2 Unix SMB/CIFS implementation.
3 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007-2010
4 Copyright (C) Matthias Dieter Wallnöfer 2009
6 This program is free software; you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation; either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 #include "lib/replace/system/python.h"
21 #include "python/py3compat.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "libcli/security/security.h"
27 #include "librpc/ndr/libndr.h"
28 #include "system/kerberos.h"
29 #include "auth/kerberos/kerberos.h"
30 #include "librpc/rpc/pyrpc_util.h"
31 #include "lib/policy/policy.h"
32 #include "param/pyparam.h"
33 #include "lib/util/dlinklist.h"
34 #include "dsdb/kcc/garbage_collect_tombstones.h"
35 #include "dsdb/kcc/scavenge_dns_records.h"
36 #include "libds/common/flag_mapping.h"
40 /* FIXME: These should be in a header file somewhere */
41 #define PyErr_LDB_OR_RAISE(py_ldb, ldb) \
42 if (!py_check_dcerpc_type(py_ldb, "ldb", "Ldb")) { \
43 PyErr_SetString(PyExc_TypeError, "Ldb connection object required"); \
46 ldb = pyldb_Ldb_AS_LDBCONTEXT(py_ldb);
48 #define PyErr_LDB_DN_OR_RAISE(py_ldb_dn, dn) \
49 if (!py_check_dcerpc_type(py_ldb_dn, "ldb", "Dn")) { \
50 PyErr_SetString(PyExc_TypeError, "ldb Dn object required"); \
53 dn = pyldb_Dn_AS_DN(py_ldb_dn);
55 static PyObject *py_ldb_get_exception(void)
57 PyObject *mod = PyImport_ImportModule("ldb");
58 PyObject *result = NULL;
62 result = PyObject_GetAttrString(mod, "LdbError");
67 static void PyErr_SetLdbError(PyObject *error, int ret, struct ldb_context *ldb_ctx)
69 if (ret == LDB_ERR_PYTHON_EXCEPTION)
70 return; /* Python exception should already be set, just keep that */
72 PyErr_SetObject(error,
73 Py_BuildValue(discard_const_p(char, "(i,s)"), ret,
74 ldb_ctx == NULL?ldb_strerror(ret):ldb_errstring(ldb_ctx)));
77 static PyObject *py_samdb_server_site_name(PyObject *self, PyObject *args)
79 PyObject *py_ldb, *result;
80 struct ldb_context *ldb;
84 if (!PyArg_ParseTuple(args, "O", &py_ldb))
87 PyErr_LDB_OR_RAISE(py_ldb, ldb);
89 mem_ctx = talloc_new(NULL);
90 if (mem_ctx == NULL) {
95 site = samdb_server_site_name(ldb, mem_ctx);
97 PyErr_SetString(PyExc_RuntimeError, "Failed to find server site");
102 result = PyUnicode_FromString(site);
103 talloc_free(mem_ctx);
107 static PyObject *py_dsdb_convert_schema_to_openldap(PyObject *self,
110 char *target_str, *mapping;
112 struct ldb_context *ldb;
116 if (!PyArg_ParseTuple(args, "Oss", &py_ldb, &target_str, &mapping))
119 PyErr_LDB_OR_RAISE(py_ldb, ldb);
121 retstr = dsdb_convert_schema_to_openldap(ldb, target_str, mapping);
122 if (retstr == NULL) {
123 PyErr_SetString(PyExc_RuntimeError,
124 "dsdb_convert_schema_to_openldap failed");
128 ret = PyUnicode_FromString(retstr);
133 static PyObject *py_samdb_set_domain_sid(PyLdbObject *self, PyObject *args)
135 PyObject *py_ldb, *py_sid;
136 struct ldb_context *ldb;
139 const char *sid_str = NULL;
141 if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_sid))
144 PyErr_LDB_OR_RAISE(py_ldb, ldb);
146 sid_str = PyUnicode_AsUTF8(py_sid);
147 if (sid_str == NULL) {
152 sid = dom_sid_parse_talloc(NULL, sid_str);
158 ret = samdb_set_domain_sid(ldb, sid);
161 PyErr_SetString(PyExc_RuntimeError, "set_domain_sid failed");
167 static PyObject *py_samdb_set_ntds_settings_dn(PyLdbObject *self, PyObject *args)
169 PyObject *py_ldb, *py_ntds_settings_dn;
170 struct ldb_context *ldb;
171 struct ldb_dn *ntds_settings_dn;
175 if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_ntds_settings_dn))
178 PyErr_LDB_OR_RAISE(py_ldb, ldb);
180 tmp_ctx = talloc_new(NULL);
181 if (tmp_ctx == NULL) {
186 if (!pyldb_Object_AsDn(tmp_ctx, py_ntds_settings_dn, ldb, &ntds_settings_dn)) {
187 /* exception thrown by "pyldb_Object_AsDn" */
188 talloc_free(tmp_ctx);
192 ret = samdb_set_ntds_settings_dn(ldb, ntds_settings_dn);
193 talloc_free(tmp_ctx);
195 PyErr_SetString(PyExc_RuntimeError, "set_ntds_settings_dn failed");
201 static PyObject *py_samdb_get_domain_sid(PyLdbObject *self, PyObject *args)
204 struct ldb_context *ldb;
205 const struct dom_sid *sid;
206 struct dom_sid_buf buf;
209 if (!PyArg_ParseTuple(args, "O", &py_ldb))
212 PyErr_LDB_OR_RAISE(py_ldb, ldb);
214 sid = samdb_domain_sid(ldb);
216 PyErr_SetString(PyExc_RuntimeError, "samdb_domain_sid failed");
220 ret = PyUnicode_FromString(dom_sid_str_buf(sid, &buf));
224 static PyObject *py_samdb_ntds_invocation_id(PyObject *self, PyObject *args)
226 PyObject *py_ldb, *result;
227 struct ldb_context *ldb;
228 const struct GUID *guid;
231 if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
235 PyErr_LDB_OR_RAISE(py_ldb, ldb);
237 guid = samdb_ntds_invocation_id(ldb);
239 PyErr_SetString(PyExc_RuntimeError,
240 "Failed to find NTDS invocation ID");
244 retstr = GUID_string(NULL, guid);
245 if (retstr == NULL) {
249 result = PyUnicode_FromString(retstr);
254 static PyObject *py_dsdb_get_oid_from_attid(PyObject *self, PyObject *args)
257 struct ldb_context *ldb;
259 struct dsdb_schema *schema;
265 if (!PyArg_ParseTuple(args, "OI", &py_ldb, &attid))
268 PyErr_LDB_OR_RAISE(py_ldb, ldb);
270 mem_ctx = talloc_new(NULL);
276 schema = dsdb_get_schema(ldb, mem_ctx);
278 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb \n");
279 talloc_free(mem_ctx);
283 status = dsdb_schema_pfm_oid_from_attid(schema->prefixmap, attid,
285 if (!W_ERROR_IS_OK(status)) {
286 PyErr_SetWERROR(status);
287 talloc_free(mem_ctx);
291 ret = PyUnicode_FromString(oid);
293 talloc_free(mem_ctx);
299 static PyObject *py_dsdb_get_attid_from_lDAPDisplayName(PyObject *self, PyObject *args)
301 PyObject *py_ldb, *is_schema_nc;
302 struct ldb_context *ldb;
303 struct dsdb_schema *schema;
304 const char *ldap_display_name;
305 bool schema_nc = false;
306 const struct dsdb_attribute *a;
309 if (!PyArg_ParseTuple(args, "OsO", &py_ldb, &ldap_display_name, &is_schema_nc))
312 PyErr_LDB_OR_RAISE(py_ldb, ldb);
315 if (!PyBool_Check(is_schema_nc)) {
316 PyErr_SetString(PyExc_TypeError, "Expected boolean is_schema_nc");
319 if (is_schema_nc == Py_True) {
324 schema = dsdb_get_schema(ldb, NULL);
327 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
331 a = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
333 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
337 attid = dsdb_attribute_get_attid(a, schema_nc);
339 return PyLong_FromUnsignedLong(attid);
343 return the systemFlags as int from the attribute name
345 static PyObject *py_dsdb_get_systemFlags_from_lDAPDisplayName(PyObject *self, PyObject *args)
348 struct ldb_context *ldb;
349 struct dsdb_schema *schema;
350 const char *ldap_display_name;
351 const struct dsdb_attribute *attribute;
353 if (!PyArg_ParseTuple(args, "Os", &py_ldb, &ldap_display_name))
356 PyErr_LDB_OR_RAISE(py_ldb, ldb);
358 schema = dsdb_get_schema(ldb, NULL);
361 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
365 attribute = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
366 if (attribute == NULL) {
367 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
371 return PyLong_FromLong(attribute->systemFlags);
375 return the linkID from the attribute name
377 static PyObject *py_dsdb_get_linkId_from_lDAPDisplayName(PyObject *self, PyObject *args)
380 struct ldb_context *ldb;
381 struct dsdb_schema *schema;
382 const char *ldap_display_name;
383 const struct dsdb_attribute *attribute;
385 if (!PyArg_ParseTuple(args, "Os", &py_ldb, &ldap_display_name))
388 PyErr_LDB_OR_RAISE(py_ldb, ldb);
390 schema = dsdb_get_schema(ldb, NULL);
393 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
397 attribute = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
398 if (attribute == NULL) {
399 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
403 return PyLong_FromLong(attribute->linkID);
407 return the backlink attribute name (if any) for an attribute
409 static PyObject *py_dsdb_get_backlink_from_lDAPDisplayName(PyObject *self, PyObject *args)
412 struct ldb_context *ldb;
413 struct dsdb_schema *schema;
414 const char *ldap_display_name;
415 const struct dsdb_attribute *attribute, *target_attr;
417 if (!PyArg_ParseTuple(args, "Os", &py_ldb, &ldap_display_name))
420 PyErr_LDB_OR_RAISE(py_ldb, ldb);
422 schema = dsdb_get_schema(ldb, NULL);
425 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
429 attribute = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
430 if (attribute == NULL) {
431 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
435 if (attribute->linkID == 0) {
439 target_attr = dsdb_attribute_by_linkID(schema, attribute->linkID ^ 1);
440 if (target_attr == NULL) {
441 /* when we add pseudo-backlinks we'll need to handle
446 return PyUnicode_FromString(target_attr->lDAPDisplayName);
450 static PyObject *py_dsdb_get_lDAPDisplayName_by_attid(PyObject *self, PyObject *args)
453 struct ldb_context *ldb;
454 struct dsdb_schema *schema;
455 const struct dsdb_attribute *a;
458 if (!PyArg_ParseTuple(args, "OI", &py_ldb, &attid))
461 PyErr_LDB_OR_RAISE(py_ldb, ldb);
463 schema = dsdb_get_schema(ldb, NULL);
466 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
470 a = dsdb_attribute_by_attributeID_id(schema, attid);
472 PyErr_Format(PyExc_KeyError, "Failed to find attribute '0x%08x'", attid);
476 return PyUnicode_FromString(a->lDAPDisplayName);
481 return the attribute syntax oid as a string from the attribute name
483 static PyObject *py_dsdb_get_syntax_oid_from_lDAPDisplayName(PyObject *self, PyObject *args)
486 struct ldb_context *ldb;
487 struct dsdb_schema *schema;
488 const char *ldap_display_name;
489 const struct dsdb_attribute *attribute;
491 if (!PyArg_ParseTuple(args, "Os", &py_ldb, &ldap_display_name))
494 PyErr_LDB_OR_RAISE(py_ldb, ldb);
496 schema = dsdb_get_schema(ldb, NULL);
499 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
503 attribute = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
504 if (attribute == NULL) {
505 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
509 return PyUnicode_FromString(attribute->syntax->ldap_oid);
513 convert a python string to a DRSUAPI drsuapi_DsReplicaAttribute attribute
515 static PyObject *py_dsdb_DsReplicaAttribute(PyObject *self, PyObject *args)
517 PyObject *py_ldb, *el_list, *ret;
518 struct ldb_context *ldb;
519 char *ldap_display_name;
520 const struct dsdb_attribute *a;
521 struct dsdb_schema *schema;
522 struct dsdb_syntax_ctx syntax_ctx;
523 struct ldb_message_element *el;
524 struct drsuapi_DsReplicaAttribute *attr;
529 if (!PyArg_ParseTuple(args, "OsO", &py_ldb, &ldap_display_name, &el_list)) {
533 PyErr_LDB_OR_RAISE(py_ldb, ldb);
535 schema = dsdb_get_schema(ldb, NULL);
537 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
541 a = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
543 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
547 dsdb_syntax_ctx_init(&syntax_ctx, ldb, schema);
548 syntax_ctx.is_schema_nc = false;
550 tmp_ctx = talloc_new(ldb);
551 if (tmp_ctx == NULL) {
556 /* If we were not given an LdbMessageElement */
557 if (!PyList_Check(el_list)) {
558 if (!py_check_dcerpc_type(el_list, "ldb", "MessageElement")) {
559 PyErr_SetString(py_ldb_get_exception(),
560 "list of strings or ldb MessageElement object required");
565 * el may not be a valid talloc context, it
566 * could be part of an array
568 el = pyldb_MessageElement_AsMessageElement(el_list);
570 el = talloc_zero(tmp_ctx, struct ldb_message_element);
573 talloc_free(tmp_ctx);
577 el->name = ldap_display_name;
578 el->num_values = PyList_Size(el_list);
580 el->values = talloc_array(el, struct ldb_val, el->num_values);
581 if (el->values == NULL) {
583 talloc_free(tmp_ctx);
587 for (i = 0; i < el->num_values; i++) {
588 PyObject *item = PyList_GetItem(el_list, i);
589 if (!(PyBytes_Check(item))) {
590 PyErr_Format(PyExc_TypeError,
591 "ldif_element type should be bytes"
593 talloc_free(tmp_ctx);
597 (uint8_t *)PyBytes_AsString(item);
598 el->values[i].length = PyBytes_Size(item);
602 attr = talloc_zero(tmp_ctx, struct drsuapi_DsReplicaAttribute);
605 talloc_free(tmp_ctx);
609 werr = a->syntax->ldb_to_drsuapi(&syntax_ctx, a, el, attr, attr);
610 PyErr_WERROR_NOT_OK_RAISE(werr);
612 ret = py_return_ndr_struct("samba.dcerpc.drsuapi", "DsReplicaAttribute", attr, attr);
614 talloc_free(tmp_ctx);
621 normalise a ldb attribute list
623 static PyObject *py_dsdb_normalise_attributes(PyObject *self, PyObject *args)
625 PyObject *py_ldb, *el_list, *py_ret;
626 struct ldb_context *ldb;
627 char *ldap_display_name;
628 const struct dsdb_attribute *a;
629 struct dsdb_schema *schema;
630 struct dsdb_syntax_ctx syntax_ctx;
631 struct ldb_message_element *el, *new_el;
632 struct drsuapi_DsReplicaAttribute *attr;
633 PyLdbMessageElementObject *ret;
637 PyTypeObject *py_type = NULL;
638 PyObject *module = NULL;
640 if (!PyArg_ParseTuple(args, "OsO", &py_ldb, &ldap_display_name, &el_list)) {
644 PyErr_LDB_OR_RAISE(py_ldb, ldb);
646 schema = dsdb_get_schema(ldb, NULL);
648 PyErr_SetString(PyExc_RuntimeError, "Failed to find a schema from ldb");
652 a = dsdb_attribute_by_lDAPDisplayName(schema, ldap_display_name);
654 PyErr_Format(PyExc_KeyError, "Failed to find attribute '%s'", ldap_display_name);
658 dsdb_syntax_ctx_init(&syntax_ctx, ldb, schema);
659 syntax_ctx.is_schema_nc = false;
661 tmp_ctx = talloc_new(ldb);
662 if (tmp_ctx == NULL) {
667 if (!PyList_Check(el_list)) {
668 if (!py_check_dcerpc_type(el_list, "ldb", "MessageElement")) {
669 PyErr_SetString(py_ldb_get_exception(),
670 "list of strings or ldb MessageElement object required");
675 * el may not be a valid talloc context, it
676 * could be part of an array
678 el = pyldb_MessageElement_AsMessageElement(el_list);
680 el = talloc_zero(tmp_ctx, struct ldb_message_element);
683 talloc_free(tmp_ctx);
687 el->name = ldap_display_name;
688 el->num_values = PyList_Size(el_list);
690 el->values = talloc_array(el, struct ldb_val, el->num_values);
691 if (el->values == NULL) {
693 talloc_free(tmp_ctx);
697 for (i = 0; i < el->num_values; i++) {
698 PyObject *item = PyList_GetItem(el_list, i);
699 if (!PyBytes_Check(item)) {
700 PyErr_Format(PyExc_TypeError,
701 "ldif_element type should be bytes"
703 talloc_free(tmp_ctx);
706 el->values[i].data = (uint8_t *)PyBytes_AsString(item);
707 el->values[i].length = PyBytes_Size(item);
711 new_el = talloc_zero(tmp_ctx, struct ldb_message_element);
712 if (new_el == NULL) {
714 talloc_free(tmp_ctx);
718 /* Normalise "objectClass" attribute if needed */
719 if (ldb_attr_cmp(a->lDAPDisplayName, "objectClass") == 0) {
721 iret = dsdb_sort_objectClass_attr(ldb, schema, el, new_el, new_el);
722 if (iret != LDB_SUCCESS) {
723 PyErr_SetString(PyExc_RuntimeError, ldb_errstring(ldb));
724 talloc_free(tmp_ctx);
729 /* first run ldb_to_drsuapi, then convert back again. This has
730 * the effect of normalising the attributes
733 attr = talloc_zero(tmp_ctx, struct drsuapi_DsReplicaAttribute);
736 talloc_free(tmp_ctx);
740 werr = a->syntax->ldb_to_drsuapi(&syntax_ctx, a, el, attr, attr);
741 PyErr_WERROR_NOT_OK_RAISE(werr);
743 /* now convert back again */
744 werr = a->syntax->drsuapi_to_ldb(&syntax_ctx, a, attr, new_el, new_el);
745 PyErr_WERROR_NOT_OK_RAISE(werr);
747 module = PyImport_ImportModule("ldb");
748 if (module == NULL) {
752 py_type = (PyTypeObject *)PyObject_GetAttrString(module, "MessageElement");
753 if (py_type == NULL) {
760 py_ret = py_type->tp_alloc(py_type, 0);
762 if (py_ret == NULL) {
766 ret = (PyLdbMessageElementObject *)py_ret;
768 ret->mem_ctx = talloc_new(NULL);
769 if (talloc_reference(ret->mem_ctx, new_el) == NULL) {
776 talloc_free(tmp_ctx);
782 static PyObject *py_dsdb_set_ntds_invocation_id(PyObject *self, PyObject *args)
784 PyObject *py_ldb, *py_guid;
787 struct ldb_context *ldb;
788 if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_guid))
791 PyErr_LDB_OR_RAISE(py_ldb, ldb);
792 GUID_from_string(PyUnicode_AsUTF8(py_guid), &guid);
794 if (GUID_all_zero(&guid)) {
795 PyErr_SetString(PyExc_RuntimeError, "set_ntds_invocation_id rejected due to all-zero invocation ID");
799 ret = samdb_set_ntds_invocation_id(ldb, &guid);
801 PyErr_SetString(PyExc_RuntimeError, "set_ntds_invocation_id failed");
807 static PyObject *py_samdb_ntds_objectGUID(PyObject *self, PyObject *args)
809 PyObject *py_ldb, *result;
810 struct ldb_context *ldb;
811 const struct GUID *guid;
814 if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
818 PyErr_LDB_OR_RAISE(py_ldb, ldb);
820 guid = samdb_ntds_objectGUID(ldb);
822 PyErr_SetString(PyExc_RuntimeError, "Failed to find NTDS GUID");
826 retstr = GUID_string(NULL, guid);
827 if (retstr == NULL) {
831 result = PyUnicode_FromString(retstr);
836 static PyObject *py_dsdb_set_global_schema(PyObject *self, PyObject *args)
839 struct ldb_context *ldb;
841 if (!PyArg_ParseTuple(args, "O", &py_ldb))
844 PyErr_LDB_OR_RAISE(py_ldb, ldb);
846 ret = dsdb_set_global_schema(ldb);
847 PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
852 static PyObject *py_dsdb_load_partition_usn(PyObject *self, PyObject *args)
854 PyObject *py_dn, *py_ldb, *result;
856 uint64_t highest_uSN, urgent_uSN;
857 struct ldb_context *ldb;
861 if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_dn)) {
865 PyErr_LDB_OR_RAISE(py_ldb, ldb);
867 mem_ctx = talloc_new(NULL);
868 if (mem_ctx == NULL) {
873 if (!pyldb_Object_AsDn(mem_ctx, py_dn, ldb, &dn)) {
874 talloc_free(mem_ctx);
878 ret = dsdb_load_partition_usn(ldb, dn, &highest_uSN, &urgent_uSN);
879 if (ret != LDB_SUCCESS) {
880 PyErr_Format(PyExc_RuntimeError,
881 "Failed to load partition [%s] uSN - %s",
882 ldb_dn_get_linearized(dn),
884 talloc_free(mem_ctx);
888 talloc_free(mem_ctx);
890 result = Py_BuildValue(
892 "uSNHighest", (uint64_t)highest_uSN,
893 "uSNUrgent", (uint64_t)urgent_uSN);
898 static PyObject *py_dsdb_set_am_rodc(PyObject *self, PyObject *args)
902 struct ldb_context *ldb;
905 if (!PyArg_ParseTuple(args, "Oi", &py_ldb, &py_val))
908 PyErr_LDB_OR_RAISE(py_ldb, ldb);
909 ret = samdb_set_am_rodc(ldb, (bool)py_val);
911 PyErr_SetString(PyExc_RuntimeError, "set_am_rodc failed");
917 static PyObject *py_dsdb_set_schema_from_ldif(PyObject *self, PyObject *args)
922 struct ldb_context *ldb;
924 if (!PyArg_ParseTuple(args, "Osss", &py_ldb, &pf, &df, &dn))
927 PyErr_LDB_OR_RAISE(py_ldb, ldb);
929 result = dsdb_set_schema_from_ldif(ldb, pf, df, dn);
930 PyErr_WERROR_NOT_OK_RAISE(result);
935 static PyObject *py_dsdb_set_schema_from_ldb(PyObject *self, PyObject *args)
938 struct ldb_context *ldb;
939 PyObject *py_from_ldb;
940 struct ldb_context *from_ldb;
941 struct dsdb_schema *schema;
943 char write_indices_and_attributes = SCHEMA_WRITE;
944 if (!PyArg_ParseTuple(args, "OO|b",
945 &py_ldb, &py_from_ldb, &write_indices_and_attributes))
948 PyErr_LDB_OR_RAISE(py_ldb, ldb);
950 PyErr_LDB_OR_RAISE(py_from_ldb, from_ldb);
952 schema = dsdb_get_schema(from_ldb, NULL);
954 PyErr_SetString(PyExc_RuntimeError, "Failed to set find a schema on 'from' ldb!\n");
958 ret = dsdb_reference_schema(ldb, schema, write_indices_and_attributes);
959 PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
964 static PyObject *py_dsdb_write_prefixes_from_schema_to_ldb(PyObject *self, PyObject *args)
967 struct ldb_context *ldb;
969 struct dsdb_schema *schema;
971 if (!PyArg_ParseTuple(args, "O", &py_ldb))
974 PyErr_LDB_OR_RAISE(py_ldb, ldb);
976 schema = dsdb_get_schema(ldb, NULL);
978 PyErr_SetString(PyExc_RuntimeError, "Failed to set find a schema on ldb!\n");
982 result = dsdb_write_prefixes_from_schema_to_ldb(NULL, ldb, schema);
983 PyErr_WERROR_NOT_OK_RAISE(result);
989 static PyObject *py_dsdb_get_partitions_dn(PyObject *self, PyObject *args)
991 struct ldb_context *ldb;
993 PyObject *py_ldb, *ret;
995 if (!PyArg_ParseTuple(args, "O", &py_ldb))
998 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1000 dn = samdb_partitions_dn(ldb, NULL);
1005 ret = pyldb_Dn_FromDn(dn);
1011 static PyObject *py_dsdb_get_nc_root(PyObject *self, PyObject *args)
1013 struct ldb_context *ldb;
1014 struct ldb_dn *dn, *nc_root;
1015 PyObject *py_ldb, *py_ldb_dn, *py_nc_root;
1018 if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_ldb_dn))
1021 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1022 PyErr_LDB_DN_OR_RAISE(py_ldb_dn, dn);
1024 ret = dsdb_find_nc_root(ldb, ldb, dn, &nc_root);
1025 PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1027 py_nc_root = pyldb_Dn_FromDn(nc_root);
1028 talloc_unlink(ldb, nc_root);
1032 static PyObject *py_dsdb_get_wellknown_dn(PyObject *self, PyObject *args)
1034 struct ldb_context *ldb;
1035 struct ldb_dn *nc_dn, *wk_dn;
1037 PyObject *py_ldb, *py_nc_dn, *py_wk_dn;
1040 if (!PyArg_ParseTuple(args, "OOs", &py_ldb, &py_nc_dn, &wkguid))
1043 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1044 PyErr_LDB_DN_OR_RAISE(py_nc_dn, nc_dn);
1046 ret = dsdb_wellknown_dn(ldb, ldb, nc_dn, wkguid, &wk_dn);
1047 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
1048 PyErr_Format(PyExc_KeyError, "Failed to find well known DN for GUID %s", wkguid);
1052 PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1054 py_wk_dn = pyldb_Dn_FromDn(wk_dn);
1055 talloc_unlink(ldb, wk_dn);
1061 call into samdb_rodc()
1063 static PyObject *py_dsdb_am_rodc(PyObject *self, PyObject *args)
1066 struct ldb_context *ldb;
1070 if (!PyArg_ParseTuple(args, "O", &py_ldb))
1073 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1075 ret = samdb_rodc(ldb, &am_rodc);
1076 if (ret != LDB_SUCCESS) {
1077 PyErr_SetString(PyExc_RuntimeError, ldb_errstring(ldb));
1081 return PyBool_FromLong(am_rodc);
1085 call into samdb_is_pdc()
1087 static PyObject *py_dsdb_am_pdc(PyObject *self, PyObject *args)
1090 struct ldb_context *ldb;
1093 if (!PyArg_ParseTuple(args, "O", &py_ldb))
1096 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1098 am_pdc = samdb_is_pdc(ldb);
1099 return PyBool_FromLong(am_pdc);
1103 call DSDB_EXTENDED_CREATE_OWN_RID_SET to get a new RID set for this server
1105 static PyObject *py_dsdb_create_own_rid_set(PyObject *self, PyObject *args)
1108 struct ldb_context *ldb;
1110 struct ldb_result *ext_res;
1112 if (!PyArg_ParseTuple(args, "O", &py_ldb))
1115 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1118 * Run DSDB_EXTENDED_CREATE_OWN_RID_SET to get a RID set
1121 ret = ldb_extended(ldb, DSDB_EXTENDED_CREATE_OWN_RID_SET, NULL, &ext_res);
1123 PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1125 TALLOC_FREE(ext_res);
1131 call DSDB_EXTENDED_ALLOCATE_RID to get a new RID set for this server
1133 static PyObject *py_dsdb_allocate_rid(PyObject *self, PyObject *args)
1136 struct ldb_context *ldb;
1139 struct ldb_result *ext_res = NULL;
1140 struct dsdb_extended_allocate_rid *rid_return = NULL;
1141 if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
1145 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1147 rid_return = talloc_zero(ldb, struct dsdb_extended_allocate_rid);
1148 if (rid_return == NULL) {
1149 return PyErr_NoMemory();
1153 * Run DSDB_EXTENDED_ALLOCATE_RID to get a new RID
1156 ret = ldb_extended(ldb, DSDB_EXTENDED_ALLOCATE_RID, rid_return, &ext_res);
1157 if (ret != LDB_SUCCESS) {
1158 TALLOC_FREE(rid_return);
1159 TALLOC_FREE(ext_res);
1160 PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1163 rid = rid_return->rid;
1164 TALLOC_FREE(rid_return);
1165 TALLOC_FREE(ext_res);
1167 return PyLong_FromLong(rid);
1170 #ifdef AD_DC_BUILD_IS_ENABLED
1172 * These functions will not work correctly on non-AD_DC builds.
1174 * The only real principal in deciding whether to put something within
1175 * these guards is whether it will compile and work when
1176 * bld.AD_DC_BUILD_IS_ENABLED() says no.
1178 * Most of DSDB is built and samba-tool will work fine with remote
1179 * servers (using -H ldap://), but some DNS and periodic service
1180 * functions are not built.
1183 static PyObject *py_dns_delete_tombstones(PyObject *self, PyObject *args)
1187 struct ldb_context *ldb = NULL;
1188 TALLOC_CTX *mem_ctx = NULL;
1189 char *error_string = NULL;
1191 if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
1194 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1196 mem_ctx = talloc_new(ldb);
1197 if (mem_ctx == NULL) {
1198 return PyErr_NoMemory();
1201 status = dns_delete_tombstones(mem_ctx, ldb, &error_string);
1203 if (!NT_STATUS_IS_OK(status)) {
1205 PyErr_Format(PyExc_RuntimeError, "%s", error_string);
1207 PyErr_SetNTSTATUS(status);
1209 TALLOC_FREE(mem_ctx);
1213 TALLOC_FREE(mem_ctx);
1217 static PyObject *py_scavenge_dns_records(PyObject *self, PyObject *args)
1221 struct ldb_context *ldb = NULL;
1222 TALLOC_CTX *mem_ctx = NULL;
1223 char *error_string = NULL;
1225 if (!PyArg_ParseTuple(args, "O", &py_ldb)) {
1228 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1230 mem_ctx = talloc_new(ldb);
1231 if (mem_ctx == NULL) {
1232 return PyErr_NoMemory();
1235 status = dns_tombstone_records(mem_ctx, ldb, &error_string);
1237 if (!NT_STATUS_IS_OK(status)) {
1239 PyErr_Format(PyExc_RuntimeError, "%s", error_string);
1241 PyErr_SetNTSTATUS(status);
1243 TALLOC_FREE(mem_ctx);
1247 TALLOC_FREE(mem_ctx);
1251 static PyObject *py_dsdb_garbage_collect_tombstones(PyObject *self, PyObject *args)
1253 PyObject *py_ldb, *py_list_dn;
1254 struct ldb_context *ldb = NULL;
1257 long long _current_time, _tombstone_lifetime = LLONG_MAX;
1258 uint32_t tombstone_lifetime32;
1259 struct dsdb_ldb_dn_list_node *part = NULL;
1260 time_t current_time, tombstone_lifetime;
1261 TALLOC_CTX *mem_ctx = NULL;
1263 unsigned int num_objects_removed = 0;
1264 unsigned int num_links_removed = 0;
1265 char *error_string = NULL;
1267 if (!PyArg_ParseTuple(args, "OOL|L", &py_ldb,
1268 &py_list_dn, &_current_time, &_tombstone_lifetime)) {
1273 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1275 mem_ctx = talloc_new(ldb);
1276 if (mem_ctx == NULL) {
1277 return PyErr_NoMemory();
1280 current_time = _current_time;
1282 if (_tombstone_lifetime == LLONG_MAX) {
1283 int ret = dsdb_tombstone_lifetime(ldb, &tombstone_lifetime32);
1284 if (ret != LDB_SUCCESS) {
1285 PyErr_Format(PyExc_RuntimeError,
1286 "Failed to get tombstone lifetime: %s",
1287 ldb_errstring(ldb));
1288 TALLOC_FREE(mem_ctx);
1291 tombstone_lifetime = tombstone_lifetime32;
1293 tombstone_lifetime = _tombstone_lifetime;
1296 if (!PyList_Check(py_list_dn)) {
1297 PyErr_SetString(PyExc_TypeError, "A list of DNs were expected");
1298 TALLOC_FREE(mem_ctx);
1302 length = PyList_GET_SIZE(py_list_dn);
1304 for (i = 0; i < length; i++) {
1305 const char *part_str = PyUnicode_AsUTF8(PyList_GetItem(py_list_dn, i));
1307 struct dsdb_ldb_dn_list_node *node;
1309 if (part_str == NULL) {
1310 TALLOC_FREE(mem_ctx);
1311 return PyErr_NoMemory();
1314 p = ldb_dn_new(mem_ctx, ldb, part_str);
1316 PyErr_Format(PyExc_RuntimeError, "Failed to parse DN %s", part_str);
1317 TALLOC_FREE(mem_ctx);
1320 node = talloc_zero(mem_ctx, struct dsdb_ldb_dn_list_node);
1323 DLIST_ADD_END(part, node);
1326 status = dsdb_garbage_collect_tombstones(mem_ctx, ldb,
1329 &num_objects_removed,
1333 if (!NT_STATUS_IS_OK(status)) {
1335 PyErr_Format(PyExc_RuntimeError, "%s", error_string);
1337 PyErr_SetNTSTATUS(status);
1339 TALLOC_FREE(mem_ctx);
1343 TALLOC_FREE(mem_ctx);
1345 return Py_BuildValue("(II)", num_objects_removed,
1351 static PyObject *py_dsdb_not_implemented(PyObject *self, PyObject *args)
1353 PyErr_SetString(PyExc_NotImplementedError,
1354 "Library built without AD DC support");
1358 #endif /* AD_DC_BUILD_IS_ENABLED */
1361 static PyObject *py_dsdb_load_udv_v2(PyObject *self, PyObject *args)
1366 PyObject *py_ldb = NULL, *py_dn = NULL, *pylist = NULL;
1367 struct ldb_context *samdb = NULL;
1368 struct ldb_dn *dn = NULL;
1369 struct drsuapi_DsReplicaCursor2 *cursors = NULL;
1370 TALLOC_CTX *tmp_ctx = NULL;
1372 if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_dn)) {
1376 PyErr_LDB_OR_RAISE(py_ldb, samdb);
1378 tmp_ctx = talloc_new(samdb);
1379 if (tmp_ctx == NULL) {
1380 return PyErr_NoMemory();
1383 ok = pyldb_Object_AsDn(tmp_ctx, py_dn, samdb, &dn);
1385 TALLOC_FREE(tmp_ctx);
1389 ret = dsdb_load_udv_v2(samdb, dn, tmp_ctx, &cursors, &count);
1390 if (ret != LDB_SUCCESS) {
1391 TALLOC_FREE(tmp_ctx);
1392 PyErr_SetString(PyExc_RuntimeError,
1393 "Failed to load udv from ldb");
1397 pylist = PyList_New(count);
1398 if (pylist == NULL) {
1399 TALLOC_FREE(tmp_ctx);
1400 return PyErr_NoMemory();
1403 for (i = 0; i < count; i++) {
1404 PyObject *py_cursor;
1405 struct drsuapi_DsReplicaCursor2 *cursor;
1406 cursor = talloc(tmp_ctx, struct drsuapi_DsReplicaCursor2);
1407 if (cursor == NULL) {
1408 TALLOC_FREE(tmp_ctx);
1409 return PyErr_NoMemory();
1411 *cursor = cursors[i];
1413 py_cursor = py_return_ndr_struct("samba.dcerpc.drsuapi",
1416 if (py_cursor == NULL) {
1417 TALLOC_FREE(tmp_ctx);
1418 return PyErr_NoMemory();
1421 PyList_SetItem(pylist, i, py_cursor);
1424 TALLOC_FREE(tmp_ctx);
1428 static PyObject *py_dsdb_user_account_control_flag_bit_to_string(PyObject *self, PyObject *args)
1432 if (!PyArg_ParseTuple(args, "L", &uf)) {
1436 if (uf > UINT32_MAX) {
1437 return PyErr_Format(PyExc_OverflowError, "No UF_ flags are over UINT32_MAX");
1440 return PyErr_Format(PyExc_KeyError, "No UF_ flags are less then zero");
1443 str = dsdb_user_account_control_flag_bit_to_string(uf);
1445 return PyErr_Format(PyExc_KeyError,
1446 "No such UF_ flag 0x%08x",
1449 return PyUnicode_FromString(str);
1452 static PyObject *py_dsdb_check_and_update_fl(PyObject *self, PyObject *args)
1454 TALLOC_CTX *frame = NULL;
1456 PyObject *py_ldb = NULL, *py_lp = NULL;
1457 struct ldb_context *ldb = NULL;
1458 struct loadparm_context *lp_ctx = NULL;
1462 if (!PyArg_ParseTuple(args, "OO", &py_ldb, &py_lp)) {
1466 PyErr_LDB_OR_RAISE(py_ldb, ldb);
1468 frame = talloc_stackframe();
1470 lp_ctx = lpcfg_from_py_object(frame, py_lp);
1471 if (lp_ctx == NULL) {
1476 ret = dsdb_check_and_update_fl(ldb, lp_ctx);
1479 PyErr_LDB_ERROR_IS_ERR_RAISE(py_ldb_get_exception(), ret, ldb);
1484 static PyObject *py_dsdb_dc_operatingSystemVersion(PyObject *self, PyObject *args)
1486 const char *str = NULL;
1489 if (!PyArg_ParseTuple(args, "i", &dc_level)) {
1493 str = dsdb_dc_operatingSystemVersion(dc_level);
1495 return PyErr_Format(PyExc_KeyError,
1496 "dsdb_dc_operatingSystemVersion(%d) failed",
1500 return PyUnicode_FromString(str);
1503 static PyMethodDef py_dsdb_methods[] = {
1504 { "_samdb_server_site_name", (PyCFunction)py_samdb_server_site_name,
1505 METH_VARARGS, "Get the server site name as a string"},
1506 { "_dsdb_convert_schema_to_openldap",
1507 (PyCFunction)py_dsdb_convert_schema_to_openldap, METH_VARARGS,
1508 "dsdb_convert_schema_to_openldap(ldb, target_str, mapping) -> str\n"
1509 "Create an OpenLDAP schema from a schema." },
1510 { "_samdb_set_domain_sid", (PyCFunction)py_samdb_set_domain_sid,
1512 "samdb_set_domain_sid(samdb, sid)\n"
1513 "Set SID of domain to use." },
1514 { "_samdb_get_domain_sid", (PyCFunction)py_samdb_get_domain_sid,
1516 "samdb_get_domain_sid(samdb)\n"
1517 "Get SID of domain in use." },
1518 { "_samdb_ntds_invocation_id", (PyCFunction)py_samdb_ntds_invocation_id,
1519 METH_VARARGS, "get the NTDS invocation ID GUID as a string"},
1520 { "_samdb_set_ntds_settings_dn", (PyCFunction)py_samdb_set_ntds_settings_dn,
1522 "samdb_set_ntds_settings_dn(samdb, ntds_settings_dn)\n"
1523 "Set NTDS Settings DN for this LDB (allows it to be set before the DB fully exists)." },
1524 { "_dsdb_get_oid_from_attid", (PyCFunction)py_dsdb_get_oid_from_attid,
1525 METH_VARARGS, NULL },
1526 { "_dsdb_get_attid_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_attid_from_lDAPDisplayName,
1527 METH_VARARGS, NULL },
1528 { "_dsdb_get_syntax_oid_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_syntax_oid_from_lDAPDisplayName,
1529 METH_VARARGS, NULL },
1530 { "_dsdb_get_systemFlags_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_systemFlags_from_lDAPDisplayName,
1531 METH_VARARGS, NULL },
1532 { "_dsdb_get_linkId_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_linkId_from_lDAPDisplayName,
1533 METH_VARARGS, NULL },
1534 { "_dsdb_get_lDAPDisplayName_by_attid", (PyCFunction)py_dsdb_get_lDAPDisplayName_by_attid,
1535 METH_VARARGS, NULL },
1536 { "_dsdb_get_backlink_from_lDAPDisplayName", (PyCFunction)py_dsdb_get_backlink_from_lDAPDisplayName,
1537 METH_VARARGS, NULL },
1538 { "_dsdb_set_ntds_invocation_id",
1539 (PyCFunction)py_dsdb_set_ntds_invocation_id, METH_VARARGS,
1541 { "_samdb_ntds_objectGUID", (PyCFunction)py_samdb_ntds_objectGUID,
1542 METH_VARARGS, "get the NTDS objectGUID as a string"},
1543 { "_dsdb_set_global_schema", (PyCFunction)py_dsdb_set_global_schema,
1544 METH_VARARGS, NULL },
1545 { "_dsdb_load_partition_usn", (PyCFunction)py_dsdb_load_partition_usn,
1547 "get uSNHighest and uSNUrgent from the partition @REPLCHANGED"},
1548 { "_dsdb_set_am_rodc",
1549 (PyCFunction)py_dsdb_set_am_rodc, METH_VARARGS,
1552 (PyCFunction)py_dsdb_am_rodc, METH_VARARGS,
1555 (PyCFunction)py_dsdb_am_pdc, METH_VARARGS,
1557 { "_dsdb_set_schema_from_ldif", (PyCFunction)py_dsdb_set_schema_from_ldif, METH_VARARGS,
1559 { "_dsdb_set_schema_from_ldb", (PyCFunction)py_dsdb_set_schema_from_ldb, METH_VARARGS,
1561 { "_dsdb_write_prefixes_from_schema_to_ldb", (PyCFunction)py_dsdb_write_prefixes_from_schema_to_ldb, METH_VARARGS,
1563 { "_dsdb_get_partitions_dn", (PyCFunction)py_dsdb_get_partitions_dn, METH_VARARGS, NULL },
1564 { "_dsdb_get_nc_root", (PyCFunction)py_dsdb_get_nc_root, METH_VARARGS, NULL },
1565 { "_dsdb_get_wellknown_dn", (PyCFunction)py_dsdb_get_wellknown_dn, METH_VARARGS, NULL },
1566 { "_dsdb_DsReplicaAttribute", (PyCFunction)py_dsdb_DsReplicaAttribute, METH_VARARGS, NULL },
1567 { "_dsdb_normalise_attributes", (PyCFunction)py_dsdb_normalise_attributes, METH_VARARGS, NULL },
1568 #ifdef AD_DC_BUILD_IS_ENABLED
1569 { "_dsdb_garbage_collect_tombstones", (PyCFunction)py_dsdb_garbage_collect_tombstones, METH_VARARGS,
1570 "_dsdb_kcc_check_deleted(samdb, [dn], current_time, tombstone_lifetime)"
1571 " -> (num_objects_expunged, num_links_expunged)" },
1572 { "_scavenge_dns_records", (PyCFunction)py_scavenge_dns_records,
1573 METH_VARARGS, NULL},
1574 { "_dns_delete_tombstones", (PyCFunction)py_dns_delete_tombstones,
1575 METH_VARARGS, NULL},
1577 { "_dsdb_garbage_collect_tombstones", (PyCFunction)py_dsdb_not_implemented,
1578 METH_VARARGS, NULL},
1579 { "_scavenge_dns_records", (PyCFunction)py_dsdb_not_implemented,
1580 METH_VARARGS, NULL},
1581 { "_dns_delete_tombstones", (PyCFunction)py_dsdb_not_implemented,
1582 METH_VARARGS, NULL},
1584 { "_dsdb_create_own_rid_set", (PyCFunction)py_dsdb_create_own_rid_set, METH_VARARGS,
1585 "_dsdb_create_own_rid_set(samdb)"
1587 { "_dsdb_allocate_rid", (PyCFunction)py_dsdb_allocate_rid, METH_VARARGS,
1588 "_dsdb_allocate_rid(samdb)"
1590 { "_dsdb_load_udv_v2", (PyCFunction)py_dsdb_load_udv_v2, METH_VARARGS, NULL },
1591 { "user_account_control_flag_bit_to_string",
1592 (PyCFunction)py_dsdb_user_account_control_flag_bit_to_string,
1594 "user_account_control_flag_bit_to_string(bit)"
1595 " -> string name" },
1596 { "check_and_update_fl",
1597 (PyCFunction)py_dsdb_check_and_update_fl,
1599 "check_and_update_fl(ldb, lp) -> None\n"
1600 "Hook to run in testing the code run on samba server startup "
1601 "to validate and update DC functional levels"},
1602 { "dc_operatingSystemVersion",
1603 (PyCFunction)py_dsdb_dc_operatingSystemVersion,
1605 "dsdb_dc_operatingSystemVersion(dc_level)"
1606 " -> string name" },
1610 static struct PyModuleDef moduledef = {
1611 PyModuleDef_HEAD_INIT,
1613 .m_doc = "Python bindings for the directory service databases.",
1615 .m_methods = py_dsdb_methods,
1618 MODULE_INIT_FUNC(dsdb)
1622 m = PyModule_Create(&moduledef);
1627 #define ADD_DSDB_FLAG(val) PyModule_AddObject(m, #val, PyLong_FromLong(val))
1629 /* "userAccountControl" flags */
1630 ADD_DSDB_FLAG(UF_NORMAL_ACCOUNT);
1631 ADD_DSDB_FLAG(UF_TEMP_DUPLICATE_ACCOUNT);
1632 ADD_DSDB_FLAG(UF_SERVER_TRUST_ACCOUNT);
1633 ADD_DSDB_FLAG(UF_WORKSTATION_TRUST_ACCOUNT);
1634 ADD_DSDB_FLAG(UF_INTERDOMAIN_TRUST_ACCOUNT);
1635 ADD_DSDB_FLAG(UF_PASSWD_NOTREQD);
1636 ADD_DSDB_FLAG(UF_ACCOUNTDISABLE);
1638 ADD_DSDB_FLAG(UF_SCRIPT);
1639 ADD_DSDB_FLAG(UF_ACCOUNTDISABLE);
1640 ADD_DSDB_FLAG(UF_00000004);
1641 ADD_DSDB_FLAG(UF_HOMEDIR_REQUIRED);
1642 ADD_DSDB_FLAG(UF_LOCKOUT);
1643 ADD_DSDB_FLAG(UF_PASSWD_NOTREQD);
1644 ADD_DSDB_FLAG(UF_PASSWD_CANT_CHANGE);
1645 ADD_DSDB_FLAG(UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED);
1646 ADD_DSDB_FLAG(UF_TEMP_DUPLICATE_ACCOUNT);
1647 ADD_DSDB_FLAG(UF_NORMAL_ACCOUNT);
1648 ADD_DSDB_FLAG(UF_00000400);
1649 ADD_DSDB_FLAG(UF_INTERDOMAIN_TRUST_ACCOUNT);
1650 ADD_DSDB_FLAG(UF_WORKSTATION_TRUST_ACCOUNT);
1651 ADD_DSDB_FLAG(UF_SERVER_TRUST_ACCOUNT);
1652 ADD_DSDB_FLAG(UF_00004000);
1653 ADD_DSDB_FLAG(UF_00008000);
1654 ADD_DSDB_FLAG(UF_DONT_EXPIRE_PASSWD);
1655 ADD_DSDB_FLAG(UF_MNS_LOGON_ACCOUNT);
1656 ADD_DSDB_FLAG(UF_SMARTCARD_REQUIRED);
1657 ADD_DSDB_FLAG(UF_TRUSTED_FOR_DELEGATION);
1658 ADD_DSDB_FLAG(UF_NOT_DELEGATED);
1659 ADD_DSDB_FLAG(UF_USE_DES_KEY_ONLY);
1660 ADD_DSDB_FLAG(UF_DONT_REQUIRE_PREAUTH);
1661 ADD_DSDB_FLAG(UF_PASSWORD_EXPIRED);
1662 ADD_DSDB_FLAG(UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION);
1663 ADD_DSDB_FLAG(UF_NO_AUTH_DATA_REQUIRED);
1664 ADD_DSDB_FLAG(UF_PARTIAL_SECRETS_ACCOUNT);
1665 ADD_DSDB_FLAG(UF_USE_AES_KEYS);
1667 /* groupType flags */
1668 ADD_DSDB_FLAG(GTYPE_SECURITY_BUILTIN_LOCAL_GROUP);
1669 ADD_DSDB_FLAG(GTYPE_SECURITY_GLOBAL_GROUP);
1670 ADD_DSDB_FLAG(GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1671 ADD_DSDB_FLAG(GTYPE_SECURITY_UNIVERSAL_GROUP);
1672 ADD_DSDB_FLAG(GTYPE_DISTRIBUTION_GLOBAL_GROUP);
1673 ADD_DSDB_FLAG(GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP);
1674 ADD_DSDB_FLAG(GTYPE_DISTRIBUTION_UNIVERSAL_GROUP);
1676 /* "sAMAccountType" flags */
1677 ADD_DSDB_FLAG(ATYPE_NORMAL_ACCOUNT);
1678 ADD_DSDB_FLAG(ATYPE_WORKSTATION_TRUST);
1679 ADD_DSDB_FLAG(ATYPE_INTERDOMAIN_TRUST);
1680 ADD_DSDB_FLAG(ATYPE_SECURITY_GLOBAL_GROUP);
1681 ADD_DSDB_FLAG(ATYPE_SECURITY_LOCAL_GROUP);
1682 ADD_DSDB_FLAG(ATYPE_SECURITY_UNIVERSAL_GROUP);
1683 ADD_DSDB_FLAG(ATYPE_DISTRIBUTION_GLOBAL_GROUP);
1684 ADD_DSDB_FLAG(ATYPE_DISTRIBUTION_LOCAL_GROUP);
1685 ADD_DSDB_FLAG(ATYPE_DISTRIBUTION_UNIVERSAL_GROUP);
1687 /* "domainFunctionality", "forestFunctionality" flags in the rootDSE */
1688 ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2000);
1689 ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2003_MIXED);
1690 ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2003);
1691 ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2008);
1692 ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2008_R2);
1693 ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2012);
1694 ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2012_R2);
1695 ADD_DSDB_FLAG(DS_DOMAIN_FUNCTION_2016);
1697 /* nc replica flags */
1698 ADD_DSDB_FLAG(INSTANCE_TYPE_IS_NC_HEAD);
1699 ADD_DSDB_FLAG(INSTANCE_TYPE_UNINSTANT);
1700 ADD_DSDB_FLAG(INSTANCE_TYPE_WRITE);
1701 ADD_DSDB_FLAG(INSTANCE_TYPE_NC_ABOVE);
1702 ADD_DSDB_FLAG(INSTANCE_TYPE_NC_COMING);
1703 ADD_DSDB_FLAG(INSTANCE_TYPE_NC_GOING);
1706 ADD_DSDB_FLAG(SYSTEM_FLAG_CR_NTDS_NC);
1707 ADD_DSDB_FLAG(SYSTEM_FLAG_CR_NTDS_DOMAIN);
1708 ADD_DSDB_FLAG(SYSTEM_FLAG_CR_NTDS_NOT_GC_REPLICATED);
1709 ADD_DSDB_FLAG(SYSTEM_FLAG_SCHEMA_BASE_OBJECT);
1710 ADD_DSDB_FLAG(SYSTEM_FLAG_ATTR_IS_RDN);
1711 ADD_DSDB_FLAG(SYSTEM_FLAG_DISALLOW_MOVE_ON_DELETE);
1712 ADD_DSDB_FLAG(SYSTEM_FLAG_DOMAIN_DISALLOW_MOVE);
1713 ADD_DSDB_FLAG(SYSTEM_FLAG_DOMAIN_DISALLOW_RENAME);
1714 ADD_DSDB_FLAG(SYSTEM_FLAG_CONFIG_ALLOW_LIMITED_MOVE);
1715 ADD_DSDB_FLAG(SYSTEM_FLAG_CONFIG_ALLOW_MOVE);
1716 ADD_DSDB_FLAG(SYSTEM_FLAG_CONFIG_ALLOW_RENAME);
1717 ADD_DSDB_FLAG(SYSTEM_FLAG_DISALLOW_DELETE);
1719 /* Kerberos encryption type constants */
1720 ADD_DSDB_FLAG(ENC_ALL_TYPES);
1721 ADD_DSDB_FLAG(ENC_CRC32);
1722 ADD_DSDB_FLAG(ENC_RSA_MD5);
1723 ADD_DSDB_FLAG(ENC_RC4_HMAC_MD5);
1724 ADD_DSDB_FLAG(ENC_HMAC_SHA1_96_AES128);
1725 ADD_DSDB_FLAG(ENC_HMAC_SHA1_96_AES256);
1726 ADD_DSDB_FLAG(ENC_HMAC_SHA1_96_AES256_SK);
1728 ADD_DSDB_FLAG(SEARCH_FLAG_ATTINDEX);
1729 ADD_DSDB_FLAG(SEARCH_FLAG_PDNTATTINDEX);
1730 ADD_DSDB_FLAG(SEARCH_FLAG_ANR);
1731 ADD_DSDB_FLAG(SEARCH_FLAG_PRESERVEONDELETE);
1732 ADD_DSDB_FLAG(SEARCH_FLAG_COPY);
1733 ADD_DSDB_FLAG(SEARCH_FLAG_TUPLEINDEX);
1734 ADD_DSDB_FLAG(SEARCH_FLAG_SUBTREEATTRINDEX);
1735 ADD_DSDB_FLAG(SEARCH_FLAG_CONFIDENTIAL);
1736 ADD_DSDB_FLAG(SEARCH_FLAG_NEVERVALUEAUDIT);
1737 ADD_DSDB_FLAG(SEARCH_FLAG_RODC_ATTRIBUTE);
1739 ADD_DSDB_FLAG(DS_FLAG_ATTR_NOT_REPLICATED);
1740 ADD_DSDB_FLAG(DS_FLAG_ATTR_REQ_PARTIAL_SET_MEMBER);
1741 ADD_DSDB_FLAG(DS_FLAG_ATTR_IS_CONSTRUCTED);
1743 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_AUTO_TOPOLOGY_DISABLED);
1744 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_TOPL_CLEANUP_DISABLED);
1745 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_TOPL_MIN_HOPS_DISABLED);
1746 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_TOPL_DETECT_STALE_DISABLED);
1747 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_INTER_SITE_AUTO_TOPOLOGY_DISABLED);
1748 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_GROUP_CACHING_ENABLED);
1749 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_FORCE_KCC_WHISTLER_BEHAVIOR);
1750 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_RAND_BH_SELECTION_DISABLED);
1751 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_SCHEDULE_HASHING_ENABLED);
1752 ADD_DSDB_FLAG(DS_NTDSSETTINGS_OPT_IS_REDUNDANT_SERVER_TOPOLOGY_ENABLED);
1754 ADD_DSDB_FLAG(DS_NTDSDSA_OPT_IS_GC);
1755 ADD_DSDB_FLAG(DS_NTDSDSA_OPT_DISABLE_INBOUND_REPL);
1756 ADD_DSDB_FLAG(DS_NTDSDSA_OPT_DISABLE_OUTBOUND_REPL);
1757 ADD_DSDB_FLAG(DS_NTDSDSA_OPT_DISABLE_NTDSCONN_XLATE);
1758 ADD_DSDB_FLAG(DS_NTDSDSA_OPT_DISABLE_SPN_REGISTRATION);
1760 /* dsHeuristics character indexes (see MS-ADTS 7.1.1.2.4.1.2) */
1761 ADD_DSDB_FLAG(DS_HR_SUPFIRSTLASTANR);
1762 ADD_DSDB_FLAG(DS_HR_SUPLASTFIRSTANR);
1763 ADD_DSDB_FLAG(DS_HR_DOLISTOBJECT);
1764 ADD_DSDB_FLAG(DS_HR_DONICKRES);
1765 ADD_DSDB_FLAG(DS_HR_LDAP_USEPERMMOD);
1766 ADD_DSDB_FLAG(DS_HR_HIDEDSID);
1767 ADD_DSDB_FLAG(DS_HR_BLOCK_ANONYMOUS_OPS);
1768 ADD_DSDB_FLAG(DS_HR_ALLOW_ANON_NSPI);
1769 ADD_DSDB_FLAG(DS_HR_USER_PASSWORD_SUPPORT);
1770 ADD_DSDB_FLAG(DS_HR_TENTH_CHAR);
1771 ADD_DSDB_FLAG(DS_HR_SPECIFY_GUID_ON_ADD);
1772 ADD_DSDB_FLAG(DS_HR_NO_STANDARD_SD);
1773 ADD_DSDB_FLAG(DS_HR_ALLOW_NONSECURE_PWD_OPS);
1774 ADD_DSDB_FLAG(DS_HR_NO_PROPAGATE_ON_NOCHANGE);
1775 ADD_DSDB_FLAG(DS_HR_COMPUTE_ANR_STATS);
1776 ADD_DSDB_FLAG(DS_HR_ADMINSDEXMASK);
1777 ADD_DSDB_FLAG(DS_HR_KVNOEMUW2K);
1779 ADD_DSDB_FLAG(DS_HR_TWENTIETH_CHAR);
1780 ADD_DSDB_FLAG(DS_HR_ATTR_AUTHZ_ON_LDAP_ADD);
1781 ADD_DSDB_FLAG(DS_HR_BLOCK_OWNER_IMPLICIT_RIGHTS);
1782 ADD_DSDB_FLAG(DS_HR_THIRTIETH_CHAR);
1783 ADD_DSDB_FLAG(DS_HR_FOURTIETH_CHAR);
1784 ADD_DSDB_FLAG(DS_HR_FIFTIETH_CHAR);
1785 ADD_DSDB_FLAG(DS_HR_SIXTIETH_CHAR);
1786 ADD_DSDB_FLAG(DS_HR_SEVENTIETH_CHAR);
1787 ADD_DSDB_FLAG(DS_HR_EIGHTIETH_CHAR);
1788 ADD_DSDB_FLAG(DS_HR_NINETIETH_CHAR);
1790 ADD_DSDB_FLAG(NTDSCONN_KCC_GC_TOPOLOGY);
1791 ADD_DSDB_FLAG(NTDSCONN_KCC_RING_TOPOLOGY);
1792 ADD_DSDB_FLAG(NTDSCONN_KCC_MINIMIZE_HOPS_TOPOLOGY);
1793 ADD_DSDB_FLAG(NTDSCONN_KCC_STALE_SERVERS_TOPOLOGY);
1794 ADD_DSDB_FLAG(NTDSCONN_KCC_OSCILLATING_CONNECTION_TOPOLOGY);
1795 ADD_DSDB_FLAG(NTDSCONN_KCC_INTERSITE_GC_TOPOLOGY);
1796 ADD_DSDB_FLAG(NTDSCONN_KCC_INTERSITE_TOPOLOGY);
1797 ADD_DSDB_FLAG(NTDSCONN_KCC_SERVER_FAILOVER_TOPOLOGY);
1798 ADD_DSDB_FLAG(NTDSCONN_KCC_SITE_FAILOVER_TOPOLOGY);
1799 ADD_DSDB_FLAG(NTDSCONN_KCC_REDUNDANT_SERVER_TOPOLOGY);
1801 ADD_DSDB_FLAG(NTDSCONN_OPT_IS_GENERATED);
1802 ADD_DSDB_FLAG(NTDSCONN_OPT_TWOWAY_SYNC);
1803 ADD_DSDB_FLAG(NTDSCONN_OPT_OVERRIDE_NOTIFY_DEFAULT);
1804 ADD_DSDB_FLAG(NTDSCONN_OPT_USE_NOTIFY);
1805 ADD_DSDB_FLAG(NTDSCONN_OPT_DISABLE_INTERSITE_COMPRESSION);
1806 ADD_DSDB_FLAG(NTDSCONN_OPT_USER_OWNED_SCHEDULE);
1807 ADD_DSDB_FLAG(NTDSCONN_OPT_RODC_TOPOLOGY);
1809 /* Site Link Object options */
1810 ADD_DSDB_FLAG(NTDSSITELINK_OPT_USE_NOTIFY);
1811 ADD_DSDB_FLAG(NTDSSITELINK_OPT_TWOWAY_SYNC);
1812 ADD_DSDB_FLAG(NTDSSITELINK_OPT_DISABLE_COMPRESSION);
1814 /* GPO policy flags */
1815 ADD_DSDB_FLAG(GPLINK_OPT_DISABLE);
1816 ADD_DSDB_FLAG(GPLINK_OPT_ENFORCE);
1817 ADD_DSDB_FLAG(GPO_FLAG_USER_DISABLE);
1818 ADD_DSDB_FLAG(GPO_FLAG_MACHINE_DISABLE);
1819 ADD_DSDB_FLAG(GPO_INHERIT);
1820 ADD_DSDB_FLAG(GPO_BLOCK_INHERITANCE);
1822 #define ADD_DSDB_STRING(val) PyModule_AddObject(m, #val, PyUnicode_FromString(val))
1824 ADD_DSDB_STRING(DSDB_SYNTAX_BINARY_DN);
1825 ADD_DSDB_STRING(DSDB_SYNTAX_STRING_DN);
1826 ADD_DSDB_STRING(DSDB_SYNTAX_OR_NAME);
1827 ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK);
1828 ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA);
1829 ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK_FIX_DUPLICATE_LINKS);
1830 ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAME);
1831 ADD_DSDB_STRING(DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SID);
1832 ADD_DSDB_STRING(DSDB_CONTROL_REPLMD_VANISH_LINKS);
1833 ADD_DSDB_STRING(DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID);
1834 ADD_DSDB_STRING(DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID);
1835 ADD_DSDB_STRING(DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID);
1836 ADD_DSDB_STRING(DSDB_CONTROL_INVALID_NOT_IMPLEMENTED);
1838 ADD_DSDB_STRING(DS_GUID_COMPUTERS_CONTAINER);
1839 ADD_DSDB_STRING(DS_GUID_DELETED_OBJECTS_CONTAINER);
1840 ADD_DSDB_STRING(DS_GUID_DOMAIN_CONTROLLERS_CONTAINER);
1841 ADD_DSDB_STRING(DS_GUID_FOREIGNSECURITYPRINCIPALS_CONTAINER);
1842 ADD_DSDB_STRING(DS_GUID_INFRASTRUCTURE_CONTAINER);
1843 ADD_DSDB_STRING(DS_GUID_LOSTANDFOUND_CONTAINER);
1844 ADD_DSDB_STRING(DS_GUID_MICROSOFT_PROGRAM_DATA_CONTAINER);
1845 ADD_DSDB_STRING(DS_GUID_NTDS_QUOTAS_CONTAINER);
1846 ADD_DSDB_STRING(DS_GUID_PROGRAM_DATA_CONTAINER);
1847 ADD_DSDB_STRING(DS_GUID_SYSTEMS_CONTAINER);
1848 ADD_DSDB_STRING(DS_GUID_USERS_CONTAINER);
1849 ADD_DSDB_STRING(DS_GUID_MANAGED_SERVICE_ACCOUNTS_CONTAINER);
1851 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_DEPARTMENT);
1852 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_DNS_HOST_NAME);
1853 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_INSTANCE_TYPE);
1854 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_MS_SFU_30);
1855 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_NT_SECURITY_DESCRIPTOR);
1856 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_PRIMARY_GROUP_ID);
1857 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_SERVICE_PRINCIPAL_NAME);
1858 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_USER_ACCOUNT_CONTROL);
1859 ADD_DSDB_STRING(DS_GUID_SCHEMA_ATTR_USER_PASSWORD);
1860 ADD_DSDB_STRING(DS_GUID_SCHEMA_CLASS_COMPUTER);
1861 ADD_DSDB_STRING(DS_GUID_SCHEMA_CLASS_MANAGED_SERVICE_ACCOUNT);
1862 ADD_DSDB_STRING(DS_GUID_SCHEMA_CLASS_USER);
1864 ADD_DSDB_STRING(DSDB_FULL_JOIN_REPLICATION_COMPLETED_OPAQUE_NAME);