- /*
- * Start a transaction, so we can query and do a subsequent atomic
- * modify
- */
-
- ret = ldb_transaction_start(d_state->sam_ctx);
- if (ret != LDB_SUCCESS) {
- DEBUG(0,("Failed to start a transaction for user creation: %s\n",
- ldb_errstring(d_state->sam_ctx)));
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- }
-
- /* check if the user already exists */
- name = samdb_search_string(d_state->sam_ctx, mem_ctx, NULL,
- "sAMAccountName",
- "(&(sAMAccountName=%s)(objectclass=user))",
- ldb_binary_encode_string(mem_ctx, account_name));
- if (name != NULL) {
- ldb_transaction_cancel(d_state->sam_ctx);
- return NT_STATUS_USER_EXISTS;
- }
-
- msg = ldb_msg_new(mem_ctx);
- if (msg == NULL) {
- ldb_transaction_cancel(d_state->sam_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- cn_name = talloc_strdup(mem_ctx, account_name);
- if (!cn_name) {
- ldb_transaction_cancel(d_state->sam_ctx);
- return NT_STATUS_NO_MEMORY;
- }
-
- cn_name_len = strlen(cn_name);
-
- /* This must be one of these values *only* */
- if (r->in.acct_flags == ACB_NORMAL) {
- container = "CN=Users";
- obj_class = "user";
-
- } else if (r->in.acct_flags == ACB_WSTRUST) {
- if (cn_name[cn_name_len - 1] != '$') {
- ldb_transaction_cancel(d_state->sam_ctx);
- return NT_STATUS_FOOBAR;
- }
- cn_name[cn_name_len - 1] = '\0';
- container = "CN=Computers";
- obj_class = "computer";
- samdb_msg_add_int(d_state->sam_ctx, mem_ctx, msg,
- "primaryGroupID", DOMAIN_RID_DOMAIN_MEMBERS);
-
- } else if (r->in.acct_flags == ACB_SVRTRUST) {
- if (cn_name[cn_name_len - 1] != '$') {
- ldb_transaction_cancel(d_state->sam_ctx);
- return NT_STATUS_FOOBAR;
- }
- cn_name[cn_name_len - 1] = '\0';
- container = "OU=Domain Controllers";
- obj_class = "computer";
- samdb_msg_add_int(d_state->sam_ctx, mem_ctx, msg,
- "primaryGroupID", DOMAIN_RID_DCS);
- } else {
- ldb_transaction_cancel(d_state->sam_ctx);
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- /* add core elements to the ldb_message for the user */
- msg->dn = ldb_dn_copy(mem_ctx, d_state->domain_dn);
- if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s,%s", cn_name, container)) {
- ldb_transaction_cancel(d_state->sam_ctx);
- return NT_STATUS_FOOBAR;
- }
-
- samdb_msg_add_string(d_state->sam_ctx, mem_ctx, msg, "sAMAccountName",
- account_name);
- samdb_msg_add_string(d_state->sam_ctx, mem_ctx, msg, "objectClass",
- obj_class);
-
- /* create the user */
- ret = ldb_add(d_state->sam_ctx, msg);
- switch (ret) {
- case LDB_SUCCESS:
- break;
- case LDB_ERR_ENTRY_ALREADY_EXISTS:
- ldb_transaction_cancel(d_state->sam_ctx);
- DEBUG(0,("Failed to create user record %s: %s\n",
- ldb_dn_get_linearized(msg->dn),
- ldb_errstring(d_state->sam_ctx)));
- return NT_STATUS_USER_EXISTS;
- case LDB_ERR_UNWILLING_TO_PERFORM:
- case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
- ldb_transaction_cancel(d_state->sam_ctx);
- DEBUG(0,("Failed to create user record %s: %s\n",
- ldb_dn_get_linearized(msg->dn),
- ldb_errstring(d_state->sam_ctx)));
- return NT_STATUS_ACCESS_DENIED;
- default:
- ldb_transaction_cancel(d_state->sam_ctx);
- DEBUG(0,("Failed to create user record %s: %s\n",
- ldb_dn_get_linearized(msg->dn),
- ldb_errstring(d_state->sam_ctx)));
- return NT_STATUS_INTERNAL_DB_CORRUPTION;