2 Unix SMB/CIFS implementation.
4 interface functions for the sam database
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 struct auth_session_info;
26 struct dsdb_control_current_partition;
27 struct dsdb_extended_replicated_object;
28 struct dsdb_extended_replicated_objects;
29 struct loadparm_context;
30 struct tevent_context;
31 struct tsocket_address;
32 struct dsdb_trust_routing_table;
34 #include "librpc/gen_ndr/security.h"
36 #include "lib/ldb-samba/ldif_handlers.h"
37 #include "librpc/gen_ndr/samr.h"
38 #include "librpc/gen_ndr/drsuapi.h"
39 #include "librpc/gen_ndr/drsblobs.h"
40 #include "dsdb/schema/schema.h"
41 #include "dsdb/samdb/samdb_proto.h"
42 #include "dsdb/common/dsdb_dn.h"
43 #include "dsdb/common/util_links.h"
44 #include "dsdb/common/proto.h"
45 #include "../libds/common/flags.h"
47 #define DSDB_CONTROL_CURRENT_PARTITION_OID "1.3.6.1.4.1.7165.4.3.2"
48 struct dsdb_control_current_partition {
50 * this is the version of the dsdb_control_current_partition
51 * version 0: initial implementation
52 * version 1: got rid of backend and module fields
54 #define DSDB_CONTROL_CURRENT_PARTITION_VERSION 1
61 flags in dsdb_repl_flags to control replication logic
63 #define DSDB_REPL_FLAG_PRIORITISE_INCOMING 1
64 #define DSDB_REPL_FLAG_PARTIAL_REPLICA 2
65 #define DSDB_REPL_FLAG_ADD_NCNAME 4
66 #define DSDB_REPL_FLAG_EXPECT_NO_SECRETS 8
67 #define DSDB_REPL_FLAG_OBJECT_SUBSET 16
68 #define DSDB_REPL_FLAG_TARGETS_UPTODATE 32
70 #define DSDB_CONTROL_REPLICATED_UPDATE_OID "1.3.6.1.4.1.7165.4.3.3"
72 #define DSDB_CONTROL_DN_STORAGE_FORMAT_OID "1.3.6.1.4.1.7165.4.3.4"
73 /* DSDB_CONTROL_DN_STORAGE_FORMAT_OID has NULL data and behaves very
74 * much like LDB_CONTROL_EXTENDED_DN_OID when the DB stores an
75 * extended DN, and otherwise returns normal DNs */
77 #define DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID "1.3.6.1.4.1.7165.4.3.8"
79 struct dsdb_user_pwd_settings {
80 uint32_t pwdProperties;
81 uint32_t pwdHistoryLength;
84 uint32_t minPwdLength;
86 const char *netbios_domain;
87 const char *dns_domain;
91 struct dsdb_control_password_change_status {
92 struct dsdb_user_pwd_settings domain_data;
93 enum samPwdChangeReason reject_reason;
96 #define DSDB_CONTROL_PASSWORD_HASH_VALUES_OID "1.3.6.1.4.1.7165.4.3.9"
98 #define DSDB_CONTROL_PASSWORD_CHANGE_OID "1.3.6.1.4.1.7165.4.3.10"
99 struct dsdb_control_password_change {
100 const struct samr_Password *old_nt_pwd_hash;
101 const struct samr_Password *old_lm_pwd_hash;
105 DSDB_CONTROL_APPLY_LINKS is internal to Samba4 - a token passed between repl_meta_data and linked_attributes modules
107 #define DSDB_CONTROL_APPLY_LINKS "1.3.6.1.4.1.7165.4.3.11"
110 * this should only be used for importing users from Samba3
112 #define DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID "1.3.6.1.4.1.7165.4.3.12"
115 OID used to allow the replacement of replPropertyMetaData.
116 It is used when the current replmetadata needs to be edited.
118 #define DSDB_CONTROL_CHANGEREPLMETADATA_OID "1.3.6.1.4.1.7165.4.3.14"
120 /* passed when we want to get the behaviour of the non-global catalog port */
121 #define DSDB_CONTROL_NO_GLOBAL_CATALOG "1.3.6.1.4.1.7165.4.3.17"
123 /* passed when we want special behaviour for partial replicas */
124 #define DSDB_CONTROL_PARTIAL_REPLICA "1.3.6.1.4.1.7165.4.3.18"
126 /* passed when we want special behaviour for dbcheck */
127 #define DSDB_CONTROL_DBCHECK "1.3.6.1.4.1.7165.4.3.19"
129 /* passed when dbcheck wants to modify a read only replica (very special case) */
130 #define DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA "1.3.6.1.4.1.7165.4.3.19.1"
132 /* passed by dbcheck to fix duplicate linked attributes (bug #13095) */
133 #define DSDB_CONTROL_DBCHECK_FIX_DUPLICATE_LINKS "1.3.6.1.4.1.7165.4.3.19.2"
135 /* passed by dbcheck to fix the DN strong of a one-way-link (bug #13495) */
136 #define DSDB_CONTROL_DBCHECK_FIX_LINK_DN_NAME "1.3.6.1.4.1.7165.4.3.19.3"
138 /* passed when importing plain text password on upgrades */
139 #define DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET_OID "1.3.6.1.4.1.7165.4.3.20"
142 * passed from the descriptor module in order to
143 * store the recalucated nTSecurityDescriptor without
144 * modifying the replPropertyMetaData.
146 #define DSDB_CONTROL_SEC_DESC_PROPAGATION_OID "1.3.6.1.4.1.7165.4.3.21"
149 * passed when creating a interdomain trust account through LSA
150 * to relax constraints in the samldb ldb module.
152 #define DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID "1.3.6.1.4.1.7165.4.3.23"
155 * Internal control to mark requests as being part of Tombstone restoring
156 * procedure - it requires slightly special behavior like:
157 * - a bit different security checks
158 * - restoring certain attributes to their default values, etc
160 #define DSDB_CONTROL_RESTORE_TOMBSTONE_OID "1.3.6.1.4.1.7165.4.3.24"
163 OID used to allow the replacement of replPropertyMetaData.
164 It is used when the current replmetadata needs only to be re-sorted, but not edited.
166 #define DSDB_CONTROL_CHANGEREPLMETADATA_RESORT_OID "1.3.6.1.4.1.7165.4.3.25"
169 * pass the default state of pwdLastSet between the "samldb" and "password_hash"
172 #define DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID "1.3.6.1.4.1.7165.4.3.26"
175 * pass the userAccountControl changes between the "samldb" and "password_hash"
178 #define DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID "1.3.6.1.4.1.7165.4.3.27"
179 struct dsdb_control_password_user_account_control {
180 uint32_t req_flags; /* the flags given by the client request */
181 uint32_t old_flags; /* the old flags stored (0 on add) */
182 uint32_t new_flags; /* the new flags stored */
186 * Ignores strict checking when adding objects to samldb.
187 * This is used when provisioning, as checking all objects when added
188 * was slow due to an unindexed search.
190 #define DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID "1.3.6.1.4.1.7165.4.3.28"
192 /* passed when we want to thoroughly delete linked attributes */
193 #define DSDB_CONTROL_REPLMD_VANISH_LINKS "1.3.6.1.4.1.7165.4.3.29"
196 * lockoutTime is a replicated attribute, but must be modified before
197 * connectivity occurs to allow password lockouts.
199 #define DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE "1.3.6.1.4.1.7165.4.3.31"
201 #define DSDB_CONTROL_INVALID_NOT_IMPLEMENTED "1.3.6.1.4.1.7165.4.3.32"
204 * Used to pass "user password change" vs "password reset" from the ACL to the
205 * password_hash module, ensuring both modules treat the request identical.
207 #define DSDB_CONTROL_PASSWORD_ACL_VALIDATION_OID "1.3.6.1.4.1.7165.4.3.33"
208 struct dsdb_control_password_acl_validation {
213 * Used to pass the current transaction identifier from the audit_log
214 * module to group membership auditing module
216 #define DSDB_CONTROL_TRANSACTION_IDENTIFIER_OID "1.3.6.1.4.1.7165.4.3.34"
217 struct dsdb_control_transaction_identifier {
218 struct GUID transaction_guid;
221 #define DSDB_EXTENDED_REPLICATED_OBJECTS_OID "1.3.6.1.4.1.7165.4.4.1"
222 struct dsdb_extended_replicated_object {
223 struct ldb_message *msg;
224 struct GUID object_guid;
225 struct GUID *parent_guid;
226 const char *when_changed;
227 struct replPropertyMetaDataBlob *meta_data;
229 /* Only used for internal processing in repl_meta_data */
230 struct ldb_dn *last_known_parent;
231 struct ldb_dn *local_parent_dn;
234 struct dsdb_extended_replicated_objects {
236 * this is the version of the dsdb_extended_replicated_objects
237 * version 0: initial implementation
239 #define DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION 3
242 /* DSDB_REPL_FLAG_* flags */
243 uint32_t dsdb_repl_flags;
245 struct ldb_dn *partition_dn;
247 const struct repsFromTo1 *source_dsa;
248 const struct drsuapi_DsReplicaCursor2CtrEx *uptodateness_vector;
250 uint32_t num_objects;
251 struct dsdb_extended_replicated_object *objects;
253 uint32_t linked_attributes_count;
254 struct drsuapi_DsReplicaLinkedAttribute *linked_attributes;
258 bool originating_updates;
261 #define DSDB_EXTENDED_CREATE_PARTITION_OID "1.3.6.1.4.1.7165.4.4.4"
262 struct dsdb_create_partition_exop {
263 struct ldb_dn *new_dn;
267 * the schema_dn is passed as struct ldb_dn in
268 * req->op.extended.data
270 #define DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID "1.3.6.1.4.1.7165.4.4.2"
272 #define DSDB_EXTENDED_SCHEMA_UPGRADE_IN_PROGRESS_OID "1.3.6.1.4.1.7165.4.4.6"
274 #define DSDB_OPENLDAP_DEREFERENCE_CONTROL "1.3.6.1.4.1.4203.666.5.16"
276 struct dsdb_openldap_dereference {
277 const char *source_attribute;
278 const char **dereference_attribute;
281 struct dsdb_openldap_dereference_control {
282 struct dsdb_openldap_dereference **dereference;
285 struct dsdb_openldap_dereference_result {
286 const char *source_attribute;
287 const char *dereferenced_dn;
289 struct ldb_message_element *attributes;
292 struct dsdb_openldap_dereference_result_control {
293 struct dsdb_openldap_dereference_result **attributes;
296 struct samldb_msds_intid_persistant {
300 #define SAMLDB_MSDS_INTID_OPAQUE "SAMLDB_MSDS_INTID_OPAQUE"
302 #define DSDB_PARTITION_DN "@PARTITION"
303 #define DSDB_PARTITION_ATTR "partition"
305 #define DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME "dsdb_extended_dn_store_format"
306 struct dsdb_extended_dn_store_format {
307 bool store_extended_dn_in_ldb;
310 #define DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME "DSDB_OPAQUE_PARTITION_MODULE_MSG"
312 /* this takes a struct dsdb_fsmo_extended_op */
313 #define DSDB_EXTENDED_ALLOCATE_RID_POOL "1.3.6.1.4.1.7165.4.4.5"
315 struct dsdb_fsmo_extended_op {
317 struct GUID destination_dsa_guid;
320 /* this takes no data */
321 #define DSDB_EXTENDED_CREATE_OWN_RID_SET "1.3.6.1.4.1.7165.4.4.8"
323 /* this takes a struct dsdb_extended_allocate_rid */
324 #define DSDB_EXTENDED_ALLOCATE_RID "1.3.6.1.4.1.7165.4.4.9"
326 struct dsdb_extended_allocate_rid {
331 * passed from the descriptor module in order to
332 * store the recalucated nTSecurityDescriptor without
333 * modifying the replPropertyMetaData.
335 #define DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID "1.3.6.1.4.1.7165.4.4.7"
336 struct dsdb_extended_sec_desc_propagation_op {
337 struct ldb_dn *nc_root;
342 #define DSDB_ACL_CHECKS_DIRSYNC_FLAG 0x1
343 #define DSDB_SAMDB_MINIMUM_ALLOWED_RID 1000
345 #define DSDB_METADATA_SCHEMA_SEQ_NUM "SCHEMA_SEQ_NUM"
348 * must be in LDB_FLAG_INTERNAL_MASK
349 * see also the values in lib/ldb/include/ldb_module.h
351 #define DSDB_FLAG_INTERNAL_FORCE_META_DATA 0x10000
353 #define SAMBA_COMPATIBLE_FEATURES_ATTR "compatibleFeatures"
354 #define SAMBA_REQUIRED_FEATURES_ATTR "requiredFeatures"
355 #define SAMBA_FEATURES_SUPPORTED_FLAG "@SAMBA_FEATURES_SUPPORTED"
357 #define SAMBA_SORTED_LINKS_FEATURE "sortedLinks"
358 #define SAMBA_ENCRYPTED_SECRETS_FEATURE "encryptedSecrets"
360 * lmdb level one feature is an experimental release with basic support
361 * for lmdb database files, instead of tdb.
362 * - Keys are limited to 511 bytes long so GUID indexes are required
363 * - Currently only the:
364 * partition data files
365 * are in lmdb format.
367 #define SAMBA_LMDB_LEVEL_ONE_FEATURE "lmdbLevelOne"
369 #endif /* __SAMDB_H__ */