b9663ef0ac81c79a3c9e0c547917dc611889560b
[amitay/samba.git] / source4 / dsdb / common / util_samr.c
1 /*
2    Unix SMB/CIFS implementation.
3
4    Helpers to add users and groups to the DB
5
6    Copyright (C) Andrew Tridgell 2004
7    Copyright (C) Volker Lendecke 2004
8    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2010
9    Copyright (C) Matthias Dieter Wallnöfer 2009
10
11    This program is free software; you can redistribute it and/or modify
12    it under the terms of the GNU General Public License as published by
13    the Free Software Foundation; either version 3 of the License, or
14    (at your option) any later version.
15
16    This program is distributed in the hope that it will be useful,
17    but WITHOUT ANY WARRANTY; without even the implied warranty of
18    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
19    GNU General Public License for more details.
20
21    You should have received a copy of the GNU General Public License
22    along with this program.  If not, see <http://www.gnu.org/licenses/>.
23 */
24
25 #include "includes.h"
26 #include "dsdb/samdb/samdb.h"
27 #include "dsdb/common/util.h"
28 #include "../libds/common/flags.h"
29 #include "libcli/security/security.h"
30
31 #include "libds/common/flag_mapping.h"
32
33 /* Add a user, SAMR style, including the correct transaction
34  * semantics.  Used by the SAMR server and by pdb_samba4 */
35 NTSTATUS dsdb_add_user(struct ldb_context *ldb,
36                        TALLOC_CTX *mem_ctx,
37                        const char *account_name,
38                        uint32_t acct_flags,
39                        const struct dom_sid *forced_sid,
40                        struct dom_sid **sid,
41                        struct ldb_dn **dn)
42 {
43         const char *name;
44         struct ldb_message *msg;
45         int ret;
46         const char *container, *obj_class=NULL;
47         char *cn_name;
48         size_t cn_name_len;
49
50         const char *attrs[] = {
51                 "objectSid",
52                 "userAccountControl",
53                 NULL
54         };
55
56         uint32_t user_account_control;
57         struct ldb_dn *account_dn;
58         struct dom_sid *account_sid;
59
60         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
61         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
62
63         /*
64          * Start a transaction, so we can query and do a subsequent atomic
65          * modify
66          */
67
68         ret = ldb_transaction_start(ldb);
69         if (ret != LDB_SUCCESS) {
70                 DEBUG(0,("Failed to start a transaction for user creation: %s\n",
71                          ldb_errstring(ldb)));
72                 talloc_free(tmp_ctx);
73                 return NT_STATUS_LOCK_NOT_GRANTED;
74         }
75
76         /* check if the user already exists */
77         name = samdb_search_string(ldb, tmp_ctx, NULL,
78                                    "sAMAccountName",
79                                    "(&(sAMAccountName=%s)(objectclass=user))",
80                                    ldb_binary_encode_string(tmp_ctx, account_name));
81         if (name != NULL) {
82                 ldb_transaction_cancel(ldb);
83                 talloc_free(tmp_ctx);
84                 return NT_STATUS_USER_EXISTS;
85         }
86
87         cn_name = talloc_strdup(tmp_ctx, account_name);
88         if (!cn_name) {
89                 ldb_transaction_cancel(ldb);
90                 talloc_free(tmp_ctx);
91                 return NT_STATUS_NO_MEMORY;
92         }
93
94         cn_name_len = strlen(cn_name);
95         if (cn_name_len < 1) {
96                 ldb_transaction_cancel(ldb);
97                 talloc_free(tmp_ctx);
98                 return NT_STATUS_INVALID_PARAMETER;
99         }
100
101         msg = ldb_msg_new(tmp_ctx);
102         if (msg == NULL) {
103                 ldb_transaction_cancel(ldb);
104                 talloc_free(tmp_ctx);
105                 return NT_STATUS_NO_MEMORY;
106         }
107
108         /* This must be one of these values *only* */
109         if (acct_flags == ACB_NORMAL) {
110                 container = "CN=Users";
111                 obj_class = "user";
112
113         } else if (acct_flags == ACB_WSTRUST) {
114                 if (cn_name[cn_name_len - 1] != '$') {
115                         ldb_transaction_cancel(ldb);
116                         return NT_STATUS_FOOBAR;
117                 }
118                 cn_name[cn_name_len - 1] = '\0';
119                 container = "CN=Computers";
120                 obj_class = "computer";
121
122         } else if (acct_flags == ACB_SVRTRUST) {
123                 if (cn_name[cn_name_len - 1] != '$') {
124                         ldb_transaction_cancel(ldb);
125                         return NT_STATUS_FOOBAR;
126                 }
127                 cn_name[cn_name_len - 1] = '\0';
128                 container = "OU=Domain Controllers";
129                 obj_class = "computer";
130         } else {
131                 ldb_transaction_cancel(ldb);
132                 talloc_free(tmp_ctx);
133                 return NT_STATUS_INVALID_PARAMETER;
134         }
135
136         /* add core elements to the ldb_message for the user */
137         msg->dn = ldb_dn_copy(msg, ldb_get_default_basedn(ldb));
138         if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s,%s", cn_name, container)) {
139                 ldb_transaction_cancel(ldb);
140                 talloc_free(tmp_ctx);
141                 return NT_STATUS_FOOBAR;
142         }
143
144         ldb_msg_add_string(msg, "sAMAccountName", account_name);
145         ldb_msg_add_string(msg, "objectClass", obj_class);
146
147         /* This is only here for migrations using pdb_samba4, the
148          * caller and the samldb are responsible for ensuring it makes
149          * sense */
150         if (forced_sid) {
151                 ret = samdb_msg_add_dom_sid(ldb, msg, msg, "objectSID", forced_sid);
152                 if (ret != LDB_SUCCESS) {
153                         ldb_transaction_cancel(ldb);
154                         talloc_free(tmp_ctx);
155                         return NT_STATUS_INTERNAL_ERROR;
156                 }
157         }
158
159         /* create the user */
160         ret = ldb_add(ldb, msg);
161         switch (ret) {
162         case LDB_SUCCESS:
163                 break;
164         case LDB_ERR_ENTRY_ALREADY_EXISTS:
165                 ldb_transaction_cancel(ldb);
166                 DEBUG(0,("Failed to create user record %s: %s\n",
167                          ldb_dn_get_linearized(msg->dn),
168                          ldb_errstring(ldb)));
169                 talloc_free(tmp_ctx);
170                 return NT_STATUS_USER_EXISTS;
171         case LDB_ERR_UNWILLING_TO_PERFORM:
172         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
173                 ldb_transaction_cancel(ldb);
174                 DEBUG(0,("Failed to create user record %s: %s\n",
175                          ldb_dn_get_linearized(msg->dn),
176                          ldb_errstring(ldb)));
177                 talloc_free(tmp_ctx);
178                 return NT_STATUS_ACCESS_DENIED;
179         default:
180                 ldb_transaction_cancel(ldb);
181                 DEBUG(0,("Failed to create user record %s: %s\n",
182                          ldb_dn_get_linearized(msg->dn),
183                          ldb_errstring(ldb)));
184                 talloc_free(tmp_ctx);
185                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
186         }
187
188         account_dn = msg->dn;
189
190         /* retrieve the sid and account control bits for the user just created */
191         ret = dsdb_search_one(ldb, tmp_ctx, &msg,
192                               account_dn, LDB_SCOPE_BASE, attrs, 0, NULL);
193
194         if (ret != LDB_SUCCESS) {
195                 ldb_transaction_cancel(ldb);
196                 DEBUG(0,("Can't locate the account we just created %s: %s\n",
197                          ldb_dn_get_linearized(account_dn), ldb_errstring(ldb)));
198                 talloc_free(tmp_ctx);
199                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
200         }
201         account_sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
202         if (account_sid == NULL) {
203                 ldb_transaction_cancel(ldb);
204                 DEBUG(0,("Apparently we failed to get the objectSid of the just created account record %s\n",
205                          ldb_dn_get_linearized(msg->dn)));
206                 talloc_free(tmp_ctx);
207                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
208         }
209
210         /* Change the account control to be the correct account type.
211          * The default is for a workstation account */
212         user_account_control = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
213         user_account_control = (user_account_control &
214                                 ~(UF_NORMAL_ACCOUNT |
215                                   UF_INTERDOMAIN_TRUST_ACCOUNT |
216                                   UF_WORKSTATION_TRUST_ACCOUNT |
217                                   UF_SERVER_TRUST_ACCOUNT));
218         user_account_control |= ds_acb2uf(acct_flags);
219
220         talloc_free(msg);
221         msg = ldb_msg_new(tmp_ctx);
222         if (msg == NULL) {
223                 ldb_transaction_cancel(ldb);
224                 talloc_free(tmp_ctx);
225                 return NT_STATUS_NO_MEMORY;
226         }
227
228         msg->dn = account_dn;
229
230         if (samdb_msg_add_uint(ldb, tmp_ctx, msg,
231                                "userAccountControl",
232                                user_account_control) != LDB_SUCCESS) {
233                 ldb_transaction_cancel(ldb);
234                 talloc_free(tmp_ctx);
235                 return NT_STATUS_NO_MEMORY;
236         }
237
238         /* modify the samdb record */
239         ret = dsdb_replace(ldb, msg, 0);
240         if (ret != LDB_SUCCESS) {
241                 DEBUG(0,("Failed to modify account record %s to set userAccountControl: %s\n",
242                          ldb_dn_get_linearized(msg->dn),
243                          ldb_errstring(ldb)));
244                 ldb_transaction_cancel(ldb);
245                 talloc_free(tmp_ctx);
246
247                 /* we really need samdb.c to return NTSTATUS */
248                 return NT_STATUS_UNSUCCESSFUL;
249         }
250
251         ret = ldb_transaction_commit(ldb);
252         if (ret != LDB_SUCCESS) {
253                 DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
254                          ldb_dn_get_linearized(msg->dn),
255                          ldb_errstring(ldb)));
256                 talloc_free(tmp_ctx);
257                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
258         }
259         *dn = talloc_steal(mem_ctx, account_dn);
260         if (sid) {
261                 *sid = talloc_steal(mem_ctx, account_sid);
262         }
263         talloc_free(tmp_ctx);
264         return NT_STATUS_OK;
265 }
266
267 /*
268   called by samr_CreateDomainGroup and pdb_samba4
269 */
270 NTSTATUS dsdb_add_domain_group(struct ldb_context *ldb,
271                                TALLOC_CTX *mem_ctx,
272                                const char *groupname,
273                                struct dom_sid **sid,
274                                struct ldb_dn **dn)
275 {
276         const char *name;
277         struct ldb_message *msg;
278         struct dom_sid *group_sid;
279         int ret;
280
281         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
282         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
283
284         /* check if the group already exists */
285         name = samdb_search_string(ldb, tmp_ctx, NULL,
286                                    "sAMAccountName",
287                                    "(&(sAMAccountName=%s)(objectclass=group))",
288                                    ldb_binary_encode_string(tmp_ctx, groupname));
289         if (name != NULL) {
290                 return NT_STATUS_GROUP_EXISTS;
291         }
292
293         msg = ldb_msg_new(tmp_ctx);
294         if (msg == NULL) {
295                 return NT_STATUS_NO_MEMORY;
296         }
297
298         /* add core elements to the ldb_message for the user */
299         msg->dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(ldb));
300         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", groupname);
301         if (!msg->dn) {
302                 talloc_free(tmp_ctx);
303                 return NT_STATUS_NO_MEMORY;
304         }
305         ldb_msg_add_string(msg, "sAMAccountName", groupname);
306         ldb_msg_add_string(msg, "objectClass", "group");
307
308         /* create the group */
309         ret = ldb_add(ldb, msg);
310         switch (ret) {
311         case  LDB_SUCCESS:
312                 break;
313         case  LDB_ERR_ENTRY_ALREADY_EXISTS:
314                 DEBUG(0,("Failed to create group record %s: %s\n",
315                          ldb_dn_get_linearized(msg->dn),
316                          ldb_errstring(ldb)));
317                 talloc_free(tmp_ctx);
318                 return NT_STATUS_GROUP_EXISTS;
319         case  LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
320                 DEBUG(0,("Failed to create group record %s: %s\n",
321                          ldb_dn_get_linearized(msg->dn),
322                          ldb_errstring(ldb)));
323                 talloc_free(tmp_ctx);
324                 return NT_STATUS_ACCESS_DENIED;
325         default:
326                 DEBUG(0,("Failed to create group record %s: %s\n",
327                          ldb_dn_get_linearized(msg->dn),
328                          ldb_errstring(ldb)));
329                 talloc_free(tmp_ctx);
330                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
331         }
332
333         /* retrieve the sid for the group just created */
334         group_sid = samdb_search_dom_sid(ldb, tmp_ctx,
335                                          msg->dn, "objectSid", NULL);
336         if (group_sid == NULL) {
337                 return NT_STATUS_UNSUCCESSFUL;
338         }
339
340         *dn = talloc_steal(mem_ctx, msg->dn);
341         *sid = talloc_steal(mem_ctx, group_sid);
342         talloc_free(tmp_ctx);
343         return NT_STATUS_OK;
344 }
345
346 NTSTATUS dsdb_add_domain_alias(struct ldb_context *ldb,
347                                TALLOC_CTX *mem_ctx,
348                                const char *alias_name,
349                                struct dom_sid **sid,
350                                struct ldb_dn **dn)
351 {
352         const char *name;
353         struct ldb_message *msg;
354         struct dom_sid *alias_sid;
355         int ret;
356
357         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
358         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
359
360         if (ldb_transaction_start(ldb) != LDB_SUCCESS) {
361                 DEBUG(0, ("Failed to start transaction in dsdb_add_domain_alias(): %s\n", ldb_errstring(ldb)));
362                 return NT_STATUS_INTERNAL_ERROR;
363         }
364
365         /* Check if alias already exists */
366         name = samdb_search_string(ldb, tmp_ctx, NULL,
367                                    "sAMAccountName",
368                                    "(sAMAccountName=%s)(objectclass=group))",
369                                    ldb_binary_encode_string(mem_ctx, alias_name));
370
371         if (name != NULL) {
372                 talloc_free(tmp_ctx);
373                 ldb_transaction_cancel(ldb);
374                 return NT_STATUS_ALIAS_EXISTS;
375         }
376
377         msg = ldb_msg_new(tmp_ctx);
378         if (msg == NULL) {
379                 talloc_free(tmp_ctx);
380                 ldb_transaction_cancel(ldb);
381                 return NT_STATUS_NO_MEMORY;
382         }
383
384         /* add core elements to the ldb_message for the alias */
385         msg->dn = ldb_dn_copy(mem_ctx, ldb_get_default_basedn(ldb));
386         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=Users", alias_name);
387         if (!msg->dn) {
388                 talloc_free(tmp_ctx);
389                 ldb_transaction_cancel(ldb);
390                 return NT_STATUS_NO_MEMORY;
391         }
392
393         ldb_msg_add_string(msg, "sAMAccountName", alias_name);
394         ldb_msg_add_string(msg, "objectClass", "group");
395         samdb_msg_add_int(ldb, mem_ctx, msg, "groupType", GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
396
397         /* create the alias */
398         ret = ldb_add(ldb, msg);
399         switch (ret) {
400         case LDB_SUCCESS:
401                 break;
402         case LDB_ERR_ENTRY_ALREADY_EXISTS:
403                 talloc_free(tmp_ctx);
404                 ldb_transaction_cancel(ldb);
405                 return NT_STATUS_ALIAS_EXISTS;
406         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
407                 talloc_free(tmp_ctx);
408                 ldb_transaction_cancel(ldb);
409                 return NT_STATUS_ACCESS_DENIED;
410         default:
411                 DEBUG(0,("Failed to create alias record %s: %s\n",
412                          ldb_dn_get_linearized(msg->dn),
413                          ldb_errstring(ldb)));
414                 talloc_free(tmp_ctx);
415                 ldb_transaction_cancel(ldb);
416                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
417         }
418
419         /* retrieve the sid for the alias just created */
420         alias_sid = samdb_search_dom_sid(ldb, tmp_ctx,
421                                          msg->dn, "objectSid", NULL);
422
423         if (ldb_transaction_commit(ldb) != LDB_SUCCESS) {
424                 DEBUG(0, ("Failed to commit transaction in dsdb_add_domain_alias(): %s\n",
425                           ldb_errstring(ldb)));
426                 return NT_STATUS_INTERNAL_ERROR;
427         }
428
429         *dn = talloc_steal(mem_ctx, msg->dn);
430         *sid = talloc_steal(mem_ctx, alias_sid);
431         talloc_free(tmp_ctx);
432
433
434         return NT_STATUS_OK;
435 }
436
437 /* Return the members of this group (which may be a domain group or an alias) */
438 NTSTATUS dsdb_enum_group_mem(struct ldb_context *ldb,
439                              TALLOC_CTX *mem_ctx,
440                              struct ldb_dn *dn,
441                              struct dom_sid **members_out,
442                              unsigned int *pnum_members)
443 {
444         struct ldb_message *msg;
445         unsigned int i, j;
446         int ret;
447         struct dom_sid *members;
448         struct ldb_message_element *member_el;
449         const char *attrs[] = { "member", NULL };
450         NTSTATUS status;
451         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
452         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
453
454         ret = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs,
455                               DSDB_SEARCH_SHOW_EXTENDED_DN, NULL);
456         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
457                 talloc_free(tmp_ctx);
458                 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
459         }
460         if (ret != LDB_SUCCESS) {
461                 DEBUG(1, ("dsdb_enum_group_mem: dsdb_search for %s failed: %s\n",
462                           ldb_dn_get_linearized(dn), ldb_errstring(ldb)));
463                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
464         }
465
466         member_el = ldb_msg_find_element(msg, "member");
467         if (!member_el) {
468                 *members_out = NULL;
469                 *pnum_members = 0;
470                 talloc_free(tmp_ctx);
471                 return NT_STATUS_OK;
472         }
473
474         members = talloc_array(mem_ctx, struct dom_sid, member_el->num_values);
475         if (members == NULL) {
476                 return NT_STATUS_NO_MEMORY;
477         }
478
479         j = 0;
480         for (i=0; i <member_el->num_values; i++) {
481                 struct ldb_dn *member_dn = ldb_dn_from_ldb_val(tmp_ctx, ldb,
482                                                                &member_el->values[i]);
483                 if (!member_dn || !ldb_dn_validate(member_dn)) {
484                         DEBUG(1, ("Could not parse %*.*s as a DN\n",
485                                   (int)member_el->values[i].length,
486                                   (int)member_el->values[i].length,
487                                   (const char *)member_el->values[i].data));
488                         talloc_free(tmp_ctx);
489                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
490                 }
491
492                 status = dsdb_get_extended_dn_sid(member_dn, &members[j],
493                                                   "SID");
494                 if (NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
495                         /* If we fail finding a SID then this is no error since
496                          * it could be a non SAM object - e.g. a contact */
497                         continue;
498                 } else if (!NT_STATUS_IS_OK(status)) {
499                         DEBUG(1, ("When parsing DN '%s' we failed to parse it's SID component, so we cannot fetch the membership: %s\n",
500                                   ldb_dn_get_extended_linearized(tmp_ctx, member_dn, 1),
501                                   nt_errstr(status)));
502                         talloc_free(tmp_ctx);
503                         return status;
504                 }
505
506                 ++j;
507         }
508
509         *members_out = talloc_steal(mem_ctx, members);
510         *pnum_members = j;
511         talloc_free(tmp_ctx);
512         return NT_STATUS_OK;
513 }
514
515 NTSTATUS dsdb_lookup_rids(struct ldb_context *ldb,
516                           TALLOC_CTX *mem_ctx,
517                           const struct dom_sid *domain_sid,
518                           unsigned int num_rids,
519                           uint32_t *rids,
520                           const char **names,
521                           enum lsa_SidType *lsa_attrs)
522 {
523         const char *attrs[] = { "sAMAccountType", "sAMAccountName", NULL };
524         unsigned int i, num_mapped;
525
526         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
527         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
528
529         num_mapped = 0;
530
531         for (i=0; i<num_rids; i++) {
532                 struct ldb_message *msg;
533                 struct ldb_dn *dn;
534                 uint32_t attr;
535                 int rc;
536
537                 lsa_attrs[i] = SID_NAME_UNKNOWN;
538
539                 dn = ldb_dn_new_fmt(tmp_ctx, ldb, "<SID=%s>",
540                                     dom_sid_string(tmp_ctx,
541                                                    dom_sid_add_rid(tmp_ctx, domain_sid,
542                                                                    rids[i])));
543                 if (dn == NULL) {
544                         talloc_free(tmp_ctx);
545                         return NT_STATUS_NO_MEMORY;
546                 }
547                 rc = dsdb_search_one(ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "samAccountName=*");
548                 if (rc == LDB_ERR_NO_SUCH_OBJECT) {
549                         continue;
550                 } else if (rc != LDB_SUCCESS) {
551                         talloc_free(tmp_ctx);
552                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
553                 }
554
555                 names[i] = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
556                 if (names[i] == NULL) {
557                         DEBUG(10, ("no samAccountName\n"));
558                         continue;
559                 }
560                 talloc_steal(names, names[i]);
561                 attr = ldb_msg_find_attr_as_uint(msg, "samAccountType", 0);
562                 lsa_attrs[i] = ds_atype_map(attr);
563                 if (lsa_attrs[i] == SID_NAME_UNKNOWN) {
564                         continue;
565                 }
566                 num_mapped += 1;
567         }
568         talloc_free(tmp_ctx);
569
570         if (num_mapped == 0) {
571                 return NT_STATUS_NONE_MAPPED;
572         }
573         if (num_mapped < num_rids) {
574                 return STATUS_SOME_UNMAPPED;
575         }
576         return NT_STATUS_OK;
577 }
578