4 Copyright (C) Andrew Bartlett 2010
5 Copyright (C) Andrew Tridgell 2010
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 add objectSid to users and groups using samba3 nextRid method
26 #include "libcli/ldap/ldap_ndr.h"
27 #include "ldb_module.h"
28 #include "dsdb/samdb/samdb.h"
29 #include "dsdb/samdb/ldb_modules/util.h"
30 #include "libcli/security/security.h"
31 #include "librpc/gen_ndr/ndr_security.h"
32 #include "../lib/util/util_ldb.h"
34 #include "param/param.h"
37 RID algorithm from pdb_ldap.c in source3/passdb/
38 (loosely based on Volkers code)
40 static int samba3sid_next_sid(struct ldb_module *module,
41 TALLOC_CTX *mem_ctx, char **sid)
43 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
44 struct ldb_result *res;
45 const char *attrs[] = { "sambaNextRid", "sambaNextUserRid",
46 "sambaNextGroupRid", "sambaSID", NULL };
48 struct ldb_context *ldb = ldb_module_get_ctx(module);
49 int sambaNextRid, sambaNextGroupRid, sambaNextUserRid;
50 struct ldb_message *msg;
54 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
56 DSDB_FLAG_NEXT_MODULE |
57 DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
58 "(&(objectClass=sambaDomain)(sambaDomainName=%s))",
59 lpcfg_sam_name(ldb_get_opaque(ldb, "loadparm")));
60 if (ret != LDB_SUCCESS) {
61 ldb_asprintf_errstring(ldb,
63 ": Failed to find domain object - %s",
68 if (res->count != 1) {
69 ldb_asprintf_errstring(ldb,
71 ": Expected exactly 1 domain object - got %u",
74 return LDB_ERR_OPERATIONS_ERROR;
78 sambaNextRid = ldb_msg_find_attr_as_uint(msg, "sambaNextRid", -1);
79 sambaNextUserRid = ldb_msg_find_attr_as_uint(msg, "sambaNextUserRid", -1);
80 sambaNextGroupRid = ldb_msg_find_attr_as_uint(msg, "sambaNextGroupRid", -1);
81 sambaSID = ldb_msg_find_attr_as_string(msg, "sambaSID", NULL);
83 if (sambaSID == NULL) {
84 ldb_asprintf_errstring(ldb,
86 ": No sambaSID in %s",
87 ldb_dn_get_linearized(msg->dn));
89 return LDB_ERR_OPERATIONS_ERROR;
92 /* choose the highest of the 3 - see pdb_ldap.c for an
95 if (sambaNextUserRid > rid) {
96 rid = sambaNextUserRid;
98 if (sambaNextGroupRid > rid) {
99 rid = sambaNextGroupRid;
102 ldb_asprintf_errstring(ldb,
104 ": No sambaNextRid in %s",
105 ldb_dn_get_linearized(msg->dn));
106 talloc_free(tmp_ctx);
107 return LDB_ERR_OPERATIONS_ERROR;
110 /* sambaNextRid is actually the previous RID .... */
113 (*sid) = talloc_asprintf(tmp_ctx, "%s-%d", sambaSID, rid);
115 talloc_free(tmp_ctx);
116 return ldb_module_oom(module);
119 ret = dsdb_module_constrainted_update_integer(module, msg->dn,
122 if (ret != LDB_SUCCESS) {
123 ldb_asprintf_errstring(ldb,
125 ": Failed to update sambaNextRid - %s",
127 talloc_free(tmp_ctx);
131 talloc_steal(mem_ctx, *sid);
132 talloc_free(tmp_ctx);
139 static int samba3sid_add(struct ldb_module *module, struct ldb_request *req)
141 struct ldb_context *ldb;
143 const struct ldb_message *msg = req->op.add.message;
144 struct ldb_message *new_msg;
146 struct ldb_request *new_req;
148 ldb = ldb_module_get_ctx(module);
150 /* do not manipulate our control entries */
151 if (ldb_dn_is_special(req->op.add.message->dn)) {
152 return ldb_next_request(module, req);
155 if (!samdb_find_attribute(ldb, msg, "objectclass", "posixAccount") &&
156 !samdb_find_attribute(ldb, msg, "objectclass", "posixGroup")) {
157 /* its not a user or a group */
158 return ldb_next_request(module, req);
161 if (ldb_msg_find_element(msg, "sambaSID")) {
162 /* a SID was supplied */
163 return ldb_next_request(module, req);
166 new_msg = ldb_msg_copy_shallow(req, req->op.add.message);
168 return ldb_module_oom(module);
171 ret = samba3sid_next_sid(module, new_msg, &sid);
172 if (ret != LDB_SUCCESS) {
176 ret = ldb_msg_add_steal_string(new_msg, "sambaSID", sid);
177 if (ret != LDB_SUCCESS) {
181 ret = ldb_build_add_req(&new_req, ldb, req,
184 req, dsdb_next_callback,
186 LDB_REQ_SET_LOCATION(new_req);
187 if (ret != LDB_SUCCESS) {
191 return ldb_next_request(module, new_req);
194 _PUBLIC_ const struct ldb_module_ops ldb_samba3sid_module_ops = {
196 .add = samba3sid_add,