MS-SAMR missing SID name use type ?

[ronnie sahlberg]

Hi,

I am a pfif subcontractor.

The IDL in MS-SAMR describes the types of sids as :

typedef enum _SID_NAME_USE {
    SidTypeUser = 1,
    SidTypeGroup,
    SidTypeDomain,
    SidTypeAlias,
    SidTypeWellKnownGroup,
    SidTypeDeletedAccount,
    SidTypeInvalid,
    SidTypeUnknown,
} SID_NAME_USE, *PSID_NAME_USE;


I believe there might be one additional value for this enum to
describe a sid for a machine/computer :

SidTypeComputer = 9   (or something similar)


This assumption is based on Wireshark and Samba4 code.


regards
ronnie sahlberg
_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[John Dunning-5]

Hello Ronnie,
   I wanted to let you know that I had received this request. Myself or one of my teammates will look into this issue and get back to you as soon as possible.

Thanks
John Dunning
Senior Escalation Engineer Microsoft Corporation US-CSS DSC PROTOCOL TEAM
Email: johndun@...
Tele: [phone]

-----Original Message-----
From: ronnie sahlberg [mailto:ronniesahlberg@...]
Sent: Thursday, October 02, 2008 11:35 AM
To: Interoperability Documentation Help
Cc: pfif@...; cifs-protocol@...
Subject: MS-SAMR missing SID name use type ?

Hi,

I am a pfif subcontractor.

The IDL in MS-SAMR describes the types of sids as :

typedef enum _SID_NAME_USE {
    SidTypeUser = 1,
    SidTypeGroup,
    SidTypeDomain,
    SidTypeAlias,
    SidTypeWellKnownGroup,
    SidTypeDeletedAccount,
    SidTypeInvalid,
    SidTypeUnknown,
} SID_NAME_USE, *PSID_NAME_USE;


I believe there might be one additional value for this enum to
describe a sid for a machine/computer :

SidTypeComputer = 9   (or something similar)


This assumption is based on Wireshark and Samba4 code.


regards
ronnie sahlberg

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Obaid Farooqi]

Good Afternoon Ronnie.
My name is Obaid Farooqi. I will be helping you with this inquiry. A case has been created for your question as follows.

Case: SRX081002601190
Title: ProtoDoc 99999 PFIF: MS-SAMR  missing SID name use type ?

Regards,
Obaid Farooqi
Sr. SEE | US-CSS DSC PROTOCOL TEAM | Microsoft

-----Original Message-----
From: ronnie sahlberg [mailto:ronniesahlberg@...]
Sent: Thursday, October 02, 2008 11:35 AM
To: Interoperability Documentation Help
Cc: pfif@...; cifs-protocol@...
Subject: MS-SAMR missing SID name use type ?

Hi,

I am a pfif subcontractor.

The IDL in MS-SAMR describes the types of sids as :

typedef enum _SID_NAME_USE {
    SidTypeUser = 1,
    SidTypeGroup,
    SidTypeDomain,
    SidTypeAlias,
    SidTypeWellKnownGroup,
    SidTypeDeletedAccount,
    SidTypeInvalid,
    SidTypeUnknown,
} SID_NAME_USE, *PSID_NAME_USE;


I believe there might be one additional value for this enum to
describe a sid for a machine/computer :

SidTypeComputer = 9   (or something similar)


This assumption is based on Wireshark and Samba4 code.


regards
ronnie sahlberg

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Obaid Farooqi]

Hi Ronnie:
I need some clarification on your question. Please provide the answers to following questions:

1. Please specify the setup in which you see this in wireshark.
2. The exact scenario in which you see it.
3. Please send Wireshark or netmon trace where you see this emun member. Please also specify frame and byte where you see it.

Thanks
Obaid Farooqi

-----Original Message-----
From: ronnie sahlberg [mailto:ronniesahlberg@...]
Sent: Thursday, October 02, 2008 11:35 AM
To: Interoperability Documentation Help
Cc: pfif@...; cifs-protocol@...
Subject: MS-SAMR missing SID name use type ?

Hi,

I am a pfif subcontractor.

The IDL in MS-SAMR describes the types of sids as :

typedef enum _SID_NAME_USE {
    SidTypeUser = 1,
    SidTypeGroup,
    SidTypeDomain,
    SidTypeAlias,
    SidTypeWellKnownGroup,
    SidTypeDeletedAccount,
    SidTypeInvalid,
    SidTypeUnknown,
} SID_NAME_USE, *PSID_NAME_USE;


I believe there might be one additional value for this enum to
describe a sid for a machine/computer :

SidTypeComputer = 9   (or something similar)


This assumption is based on Wireshark and Samba4 code.


regards
ronnie sahlberg

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Obaid Farooqi]

Good Morning Ronnie:
I haven't received the information I requested in the following email. Please provide the information. We need this to move forward in this case.

Thanks
Obaid Farooqi
Sr. SEE | Microsoft

-----Original Message-----
From: Obaid Farooqi
Sent: Wednesday, October 08, 2008 10:45 AM
To: ronnie sahlberg
Cc: pfif@...; cifs-protocol@...
Subject: RE: MS-SAMR missing SID name use type ?

Hi Ronnie:
I need some clarification on your question. Please provide the answers to following questions:

1. Please specify the setup in which you see this in wireshark.
2. The exact scenario in which you see it.
3. Please send Wireshark or netmon trace where you see this emun member. Please also specify frame and byte where you see it.

Thanks
Obaid Farooqi

-----Original Message-----
From: ronnie sahlberg [mailto:ronniesahlberg@...]
Sent: Thursday, October 02, 2008 11:35 AM
To: Interoperability Documentation Help
Cc: pfif@...; cifs-protocol@...
Subject: MS-SAMR missing SID name use type ?

Hi,

I am a pfif subcontractor.

The IDL in MS-SAMR describes the types of sids as :

typedef enum _SID_NAME_USE {
    SidTypeUser = 1,
    SidTypeGroup,
    SidTypeDomain,
    SidTypeAlias,
    SidTypeWellKnownGroup,
    SidTypeDeletedAccount,
    SidTypeInvalid,
    SidTypeUnknown,
} SID_NAME_USE, *PSID_NAME_USE;


I believe there might be one additional value for this enum to
describe a sid for a machine/computer :

SidTypeComputer = 9   (or something similar)


This assumption is based on Wireshark and Samba4 code.


regards
ronnie sahlberg

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Obaid Farooqi]

Good Afternoon Ronnie:
I am still waiting for your response. We need this info to move forward on this case.

Thanks
Obaid Farooqi
Sr. SEE | Microsoft

-----Original Message-----
From: Obaid Farooqi
Sent: Thursday, October 16, 2008 7:40 AM
To: 'ronnie sahlberg'
Cc: 'pfif@...'; 'cifs-protocol@...'
Subject: RE: MS-SAMR missing SID name use type ?

Good Morning Ronnie:
I haven't received the information I requested in the following email. Please provide the information. We need this to move forward in this case.

Thanks
Obaid Farooqi
Sr. SEE | Microsoft

-----Original Message-----
From: Obaid Farooqi
Sent: Wednesday, October 08, 2008 10:45 AM
To: ronnie sahlberg
Cc: pfif@...; cifs-protocol@...
Subject: RE: MS-SAMR missing SID name use type ?

Hi Ronnie:
I need some clarification on your question. Please provide the answers to following questions:

1. Please specify the setup in which you see this in wireshark.
2. The exact scenario in which you see it.
3. Please send Wireshark or netmon trace where you see this emun member. Please also specify frame and byte where you see it.

Thanks
Obaid Farooqi

-----Original Message-----
From: ronnie sahlberg [mailto:ronniesahlberg@...]
Sent: Thursday, October 02, 2008 11:35 AM
To: Interoperability Documentation Help
Cc: pfif@...; cifs-protocol@...
Subject: MS-SAMR missing SID name use type ?

Hi,

I am a pfif subcontractor.

The IDL in MS-SAMR describes the types of sids as :

typedef enum _SID_NAME_USE {
    SidTypeUser = 1,
    SidTypeGroup,
    SidTypeDomain,
    SidTypeAlias,
    SidTypeWellKnownGroup,
    SidTypeDeletedAccount,
    SidTypeInvalid,
    SidTypeUnknown,
} SID_NAME_USE, *PSID_NAME_USE;


I believe there might be one additional value for this enum to
describe a sid for a machine/computer :

SidTypeComputer = 9   (or something similar)


This assumption is based on Wireshark and Samba4 code.


regards
ronnie sahlberg

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Andrew Bartlett]

On Thu, 2008-10-23 at 17:22 -0700, Obaid Farooqi wrote:
> Good Afternoon Ronnie:
> I am still waiting for your response. We need this info to move forward on this case.

>
> I believe there might be one additional value for this enum to
> describe a sid for a machine/computer :
>
> SidTypeComputer = 9   (or something similar)
>
>
> This assumption is based on Wireshark and Samba4 code.

Because of the long history of Samba - without suitable documentation
for the most part, sometimes myths and legends build up.  That said, I'm
unable to produce this value on the wire for LSA lookup names.  

What we are asking is for is some research and clarification (if
possible).  We can't ask you how we got this in the first place, but we
were hoping you might be able to do some digging, to check the IDL and
see if this value ever occours in this enum in windows (ie, is this a
cut-down enum), or if there is another similar (but not identical) enum
that we might have got confused with.

Thanks,

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.


_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Obaid Farooqi]

Hi Andrew:
I tried to dig this up but the scope of your question is currently just too broad. It would help greatly if you can give a little more information about the scenario in which you saw this enum. Is there any additional information that you or another member of Samba can recall that will help reduce the breadth of the scope? Even a timeframe that the scenario was experienced may prove to be useful.

Thanks
Obaid Farooqi

-----Original Message-----
From: Andrew Bartlett [mailto:abartlet@...]
Sent: Thursday, October 23, 2008 9:48 PM
To: Obaid Farooqi
Cc: 'ronnie sahlberg'; 'pfif@...'; 'cifs-protocol@...'
Subject: Re: [cifs-protocol] RE: MS-SAMR missing SID name use type ?

On Thu, 2008-10-23 at 17:22 -0700, Obaid Farooqi wrote:
> Good Afternoon Ronnie:
> I am still waiting for your response. We need this info to move forward on this case.

>
> I believe there might be one additional value for this enum to
> describe a sid for a machine/computer :
>
> SidTypeComputer = 9   (or something similar)
>
>
> This assumption is based on Wireshark and Samba4 code.

Because of the long history of Samba - without suitable documentation for the most part, sometimes myths and legends build up.  That said, I'm unable to produce this value on the wire for LSA lookup names.

What we are asking is for is some research and clarification (if possible).  We can't ask you how we got this in the first place, but we were hoping you might be able to do some digging, to check the IDL and see if this value ever occours in this enum in windows (ie, is this a cut-down enum), or if there is another similar (but not identical) enum that we might have got confused with.

Thanks,

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.
_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[Andrew Bartlett]

On Mon, 2008-11-03 at 12:22 -0800, Obaid Farooqi wrote:
> Hi Andrew:
> I tried to dig this up but the scope of your question is currently
> just too broad.

Clearly you know a fishing expedition when you see one.  :-)

> It would help greatly if you can give a little more information about
> the scenario in which you saw this enum. Is there any additional
> information that you or another member of Samba can recall that will
> help reduce the breadth of the scope? Even a timeframe that the
> scenario was experienced may prove to be useful.

I'll see if I can find this in our GIT history.  

Andrew Bartlett

--
Andrew Bartlett
http://samba.org/~abartlet/
Authentication Developer, Samba Team           http://samba.org
Samba Developer, Red Hat Inc.


_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[neilbm]

I think this is probably what you are after:
from : http://msdn.microsoft.com/en-us/library/aa379601.aspx
typedef enum _SID_NAME_USE {
  SidTypeUser             = 1,
  SidTypeGroup,
  SidTypeDomain,
  SidTypeAlias,
  SidTypeWellKnownGroup,
  SidTypeDeletedAccount,
  SidTypeInvalid,
  SidTypeUnknown,
  SidTypeComputer,
  SidTypeLabel
} SID_NAME_USE,  *PSID_NAME_USE;

[ronnie sahlberg]

Hi Obaid,

Since I was the originator for this request,
If you have looked but not found any indication that there are any
additional sid types than those listed
I assume that SidTypeComputer = 9   (or something similar) must be a
mistake in the way that these things were discovered previously in
samba or wireshark.


You can close this issue as far as I am concerned.



On Tue, Nov 4, 2008 at 7:22 AM, Obaid Farooqi <obaidf@...> wrote:

> Hi Andrew:
> I tried to dig this up but the scope of your question is currently just too broad. It would help greatly if you can give a little more information about the scenario in which you saw this enum. Is there any additional information that you or another member of Samba can recall that will help reduce the breadth of the scope? Even a timeframe that the scenario was experienced may prove to be useful.
>
> Thanks
> Obaid Farooqi
>
> -----Original Message-----
> From: Andrew Bartlett [mailto:abartlet@...]
> Sent: Thursday, October 23, 2008 9:48 PM
> To: Obaid Farooqi
> Cc: 'ronnie sahlberg'; 'pfif@...'; 'cifs-protocol@...'
> Subject: Re: [cifs-protocol] RE: MS-SAMR missing SID name use type ?
>
> On Thu, 2008-10-23 at 17:22 -0700, Obaid Farooqi wrote:
>> Good Afternoon Ronnie:
>> I am still waiting for your response. We need this info to move forward on this case.
>
>>
>> I believe there might be one additional value for this enum to
>> describe a sid for a machine/computer :
>>
>> SidTypeComputer = 9   (or something similar)
>>
>>
>> This assumption is based on Wireshark and Samba4 code.
>
> Because of the long history of Samba - without suitable documentation for the most part, sometimes myths and legends build up.  That said, I'm unable to produce this value on the wire for LSA lookup names.
>
> What we are asking is for is some research and clarification (if possible).  We can't ask you how we got this in the first place, but we were hoping you might be able to do some digging, to check the IDL and see if this value ever occours in this enum in windows (ie, is this a cut-down enum), or if there is another similar (but not identical) enum that we might have got confused with.
>
> Thanks,
>
> --
> Andrew Bartlett
> http://samba.org/~abartlet/
> Authentication Developer, Samba Team           http://samba.org
> Samba Developer, Red Hat Inc.
>

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[ronnie sahlberg]

Hi Obaid


Some new information relevant to this issue has just been received by me.
Please disregard my previous post to let me digest this new
inconsistency in the documentation before i follow up.
Please leave the case open until I have investigated.


regards
ronnie sahlberg




On Thu, Nov 6, 2008 at 8:55 AM, ronnie sahlberg
<ronniesahlberg@...> wrote:

> Hi Obaid,
> Since I was the originator for this request,
> If you have looked but not found any indication that there are any
> additional sid types than those listed
> I assume that SidTypeComputer = 9   (or something similar) must be a
> mistake in the way that these things were discovered previously in
> samba or wireshark.
>
>
> You can close this issue as far as I am concerned.
>
>
>
> On Tue, Nov 4, 2008 at 7:22 AM, Obaid Farooqi <obaidf@...> wrote:
>> Hi Andrew:
>> I tried to dig this up but the scope of your question is currently just too broad. It would help greatly if you can give a little more information about the scenario in which you saw this enum. Is there any additional information that you or another member of Samba can recall that will help reduce the breadth of the scope? Even a timeframe that the scenario was experienced may prove to be useful.
>>
>> Thanks
>> Obaid Farooqi
>>
>> -----Original Message-----
>> From: Andrew Bartlett [mailto:abartlet@...]
>> Sent: Thursday, October 23, 2008 9:48 PM
>> To: Obaid Farooqi
>> Cc: 'ronnie sahlberg'; 'pfif@...'; 'cifs-protocol@...'
>> Subject: Re: [cifs-protocol] RE: MS-SAMR missing SID name use type ?
>>
>> On Thu, 2008-10-23 at 17:22 -0700, Obaid Farooqi wrote:
>>> Good Afternoon Ronnie:
>>> I am still waiting for your response. We need this info to move forward on this case.
>>
>>>
>>> I believe there might be one additional value for this enum to
>>> describe a sid for a machine/computer :
>>>
>>> SidTypeComputer = 9   (or something similar)
>>>
>>>
>>> This assumption is based on Wireshark and Samba4 code.
>>
>> Because of the long history of Samba - without suitable documentation for the most part, sometimes myths and legends build up.  That said, I'm unable to produce this value on the wire for LSA lookup names.
>>
>> What we are asking is for is some research and clarification (if possible).  We can't ask you how we got this in the first place, but we were hoping you might be able to do some digging, to check the IDL and see if this value ever occours in this enum in windows (ie, is this a cut-down enum), or if there is another similar (but not identical) enum that we might have got confused with.
>>
>> Thanks,
>>
>> --
>> Andrew Bartlett
>> http://samba.org/~abartlet/
>> Authentication Developer, Samba Team           http://samba.org
>> Samba Developer, Red Hat Inc.
>>
>

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol

[ronnie sahlberg]

I see where the confusion has arised from now.


LSA and SAMR both contain a definition for SID_NAME_TYPE but they are
subtly different.

The definitions of SID_NAME_TYPE in LSA and SAMR are identical up to
item 8 where the SAMR version ends.
LSA contains two extra name types   COMPUTER==9 and LABEL==10


Any particular reason why SAMR and LSA uses similar but different
definitions of this structure?
This leads to confusion.


regards
ronnie sahlberg



On Thu, Nov 6, 2008 at 8:36 PM, ronnie sahlberg
<ronniesahlberg@...> wrote:

> Hi Obaid
>
>
> Some new information relevant to this issue has just been received by me.
> Please disregard my previous post to let me digest this new
> inconsistency in the documentation before i follow up.
> Please leave the case open until I have investigated.
>
>
> regards
> ronnie sahlberg
>
>
>
>
> On Thu, Nov 6, 2008 at 8:55 AM, ronnie sahlberg
> <ronniesahlberg@...> wrote:
>> Hi Obaid,
>> Since I was the originator for this request,
>> If you have looked but not found any indication that there are any
>> additional sid types than those listed
>> I assume that SidTypeComputer = 9   (or something similar) must be a
>> mistake in the way that these things were discovered previously in
>> samba or wireshark.
>>
>>
>> You can close this issue as far as I am concerned.
>>
>>
>>
>> On Tue, Nov 4, 2008 at 7:22 AM, Obaid Farooqi <obaidf@...> wrote:
>>> Hi Andrew:
>>> I tried to dig this up but the scope of your question is currently just too broad. It would help greatly if you can give a little more information about the scenario in which you saw this enum. Is there any additional information that you or another member of Samba can recall that will help reduce the breadth of the scope? Even a timeframe that the scenario was experienced may prove to be useful.
>>>
>>> Thanks
>>> Obaid Farooqi
>>>
>>> -----Original Message-----
>>> From: Andrew Bartlett [mailto:abartlet@...]
>>> Sent: Thursday, October 23, 2008 9:48 PM
>>> To: Obaid Farooqi
>>> Cc: 'ronnie sahlberg'; 'pfif@...'; 'cifs-protocol@...'
>>> Subject: Re: [cifs-protocol] RE: MS-SAMR missing SID name use type ?
>>>
>>> On Thu, 2008-10-23 at 17:22 -0700, Obaid Farooqi wrote:
>>>> Good Afternoon Ronnie:
>>>> I am still waiting for your response. We need this info to move forward on this case.
>>>
>>>>
>>>> I believe there might be one additional value for this enum to
>>>> describe a sid for a machine/computer :
>>>>
>>>> SidTypeComputer = 9   (or something similar)
>>>>
>>>>
>>>> This assumption is based on Wireshark and Samba4 code.
>>>
>>> Because of the long history of Samba - without suitable documentation for the most part, sometimes myths and legends build up.  That said, I'm unable to produce this value on the wire for LSA lookup names.
>>>
>>> What we are asking is for is some research and clarification (if possible).  We can't ask you how we got this in the first place, but we were hoping you might be able to do some digging, to check the IDL and see if this value ever occours in this enum in windows (ie, is this a cut-down enum), or if there is another similar (but not identical) enum that we might have got confused with.
>>>
>>> Thanks,
>>>
>>> --
>>> Andrew Bartlett
>>> http://samba.org/~abartlet/
>>> Authentication Developer, Samba Team           http://samba.org
>>> Samba Developer, Red Hat Inc.
>>>
>>
>

_______________________________________________
cifs-protocol mailing list
cifs-protocol@...
https://lists.samba.org/mailman/listinfo/cifs-protocol