#include "param/param.h"
#include "libcli/auth/libcli_auth.h"
#include "librpc/gen_ndr/ndr_drsblobs.h"
+#include "system/locale.h"
/*
search the sam for the specified attributes in a specific domain, filter on
uint_t samdb_result_hashes(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
const char *attr, struct samr_Password **hashes)
{
- uint_t count = 0;
+ uint_t count, i;
const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
- int i;
*hashes = NULL;
if (!val) {
return server_site_dn;
}
+const char *samdb_server_site_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
+{
+ const struct ldb_val *val = ldb_dn_get_rdn_val(samdb_server_site_dn(ldb, mem_ctx));
+
+ if (val != NULL)
+ return (const char *) val->data;
+ else
+ return NULL;
+}
+
/*
work out if we are the PDC for the domain of the current open ldb
*/
/*
- set the user password using plaintext, obeying any user or domain
- password restrictions
+ * Performs checks on a user password (plaintext UNIX format - attribute
+ * "password"). The remaining parameters have to be extracted from the domain
+ * object in the AD.
+ *
+ * Result codes from "enum samr_ValidationStatus" (consider "samr.idl")
+ */
+enum samr_ValidationStatus samdb_check_password(const DATA_BLOB *password,
+ const uint32_t pwdProperties,
+ const uint32_t minPwdLength)
+{
+ /* checks if the "minPwdLength" property is satisfied */
+ if (minPwdLength > password->length)
+ return SAMR_VALIDATION_STATUS_PWD_TOO_SHORT;
- note that this function doesn't actually store the result in the
- database, it just fills in the "mod" structure with ldb modify
- elements to setup the correct change when samdb_replace() is
- called. This allows the caller to combine the change with other
- changes (as is needed by some of the set user info levels)
+ /* checks the password complexity */
+ if (((pwdProperties & DOMAIN_PASSWORD_COMPLEX) != 0)
+ && (password->data != NULL)
+ && (!check_password_quality((const char *) password->data)))
+ return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH;
- The caller should probably have a transaction wrapping this
-*/
+ return SAMR_VALIDATION_STATUS_SUCCESS;
+}
+
+/*
+ * Sets the user password using plaintext UTF16 (attribute "new_password") or
+ * LM (attribute "lmNewHash") or NT (attribute "ntNewHash") hash. Also pass
+ * as parameter if it's a user change or not ("userChange"). The "rejectReason"
+ * gives some more informations if the changed failed.
+ *
+ * The caller should have a LDB transaction wrapping this.
+ *
+ * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION,
+ * NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
+ * NT_STATUS_PASSWORD_RESTRICTION
+ */
NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
- struct ldb_dn *user_dn,
- struct ldb_dn *domain_dn,
+ struct ldb_dn *user_dn, struct ldb_dn *domain_dn,
struct ldb_message *mod,
const DATA_BLOB *new_password,
struct samr_Password *param_lmNewHash,
/*
- set the user password using plaintext, obeying any user or domain
- password restrictions
-
- This wrapper function takes a SID as input, rather than a user DN,
- and actually performs the password change
-
-*/
-NTSTATUS samdb_set_password_sid(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
+ * Sets the user password using plaintext UTF16 (attribute "new_password") or
+ * LM (attribute "lmNewHash") or NT (attribute "ntNewHash") hash. Also pass
+ * as parameter if it's a user change or not ("userChange"). The "rejectReason"
+ * gives some more informations if the changed failed.
+ *
+ * This wrapper function for "samdb_set_password" takes a SID as input rather
+ * than a user DN.
+ *
+ * This call encapsulates a new LDB transaction for changing the password;
+ * therefore the user hasn't to start a new one.
+ *
+ * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION,
+ * NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
+ * NT_STATUS_PASSWORD_RESTRICTION
+ */
+NTSTATUS samdb_set_password_sid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
const struct dom_sid *user_sid,
- const DATA_BLOB *new_pass,
+ const DATA_BLOB *new_password,
struct samr_Password *lmNewHash,
struct samr_Password *ntNewHash,
bool user_change,
struct ldb_message *msg;
int ret;
- ret = ldb_transaction_start(ctx);
- if (ret) {
- DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(ctx)));
+ ret = ldb_transaction_start(ldb);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(ldb)));
return NT_STATUS_TRANSACTION_ABORTED;
}
- user_dn = samdb_search_dn(ctx, mem_ctx, NULL,
+ user_dn = samdb_search_dn(ldb, mem_ctx, NULL,
"(&(objectSid=%s)(objectClass=user))",
ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
if (!user_dn) {
- ldb_transaction_cancel(ctx);
+ ldb_transaction_cancel(ldb);
DEBUG(3, ("samdb_set_password_sid: SID %s not found in samdb, returning NO_SUCH_USER\n",
dom_sid_string(mem_ctx, user_sid)));
return NT_STATUS_NO_SUCH_USER;
msg = ldb_msg_new(mem_ctx);
if (msg == NULL) {
- ldb_transaction_cancel(ctx);
+ ldb_transaction_cancel(ldb);
return NT_STATUS_NO_MEMORY;
}
msg->dn = ldb_dn_copy(msg, user_dn);
if (!msg->dn) {
- ldb_transaction_cancel(ctx);
+ ldb_transaction_cancel(ldb);
return NT_STATUS_NO_MEMORY;
}
- nt_status = samdb_set_password(ctx, mem_ctx,
+ nt_status = samdb_set_password(ldb, mem_ctx,
user_dn, NULL,
- msg, new_pass,
+ msg, new_password,
lmNewHash, ntNewHash,
user_change, /* This is a password set, not change */
reject_reason, _dominfo);
if (!NT_STATUS_IS_OK(nt_status)) {
- ldb_transaction_cancel(ctx);
+ ldb_transaction_cancel(ldb);
return nt_status;
}
/* modify the samdb record */
- ret = samdb_replace(ctx, mem_ctx, msg);
- if (ret != 0) {
- ldb_transaction_cancel(ctx);
+ ret = samdb_replace(ldb, mem_ctx, msg);
+ if (ret != LDB_SUCCESS) {
+ ldb_transaction_cancel(ldb);
return NT_STATUS_ACCESS_DENIED;
}
- ret = ldb_transaction_commit(ctx);
- if (ret != 0) {
+ ret = ldb_transaction_commit(ldb);
+ if (ret != LDB_SUCCESS) {
DEBUG(0,("Failed to commit transaction to change password on %s: %s\n",
ldb_dn_get_linearized(msg->dn),
- ldb_errstring(ctx)));
+ ldb_errstring(ldb)));
return NT_STATUS_TRANSACTION_ABORTED;
}
return NT_STATUS_OK;
}
-
NTSTATUS samdb_create_foreign_security_principal(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
struct dom_sid *sid, struct ldb_dn **ret_dn)
{
talloc_free(tmp_ctx);
return LDB_ERR_NO_SUCH_OBJECT;
}
+
+/*
+ * Function which generates a "lDAPDisplayName" attribute from a "CN" one.
+ * Algorithm implemented according to MS-ADTS 3.1.1.2.3.4
+ */
+const char *samdb_cn_to_lDAPDisplayName(TALLOC_CTX *mem_ctx, const char *cn)
+{
+ char **tokens, *ret;
+ size_t i;
+
+ tokens = str_list_make(mem_ctx, cn, " -_");
+ if (tokens == NULL)
+ return NULL;
+
+ /* "tolower()" and "toupper()" should also work properly on 0x00 */
+ tokens[0][0] = tolower(tokens[0][0]);
+ for (i = 1; i < str_list_length((const char **)tokens); i++)
+ tokens[i][0] = toupper(tokens[i][0]);
+
+ ret = talloc_strdup(mem_ctx, tokens[0]);
+ for (i = 1; i < str_list_length((const char **)tokens); i++)
+ ret = talloc_asprintf_append_buffer(ret, "%s", tokens[i]);
+
+ talloc_free(tokens);
+
+ return ret;
+}
git.samba.org / ira / wip.git / blobdiff