2 Unix SMB/CIFS implementation.
6 Copyright (C) Andrew Tridgell 2005
7 Copyright (C) Simo Sorce 2005-2008
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "lib/ldb/include/ldb.h"
25 #include "lib/ldb/include/ldb_module.h"
26 #include "system/time.h"
27 #include "dsdb/samdb/samdb.h"
29 #include "dsdb/samdb/ldb_modules/util.h"
30 #include "libcli/security/security.h"
31 #include "librpc/ndr/libndr.h"
32 #include "auth/auth.h"
35 unsigned int num_controls;
37 unsigned int num_partitions;
38 struct ldb_dn **partitions;
42 return 1 if a specific attribute has been requested
44 static int do_attribute(const char * const *attrs, const char *name)
46 return attrs == NULL ||
47 ldb_attr_in_list(attrs, name) ||
48 ldb_attr_in_list(attrs, "*");
51 static int do_attribute_explicit(const char * const *attrs, const char *name)
53 return attrs != NULL && ldb_attr_in_list(attrs, name);
58 expand a DN attribute to include extended DN information if requested
60 static int expand_dn_in_message(struct ldb_module *module, struct ldb_message *msg,
61 const char *attrname, struct ldb_control *edn_control,
62 struct ldb_request *req)
64 struct ldb_dn *dn, *dn2;
67 struct ldb_request *req2;
69 const char *no_attrs[] = { NULL };
70 struct ldb_result *res;
71 struct ldb_extended_dn_control *edn;
72 TALLOC_CTX *tmp_ctx = talloc_new(req);
73 struct ldb_context *ldb;
76 ldb = ldb_module_get_ctx(module);
78 edn = talloc_get_type(edn_control->data, struct ldb_extended_dn_control);
83 v = discard_const_p(struct ldb_val, ldb_msg_find_ldb_val(msg, attrname));
89 dn_string = talloc_strndup(tmp_ctx, (const char *)v->data, v->length);
90 if (dn_string == NULL) {
92 return ldb_operr(ldb);
95 res = talloc_zero(tmp_ctx, struct ldb_result);
98 return ldb_operr(ldb);
101 dn = ldb_dn_new(tmp_ctx, ldb, dn_string);
102 if (!ldb_dn_validate(dn)) {
103 talloc_free(tmp_ctx);
104 return ldb_operr(ldb);
107 ret = ldb_build_search_req(&req2, ldb, tmp_ctx,
113 res, ldb_search_default_callback,
115 if (ret != LDB_SUCCESS) {
116 talloc_free(tmp_ctx);
121 ret = ldb_request_add_control(req2,
122 LDB_CONTROL_EXTENDED_DN_OID,
123 edn_control->critical, edn);
124 if (ret != LDB_SUCCESS) {
125 talloc_free(tmp_ctx);
129 ret = ldb_next_request(module, req2);
130 if (ret == LDB_SUCCESS) {
131 ret = ldb_wait(req2->handle, LDB_WAIT_ALL);
133 if (ret != LDB_SUCCESS) {
134 talloc_free(tmp_ctx);
138 if (!res || res->count != 1) {
139 talloc_free(tmp_ctx);
140 return ldb_operr(ldb);
143 dn2 = res->msgs[0]->dn;
145 v->data = (uint8_t *)ldb_dn_get_extended_linearized(msg->elements, dn2, edn_type);
146 v->length = strlen((char *)v->data);
148 if (v->data == NULL) {
149 talloc_free(tmp_ctx);
150 return ldb_operr(ldb);
153 talloc_free(tmp_ctx);
160 add dynamically generated attributes to rootDSE result
162 static int rootdse_add_dynamic(struct ldb_module *module, struct ldb_message *msg,
163 const char * const *attrs, struct ldb_request *req)
165 struct ldb_context *ldb;
166 struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
168 const struct dsdb_schema *schema;
170 struct ldb_control *edn_control;
171 const char *dn_attrs[] = {
172 "configurationNamingContext",
173 "defaultNamingContext",
175 "rootDomainNamingContext",
176 "schemaNamingContext",
181 ldb = ldb_module_get_ctx(module);
182 schema = dsdb_get_schema(ldb, NULL);
184 msg->dn = ldb_dn_new(msg, ldb, NULL);
186 /* don't return the distinduishedName, cn and name attributes */
187 ldb_msg_remove_attr(msg, "distinguishedName");
188 ldb_msg_remove_attr(msg, "cn");
189 ldb_msg_remove_attr(msg, "name");
191 if (do_attribute(attrs, "currentTime")) {
192 if (ldb_msg_add_steal_string(msg, "currentTime",
193 ldb_timestring(msg, time(NULL))) != 0) {
198 if (priv && do_attribute(attrs, "supportedControl")) {
200 for (i = 0; i < priv->num_controls; i++) {
201 char *control = talloc_strdup(msg, priv->controls[i]);
205 if (ldb_msg_add_steal_string(msg, "supportedControl",
212 if (priv && do_attribute(attrs, "namingContexts")) {
214 for (i = 0; i < priv->num_partitions; i++) {
215 struct ldb_dn *dn = priv->partitions[i];
216 if (ldb_msg_add_steal_string(msg, "namingContexts",
217 ldb_dn_alloc_linearized(msg, dn)) != 0) {
223 server_sasl = talloc_get_type(ldb_get_opaque(ldb, "supportedSASLMechanisms"),
225 if (server_sasl && do_attribute(attrs, "supportedSASLMechanisms")) {
227 for (i = 0; server_sasl && server_sasl[i]; i++) {
228 char *sasl_name = talloc_strdup(msg, server_sasl[i]);
232 if (ldb_msg_add_steal_string(msg, "supportedSASLMechanisms",
239 if (do_attribute(attrs, "highestCommittedUSN")) {
241 int ret = ldb_sequence_number(ldb, LDB_SEQ_HIGHEST_SEQ, &seq_num);
242 if (ret == LDB_SUCCESS) {
243 if (ldb_msg_add_fmt(msg, "highestCommittedUSN",
244 "%llu", (unsigned long long)seq_num) != 0) {
250 if (schema && do_attribute_explicit(attrs, "dsSchemaAttrCount")) {
251 struct dsdb_attribute *cur;
254 for (cur = schema->attributes; cur; cur = cur->next) {
258 if (ldb_msg_add_fmt(msg, "dsSchemaAttrCount",
264 if (schema && do_attribute_explicit(attrs, "dsSchemaClassCount")) {
265 struct dsdb_class *cur;
268 for (cur = schema->classes; cur; cur = cur->next) {
272 if (ldb_msg_add_fmt(msg, "dsSchemaClassCount",
278 if (schema && do_attribute_explicit(attrs, "dsSchemaPrefixCount")) {
279 if (ldb_msg_add_fmt(msg, "dsSchemaPrefixCount",
280 "%u", schema->prefixmap->length) != 0) {
285 if (do_attribute_explicit(attrs, "validFSMOs")) {
286 const struct dsdb_naming_fsmo *naming_fsmo;
287 const struct dsdb_pdc_fsmo *pdc_fsmo;
290 if (schema && schema->fsmo.we_are_master) {
291 dn_str = ldb_dn_get_linearized(ldb_get_schema_basedn(ldb));
292 if (dn_str && dn_str[0]) {
293 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
299 naming_fsmo = talloc_get_type(ldb_get_opaque(ldb, "dsdb_naming_fsmo"),
300 struct dsdb_naming_fsmo);
301 if (naming_fsmo && naming_fsmo->we_are_master) {
302 dn_str = ldb_dn_get_linearized(samdb_partitions_dn(ldb, msg));
303 if (dn_str && dn_str[0]) {
304 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
310 pdc_fsmo = talloc_get_type(ldb_get_opaque(ldb, "dsdb_pdc_fsmo"),
311 struct dsdb_pdc_fsmo);
312 if (pdc_fsmo && pdc_fsmo->we_are_master) {
313 dn_str = ldb_dn_get_linearized(ldb_get_default_basedn(ldb));
314 if (dn_str && dn_str[0]) {
315 if (ldb_msg_add_fmt(msg, "validFSMOs", "%s", dn_str) != 0) {
322 if (do_attribute_explicit(attrs, "vendorVersion")) {
323 if (ldb_msg_add_fmt(msg, "vendorVersion",
324 "%s", SAMBA_VERSION_STRING) != 0) {
329 if (priv && do_attribute(attrs, "domainFunctionality")) {
330 if (ldb_msg_add_fmt(msg, "domainFunctionality",
331 "%d", dsdb_functional_level(ldb)) != 0) {
336 if (priv && do_attribute(attrs, "forestFunctionality")
337 && (val = talloc_get_type(ldb_get_opaque(ldb, "forestFunctionality"), int))) {
338 if (ldb_msg_add_fmt(msg, "forestFunctionality",
344 if (priv && do_attribute(attrs, "domainControllerFunctionality")
345 && (val = talloc_get_type(ldb_get_opaque(ldb, "domainControllerFunctionality"), int))) {
346 if (ldb_msg_add_fmt(msg, "domainControllerFunctionality",
352 edn_control = ldb_request_get_control(req, LDB_CONTROL_EXTENDED_DN_OID);
354 /* if the client sent us the EXTENDED_DN control then we need
355 to expand the DNs to have GUID and SID. W2K8 join relies on
360 for (i=0; dn_attrs[i]; i++) {
361 if (!do_attribute(attrs, dn_attrs[i])) continue;
362 ret = expand_dn_in_message(module, msg, dn_attrs[i],
364 if (ret != LDB_SUCCESS) {
365 DEBUG(0,(__location__ ": Failed to expand DN in rootDSE for %s\n",
372 if (do_attribute(attrs, "isGlobalCatalogReady")) {
373 /* MS-ADTS 3.1.1.3.2.10
374 Note, we should only return true here is we have
375 completed at least one synchronisation. As both
376 provision and vampire do a full sync, this means we
377 can return true is the gc bit is set in the NTDSDSA
379 if (ldb_msg_add_fmt(msg, "isGlobalCatalogReady",
380 "%s", samdb_is_gc(ldb)?"TRUE":"FALSE") != 0) {
385 if (do_attribute_explicit(attrs, "tokenGroups")) {
387 /* Obtain the user's session_info */
388 struct auth_session_info *session_info
389 = (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
390 if (session_info && session_info->security_token) {
391 /* The list of groups this user is in */
392 for (i = 0; i < session_info->security_token->num_sids; i++) {
393 if (samdb_msg_add_dom_sid(ldb, msg, msg,
395 &session_info->security_token->sids[i]) != 0) {
402 /* TODO: lots more dynamic attributes should be added here */
407 return ldb_operr(ldb);
411 handle search requests
414 struct rootdse_context {
415 struct ldb_module *module;
416 struct ldb_request *req;
419 static struct rootdse_context *rootdse_init_context(struct ldb_module *module,
420 struct ldb_request *req)
422 struct ldb_context *ldb;
423 struct rootdse_context *ac;
425 ldb = ldb_module_get_ctx(module);
427 ac = talloc_zero(req, struct rootdse_context);
429 ldb_set_errstring(ldb, "Out of Memory");
439 static int rootdse_callback(struct ldb_request *req, struct ldb_reply *ares)
441 struct rootdse_context *ac;
444 ac = talloc_get_type(req->context, struct rootdse_context);
447 return ldb_module_done(ac->req, NULL, NULL,
448 LDB_ERR_OPERATIONS_ERROR);
450 if (ares->error != LDB_SUCCESS) {
451 return ldb_module_done(ac->req, ares->controls,
452 ares->response, ares->error);
455 switch (ares->type) {
456 case LDB_REPLY_ENTRY:
458 * if the client explicit asks for the 'netlogon' attribute
459 * the reply_entry needs to be skipped
461 if (ac->req->op.search.attrs &&
462 ldb_attr_in_list(ac->req->op.search.attrs, "netlogon")) {
467 /* for each record returned post-process to add any dynamic
468 attributes that have been asked for */
469 ret = rootdse_add_dynamic(ac->module, ares->message,
470 ac->req->op.search.attrs, ac->req);
471 if (ret != LDB_SUCCESS) {
473 return ldb_module_done(ac->req, NULL, NULL, ret);
476 return ldb_module_send_entry(ac->req, ares->message, ares->controls);
478 case LDB_REPLY_REFERRAL:
479 /* should we allow the backend to return referrals in this case
484 return ldb_module_done(ac->req, ares->controls,
485 ares->response, ares->error);
492 static int rootdse_search(struct ldb_module *module, struct ldb_request *req)
494 struct ldb_context *ldb;
495 struct rootdse_context *ac;
496 struct ldb_request *down_req;
499 ldb = ldb_module_get_ctx(module);
501 /* see if its for the rootDSE - only a base search on the "" DN qualifies */
502 if (!(req->op.search.scope == LDB_SCOPE_BASE && ldb_dn_is_null(req->op.search.base))) {
503 /* Otherwise, pass down to the rest of the stack */
504 return ldb_next_request(module, req);
507 ac = rootdse_init_context(module, req);
509 return ldb_operr(ldb);
512 /* in our db we store the rootDSE with a DN of @ROOTDSE */
513 ret = ldb_build_search_req(&down_req, ldb, ac,
514 ldb_dn_new(ac, ldb, "@ROOTDSE"),
517 req->op.search.attrs,
518 NULL,/* for now skip the controls from the client */
519 ac, rootdse_callback,
521 if (ret != LDB_SUCCESS) {
525 return ldb_next_request(module, down_req);
528 static int rootdse_register_control(struct ldb_module *module, struct ldb_request *req)
530 struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
533 list = talloc_realloc(priv, priv->controls, char *, priv->num_controls + 1);
535 return ldb_oom(ldb_module_get_ctx(module));
538 list[priv->num_controls] = talloc_strdup(list, req->op.reg_control.oid);
539 if (!list[priv->num_controls]) {
540 return ldb_oom(ldb_module_get_ctx(module));
543 priv->num_controls += 1;
544 priv->controls = list;
546 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
549 static int rootdse_register_partition(struct ldb_module *module, struct ldb_request *req)
551 struct private_data *priv = talloc_get_type(ldb_module_get_private(module), struct private_data);
552 struct ldb_dn **list;
554 list = talloc_realloc(priv, priv->partitions, struct ldb_dn *, priv->num_partitions + 1);
556 return ldb_oom(ldb_module_get_ctx(module));
559 list[priv->num_partitions] = ldb_dn_copy(list, req->op.reg_partition.dn);
560 if (!list[priv->num_partitions]) {
561 return ldb_operr(ldb_module_get_ctx(module));
564 priv->num_partitions += 1;
565 priv->partitions = list;
567 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
571 static int rootdse_request(struct ldb_module *module, struct ldb_request *req)
573 switch (req->operation) {
575 case LDB_REQ_REGISTER_CONTROL:
576 return rootdse_register_control(module, req);
577 case LDB_REQ_REGISTER_PARTITION:
578 return rootdse_register_partition(module, req);
583 return ldb_next_request(module, req);
586 static int rootdse_init(struct ldb_module *module)
589 struct ldb_context *ldb;
590 struct ldb_result *res;
591 struct private_data *data;
592 const char *attrs[] = { "msDS-Behavior-Version", NULL };
593 const char *ds_attrs[] = { "dsServiceName", NULL };
596 ldb = ldb_module_get_ctx(module);
598 data = talloc_zero(module, struct private_data);
603 data->num_controls = 0;
604 data->controls = NULL;
605 data->num_partitions = 0;
606 data->partitions = NULL;
607 ldb_module_set_private(module, data);
609 ldb_set_default_dns(ldb);
611 ret = ldb_next_init(module);
613 if (ret != LDB_SUCCESS) {
617 mem_ctx = talloc_new(data);
622 /* Now that the partitions are set up, do a search for:
623 - domainControllerFunctionality
624 - domainFunctionality
625 - forestFunctionality
627 Then stuff these values into an opaque
629 ret = ldb_search(ldb, mem_ctx, &res,
630 ldb_get_default_basedn(ldb),
631 LDB_SCOPE_BASE, attrs, NULL);
632 if (ret == LDB_SUCCESS && res->count == 1) {
633 int domain_behaviour_version
634 = ldb_msg_find_attr_as_int(res->msgs[0],
635 "msDS-Behavior-Version", -1);
636 if (domain_behaviour_version != -1) {
637 int *val = talloc(ldb, int);
639 talloc_free(mem_ctx);
642 *val = domain_behaviour_version;
643 ret = ldb_set_opaque(ldb, "domainFunctionality", val);
644 if (ret != LDB_SUCCESS) {
645 talloc_free(mem_ctx);
651 ret = ldb_search(ldb, mem_ctx, &res,
652 samdb_partitions_dn(ldb, mem_ctx),
653 LDB_SCOPE_BASE, attrs, NULL);
654 if (ret == LDB_SUCCESS && res->count == 1) {
655 int forest_behaviour_version
656 = ldb_msg_find_attr_as_int(res->msgs[0],
657 "msDS-Behavior-Version", -1);
658 if (forest_behaviour_version != -1) {
659 int *val = talloc(ldb, int);
661 talloc_free(mem_ctx);
664 *val = forest_behaviour_version;
665 ret = ldb_set_opaque(ldb, "forestFunctionality", val);
666 if (ret != LDB_SUCCESS) {
667 talloc_free(mem_ctx);
673 ret = ldb_search(ldb, mem_ctx, &res,
674 ldb_dn_new(mem_ctx, ldb, ""),
675 LDB_SCOPE_BASE, ds_attrs, NULL);
676 if (ret == LDB_SUCCESS && res->count == 1) {
678 = ldb_msg_find_attr_as_dn(ldb, mem_ctx, res->msgs[0],
681 ret = ldb_search(ldb, mem_ctx, &res, ds_dn,
682 LDB_SCOPE_BASE, attrs, NULL);
683 if (ret == LDB_SUCCESS && res->count == 1) {
684 int domain_controller_behaviour_version
685 = ldb_msg_find_attr_as_int(res->msgs[0],
686 "msDS-Behavior-Version", -1);
687 if (domain_controller_behaviour_version != -1) {
688 int *val = talloc(ldb, int);
690 talloc_free(mem_ctx);
693 *val = domain_controller_behaviour_version;
694 ret = ldb_set_opaque(ldb,
695 "domainControllerFunctionality", val);
696 if (ret != LDB_SUCCESS) {
697 talloc_free(mem_ctx);
705 talloc_free(mem_ctx);
711 * This function gets the string SCOPE_DN:OPTIONAL_FEATURE_GUID and parse it
712 * to a DN and a GUID object
714 static int get_optional_feature_dn_guid(struct ldb_request *req, struct ldb_context *ldb,
716 struct ldb_dn **op_feature_scope_dn,
717 struct GUID *op_feature_guid)
719 const struct ldb_message *msg = req->op.mod.message;
720 const char *ldb_val_str;
722 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
725 ldb_val_str = ldb_msg_find_attr_as_string(msg, "enableOptionalFeature", NULL);
727 ldb_set_errstring(ldb,
728 "rootdse: unable to find 'enableOptionalFeature'!");
729 return LDB_ERR_UNWILLING_TO_PERFORM;
732 guid = strchr(ldb_val_str, ':');
734 ldb_set_errstring(ldb,
735 "rootdse: unable to find GUID in 'enableOptionalFeature'!");
736 return LDB_ERR_UNWILLING_TO_PERFORM;
738 status = GUID_from_string(guid+1, op_feature_guid);
739 if (!NT_STATUS_IS_OK(status)) {
740 ldb_set_errstring(ldb,
741 "rootdse: bad GUID in 'enableOptionalFeature'!");
742 return LDB_ERR_UNWILLING_TO_PERFORM;
745 dn = talloc_strndup(tmp_ctx, ldb_val_str, guid-ldb_val_str);
747 ldb_set_errstring(ldb,
748 "rootdse: bad DN in 'enableOptionalFeature'!");
749 return LDB_ERR_UNWILLING_TO_PERFORM;
752 *op_feature_scope_dn = ldb_dn_new(mem_ctx, ldb, dn);
754 talloc_free(tmp_ctx);
759 * This function gets the OPTIONAL_FEATURE_GUID and looks for the optional feature
760 * ldb_message object.
762 static int dsdb_find_optional_feature(struct ldb_module *module, struct ldb_context *ldb,
763 TALLOC_CTX *mem_ctx, struct GUID op_feature_guid, struct ldb_message **msg)
765 struct ldb_result *res;
766 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
769 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
771 DSDB_FLAG_NEXT_MODULE |
772 DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
773 "(&(objectClass=msDS-OptionalFeature)"
774 "(msDS-OptionalFeatureGUID=%s))",GUID_string(tmp_ctx, &op_feature_guid));
776 if (ret != LDB_SUCCESS) {
777 talloc_free(tmp_ctx);
780 if (res->count == 0) {
781 talloc_free(tmp_ctx);
782 return LDB_ERR_NO_SUCH_OBJECT;
784 if (res->count != 1) {
785 ldb_asprintf_errstring(ldb,
786 "More than one object found matching optional feature GUID %s\n",
787 GUID_string(tmp_ctx, &op_feature_guid));
788 talloc_free(tmp_ctx);
789 return LDB_ERR_OPERATIONS_ERROR;
792 *msg = talloc_steal(mem_ctx, res->msgs[0]);
794 talloc_free(tmp_ctx);
798 static int rootdse_enable_recycle_bin(struct ldb_module *module,struct ldb_context *ldb,
799 TALLOC_CTX *mem_ctx, struct ldb_dn *op_feature_scope_dn,
800 struct ldb_message *op_feature_msg)
803 const int domain_func_level = dsdb_functional_level(ldb);
804 struct ldb_dn *ntds_settings_dn;
806 unsigned int el_count = 0;
807 struct ldb_message *msg;
809 ret = ldb_msg_find_attr_as_int(op_feature_msg, "msDS-RequiredForestBehaviorVersion", 0);
810 if (domain_func_level < ret){
811 ldb_asprintf_errstring(ldb,
812 "rootdse_enable_recycle_bin: Domain functional level must be at least %d\n",
814 return LDB_ERR_UNWILLING_TO_PERFORM;
817 tmp_ctx = talloc_new(mem_ctx);
818 ntds_settings_dn = samdb_ntds_settings_dn(ldb);
819 if (!ntds_settings_dn) {
820 DEBUG(0, (__location__ ": Failed to find NTDS settings DN\n"));
821 ret = LDB_ERR_OPERATIONS_ERROR;
822 talloc_free(tmp_ctx);
826 ntds_settings_dn = ldb_dn_copy(tmp_ctx, ntds_settings_dn);
827 if (!ntds_settings_dn) {
828 DEBUG(0, (__location__ ": Failed to copy NTDS settings DN\n"));
829 ret = LDB_ERR_OPERATIONS_ERROR;
830 talloc_free(tmp_ctx);
834 msg = ldb_msg_new(tmp_ctx);
835 msg->dn = ntds_settings_dn;
837 ldb_msg_add_linearized_dn(msg, "msDS-EnabledFeature", op_feature_msg->dn);
838 msg->elements[el_count++].flags = LDB_FLAG_MOD_ADD;
840 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
841 if (ret != LDB_SUCCESS) {
842 ldb_asprintf_errstring(ldb,
843 "rootdse_enable_recycle_bin: Failed to modify object %s - %s",
844 ldb_dn_get_linearized(ntds_settings_dn),
846 talloc_free(tmp_ctx);
850 msg->dn = op_feature_scope_dn;
851 ret = dsdb_module_modify(module, msg, DSDB_FLAG_NEXT_MODULE);
852 if (ret != LDB_SUCCESS) {
853 ldb_asprintf_errstring(ldb,
854 "rootdse_enable_recycle_bin: Failed to modify object %s - %s",
855 ldb_dn_get_linearized(op_feature_scope_dn),
857 talloc_free(tmp_ctx);
864 static int rootdse_enableoptionalfeature(struct ldb_module *module, struct ldb_request *req)
868 - check for system (only system can enable features)
869 - extract GUID from the request
870 - find the feature object
871 - check functional level, must be at least msDS-RequiredForestBehaviorVersion
872 - check if it is already enabled (if enabled return LDAP_ATTRIBUTE_OR_VALUE_EXISTS) - probably not needed, just return error from the add/modify
873 - add/modify objects (see ntdsconnection code for an example)
876 struct ldb_context *ldb = ldb_module_get_ctx(module);
877 struct GUID op_feature_guid;
878 struct ldb_dn *op_feature_scope_dn;
879 struct ldb_message *op_feature_msg;
880 struct auth_session_info *session_info =
881 (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
882 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
884 const char *guid_string;
886 if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
887 ldb_set_errstring(ldb, "rootdse: Insufficient rights for enableoptionalfeature");
888 return LDB_ERR_UNWILLING_TO_PERFORM;
891 ret = get_optional_feature_dn_guid(req, ldb, tmp_ctx, &op_feature_scope_dn, &op_feature_guid);
892 if (ret != LDB_SUCCESS) {
893 talloc_free(tmp_ctx);
897 guid_string = GUID_string(tmp_ctx, &op_feature_guid);
899 ldb_set_errstring(ldb, "rootdse: bad optional feature GUID");
900 return LDB_ERR_UNWILLING_TO_PERFORM;
903 ret = dsdb_find_optional_feature(module, ldb, tmp_ctx, op_feature_guid, &op_feature_msg);
904 if (ret != LDB_SUCCESS) {
905 ldb_asprintf_errstring(ldb,
906 "rootdse: unable to find optional feature for %s - %s",
907 guid_string, ldb_errstring(ldb));
908 talloc_free(tmp_ctx);
912 if (strcasecmp(DS_GUID_FEATURE_RECYCLE_BIN, guid_string) == 0) {
913 ret = rootdse_enable_recycle_bin(module, ldb,
914 tmp_ctx, op_feature_scope_dn,
917 ldb_asprintf_errstring(ldb,
918 "rootdse: unknown optional feature %s",
920 talloc_free(tmp_ctx);
921 return LDB_ERR_UNWILLING_TO_PERFORM;
923 if (ret != LDB_SUCCESS) {
924 ldb_asprintf_errstring(ldb,
925 "rootdse: failed to set optional feature for %s - %s",
926 guid_string, ldb_errstring(ldb));
927 talloc_free(tmp_ctx);
931 talloc_free(tmp_ctx);
932 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);;
935 static int rootdse_schemaupdatenow(struct ldb_module *module, struct ldb_request *req)
937 struct ldb_context *ldb = ldb_module_get_ctx(module);
938 struct ldb_result *ext_res;
940 struct ldb_dn *schema_dn;
942 schema_dn = ldb_get_schema_basedn(ldb);
944 ldb_reset_err_string(ldb);
945 ldb_debug(ldb, LDB_DEBUG_WARNING,
946 "rootdse_modify: no schema dn present: (skip ldb_extended call)\n");
947 return ldb_next_request(module, req);
950 ret = ldb_extended(ldb, DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID, schema_dn, &ext_res);
951 if (ret != LDB_SUCCESS) {
952 return ldb_operr(ldb);
955 talloc_free(ext_res);
956 return ldb_module_done(req, NULL, NULL, ret);
959 static int rootdse_add(struct ldb_module *module, struct ldb_request *req)
961 struct ldb_context *ldb = ldb_module_get_ctx(module);
964 If dn is not "" we should let it pass through
966 if (!ldb_dn_is_null(req->op.add.message->dn)) {
967 return ldb_next_request(module, req);
970 ldb_set_errstring(ldb, "rootdse_add: you cannot add a new rootdse entry!");
971 return LDB_ERR_NAMING_VIOLATION;
974 static int rootdse_modify(struct ldb_module *module, struct ldb_request *req)
976 struct ldb_context *ldb = ldb_module_get_ctx(module);
979 If dn is not "" we should let it pass through
981 if (!ldb_dn_is_null(req->op.mod.message->dn)) {
982 return ldb_next_request(module, req);
986 dn is empty so check for schemaUpdateNow attribute
987 "The type of modification and values specified in the LDAP modify operation do not matter." MSDN
989 if (ldb_msg_find_element(req->op.mod.message, "schemaUpdateNow")) {
990 return rootdse_schemaupdatenow(module, req);
993 if (ldb_msg_find_element(req->op.mod.message, "enableOptionalFeature")) {
994 return rootdse_enableoptionalfeature(module, req);
997 ldb_set_errstring(ldb, "rootdse_modify: unknown attribute to change!");
998 return LDB_ERR_UNWILLING_TO_PERFORM;
1001 static int rootdse_delete(struct ldb_module *module, struct ldb_request *req)
1003 struct ldb_context *ldb = ldb_module_get_ctx(module);
1006 If dn is not "" we should let it pass through
1008 if (!ldb_dn_is_null(req->op.del.dn)) {
1009 return ldb_next_request(module, req);
1012 ldb_set_errstring(ldb, "rootdse_remove: you cannot delete the rootdse entry!");
1013 return LDB_ERR_NO_SUCH_OBJECT;
1016 _PUBLIC_ const struct ldb_module_ops ldb_rootdse_module_ops = {
1018 .init_context = rootdse_init,
1019 .search = rootdse_search,
1020 .request = rootdse_request,
1022 .modify = rootdse_modify,
1023 .del = rootdse_delete