4 Copyright (C) Simo Sorce 2004
6 * NOTICE: this module is NOT released under the GNU LGPL license as
7 * other ldb code. This module is release under the GNU GPL v2 or
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 * Component: ldb samldb module
30 * Description: add embedded user/group creation functionality
36 #include "lib/ldb/include/ldb.h"
37 #include "lib/ldb/include/ldb_private.h"
38 #include "system/time.h"
39 #include "librpc/gen_ndr/ndr_security.h"
41 #define SAM_ACCOUNT_NAME_BASE "$000000-000000000000"
44 const char *error_string;
47 static int samldb_search(struct ldb_module *module, const char *base,
48 enum ldb_scope scope, const char *expression,
49 const char * const *attrs, struct ldb_message ***res)
51 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_search\n");
52 return ldb_next_search(module, base, scope, expression, attrs, res);
55 static int samldb_search_bytree(struct ldb_module *module, const char *base,
56 enum ldb_scope scope, struct ldb_parse_tree *tree,
57 const char * const *attrs, struct ldb_message ***res)
59 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_search\n");
60 return ldb_next_search_bytree(module, base, scope, tree, attrs, res);
64 allocate a new id, attempting to do it atomically
65 return 0 on failure, the id on success
67 static int samldb_allocate_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
68 const char *dn, uint32_t *id)
70 const char * const attrs[2] = { "nextRid", NULL };
71 struct ldb_message **res = NULL;
72 struct ldb_message msg;
75 struct ldb_val vals[2];
76 struct ldb_message_element els[2];
78 ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
80 if (res) talloc_free(res);
83 str = ldb_msg_find_string(res[0], "nextRid", NULL);
85 ldb_debug(ldb, LDB_DEBUG_FATAL, "attribute nextRid not found in %s\n", dn);
90 *id = strtol(str, NULL, 0);
93 ldb_debug(ldb, LDB_DEBUG_FATAL, "Are we out of valid IDs ?\n");
99 /* we do a delete and add as a single operation. That prevents
102 msg.dn = talloc_strdup(mem_ctx, dn);
106 msg.num_elements = 2;
109 els[0].num_values = 1;
110 els[0].values = &vals[0];
111 els[0].flags = LDB_FLAG_MOD_DELETE;
112 els[0].name = talloc_strdup(mem_ctx, "nextRid");
117 els[1].num_values = 1;
118 els[1].values = &vals[1];
119 els[1].flags = LDB_FLAG_MOD_ADD;
120 els[1].name = els[0].name;
122 vals[0].data = talloc_asprintf(mem_ctx, "%u", *id);
126 vals[0].length = strlen(vals[0].data);
128 vals[1].data = talloc_asprintf(mem_ctx, "%u", (*id)+1);
132 vals[1].length = strlen(vals[1].data);
134 ret = ldb_modify(ldb, &msg);
144 static char *samldb_search_domain(struct ldb_module *module, TALLOC_CTX *mem_ctx, const char *dn)
147 struct ldb_message **res = NULL;
151 while ((sdn = strchr(sdn, ',')) != NULL) {
155 ret = ldb_search(module->ldb, sdn, LDB_SCOPE_BASE, "objectClass=domain", NULL, &res);
166 return talloc_strdup(mem_ctx, sdn);
169 /* search the domain related to the provided dn
170 allocate a new RID for the domain
171 return the new sid string
173 static struct dom_sid *samldb_get_new_sid(struct ldb_module *module,
174 TALLOC_CTX *mem_ctx, const char *obj_dn)
176 const char * const attrs[2] = { "objectSid", NULL };
177 struct ldb_message **res = NULL;
181 struct dom_sid *dom_sid, *obj_sid;
183 /* get the domain component part of the provided dn */
185 /* FIXME: quick search here, I think we should use something like
186 ldap_parse_dn here to be 100% sure we get the right domain dn */
188 /* FIXME: "dc=" is probably not utf8 safe either,
189 we need a multibyte safe substring search function here */
191 dom_dn = samldb_search_domain(module, mem_ctx, obj_dn);
192 if (dom_dn == NULL) {
193 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Invalid dn (%s) not child of a domain object!\n", obj_dn);
197 /* find the domain sid */
199 ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
201 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_get_new_sid: error retrieving domain sid!\n");
206 dom_sid = samdb_result_dom_sid(res, res[0], "objectSid");
207 if (dom_sid == NULL) {
208 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_get_new_sid: error retrieving domain sid!\n");
213 /* allocate a new Rid for the domain */
215 /* we need to try multiple times to cope with two account
216 creations at the same time */
218 ret = samldb_allocate_next_rid(module->ldb, mem_ctx, dom_dn, &rid);
224 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s\n", dom_dn);
229 /* return the new object sid */
230 obj_sid = dom_sid_add_rid(mem_ctx, dom_sid, rid);
237 static char *samldb_generate_samAccountName(const void *mem_ctx) {
240 name = talloc_strdup(mem_ctx, SAM_ACCOUNT_NAME_BASE);
241 /* TODO: randomize name */
246 static BOOL samldb_get_rdn_and_basedn(const void *mem_ctx, const char *dn, char **rdn, char **basedn)
255 *rdn = talloc_strndup(mem_ctx, dn, p - dn);
261 *basedn = talloc_strdup(mem_ctx, p + 1);
272 /* if value is not null also check for attribute to have exactly that value */
273 static struct ldb_message_element *samldb_find_attribute(const struct ldb_message *msg, const char *name, const char *value)
277 for (i = 0; i < msg->num_elements; i++) {
278 if (ldb_attr_cmp(name, msg->elements[i].name) == 0) {
280 return &msg->elements[i];
282 for (j = 0; j < msg->elements[i].num_values; j++) {
283 if (strcasecmp(value, msg->elements[i].values[j].data) == 0) {
284 return &msg->elements[i];
293 static BOOL samldb_msg_add_string(struct ldb_module *module, struct ldb_message *msg, const char *name, const char *value)
295 char *aname = talloc_strdup(msg, name);
296 char *aval = talloc_strdup(msg, value);
298 if (aname == NULL || aval == NULL) {
299 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_msg_add_string: talloc_strdup failed!\n");
303 if (ldb_msg_add_string(module->ldb, msg, aname, aval) != 0) {
310 static BOOL samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
314 status = ndr_push_struct_blob(&v, msg, sid,
315 (ndr_push_flags_fn_t)ndr_push_dom_sid);
316 if (!NT_STATUS_IS_OK(status)) {
319 return (ldb_msg_add_value(module->ldb, msg, name, &v) == 0);
322 static BOOL samldb_find_or_add_attribute(struct ldb_module *module, struct ldb_message *msg, const char *name, const char *value, const char *set_value)
324 if (samldb_find_attribute(msg, name, value) == NULL) {
325 return samldb_msg_add_string(module, msg, name, set_value);
330 static int samldb_copy_template(struct ldb_module *module, struct ldb_message *msg, const char *filter)
332 struct ldb_message **res, *t;
336 /* pull the template record */
337 ret = ldb_search(module->ldb, NULL, LDB_SCOPE_SUBTREE, filter, NULL, &res);
339 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb: ERROR: template '%s' matched %d records\n", filter, ret);
344 for (i = 0; i < t->num_elements; i++) {
345 struct ldb_message_element *el = &t->elements[i];
346 /* some elements should not be copied from the template */
347 if (strcasecmp(el->name, "cn") == 0 ||
348 strcasecmp(el->name, "name") == 0 ||
349 strcasecmp(el->name, "sAMAccountName") == 0) {
352 for (j = 0; j < el->num_values; j++) {
353 if (strcasecmp(el->name, "objectClass") == 0 &&
354 (strcasecmp((char *)el->values[j].data, "Template") == 0 ||
355 strcasecmp((char *)el->values[j].data, "userTemplate") == 0 ||
356 strcasecmp((char *)el->values[j].data, "groupTemplate") == 0 ||
357 strcasecmp((char *)el->values[j].data, "foreignSecurityTemplate") == 0 ||
358 strcasecmp((char *)el->values[j].data, "aliasTemplate") == 0 ||
359 strcasecmp((char *)el->values[j].data, "trustedDomainTemplate") == 0 ||
360 strcasecmp((char *)el->values[j].data, "secretTemplate") == 0)) {
363 if ( ! samldb_find_or_add_attribute(module, msg, el->name,
365 (char *)el->values[j].data)) {
366 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Attribute adding failed...\n");
378 static struct ldb_message *samldb_fill_group_object(struct ldb_module *module, const struct ldb_message *msg)
380 struct ldb_message *msg2;
381 struct ldb_message_element *attribute;
384 if (samldb_find_attribute(msg, "objectclass", "group") == NULL) {
388 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_group_object\n");
390 /* build the new msg */
391 msg2 = ldb_msg_copy(module->ldb, msg);
393 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
397 if (samldb_copy_template(module, msg2, "(&(name=TemplateGroup)(objectclass=groupTemplate))") != 0) {
398 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_group_object: Error copying template!\n");
402 if ( ! samldb_get_rdn_and_basedn(msg2, msg2->dn, &rdn, &basedn)) {
403 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad DN (%s)!\n", msg2->dn);
406 if (strncasecmp(rdn, "cn", 2) != 0) {
407 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn);
411 if ((attribute = samldb_find_attribute(msg2, "cn", NULL)) != NULL) {
412 if (strcasecmp(&rdn[3], attribute->values[0].data) != 0) {
413 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad Attribute Syntax for CN\n");
416 } else { /* FIXME: remove this if ldb supports natively aliasing between the rdn and the "cn" attribute */
417 if ( ! samldb_msg_add_string(module, msg2, "cn", &rdn[3])) {
422 if ((attribute = samldb_find_attribute(msg2, "name", NULL)) != NULL) {
423 if (strcasecmp(&rdn[3], attribute->values[0].data) != 0) {
426 } else { /* FIXME: remove this if ldb supports natively aliasing between the rdn and the "name" attribute */
427 if ( ! samldb_msg_add_string(module, msg2, "name", &rdn[3])) {
432 if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
433 struct dom_sid *sid = samldb_get_new_sid(module, msg2, msg2->dn);
435 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: internal error! Can't generate new sid\n");
439 if (!samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
446 if ( ! samldb_find_or_add_attribute(module, msg2, "sAMAccountName", NULL, samldb_generate_samAccountName(msg2))) {
450 /* TODO: objectGUID */
452 talloc_steal(msg, msg2);
457 static struct ldb_message *samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg)
459 struct ldb_message *msg2;
460 struct ldb_message_element *attribute;
463 if ((samldb_find_attribute(msg, "objectclass", "user") == NULL) &&
464 (samldb_find_attribute(msg, "objectclass", "computer") == NULL)) {
468 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_user_or_computer_object\n");
470 /* build the new msg */
471 msg2 = ldb_msg_copy(module->ldb, msg);
473 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
477 if (samldb_copy_template(module, msg2, "(&(name=TemplateUser)(objectclass=userTemplate))") != 0) {
478 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_user_or_computer_object: Error copying template!\n");
482 if ( ! samldb_get_rdn_and_basedn(msg2, msg2->dn, &rdn, &basedn)) {
485 if (strncasecmp(rdn, "cn", 2) != 0) {
486 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: Bad RDN (%s) for group!\n", rdn);
490 /* if the only attribute was: "objectclass: computer", then make sure we also add "user" objectclass */
491 if ( ! samldb_find_or_add_attribute(module, msg2, "objectclass", "user", "user")) {
495 if ((attribute = samldb_find_attribute(msg2, "cn", NULL)) != NULL) {
496 if (strcasecmp(&rdn[3], attribute->values[0].data) != 0) {
497 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: Bad Attribute Syntax for CN\n");
500 } else { /* FIXME: remove this if ldb supports natively aliasing between the rdn and the "cn" attribute */
501 if ( ! samldb_msg_add_string(module, msg2, "cn", &rdn[3])) {
506 if ((attribute = samldb_find_attribute(msg2, "name", NULL)) != NULL) {
507 if (strcasecmp(&rdn[3], attribute->values[0].data) != 0) {
508 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: Bad Attribute Syntax for name\n");
511 } else { /* FIXME: remove this if ldb supports natively aliasing between the rdn and the "name" attribute */
512 if ( ! samldb_msg_add_string(module, msg2, "name", &rdn[3])) {
517 if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
519 sid = samldb_get_new_sid(module, msg2, msg2->dn);
521 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: internal error! Can't generate new sid\n");
525 if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
532 if ( ! samldb_find_or_add_attribute(module, msg2, "sAMAccountName", NULL, samldb_generate_samAccountName(msg2))) {
536 /* TODO: objectGUID, objectCategory, userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
538 talloc_steal(msg, msg2);
544 static int samldb_add_record(struct ldb_module *module, const struct ldb_message *msg)
546 struct ldb_message *msg2 = NULL;
549 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");
551 if (msg->dn[0] == '@') { /* do not manipulate our control entries */
552 return ldb_next_add_record(module, msg);
555 /* is user or computer? add all relevant missing objects */
556 msg2 = samldb_fill_user_or_computer_object(module, msg);
558 /* is group? add all relevant missing objects */
560 msg2 = samldb_fill_group_object(module, msg);
564 ret = ldb_next_add_record(module, msg2);
566 ret = ldb_next_add_record(module, msg);
572 /* modify_record: change modifyTimestamp as well */
573 static int samldb_modify_record(struct ldb_module *module, const struct ldb_message *msg)
575 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_modify_record\n");
576 return ldb_next_modify_record(module, msg);
579 static int samldb_delete_record(struct ldb_module *module, const char *dn)
581 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_delete_record\n");
582 return ldb_next_delete_record(module, dn);
585 static int samldb_rename_record(struct ldb_module *module, const char *olddn, const char *newdn)
587 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_rename_record\n");
588 return ldb_next_rename_record(module, olddn, newdn);
591 static int samldb_lock(struct ldb_module *module, const char *lockname)
593 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_lock\n");
594 return ldb_next_named_lock(module, lockname);
597 static int samldb_unlock(struct ldb_module *module, const char *lockname)
599 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_unlock\n");
600 return ldb_next_named_unlock(module, lockname);
603 /* return extended error information */
604 static const char *samldb_errstring(struct ldb_module *module)
606 struct private_data *data = (struct private_data *)module->private_data;
608 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_errstring\n");
609 if (data->error_string) {
612 error = data->error_string;
613 data->error_string = NULL;
617 return ldb_next_errstring(module);
620 static int samldb_destructor(void *module_ctx)
622 /* struct ldb_module *ctx = module_ctx; */
623 /* put your clean-up functions here */
627 static const struct ldb_module_ops samldb_ops = {
629 .search = samldb_search,
630 .search_bytree = samldb_search_bytree,
631 .add_record = samldb_add_record,
632 .modify_record = samldb_modify_record,
633 .delete_record = samldb_delete_record,
634 .rename_record = samldb_rename_record,
635 .named_lock = samldb_lock,
636 .named_unlock = samldb_unlock,
637 .errstring = samldb_errstring
641 /* the init function */
642 #ifdef HAVE_DLOPEN_DISABLED
643 struct ldb_module *init_module(struct ldb_context *ldb, const char *options[])
645 struct ldb_module *samldb_module_init(struct ldb_context *ldb, const char *options[])
648 struct ldb_module *ctx;
649 struct private_data *data;
651 ctx = talloc(ldb, struct ldb_module);
655 data = talloc(ctx, struct private_data);
661 data->error_string = NULL;
662 ctx->private_data = data;
664 ctx->prev = ctx->next = NULL;
665 ctx->ops = &samldb_ops;
667 talloc_set_destructor(ctx, samldb_destructor);