2 Unix SMB/CIFS implementation.
4 implement the DsAddEntry call
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Andrew Tridgell 2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "param/param.h"
27 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
28 #include "librpc/gen_ndr/ndr_drsuapi.h"
32 add special SPNs needed for DRS replication to machine accounts when
33 an AddEntry is done to create a nTDSDSA object
35 static WERROR drsuapi_add_SPNs(struct drsuapi_bind_state *b_state,
36 struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
37 const struct drsuapi_DsReplicaObjectListItem *first_object)
40 const struct drsuapi_DsReplicaObjectListItem *obj;
41 const char *attrs[] = { "serverReference", "objectGUID", NULL };
43 for (obj = first_object; obj; obj=obj->next_object) {
44 const char *dn_string = obj->object.identifier->dn;
45 struct ldb_dn *dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, dn_string);
46 struct ldb_result *res, *res2;
47 struct ldb_dn *ref_dn;
48 struct GUID ntds_guid;
49 struct ldb_message *msg;
50 struct ldb_message_element *el;
51 const char *ntds_guid_str;
52 const char *dom_string;
53 const char *attrs2[] = { "dNSHostName", "cn", NULL };
54 const char *dNSHostName, *cn;
56 DEBUG(6,(__location__ ": Adding SPNs for %s\n",
57 ldb_dn_get_linearized(dn)));
59 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res,
60 dn, LDB_SCOPE_BASE, attrs,
61 "(objectClass=ntDSDSA)");
62 if (ret != LDB_SUCCESS || res->count < 1) {
63 DEBUG(0,(__location__ ": Failed to find dn '%s'\n", dn_string));
64 return WERR_DS_DRA_INTERNAL_ERROR;
67 ref_dn = samdb_result_dn(b_state->sam_ctx, mem_ctx, res->msgs[0], "serverReference", NULL);
69 /* we only add SPNs for objects with a
74 DEBUG(6,(__location__ ": serverReference %s\n",
75 ldb_dn_get_linearized(ref_dn)));
77 ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
79 ntds_guid_str = GUID_string(res, &ntds_guid);
81 dom_string = lp_dnsdomain(dce_call->conn->dce_ctx->lp_ctx);
83 /* get the dNSHostName and cn */
84 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res2,
85 ref_dn, LDB_SCOPE_BASE, attrs2, NULL);
86 if (ret != LDB_SUCCESS) {
87 DEBUG(0,(__location__ ": Failed to find ref_dn '%s'\n",
88 ldb_dn_get_linearized(ref_dn)));
89 return WERR_DS_DRA_INTERNAL_ERROR;
92 dNSHostName = ldb_msg_find_attr_as_string(res2->msgs[0], "dNSHostName", NULL);
93 cn = ldb_msg_find_attr_as_string(res2->msgs[0], "cn", NULL);
96 * construct a modify request to add the new SPNs to
99 msg = ldb_msg_new(mem_ctx);
105 ret = ldb_msg_add_empty(msg, "servicePrincipalName",
106 LDB_FLAG_MOD_ADD, &el);
107 if (ret != LDB_SUCCESS) {
112 ldb_msg_add_steal_string(msg, "servicePrincipalName",
113 talloc_asprintf(el->values,
114 "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
115 ntds_guid_str, dom_string));
116 ldb_msg_add_steal_string(msg, "servicePrincipalName",
117 talloc_asprintf(el->values, "ldap/%s._msdcs.%s",
118 ntds_guid_str, dom_string));
120 ldb_msg_add_steal_string(msg, "servicePrincipalName",
121 talloc_asprintf(el->values, "ldap/%s", cn));
124 ldb_msg_add_steal_string(msg, "servicePrincipalName",
125 talloc_asprintf(el->values, "ldap/%s", dNSHostName));
127 if (el->num_values < 2) {
131 ret = ldb_modify(b_state->sam_ctx, msg);
132 if (ret != LDB_SUCCESS) {
133 DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
134 ldb_errstring(b_state->sam_ctx)));
135 return WERR_DS_DRA_INTERNAL_ERROR;
148 WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
149 struct drsuapi_DsAddEntry *r)
152 struct drsuapi_bind_state *b_state;
153 struct dcesrv_handle *h;
155 struct drsuapi_DsReplicaObjectIdentifier2 *ids = NULL;
157 const struct drsuapi_DsReplicaObjectListItem *first_object;
160 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry, NDR_IN, r);
163 /* TODO: check which out level the client supports */
165 ZERO_STRUCTP(r->out.ctr);
166 *r->out.level_out = 3;
167 r->out.ctr->ctr3.level = 1;
168 r->out.ctr->ctr3.error = talloc_zero(mem_ctx, union drsuapi_DsAddEntryError);
170 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
173 status = drs_security_level_check(dce_call, "DsAddEntry");
174 if (!W_ERROR_IS_OK(status)) {
178 switch (r->in.level) {
180 ret = ldb_transaction_start(b_state->sam_ctx);
181 if (ret != LDB_SUCCESS) {
182 return WERR_DS_DRA_INTERNAL_ERROR;
186 first_object = &r->in.req->req2.first_object;
188 status = dsdb_origin_objects_commit(b_state->sam_ctx,
193 if (!W_ERROR_IS_OK(status)) {
194 r->out.ctr->ctr3.error->info1.status = status;
195 ldb_transaction_cancel(b_state->sam_ctx);
196 DEBUG(0,(__location__ ": DsAddEntry failed - %s\n", win_errstr(status)));
200 r->out.ctr->ctr3.count = num;
201 r->out.ctr->ctr3.objects = ids;
208 /* if any of the added entries are nTDSDSA objects then we
209 * need to add the SPNs to the machine account
211 status = drsuapi_add_SPNs(b_state, dce_call, mem_ctx, first_object);
212 if (!W_ERROR_IS_OK(status)) {
213 r->out.ctr->ctr3.error->info1.status = status;
214 ldb_transaction_cancel(b_state->sam_ctx);
215 DEBUG(0,(__location__ ": DsAddEntry add SPNs failed - %s\n", win_errstr(status)));
219 ret = ldb_transaction_commit(b_state->sam_ctx);
220 if (ret != LDB_SUCCESS) {
221 DEBUG(0,(__location__ ": DsAddEntry commit failed: %s\n",
222 ldb_errstring(b_state->sam_ctx)));
223 return WERR_DS_DRA_INTERNAL_ERROR;