SAM ldb module
Copyright (C) Simo Sorce 2004
+ Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
* NOTICE: this module is NOT released under the GNU LGPL license as
- * other ldb code. This module is release under the GNU GPL v2 or
+ * other ldb code. This module is release under the GNU GPL v3 or
* later license.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
*/
#include "includes.h"
-#include "lib/ldb/include/ldb.h"
+#include "libcli/ldap/ldap_ndr.h"
#include "lib/ldb/include/ldb_errors.h"
+#include "lib/ldb/include/ldb.h"
#include "lib/ldb/include/ldb_private.h"
-#include "system/time.h"
-#include "librpc/gen_ndr/ndr_security.h"
#include "dsdb/samdb/samdb.h"
+#include "libcli/security/security.h"
+#include "librpc/gen_ndr/ndr_security.h"
+#include "util/util_ldb.h"
-#define SAM_ACCOUNT_NAME_BASE "$000000-000000000000"
+int samldb_notice_sid(struct ldb_module *module,
+ TALLOC_CTX *mem_ctx, const struct dom_sid *sid);
+
+static bool samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
+{
+ struct ldb_val v;
+ enum ndr_err_code ndr_err;
+
+ ndr_err = ndr_push_struct_blob(&v, msg, NULL, sid,
+ (ndr_push_flags_fn_t)ndr_push_dom_sid);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return false;
+ }
+ return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
+}
/*
allocate a new id, attempting to do it atomically
return 0 on failure, the id on success
*/
-static int samldb_allocate_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
- const struct ldb_dn *dn, uint32_t *id)
+static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
+ struct ldb_dn *dn, uint32_t old_id, uint32_t new_id)
{
- const char * const attrs[2] = { "nextRid", NULL };
- struct ldb_result *res = NULL;
struct ldb_message msg;
int ret;
- const char *str;
struct ldb_val vals[2];
struct ldb_message_element els[2];
- ret = ldb_search(ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
- if (ret != LDB_SUCCESS || res->count != 1) {
- if (res) talloc_free(res);
- return -1;
- }
- str = ldb_msg_find_string(res->msgs[0], "nextRid", NULL);
- if (str == NULL) {
- ldb_debug(ldb, LDB_DEBUG_FATAL, "attribute nextRid not found in %s\n", ldb_dn_linearize(res, dn));
- talloc_free(res);
- return -1;
- }
-
- *id = strtol(str, NULL, 0);
- if ((*id)+1 == 0) {
+ if (new_id == 0) {
/* out of IDs ! */
- ldb_debug(ldb, LDB_DEBUG_FATAL, "Are we out of valid IDs ?\n");
- talloc_free(res);
- return -1;
+ ldb_set_errstring(ldb, "Are we out of valid IDs ?\n");
+ return LDB_ERR_OPERATIONS_ERROR;
}
- talloc_free(res);
/* we do a delete and add as a single operation. That prevents
- a race */
+ a race, in case we are not actually on a transaction db */
ZERO_STRUCT(msg);
msg.dn = ldb_dn_copy(mem_ctx, dn);
if (!msg.dn) {
- return -1;
+ ldb_oom(ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
}
msg.num_elements = 2;
msg.elements = els;
els[0].flags = LDB_FLAG_MOD_DELETE;
els[0].name = talloc_strdup(mem_ctx, "nextRid");
if (!els[0].name) {
- return -1;
+ ldb_oom(ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
}
els[1].num_values = 1;
els[1].flags = LDB_FLAG_MOD_ADD;
els[1].name = els[0].name;
- vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", *id);
+ vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", old_id);
if (!vals[0].data) {
- return -1;
+ ldb_oom(ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
}
vals[0].length = strlen((char *)vals[0].data);
- vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", (*id)+1);
+ vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", new_id);
if (!vals[1].data) {
- return -1;
+ ldb_oom(ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
}
vals[1].length = strlen((char *)vals[1].data);
ret = ldb_modify(ldb, &msg);
- if (ret != 0) {
- return 1;
- }
-
- (*id)++;
-
- return 0;
+ return ret;
}
-static struct ldb_dn *samldb_search_domain(struct ldb_module *module, TALLOC_CTX *mem_ctx, const struct ldb_dn *dn)
+/*
+ allocate a new id, attempting to do it atomically
+ return 0 on failure, the id on success
+*/
+static int samldb_find_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
+ struct ldb_dn *dn, uint32_t *old_rid)
{
- TALLOC_CTX *local_ctx;
- struct ldb_dn *sdn;
+ const char * const attrs[2] = { "nextRid", NULL };
struct ldb_result *res = NULL;
- int ret = 0;
-
- local_ctx = talloc_new(mem_ctx);
- if (local_ctx == NULL) return NULL;
+ int ret;
+ const char *str;
- sdn = ldb_dn_copy(local_ctx, dn);
- do {
- ret = ldb_search(module->ldb, sdn, LDB_SCOPE_BASE, "objectClass=domain", NULL, &res);
- talloc_steal(local_ctx, res);
- if (ret == LDB_SUCCESS && res->count == 1)
- break;
- } while ((sdn = ldb_dn_get_parent(local_ctx, sdn)));
+ ret = ldb_search(module->ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ if (res->count != 1) {
+ talloc_free(res);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
- if (ret != LDB_SUCCESS || res->count != 1) {
- talloc_free(local_ctx);
- return NULL;
+ str = ldb_msg_find_attr_as_string(res->msgs[0], "nextRid", NULL);
+ if (str == NULL) {
+ ldb_asprintf_errstring(module->ldb,
+ "attribute nextRid not found in %s\n",
+ ldb_dn_get_linearized(dn));
+ talloc_free(res);
+ return LDB_ERR_OPERATIONS_ERROR;
}
- talloc_steal(mem_ctx, sdn);
- talloc_free(local_ctx);
+ *old_rid = strtol(str, NULL, 0);
+ talloc_free(res);
+ return LDB_SUCCESS;
+}
+
+static int samldb_allocate_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
+ struct ldb_dn *dn, const struct dom_sid *dom_sid,
+ struct dom_sid **new_sid)
+{
+ struct dom_sid *obj_sid;
+ uint32_t old_rid;
+ int ret;
+
+ ret = samldb_find_next_rid(module, mem_ctx, dn, &old_rid);
+ if (ret) {
+ return ret;
+ }
+
+ /* return the new object sid */
+ obj_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid);
+
+ *new_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid + 1);
+ if (!*new_sid) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
- return sdn;
+ ret = samldb_notice_sid(module, mem_ctx, *new_sid);
+ if (ret != 0) {
+ /* gah, there are conflicting sids.
+ * This is a critical situation it means that someone messed up with
+ * the DB and nextRid is not returning free RIDs, report an error
+ * and refuse to create any user until the problem is fixed */
+ ldb_asprintf_errstring(module->ldb,
+ "Critical Error: unconsistent DB, unable to retireve an unique RID to generate a new SID: %s",
+ ldb_errstring(module->ldb));
+ return ret;
+ }
+ return ret;
}
/* search the domain related to the provided dn
allocate a new RID for the domain
return the new sid string
*/
-static struct dom_sid *samldb_get_new_sid(struct ldb_module *module,
- TALLOC_CTX *mem_ctx, const struct ldb_dn *obj_dn)
+static int samldb_get_new_sid(struct ldb_module *module,
+ TALLOC_CTX *mem_ctx, struct ldb_dn *obj_dn,
+ struct ldb_dn *dom_dn,
+ struct dom_sid **sid)
{
const char * const attrs[2] = { "objectSid", NULL };
struct ldb_result *res = NULL;
- const struct ldb_dn *dom_dn;
- uint32_t rid;
int ret;
- struct dom_sid *dom_sid, *obj_sid;
+ struct dom_sid *dom_sid;
/* get the domain component part of the provided dn */
- /* FIXME: quick search here, I think we should use something like
- ldap_parse_dn here to be 100% sure we get the right domain dn */
-
- /* FIXME: "dc=" is probably not utf8 safe either,
- we need a multibyte safe substring search function here */
-
- dom_dn = samldb_search_domain(module, mem_ctx, obj_dn);
- if (dom_dn == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Invalid dn (%s) not child of a domain object!\n", ldb_dn_linearize(mem_ctx, obj_dn));
- return NULL;
- }
-
/* find the domain sid */
ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
- if (ret != LDB_SUCCESS || res->count != 1) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_get_new_sid: error retrieving domain sid!\n");
+ if (ret != LDB_SUCCESS) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_get_new_sid: error retrieving domain sid from %s: %s!\n",
+ ldb_dn_get_linearized(dom_dn),
+ ldb_errstring(module->ldb));
talloc_free(res);
- return NULL;
+ return ret;
+ }
+
+ if (res->count != 1) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_get_new_sid: error retrieving domain sid from %s: not found!\n",
+ ldb_dn_get_linearized(dom_dn));
+ talloc_free(res);
+ return LDB_ERR_CONSTRAINT_VIOLATION;
}
dom_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
if (dom_sid == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_get_new_sid: error retrieving domain sid!\n");
+ ldb_set_errstring(module->ldb, "samldb_get_new_sid: error parsing domain sid!\n");
talloc_free(res);
- return NULL;
+ return LDB_ERR_CONSTRAINT_VIOLATION;
}
/* allocate a new Rid for the domain */
- ret = samldb_allocate_next_rid(module->ldb, mem_ctx, dom_dn, &rid);
+ ret = samldb_allocate_next_rid(module, mem_ctx, dom_dn, dom_sid, sid);
if (ret != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s\n", ldb_dn_linearize(mem_ctx, dom_dn));
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_get_linearized(dom_dn), ldb_errstring(module->ldb));
talloc_free(res);
- return NULL;
+ return ret;
}
- /* return the new object sid */
- obj_sid = dom_sid_add_rid(mem_ctx, dom_sid, rid);
-
talloc_free(res);
- return obj_sid;
+ return ret;
}
-static char *samldb_generate_samAccountName(const void *mem_ctx) {
- char *name;
-
- name = talloc_strdup(mem_ctx, SAM_ACCOUNT_NAME_BASE);
- /* TODO: randomize name */
+/* If we are adding new users/groups, we need to update the nextRid
+ * attribute to be 'above' all incoming users RIDs. This tries to
+ * avoid clashes in future */
- return name;
-}
-
-/* if value is not null also check for attribute to have exactly that value */
-static struct ldb_message_element *samldb_find_attribute(const struct ldb_message *msg, const char *name, const char *value)
+int samldb_notice_sid(struct ldb_module *module,
+ TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
{
- int i, j;
+ int ret;
+ struct ldb_dn *dom_dn;
+ struct dom_sid *dom_sid;
+ const char *attrs[] = { NULL };
+ struct ldb_result *dom_res;
+ struct ldb_result *res;
+ uint32_t old_rid;
+
+ /* find if this SID already exists */
+ ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &res,
+ NULL, LDB_SCOPE_SUBTREE, attrs,
+ "(objectSid=%s)", ldap_encode_ndr_dom_sid(mem_ctx, sid));
+ if (ret == LDB_SUCCESS) {
+ if (res->count > 0) {
+ talloc_free(res);
+ ldb_asprintf_errstring(module->ldb,
+ "Attempt to add record with SID %s rejected,"
+ " because this SID is already in the database",
+ dom_sid_string(mem_ctx, sid));
+ /* We have a duplicate SID, we must reject the add */
+ return LDB_ERR_CONSTRAINT_VIOLATION;
+ }
+ talloc_free(res);
+ } else {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_notice_sid: error searching to see if sid %s is in use: %s\n",
+ dom_sid_string(mem_ctx, sid),
+ ldb_errstring(module->ldb));
+ return ret;
+ }
+
+ dom_sid = dom_sid_dup(mem_ctx, sid);
+ if (!dom_sid) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ /* get the domain component part of the provided SID */
+ dom_sid->num_auths--;
+
+ /* find the domain DN */
+ ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &dom_res,
+ NULL, LDB_SCOPE_SUBTREE, attrs,
+ "(&(objectSid=%s)(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain)))",
+ ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
+ if (ret == LDB_SUCCESS) {
+ if (dom_res->count == 0) {
+ talloc_free(dom_res);
+ /* This isn't an operation on a domain we know about, so nothing to update */
+ return LDB_SUCCESS;
+ }
- for (i = 0; i < msg->num_elements; i++) {
- if (ldb_attr_cmp(name, msg->elements[i].name) == 0) {
- if (!value) {
- return &msg->elements[i];
- }
- for (j = 0; j < msg->elements[i].num_values; j++) {
- if (strcasecmp(value,
- (char *)msg->elements[i].values[j].data) == 0) {
- return &msg->elements[i];
- }
- }
+ if (dom_res->count > 1) {
+ talloc_free(dom_res);
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_notice_sid: error retrieving domain from sid: duplicate (found %d) domain: %s!\n",
+ dom_res->count, dom_sid_string(dom_res, dom_sid));
+ return LDB_ERR_OPERATIONS_ERROR;
}
+ } else {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_notice_sid: error retrieving domain from sid: %s: %s\n",
+ dom_sid_string(dom_res, dom_sid),
+ ldb_errstring(module->ldb));
+ return ret;
}
- return NULL;
-}
+ dom_dn = dom_res->msgs[0]->dn;
-static BOOL samldb_msg_add_string(struct ldb_module *module, struct ldb_message *msg, const char *name, const char *value)
-{
- char *aname = talloc_strdup(msg, name);
- char *aval = talloc_strdup(msg, value);
-
- if (aname == NULL || aval == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_msg_add_string: talloc_strdup failed!\n");
- return False;
+ ret = samldb_find_next_rid(module, mem_ctx,
+ dom_dn, &old_rid);
+ if (ret) {
+ talloc_free(dom_res);
+ return ret;
}
- if (ldb_msg_add_string(msg, aname, aval) != 0) {
- return False;
+ if (old_rid <= sid->sub_auths[sid->num_auths - 1]) {
+ ret = samldb_set_next_rid(module->ldb, mem_ctx, dom_dn, old_rid,
+ sid->sub_auths[sid->num_auths - 1] + 1);
}
-
- return True;
+ talloc_free(dom_res);
+ return ret;
}
-static BOOL samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
+static int samldb_handle_sid(struct ldb_module *module,
+ TALLOC_CTX *mem_ctx, struct ldb_message *msg2,
+ struct ldb_dn *parent_dn)
{
- struct ldb_val v;
- NTSTATUS status;
- status = ndr_push_struct_blob(&v, msg, sid,
- (ndr_push_flags_fn_t)ndr_push_dom_sid);
- if (!NT_STATUS_IS_OK(status)) {
- return -1;
- }
- return (ldb_msg_add_value(msg, name, &v) == 0);
-}
+ int ret;
+
+ struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg2, "objectSid");
+ if (sid == NULL) {
+ ret = samldb_get_new_sid(module, msg2, msg2->dn, parent_dn, &sid);
+ if (ret != 0) {
+ return ret;
+ }
-static BOOL samldb_find_or_add_attribute(struct ldb_module *module, struct ldb_message *msg, const char *name, const char *value, const char *set_value)
-{
- if (samldb_find_attribute(msg, name, value) == NULL) {
- return samldb_msg_add_string(module, msg, name, set_value);
+ if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
+ talloc_free(sid);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ talloc_free(sid);
+ ret = LDB_SUCCESS;
+ } else {
+ ret = samldb_notice_sid(module, msg2, sid);
}
- return True;
+ return ret;
}
-static int samldb_copy_template(struct ldb_module *module, struct ldb_message *msg, const char *filter)
+static int samldb_generate_samAccountName(struct ldb_module *module, TALLOC_CTX *mem_ctx,
+ struct ldb_dn *dom_dn, char **name)
{
+ const char *attrs[] = { NULL };
struct ldb_result *res;
- struct ldb_message *t;
- int ret, i, j;
+ int ret;
-
- /* pull the template record */
- ret = ldb_search(module->ldb, NULL, LDB_SCOPE_SUBTREE, filter, NULL, &res);
- if (ret != LDB_SUCCESS || res->count != 1) {
- ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb: ERROR: template '%s' matched too many records\n", filter);
- return -1;
- }
- t = res->msgs[0];
-
- for (i = 0; i < t->num_elements; i++) {
- struct ldb_message_element *el = &t->elements[i];
- /* some elements should not be copied from the template */
- if (strcasecmp(el->name, "cn") == 0 ||
- strcasecmp(el->name, "name") == 0 ||
- strcasecmp(el->name, "sAMAccountName") == 0 ||
- strcasecmp(el->name, "objectGUID") == 0) {
- continue;
- }
- for (j = 0; j < el->num_values; j++) {
- if (strcasecmp(el->name, "objectClass") == 0) {
- if (strcasecmp((char *)el->values[j].data, "Template") == 0 ||
- strcasecmp((char *)el->values[j].data, "userTemplate") == 0 ||
- strcasecmp((char *)el->values[j].data, "groupTemplate") == 0 ||
- strcasecmp((char *)el->values[j].data, "foreignSecurityPrincipalTemplate") == 0 ||
- strcasecmp((char *)el->values[j].data, "aliasTemplate") == 0 ||
- strcasecmp((char *)el->values[j].data, "trustedDomainTemplate") == 0 ||
- strcasecmp((char *)el->values[j].data, "secretTemplate") == 0) {
- continue;
- }
- if ( ! samldb_find_or_add_attribute(module, msg, el->name,
- (char *)el->values[j].data,
- (char *)el->values[j].data)) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Attribute adding failed...\n");
- talloc_free(res);
- return -1;
- }
- } else {
- if ( ! samldb_find_or_add_attribute(module, msg, el->name,
- NULL,
- (char *)el->values[j].data)) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Attribute adding failed...\n");
- talloc_free(res);
- return -1;
- }
- }
+ /* Format: $000000-000000000000 */
+
+ do {
+ *name = talloc_asprintf(mem_ctx, "$%.6X-%.6X%.6X", (unsigned int)generate_random(), (unsigned int)generate_random(), (unsigned int)generate_random());
+ /* TODO: Figure out exactly what this is meant to conflict with */
+ ret = ldb_search_exp_fmt(module->ldb,
+ mem_ctx, &res, dom_dn, LDB_SCOPE_SUBTREE, attrs,
+ "samAccountName=%s",
+ ldb_binary_encode_string(mem_ctx, *name));
+ if (ret != LDB_SUCCESS) {
+ ldb_asprintf_errstring(module->ldb, "samldb: Failure searching to determine if samAccountName %s is unique: %s",
+ *name, ldb_errstring(module->ldb));
+ return ret;
}
- }
- talloc_free(res);
-
- return 0;
+ if (res->count == 0) {
+ talloc_free(res);
+ /* Great. There are no conflicting users/groups/etc */
+ return LDB_SUCCESS;
+ } else {
+ talloc_free(*name);
+ /* gah, there is a conflicting name, lets move around the loop again... */
+ }
+ } while (1);
}
-static struct ldb_message *samldb_fill_group_object(struct ldb_module *module, const struct ldb_message *msg)
+static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_message *msg,
+ struct ldb_message **ret_msg)
{
+ int ret;
+ unsigned int group_type;
+ char *name;
struct ldb_message *msg2;
- struct ldb_message_element *attribute;
- struct ldb_dn_component *rdn;
-
- if (samldb_find_attribute(msg, "objectclass", "group") == NULL) {
- return NULL;
+ struct ldb_dn *dom_dn;
+ const char *rdn_name;
+ TALLOC_CTX *mem_ctx = talloc_new(msg);
+ const char *errstr;
+ if (!mem_ctx) {
+ return LDB_ERR_OPERATIONS_ERROR;
}
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_group_object\n");
-
/* build the new msg */
- msg2 = ldb_msg_copy(module->ldb, msg);
+ msg2 = ldb_msg_copy(mem_ctx, msg);
if (!msg2) {
ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
- return NULL;
+ talloc_free(mem_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
}
- if (samldb_copy_template(module, msg2, "(&(CN=TemplateGroup)(objectclass=groupTemplate))") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_group_object: Error copying template!\n");
- return NULL;
+ ret = samdb_copy_template(module->ldb, msg2,
+ "group",
+ &errstr);
+ if (ret != 0) {
+
+ talloc_free(mem_ctx);
+ return ret;
}
- if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad DN (%s)!\n", ldb_dn_linearize(msg2, msg2->dn));
- return NULL;
+ rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+
+ if (strcasecmp(rdn_name, "cn") != 0) {
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn_name);
+ talloc_free(mem_ctx);
+ return LDB_ERR_CONSTRAINT_VIOLATION;
}
- if (strcasecmp(rdn->name, "cn") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn->name);
- return NULL;
+
+ ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
+ if (ret != LDB_SUCCESS) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_group_object: %s", errstr);
+ return ret;
}
- if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
- struct dom_sid *sid = samldb_get_new_sid(module, msg2, msg2->dn);
- if (sid == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: internal error! Can't generate new sid\n");
- return NULL;
+ /* Generate a random name, if no samAccountName was supplied */
+ if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
+ ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(mem_ctx);
+ return ret;
}
-
- if (!samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
- talloc_free(sid);
- return NULL;
+ ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
+ if (ret) {
+ talloc_free(mem_ctx);
+ return ret;
}
- talloc_free(sid);
}
-
- if ( ! samldb_find_or_add_attribute(module, msg2, "sAMAccountName", NULL, samldb_generate_samAccountName(msg2))) {
- return NULL;
+
+ if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
+ ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+ talloc_free(mem_ctx);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+ group_type = samdb_result_uint(msg2, "groupType", 0);
+ if (group_type == 0) {
+ ldb_asprintf_errstring(module->ldb, "groupType invalid");
+ talloc_free(mem_ctx);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ } else {
+ unsigned int account_type = samdb_gtype2atype(group_type);
+ ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
}
- talloc_steal(msg, msg2);
+ /* Manage SID allocation, conflicts etc */
+ ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn);
- return msg2;
+ if (ret == LDB_SUCCESS) {
+ talloc_steal(msg, msg2);
+ *ret_msg = msg2;
+ }
+ talloc_free(mem_ctx);
+ return ret;
}
-static struct ldb_message *samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg)
+static int samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg, struct ldb_message **ret_msg)
{
+ int ret;
+ char *name;
struct ldb_message *msg2;
- struct ldb_message_element *attribute;
- struct ldb_dn_component *rdn;
-
- if ((samldb_find_attribute(msg, "objectclass", "user") == NULL) &&
- (samldb_find_attribute(msg, "objectclass", "computer") == NULL)) {
- return NULL;
+ struct ldb_dn *dom_dn;
+ const char *rdn_name;
+ TALLOC_CTX *mem_ctx = talloc_new(msg);
+ const char *errstr;
+ unsigned int user_account_control;
+ if (!mem_ctx) {
+ return LDB_ERR_OPERATIONS_ERROR;
}
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_user_or_computer_object\n");
-
/* build the new msg */
- msg2 = ldb_msg_copy(module->ldb, msg);
+ msg2 = ldb_msg_copy(mem_ctx, msg);
if (!msg2) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
- return NULL;
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: ldb_msg_copy failed!\n");
+ talloc_free(mem_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
}
- if (samldb_find_attribute(msg, "objectclass", "computer") != NULL) {
- if (samldb_copy_template(module, msg2, "(&(CN=TemplateComputer)(objectclass=userTemplate))") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_user_or_computer_object: Error copying computer template!\n");
- return NULL;
- }
- } else {
- if (samldb_copy_template(module, msg2, "(&(CN=TemplateUser)(objectclass=userTemplate))") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_user_or_computer_object: Error copying user template!\n");
- return NULL;
- }
+ ret = samdb_copy_template(module->ldb, msg2,
+ "user",
+ &errstr);
+ if (ret) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
+ errstr);
+ talloc_free(mem_ctx);
+ return ret;
}
- if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
- return NULL;
- }
- if (strcasecmp(rdn->name, "cn") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: Bad RDN (%s) for user/computer!\n", rdn->name);
- return NULL;
+ rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+
+ if (strcasecmp(rdn_name, "cn") != 0) {
+ ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for user/computer, should be CN=!\n", rdn_name);
+ talloc_free(mem_ctx);
+ return LDB_ERR_CONSTRAINT_VIOLATION;
}
- /* if the only attribute was: "objectclass: computer", then make sure we also add "user" objectclass */
- if ( ! samldb_find_or_add_attribute(module, msg2, "objectclass", "user", "user")) {
- return NULL;
+ ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
+ if (ret != LDB_SUCCESS) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_user_or_computer_object: %s", errstr);
+ return ret;
}
- if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
- struct dom_sid *sid;
- sid = samldb_get_new_sid(module, msg2, msg2->dn);
- if (sid == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: internal error! Can't generate new sid\n");
- return NULL;
+ if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
+ ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(mem_ctx);
+ return ret;
}
-
- if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
- talloc_free(sid);
- return NULL;
+ ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
+ if (ret) {
+ talloc_free(mem_ctx);
+ return ret;
}
- talloc_free(sid);
}
- if ( ! samldb_find_or_add_attribute(module, msg2, "sAMAccountName", NULL, samldb_generate_samAccountName(msg2))) {
- return NULL;
+ if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
+ ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+ talloc_free(mem_ctx);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+ user_account_control = samdb_result_uint(msg2, "userAccountControl", 0);
+ if (user_account_control == 0) {
+ ldb_asprintf_errstring(module->ldb, "userAccountControl invalid");
+ talloc_free(mem_ctx);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ } else {
+ unsigned int account_type = samdb_uf2atype(user_account_control);
+ ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
}
- /*
- useraccountcontrol: setting value 0 gives 0x200 for users
- */
+ /* Manage SID allocation, conflicts etc */
+ ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn);
- /* TODO: objectCategory, userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
+ /* TODO: userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
- return msg2;
+ if (ret == 0) {
+ *ret_msg = msg2;
+ talloc_steal(msg, msg2);
+ }
+ talloc_free(mem_ctx);
+ return ret;
}
-
-static struct ldb_message *samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg)
+
+static int samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg,
+ struct ldb_message **ret_msg)
{
struct ldb_message *msg2;
- struct ldb_message_element *attribute;
- struct ldb_dn_component *rdn;
+ const char *rdn_name;
+ struct dom_sid *dom_sid;
+ struct dom_sid *sid;
+ const char *dom_attrs[] = { "name", NULL };
+ struct ldb_message **dom_msgs;
+ const char *errstr;
+ int ret;
- if (samldb_find_attribute(msg, "objectclass", "foreignSecurityPrincipal") == NULL) {
- return NULL;
+ TALLOC_CTX *mem_ctx = talloc_new(msg);
+ if (!mem_ctx) {
+ return LDB_ERR_OPERATIONS_ERROR;
}
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_fill_foreignSecurityPrincipal_object\n");
-
/* build the new msg */
- msg2 = ldb_msg_copy(module->ldb, msg);
+ msg2 = ldb_msg_copy(mem_ctx, msg);
if (!msg2) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincpal_object: ldb_msg_copy failed!\n");
- return NULL;
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: ldb_msg_copy failed!\n");
+ talloc_free(mem_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
}
- talloc_steal(msg, msg2);
-
- if (samldb_copy_template(module, msg2, "(&(CN=TemplateForeignSecurityPrincipal)(objectclass=foreignSecurityPrincipalTemplate))") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_WARNING, "samldb_fill_foreignSecurityPrincipal_object: Error copying template!\n");
- return NULL;
+ ret = samdb_copy_template(module->ldb, msg2,
+ "ForeignSecurityPrincipal",
+ &errstr);
+ if (ret != 0) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_foreignSecurityPrincipal_object: "
+ "Error copying template: %s",
+ errstr);
+ talloc_free(mem_ctx);
+ return ret;
}
- if ((rdn = ldb_dn_get_rdn(msg2, msg2->dn)) == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: Bad DN (%s)!\n", ldb_dn_linearize(msg2, msg2->dn));
- return NULL;
- }
- if (strcasecmp(rdn->name, "cn") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: Bad RDN (%s) for foreignSecurityPrincpal!\n", rdn->name);
- return NULL;
+ rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+
+ if (strcasecmp(rdn_name, "cn") != 0) {
+ ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for ForeignSecurityPrincipal, should be CN=!", rdn_name);
+ talloc_free(mem_ctx);
+ return LDB_ERR_CONSTRAINT_VIOLATION;
}
- if ((attribute = samldb_find_attribute(msg2, "objectSid", NULL)) == NULL ) {
- struct dom_sid *sid = dom_sid_parse_talloc(msg2, (char *)rdn->value.data);
- if (sid == NULL) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: internal error! Can't parse sid in CN\n");
- return NULL;
+ sid = samdb_result_dom_sid(msg2, msg, "objectSid");
+ if (!sid) {
+ /* Slightly different for the foreign sids. We don't want
+ * domain SIDs ending up there, it would cause all sorts of
+ * pain */
+
+ sid = dom_sid_parse_talloc(msg2, (const char *)ldb_dn_get_rdn_val(msg2->dn)->data);
+ if (!sid) {
+ ldb_set_errstring(module->ldb, "No valid found SID in ForeignSecurityPrincipal CN!");
+ talloc_free(mem_ctx);
+ return LDB_ERR_CONSTRAINT_VIOLATION;
}
- if (!samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
+ if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
talloc_free(sid);
- return NULL;
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ dom_sid = dom_sid_dup(mem_ctx, sid);
+ if (!dom_sid) {
+ talloc_free(mem_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ /* get the domain component part of the provided SID */
+ dom_sid->num_auths--;
+
+ /* find the domain DN */
+
+ ret = gendb_search(module->ldb,
+ mem_ctx, NULL, &dom_msgs, dom_attrs,
+ "(&(objectSid=%s)(objectclass=domain))",
+ ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
+ if (ret >= 1) {
+ /* We don't really like the idea of foreign sids that are not foreign, but it happens */
+ const char *name = samdb_result_string(dom_msgs[0], "name", NULL);
+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "NOTE (strange but valid): Adding foreign SID record with SID %s, but this domian (%s) is already in the database",
+ dom_sid_string(mem_ctx, sid), name);
+ } else if (ret == -1) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_foreignSecurityPrincipal_object: error searching for a domain with this sid: %s\n",
+ dom_sid_string(mem_ctx, dom_sid));
+ talloc_free(dom_msgs);
+ return LDB_ERR_OPERATIONS_ERROR;
}
- talloc_free(sid);
}
- return msg2;
+ /* This isn't an operation on a domain we know about, so just
+ * check for the SID, looking for duplicates via the common
+ * code */
+ ret = samldb_notice_sid(module, msg2, sid);
+ if (ret == 0) {
+ talloc_steal(msg, msg2);
+ *ret_msg = msg2;
+ }
+
+ return ret;
}
/* add_record */
+
+/*
+ * FIXME
+ *
+ * Actually this module is not async at all as it does a number of sync searches
+ * in the process. It still to be decided how to deal with it properly so it is
+ * left SYNC for now until we think of a good solution.
+ */
+
static int samldb_add(struct ldb_module *module, struct ldb_request *req)
{
const struct ldb_message *msg = req->op.add.message;
struct ldb_message *msg2 = NULL;
+ struct ldb_request *down_req;
int ret;
ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");
-
if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
return ldb_next_request(module, req);
}
- /* is user or computer? add all relevant missing objects */
- msg2 = samldb_fill_user_or_computer_object(module, msg);
+ /* is user or computer? */
+ if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) ||
+ (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
+ /* add all relevant missing objects */
+ ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
+ if (ret) {
+ return ret;
+ }
+ }
/* is group? add all relevant missing objects */
if ( ! msg2 ) {
- msg2 = samldb_fill_group_object(module, msg);
+ if (samdb_find_attribute(module->ldb, msg, "objectclass", "group") != NULL) {
+ ret = samldb_fill_group_object(module, msg, &msg2);
+ if (ret) {
+ return ret;
+ }
+ }
}
/* perhaps a foreignSecurityPrincipal? */
if ( ! msg2 ) {
- msg2 = samldb_fill_foreignSecurityPrincipal_object(module, msg);
+ if (samdb_find_attribute(module->ldb, msg, "objectclass", "foreignSecurityPrincipal") != NULL) {
+ ret = samldb_fill_foreignSecurityPrincipal_object(module, msg, &msg2);
+ if (ret) {
+ return ret;
+ }
+ }
}
- if (msg2) {
- req->op.add.message = msg2;
- ret = ldb_next_request(module, req);
- req->op.add.message = msg;
- } else {
- ret = ldb_next_request(module, req);
+ if (msg2 == NULL) {
+ return ldb_next_request(module, req);
}
- return ret;
-}
-
-static int samldb_destructor(void *module_ctx)
-{
- /* struct ldb_module *ctx = module_ctx; */
- /* put your clean-up functions here */
- return 0;
-}
+ down_req = talloc(req, struct ldb_request);
+ if (down_req == NULL) {
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
-static int samldb_request(struct ldb_module *module, struct ldb_request *req)
-{
- switch (req->operation) {
+ *down_req = *req;
+
+ down_req->op.add.message = talloc_steal(down_req, msg2);
- case LDB_REQ_ADD:
- return samldb_add(module, req);
+ ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
- default:
- return ldb_next_request(module, req);
+ /* go on with the call chain */
+ ret = ldb_next_request(module, down_req);
+ /* do not free down_req as the call results may be linked to it,
+ * it will be freed when the upper level request get freed */
+ if (ret == LDB_SUCCESS) {
+ req->handle = down_req->handle;
}
+
+ return ret;
}
-static const struct ldb_module_ops samldb_ops = {
- .name = "samldb",
- .request = samldb_request
-};
+/* modify */
+static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
+{
+ struct ldb_message *msg;
+ struct ldb_message_element *el, *el2;
+ int ret;
+ unsigned int group_type, user_account_control, account_type;
+ if (ldb_dn_is_special(req->op.mod.message->dn)) { /* do not manipulate our control entries */
+ return ldb_next_request(module, req);
+ }
+ if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
+ ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
-/* the init function */
-#ifdef HAVE_DLOPEN_DISABLED
- struct ldb_module *init_module(struct ldb_context *ldb, const char *options[])
-#else
-struct ldb_module *samldb_module_init(struct ldb_context *ldb, const char *options[])
-#endif
-{
- struct ldb_module *ctx;
+ el = ldb_msg_find_element(req->op.mod.message, "groupType");
+ if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+ req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+
+ group_type = strtoul((const char *)el->values[0].data, NULL, 0);
+ account_type = samdb_gtype2atype(group_type);
+ ret = samdb_msg_add_uint(module->ldb, msg, msg,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(msg, "sAMAccountType");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
+ }
- ctx = talloc(ldb, struct ldb_module);
- if (!ctx)
- return NULL;
+ el = ldb_msg_find_element(req->op.mod.message, "userAccountControl");
+ if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+ req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
- ctx->private_data = NULL;
- ctx->ldb = ldb;
- ctx->prev = ctx->next = NULL;
- ctx->ops = &samldb_ops;
+ user_account_control = strtoul((const char *)el->values[0].data, NULL, 0);
+ account_type = samdb_uf2atype(user_account_control);
+ ret = samdb_msg_add_uint(module->ldb, msg, msg,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(msg, "sAMAccountType");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
+ }
+ return ldb_next_request(module, req);
+}
- talloc_set_destructor(ctx, samldb_destructor);
- return ctx;
+static int samldb_init(struct ldb_module *module)
+{
+ return ldb_next_init(module);
}
+
+_PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
+ .name = "samldb",
+ .init_context = samldb_init,
+ .add = samldb_add,
+ .modify = samldb_modify
+};
git.samba.org / kai / samba.git / blobdiff