2 Unix SMB/CIFS implementation.
3 Samba utility functions
5 Copyright (C) Andrew Tridgell 2004
6 Copyright (C) Volker Lendecke 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006
8 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "events/events.h"
27 #include "ldb_errors.h"
28 #include "../lib/util/util_ldb.h"
29 #include "../lib/crypto/crypto.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "libcli/security/security.h"
32 #include "librpc/gen_ndr/ndr_security.h"
33 #include "librpc/gen_ndr/ndr_misc.h"
34 #include "../libds/common/flags.h"
35 #include "dsdb/common/proto.h"
36 #include "libcli/ldap/ldap_ndr.h"
37 #include "param/param.h"
38 #include "libcli/auth/libcli_auth.h"
39 #include "librpc/gen_ndr/ndr_drsblobs.h"
40 #include "system/locale.h"
43 search the sam for the specified attributes in a specific domain, filter on
44 objectSid being in domain_sid.
46 int samdb_search_domain(struct ldb_context *sam_ldb,
48 struct ldb_dn *basedn,
49 struct ldb_message ***res,
50 const char * const *attrs,
51 const struct dom_sid *domain_sid,
52 const char *format, ...) _PRINTF_ATTRIBUTE(7,8)
58 count = gendb_search_v(sam_ldb, mem_ctx, basedn,
59 res, attrs, format, ap);
65 struct dom_sid *entry_sid;
67 entry_sid = samdb_result_dom_sid(mem_ctx, (*res)[i], "objectSid");
69 if ((entry_sid == NULL) ||
70 (!dom_sid_in_domain(domain_sid, entry_sid))) {
71 /* Delete that entry from the result set */
72 (*res)[i] = (*res)[count-1];
74 talloc_free(entry_sid);
77 talloc_free(entry_sid);
85 search the sam for a single string attribute in exactly 1 record
87 const char *samdb_search_string_v(struct ldb_context *sam_ldb,
89 struct ldb_dn *basedn,
90 const char *attr_name,
91 const char *format, va_list ap) _PRINTF_ATTRIBUTE(5,0)
94 const char *attrs[2] = { NULL, NULL };
95 struct ldb_message **res = NULL;
99 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
101 DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n",
102 attr_name, format, count));
109 return samdb_result_string(res[0], attr_name, NULL);
113 search the sam for a single string attribute in exactly 1 record
115 const char *samdb_search_string(struct ldb_context *sam_ldb,
117 struct ldb_dn *basedn,
118 const char *attr_name,
119 const char *format, ...) _PRINTF_ATTRIBUTE(5,6)
124 va_start(ap, format);
125 str = samdb_search_string_v(sam_ldb, mem_ctx, basedn, attr_name, format, ap);
131 struct ldb_dn *samdb_search_dn(struct ldb_context *sam_ldb,
133 struct ldb_dn *basedn,
134 const char *format, ...) _PRINTF_ATTRIBUTE(4,5)
138 struct ldb_message **res = NULL;
141 va_start(ap, format);
142 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, NULL, format, ap);
145 if (count != 1) return NULL;
147 ret = talloc_steal(mem_ctx, res[0]->dn);
154 search the sam for a dom_sid attribute in exactly 1 record
156 struct dom_sid *samdb_search_dom_sid(struct ldb_context *sam_ldb,
158 struct ldb_dn *basedn,
159 const char *attr_name,
160 const char *format, ...) _PRINTF_ATTRIBUTE(5,6)
164 struct ldb_message **res;
165 const char *attrs[2] = { NULL, NULL };
168 attrs[0] = attr_name;
170 va_start(ap, format);
171 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
174 DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n",
175 attr_name, format, count));
181 sid = samdb_result_dom_sid(mem_ctx, res[0], attr_name);
187 return the count of the number of records in the sam matching the query
189 int samdb_search_count(struct ldb_context *sam_ldb,
190 struct ldb_dn *basedn,
191 const char *format, ...) _PRINTF_ATTRIBUTE(3,4)
194 struct ldb_message **res;
195 const char *attrs[] = { NULL };
197 TALLOC_CTX *tmp_ctx = talloc_new(sam_ldb);
199 va_start(ap, format);
200 ret = gendb_search_v(sam_ldb, tmp_ctx, basedn, &res, attrs, format, ap);
202 talloc_free(tmp_ctx);
209 search the sam for a single integer attribute in exactly 1 record
211 uint_t samdb_search_uint(struct ldb_context *sam_ldb,
213 uint_t default_value,
214 struct ldb_dn *basedn,
215 const char *attr_name,
216 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
220 struct ldb_message **res;
221 const char *attrs[2] = { NULL, NULL };
223 attrs[0] = attr_name;
225 va_start(ap, format);
226 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
230 return default_value;
233 return samdb_result_uint(res[0], attr_name, default_value);
237 search the sam for a single signed 64 bit integer attribute in exactly 1 record
239 int64_t samdb_search_int64(struct ldb_context *sam_ldb,
241 int64_t default_value,
242 struct ldb_dn *basedn,
243 const char *attr_name,
244 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
248 struct ldb_message **res;
249 const char *attrs[2] = { NULL, NULL };
251 attrs[0] = attr_name;
253 va_start(ap, format);
254 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
258 return default_value;
261 return samdb_result_int64(res[0], attr_name, default_value);
265 search the sam for multipe records each giving a single string attribute
266 return the number of matches, or -1 on error
268 int samdb_search_string_multiple(struct ldb_context *sam_ldb,
270 struct ldb_dn *basedn,
272 const char *attr_name,
273 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
277 const char *attrs[2] = { NULL, NULL };
278 struct ldb_message **res = NULL;
280 attrs[0] = attr_name;
282 va_start(ap, format);
283 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
290 /* make sure its single valued */
291 for (i=0;i<count;i++) {
292 if (res[i]->num_elements != 1) {
293 DEBUG(1,("samdb: search for %s %s not single valued\n",
300 *strs = talloc_array(mem_ctx, const char *, count+1);
306 for (i=0;i<count;i++) {
307 (*strs)[i] = samdb_result_string(res[i], attr_name, NULL);
309 (*strs)[count] = NULL;
315 pull a uint from a result set.
317 uint_t samdb_result_uint(const struct ldb_message *msg, const char *attr, uint_t default_value)
319 return ldb_msg_find_attr_as_uint(msg, attr, default_value);
323 pull a (signed) int64 from a result set.
325 int64_t samdb_result_int64(const struct ldb_message *msg, const char *attr, int64_t default_value)
327 return ldb_msg_find_attr_as_int64(msg, attr, default_value);
331 pull a string from a result set.
333 const char *samdb_result_string(const struct ldb_message *msg, const char *attr,
334 const char *default_value)
336 return ldb_msg_find_attr_as_string(msg, attr, default_value);
339 struct ldb_dn *samdb_result_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
340 const char *attr, struct ldb_dn *default_value)
342 struct ldb_dn *ret_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, msg, attr);
344 return default_value;
350 pull a rid from a objectSid in a result set.
352 uint32_t samdb_result_rid_from_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
353 const char *attr, uint32_t default_value)
358 sid = samdb_result_dom_sid(mem_ctx, msg, attr);
360 return default_value;
362 rid = sid->sub_auths[sid->num_auths-1];
368 pull a dom_sid structure from a objectSid in a result set.
370 struct dom_sid *samdb_result_dom_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
373 const struct ldb_val *v;
375 enum ndr_err_code ndr_err;
376 v = ldb_msg_find_ldb_val(msg, attr);
380 sid = talloc(mem_ctx, struct dom_sid);
384 ndr_err = ndr_pull_struct_blob(v, sid, NULL, sid,
385 (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
386 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
394 pull a guid structure from a objectGUID in a result set.
396 struct GUID samdb_result_guid(const struct ldb_message *msg, const char *attr)
398 const struct ldb_val *v;
402 v = ldb_msg_find_ldb_val(msg, attr);
403 if (!v) return GUID_zero();
405 status = GUID_from_ndr_blob(v, &guid);
406 if (!NT_STATUS_IS_OK(status)) {
414 pull a sid prefix from a objectSid in a result set.
415 this is used to find the domain sid for a user
417 struct dom_sid *samdb_result_sid_prefix(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
420 struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg, attr);
421 if (!sid || sid->num_auths < 1) return NULL;
427 pull a NTTIME in a result set.
429 NTTIME samdb_result_nttime(const struct ldb_message *msg, const char *attr,
430 NTTIME default_value)
432 return ldb_msg_find_attr_as_uint64(msg, attr, default_value);
436 * Windows stores 0 for lastLogoff.
437 * But when a MS DC return the lastLogoff (as Logoff Time)
438 * it returns 0x7FFFFFFFFFFFFFFF, not returning this value in this case
439 * cause windows 2008 and newer version to fail for SMB requests
441 NTTIME samdb_result_last_logoff(const struct ldb_message *msg)
443 NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "lastLogoff",0);
446 ret = 0x7FFFFFFFFFFFFFFFULL;
452 * Windows uses both 0 and 9223372036854775807 (0x7FFFFFFFFFFFFFFFULL) to
453 * indicate an account doesn't expire.
455 * When Windows initially creates an account, it sets
456 * accountExpires = 9223372036854775807 (0x7FFFFFFFFFFFFFFF). However,
457 * when changing from an account having a specific expiration date to
458 * that account never expiring, it sets accountExpires = 0.
460 * Consolidate that logic here to allow clearer logic for account expiry in
461 * the rest of the code.
463 NTTIME samdb_result_account_expires(const struct ldb_message *msg)
465 NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "accountExpires",
469 ret = 0x7FFFFFFFFFFFFFFFULL;
475 pull a uint64_t from a result set.
477 uint64_t samdb_result_uint64(const struct ldb_message *msg, const char *attr,
478 uint64_t default_value)
480 return ldb_msg_find_attr_as_uint64(msg, attr, default_value);
485 construct the allow_password_change field from the PwdLastSet attribute and the
486 domain password settings
488 NTTIME samdb_result_allow_password_change(struct ldb_context *sam_ldb,
490 struct ldb_dn *domain_dn,
491 struct ldb_message *msg,
494 uint64_t attr_time = samdb_result_uint64(msg, attr, 0);
497 if (attr_time == 0) {
501 minPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "minPwdAge", NULL);
503 /* yes, this is a -= not a += as minPwdAge is stored as the negative
504 of the number of 100-nano-seconds */
505 attr_time -= minPwdAge;
511 construct the force_password_change field from the PwdLastSet
512 attribute, the userAccountControl and the domain password settings
514 NTTIME samdb_result_force_password_change(struct ldb_context *sam_ldb,
516 struct ldb_dn *domain_dn,
517 struct ldb_message *msg)
519 uint64_t attr_time = samdb_result_uint64(msg, "pwdLastSet", 0);
520 uint32_t userAccountControl = samdb_result_uint64(msg, "userAccountControl", 0);
523 /* Machine accounts don't expire, and there is a flag for 'no expiry' */
524 if (!(userAccountControl & UF_NORMAL_ACCOUNT)
525 || (userAccountControl & UF_DONT_EXPIRE_PASSWD)) {
526 return 0x7FFFFFFFFFFFFFFFULL;
529 if (attr_time == 0) {
533 maxPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "maxPwdAge", NULL);
534 if (maxPwdAge == 0) {
535 return 0x7FFFFFFFFFFFFFFFULL;
537 attr_time -= maxPwdAge;
544 pull a samr_Password structutre from a result set.
546 struct samr_Password *samdb_result_hash(TALLOC_CTX *mem_ctx, const struct ldb_message *msg, const char *attr)
548 struct samr_Password *hash = NULL;
549 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
550 if (val && (val->length >= sizeof(hash->hash))) {
551 hash = talloc(mem_ctx, struct samr_Password);
552 memcpy(hash->hash, val->data, MIN(val->length, sizeof(hash->hash)));
558 pull an array of samr_Password structutres from a result set.
560 uint_t samdb_result_hashes(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
561 const char *attr, struct samr_Password **hashes)
564 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
570 count = val->length / 16;
575 *hashes = talloc_array(mem_ctx, struct samr_Password, count);
580 for (i=0;i<count;i++) {
581 memcpy((*hashes)[i].hash, (i*16)+(char *)val->data, 16);
587 NTSTATUS samdb_result_passwords(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, struct ldb_message *msg,
588 struct samr_Password **lm_pwd, struct samr_Password **nt_pwd)
590 struct samr_Password *lmPwdHash, *ntPwdHash;
593 num_nt = samdb_result_hashes(mem_ctx, msg, "unicodePwd", &ntPwdHash);
596 } else if (num_nt > 1) {
597 return NT_STATUS_INTERNAL_DB_CORRUPTION;
599 *nt_pwd = &ntPwdHash[0];
603 /* Ensure that if we have turned off LM
604 * authentication, that we never use the LM hash, even
606 if (lp_lanman_auth(lp_ctx)) {
608 num_lm = samdb_result_hashes(mem_ctx, msg, "dBCSPwd", &lmPwdHash);
611 } else if (num_lm > 1) {
612 return NT_STATUS_INTERNAL_DB_CORRUPTION;
614 *lm_pwd = &lmPwdHash[0];
624 pull a samr_LogonHours structutre from a result set.
626 struct samr_LogonHours samdb_result_logon_hours(TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr)
628 struct samr_LogonHours hours;
629 const int units_per_week = 168;
630 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
632 hours.bits = talloc_array(mem_ctx, uint8_t, units_per_week);
636 hours.units_per_week = units_per_week;
637 memset(hours.bits, 0xFF, units_per_week);
639 memcpy(hours.bits, val->data, MIN(val->length, units_per_week));
645 pull a set of account_flags from a result set.
647 This requires that the attributes:
652 uint32_t samdb_result_acct_flags(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
653 struct ldb_message *msg, struct ldb_dn *domain_dn)
655 uint32_t userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
656 uint32_t acct_flags = ds_uf2acb(userAccountControl);
657 NTTIME must_change_time;
660 must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx,
663 /* Test account expire time */
664 unix_to_nt_time(&now, time(NULL));
665 /* check for expired password */
666 if (must_change_time < now) {
667 acct_flags |= ACB_PW_EXPIRED;
672 struct lsa_BinaryString samdb_result_parameters(TALLOC_CTX *mem_ctx,
673 struct ldb_message *msg,
676 struct lsa_BinaryString s;
677 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
685 s.array = talloc_array(mem_ctx, uint16_t, val->length/2);
689 s.length = s.size = val->length/2;
690 memcpy(s.array, val->data, val->length);
695 /* Find an attribute, with a particular value */
697 /* The current callers of this function expect a very specific
698 * behaviour: In particular, objectClass subclass equivilance is not
699 * wanted. This means that we should not lookup the schema for the
700 * comparison function */
701 struct ldb_message_element *samdb_find_attribute(struct ldb_context *ldb,
702 const struct ldb_message *msg,
703 const char *name, const char *value)
706 struct ldb_message_element *el = ldb_msg_find_element(msg, name);
712 for (i=0;i<el->num_values;i++) {
713 if (ldb_attr_cmp(value, (char *)el->values[i].data) == 0) {
721 int samdb_find_or_add_value(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value)
723 if (samdb_find_attribute(ldb, msg, name, set_value) == NULL) {
724 return samdb_msg_add_string(ldb, msg, msg, name, set_value);
729 int samdb_find_or_add_attribute(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value)
731 struct ldb_message_element *el;
733 el = ldb_msg_find_element(msg, name);
738 return samdb_msg_add_string(ldb, msg, msg, name, set_value);
744 add a string element to a message
746 int samdb_msg_add_string(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
747 const char *attr_name, const char *str)
749 char *s = talloc_strdup(mem_ctx, str);
750 char *a = talloc_strdup(mem_ctx, attr_name);
751 if (s == NULL || a == NULL) {
752 return LDB_ERR_OPERATIONS_ERROR;
754 return ldb_msg_add_string(msg, a, s);
758 add a dom_sid element to a message
760 int samdb_msg_add_dom_sid(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
761 const char *attr_name, struct dom_sid *sid)
764 enum ndr_err_code ndr_err;
766 ndr_err = ndr_push_struct_blob(&v, mem_ctx,
767 lp_iconv_convenience(ldb_get_opaque(sam_ldb, "loadparm")),
769 (ndr_push_flags_fn_t)ndr_push_dom_sid);
770 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
773 return ldb_msg_add_value(msg, attr_name, &v, NULL);
778 add a delete element operation to a message
780 int samdb_msg_add_delete(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
781 const char *attr_name)
783 /* we use an empty replace rather than a delete, as it allows for
784 samdb_replace() to be used everywhere */
785 return ldb_msg_add_empty(msg, attr_name, LDB_FLAG_MOD_REPLACE, NULL);
789 add a add attribute value to a message
791 int samdb_msg_add_addval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
792 const char *attr_name, const char *value)
794 struct ldb_message_element *el;
797 a = talloc_strdup(mem_ctx, attr_name);
800 v = talloc_strdup(mem_ctx, value);
803 ret = ldb_msg_add_string(msg, a, v);
806 el = ldb_msg_find_element(msg, a);
809 el->flags = LDB_FLAG_MOD_ADD;
814 add a delete attribute value to a message
816 int samdb_msg_add_delval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
817 const char *attr_name, const char *value)
819 struct ldb_message_element *el;
822 a = talloc_strdup(mem_ctx, attr_name);
825 v = talloc_strdup(mem_ctx, value);
828 ret = ldb_msg_add_string(msg, a, v);
831 el = ldb_msg_find_element(msg, a);
834 el->flags = LDB_FLAG_MOD_DELETE;
839 add a int element to a message
841 int samdb_msg_add_int(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
842 const char *attr_name, int v)
844 const char *s = talloc_asprintf(mem_ctx, "%d", v);
845 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
849 add a uint_t element to a message
851 int samdb_msg_add_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
852 const char *attr_name, uint_t v)
854 const char *s = talloc_asprintf(mem_ctx, "%u", v);
855 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
859 add a (signed) int64_t element to a message
861 int samdb_msg_add_int64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
862 const char *attr_name, int64_t v)
864 const char *s = talloc_asprintf(mem_ctx, "%lld", (long long)v);
865 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
869 add a uint64_t element to a message
871 int samdb_msg_add_uint64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
872 const char *attr_name, uint64_t v)
874 const char *s = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)v);
875 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
879 add a samr_Password element to a message
881 int samdb_msg_add_hash(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
882 const char *attr_name, struct samr_Password *hash)
885 val.data = talloc_memdup(mem_ctx, hash->hash, 16);
890 return ldb_msg_add_value(msg, attr_name, &val, NULL);
894 add a samr_Password array to a message
896 int samdb_msg_add_hashes(TALLOC_CTX *mem_ctx, struct ldb_message *msg,
897 const char *attr_name, struct samr_Password *hashes, uint_t count)
901 val.data = talloc_array_size(mem_ctx, 16, count);
902 val.length = count*16;
906 for (i=0;i<count;i++) {
907 memcpy(i*16 + (char *)val.data, hashes[i].hash, 16);
909 return ldb_msg_add_value(msg, attr_name, &val, NULL);
913 add a acct_flags element to a message
915 int samdb_msg_add_acct_flags(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
916 const char *attr_name, uint32_t v)
918 return samdb_msg_add_uint(sam_ldb, mem_ctx, msg, attr_name, ds_acb2uf(v));
922 add a logon_hours element to a message
924 int samdb_msg_add_logon_hours(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
925 const char *attr_name, struct samr_LogonHours *hours)
928 val.length = hours->units_per_week / 8;
929 val.data = hours->bits;
930 return ldb_msg_add_value(msg, attr_name, &val, NULL);
934 add a parameters element to a message
936 int samdb_msg_add_parameters(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
937 const char *attr_name, struct lsa_BinaryString *parameters)
940 val.length = parameters->length * 2;
941 val.data = (uint8_t *)parameters->array;
942 return ldb_msg_add_value(msg, attr_name, &val, NULL);
945 add a general value element to a message
947 int samdb_msg_add_value(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
948 const char *attr_name, const struct ldb_val *val)
950 return ldb_msg_add_value(msg, attr_name, val, NULL);
954 sets a general value element to a message
956 int samdb_msg_set_value(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
957 const char *attr_name, const struct ldb_val *val)
959 struct ldb_message_element *el;
961 el = ldb_msg_find_element(msg, attr_name);
965 return ldb_msg_add_value(msg, attr_name, val, NULL);
969 set a string element in a message
971 int samdb_msg_set_string(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
972 const char *attr_name, const char *str)
974 struct ldb_message_element *el;
976 el = ldb_msg_find_element(msg, attr_name);
980 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, str);
984 replace elements in a record
986 int samdb_replace(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg)
990 /* mark all the message elements as LDB_FLAG_MOD_REPLACE */
991 for (i=0;i<msg->num_elements;i++) {
992 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
995 /* modify the samdb record */
996 return ldb_modify(sam_ldb, msg);
1000 return a default security descriptor
1002 struct security_descriptor *samdb_default_security_descriptor(TALLOC_CTX *mem_ctx)
1004 struct security_descriptor *sd;
1006 sd = security_descriptor_initialise(mem_ctx);
1011 struct ldb_dn *samdb_base_dn(struct ldb_context *sam_ctx)
1013 return ldb_get_default_basedn(sam_ctx);
1016 struct ldb_dn *samdb_config_dn(struct ldb_context *sam_ctx)
1018 return ldb_get_config_basedn(sam_ctx);
1021 struct ldb_dn *samdb_schema_dn(struct ldb_context *sam_ctx)
1023 return ldb_get_schema_basedn(sam_ctx);
1026 struct ldb_dn *samdb_aggregate_schema_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1028 struct ldb_dn *schema_dn = ldb_get_schema_basedn(sam_ctx);
1029 struct ldb_dn *aggregate_dn;
1034 aggregate_dn = ldb_dn_copy(mem_ctx, schema_dn);
1035 if (!aggregate_dn) {
1038 if (!ldb_dn_add_child_fmt(aggregate_dn, "CN=Aggregate")) {
1041 return aggregate_dn;
1044 struct ldb_dn *samdb_root_dn(struct ldb_context *sam_ctx)
1046 return ldb_get_root_basedn(sam_ctx);
1049 struct ldb_dn *samdb_partitions_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1051 struct ldb_dn *new_dn;
1053 new_dn = ldb_dn_copy(mem_ctx, samdb_config_dn(sam_ctx));
1054 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Partitions")) {
1055 talloc_free(new_dn);
1061 struct ldb_dn *samdb_sites_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1063 struct ldb_dn *new_dn;
1065 new_dn = ldb_dn_copy(mem_ctx, samdb_config_dn(sam_ctx));
1066 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Sites")) {
1067 talloc_free(new_dn);
1074 work out the domain sid for the current open ldb
1076 const struct dom_sid *samdb_domain_sid(struct ldb_context *ldb)
1078 TALLOC_CTX *tmp_ctx;
1079 const struct dom_sid *domain_sid;
1080 const char *attrs[] = {
1084 struct ldb_result *res;
1087 /* see if we have a cached copy */
1088 domain_sid = (struct dom_sid *)ldb_get_opaque(ldb, "cache.domain_sid");
1093 tmp_ctx = talloc_new(ldb);
1094 if (tmp_ctx == NULL) {
1098 ret = ldb_search(ldb, tmp_ctx, &res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, attrs, "objectSid=*");
1100 if (ret != LDB_SUCCESS) {
1104 if (res->count != 1) {
1108 domain_sid = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSid");
1109 if (domain_sid == NULL) {
1113 /* cache the domain_sid in the ldb */
1114 if (ldb_set_opaque(ldb, "cache.domain_sid", discard_const_p(struct dom_sid, domain_sid)) != LDB_SUCCESS) {
1118 talloc_steal(ldb, domain_sid);
1119 talloc_free(tmp_ctx);
1124 DEBUG(1,("Failed to find domain_sid for open ldb\n"));
1125 talloc_free(tmp_ctx);
1129 bool samdb_set_domain_sid(struct ldb_context *ldb, const struct dom_sid *dom_sid_in)
1131 TALLOC_CTX *tmp_ctx;
1132 struct dom_sid *dom_sid_new;
1133 struct dom_sid *dom_sid_old;
1135 /* see if we have a cached copy */
1136 dom_sid_old = talloc_get_type(ldb_get_opaque(ldb,
1137 "cache.domain_sid"), struct dom_sid);
1139 tmp_ctx = talloc_new(ldb);
1140 if (tmp_ctx == NULL) {
1144 dom_sid_new = dom_sid_dup(tmp_ctx, dom_sid_in);
1149 /* cache the domain_sid in the ldb */
1150 if (ldb_set_opaque(ldb, "cache.domain_sid", dom_sid_new) != LDB_SUCCESS) {
1154 talloc_steal(ldb, dom_sid_new);
1155 talloc_free(tmp_ctx);
1156 talloc_free(dom_sid_old);
1161 DEBUG(1,("Failed to set our own cached domain SID in the ldb!\n"));
1162 talloc_free(tmp_ctx);
1166 /* Obtain the short name of the flexible single master operator
1167 * (FSMO), such as the PDC Emulator */
1168 const char *samdb_result_fsmo_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
1171 /* Format is cn=NTDS Settings,cn=<NETBIOS name of FSMO>,.... */
1172 struct ldb_dn *fsmo_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, msg, attr);
1173 const struct ldb_val *val = ldb_dn_get_component_val(fsmo_dn, 1);
1174 const char *name = ldb_dn_get_component_name(fsmo_dn, 1);
1176 if (!name || (ldb_attr_cmp(name, "cn") != 0)) {
1177 /* Ensure this matches the format. This gives us a
1178 * bit more confidence that a 'cn' value will be a
1183 return (char *)val->data;
1189 work out the ntds settings dn for the current open ldb
1191 struct ldb_dn *samdb_ntds_settings_dn(struct ldb_context *ldb)
1193 TALLOC_CTX *tmp_ctx;
1194 const char *root_attrs[] = { "dsServiceName", NULL };
1196 struct ldb_result *root_res;
1197 struct ldb_dn *settings_dn;
1199 /* see if we have a cached copy */
1200 settings_dn = (struct ldb_dn *)ldb_get_opaque(ldb, "cache.settings_dn");
1205 tmp_ctx = talloc_new(ldb);
1206 if (tmp_ctx == NULL) {
1210 ret = ldb_search(ldb, tmp_ctx, &root_res, ldb_dn_new(tmp_ctx, ldb, ""), LDB_SCOPE_BASE, root_attrs, NULL);
1212 DEBUG(1,("Searching for dsServiceName in rootDSE failed: %s\n",
1213 ldb_errstring(ldb)));
1217 if (root_res->count != 1) {
1221 settings_dn = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, root_res->msgs[0], "dsServiceName");
1223 /* cache the domain_sid in the ldb */
1224 if (ldb_set_opaque(ldb, "cache.settings_dn", settings_dn) != LDB_SUCCESS) {
1228 talloc_steal(ldb, settings_dn);
1229 talloc_free(tmp_ctx);
1234 DEBUG(1,("Failed to find our own NTDS Settings DN in the ldb!\n"));
1235 talloc_free(tmp_ctx);
1240 work out the ntds settings invocationId for the current open ldb
1242 const struct GUID *samdb_ntds_invocation_id(struct ldb_context *ldb)
1244 TALLOC_CTX *tmp_ctx;
1245 const char *attrs[] = { "invocationId", NULL };
1247 struct ldb_result *res;
1248 struct GUID *invocation_id;
1250 /* see if we have a cached copy */
1251 invocation_id = (struct GUID *)ldb_get_opaque(ldb, "cache.invocation_id");
1252 if (invocation_id) {
1253 return invocation_id;
1256 tmp_ctx = talloc_new(ldb);
1257 if (tmp_ctx == NULL) {
1261 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1266 if (res->count != 1) {
1270 invocation_id = talloc(tmp_ctx, struct GUID);
1271 if (!invocation_id) {
1275 *invocation_id = samdb_result_guid(res->msgs[0], "invocationId");
1277 /* cache the domain_sid in the ldb */
1278 if (ldb_set_opaque(ldb, "cache.invocation_id", invocation_id) != LDB_SUCCESS) {
1282 talloc_steal(ldb, invocation_id);
1283 talloc_free(tmp_ctx);
1285 return invocation_id;
1288 DEBUG(1,("Failed to find our own NTDS Settings invocationId in the ldb!\n"));
1289 talloc_free(tmp_ctx);
1293 bool samdb_set_ntds_invocation_id(struct ldb_context *ldb, const struct GUID *invocation_id_in)
1295 TALLOC_CTX *tmp_ctx;
1296 struct GUID *invocation_id_new;
1297 struct GUID *invocation_id_old;
1299 /* see if we have a cached copy */
1300 invocation_id_old = (struct GUID *)ldb_get_opaque(ldb,
1301 "cache.invocation_id");
1303 tmp_ctx = talloc_new(ldb);
1304 if (tmp_ctx == NULL) {
1308 invocation_id_new = talloc(tmp_ctx, struct GUID);
1309 if (!invocation_id_new) {
1313 *invocation_id_new = *invocation_id_in;
1315 /* cache the domain_sid in the ldb */
1316 if (ldb_set_opaque(ldb, "cache.invocation_id", invocation_id_new) != LDB_SUCCESS) {
1320 talloc_steal(ldb, invocation_id_new);
1321 talloc_free(tmp_ctx);
1322 talloc_free(invocation_id_old);
1327 DEBUG(1,("Failed to set our own cached invocationId in the ldb!\n"));
1328 talloc_free(tmp_ctx);
1333 work out the ntds settings objectGUID for the current open ldb
1335 const struct GUID *samdb_ntds_objectGUID(struct ldb_context *ldb)
1337 TALLOC_CTX *tmp_ctx;
1338 const char *attrs[] = { "objectGUID", NULL };
1340 struct ldb_result *res;
1341 struct GUID *ntds_guid;
1343 /* see if we have a cached copy */
1344 ntds_guid = (struct GUID *)ldb_get_opaque(ldb, "cache.ntds_guid");
1349 tmp_ctx = talloc_new(ldb);
1350 if (tmp_ctx == NULL) {
1354 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1359 if (res->count != 1) {
1363 ntds_guid = talloc(tmp_ctx, struct GUID);
1368 *ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
1370 /* cache the domain_sid in the ldb */
1371 if (ldb_set_opaque(ldb, "cache.ntds_guid", ntds_guid) != LDB_SUCCESS) {
1375 talloc_steal(ldb, ntds_guid);
1376 talloc_free(tmp_ctx);
1381 DEBUG(1,("Failed to find our own NTDS Settings objectGUID in the ldb!\n"));
1382 talloc_free(tmp_ctx);
1386 bool samdb_set_ntds_objectGUID(struct ldb_context *ldb, const struct GUID *ntds_guid_in)
1388 TALLOC_CTX *tmp_ctx;
1389 struct GUID *ntds_guid_new;
1390 struct GUID *ntds_guid_old;
1392 /* see if we have a cached copy */
1393 ntds_guid_old = (struct GUID *)ldb_get_opaque(ldb, "cache.ntds_guid");
1395 tmp_ctx = talloc_new(ldb);
1396 if (tmp_ctx == NULL) {
1400 ntds_guid_new = talloc(tmp_ctx, struct GUID);
1401 if (!ntds_guid_new) {
1405 *ntds_guid_new = *ntds_guid_in;
1407 /* cache the domain_sid in the ldb */
1408 if (ldb_set_opaque(ldb, "cache.ntds_guid", ntds_guid_new) != LDB_SUCCESS) {
1412 talloc_steal(ldb, ntds_guid_new);
1413 talloc_free(tmp_ctx);
1414 talloc_free(ntds_guid_old);
1419 DEBUG(1,("Failed to set our own cached invocationId in the ldb!\n"));
1420 talloc_free(tmp_ctx);
1425 work out the server dn for the current open ldb
1427 struct ldb_dn *samdb_server_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1429 return ldb_dn_get_parent(mem_ctx, samdb_ntds_settings_dn(ldb));
1433 work out the server dn for the current open ldb
1435 struct ldb_dn *samdb_server_site_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1437 struct ldb_dn *server_dn;
1438 struct ldb_dn *server_site_dn;
1440 server_dn = samdb_server_dn(ldb, mem_ctx);
1441 if (!server_dn) return NULL;
1443 server_site_dn = ldb_dn_get_parent(mem_ctx, server_dn);
1445 talloc_free(server_dn);
1446 return server_site_dn;
1449 const char *samdb_server_site_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1451 const struct ldb_val *val = ldb_dn_get_rdn_val(samdb_server_site_dn(ldb, mem_ctx));
1454 return (const char *) val->data;
1460 work out if we are the PDC for the domain of the current open ldb
1462 bool samdb_is_pdc(struct ldb_context *ldb)
1464 const char *dom_attrs[] = { "fSMORoleOwner", NULL };
1466 struct ldb_result *dom_res;
1467 TALLOC_CTX *tmp_ctx;
1471 tmp_ctx = talloc_new(ldb);
1472 if (tmp_ctx == NULL) {
1473 DEBUG(1, ("talloc_new failed in samdb_is_pdc"));
1477 ret = ldb_search(ldb, tmp_ctx, &dom_res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, dom_attrs, NULL);
1479 DEBUG(1,("Searching for fSMORoleOwner in %s failed: %s\n",
1480 ldb_dn_get_linearized(ldb_get_default_basedn(ldb)),
1481 ldb_errstring(ldb)));
1484 if (dom_res->count != 1) {
1488 pdc = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, dom_res->msgs[0], "fSMORoleOwner");
1490 if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), pdc) == 0) {
1496 talloc_free(tmp_ctx);
1501 DEBUG(1,("Failed to find if we are the PDC for this ldb\n"));
1502 talloc_free(tmp_ctx);
1507 work out if we are a Global Catalog server for the domain of the current open ldb
1509 bool samdb_is_gc(struct ldb_context *ldb)
1511 const char *attrs[] = { "options", NULL };
1513 struct ldb_result *res;
1514 TALLOC_CTX *tmp_ctx;
1516 tmp_ctx = talloc_new(ldb);
1517 if (tmp_ctx == NULL) {
1518 DEBUG(1, ("talloc_new failed in samdb_is_pdc"));
1522 /* Query cn=ntds settings,.... */
1523 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1525 talloc_free(tmp_ctx);
1528 if (res->count != 1) {
1529 talloc_free(tmp_ctx);
1533 options = ldb_msg_find_attr_as_int(res->msgs[0], "options", 0);
1534 talloc_free(tmp_ctx);
1536 /* if options attribute has the 0x00000001 flag set, then enable the global catlog */
1537 if (options & 0x000000001) {
1543 /* Find a domain object in the parents of a particular DN. */
1544 int samdb_search_for_parent_domain(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
1545 struct ldb_dn **parent_dn, const char **errstring)
1547 TALLOC_CTX *local_ctx;
1548 struct ldb_dn *sdn = dn;
1549 struct ldb_result *res = NULL;
1551 const char *attrs[] = { NULL };
1553 local_ctx = talloc_new(mem_ctx);
1554 if (local_ctx == NULL) return LDB_ERR_OPERATIONS_ERROR;
1556 while ((sdn = ldb_dn_get_parent(local_ctx, sdn))) {
1557 ret = ldb_search(ldb, local_ctx, &res, sdn, LDB_SCOPE_BASE, attrs,
1558 "(|(objectClass=domain)(objectClass=builtinDomain))");
1559 if (ret == LDB_SUCCESS) {
1560 if (res->count == 1) {
1568 if (ret != LDB_SUCCESS) {
1569 *errstring = talloc_asprintf(mem_ctx, "Error searching for parent domain of %s, failed searching for %s: %s",
1570 ldb_dn_get_linearized(dn),
1571 ldb_dn_get_linearized(sdn),
1572 ldb_errstring(ldb));
1573 talloc_free(local_ctx);
1576 if (res->count != 1) {
1577 *errstring = talloc_asprintf(mem_ctx, "Invalid dn (%s), not child of a domain object",
1578 ldb_dn_get_linearized(dn));
1579 DEBUG(0,(__location__ ": %s\n", *errstring));
1580 talloc_free(local_ctx);
1581 return LDB_ERR_CONSTRAINT_VIOLATION;
1584 *parent_dn = talloc_steal(mem_ctx, res->msgs[0]->dn);
1585 talloc_free(local_ctx);
1591 * Performs checks on a user password (plaintext UNIX format - attribute
1592 * "password"). The remaining parameters have to be extracted from the domain
1595 * Result codes from "enum samr_ValidationStatus" (consider "samr.idl")
1597 enum samr_ValidationStatus samdb_check_password(const DATA_BLOB *password,
1598 const uint32_t pwdProperties,
1599 const uint32_t minPwdLength)
1601 /* checks if the "minPwdLength" property is satisfied */
1602 if (minPwdLength > password->length)
1603 return SAMR_VALIDATION_STATUS_PWD_TOO_SHORT;
1605 /* checks the password complexity */
1606 if (((pwdProperties & DOMAIN_PASSWORD_COMPLEX) != 0)
1607 && (password->data != NULL)
1608 && (!check_password_quality((const char *) password->data)))
1609 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH;
1611 return SAMR_VALIDATION_STATUS_SUCCESS;
1615 * Sets the user password using plaintext UTF16 (attribute "new_password") or
1616 * LM (attribute "lmNewHash") or NT (attribute "ntNewHash") hash. Also pass
1617 * as parameter if it's a user change or not ("userChange"). The "rejectReason"
1618 * gives some more informations if the changed failed.
1620 * The caller should have a LDB transaction wrapping this.
1622 * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION,
1623 * NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
1624 * NT_STATUS_PASSWORD_RESTRICTION
1626 NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
1627 struct ldb_dn *user_dn, struct ldb_dn *domain_dn,
1628 struct ldb_message *mod,
1629 const DATA_BLOB *new_password,
1630 struct samr_Password *param_lmNewHash,
1631 struct samr_Password *param_ntNewHash,
1633 enum samPwdChangeReason *reject_reason,
1634 struct samr_DomInfo1 **_dominfo)
1636 const char * const user_attrs[] = { "userAccountControl",
1639 "dBCSPwd", "unicodePwd",
1641 "pwdLastSet", NULL };
1642 const char * const domain_attrs[] = { "minPwdLength", "pwdProperties",
1644 "maxPwdAge", "minPwdAge", NULL };
1646 uint32_t minPwdLength, pwdProperties, pwdHistoryLength;
1647 int64_t maxPwdAge, minPwdAge;
1648 uint32_t userAccountControl;
1649 struct samr_Password *sambaLMPwdHistory, *sambaNTPwdHistory,
1650 *lmPwdHash, *ntPwdHash, *lmNewHash, *ntNewHash;
1651 struct samr_Password local_lmNewHash, local_ntNewHash;
1652 int sambaLMPwdHistory_len, sambaNTPwdHistory_len;
1653 struct dom_sid *domain_sid;
1654 struct ldb_message **res;
1657 time_t now = time(NULL);
1661 /* we need to know the time to compute password age */
1662 unix_to_nt_time(&now_nt, now);
1664 /* pull all the user parameters */
1665 count = gendb_search_dn(ctx, mem_ctx, user_dn, &res, user_attrs);
1667 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1669 userAccountControl = samdb_result_uint(res[0], "userAccountControl", 0);
1670 sambaLMPwdHistory_len = samdb_result_hashes(mem_ctx, res[0],
1671 "lmPwdHistory", &sambaLMPwdHistory);
1672 sambaNTPwdHistory_len = samdb_result_hashes(mem_ctx, res[0],
1673 "ntPwdHistory", &sambaNTPwdHistory);
1674 lmPwdHash = samdb_result_hash(mem_ctx, res[0], "dBCSPwd");
1675 ntPwdHash = samdb_result_hash(mem_ctx, res[0], "unicodePwd");
1676 pwdLastSet = samdb_result_uint64(res[0], "pwdLastSet", 0);
1678 /* Copy parameters */
1679 lmNewHash = param_lmNewHash;
1680 ntNewHash = param_ntNewHash;
1682 /* Only non-trust accounts have restrictions (possibly this
1683 * test is the wrong way around, but I like to be restrictive
1685 restrictions = !(userAccountControl & (UF_INTERDOMAIN_TRUST_ACCOUNT
1686 |UF_WORKSTATION_TRUST_ACCOUNT
1687 |UF_SERVER_TRUST_ACCOUNT));
1689 if (domain_dn != NULL) {
1690 /* pull the domain parameters */
1691 count = gendb_search_dn(ctx, mem_ctx, domain_dn, &res,
1694 DEBUG(2, ("samdb_set_password: Domain DN %s is invalid, for user %s\n",
1695 ldb_dn_get_linearized(domain_dn),
1696 ldb_dn_get_linearized(user_dn)));
1697 return NT_STATUS_NO_SUCH_DOMAIN;
1700 /* work out the domain sid, and pull the domain from there */
1701 domain_sid = samdb_result_sid_prefix(mem_ctx, res[0],
1703 if (domain_sid == NULL) {
1704 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1707 count = gendb_search(ctx, mem_ctx, NULL, &res, domain_attrs,
1709 ldap_encode_ndr_dom_sid(mem_ctx, domain_sid));
1711 DEBUG(2, ("samdb_set_password: Could not find domain to match SID: %s, for user %s\n",
1712 dom_sid_string(mem_ctx, domain_sid),
1713 ldb_dn_get_linearized(user_dn)));
1714 return NT_STATUS_NO_SUCH_DOMAIN;
1718 minPwdLength = samdb_result_uint(res[0], "minPwdLength", 0);
1719 pwdProperties = samdb_result_uint(res[0], "pwdProperties", 0);
1720 pwdHistoryLength = samdb_result_uint(res[0], "pwdHistoryLength", 0);
1721 maxPwdAge = samdb_result_int64(res[0], "maxPwdAge", 0);
1722 minPwdAge = samdb_result_int64(res[0], "minPwdAge", 0);
1724 if ((userAccountControl & UF_PASSWD_NOTREQD) != 0) {
1725 /* see [MS-ADTS] 2.2.15 */
1729 if (_dominfo != NULL) {
1730 struct samr_DomInfo1 *dominfo;
1731 /* on failure we need to fill in the reject reasons */
1732 dominfo = talloc(mem_ctx, struct samr_DomInfo1);
1733 if (dominfo == NULL) {
1734 return NT_STATUS_NO_MEMORY;
1736 dominfo->min_password_length = minPwdLength;
1737 dominfo->password_properties = pwdProperties;
1738 dominfo->password_history_length = pwdHistoryLength;
1739 dominfo->max_password_age = maxPwdAge;
1740 dominfo->min_password_age = minPwdAge;
1741 *_dominfo = dominfo;
1744 if ((restrictions != 0) && (new_password != 0)) {
1747 /* checks if the "minPwdLength" property is satisfied */
1748 if ((restrictions != 0)
1749 && (minPwdLength > utf16_len_n(
1750 new_password->data, new_password->length)/2)) {
1751 if (reject_reason) {
1752 *reject_reason = SAM_PWD_CHANGE_PASSWORD_TOO_SHORT;
1754 return NT_STATUS_PASSWORD_RESTRICTION;
1757 /* Create the NT hash */
1758 mdfour(local_ntNewHash.hash, new_password->data,
1759 new_password->length);
1761 ntNewHash = &local_ntNewHash;
1763 /* Only check complexity if we can convert it at all. Assuming unconvertable passwords are 'strong' */
1764 if (convert_string_talloc_convenience(mem_ctx,
1765 lp_iconv_convenience(ldb_get_opaque(ctx, "loadparm")),
1767 new_password->data, new_password->length,
1768 (void **)&new_pass, NULL, false)) {
1770 /* checks the password complexity */
1771 if ((restrictions != 0)
1773 & DOMAIN_PASSWORD_COMPLEX) != 0)
1774 && (!check_password_quality(new_pass))) {
1775 if (reject_reason) {
1776 *reject_reason = SAM_PWD_CHANGE_NOT_COMPLEX;
1778 return NT_STATUS_PASSWORD_RESTRICTION;
1781 /* compute the new lm hashes (for checking history - case insenitivly!) */
1782 if (E_deshash(new_pass, local_lmNewHash.hash)) {
1783 lmNewHash = &local_lmNewHash;
1788 if ((restrictions != 0) && user_change) {
1789 /* are all password changes disallowed? */
1790 if ((pwdProperties & DOMAIN_REFUSE_PASSWORD_CHANGE) != 0) {
1791 if (reject_reason) {
1792 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
1794 return NT_STATUS_PASSWORD_RESTRICTION;
1797 /* can this user change the password? */
1798 if ((userAccountControl & UF_PASSWD_CANT_CHANGE) != 0) {
1799 if (reject_reason) {
1800 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
1802 return NT_STATUS_PASSWORD_RESTRICTION;
1805 /* Password minimum age: yes, this is a minus. The ages are in negative 100nsec units! */
1806 if (pwdLastSet - minPwdAge > now_nt) {
1807 if (reject_reason) {
1808 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
1810 return NT_STATUS_PASSWORD_RESTRICTION;
1813 /* check the immediately past password */
1814 if (pwdHistoryLength > 0) {
1815 if (lmNewHash && lmPwdHash && memcmp(lmNewHash->hash,
1816 lmPwdHash->hash, 16) == 0) {
1817 if (reject_reason) {
1818 *reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1820 return NT_STATUS_PASSWORD_RESTRICTION;
1822 if (ntNewHash && ntPwdHash && memcmp(ntNewHash->hash,
1823 ntPwdHash->hash, 16) == 0) {
1824 if (reject_reason) {
1825 *reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1827 return NT_STATUS_PASSWORD_RESTRICTION;
1831 /* check the password history */
1832 sambaLMPwdHistory_len = MIN(sambaLMPwdHistory_len,
1834 sambaNTPwdHistory_len = MIN(sambaNTPwdHistory_len,
1837 for (i=0; lmNewHash && i<sambaLMPwdHistory_len;i++) {
1838 if (memcmp(lmNewHash->hash, sambaLMPwdHistory[i].hash,
1840 if (reject_reason) {
1841 *reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1843 return NT_STATUS_PASSWORD_RESTRICTION;
1846 for (i=0; ntNewHash && i<sambaNTPwdHistory_len;i++) {
1847 if (memcmp(ntNewHash->hash, sambaNTPwdHistory[i].hash,
1849 if (reject_reason) {
1850 *reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1852 return NT_STATUS_PASSWORD_RESTRICTION;
1857 #define CHECK_RET(x) do { if (x != 0) return NT_STATUS_NO_MEMORY; } while(0)
1859 /* the password is acceptable. Start forming the new fields */
1860 if (new_password != NULL) {
1861 /* if we know the cleartext UTF16 password, then set it.
1862 * Modules in ldb will set all the appropriate
1864 CHECK_RET(ldb_msg_add_value(mod, "clearTextPassword", new_password, NULL));
1866 /* we don't have the cleartext, so set what we have of the
1870 CHECK_RET(samdb_msg_add_hash(ctx, mem_ctx, mod, "dBCSPwd", lmNewHash));
1874 CHECK_RET(samdb_msg_add_hash(ctx, mem_ctx, mod, "unicodePwd", ntNewHash));
1878 if (reject_reason) {
1879 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
1881 return NT_STATUS_OK;
1886 * Sets the user password using plaintext UTF16 (attribute "new_password") or
1887 * LM (attribute "lmNewHash") or NT (attribute "ntNewHash") hash. Also pass
1888 * as parameter if it's a user change or not ("userChange"). The "rejectReason"
1889 * gives some more informations if the changed failed.
1891 * This wrapper function for "samdb_set_password" takes a SID as input rather
1894 * This call encapsulates a new LDB transaction for changing the password;
1895 * therefore the user hasn't to start a new one.
1897 * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION,
1898 * NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
1899 * NT_STATUS_PASSWORD_RESTRICTION
1901 NTSTATUS samdb_set_password_sid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
1902 const struct dom_sid *user_sid,
1903 const DATA_BLOB *new_password,
1904 struct samr_Password *lmNewHash,
1905 struct samr_Password *ntNewHash,
1907 enum samPwdChangeReason *reject_reason,
1908 struct samr_DomInfo1 **_dominfo)
1911 struct ldb_dn *user_dn;
1912 struct ldb_message *msg;
1915 ret = ldb_transaction_start(ldb);
1916 if (ret != LDB_SUCCESS) {
1917 DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(ldb)));
1918 return NT_STATUS_TRANSACTION_ABORTED;
1921 user_dn = samdb_search_dn(ldb, mem_ctx, NULL,
1922 "(&(objectSid=%s)(objectClass=user))",
1923 ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
1925 ldb_transaction_cancel(ldb);
1926 DEBUG(3, ("samdb_set_password_sid: SID %s not found in samdb, returning NO_SUCH_USER\n",
1927 dom_sid_string(mem_ctx, user_sid)));
1928 return NT_STATUS_NO_SUCH_USER;
1931 msg = ldb_msg_new(mem_ctx);
1933 ldb_transaction_cancel(ldb);
1934 talloc_free(user_dn);
1935 return NT_STATUS_NO_MEMORY;
1938 msg->dn = ldb_dn_copy(msg, user_dn);
1940 ldb_transaction_cancel(ldb);
1941 talloc_free(user_dn);
1943 return NT_STATUS_NO_MEMORY;
1946 nt_status = samdb_set_password(ldb, mem_ctx,
1949 lmNewHash, ntNewHash,
1951 reject_reason, _dominfo);
1952 if (!NT_STATUS_IS_OK(nt_status)) {
1953 ldb_transaction_cancel(ldb);
1954 talloc_free(user_dn);
1959 /* modify the samdb record */
1960 ret = samdb_replace(ldb, mem_ctx, msg);
1961 if (ret != LDB_SUCCESS) {
1962 ldb_transaction_cancel(ldb);
1963 talloc_free(user_dn);
1965 return NT_STATUS_ACCESS_DENIED;
1970 ret = ldb_transaction_commit(ldb);
1971 if (ret != LDB_SUCCESS) {
1972 DEBUG(0,("Failed to commit transaction to change password on %s: %s\n",
1973 ldb_dn_get_linearized(user_dn),
1974 ldb_errstring(ldb)));
1975 talloc_free(user_dn);
1976 return NT_STATUS_TRANSACTION_ABORTED;
1979 talloc_free(user_dn);
1980 return NT_STATUS_OK;
1984 NTSTATUS samdb_create_foreign_security_principal(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
1985 struct dom_sid *sid, struct ldb_dn **ret_dn)
1987 struct ldb_message *msg;
1988 struct ldb_dn *basedn;
1992 sidstr = dom_sid_string(mem_ctx, sid);
1993 NT_STATUS_HAVE_NO_MEMORY(sidstr);
1995 /* We might have to create a ForeignSecurityPrincipal, even if this user
1996 * is in our own domain */
1998 msg = ldb_msg_new(mem_ctx);
2000 return NT_STATUS_NO_MEMORY;
2003 /* TODO: Hmmm. This feels wrong. How do I find the base dn to
2004 * put the ForeignSecurityPrincipals? d_state->domain_dn does
2005 * not work, this is wrong for the Builtin domain, there's no
2006 * cn=For...,cn=Builtin,dc={BASEDN}. -- vl
2009 basedn = samdb_search_dn(sam_ctx, mem_ctx, NULL,
2010 "(&(objectClass=container)(cn=ForeignSecurityPrincipals))");
2012 if (basedn == NULL) {
2013 DEBUG(0, ("Failed to find DN for "
2014 "ForeignSecurityPrincipal container\n"));
2015 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2018 /* add core elements to the ldb_message for the alias */
2019 msg->dn = ldb_dn_copy(mem_ctx, basedn);
2020 if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s", sidstr))
2021 return NT_STATUS_NO_MEMORY;
2023 samdb_msg_add_string(sam_ctx, mem_ctx, msg,
2025 "foreignSecurityPrincipal");
2027 /* create the alias */
2028 ret = ldb_add(sam_ctx, msg);
2030 DEBUG(0,("Failed to create foreignSecurityPrincipal "
2032 ldb_dn_get_linearized(msg->dn),
2033 ldb_errstring(sam_ctx)));
2034 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2037 return NT_STATUS_OK;
2042 Find the DN of a domain, assuming it to be a dotted.dns name
2045 struct ldb_dn *samdb_dns_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char *dns_domain)
2048 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
2049 const char *binary_encoded;
2050 const char **split_realm;
2057 split_realm = (const char **)str_list_make(tmp_ctx, dns_domain, ".");
2059 talloc_free(tmp_ctx);
2062 dn = ldb_dn_new(mem_ctx, ldb, NULL);
2063 for (i=0; split_realm[i]; i++) {
2064 binary_encoded = ldb_binary_encode_string(tmp_ctx, split_realm[i]);
2065 if (!ldb_dn_add_base_fmt(dn, "dc=%s", binary_encoded)) {
2066 DEBUG(2, ("Failed to add dc=%s element to DN %s\n",
2067 binary_encoded, ldb_dn_get_linearized(dn)));
2068 talloc_free(tmp_ctx);
2072 if (!ldb_dn_validate(dn)) {
2073 DEBUG(2, ("Failed to validated DN %s\n",
2074 ldb_dn_get_linearized(dn)));
2080 Find the DN of a domain, be it the netbios or DNS name
2083 struct ldb_dn *samdb_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
2084 const char *domain_name)
2086 const char * const domain_ref_attrs[] = {
2089 const char * const domain_ref2_attrs[] = {
2092 struct ldb_result *res_domain_ref;
2093 char *escaped_domain = ldb_binary_encode_string(mem_ctx, domain_name);
2094 /* find the domain's DN */
2095 int ret_domain = ldb_search(ldb, mem_ctx,
2097 samdb_partitions_dn(ldb, mem_ctx),
2100 "(&(nETBIOSName=%s)(objectclass=crossRef))",
2102 if (ret_domain != 0) {
2106 if (res_domain_ref->count == 0) {
2107 ret_domain = ldb_search(ldb, mem_ctx,
2109 samdb_dns_domain_to_dn(ldb, mem_ctx, domain_name),
2112 "(objectclass=domain)");
2113 if (ret_domain != 0) {
2117 if (res_domain_ref->count == 1) {
2118 return res_domain_ref->msgs[0]->dn;
2123 if (res_domain_ref->count > 1) {
2124 DEBUG(0,("Found %d records matching domain [%s]\n",
2125 ret_domain, domain_name));
2129 return samdb_result_dn(ldb, mem_ctx, res_domain_ref->msgs[0], "nCName", NULL);
2135 use a GUID to find a DN
2137 int dsdb_find_dn_by_guid(struct ldb_context *ldb,
2138 TALLOC_CTX *mem_ctx,
2139 const char *guid_str, struct ldb_dn **dn)
2142 struct ldb_result *res;
2143 const char *attrs[] = { NULL };
2144 struct ldb_request *search_req;
2146 struct ldb_search_options_control *options;
2148 expression = talloc_asprintf(mem_ctx, "objectGUID=%s", guid_str);
2150 DEBUG(0, (__location__ ": out of memory\n"));
2151 return LDB_ERR_OPERATIONS_ERROR;
2154 res = talloc_zero(mem_ctx, struct ldb_result);
2156 DEBUG(0, (__location__ ": out of memory\n"));
2157 return LDB_ERR_OPERATIONS_ERROR;
2160 ret = ldb_build_search_req(&search_req, ldb, mem_ctx,
2161 ldb_get_default_basedn(ldb),
2165 res, ldb_search_default_callback,
2167 if (ret != LDB_SUCCESS) {
2171 /* we need to cope with cross-partition links, so search for
2172 the GUID over all partitions */
2173 options = talloc(search_req, struct ldb_search_options_control);
2174 if (options == NULL) {
2175 DEBUG(0, (__location__ ": out of memory\n"));
2176 return LDB_ERR_OPERATIONS_ERROR;
2178 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
2180 ret = ldb_request_add_control(search_req, LDB_CONTROL_EXTENDED_DN_OID, true, NULL);
2181 if (ret != LDB_SUCCESS) {
2185 ret = ldb_request_add_control(search_req,
2186 LDB_CONTROL_SEARCH_OPTIONS_OID,
2188 if (ret != LDB_SUCCESS) {
2192 ret = ldb_request(ldb, search_req);
2193 if (ret != LDB_SUCCESS) {
2197 ret = ldb_wait(search_req->handle, LDB_WAIT_ALL);
2198 if (ret != LDB_SUCCESS) {
2202 /* this really should be exactly 1, but there is a bug in the
2203 partitions module that can return two here with the
2204 search_options control set */
2205 if (res->count < 1) {
2206 return LDB_ERR_NO_SUCH_OBJECT;
2209 *dn = res->msgs[0]->dn;
2215 search for attrs on one DN, allowing for deleted objects
2217 int dsdb_search_dn_with_deleted(struct ldb_context *ldb,
2218 TALLOC_CTX *mem_ctx,
2219 struct ldb_result **_res,
2220 struct ldb_dn *basedn,
2221 const char * const *attrs)
2224 struct ldb_request *req;
2225 TALLOC_CTX *tmp_ctx;
2226 struct ldb_result *res;
2228 tmp_ctx = talloc_new(mem_ctx);
2230 res = talloc_zero(tmp_ctx, struct ldb_result);
2232 return LDB_ERR_OPERATIONS_ERROR;
2235 ret = ldb_build_search_req(&req, ldb, tmp_ctx,
2242 ldb_search_default_callback,
2244 if (ret != LDB_SUCCESS) {
2245 talloc_free(tmp_ctx);
2249 ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_DELETED_OID, true, NULL);
2250 if (ret != LDB_SUCCESS) {
2254 ret = ldb_request(ldb, req);
2255 if (ret == LDB_SUCCESS) {
2256 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
2260 *_res = talloc_steal(mem_ctx, res);
2266 use a DN to find a GUID
2268 int dsdb_find_guid_by_dn(struct ldb_context *ldb,
2269 struct ldb_dn *dn, struct GUID *guid)
2272 struct ldb_result *res;
2273 const char *attrs[] = { "objectGUID", NULL };
2274 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
2276 ret = dsdb_search_dn_with_deleted(ldb, tmp_ctx, &res, dn, attrs);
2277 if (ret != LDB_SUCCESS) {
2278 talloc_free(tmp_ctx);
2281 if (res->count < 1) {
2282 talloc_free(tmp_ctx);
2283 return LDB_ERR_NO_SUCH_OBJECT;
2285 *guid = samdb_result_guid(res->msgs[0], "objectGUID");
2286 talloc_free(tmp_ctx);
2293 adds the given GUID to the given ldb_message. This value is added
2294 for the given attr_name (may be either "objectGUID" or "parentGUID").
2296 int dsdb_msg_add_guid(struct ldb_message *msg,
2298 const char *attr_name)
2303 TALLOC_CTX *tmp_ctx = talloc_init("dsdb_msg_add_guid");
2305 status = GUID_to_ndr_blob(guid, tmp_ctx, &v);
2306 if (!NT_STATUS_IS_OK(status)) {
2307 ret = LDB_ERR_OPERATIONS_ERROR;
2311 ret = ldb_msg_add_steal_value(msg, attr_name, &v);
2312 if (ret != LDB_SUCCESS) {
2313 DEBUG(4,(__location__ ": Failed to add %s to the message\n",
2321 talloc_free(tmp_ctx);
2328 use a DN to find a SID
2330 int dsdb_find_sid_by_dn(struct ldb_context *ldb,
2331 struct ldb_dn *dn, struct dom_sid *sid)
2334 struct ldb_result *res;
2335 const char *attrs[] = { "objectSID", NULL };
2336 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
2341 ret = dsdb_search_dn_with_deleted(ldb, tmp_ctx, &res, dn, attrs);
2342 if (ret != LDB_SUCCESS) {
2343 talloc_free(tmp_ctx);
2346 if (res->count < 1) {
2347 talloc_free(tmp_ctx);
2348 return LDB_ERR_NO_SUCH_OBJECT;
2350 s = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSID");
2352 talloc_free(tmp_ctx);
2353 return LDB_ERR_NO_SUCH_OBJECT;
2356 talloc_free(tmp_ctx);
2363 load a repsFromTo blob list for a given partition GUID
2364 attr must be "repsFrom" or "repsTo"
2366 WERROR dsdb_loadreps(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
2367 const char *attr, struct repsFromToBlob **r, uint32_t *count)
2369 const char *attrs[] = { attr, NULL };
2370 struct ldb_result *res = NULL;
2371 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
2373 struct ldb_message_element *el;
2378 if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
2380 DEBUG(0,("dsdb_loadreps: failed to read partition object\n"));
2381 talloc_free(tmp_ctx);
2382 return WERR_DS_DRA_INTERNAL_ERROR;
2385 el = ldb_msg_find_element(res->msgs[0], attr);
2387 /* it's OK to be empty */
2388 talloc_free(tmp_ctx);
2392 *count = el->num_values;
2393 *r = talloc_array(mem_ctx, struct repsFromToBlob, *count);
2395 talloc_free(tmp_ctx);
2396 return WERR_DS_DRA_INTERNAL_ERROR;
2399 for (i=0; i<(*count); i++) {
2400 enum ndr_err_code ndr_err;
2401 ndr_err = ndr_pull_struct_blob(&el->values[i],
2402 mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
2404 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
2405 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2406 talloc_free(tmp_ctx);
2407 return WERR_DS_DRA_INTERNAL_ERROR;
2411 talloc_free(tmp_ctx);
2417 save the repsFromTo blob list for a given partition GUID
2418 attr must be "repsFrom" or "repsTo"
2420 WERROR dsdb_savereps(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
2421 const char *attr, struct repsFromToBlob *r, uint32_t count)
2423 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
2424 struct ldb_message *msg;
2425 struct ldb_message_element *el;
2428 msg = ldb_msg_new(tmp_ctx);
2430 if (ldb_msg_add_empty(msg, attr, LDB_FLAG_MOD_REPLACE, &el) != LDB_SUCCESS) {
2434 el->values = talloc_array(msg, struct ldb_val, count);
2439 for (i=0; i<count; i++) {
2441 enum ndr_err_code ndr_err;
2443 ndr_err = ndr_push_struct_blob(&v, tmp_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
2445 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
2446 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2454 if (ldb_modify(sam_ctx, msg) != LDB_SUCCESS) {
2455 DEBUG(0,("Failed to store %s - %s\n", attr, ldb_errstring(sam_ctx)));
2459 talloc_free(tmp_ctx);
2464 talloc_free(tmp_ctx);
2465 return WERR_DS_DRA_INTERNAL_ERROR;
2470 load the uSNHighest attribute from the @REPLCHANGED object for a
2473 int dsdb_load_partition_usn(struct ldb_context *ldb, struct ldb_dn *dn, uint64_t *uSN)
2475 struct ldb_request *req;
2477 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
2478 struct dsdb_control_current_partition *p_ctrl;
2479 struct ldb_result *res;
2481 res = talloc_zero(tmp_ctx, struct ldb_result);
2483 talloc_free(tmp_ctx);
2484 return LDB_ERR_OPERATIONS_ERROR;
2487 ret = ldb_build_search_req(&req, ldb, tmp_ctx,
2488 ldb_dn_new(tmp_ctx, ldb, "@REPLCHANGED"),
2492 res, ldb_search_default_callback,
2494 if (ret != LDB_SUCCESS) {
2495 talloc_free(tmp_ctx);
2499 p_ctrl = talloc(req, struct dsdb_control_current_partition);
2500 if (p_ctrl == NULL) {
2502 return LDB_ERR_OPERATIONS_ERROR;
2504 p_ctrl->version = DSDB_CONTROL_CURRENT_PARTITION_VERSION;
2508 ret = ldb_request_add_control(req,
2509 DSDB_CONTROL_CURRENT_PARTITION_OID,
2511 if (ret != LDB_SUCCESS) {
2512 talloc_free(tmp_ctx);
2516 /* Run the new request */
2517 ret = ldb_request(ldb, req);
2519 if (ret == LDB_SUCCESS) {
2520 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
2523 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2524 /* it hasn't been created yet, which means
2525 an implicit value of zero */
2527 talloc_free(tmp_ctx);
2531 if (ret != LDB_SUCCESS) {
2532 talloc_free(tmp_ctx);
2536 if (res->count < 1) {
2539 *uSN = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNHighest", 0);
2542 talloc_free(tmp_ctx);
2548 save the uSNHighest attribute in the @REPLCHANGED object for a
2551 int dsdb_save_partition_usn(struct ldb_context *ldb, struct ldb_dn *dn, uint64_t uSN)
2553 struct ldb_request *req;
2554 struct ldb_message *msg;
2555 struct dsdb_control_current_partition *p_ctrl;
2558 msg = ldb_msg_new(ldb);
2560 return LDB_ERR_OPERATIONS_ERROR;
2563 msg->dn = ldb_dn_new(msg, ldb, "@REPLCHANGED");
2564 if (msg->dn == NULL) {
2566 return LDB_ERR_OPERATIONS_ERROR;
2569 ret = ldb_msg_add_fmt(msg, "uSNHighest", "%llu", (unsigned long long)uSN);
2570 if (ret != LDB_SUCCESS) {
2574 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
2577 p_ctrl = talloc(msg, struct dsdb_control_current_partition);
2578 if (p_ctrl == NULL) {
2580 return LDB_ERR_OPERATIONS_ERROR;
2582 p_ctrl->version = DSDB_CONTROL_CURRENT_PARTITION_VERSION;
2585 ret = ldb_build_mod_req(&req, ldb, msg,
2588 NULL, ldb_op_default_callback,
2591 if (ret != LDB_SUCCESS) {
2596 ret = ldb_request_add_control(req,
2597 DSDB_CONTROL_CURRENT_PARTITION_OID,
2599 if (ret != LDB_SUCCESS) {
2604 /* Run the new request */
2605 ret = ldb_request(ldb, req);
2607 if (ret == LDB_SUCCESS) {
2608 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
2610 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2611 ret = ldb_build_add_req(&req, ldb, msg,
2614 NULL, ldb_op_default_callback,
2624 int drsuapi_DsReplicaCursor2_compare(const struct drsuapi_DsReplicaCursor2 *c1,
2625 const struct drsuapi_DsReplicaCursor2 *c2)
2627 return GUID_compare(&c1->source_dsa_invocation_id, &c2->source_dsa_invocation_id);
2631 see if we are a RODC
2633 TODO: This should take a sam_ctx, and lookup the right object (with
2636 bool samdb_rodc(struct loadparm_context *lp_ctx)
2638 return lp_parm_bool(lp_ctx, NULL, "repl", "RODC", false);
2643 return NTDS options flags. See MS-ADTS 7.1.1.2.2.1.2.1.1
2645 flags are DS_NTDS_OPTION_*
2647 int samdb_ntds_options(struct ldb_context *ldb, uint32_t *options)
2649 TALLOC_CTX *tmp_ctx;
2650 const char *attrs[] = { "options", NULL };
2652 struct ldb_result *res;
2654 tmp_ctx = talloc_new(ldb);
2655 if (tmp_ctx == NULL) {
2659 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
2664 if (res->count != 1) {
2668 *options = samdb_result_uint(res->msgs[0], "options", 0);
2670 talloc_free(tmp_ctx);
2675 DEBUG(1,("Failed to find our own NTDS Settings objectGUID in the ldb!\n"));
2676 talloc_free(tmp_ctx);
2677 return LDB_ERR_NO_SUCH_OBJECT;
2681 * Function which generates a "lDAPDisplayName" attribute from a "CN" one.
2682 * Algorithm implemented according to MS-ADTS 3.1.1.2.3.4
2684 const char *samdb_cn_to_lDAPDisplayName(TALLOC_CTX *mem_ctx, const char *cn)
2686 char **tokens, *ret;
2689 tokens = str_list_make(mem_ctx, cn, " -_");
2693 /* "tolower()" and "toupper()" should also work properly on 0x00 */
2694 tokens[0][0] = tolower(tokens[0][0]);
2695 for (i = 1; i < str_list_length((const char **)tokens); i++)
2696 tokens[i][0] = toupper(tokens[i][0]);
2698 ret = talloc_strdup(mem_ctx, tokens[0]);
2699 for (i = 1; i < str_list_length((const char **)tokens); i++)
2700 ret = talloc_asprintf_append_buffer(ret, "%s", tokens[i]);
2702 talloc_free(tokens);
2708 return domain functional level
2709 returns DS_DOMAIN_FUNCTION_*
2711 int dsdb_functional_level(struct ldb_context *ldb)
2713 int *domainFunctionality =
2714 talloc_get_type(ldb_get_opaque(ldb, "domainFunctionality"), int);
2715 if (!domainFunctionality) {
2716 DEBUG(0,(__location__ ": WARNING: domainFunctionality not setup\n"));
2717 return DS_DOMAIN_FUNCTION_2000;
2719 return *domainFunctionality;
2723 return a GUID from a extended DN structure
2725 NTSTATUS dsdb_get_extended_dn_guid(struct ldb_dn *dn, struct GUID *guid)
2727 const struct ldb_val *v;
2729 v = ldb_dn_get_extended_component(dn, "GUID");
2731 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2734 return GUID_from_ndr_blob(v, guid);
2738 return a uint64_t from a extended DN structure
2740 NTSTATUS dsdb_get_extended_dn_uint64(struct ldb_dn *dn, uint64_t *val, const char *component_name)
2742 const struct ldb_val *v;
2745 v = ldb_dn_get_extended_component(dn, component_name);
2747 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2749 s = talloc_strndup(dn, (const char *)v->data, v->length);
2750 NT_STATUS_HAVE_NO_MEMORY(s);
2752 *val = strtoull(s, NULL, 0);
2755 return NT_STATUS_OK;
2759 return a NTTIME from a extended DN structure
2761 NTSTATUS dsdb_get_extended_dn_nttime(struct ldb_dn *dn, NTTIME *nttime, const char *component_name)
2763 return dsdb_get_extended_dn_uint64(dn, nttime, component_name);
2767 return a uint32_t from a extended DN structure
2769 NTSTATUS dsdb_get_extended_dn_uint32(struct ldb_dn *dn, uint32_t *val, const char *component_name)
2771 const struct ldb_val *v;
2774 v = ldb_dn_get_extended_component(dn, component_name);
2776 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2779 s = talloc_strndup(dn, (const char *)v->data, v->length);
2780 NT_STATUS_HAVE_NO_MEMORY(s);
2782 *val = strtoul(s, NULL, 0);
2785 return NT_STATUS_OK;
2789 return true if a ldb_val containing a DN in storage form is deleted
2791 bool dsdb_dn_is_deleted_val(struct ldb_val *val)
2793 /* this relies on the sort order and exact format of
2794 linearized extended DNs */
2795 if (val->length >= 12 &&
2796 strncmp((const char *)val->data, "<DELETED=1>;", 12) == 0) {
2803 return a DN for a wellknown GUID
2805 int dsdb_wellknown_dn(struct ldb_context *samdb, TALLOC_CTX *mem_ctx,
2806 struct ldb_dn *nc_root, const char *wk_guid,
2807 struct ldb_dn **wkguid_dn)
2809 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
2810 const char *attrs[] = { NULL };
2813 struct ldb_result *res;
2815 /* construct the magic WKGUID DN */
2816 dn = ldb_dn_new_fmt(tmp_ctx, samdb, "<WKGUID=%s,%s>",
2817 wk_guid, ldb_dn_get_linearized(nc_root));
2819 talloc_free(tmp_ctx);
2820 return LDB_ERR_OPERATIONS_ERROR;
2823 ret = dsdb_search_dn_with_deleted(samdb, tmp_ctx, &res, dn, attrs);
2824 if (ret != LDB_SUCCESS) {
2825 talloc_free(tmp_ctx);
2829 (*wkguid_dn) = talloc_steal(mem_ctx, res->msgs[0]->dn);
2830 talloc_free(tmp_ctx);
2835 static int dsdb_dn_compare_ptrs(struct ldb_dn **dn1, struct ldb_dn **dn2)
2837 return ldb_dn_compare(*dn1, *dn2);
2841 find a NC root given a DN within the NC
2843 int dsdb_find_nc_root(struct ldb_context *samdb, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
2844 struct ldb_dn **nc_root)
2846 const char *root_attrs[] = { "namingContexts", NULL };
2847 TALLOC_CTX *tmp_ctx;
2849 struct ldb_message_element *el;
2850 struct ldb_result *root_res;
2852 struct ldb_dn **nc_dns;
2854 tmp_ctx = talloc_new(samdb);
2855 if (tmp_ctx == NULL) {
2856 return LDB_ERR_OPERATIONS_ERROR;
2859 ret = ldb_search(samdb, tmp_ctx, &root_res,
2860 ldb_dn_new(tmp_ctx, samdb, ""), LDB_SCOPE_BASE, root_attrs, NULL);
2862 DEBUG(1,("Searching for namingContexts in rootDSE failed: %s\n", ldb_errstring(samdb)));
2863 talloc_free(tmp_ctx);
2867 el = ldb_msg_find_element(root_res->msgs[0], "namingContexts");
2869 DEBUG(1,("Finding namingContexts element in root_res failed: %s\n",
2870 ldb_errstring(samdb)));
2871 talloc_free(tmp_ctx);
2872 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2875 nc_dns = talloc_array(tmp_ctx, struct ldb_dn *, el->num_values);
2877 talloc_free(tmp_ctx);
2878 return LDB_ERR_OPERATIONS_ERROR;
2881 for (i=0; i<el->num_values; i++) {
2882 nc_dns[i] = ldb_dn_from_ldb_val(nc_dns, samdb, &el->values[i]);
2883 if (nc_dns[i] == NULL) {
2884 talloc_free(tmp_ctx);
2885 return LDB_ERR_OPERATIONS_ERROR;
2889 qsort(nc_dns, el->num_values, sizeof(nc_dns[0]), (comparison_fn_t)dsdb_dn_compare_ptrs);
2891 for (i=0; i<el->num_values; i++) {
2892 if (ldb_dn_compare_base(nc_dns[i], dn) == 0) {
2893 (*nc_root) = talloc_steal(mem_ctx, nc_dns[i]);
2894 talloc_free(tmp_ctx);
2899 talloc_free(tmp_ctx);
2900 return LDB_ERR_NO_SUCH_OBJECT;
2905 find the deleted objects DN for any object, by looking for the NC
2906 root, then looking up the wellknown GUID
2908 int dsdb_get_deleted_objects_dn(struct ldb_context *ldb,
2909 TALLOC_CTX *mem_ctx, struct ldb_dn *obj_dn,
2910 struct ldb_dn **do_dn)
2912 struct ldb_dn *nc_root;
2915 ret = dsdb_find_nc_root(ldb, mem_ctx, obj_dn, &nc_root);
2916 if (ret != LDB_SUCCESS) {
2920 ret = dsdb_wellknown_dn(ldb, mem_ctx, nc_root, DS_GUID_DELETED_OBJECTS_CONTAINER, do_dn);
2921 talloc_free(nc_root);