4 Copyright (C) Simo Sorce 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 * NOTICE: this module is NOT released under the GNU LGPL license as
8 * other ldb code. This module is release under the GNU GPL v2 or
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
28 * Component: ldb samldb module
30 * Description: add embedded user/group creation functionality
36 #include "libcli/ldap/ldap_ndr.h"
37 #include "lib/ldb/include/ldb_errors.h"
38 #include "lib/ldb/include/ldb.h"
39 #include "lib/ldb/include/ldb_private.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "libcli/security/security.h"
42 #include "librpc/gen_ndr/ndr_security.h"
43 #include "util/util_ldb.h"
45 int samldb_notice_sid(struct ldb_module *module,
46 TALLOC_CTX *mem_ctx, const struct dom_sid *sid);
48 static bool samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
51 enum ndr_err_code ndr_err;
53 ndr_err = ndr_push_struct_blob(&v, msg, NULL, sid,
54 (ndr_push_flags_fn_t)ndr_push_dom_sid);
55 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
58 return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
62 allocate a new id, attempting to do it atomically
63 return 0 on failure, the id on success
65 static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
66 struct ldb_dn *dn, uint32_t old_id, uint32_t new_id)
68 struct ldb_message msg;
70 struct ldb_val vals[2];
71 struct ldb_message_element els[2];
75 ldb_set_errstring(ldb, "Are we out of valid IDs ?\n");
76 return LDB_ERR_OPERATIONS_ERROR;
79 /* we do a delete and add as a single operation. That prevents
80 a race, in case we are not actually on a transaction db */
82 msg.dn = ldb_dn_copy(mem_ctx, dn);
85 return LDB_ERR_OPERATIONS_ERROR;
90 els[0].num_values = 1;
91 els[0].values = &vals[0];
92 els[0].flags = LDB_FLAG_MOD_DELETE;
93 els[0].name = talloc_strdup(mem_ctx, "nextRid");
96 return LDB_ERR_OPERATIONS_ERROR;
99 els[1].num_values = 1;
100 els[1].values = &vals[1];
101 els[1].flags = LDB_FLAG_MOD_ADD;
102 els[1].name = els[0].name;
104 vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", old_id);
107 return LDB_ERR_OPERATIONS_ERROR;
109 vals[0].length = strlen((char *)vals[0].data);
111 vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", new_id);
114 return LDB_ERR_OPERATIONS_ERROR;
116 vals[1].length = strlen((char *)vals[1].data);
118 ret = ldb_modify(ldb, &msg);
123 allocate a new id, attempting to do it atomically
124 return 0 on failure, the id on success
126 static int samldb_find_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
127 struct ldb_dn *dn, uint32_t *old_rid)
129 const char * const attrs[2] = { "nextRid", NULL };
130 struct ldb_result *res = NULL;
134 ret = ldb_search(module->ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
135 if (ret != LDB_SUCCESS) {
138 if (res->count != 1) {
140 return LDB_ERR_OPERATIONS_ERROR;
143 str = ldb_msg_find_attr_as_string(res->msgs[0], "nextRid", NULL);
145 ldb_asprintf_errstring(module->ldb,
146 "attribute nextRid not found in %s\n",
147 ldb_dn_get_linearized(dn));
149 return LDB_ERR_OPERATIONS_ERROR;
152 *old_rid = strtol(str, NULL, 0);
157 static int samldb_allocate_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
158 struct ldb_dn *dn, const struct dom_sid *dom_sid,
159 struct dom_sid **new_sid)
161 struct dom_sid *obj_sid;
165 ret = samldb_find_next_rid(module, mem_ctx, dn, &old_rid);
170 /* return the new object sid */
171 obj_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid);
173 *new_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid + 1);
175 return LDB_ERR_OPERATIONS_ERROR;
178 ret = samldb_notice_sid(module, mem_ctx, *new_sid);
180 /* gah, there are conflicting sids.
181 * This is a critical situation it means that someone messed up with
182 * the DB and nextRid is not returning free RIDs, report an error
183 * and refuse to create any user until the problem is fixed */
184 ldb_asprintf_errstring(module->ldb,
185 "Critical Error: unconsistent DB, unable to retireve an unique RID to generate a new SID: %s",
186 ldb_errstring(module->ldb));
192 /* search the domain related to the provided dn
193 allocate a new RID for the domain
194 return the new sid string
196 static int samldb_get_new_sid(struct ldb_module *module,
197 TALLOC_CTX *mem_ctx, struct ldb_dn *obj_dn,
198 struct ldb_dn *dom_dn,
199 struct dom_sid **sid)
201 const char * const attrs[2] = { "objectSid", NULL };
202 struct ldb_result *res = NULL;
204 struct dom_sid *dom_sid;
206 /* get the domain component part of the provided dn */
208 /* find the domain sid */
210 ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
211 if (ret != LDB_SUCCESS) {
212 ldb_asprintf_errstring(module->ldb,
213 "samldb_get_new_sid: error retrieving domain sid from %s: %s!\n",
214 ldb_dn_get_linearized(dom_dn),
215 ldb_errstring(module->ldb));
220 if (res->count != 1) {
221 ldb_asprintf_errstring(module->ldb,
222 "samldb_get_new_sid: error retrieving domain sid from %s: not found!\n",
223 ldb_dn_get_linearized(dom_dn));
225 return LDB_ERR_CONSTRAINT_VIOLATION;
228 dom_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
229 if (dom_sid == NULL) {
230 ldb_set_errstring(module->ldb, "samldb_get_new_sid: error parsing domain sid!\n");
232 return LDB_ERR_CONSTRAINT_VIOLATION;
235 /* allocate a new Rid for the domain */
236 ret = samldb_allocate_next_rid(module, mem_ctx, dom_dn, dom_sid, sid);
238 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_get_linearized(dom_dn), ldb_errstring(module->ldb));
248 /* If we are adding new users/groups, we need to update the nextRid
249 * attribute to be 'above' all incoming users RIDs. This tries to
250 * avoid clashes in future */
252 int samldb_notice_sid(struct ldb_module *module,
253 TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
256 struct ldb_dn *dom_dn;
257 struct dom_sid *dom_sid;
258 const char *attrs[] = { NULL };
259 struct ldb_result *dom_res;
260 struct ldb_result *res;
263 /* find if this SID already exists */
264 ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &res,
265 NULL, LDB_SCOPE_SUBTREE, attrs,
266 "(objectSid=%s)", ldap_encode_ndr_dom_sid(mem_ctx, sid));
267 if (ret == LDB_SUCCESS) {
268 if (res->count > 0) {
270 ldb_asprintf_errstring(module->ldb,
271 "Attempt to add record with SID %s rejected,"
272 " because this SID is already in the database",
273 dom_sid_string(mem_ctx, sid));
274 /* We have a duplicate SID, we must reject the add */
275 return LDB_ERR_CONSTRAINT_VIOLATION;
279 ldb_asprintf_errstring(module->ldb,
280 "samldb_notice_sid: error searching to see if sid %s is in use: %s\n",
281 dom_sid_string(mem_ctx, sid),
282 ldb_errstring(module->ldb));
286 dom_sid = dom_sid_dup(mem_ctx, sid);
288 return LDB_ERR_OPERATIONS_ERROR;
290 /* get the domain component part of the provided SID */
291 dom_sid->num_auths--;
293 /* find the domain DN */
294 ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &dom_res,
295 NULL, LDB_SCOPE_SUBTREE, attrs,
296 "(&(objectSid=%s)(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain)))",
297 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
298 if (ret == LDB_SUCCESS) {
299 if (dom_res->count == 0) {
300 talloc_free(dom_res);
301 /* This isn't an operation on a domain we know about, so nothing to update */
305 if (dom_res->count > 1) {
306 talloc_free(dom_res);
307 ldb_asprintf_errstring(module->ldb,
308 "samldb_notice_sid: error retrieving domain from sid: duplicate (found %d) domain: %s!\n",
309 dom_res->count, dom_sid_string(dom_res, dom_sid));
310 return LDB_ERR_OPERATIONS_ERROR;
313 ldb_asprintf_errstring(module->ldb,
314 "samldb_notice_sid: error retrieving domain from sid: %s: %s\n",
315 dom_sid_string(dom_res, dom_sid),
316 ldb_errstring(module->ldb));
320 dom_dn = dom_res->msgs[0]->dn;
322 ret = samldb_find_next_rid(module, mem_ctx,
325 talloc_free(dom_res);
329 if (old_rid <= sid->sub_auths[sid->num_auths - 1]) {
330 ret = samldb_set_next_rid(module->ldb, mem_ctx, dom_dn, old_rid,
331 sid->sub_auths[sid->num_auths - 1] + 1);
333 talloc_free(dom_res);
337 static int samldb_handle_sid(struct ldb_module *module,
338 TALLOC_CTX *mem_ctx, struct ldb_message *msg2,
339 struct ldb_dn *parent_dn)
343 struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg2, "objectSid");
345 ret = samldb_get_new_sid(module, msg2, msg2->dn, parent_dn, &sid);
350 if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
352 return LDB_ERR_OPERATIONS_ERROR;
357 ret = samldb_notice_sid(module, msg2, sid);
362 static int samldb_generate_samAccountName(struct ldb_module *module, TALLOC_CTX *mem_ctx,
363 struct ldb_dn *dom_dn, char **name)
365 const char *attrs[] = { NULL };
366 struct ldb_result *res;
369 /* Format: $000000-000000000000 */
372 *name = talloc_asprintf(mem_ctx, "$%.6X-%.6X%.6X", (unsigned int)generate_random(), (unsigned int)generate_random(), (unsigned int)generate_random());
373 /* TODO: Figure out exactly what this is meant to conflict with */
374 ret = ldb_search_exp_fmt(module->ldb,
375 mem_ctx, &res, dom_dn, LDB_SCOPE_SUBTREE, attrs,
377 ldb_binary_encode_string(mem_ctx, *name));
378 if (ret != LDB_SUCCESS) {
379 ldb_asprintf_errstring(module->ldb, "samldb: Failure searching to determine if samAccountName %s is unique: %s",
380 *name, ldb_errstring(module->ldb));
384 if (res->count == 0) {
386 /* Great. There are no conflicting users/groups/etc */
390 /* gah, there is a conflicting name, lets move around the loop again... */
395 static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_message *msg,
396 struct ldb_message **ret_msg)
399 unsigned int group_type;
401 struct ldb_message *msg2;
402 struct ldb_dn *dom_dn;
403 const char *rdn_name;
404 TALLOC_CTX *mem_ctx = talloc_new(msg);
407 return LDB_ERR_OPERATIONS_ERROR;
410 /* build the new msg */
411 msg2 = ldb_msg_copy(mem_ctx, msg);
413 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
414 talloc_free(mem_ctx);
415 return LDB_ERR_OPERATIONS_ERROR;
418 ret = samdb_copy_template(module->ldb, msg2,
423 talloc_free(mem_ctx);
427 rdn_name = ldb_dn_get_rdn_name(msg2->dn);
429 if (strcasecmp(rdn_name, "cn") != 0) {
430 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn_name);
431 talloc_free(mem_ctx);
432 return LDB_ERR_CONSTRAINT_VIOLATION;
435 ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
436 if (ret != LDB_SUCCESS) {
437 ldb_asprintf_errstring(module->ldb,
438 "samldb_fill_group_object: %s", errstr);
442 /* Generate a random name, if no samAccountName was supplied */
443 if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
444 ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
445 if (ret != LDB_SUCCESS) {
446 talloc_free(mem_ctx);
449 ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
451 talloc_free(mem_ctx);
456 if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
457 ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
458 talloc_free(mem_ctx);
459 return LDB_ERR_UNWILLING_TO_PERFORM;
461 group_type = samdb_result_uint(msg2, "groupType", 0);
462 if (group_type == 0) {
463 ldb_asprintf_errstring(module->ldb, "groupType invalid");
464 talloc_free(mem_ctx);
465 return LDB_ERR_UNWILLING_TO_PERFORM;
467 unsigned int account_type = samdb_gtype2atype(group_type);
468 ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
471 if (ret != LDB_SUCCESS) {
476 /* Manage SID allocation, conflicts etc */
477 ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn);
479 if (ret == LDB_SUCCESS) {
480 talloc_steal(msg, msg2);
483 talloc_free(mem_ctx);
487 static int samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg,
488 struct ldb_message **ret_msg)
492 struct ldb_message *msg2;
493 struct ldb_dn *dom_dn;
494 const char *rdn_name;
495 TALLOC_CTX *mem_ctx = talloc_new(msg);
497 unsigned int user_account_control;
499 return LDB_ERR_OPERATIONS_ERROR;
502 /* build the new msg */
503 msg2 = ldb_msg_copy(mem_ctx, msg);
505 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: ldb_msg_copy failed!\n");
506 talloc_free(mem_ctx);
507 return LDB_ERR_OPERATIONS_ERROR;
510 ret = samdb_copy_template(module->ldb, msg2,
514 ldb_asprintf_errstring(module->ldb,
515 "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
517 talloc_free(mem_ctx);
521 rdn_name = ldb_dn_get_rdn_name(msg2->dn);
523 if (strcasecmp(rdn_name, "cn") != 0) {
524 ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for user/computer, should be CN=!\n", rdn_name);
525 talloc_free(mem_ctx);
526 return LDB_ERR_CONSTRAINT_VIOLATION;
529 ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
530 if (ret != LDB_SUCCESS) {
531 ldb_asprintf_errstring(module->ldb,
532 "samldb_fill_user_or_computer_object: %s", errstr);
536 if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
537 ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
538 if (ret != LDB_SUCCESS) {
539 talloc_free(mem_ctx);
542 ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
544 talloc_free(mem_ctx);
549 if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
550 ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
551 talloc_free(mem_ctx);
552 return LDB_ERR_UNWILLING_TO_PERFORM;
554 user_account_control = samdb_result_uint(msg2, "userAccountControl", 0);
555 if (user_account_control == 0) {
556 ldb_asprintf_errstring(module->ldb, "userAccountControl invalid");
557 talloc_free(mem_ctx);
558 return LDB_ERR_UNWILLING_TO_PERFORM;
560 unsigned int account_type = samdb_uf2atype(user_account_control);
561 ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
564 if (ret != LDB_SUCCESS) {
569 /* Manage SID allocation, conflicts etc */
570 ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn);
572 /* TODO: userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
576 talloc_steal(msg, msg2);
578 talloc_free(mem_ctx);
582 static int samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg,
583 struct ldb_message **ret_msg)
585 struct ldb_message *msg2;
586 const char *rdn_name;
587 struct dom_sid *dom_sid;
589 const char *dom_attrs[] = { "name", NULL };
590 struct ldb_message **dom_msgs;
594 TALLOC_CTX *mem_ctx = talloc_new(msg);
596 return LDB_ERR_OPERATIONS_ERROR;
599 /* build the new msg */
600 msg2 = ldb_msg_copy(mem_ctx, msg);
602 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: ldb_msg_copy failed!\n");
603 talloc_free(mem_ctx);
604 return LDB_ERR_OPERATIONS_ERROR;
607 ret = samdb_copy_template(module->ldb, msg2,
608 "ForeignSecurityPrincipal",
611 ldb_asprintf_errstring(module->ldb,
612 "samldb_fill_foreignSecurityPrincipal_object: "
613 "Error copying template: %s",
615 talloc_free(mem_ctx);
619 rdn_name = ldb_dn_get_rdn_name(msg2->dn);
621 if (strcasecmp(rdn_name, "cn") != 0) {
622 ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for ForeignSecurityPrincipal, should be CN=!", rdn_name);
623 talloc_free(mem_ctx);
624 return LDB_ERR_CONSTRAINT_VIOLATION;
627 sid = samdb_result_dom_sid(msg2, msg, "objectSid");
629 /* Slightly different for the foreign sids. We don't want
630 * domain SIDs ending up there, it would cause all sorts of
633 sid = dom_sid_parse_talloc(msg2, (const char *)ldb_dn_get_rdn_val(msg2->dn)->data);
635 ldb_set_errstring(module->ldb, "No valid found SID in ForeignSecurityPrincipal CN!");
636 talloc_free(mem_ctx);
637 return LDB_ERR_CONSTRAINT_VIOLATION;
640 if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
642 return LDB_ERR_OPERATIONS_ERROR;
645 dom_sid = dom_sid_dup(mem_ctx, sid);
647 talloc_free(mem_ctx);
648 return LDB_ERR_OPERATIONS_ERROR;
650 /* get the domain component part of the provided SID */
651 dom_sid->num_auths--;
653 /* find the domain DN */
655 ret = gendb_search(module->ldb,
656 mem_ctx, NULL, &dom_msgs, dom_attrs,
657 "(&(objectSid=%s)(objectclass=domain))",
658 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
660 /* We don't really like the idea of foreign sids that are not foreign, but it happens */
661 const char *name = samdb_result_string(dom_msgs[0], "name", NULL);
662 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "NOTE (strange but valid): Adding foreign SID record with SID %s, but this domian (%s) is already in the database",
663 dom_sid_string(mem_ctx, sid), name);
664 } else if (ret == -1) {
665 ldb_asprintf_errstring(module->ldb,
666 "samldb_fill_foreignSecurityPrincipal_object: error searching for a domain with this sid: %s\n",
667 dom_sid_string(mem_ctx, dom_sid));
668 talloc_free(dom_msgs);
669 return LDB_ERR_OPERATIONS_ERROR;
673 /* This isn't an operation on a domain we know about, so just
674 * check for the SID, looking for duplicates via the common
676 ret = samldb_notice_sid(module, msg2, sid);
678 talloc_steal(msg, msg2);
690 * Actually this module is not async at all as it does a number of sync searches
691 * in the process. It still to be decided how to deal with it properly so it is
692 * left SYNC for now until we think of a good solution.
695 static int samldb_add(struct ldb_module *module, struct ldb_request *req)
697 const struct ldb_message *msg = req->op.add.message;
698 struct ldb_message *msg2 = NULL;
699 struct ldb_request *down_req;
702 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");
704 if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
705 return ldb_next_request(module, req);
708 /* is user or computer? */
709 if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) ||
710 (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
711 /* add all relevant missing objects */
712 ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
718 /* is group? add all relevant missing objects */
720 if (samdb_find_attribute(module->ldb, msg, "objectclass", "group") != NULL) {
721 ret = samldb_fill_group_object(module, msg, &msg2);
728 /* perhaps a foreignSecurityPrincipal? */
730 if (samdb_find_attribute(module->ldb, msg, "objectclass", "foreignSecurityPrincipal") != NULL) {
731 ret = samldb_fill_foreignSecurityPrincipal_object(module, msg, &msg2);
739 return ldb_next_request(module, req);
742 down_req = talloc(req, struct ldb_request);
743 if (down_req == NULL) {
744 return LDB_ERR_OPERATIONS_ERROR;
749 down_req->op.add.message = talloc_steal(down_req, msg2);
751 ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
753 /* go on with the call chain */
754 ret = ldb_next_request(module, down_req);
756 /* do not free down_req as the call results may be linked to it,
757 * it will be freed when the upper level request get freed */
758 if (ret == LDB_SUCCESS) {
759 req->handle = down_req->handle;
766 static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
768 struct ldb_message *msg;
769 struct ldb_message_element *el, *el2;
771 unsigned int group_type, user_account_control, account_type;
772 if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
773 ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
774 return LDB_ERR_UNWILLING_TO_PERFORM;
777 el = ldb_msg_find_element(req->op.mod.message, "groupType");
778 if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
779 req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
781 group_type = strtoul((const char *)el->values[0].data, NULL, 0);
782 account_type = samdb_gtype2atype(group_type);
783 ret = samdb_msg_add_uint(module->ldb, msg, msg,
786 if (ret != LDB_SUCCESS) {
789 el2 = ldb_msg_find_element(msg, "sAMAccountType");
790 el2->flags = LDB_FLAG_MOD_REPLACE;
793 el = ldb_msg_find_element(req->op.mod.message, "userAccountControl");
794 if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
795 req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
797 user_account_control = strtoul((const char *)el->values[0].data, NULL, 0);
798 account_type = samdb_uf2atype(user_account_control);
799 ret = samdb_msg_add_uint(module->ldb, msg, msg,
802 if (ret != LDB_SUCCESS) {
805 el2 = ldb_msg_find_element(msg, "sAMAccountType");
806 el2->flags = LDB_FLAG_MOD_REPLACE;
808 return ldb_next_request(module, req);
812 static int samldb_init(struct ldb_module *module)
814 return ldb_next_init(module);
817 _PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
819 .init_context = samldb_init,
821 .modify = samldb_modify