4 Copyright (C) Andrew Bartlett 2010
5 Copyright (C) Andrew Tridgell 2010
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 add objectSID to users and groups using samba3 nextRid method
26 #include "libcli/ldap/ldap_ndr.h"
27 #include "ldb_module.h"
28 #include "dsdb/samdb/samdb.h"
29 #include "dsdb/samdb/ldb_modules/util.h"
30 #include "libcli/security/security.h"
31 #include "librpc/gen_ndr/ndr_security.h"
32 #include "../lib/util/util_ldb.h"
34 #include "param/param.h"
37 RID algorithm from pdb_ldap.c in source3/passdb/
38 (loosely based on Volkers code)
40 static int samba3sid_next_sid(struct ldb_module *module,
41 TALLOC_CTX *mem_ctx, char **sid)
43 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
44 struct ldb_result *res;
45 const char *attrs[] = { "sambaNextRid", "sambaNextUserRid",
46 "sambaNextGroupRid", "sambaSID", NULL };
48 struct ldb_context *ldb = ldb_module_get_ctx(module);
49 int sambaNextRid, sambaNextGroupRid, sambaNextUserRid;
50 struct ldb_message *msg;
54 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
55 attrs, DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
56 "(&(objectClass=sambaDomain)(sambaDomainName=%s))",
57 lp_sam_name(ldb_get_opaque(ldb, "loadparm")));
58 if (ret != LDB_SUCCESS) {
59 ldb_asprintf_errstring(ldb,
61 ": Failed to find domain object - %s",
66 if (res->count != 1) {
67 ldb_asprintf_errstring(ldb,
69 ": Expected exactly 1 domain object - got %u",
76 sambaNextRid = ldb_msg_find_attr_as_uint(msg, "sambaNextRid", -1);
77 sambaNextUserRid = ldb_msg_find_attr_as_uint(msg, "sambaNextUserRid", -1);
78 sambaNextGroupRid = ldb_msg_find_attr_as_uint(msg, "sambaNextGroupRid", -1);
79 sambaSID = ldb_msg_find_attr_as_string(msg, "sambaSID", NULL);
81 if (sambaSID == NULL) {
82 ldb_asprintf_errstring(ldb,
84 ": No sambaSID in %s",
85 ldb_dn_get_linearized(msg->dn));
90 /* choose the highest of the 3 - see pdb_ldap.c for an
93 if (sambaNextUserRid > rid) {
94 rid = sambaNextUserRid;
96 if (sambaNextGroupRid > rid) {
97 rid = sambaNextGroupRid;
100 ldb_asprintf_errstring(ldb,
102 ": No sambaNextRid in %s",
103 ldb_dn_get_linearized(msg->dn));
104 talloc_free(tmp_ctx);
108 (*sid) = talloc_asprintf(tmp_ctx, "%s-%u", sambaSID, rid);
110 ldb_module_oom(module);
111 talloc_free(tmp_ctx);
112 return LDB_ERR_OPERATIONS_ERROR;
115 ret = dsdb_module_constrainted_update_integer(module, msg->dn,
117 sambaNextRid, rid+1);
118 if (ret != LDB_SUCCESS) {
119 ldb_asprintf_errstring(ldb,
121 ": Failed to update sambaNextRid - %s",
123 talloc_free(tmp_ctx);
127 talloc_steal(mem_ctx, *sid);
128 talloc_free(tmp_ctx);
135 static int samba3sid_add(struct ldb_module *module, struct ldb_request *req)
137 struct ldb_context *ldb;
139 const struct ldb_message *msg = req->op.add.message;
140 struct ldb_message *new_msg;
142 struct ldb_request *new_req;
144 ldb = ldb_module_get_ctx(module);
146 /* do not manipulate our control entries */
147 if (ldb_dn_is_special(req->op.add.message->dn)) {
148 return ldb_next_request(module, req);
151 if (!samdb_find_attribute(ldb, msg, "objectclass", "posixAccount") &&
152 !samdb_find_attribute(ldb, msg, "objectclass", "posixGroup")) {
153 /* its not a user or a group */
154 return ldb_next_request(module, req);
157 if (ldb_msg_find_element(msg, "sambaSID")) {
158 /* a SID was supplied */
159 return ldb_next_request(module, req);
162 new_msg = ldb_msg_copy_shallow(req, req->op.add.message);
164 ldb_module_oom(module);
165 return LDB_ERR_OPERATIONS_ERROR;
168 ret = samba3sid_next_sid(module, new_msg, &sid);
169 if (ret != LDB_SUCCESS) {
173 ret = ldb_msg_add_steal_string(new_msg, "sambaSID", sid);
174 if (ret != LDB_SUCCESS) {
178 ret = ldb_build_add_req(&new_req, ldb, req,
181 req, dsdb_next_callback,
183 if (ret != LDB_SUCCESS) {
187 return ldb_next_request(module, new_req);
190 _PUBLIC_ const struct ldb_module_ops ldb_samba3sid_module_ops = {
192 .add = samba3sid_add,