Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
Copyright (C) Simo Sorce 2004-2008
- Copyright (C) Matthias Dieter Wallnöfer 2009
+ Copyright (C) Matthias Dieter Wallnöfer 2009-2010
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
/* used in "samldb_user_dn_to_prim_group_rid" */
uint32_t prim_group_rid;
- /* used in conjunction with "prim_group_rid" in
- * "samldb_prim_group_rid_to_users_cnt" */
- unsigned int users_cnt;
-
/* used in "samldb_group_add_member" and "samldb_group_del_member" */
struct ldb_dn *group_dn;
struct ldb_dn *member_dn;
struct ldb_dn *user_dn;
struct ldb_dn *old_prim_group_dn, *new_prim_group_dn;
- /* generic counter - used in "samldb_member_check" */
- unsigned int cnt;
-
/* all the async steps necessary to complete the operation */
struct samldb_step *steps;
struct samldb_step *curstep;
}
ret = ldb_build_search_req(&req, ldb, ac,
- samdb_base_dn(ldb), LDB_SCOPE_SUBTREE,
+ ldb_get_default_basedn(ldb),
+ LDB_SCOPE_SUBTREE,
filter, NULL,
NULL,
ac, samldb_check_samAccountName_callback,
struct ldb_val v;
enum ndr_err_code ndr_err;
- ndr_err = ndr_push_struct_blob(&v, msg, NULL, sid,
+ ndr_err = ndr_push_struct_blob(&v, msg, sid,
(ndr_push_flags_fn_t)ndr_push_dom_sid);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return false;
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
+
+ if (ares->type == LDB_REPLY_REFERRAL) {
+ return ldb_module_send_referral(ac->req, ares->referral);
+ }
+
if (ares->error != LDB_SUCCESS) {
return ldb_module_done(ac->req, ares->controls,
ares->response, ares->error);
return ldb_module_done(ac->req, NULL, NULL,
LDB_ERR_OPERATIONS_ERROR);
}
+
+ if (ares->type == LDB_REPLY_REFERRAL) {
+ return ldb_module_send_referral(ac->req, ares->referral);
+ }
+
if (ares->error != LDB_SUCCESS) {
return ldb_module_done(ac->req, ares->controls,
ares->response, ares->error);
return ldb_next_request(ac->module, req);
}
+/*
+ * return true if msg carries an attributeSchema that is intended to be RODC
+ * filtered but is also a system-critical attribute.
+ */
+static bool check_rodc_critical_attribute(struct ldb_message *msg)
+{
+ uint32_t schemaFlagsEx, searchFlags, rodc_filtered_flags;
+
+ schemaFlagsEx = ldb_msg_find_attr_as_uint(msg, "schemaFlagsEx", 0);
+ searchFlags = ldb_msg_find_attr_as_uint(msg, "searchFlags", 0);
+ rodc_filtered_flags = (SEARCH_FLAG_RODC_ATTRIBUTE | SEARCH_FLAG_CONFIDENTIAL);
+
+ if ((schemaFlagsEx & SCHEMA_FLAG_ATTR_IS_CRITICAL) &&
+ ((searchFlags & rodc_filtered_flags) == rodc_filtered_flags)) {
+ return true;
+ } else {
+ return false;
+ }
+}
+
static int samldb_fill_object(struct samldb_ctx *ac, const char *type)
{
"rdnAttId", "cn");
if (ret != LDB_SUCCESS) return ret;
+ /* do not allow to mark an attributeSchema as RODC filtered if it
+ * is system-critical */
+ if (check_rodc_critical_attribute(ac->msg)) {
+ ldb_asprintf_errstring(ldb, "Refusing schema add of %s - cannot combine critical class with RODC filtering",
+ ldb_dn_get_linearized(ac->msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+
rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
/* the RDN has prefix "CN" */
}
}
+ /* do not allow to mark an attributeSchema as RODC filtered if it
+ * is system-critical */
+ if (check_rodc_critical_attribute(ac->msg)) {
+ ldb_asprintf_errstring(ldb, "Refusing schema add of %s - cannot combine critical attribute with RODC filtering",
+ ldb_dn_get_linearized(ac->msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
ret = samdb_find_or_add_attribute(ldb, ac->msg,
"isSingleValued", "FALSE");
if (ret != LDB_SUCCESS) return ret;
return LDB_SUCCESS;
}
-/*
- * samldb_sid_from_dn (async)
- */
-
-static int samldb_sid_from_dn(struct samldb_ctx *ac);
-
-static int samldb_sid_from_dn_callback(struct ldb_request *req,
- struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
- if (ares->error != LDB_SUCCESS) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- /* save entry */
- if (ac->res_sid != NULL) {
- /* one too many! */
- ldb_set_errstring(ldb,
- "Invalid number of results while searching "
- "for domain objects!");
- ret = LDB_ERR_OPERATIONS_ERROR;
- break;
- }
- ac->res_sid = samdb_result_dom_sid(ac, ares->message,
- "objectSid");
-
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
-
- /* found or not found, go on */
- ret = samldb_next_step(ac);
- break;
- }
-
-done:
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
-/* Finds the SID "res_sid" of an object with a given DN "dn" */
-static int samldb_sid_from_dn(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- static const char * const attrs[] = { "objectSid", NULL };
- struct ldb_request *req;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if (ac->dn == NULL)
- return LDB_ERR_OPERATIONS_ERROR;
-
- ret = ldb_build_search_req(&req, ldb, ac,
- ac->dn,
- LDB_SCOPE_BASE,
- NULL, attrs,
- NULL,
- ac, samldb_sid_from_dn_callback,
- ac->req);
- if (ret != LDB_SUCCESS)
- return ret;
-
- return ldb_next_request(ac->module, req);
-}
-
/*
* samldb_user_dn_to_prim_group_rid (async)
*/
return ldb_next_request(ac->module, req);
}
-/*
- * samldb_prim_group_rid_to_users_cnt (async)
- */
-
-static int samldb_prim_group_rid_to_users_cnt(struct samldb_ctx *ac);
-
-static int samldb_prim_group_rid_to_users_cnt_callback(struct ldb_request *req,
- struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
- if (ares->error != LDB_SUCCESS) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- /* save entry */
- ++(ac->users_cnt);
-
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
-
- /* found or not found, go on */
- ret = samldb_next_step(ac);
- break;
- }
-
-done:
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
-/* Finds the amount of users which have the primary group "prim_group_rid" and
- * save the result in "users_cnt" */
-static int samldb_prim_group_rid_to_users_cnt(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- static const char * const attrs[] = { NULL };
- struct ldb_request *req;
- char *filter;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if ((ac->prim_group_rid == 0) || (ac->users_cnt != 0))
- return LDB_ERR_OPERATIONS_ERROR;
-
- filter = talloc_asprintf(ac, "(&(primaryGroupID=%u)(objectclass=user))",
- ac->prim_group_rid);
- if (filter == NULL)
- return LDB_ERR_OPERATIONS_ERROR;
-
- ret = ldb_build_search_req(&req, ldb, ac,
- ldb_get_default_basedn(ldb),
- LDB_SCOPE_SUBTREE,
- filter, attrs,
- NULL,
- ac,
- samldb_prim_group_rid_to_users_cnt_callback,
- ac->req);
- if (ret != LDB_SUCCESS)
- return ret;
-
- return ldb_next_request(ac->module, req);
-}
-
/*
* samldb_group_add_member (async)
* samldb_group_del_member (async)
ret = LDB_ERR_OPERATIONS_ERROR;
goto done;
}
+
+ if (ares->type == LDB_REPLY_REFERRAL) {
+ return ldb_module_send_referral(ac->req, ares->referral);
+ }
+
if (ares->error != LDB_SUCCESS) {
if (ares->error == LDB_ERR_NO_SUCH_ATTRIBUTE) {
/* On error "NO_SUCH_ATTRIBUTE" (delete of an invalid
}
-static int samldb_member_check_1(struct samldb_ctx *ac)
+static int samldb_member_check(struct samldb_ctx *ac)
{
struct ldb_context *ldb;
struct ldb_message_element *el;
+ struct ldb_dn *member_dn, *group_dn;
+ uint32_t prim_group_rid;
+ struct dom_sid *sid;
+ unsigned int i;
ldb = ldb_module_get_ctx(ac->module);
el = ldb_msg_find_element(ac->msg, "member");
-
- ac->user_dn = ldb_dn_from_ldb_val(ac, ldb, &el->values[ac->cnt]);
- if (!ldb_dn_validate(ac->user_dn))
- return LDB_ERR_OPERATIONS_ERROR;
- ac->prim_group_rid = 0;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_member_check_2(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb),
- ac->prim_group_rid);
- if (ac->sid == NULL)
- return LDB_ERR_OPERATIONS_ERROR;
- ac->res_dn = NULL;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_member_check_3(struct samldb_ctx *ac)
-{
- if (ldb_dn_compare(ac->res_dn, ac->msg->dn) == 0)
- return LDB_ERR_ENTRY_ALREADY_EXISTS;
-
- ++(ac->cnt);
-
- return samldb_next_step(ac);
-}
-
-static int samldb_member_check_4(struct samldb_ctx *ac)
-{
- return ldb_next_request(ac->module, ac->req);
-}
-
-static int samldb_member_check(struct samldb_ctx *ac)
-{
- struct ldb_message_element *el;
- int i, ret;
-
- el = ldb_msg_find_element(ac->msg, "member");
- ac->cnt = 0;
for (i = 0; i < el->num_values; i++) {
/* Denies to add "member"s to groups which are primary ones
* for them */
- ret = samldb_add_step(ac, samldb_member_check_1);
- if (ret != LDB_SUCCESS) return ret;
+ member_dn = ldb_dn_from_ldb_val(ac, ldb, &el->values[i]);
+ if (!ldb_dn_validate(member_dn)) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
- ret = samldb_add_step(ac, samldb_user_dn_to_prim_group_rid);
- if (ret != LDB_SUCCESS) return ret;
+ prim_group_rid = samdb_search_uint(ldb, ac, (uint32_t) -1,
+ member_dn, "primaryGroupID",
+ NULL);
+ if (prim_group_rid == (uint32_t) -1) {
+ /* the member hasn't to be a user account -> therefore
+ * no check needed in this case. */
+ continue;
+ }
- ret = samldb_add_step(ac, samldb_member_check_2);
- if (ret != LDB_SUCCESS) return ret;
+ sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb),
+ prim_group_rid);
+ if (sid == NULL) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
- ret = samldb_add_step(ac, samldb_dn_from_sid);
- if (ret != LDB_SUCCESS) return ret;
+ group_dn = samdb_search_dn(ldb, ac, NULL, "(objectSID=%s)",
+ dom_sid_string(ac, sid));
+ if (group_dn == NULL) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
- ret = samldb_add_step(ac, samldb_member_check_3);
- if (ret != LDB_SUCCESS) return ret;
+ if (ldb_dn_compare(group_dn, ac->msg->dn) == 0) {
+ return LDB_ERR_ENTRY_ALREADY_EXISTS;
+ }
}
- ret = samldb_add_step(ac, samldb_member_check_4);
- if (ret != LDB_SUCCESS) return ret;
-
- return samldb_first_step(ac);
+ return ldb_next_request(ac->module, ac->req);
}
-static int samldb_prim_group_users_check_1(struct samldb_ctx *ac)
-{
- ac->dn = ac->req->op.del.dn;
- ac->res_sid = NULL;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_prim_group_users_check_2(struct samldb_ctx *ac)
+static int samldb_prim_group_users_check(struct samldb_ctx *ac)
{
- NTSTATUS status;
+ struct ldb_context *ldb;
+ struct dom_sid *sid;
uint32_t rid;
+ NTSTATUS status;
+ int count;
+
+ ldb = ldb_module_get_ctx(ac->module);
- if (ac->res_sid == NULL) {
- /* No SID - therefore ok here */
+ /* Finds out the SID/RID of the SAM object */
+ sid = samdb_search_dom_sid(ldb, ac, ac->req->op.del.dn, "objectSID",
+ NULL);
+ if (sid == NULL) {
+ /* No SID - it might not be a SAM object - therefore ok */
return ldb_next_request(ac->module, ac->req);
}
- status = dom_sid_split_rid(ac, ac->res_sid, NULL, &rid);
- if (!NT_STATUS_IS_OK(status))
+ status = dom_sid_split_rid(ac, sid, NULL, &rid);
+ if (!NT_STATUS_IS_OK(status)) {
return LDB_ERR_OPERATIONS_ERROR;
-
+ }
if (rid == 0) {
/* Special object (security principal?) */
return ldb_next_request(ac->module, ac->req);
}
- ac->prim_group_rid = rid;
- ac->users_cnt = 0;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_prim_group_users_check_3(struct samldb_ctx *ac)
-{
- if (ac->users_cnt > 0)
+ /* Deny delete requests from groups which are primary ones */
+ count = samdb_search_count(ldb, NULL,
+ "(&(primaryGroupID=%u)(objectClass=user))",
+ rid);
+ if (count < 0) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ if (count > 0) {
return LDB_ERR_ENTRY_ALREADY_EXISTS;
+ }
return ldb_next_request(ac->module, ac->req);
}
-static int samldb_prim_group_users_check(struct samldb_ctx *ac)
-{
- int ret;
-
- /* Finds out the SID/RID of the domain object */
-
- ret = samldb_add_step(ac, samldb_prim_group_users_check_1);
- if (ret != LDB_SUCCESS) return ret;
-
- ret = samldb_add_step(ac, samldb_sid_from_dn);
- if (ret != LDB_SUCCESS) return ret;
-
- /* Deny delete requests from groups which are primary ones */
-
- ret = samldb_add_step(ac, samldb_prim_group_users_check_2);
- if (ret != LDB_SUCCESS) return ret;
-
- ret = samldb_add_step(ac, samldb_prim_group_rid_to_users_cnt);
- if (ret != LDB_SUCCESS) return ret;
-
- ret = samldb_add_step(ac, samldb_prim_group_users_check_3);
- if (ret != LDB_SUCCESS) return ret;
-
- return samldb_first_step(ac);
-}
-
/* add */
static int samldb_add(struct ldb_module *module, struct ldb_request *req)
git.samba.org / bbaumbach / samba-autobuild / .git / blobdiff