4 Copyright (C) Simo Sorce 2004
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
7 * NOTICE: this module is NOT released under the GNU LGPL license as
8 * other ldb code. This module is release under the GNU GPL v2 or
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 2 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program; if not, write to the Free Software
23 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
29 * Component: ldb samldb module
31 * Description: add embedded user/group creation functionality
37 #include "libcli/ldap/ldap.h"
38 #include "lib/ldb/include/ldb_errors.h"
39 #include "lib/ldb/include/ldb_private.h"
40 #include "dsdb/samdb/samdb.h"
41 #include "libcli/security/security.h"
42 #include "librpc/gen_ndr/ndr_security.h"
45 int samldb_notice_sid(struct ldb_module *module,
46 TALLOC_CTX *mem_ctx, const struct dom_sid *sid);
48 static BOOL samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
52 status = ndr_push_struct_blob(&v, msg, sid,
53 (ndr_push_flags_fn_t)ndr_push_dom_sid);
54 if (!NT_STATUS_IS_OK(status)) {
57 return (ldb_msg_add_value(msg, name, &v) == 0);
61 allocate a new id, attempting to do it atomically
62 return 0 on failure, the id on success
64 static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
65 const struct ldb_dn *dn, uint32_t old_id, uint32_t new_id)
67 struct ldb_message msg;
69 struct ldb_val vals[2];
70 struct ldb_message_element els[2];
74 ldb_debug(ldb, LDB_DEBUG_FATAL, "Are we out of valid IDs ?\n");
75 return LDB_ERR_OPERATIONS_ERROR;
78 /* we do a delete and add as a single operation. That prevents
79 a race, in case we are not actually on a transaction db */
81 msg.dn = ldb_dn_copy(mem_ctx, dn);
83 return LDB_ERR_OPERATIONS_ERROR;
88 els[0].num_values = 1;
89 els[0].values = &vals[0];
90 els[0].flags = LDB_FLAG_MOD_DELETE;
91 els[0].name = talloc_strdup(mem_ctx, "nextRid");
93 return LDB_ERR_OPERATIONS_ERROR;
96 els[1].num_values = 1;
97 els[1].values = &vals[1];
98 els[1].flags = LDB_FLAG_MOD_ADD;
99 els[1].name = els[0].name;
101 vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", old_id);
103 return LDB_ERR_OPERATIONS_ERROR;
105 vals[0].length = strlen((char *)vals[0].data);
107 vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", new_id);
109 return LDB_ERR_OPERATIONS_ERROR;
111 vals[1].length = strlen((char *)vals[1].data);
113 ret = ldb_modify(ldb, &msg);
118 allocate a new id, attempting to do it atomically
119 return 0 on failure, the id on success
121 static int samldb_find_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
122 const struct ldb_dn *dn, uint32_t *old_rid)
124 const char * const attrs[2] = { "nextRid", NULL };
125 struct ldb_result *res = NULL;
129 ret = ldb_search(module->ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
130 if (ret != LDB_SUCCESS) {
133 talloc_steal(mem_ctx, res);
134 if (res->count != 1) {
136 return LDB_ERR_OPERATIONS_ERROR;
139 str = ldb_msg_find_attr_as_string(res->msgs[0], "nextRid", NULL);
141 ldb_asprintf_errstring(module->ldb,
142 "attribute nextRid not found in %s\n",
143 ldb_dn_linearize(res, dn));
145 return LDB_ERR_OPERATIONS_ERROR;
148 *old_rid = strtol(str, NULL, 0);
153 static int samldb_allocate_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
154 const struct ldb_dn *dn, const struct dom_sid *dom_sid,
155 struct dom_sid **new_sid)
157 struct dom_sid *obj_sid;
161 ret = samldb_find_next_rid(module, mem_ctx, dn, &old_rid);
166 /* return the new object sid */
167 obj_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid);
169 *new_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid + 1);
171 return LDB_ERR_OPERATIONS_ERROR;
174 ret = samldb_notice_sid(module, mem_ctx, *new_sid);
176 /* gah, there are conflicting sids.
177 * This is a critical situation it means that someone messed up with
178 * the DB and nextRid is not returning free RIDs, report an error
179 * and refuse to create any user until the problem is fixed */
180 ldb_asprintf_errstring(module->ldb,
181 "Critical Error: unconsistent DB, unable to retireve an unique RID to generate a new SID: %s",
182 ldb_errstring(module->ldb));
188 /* Find a domain object in the parents of a particular DN. */
189 static struct ldb_dn *samldb_search_domain(struct ldb_module *module, TALLOC_CTX *mem_ctx, const struct ldb_dn *dn)
191 TALLOC_CTX *local_ctx;
193 struct ldb_result *res = NULL;
195 const char *attrs[] = { NULL };
197 local_ctx = talloc_new(mem_ctx);
198 if (local_ctx == NULL) return NULL;
200 sdn = ldb_dn_copy(local_ctx, dn);
202 ret = ldb_search(module->ldb, sdn, LDB_SCOPE_BASE,
203 "(|(objectClass=domain)(objectClass=builtinDomain))", attrs, &res);
204 talloc_steal(local_ctx, res);
205 if (ret == LDB_SUCCESS && res->count == 1)
207 } while ((sdn = ldb_dn_get_parent(local_ctx, sdn)));
209 if (ret != LDB_SUCCESS || res->count != 1) {
210 talloc_free(local_ctx);
214 talloc_steal(mem_ctx, sdn);
215 talloc_free(local_ctx);
220 /* search the domain related to the provided dn
221 allocate a new RID for the domain
222 return the new sid string
224 static int samldb_get_new_sid(struct ldb_module *module,
225 TALLOC_CTX *mem_ctx, const struct ldb_dn *obj_dn,
226 struct dom_sid **sid)
228 const char * const attrs[2] = { "objectSid", NULL };
229 struct ldb_result *res = NULL;
230 const struct ldb_dn *dom_dn;
232 struct dom_sid *dom_sid;
234 /* get the domain component part of the provided dn */
236 dom_dn = samldb_search_domain(module, mem_ctx, obj_dn);
237 if (dom_dn == NULL) {
238 ldb_asprintf_errstring(module->ldb,
239 "Invalid dn (%s) not child of a domain object!\n",
240 ldb_dn_linearize(mem_ctx, obj_dn));
241 return LDB_ERR_CONSTRAINT_VIOLATION;
244 /* find the domain sid */
246 ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
247 if (ret != LDB_SUCCESS) {
248 ldb_asprintf_errstring(module->ldb,
249 "samldb_get_new_sid: error retrieving domain sid from %s: %s!\n",
250 ldb_dn_linearize(mem_ctx, dom_dn),
251 ldb_errstring(module->ldb));
256 if (res->count != 1) {
257 ldb_asprintf_errstring(module->ldb,
258 "samldb_get_new_sid: error retrieving domain sid from %s: not found!\n",
259 ldb_dn_linearize(mem_ctx, dom_dn));
260 return LDB_ERR_CONSTRAINT_VIOLATION;
263 dom_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
264 if (dom_sid == NULL) {
265 ldb_set_errstring(module->ldb, "samldb_get_new_sid: error parsing domain sid!\n");
267 return LDB_ERR_CONSTRAINT_VIOLATION;
270 /* allocate a new Rid for the domain */
271 ret = samldb_allocate_next_rid(module, mem_ctx, dom_dn, dom_sid, sid);
273 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_linearize(mem_ctx, dom_dn), ldb_errstring(module->ldb));
283 /* If we are adding new users/groups, we need to update the nextRid
284 * attribute to be 'above' all incoming users RIDs. This tries to
285 * avoid clashes in future */
287 int samldb_notice_sid(struct ldb_module *module,
288 TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
291 struct ldb_dn *dom_dn;
292 struct dom_sid *dom_sid;
293 const char *attrs[] = { NULL };
294 struct ldb_result *dom_res;
295 struct ldb_result *res;
299 /* find if this SID already exists */
301 filter = talloc_asprintf(mem_ctx, "(objectSid=%s)",
302 ldap_encode_ndr_dom_sid(mem_ctx, sid));
304 ret = ldb_search(module->ldb, samdb_base_dn(mem_ctx), LDB_SCOPE_SUBTREE, filter, attrs, &res);
305 if (ret == LDB_SUCCESS) {
306 if (res->count > 0) {
308 ldb_asprintf_errstring(module->ldb,
309 "Attempt to add record with SID %s rejected,"
310 " because this SID is already in the database",
311 dom_sid_string(mem_ctx, sid));
312 /* We have a duplicate SID, we must reject the add */
313 return LDB_ERR_CONSTRAINT_VIOLATION;
317 ldb_asprintf_errstring(module->ldb,
318 "samldb_notice_sid: error searching to see if sid %s is in use: %s\n",
319 dom_sid_string(mem_ctx, sid),
320 ldb_errstring(module->ldb));
324 dom_sid = dom_sid_dup(mem_ctx, sid);
326 return LDB_ERR_OPERATIONS_ERROR;
328 /* get the domain component part of the provided SID */
329 dom_sid->num_auths--;
331 /* find the domain DN */
333 filter = talloc_asprintf(mem_ctx, "(&(objectSid=%s)(objectclass=domain))",
334 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
336 ret = ldb_search(module->ldb, samdb_base_dn(mem_ctx), LDB_SCOPE_SUBTREE, filter, attrs, &dom_res);
337 if (ret == LDB_SUCCESS) {
338 talloc_steal(mem_ctx, dom_res);
339 if (dom_res->count == 0) {
340 talloc_free(dom_res);
341 /* This isn't an operation on a domain we know about, so nothing to update */
345 if (dom_res->count > 1) {
346 talloc_free(dom_res);
347 ldb_asprintf_errstring(module->ldb,
348 "samldb_notice_sid: error retrieving domain from sid: duplicate (found %d) domain: %s!\n",
349 dom_res->count, dom_sid_string(dom_res, dom_sid));
350 return LDB_ERR_OPERATIONS_ERROR;
353 ldb_asprintf_errstring(module->ldb,
354 "samldb_notice_sid: error retrieving domain from sid: %s: %s\n",
355 dom_sid_string(dom_res, dom_sid),
356 ldb_errstring(module->ldb));
360 dom_dn = dom_res->msgs[0]->dn;
362 ret = samldb_find_next_rid(module, mem_ctx,
365 talloc_free(dom_res);
369 if (old_rid <= sid->sub_auths[sid->num_auths - 1]) {
370 ret = samldb_set_next_rid(module->ldb, mem_ctx, dom_dn, old_rid,
371 sid->sub_auths[sid->num_auths - 1] + 1);
373 talloc_free(dom_res);
377 static int samldb_handle_sid(struct ldb_module *module,
378 TALLOC_CTX *mem_ctx, struct ldb_message *msg2)
382 struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg2, "objectSid");
384 ret = samldb_get_new_sid(module, msg2, msg2->dn, &sid);
389 if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
391 return LDB_ERR_OPERATIONS_ERROR;
396 ret = samldb_notice_sid(module, msg2, sid);
401 static char *samldb_generate_samAccountName(struct ldb_module *module, TALLOC_CTX *mem_ctx)
404 const char *attrs[] = { NULL };
405 struct ldb_message **msgs;
408 /* Format: $000000-000000000000 */
411 name = talloc_asprintf(mem_ctx, "$%.6X-%.6X%.6X", (unsigned int)random(), (unsigned int)random(), (unsigned int)random());
412 /* TODO: Figure out exactly what this is meant to conflict with */
413 ret = gendb_search(module->ldb,
414 mem_ctx, NULL, &msgs, attrs,
416 ldb_binary_encode_string(mem_ctx, name));
418 /* Great. There are no conflicting users/groups/etc */
420 } else if (ret == -1) {
421 /* Bugger, there is a problem, and we don't know what it is until gendb_search improves */
425 /* gah, there are conflicting sids, lets move around the loop again... */
430 static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_message *msg,
431 struct ldb_message **ret_msg)
435 struct ldb_message *msg2;
436 struct ldb_dn_component *rdn;
437 TALLOC_CTX *mem_ctx = talloc_new(msg);
439 return LDB_ERR_OPERATIONS_ERROR;
442 /* build the new msg */
443 msg2 = ldb_msg_copy(mem_ctx, msg);
445 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
446 talloc_free(mem_ctx);
447 return LDB_ERR_OPERATIONS_ERROR;
450 ret = samdb_copy_template(module->ldb, msg2, "(&(CN=TemplateGroup)(objectclass=groupTemplate))");
452 talloc_free(mem_ctx);
456 rdn = ldb_dn_get_rdn(msg2, msg2->dn);
458 if (strcasecmp(rdn->name, "cn") != 0) {
459 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn->name);
460 talloc_free(mem_ctx);
461 return LDB_ERR_CONSTRAINT_VIOLATION;
464 /* Generate a random name, if no samAccountName was supplied */
465 if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
466 name = samldb_generate_samAccountName(module, mem_ctx);
468 talloc_free(mem_ctx);
469 return LDB_ERR_OPERATIONS_ERROR;
471 ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
473 talloc_free(mem_ctx);
478 /* Manage SID allocation, conflicts etc */
479 ret = samldb_handle_sid(module, mem_ctx, msg2);
481 if (ret == LDB_SUCCESS) {
482 talloc_steal(msg, msg2);
485 talloc_free(mem_ctx);
489 static int samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg,
490 struct ldb_message **ret_msg)
494 struct ldb_message *msg2;
495 struct ldb_dn_component *rdn;
496 TALLOC_CTX *mem_ctx = talloc_new(msg);
498 return LDB_ERR_OPERATIONS_ERROR;
501 /* build the new msg */
502 msg2 = ldb_msg_copy(mem_ctx, msg);
504 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
505 talloc_free(mem_ctx);
506 return LDB_ERR_OPERATIONS_ERROR;
509 if (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL) {
511 ret = samdb_copy_template(module->ldb, msg2, "(&(CN=TemplateComputer)(objectclass=userTemplate))");
513 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_user_or_computer_object: Error copying computer template!\n");
514 talloc_free(mem_ctx);
518 /* readd user and then computer objectclasses */
519 ret = samdb_find_or_add_value(module->ldb, msg2, "objectclass", "user");
521 talloc_free(mem_ctx);
524 ret = samdb_find_or_add_value(module->ldb, msg2, "objectclass", "computer");
526 talloc_free(mem_ctx);
531 ret = samdb_copy_template(module->ldb, msg2, "(&(CN=TemplateUser)(objectclass=userTemplate))");
533 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_user_or_computer_object: Error copying user template!\n");
534 talloc_free(mem_ctx);
537 /* readd user objectclass */
538 ret = samdb_find_or_add_value(module->ldb, msg2, "objectclass", "user");
540 talloc_free(mem_ctx);
545 rdn = ldb_dn_get_rdn(msg2, msg2->dn);
547 if (strcasecmp(rdn->name, "cn") != 0) {
548 ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for user/computer, should be CN=!\n", rdn->name);
549 talloc_free(mem_ctx);
550 return LDB_ERR_CONSTRAINT_VIOLATION;
553 if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
554 name = samldb_generate_samAccountName(module, mem_ctx);
556 talloc_free(mem_ctx);
557 return LDB_ERR_OPERATIONS_ERROR;
559 ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
561 talloc_free(mem_ctx);
567 TODO: useraccountcontrol: setting value 0 gives 0x200 for users
570 /* Manage SID allocation, conflicts etc */
571 ret = samldb_handle_sid(module, mem_ctx, msg2);
573 /* TODO: objectCategory, userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
577 talloc_steal(msg, msg2);
579 talloc_free(mem_ctx);
583 static int samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg,
584 struct ldb_message **ret_msg)
586 struct ldb_message *msg2;
587 struct ldb_dn_component *rdn;
588 struct dom_sid *dom_sid;
590 const char *dom_attrs[] = { "name", NULL };
591 struct ldb_message **dom_msgs;
594 TALLOC_CTX *mem_ctx = talloc_new(msg);
596 return LDB_ERR_OPERATIONS_ERROR;
599 /* build the new msg */
600 msg2 = ldb_msg_copy(mem_ctx, msg);
602 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincpal_object: ldb_msg_copy failed!\n");
603 talloc_free(mem_ctx);
604 return LDB_ERR_OPERATIONS_ERROR;
607 ret = samdb_copy_template(module->ldb, msg2, "(&(CN=TemplateForeignSecurityPrincipal)(objectclass=foreignSecurityPrincipalTemplate))");
609 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_foreignSecurityPrincipal_object: Error copying template!\n");
610 talloc_free(mem_ctx);
614 rdn = ldb_dn_get_rdn(msg2, msg2->dn);
616 if (strcasecmp(rdn->name, "cn") != 0) {
617 ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for ForeignSecurityPrincipal, should be CN=!", rdn->name);
618 talloc_free(mem_ctx);
619 return LDB_ERR_CONSTRAINT_VIOLATION;
622 /* Slightly different for the foreign sids. We don't want
623 * domain SIDs ending up there, it would cause all sorts of
626 sid = dom_sid_parse_talloc(msg2, (const char *)rdn->value.data);
628 ldb_set_errstring(module->ldb, "No valid found SID in ForeignSecurityPrincipal CN!");
629 talloc_free(mem_ctx);
630 return LDB_ERR_CONSTRAINT_VIOLATION;
633 if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
635 return LDB_ERR_OPERATIONS_ERROR;
638 dom_sid = dom_sid_dup(mem_ctx, sid);
640 talloc_free(mem_ctx);
641 return LDB_ERR_OPERATIONS_ERROR;
643 /* get the domain component part of the provided SID */
644 dom_sid->num_auths--;
646 /* find the domain DN */
648 ret = gendb_search(module->ldb,
649 mem_ctx, NULL, &dom_msgs, dom_attrs,
650 "(&(objectSid=%s)(objectclass=domain))",
651 ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
653 /* We don't really like the idea of foreign sids that are not foreign, but it happens */
654 const char *name = samdb_result_string(dom_msgs[0], "name", NULL);
655 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "NOTE (strange but valid): Adding foreign SID record with SID %s, but this domian (%s) is already in the database",
656 dom_sid_string(mem_ctx, sid), name);
657 } else if (ret == -1) {
658 ldb_asprintf_errstring(module->ldb,
659 "samldb_fill_foreignSecurityPrincipal_object: error searching for a domain with this sid: %s\n",
660 dom_sid_string(mem_ctx, dom_sid));
661 talloc_free(dom_msgs);
662 return LDB_ERR_OPERATIONS_ERROR;
665 /* This isn't an operation on a domain we know about, so just
666 * check for the SID, looking for duplicates via the common
668 ret = samldb_notice_sid(module, msg2, sid);
670 talloc_steal(msg, msg2);
682 * Actually this module is not async at all as it does a number of sync searches
683 * in the process. It still to be decided how to deal with it properly so it is
684 * left SYNC for now until we think of a good solution.
687 static int samldb_add(struct ldb_module *module, struct ldb_request *req)
689 const struct ldb_message *msg = req->op.add.message;
690 struct ldb_message *msg2 = NULL;
691 struct ldb_request *down_req;
694 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");
696 if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
697 return ldb_next_request(module, req);
700 /* is user or computer? */
701 if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) ||
702 (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
703 /* add all relevant missing objects */
704 ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
710 /* is group? add all relevant missing objects */
712 if (samdb_find_attribute(module->ldb, msg, "objectclass", "group") != NULL) {
713 ret = samldb_fill_group_object(module, msg, &msg2);
720 /* perhaps a foreignSecurityPrincipal? */
722 if (samdb_find_attribute(module->ldb, msg, "objectclass", "foreignSecurityPrincipal") != NULL) {
723 ret = samldb_fill_foreignSecurityPrincipal_object(module, msg, &msg2);
731 return ldb_next_request(module, req);
734 down_req = talloc(module, struct ldb_request);
735 if (down_req == NULL) {
736 return LDB_ERR_OPERATIONS_ERROR;
741 down_req->op.add.message = talloc_steal(down_req, msg2);
743 ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
745 /* go on with the call chain */
746 ret = ldb_next_request(module, down_req);
748 /* do not free down_req as the call results may be linked to it,
749 * it will be freed when the upper level request get freed */
750 if (ret == LDB_SUCCESS) {
751 req->handle = down_req->handle;
757 static int samldb_init(struct ldb_module *module)
759 return ldb_next_init(module);
762 static const struct ldb_module_ops samldb_ops = {
764 .init_context = samldb_init,
769 int samldb_module_init(void)
771 return ldb_register_module(&samldb_ops);