4 Copyright (C) Simo Sorce 2004
6 * NOTICE: this module is NOT released under the GNU LGPL license as
7 * other ldb code. This module is release under the GNU GPL v2 or
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 2 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program; if not, write to the Free Software
22 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
28 * Component: ldb samldb module
30 * Description: add embedded user/group creation functionality
36 #include "lib/ldb/include/ldb.h"
37 #include "lib/ldb/include/ldb_errors.h"
38 #include "lib/ldb/include/ldb_private.h"
39 #include "system/time.h"
40 #include "librpc/gen_ndr/ndr_security.h"
41 #include "dsdb/samdb/samdb.h"
43 #define SAM_ACCOUNT_NAME_BASE "$000000-000000000000"
46 allocate a new id, attempting to do it atomically
47 return 0 on failure, the id on success
49 static int samldb_allocate_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
50 const struct ldb_dn *dn, uint32_t *id)
52 const char * const attrs[2] = { "nextRid", NULL };
53 struct ldb_result *res = NULL;
54 struct ldb_message msg;
57 struct ldb_val vals[2];
58 struct ldb_message_element els[2];
60 ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
61 if (ret != LDB_SUCCESS || res->count != 1) {
62 if (res) talloc_free(res);
65 str = ldb_msg_find_string(res->msgs[0], "nextRid", NULL);
67 ldb_debug(ldb, LDB_DEBUG_FATAL, "attribute nextRid not found in %s\n", ldb_dn_linearize(res, dn));
72 *id = strtol(str, NULL, 0);
75 ldb_debug(ldb, LDB_DEBUG_FATAL, "Are we out of valid IDs ?\n");
81 /* we do a delete and add as a single operation. That prevents
84 msg.dn = ldb_dn_copy(mem_ctx, dn);
91 els[0].num_values = 1;
92 els[0].values = &vals[0];
93 els[0].flags = LDB_FLAG_MOD_DELETE;
94 els[0].name = talloc_strdup(mem_ctx, "nextRid");
99 els[1].num_values = 1;
100 els[1].values = &vals[1];
101 els[1].flags = LDB_FLAG_MOD_ADD;
102 els[1].name = els[0].name;
104 vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", *id);
108 vals[0].length = strlen((char *)vals[0].data);
110 vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", (*id)+1);
114 vals[1].length = strlen((char *)vals[1].data);
116 ret = ldb_modify(ldb, &msg);
126 static struct ldb_dn *samldb_search_domain(struct ldb_module *module, TALLOC_CTX *mem_ctx, const struct ldb_dn *dn)
128 TALLOC_CTX *local_ctx;
130 struct ldb_result *res = NULL;
133 local_ctx = talloc_new(mem_ctx);
134 if (local_ctx == NULL) return NULL;
136 sdn = ldb_dn_copy(local_ctx, dn);
138 ret = ldb_search(module->ldb, sdn, LDB_SCOPE_BASE, "objectClass=domain", NULL, &res);
139 talloc_steal(local_ctx, res);
140 if (ret == LDB_SUCCESS && res->count == 1)
142 } while ((sdn = ldb_dn_get_parent(local_ctx, sdn)));
144 if (ret != LDB_SUCCESS || res->count != 1) {
145 talloc_free(local_ctx);
149 talloc_steal(mem_ctx, sdn);
150 talloc_free(local_ctx);
155 /* search the domain related to the provided dn
156 allocate a new RID for the domain
157 return the new sid string
159 static struct dom_sid *samldb_get_new_sid(struct ldb_module *module,
160 TALLOC_CTX *mem_ctx, const struct ldb_dn *obj_dn)
162 const char * const attrs[2] = { "objectSid", NULL };
163 struct ldb_result *res = NULL;
164 const struct ldb_dn *dom_dn;
167 struct dom_sid *dom_sid, *obj_sid;
169 /* get the domain component part of the provided dn */
171 /* FIXME: quick search here, I think we should use something like
172 ldap_parse_dn here to be 100% sure we get the right domain dn */
174 /* FIXME: "dc=" is probably not utf8 safe either,
175 we need a multibyte safe substring search function here */
177 dom_dn = samldb_search_domain(module, mem_ctx, obj_dn);
178 if (dom_dn == NULL) {
179 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Invalid dn (%s) not child of a domain object!\n", ldb_dn_linearize(mem_ctx, obj_dn));
183 /* find the domain sid */
185 ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
186 if (ret != LDB_SUCCESS || res->count != 1) {
187 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_get_new_sid: error retrieving domain sid!\n");
192 dom_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
193 if (dom_sid == NULL) {
194 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_get_new_sid: error retrieving domain sid!\n");
199 /* allocate a new Rid for the domain */
200 ret = samldb_allocate_next_rid(module->ldb, mem_ctx, dom_dn, &rid);
202 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s\n", ldb_dn_linearize(mem_ctx, dom_dn));
207 /* return the new object sid */
208 obj_sid = dom_sid_add_rid(mem_ctx, dom_sid, rid);
215 static char *samldb_generate_samAccountName(const void *mem_ctx) {
218 name = talloc_strdup(mem_ctx, SAM_ACCOUNT_NAME_BASE);
219 /* TODO: randomize name */
224 /* if value is not null also check for attribute to have exactly that value */
225 static struct ldb_message_element *samldb_find_attribute(const struct ldb_message *msg, const char *name, const char *value)
229 for (i = 0; i < msg->num_elements; i++) {
230 if (ldb_attr_cmp(name, msg->elements[i].name) == 0) {
232 return &msg->elements[i];
234 for (j = 0; j < msg->elements[i].num_values; j++) {
235 if (strcasecmp(value,
236 (char *)msg->elements[i].values[j].data) == 0) {
237 return &msg->elements[i];
246 static BOOL samldb_msg_add_string(struct ldb_module *module, struct ldb_message *msg, const char *name, const char *value)
248 char *aname = talloc_strdup(msg, name);
249 char *aval = talloc_strdup(msg, value);
251 if (aname == NULL || aval == NULL) {
252 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_msg_add_string: talloc_strdup failed!\n");
256 if (ldb_msg_add_string(msg, aname, aval) != 0) {
263 static BOOL samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
267 status = ndr_push_struct_blob(&v, msg, sid,
268 (ndr_push_flags_fn_t)ndr_push_dom_sid);
269 if (!NT_STATUS_IS_OK(status)) {
272 return (ldb_msg_add_value(msg, name, &v) == 0);
275 static BOOL samldb_find_or_add_attribute(struct ldb_module *module, struct ldb_message *msg, const char *name, const char *value, const char *set_value)
277 if (samldb_find_attribute(msg, name, value) == NULL) {
278 return samldb_msg_add_string(module, msg, name, set_value);
283 static int samldb_copy_template(struct ldb_module *module, struct ldb_message *msg, const char *filter)
285 struct ldb_result *res;
286 struct ldb_message *t;
290 /* pull the template record */
291 ret = ldb_search(module->ldb, NULL, LDB_SCOPE_SUBTREE, filter, NULL, &res);
292 if (ret != LDB_SUCCESS || res->count != 1) {
293 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb: ERROR: template '%s' matched too many records\n", filter);
298 for (i = 0; i < t->num_elements; i++) {
299 struct ldb_message_element *el = &t->elements[i];
300 /* some elements should not be copied from the template */
301 if (strcasecmp(el->name, "cn") == 0 ||
302 strcasecmp(el->name, "name") == 0 ||
303 strcasecmp(el->name, "sAMAccountName") == 0 ||
304 strcasecmp(el->name, "objectGUID") == 0) {
307 for (j = 0; j < el->num_values; j++) {
308 if (strcasecmp(el->name, "objectClass") == 0) {
309 if (strcasecmp((char *)el->values[j].data, "Template") == 0 ||
310 strcasecmp((char *)el->values[j].data, "userTemplate") == 0 ||
311 strcasecmp((char *)el->values[j].data, "groupTemplate") == 0 ||
312 strcasecmp((char *)el->values[j].data, "foreignSecurityPrincipalTemplate") == 0 ||
313 strcasecmp((char *)el->values[j].data, "aliasTemplate") == 0 ||
314 strcasecmp((char *)el->values[j].data, "trustedDomainTemplate") == 0 ||
315 strcasecmp((char *)el->values[j].data, "secretTemplate") == 0) {
318 if ( ! samldb_find_or_add_attribute(module, msg, el->name,
319 (char *)el->values[j].data,
320 (char *)el->values[j].data)) {
321 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Attribute adding failed...\n");
326 if ( ! samldb_find_or_add_attribute(module, msg, el->name,
328 (char *)el->values[j].data)) {
329 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Attribute adding failed...\n");
342 static struct ldb_message *samldb_fill_group_object(struct ldb_module *module, const struct ldb_message *msg)
344 struct ldb_message *msg2;
345 struct ldb_message_element *attribute;
346 struct ldb_dn_component *rdn;
348 if (samldb_find_attribute(msg, "objectclass", "group") == NULL) {
352 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_group_object\n");
354 /* build the new msg */
355 msg2 = ldb_msg_copy(module->ldb, msg);
357 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
361 if (samldb_copy_template(module, msg2, "(&(CN=TemplateGroup)(objectclass=groupTemplate))") != 0) {
362 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_group_object: Error copying template!\n");
366 if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
367 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad DN (%s)!\n", ldb_dn_linearize(msg2, msg2->dn));
370 if (strcasecmp(rdn->name, "cn") != 0) {
371 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn->name);
375 if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
376 struct dom_sid *sid = samldb_get_new_sid(module, msg2, msg2->dn);
378 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: internal error! Can't generate new sid\n");
382 if (!samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
389 if ( ! samldb_find_or_add_attribute(module, msg2, "sAMAccountName", NULL, samldb_generate_samAccountName(msg2))) {
393 talloc_steal(msg, msg2);
398 static struct ldb_message *samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg)
400 struct ldb_message *msg2;
401 struct ldb_message_element *attribute;
402 struct ldb_dn_component *rdn;
404 if ((samldb_find_attribute(msg, "objectclass", "user") == NULL) &&
405 (samldb_find_attribute(msg, "objectclass", "computer") == NULL)) {
409 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_user_or_computer_object\n");
411 /* build the new msg */
412 msg2 = ldb_msg_copy(module->ldb, msg);
414 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
418 if (samldb_find_attribute(msg, "objectclass", "computer") != NULL) {
419 if (samldb_copy_template(module, msg2, "(&(CN=TemplateComputer)(objectclass=userTemplate))") != 0) {
420 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_user_or_computer_object: Error copying computer template!\n");
424 if (samldb_copy_template(module, msg2, "(&(CN=TemplateUser)(objectclass=userTemplate))") != 0) {
425 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_user_or_computer_object: Error copying user template!\n");
430 if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
433 if (strcasecmp(rdn->name, "cn") != 0) {
434 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: Bad RDN (%s) for user/computer!\n", rdn->name);
438 /* if the only attribute was: "objectclass: computer", then make sure we also add "user" objectclass */
439 if ( ! samldb_find_or_add_attribute(module, msg2, "objectclass", "user", "user")) {
443 if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
445 sid = samldb_get_new_sid(module, msg2, msg2->dn);
447 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: internal error! Can't generate new sid\n");
451 if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
458 if ( ! samldb_find_or_add_attribute(module, msg2, "sAMAccountName", NULL, samldb_generate_samAccountName(msg2))) {
463 useraccountcontrol: setting value 0 gives 0x200 for users
466 /* TODO: objectCategory, userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
471 static struct ldb_message *samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg)
473 struct ldb_message *msg2;
474 struct ldb_message_element *attribute;
475 struct ldb_dn_component *rdn;
477 if (samldb_find_attribute(msg, "objectclass", "foreignSecurityPrincipal") == NULL) {
481 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_foreignSecurityPrincipal_object\n");
483 /* build the new msg */
484 msg2 = ldb_msg_copy(module->ldb, msg);
486 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincpal_object: ldb_msg_copy failed!\n");
490 talloc_steal(msg, msg2);
492 if (samldb_copy_template(module, msg2, "(&(CN=TemplateForeignSecurityPrincipal)(objectclass=foreignSecurityPrincipalTemplate))") != 0) {
493 ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_foreignSecurityPrincipal_object: Error copying template!\n");
497 if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
498 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: Bad DN (%s)!\n", ldb_dn_linearize(msg2, msg2->dn));
501 if (strcasecmp(rdn->name, "cn") != 0) {
502 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: Bad RDN (%s) for foreignSecurityPrincpal!\n", rdn->name);
506 if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
507 struct dom_sid *sid = dom_sid_parse_talloc(msg2, (char *)rdn->value.data);
509 ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: internal error! Can't parse sid in CN\n");
513 if (!samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
524 static int samldb_add(struct ldb_module *module, struct ldb_request *req)
526 const struct ldb_message *msg = req->op.add.message;
527 struct ldb_message *msg2 = NULL;
530 ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");
533 if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
534 return ldb_next_request(module, req);
537 /* is user or computer? add all relevant missing objects */
538 msg2 = samldb_fill_user_or_computer_object(module, msg);
540 /* is group? add all relevant missing objects */
542 msg2 = samldb_fill_group_object(module, msg);
545 /* perhaps a foreignSecurityPrincipal? */
547 msg2 = samldb_fill_foreignSecurityPrincipal_object(module, msg);
551 req->op.add.message = msg2;
552 ret = ldb_next_request(module, req);
553 req->op.add.message = msg;
555 ret = ldb_next_request(module, req);
561 static int samldb_destructor(void *module_ctx)
563 /* struct ldb_module *ctx = module_ctx; */
564 /* put your clean-up functions here */
568 static int samldb_request(struct ldb_module *module, struct ldb_request *req)
570 switch (req->operation) {
573 return samldb_add(module, req);
576 return ldb_next_request(module, req);
581 static const struct ldb_module_ops samldb_ops = {
583 .request = samldb_request
587 /* the init function */
588 #ifdef HAVE_DLOPEN_DISABLED
589 struct ldb_module *init_module(struct ldb_context *ldb, const char *options[])
591 struct ldb_module *samldb_module_init(struct ldb_context *ldb, const char *options[])
594 struct ldb_module *ctx;
596 ctx = talloc(ldb, struct ldb_module);
600 ctx->private_data = NULL;
602 ctx->prev = ctx->next = NULL;
603 ctx->ops = &samldb_ops;
605 talloc_set_destructor(ctx, samldb_destructor);