CTS_HMAC_SHA1_96,

	0

};

static krb5_enctype v60_later_enctypes[] = {

	ENCTYPE_AES256_CTS_HMAC_SHA1_96,

	ENCTYPE_AES128_CTS_HMAC_SHA1_96,

	ENCTYPE_DES3_CBC_SHA1,

	ENCTYPE_ARCFOUR_HMAC,

	ENCTYPE_DES_CBC_MD5,

	ENCTYPE_DES_CBC_CRC,

	0

};

static krb5_enctype v51_earlier_enctypes[] = {

	ENCTYPE_DES_CBC_CRC,

	ENCTYPE_DES_CBC_MD5,

	ENCTYPE_ARCFOUR_HMAC,

	0

};

/* The following list containst all attributes handled by adcli, some are

 * read-only and the others can be written as well. To properly document the

 * required permissions each attribute which adcli tries to modify should have

 * a comment starting with ':ADPermissions:' and the related permissions in AD

 * on the same line. Multiple permissions can be seperated with a '*'. For all

 * other attribute a suitable comment is very welcome. */

static char *default_ad_ldap_attrs[] =  {

	"sAMAccountName", /* Only set during creation */

	"userPrincipalName",   /* :ADPermissions: Read/Write userPrincipal Name */

	"msDS-KeyVersionNumber", /* Manages by AD */

	"msDS-supportedEncryptionTypes", /* :ADPermissions: Read/Write msDS-SupportedEncryptionTypes */

	"dNSHostName", /* :ADPermissions: Read/Write dNSHostName * Read and write DNS host name attributes * Validated write to DNS host name */

	"servicePrincipalName", /* :ADPermissions: Read/Write servicePrincipalName * Validated write to service principal name */

	"operatingSystem", /* :ADPermissions: Read/Write Operating System */

	"operatingSystemVersion", /* :ADPermissions: Read/Write Operating System Version */

	"operatingSystemServicePack", /* :ADPermissions: Read/Write operatingSystemServicePack */

	"pwdLastSet", /* Managed by AD */

	"userAccountControl", /* :ADPermissions: Read/Write userAccountControl */

	"description", /* :ADPermissions: Read/Write Description */

	NULL,

};

/* Some constants for the userAccountControl AD LDAP attribute, see e.g.

 * https://support.microsoft.com/en-us/help/305144/how-to-use-the-useraccountcontrol-flags-to-manipulate-user-account-pro

 * for details. */

#define UAC_WORKSTATION_TRUST_ACCOUNT  0x1000

#define UAC_DONT_EXPIRE_PASSWORD      0x10000

#define UAC_TRUSTED_FOR_DELEGATION    0x80000

struct _adcli_enroll {

	int refs;

	adcli_conn *conn;

	bool is_service;

	bool is_service_explicit;

	char *host_fqdn;

	int host_fqdn_explicit;

	char *computer_name;

	int computer_name_explicit;

	char *computer_sam;

	char *computer_password;

	int computer_password_explicit;

	int reset_password;

	krb5_principal computer_principal;

	char *domain_ou;

	int domain_ou_validated;

	int domain_ou_explicit;

	char *computer_dn;

	char *computer_container;

	LDAPMessage *computer_attributes;

	char **service_names;

	char **service_principals;

	int service_principals_explicit;

	char **service_principals_to_add;

	char **service_principals_to_remove;

	char *user_principal;

	int user_princpal_generate;

	char *os_name;

	int os_name_explicit;

	char *os_version;

	int os_version_explicit;

	char *os_service_pack;

	int os_service_pack_explicit;

	krb5_kvno kvno;

	char *keytab_name;

	int keytab_name_is_krb5;

	krb5_keytab keytab;

	krb5_principal *keytab_principals;

	krb5_enctype *keytab_enctypes;

	int keytab_enctypes_explicit;

	unsigned int computer_password_lifetime;

	int computer_password_lifetime_explicit;

	char *samba_data_tool;

	bool trusted_for_delegation;

	int trusted_for_delegation_explicit;

	char *description;

};

static const char *

s_or_c (adcli_enroll *enroll)

{

	return enroll->is_service ? "service" : "computer";

}

static void

check_if_service (adcli_enroll *enroll,

                  LDAP *ldap,

                  LDAPMessage *results)

{

	char **objectclasses = NULL;

	objectclasses = _adcli_ldap_parse_values (ldap, results, "objectClass");

	enroll->is_service = _adcli_strv_has_ex (objectclasses,

	                                         "msDS-ManagedServiceAccount",

	                                         strcasecmp) == 1 ? true : false;

	_adcli_strv_free (objectclasses);

}

static adcli_result

ensure_host_fqdn (adcli_result res,

                  adcli_enroll *enroll)

{

	const char *fqdn;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->host_fqdn) {

		_adcli_info ("Using fully qualified name: %s",

		             enroll->host_fqdn);

		return ADCLI_SUCCESS;

	}

	if (enroll->host_fqdn_explicit) {

		_adcli_info ("Not setting fully qualified name");

		return ADCLI_SUCCESS;

	}

	/* By default use our actual host name discovered during connecting */

	fqdn = adcli_conn_get_host_fqdn (enroll->conn);

	_adcli_str_set (&enroll->host_fqdn, fqdn);

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_computer_name (adcli_result res,

                      adcli_enroll *enroll)

{

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->computer_name) {

		_adcli_info ("Enrolling %s name: %s",

		             s_or_c (enroll),

		             enroll->computer_name);

		return ADCLI_SUCCESS;

	}

	if (!enroll->host_fqdn) {

		_adcli_err ("No host name from which to determine the %s name",

		            s_or_c (enroll));

		return ADCLI_ERR_CONFIG;

	}

	enroll->computer_name = _adcli_calc_netbios_name (enroll->host_fqdn);

	if (enroll->computer_name == NULL)

		return ADCLI_ERR_CONFIG;

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_computer_sam (adcli_result res,

                     adcli_enroll *enroll)

{

	krb5_error_code code;

	krb5_context k5;

	if (res != ADCLI_SUCCESS)

		return res;

	free (enroll->computer_sam);

	enroll->computer_sam = NULL;

	if (asprintf (&enroll->computer_sam, "%s$", enroll->computer_name) < 0)

		return_unexpected_if_fail (enroll->computer_sam != NULL);

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_unexpected_if_fail (k5 != NULL);

	if (enroll->computer_principal)

		krb5_free_principal (k5, enroll->computer_principal);

	enroll->computer_principal = NULL;

	code = _adcli_krb5_build_principal (k5, enroll->computer_sam,

	                                    adcli_conn_get_domain_realm (enroll->conn),

	                                    &enroll->computer_principal);

	return_unexpected_if_fail (code == 0);

	return ADCLI_SUCCESS;

}

static int

filter_password_chars (char *password,

                       int length)

{

	int i, j;

	/*

	 * The MS documentation says their servers only use ASCII characters

	 * between 32 and 122 inclusive. We do that as well, and filter out

	 * all other random characters. We also remove certain characters

	 * special for use in a shell.

	 */

	for (i = 0, j = 0; i < length; i++) {

		if (password[i] >= 32 && password[i] <= 122 &&

		    strchr (" !'\"$`", password[i]) == NULL)

			password[j++] = password[i];

	}

	/* return the number of valid characters remaining */

	return j;

}

static char *

generate_host_password  (adcli_enroll *enroll,

                         size_t length)

{

	char *password;

	krb5_context k5;

	krb5_error_code code;

	krb5_data buffer;

	int at;

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_val_if_fail (k5 != NULL, NULL);

	password = malloc (length + 1);

	return_val_if_fail (password != NULL, NULL);

	at = 0;

	while (at != length) {

		buffer.length = length - at;

		buffer.data = password + at;

		code = krb5_c_random_make_octets (k5, &buffer);

		return_val_if_fail (code == 0, NULL);

		at += filter_password_chars (buffer.data, buffer.length);

		assert (at <= length);

	}

	/* This null termination works around a bug in krb5 */

	password[length] = '\0';

	return password;

}

static adcli_result

ensure_computer_password (adcli_result res,

                      adcli_enroll *enroll)

{

	const int length = 120;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->computer_password)

		return ADCLI_SUCCESS;

	if (enroll->reset_password) {

		assert (enroll->computer_name != NULL);

		enroll->computer_password = _adcli_calc_reset_password (enroll->computer_name);

		return_unexpected_if_fail (enroll->computer_password != NULL);

		_adcli_info ("Using default reset computer password");

	} else {

		enroll->computer_password = generate_host_password (enroll, length);

		return_unexpected_if_fail (enroll->computer_password != NULL);

		_adcli_info ("Generated %d character computer password", length);

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_default_service_names (adcli_enroll *enroll)

{

	int length = 0;

	if (enroll->service_names != NULL) {

		length = seq_count (enroll->service_names);

		/* Make sure there is no entry with an unexpected case. AD

		 * would not care but since the client side is case-sensitive

		 * we should make sure we use the expected spelling. */

		seq_remove_unsorted (enroll->service_names,

		                     &length, "host",

		                     (seq_compar)strcasecmp, free);

		seq_remove_unsorted (enroll->service_names,

		                     &length, "RestrictedKrbHost",

		                     (seq_compar)strcasecmp, free);

	}

	/* The default ones specified by MS */

	enroll->service_names = _adcli_strv_add (enroll->service_names,

	                                         strdup ("host"), &length);

	enroll->service_names = _adcli_strv_add (enroll->service_names,

	                                         strdup ("RestrictedKrbHost"), &length);

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_service_names (adcli_result res,

                      adcli_enroll *enroll)

{

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->service_names || enroll->service_principals)

		return ADCLI_SUCCESS;

	return ensure_default_service_names (enroll);

}

static adcli_result

add_service_names_to_service_principals (adcli_enroll *enroll)

{

	char *name;

	int length = 0;

	int i;

	if (enroll->service_principals != NULL) {

		length = seq_count (enroll->service_principals);

	}

	for (i = 0; enroll->service_names[i] != NULL; i++) {

		if (asprintf (&name, "%s/%s", enroll->service_names[i], enroll->computer_name) < 0)

			return_unexpected_if_reached ();

		enroll->service_principals = _adcli_strv_add_unique (enroll->service_principals,

		                                                     name, &length, false);

		if (enroll->host_fqdn) {

			if (asprintf (&name, "%s/%s", enroll->service_names[i], enroll->host_fqdn) < 0)

				return_unexpected_if_reached ();

			enroll->service_principals = _adcli_strv_add_unique (enroll->service_principals,

			                                                     name, &length, false);

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

add_and_remove_service_principals (adcli_enroll *enroll)

{

	int length = 0;

	size_t c;

	const char **list;

	if (enroll->service_principals != NULL) {

		length = seq_count (enroll->service_principals);

	}

	list = adcli_enroll_get_service_principals_to_add (enroll);

	if (list != NULL) {

		for (c = 0; list[c] != NULL; c++) {

			enroll->service_principals = _adcli_strv_add_unique (enroll->service_principals,

			                                                     strdup (list[c]),

			                                                     &length, false);

			if (enroll->service_principals == NULL) {

				return ADCLI_ERR_UNEXPECTED;

			}

		}

	}

	list = adcli_enroll_get_service_principals_to_remove (enroll);

	if (list != NULL) {

		for (c = 0; list[c] != NULL; c++) {

			/* enroll->service_principals typically refects the

			 * order of the principal in the keytabm so it is not

			 * ordered. */

			_adcli_strv_remove_unsorted (enroll->service_principals,

			                             list[c], &length);

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_service_principals (adcli_result res,

                           adcli_enroll *enroll)

{

	if (res != ADCLI_SUCCESS)

		return res;

	assert (enroll->keytab_principals == NULL);

	if (!enroll->service_principals) {

		assert (enroll->service_names != NULL);

		res = add_service_names_to_service_principals (enroll);

	}

	if (res == ADCLI_SUCCESS) {

		res = add_and_remove_service_principals (enroll);

	}

	return res;

}

static void enroll_clear_keytab_principals (adcli_enroll *enroll)

{

	krb5_context k5;

	size_t c;

	if (enroll->keytab_principals) {

		k5 = adcli_conn_get_krb5_context (enroll->conn);

		return_if_fail (k5 != NULL);

		for (c = 0; enroll->keytab_principals[c] != NULL; c++)

			krb5_free_principal (k5, enroll->keytab_principals[c]);

		free (enroll->keytab_principals);

		enroll->keytab_principals = NULL;

	}

	return;

}

static adcli_result

ensure_keytab_principals (adcli_result res,

                          adcli_enroll *enroll)

{

	krb5_context k5;

	krb5_error_code code;

	int count = 0;

	int at, i;

	/* Prepare the principals we're going to add to the keytab */

	if (!enroll->is_service) {

		return_unexpected_if_fail (enroll->service_principals);

		count = _adcli_strv_len (enroll->service_principals);

	}

	k5 = adcli_conn_get_krb5_context (enroll->conn);

	return_unexpected_if_fail (k5 != NULL);

	enroll_clear_keytab_principals (enroll);

	enroll->keytab_principals = calloc (count + 3, sizeof (krb5_principal));

	return_unexpected_if_fail (enroll->keytab_principals != NULL);

	at = 0;

	/* First add the principal for the computer account name */

	code = krb5_copy_principal (k5, enroll->computer_principal,

	                            &enroll->keytab_principals[at++]);

	return_unexpected_if_fail (code == 0);

	/* Next, optionally add the user principal */

	if (enroll->user_principal) {

		code = krb5_parse_name (k5, enroll->user_principal,

		                        &enroll->keytab_principals[at++]);

		if (code != 0) {

			if (code != 0) {

				_adcli_err ("Couldn't parse kerberos user principal: %s: %s",

				            enroll->user_principal,

				            krb5_get_error_message (k5, code));

				return ADCLI_ERR_CONFIG;

			}

		}

	}

	/* Now add the principals for all the various services */

	for (i = 0; i < count; i++) {

		code = _adcli_krb5_build_principal (k5, enroll->service_principals[i],

		                                    adcli_conn_get_domain_realm (enroll->conn),

		                                    &enroll->keytab_principals[at++]);

		if (code != 0) {

			_adcli_err ("Couldn't parse kerberos service principal: %s: %s",

			            enroll->service_principals[i],

			            krb5_get_error_message (k5, code));

			return ADCLI_ERR_CONFIG;

		}

	}

	return ADCLI_SUCCESS;

}

static adcli_result

ensure_user_principal (adcli_result res,

                       adcli_enroll *enroll)

{

	char *name;

	if (res != ADCLI_SUCCESS)

		return res;

	if (enroll->user_princpal_generate) {

		name = strdup (enroll->computer_name);

		return_unexpected_if_fail (name != NULL);

		_adcli_str_down (name);

		assert (enroll->user_principal == NULL);

		if (asprintf (&enroll->user_principal, "host/%s@%s",

		              name, adcli_conn_get_domain_realm (enroll->conn)) < 0)

			return_unexpected_if_reached ();

		free (name);

	}

	if (enroll->user_principal)

		_adcli_info ("With user principal: %s", enroll->user_principal);

	return ADCLI_SUCCESS;

}

static adcli_result

lookup_computer_container (adcli_enroll *enroll,

                           LDAP *ldap)

{

	char *attrs[] = { enroll->is_service ? "otherWellKnownObjects"

	                                     : "wellKnownObjects", NULL };

	const char *prefix = enroll->is_service ? "B:32:1EB93889E40C45DF9F0C64D23BBB6237:"

	                                        : "B:32:AA312825768811D1ADED00C04FD8D5CD:";

	const char *filter = enroll->is_service ? "(&(objectClass=container)(cn=Managed Service Accounts))"

	                                        : "(&(objectClass=container)(cn=Computers))";

	int prefix_len;

	LDAPMessage *results;

	const char *base;

	char **values;

	int ret;

	int i;

	if (enroll->computer_container)

		return ADCLI_SUCCESS;

	base = enroll->domain_ou;

	if (base == NULL)

		base = adcli_conn_get_default_naming_context (enroll->conn);

	assert (base != NULL);

	ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE,

	                         "(objectClass=*)", attrs, 0, NULL, NULL,

	                         NULL, -1, &results);

	if (ret == LDAP_NO_SUCH_OBJECT && enroll->domain_ou) {

		_adcli_err ("The organizational unit does not exist: %s", enroll->domain_ou);

		return enroll->domain_ou_explicit ? ADCLI_ERR_CONFIG : ADCLI_ERR_DIRECTORY;

	} else if (ret != LDAP_SUCCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't lookup %s container: %s",

		                                   s_or_c (enroll), base);

	}

	values = _adcli_ldap_parse_values (ldap, results, attrs[0]);

	ldap_msgfree (results);

	prefix_len = strlen (prefix);

	for (i = 0; values && values[i]; i++) {

		if (strncmp (values[i], prefix, prefix_len) == 0) {

			enroll->computer_container = strdup (values[i] + prefix_len);

			return_unexpected_if_fail (enroll->computer_container != NULL);

			_adcli_info ("Found well known %s container at: %s",

			             s_or_c (enroll), enroll->computer_container);

			break;

		}

	}

	_adcli_strv_free (values);

	/* Try harder */

	if (!enroll->computer_container) {

		ret = ldap_search_ext_s (ldap, base, LDAP_SCOPE_BASE, filter,

		                         attrs, 0, NULL, NULL, NULL, -1, &results);

		if (ret == LDAP_SUCCESS) {

			enroll->computer_container = _adcli_ldap_parse_dn (ldap, results);

			if (enroll->computer_container) {

				_adcli_info ("Well known %s container not "

				             "found, but found suitable one at: %s",

				             s_or_c (enroll),

				             enroll->computer_container);

			}

		}

		ldap_msgfree (results);

	}

	if (!enroll->computer_container && enroll->domain_ou) {

		_adcli_warn ("Couldn't find a computer container in the ou, "

		             "creating computer account directly in: %s", enroll->domain_ou);

		enroll->computer_container = strdup (enroll->domain_ou);

		return_unexpected_if_fail (enroll->computer_container != NULL);

	}

	if (!enroll->computer_container) {

		_adcli_err ("Couldn't find location to create %s accounts",

		            s_or_c (enroll));

		return ADCLI_ERR_DIRECTORY;

	}

	return ADCLI_SUCCESS;

}

static adcli_result

calculate_computer_account (adcli_enroll *enroll,

                            LDAP *ldap)

{

	adcli_result res;

	assert (enroll->computer_dn == NULL);

	/* Now need to find or validate the computer container */

	res = lookup_computer_container (enroll, ldap);

	if (res != ADCLI_SUCCESS)

		return res;

	assert (enroll->computer_container);

	free (enroll->computer_dn);

	enroll->computer_dn = NULL;

	if (asprintf (&enroll->computer_dn, "CN=%s,%s", enroll->computer_name, enroll->computer_container) < 0)

		return_unexpected_if_reached ();

	_adcli_info ("Calculated %s account: %s",

	             s_or_c (enroll), enroll->computer_dn);

	return ADCLI_SUCCESS;

}

static adcli_result

calculate_enctypes (adcli_enroll *enroll, char **enctype)

{

	char *value = NULL;

	krb5_enctype *read_enctypes;

	krb5_enctype *new_enctypes;

	char *new_value = NULL;

	int is_2008_or_later;

	LDAP *ldap;

	*enctype = NULL;

	/*

	 * Because we're using a keytab we want the server to be aware of the

	 * encryption types supported on the client, because we can't dynamically

	 * use a new one that's thrown at us.

	 *

	 * If the encryption types are not explicitly set by the caller of this

	 * library, then see if the account already has some encryption types

	 * marked on it.

	 *

	 * If not, write our default set to the account.

	 *

	 * Note that Windows 2003 and earlier have a standard set of encryption

	 * types, and no msDS-supportedEncryptionTypes attribute.

	 */

	ldap = adcli_conn_get_ldap_connection (enroll->conn);

	return_unexpected_if_fail (ldap != NULL);

	is_2008_or_later = adcli_conn_server_has_capability (enroll->conn, ADCLI_CAP_V60_OID);

	/* In 2008 or later, use the msDS-supportedEncryptionTypes attribute */

	if (is_2008_or_later && enroll->computer_attributes != NULL) {

		value = _adcli_ldap_parse_value (ldap, enroll->computer_attributes,

		                                 "msDS-supportedEncryptionTypes");

		if (!enroll->keytab_enctypes_explicit && value != NULL) {

			read_enctypes = _adcli_krb5_parse_enctypes (value);

			if (read_enctypes == NULL) {

				_adcli_warn ("Invalid or unsupported encryption types are set on "

				             "the computer account (%s).", value);

			} else {

				free (enroll->keytab_enctypes);

				enroll->keytab_enctypes = read_enctypes;

			}

		}

	/* In 2003 or earlier, standard set of enc types */

	} else {

		value = _adcli_krb5_format_enctypes (v51_earlier_enctypes);

	}

	new_enctypes = adcli_enroll_get_permitted_keytab_enctypes (enroll);

	if (new_enctypes == NULL) {

		_adcli_warn ("No permitted encryption type found.");

		return ADCLI_ERR_UNEXPECTED;

	}

	new_value = _adcli_krb5_format_enctypes (new_enctypes);

	krb5_free_enctypes (adcli_conn_get_krb5_context (enroll->conn), new_enctypes);

	if (new_value == NULL) {

		free (value);

		_adcli_warn ("The encryption types desired are not available in active directory");

		return ADCLI_ERR_CONFIG;

	}

	/* If we already have this value, then don't need to update */

	if (value && strcmp (new_value, value) == 0) {

		free (value);

		free (new_value);

		return ADCLI_SUCCESS;

	}

	free (value);

	if (!is_2008_or_later) {

		free (new_value);

		_adcli_warn ("Server does not support setting encryption types");

		return ADCLI_SUCCESS;

	}

	*enctype = new_value;

	return ADCLI_SUCCESS;

}

static adcli_result

create_computer_account (adcli_enroll *enroll,

                         LDAP *ldap)

{

	char *vals_objectClass[] = { enroll->is_service ? "msDS-ManagedServiceAccount" : "computer", NULL };

	LDAPMod objectClass = { LDAP_MOD_ADD, "objectClass", { vals_objectClass, } };

	char *vals_sAMAccountName[] = { enroll->computer_sam, NULL };

	LDAPMod sAMAccountName = { LDAP_MOD_ADD, "sAMAccountName", { vals_sAMAccountName, } };

	char *vals_userAccountControl[] = { "69632", NULL }; /* WORKSTATION_TRUST_ACCOUNT | DONT_EXPIRE_PASSWD */

	LDAPMod userAccountControl = { LDAP_MOD_ADD, "userAccountControl", { vals_userAccountControl, } };

	char *vals_supportedEncryptionTypes[] = { NULL, NULL };

	LDAPMod encTypes = { LDAP_MOD_ADD, "msDS-supportedEncryptionTypes", { vals_supportedEncryptionTypes, } };

	char *vals_dNSHostName[] = { enroll->host_fqdn, NULL };

	LDAPMod dNSHostName = { LDAP_MOD_ADD, "dNSHostName", { vals_dNSHostName, } };

	char *vals_operatingSystem[] = { enroll->os_name, NULL };

	LDAPMod operatingSystem = { LDAP_MOD_ADD, "operatingSystem", { vals_operatingSystem, } };

	char *vals_operatingSystemVersion[] = { enroll->os_version, NULL };

	LDAPMod operatingSystemVersion = { LDAP_MOD_ADD, "operatingSystemVersion", { vals_operatingSystemVersion, } };

	char *vals_operatingSystemServicePack[] = { enroll->os_service_pack, NULL };

	LDAPMod operatingSystemServicePack = { LDAP_MOD_ADD, "operatingSystemServicePack", { vals_operatingSystemServicePack, } };

	char *vals_userPrincipalName[] = { enroll->user_principal, NULL };

	LDAPMod userPrincipalName = { LDAP_MOD_ADD, "userPrincipalName", { vals_userPrincipalName, }, };

	LDAPMod servicePrincipalName = { LDAP_MOD_ADD, "servicePrincipalName", { enroll->service_principals, } };

	char *vals_description[] = { enroll->description, NULL };

	LDAPMod description = { LDAP_MOD_ADD, "description", { vals_description, }, };

	char *val = NULL;

	int ret;

	size_t c;

	size_t m;

	LDAPMod *all_mods[] = {

		&objectClass,

		&sAMAccountName,

		&userAccountControl,

		&encTypes,

		&dNSHostName,

		&operatingSystem,

		&operatingSystemVersion,

		&operatingSystemServicePack,

		&userPrincipalName,

		&servicePrincipalName,

		&description,

		NULL

	};

	size_t mods_count = sizeof (all_mods) / sizeof (LDAPMod *);

	LDAPMod *mods[mods_count];

	if (adcli_enroll_get_trusted_for_delegation (enroll)) {

		vals_userAccountControl[0] = "593920"; /* WORKSTATION_TRUST_ACCOUNT | DONT_EXPIRE_PASSWD | TRUSTED_FOR_DELEGATION */

	}

	ret = calculate_enctypes (enroll, &val;;

	if (ret != ADCLI_SUCCESS) {

		return ret;

	}

	vals_supportedEncryptionTypes[0] = val;

	m = 0;

	for (c = 0; c < mods_count - 1; c++) {

		/* Skip empty LDAP sttributes */

		if (all_mods[c]->mod_vals.modv_strvals != NULL && all_mods[c]->mod_vals.modv_strvals[0] != NULL) {

			mods[m++] = all_mods[c];

		}

	}

	mods[m] = NULL;

	ret = ldap_add_ext_s (ldap, enroll->computer_dn, mods, NULL, NULL);

	free (val);

	/*

	 * Hand to head. This is really dumb... AD returns

	 * OBJECT_CLASS_VIOLATION when the 'admin' account doesn't have

	 * enough permission to create this computer account.

	 *

	 * Additionally LDAP_UNWILLING_TO_PERFORM and LDAP_CONSTRAINT_VIOLATION

	 * are seen on various Windows Servers as responses to this case.

	 *

	 * TODO: Perhaps some missing attributes are auto-generated when

	 * the administrative credentials have sufficient permissions, and

	 * those missing attributes cause the object class violation. However

	 * I've tried to screw around with this, and can't find the missing

	 * attributes. They may be hidden, like unicodePwd.

	 */

	if (ret == LDAP_INSUFFICIENT_ACCESS || ret == LDAP_OBJECT_CLASS_VIOLATION ||

	    ret == LDAP_UNWILLING_TO_PERFORM || ret == LDAP_CONSTRAINT_VIOLATION) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_CREDENTIALS,

		                                   "Insufficient permissions to modify computer account: %s",

		                                   enroll->computer_dn);

	} else if (ret != LDAP_SUCCESS) {

		return _adcli_ldap_handle_failure (ldap, ADCLI_ERR_DIRECTORY,

		                                   "Couldn't create computer account: %s",

		                                   enroll->computer_dn);

	}

	_adcli_info ("Created %s account: %s", s_or_c (enroll),

	                                       enroll->computer_dn);

	return ADCLI_SUCCESS;

}