Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
* NOTICE: this module is NOT released under the GNU LGPL license as
- * other ldb code. This module is release under the GNU GPL v2 or
+ * other ldb code. This module is release under the GNU GPL v3 or
* later license.
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
/*
*/
#include "includes.h"
-#include "libcli/ldap/ldap.h"
+#include "libcli/ldap/ldap_ndr.h"
#include "lib/ldb/include/ldb_errors.h"
+#include "lib/ldb/include/ldb.h"
#include "lib/ldb/include/ldb_private.h"
#include "dsdb/samdb/samdb.h"
#include "libcli/security/security.h"
#include "librpc/gen_ndr/ndr_security.h"
-#include "db_wrap.h"
+#include "util/util_ldb.h"
int samldb_notice_sid(struct ldb_module *module,
TALLOC_CTX *mem_ctx, const struct dom_sid *sid);
-static BOOL samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
+static bool samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
{
struct ldb_val v;
- NTSTATUS status;
- status = ndr_push_struct_blob(&v, msg, sid,
- (ndr_push_flags_fn_t)ndr_push_dom_sid);
- if (!NT_STATUS_IS_OK(status)) {
- return -1;
+ enum ndr_err_code ndr_err;
+
+ ndr_err = ndr_push_struct_blob(&v, msg, NULL, sid,
+ (ndr_push_flags_fn_t)ndr_push_dom_sid);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return false;
}
- return (ldb_msg_add_value(msg, name, &v) == 0);
+ return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
}
/*
return 0 on failure, the id on success
*/
static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
- const struct ldb_dn *dn, uint32_t old_id, uint32_t new_id)
+ struct ldb_dn *dn, uint32_t old_id, uint32_t new_id)
{
struct ldb_message msg;
int ret;
if (new_id == 0) {
/* out of IDs ! */
- ldb_debug(ldb, LDB_DEBUG_FATAL, "Are we out of valid IDs ?\n");
+ ldb_set_errstring(ldb, "Are we out of valid IDs ?\n");
return LDB_ERR_OPERATIONS_ERROR;
}
ZERO_STRUCT(msg);
msg.dn = ldb_dn_copy(mem_ctx, dn);
if (!msg.dn) {
+ ldb_oom(ldb);
return LDB_ERR_OPERATIONS_ERROR;
}
msg.num_elements = 2;
els[0].flags = LDB_FLAG_MOD_DELETE;
els[0].name = talloc_strdup(mem_ctx, "nextRid");
if (!els[0].name) {
+ ldb_oom(ldb);
return LDB_ERR_OPERATIONS_ERROR;
}
vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", old_id);
if (!vals[0].data) {
+ ldb_oom(ldb);
return LDB_ERR_OPERATIONS_ERROR;
}
vals[0].length = strlen((char *)vals[0].data);
vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", new_id);
if (!vals[1].data) {
+ ldb_oom(ldb);
return LDB_ERR_OPERATIONS_ERROR;
}
vals[1].length = strlen((char *)vals[1].data);
return 0 on failure, the id on success
*/
static int samldb_find_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
- const struct ldb_dn *dn, uint32_t *old_rid)
+ struct ldb_dn *dn, uint32_t *old_rid)
{
const char * const attrs[2] = { "nextRid", NULL };
struct ldb_result *res = NULL;
if (ret != LDB_SUCCESS) {
return ret;
}
- talloc_steal(mem_ctx, res);
if (res->count != 1) {
talloc_free(res);
return LDB_ERR_OPERATIONS_ERROR;
if (str == NULL) {
ldb_asprintf_errstring(module->ldb,
"attribute nextRid not found in %s\n",
- ldb_dn_linearize(res, dn));
+ ldb_dn_get_linearized(dn));
talloc_free(res);
return LDB_ERR_OPERATIONS_ERROR;
}
}
static int samldb_allocate_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
- const struct ldb_dn *dn, const struct dom_sid *dom_sid,
+ struct ldb_dn *dn, const struct dom_sid *dom_sid,
struct dom_sid **new_sid)
{
struct dom_sid *obj_sid;
return ret;
}
-/* Find a domain object in the parents of a particular DN. */
-static struct ldb_dn *samldb_search_domain(struct ldb_module *module, TALLOC_CTX *mem_ctx, const struct ldb_dn *dn)
-{
- TALLOC_CTX *local_ctx;
- struct ldb_dn *sdn;
- struct ldb_result *res = NULL;
- int ret = 0;
- const char *attrs[] = { NULL };
-
- local_ctx = talloc_new(mem_ctx);
- if (local_ctx == NULL) return NULL;
-
- sdn = ldb_dn_copy(local_ctx, dn);
- do {
- ret = ldb_search(module->ldb, sdn, LDB_SCOPE_BASE,
- "(|(objectClass=domain)(objectClass=builtinDomain))", attrs, &res);
- talloc_steal(local_ctx, res);
- if (ret == LDB_SUCCESS && res->count == 1)
- break;
- } while ((sdn = ldb_dn_get_parent(local_ctx, sdn)));
-
- if (ret != LDB_SUCCESS || res->count != 1) {
- talloc_free(local_ctx);
- return NULL;
- }
-
- talloc_steal(mem_ctx, sdn);
- talloc_free(local_ctx);
-
- return sdn;
-}
-
/* search the domain related to the provided dn
allocate a new RID for the domain
return the new sid string
*/
static int samldb_get_new_sid(struct ldb_module *module,
- TALLOC_CTX *mem_ctx, const struct ldb_dn *obj_dn,
+ TALLOC_CTX *mem_ctx, struct ldb_dn *obj_dn,
+ struct ldb_dn *dom_dn,
struct dom_sid **sid)
{
const char * const attrs[2] = { "objectSid", NULL };
struct ldb_result *res = NULL;
- const struct ldb_dn *dom_dn;
int ret;
struct dom_sid *dom_sid;
/* get the domain component part of the provided dn */
- dom_dn = samldb_search_domain(module, mem_ctx, obj_dn);
- if (dom_dn == NULL) {
- ldb_asprintf_errstring(module->ldb,
- "Invalid dn (%s) not child of a domain object!\n",
- ldb_dn_linearize(mem_ctx, obj_dn));
- return LDB_ERR_CONSTRAINT_VIOLATION;
- }
-
/* find the domain sid */
ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(module->ldb,
"samldb_get_new_sid: error retrieving domain sid from %s: %s!\n",
- ldb_dn_linearize(mem_ctx, dom_dn),
+ ldb_dn_get_linearized(dom_dn),
ldb_errstring(module->ldb));
talloc_free(res);
return ret;
if (res->count != 1) {
ldb_asprintf_errstring(module->ldb,
"samldb_get_new_sid: error retrieving domain sid from %s: not found!\n",
- ldb_dn_linearize(mem_ctx, dom_dn));
+ ldb_dn_get_linearized(dom_dn));
+ talloc_free(res);
return LDB_ERR_CONSTRAINT_VIOLATION;
}
/* allocate a new Rid for the domain */
ret = samldb_allocate_next_rid(module, mem_ctx, dom_dn, dom_sid, sid);
if (ret != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_linearize(mem_ctx, dom_dn), ldb_errstring(module->ldb));
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_get_linearized(dom_dn), ldb_errstring(module->ldb));
talloc_free(res);
return ret;
}
struct ldb_result *dom_res;
struct ldb_result *res;
uint32_t old_rid;
- char *filter;
/* find if this SID already exists */
-
- filter = talloc_asprintf(mem_ctx, "(objectSid=%s)",
- ldap_encode_ndr_dom_sid(mem_ctx, sid));
-
- ret = ldb_search(module->ldb, samdb_base_dn(mem_ctx), LDB_SCOPE_SUBTREE, filter, attrs, &res);
+ ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &res,
+ NULL, LDB_SCOPE_SUBTREE, attrs,
+ "(objectSid=%s)", ldap_encode_ndr_dom_sid(mem_ctx, sid));
if (ret == LDB_SUCCESS) {
if (res->count > 0) {
talloc_free(res);
dom_sid->num_auths--;
/* find the domain DN */
-
- filter = talloc_asprintf(mem_ctx, "(&(objectSid=%s)(objectclass=domain))",
+ ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &dom_res,
+ NULL, LDB_SCOPE_SUBTREE, attrs,
+ "(&(objectSid=%s)(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain)))",
ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
-
- ret = ldb_search(module->ldb, samdb_base_dn(mem_ctx), LDB_SCOPE_SUBTREE, filter, attrs, &dom_res);
if (ret == LDB_SUCCESS) {
- talloc_steal(mem_ctx, dom_res);
if (dom_res->count == 0) {
talloc_free(dom_res);
/* This isn't an operation on a domain we know about, so nothing to update */
}
static int samldb_handle_sid(struct ldb_module *module,
- TALLOC_CTX *mem_ctx, struct ldb_message *msg2)
+ TALLOC_CTX *mem_ctx, struct ldb_message *msg2,
+ struct ldb_dn *parent_dn)
{
int ret;
struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg2, "objectSid");
if (sid == NULL) {
- ret = samldb_get_new_sid(module, msg2, msg2->dn, &sid);
+ ret = samldb_get_new_sid(module, msg2, msg2->dn, parent_dn, &sid);
if (ret != 0) {
return ret;
}
return ret;
}
-static char *samldb_generate_samAccountName(struct ldb_module *module, TALLOC_CTX *mem_ctx)
+static int samldb_generate_samAccountName(struct ldb_module *module, TALLOC_CTX *mem_ctx,
+ struct ldb_dn *dom_dn, char **name)
{
- char *name;
const char *attrs[] = { NULL };
- struct ldb_message **msgs;
+ struct ldb_result *res;
int ret;
/* Format: $000000-000000000000 */
do {
- name = talloc_asprintf(mem_ctx, "$%.6X-%.6X%.6X", (unsigned int)random(), (unsigned int)random(), (unsigned int)random());
+ *name = talloc_asprintf(mem_ctx, "$%.6X-%.6X%.6X", (unsigned int)generate_random(), (unsigned int)generate_random(), (unsigned int)generate_random());
/* TODO: Figure out exactly what this is meant to conflict with */
- ret = gendb_search(module->ldb,
- mem_ctx, NULL, &msgs, attrs,
- "samAccountName=%s",
- ldb_binary_encode_string(mem_ctx, name));
- if (ret == 0) {
+ ret = ldb_search_exp_fmt(module->ldb,
+ mem_ctx, &res, dom_dn, LDB_SCOPE_SUBTREE, attrs,
+ "samAccountName=%s",
+ ldb_binary_encode_string(mem_ctx, *name));
+ if (ret != LDB_SUCCESS) {
+ ldb_asprintf_errstring(module->ldb, "samldb: Failure searching to determine if samAccountName %s is unique: %s",
+ *name, ldb_errstring(module->ldb));
+ return ret;
+ }
+
+ if (res->count == 0) {
+ talloc_free(res);
/* Great. There are no conflicting users/groups/etc */
- return name;
- } else if (ret == -1) {
- /* Bugger, there is a problem, and we don't know what it is until gendb_search improves */
- return NULL;
+ return LDB_SUCCESS;
} else {
- talloc_free(name);
- /* gah, there are conflicting sids, lets move around the loop again... */
+ talloc_free(*name);
+ /* gah, there is a conflicting name, lets move around the loop again... */
}
} while (1);
}
struct ldb_message **ret_msg)
{
int ret;
- const char *name;
+ unsigned int group_type;
+ char *name;
struct ldb_message *msg2;
- struct ldb_dn_component *rdn;
+ struct ldb_dn *dom_dn;
+ const char *rdn_name;
TALLOC_CTX *mem_ctx = talloc_new(msg);
- char *errstr;
+ const char *errstr;
if (!mem_ctx) {
return LDB_ERR_OPERATIONS_ERROR;
}
}
ret = samdb_copy_template(module->ldb, msg2,
- "(&(CN=TemplateGroup)(objectclass=groupTemplate))",
+ "group",
&errstr);
if (ret != 0) {
return ret;
}
- rdn = ldb_dn_get_rdn(msg2, msg2->dn);
+ rdn_name = ldb_dn_get_rdn_name(msg2->dn);
- if (strcasecmp(rdn->name, "cn") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn->name);
+ if (strcasecmp(rdn_name, "cn") != 0) {
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn_name);
talloc_free(mem_ctx);
return LDB_ERR_CONSTRAINT_VIOLATION;
}
+ ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
+ if (ret != LDB_SUCCESS) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_group_object: %s", errstr);
+ return ret;
+ }
+
/* Generate a random name, if no samAccountName was supplied */
if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
- name = samldb_generate_samAccountName(module, mem_ctx);
- if (!name) {
+ ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
+ if (ret != LDB_SUCCESS) {
talloc_free(mem_ctx);
- return LDB_ERR_OPERATIONS_ERROR;
+ return ret;
}
ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
if (ret) {
}
}
+ if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
+ ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+ talloc_free(mem_ctx);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+ group_type = samdb_result_uint(msg2, "groupType", 0);
+ if (group_type == 0) {
+ ldb_asprintf_errstring(module->ldb, "groupType invalid");
+ talloc_free(mem_ctx);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ } else {
+ unsigned int account_type = samdb_gtype2atype(group_type);
+ ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+
/* Manage SID allocation, conflicts etc */
- ret = samldb_handle_sid(module, mem_ctx, msg2);
+ ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn);
if (ret == LDB_SUCCESS) {
talloc_steal(msg, msg2);
return ret;
}
-static int samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg,
- struct ldb_message **ret_msg)
+static int samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg, struct ldb_message **ret_msg)
{
int ret;
char *name;
struct ldb_message *msg2;
- struct ldb_dn_component *rdn;
+ struct ldb_dn *dom_dn;
+ const char *rdn_name;
TALLOC_CTX *mem_ctx = talloc_new(msg);
- char *errstr;
+ const char *errstr;
+ unsigned int user_account_control;
if (!mem_ctx) {
return LDB_ERR_OPERATIONS_ERROR;
}
/* build the new msg */
msg2 = ldb_msg_copy(mem_ctx, msg);
if (!msg2) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: ldb_msg_copy failed!\n");
talloc_free(mem_ctx);
return LDB_ERR_OPERATIONS_ERROR;
}
- if (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL) {
-
- ret = samdb_copy_template(module->ldb, msg2,
- "(&(CN=TemplateComputer)(objectclass=userTemplate))",
- &errstr);
- if (ret) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_fill_user_or_computer_object: "
- "Error copying computer template: %s",
- errstr);
- talloc_free(mem_ctx);
- return ret;
- }
-
- /* readd user and then computer objectclasses */
- ret = samdb_find_or_add_value(module->ldb, msg2, "objectclass", "user");
- if (ret) {
- talloc_free(mem_ctx);
- return ret;
- }
- ret = samdb_find_or_add_value(module->ldb, msg2, "objectclass", "computer");
- if (ret) {
- talloc_free(mem_ctx);
- return ret;
- }
-
- } else {
- ret = samdb_copy_template(module->ldb, msg2,
- "(&(CN=TemplateUser)(objectclass=userTemplate))",
- &errstr);
- if (ret) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
- errstr);
- talloc_free(mem_ctx);
- return ret;
- }
- /* readd user objectclass */
- ret = samdb_find_or_add_value(module->ldb, msg2, "objectclass", "user");
- if (ret) {
- talloc_free(mem_ctx);
- return ret;
- }
+ ret = samdb_copy_template(module->ldb, msg2,
+ "user",
+ &errstr);
+ if (ret) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
+ errstr);
+ talloc_free(mem_ctx);
+ return ret;
}
- rdn = ldb_dn_get_rdn(msg2, msg2->dn);
+ rdn_name = ldb_dn_get_rdn_name(msg2->dn);
- if (strcasecmp(rdn->name, "cn") != 0) {
- ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for user/computer, should be CN=!\n", rdn->name);
+ if (strcasecmp(rdn_name, "cn") != 0) {
+ ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for user/computer, should be CN=!\n", rdn_name);
talloc_free(mem_ctx);
return LDB_ERR_CONSTRAINT_VIOLATION;
}
+ ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
+ if (ret != LDB_SUCCESS) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_user_or_computer_object: %s", errstr);
+ return ret;
+ }
+
if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
- name = samldb_generate_samAccountName(module, mem_ctx);
- if (!name) {
+ ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
+ if (ret != LDB_SUCCESS) {
talloc_free(mem_ctx);
- return LDB_ERR_OPERATIONS_ERROR;
+ return ret;
}
ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
if (ret) {
}
}
- /*
- TODO: useraccountcontrol: setting value 0 gives 0x200 for users
- */
+ if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
+ ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+ talloc_free(mem_ctx);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+ user_account_control = samdb_result_uint(msg2, "userAccountControl", 0);
+ if (user_account_control == 0) {
+ ldb_asprintf_errstring(module->ldb, "userAccountControl invalid");
+ talloc_free(mem_ctx);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ } else {
+ unsigned int account_type = samdb_uf2atype(user_account_control);
+ ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
/* Manage SID allocation, conflicts etc */
- ret = samldb_handle_sid(module, mem_ctx, msg2);
+ ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn);
- /* TODO: objectCategory, userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
+ /* TODO: userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
if (ret == 0) {
*ret_msg = msg2;
struct ldb_message **ret_msg)
{
struct ldb_message *msg2;
- struct ldb_dn_component *rdn;
+ const char *rdn_name;
struct dom_sid *dom_sid;
struct dom_sid *sid;
const char *dom_attrs[] = { "name", NULL };
struct ldb_message **dom_msgs;
- char *errstr;
+ const char *errstr;
int ret;
TALLOC_CTX *mem_ctx = talloc_new(msg);
/* build the new msg */
msg2 = ldb_msg_copy(mem_ctx, msg);
if (!msg2) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincpal_object: ldb_msg_copy failed!\n");
+ ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: ldb_msg_copy failed!\n");
talloc_free(mem_ctx);
return LDB_ERR_OPERATIONS_ERROR;
}
ret = samdb_copy_template(module->ldb, msg2,
- "(&(CN=TemplateForeignSecurityPrincipal)(objectclass=foreignSecurityPrincipalTemplate))",
+ "ForeignSecurityPrincipal",
&errstr);
if (ret != 0) {
ldb_asprintf_errstring(module->ldb,
return ret;
}
- rdn = ldb_dn_get_rdn(msg2, msg2->dn);
+ rdn_name = ldb_dn_get_rdn_name(msg2->dn);
- if (strcasecmp(rdn->name, "cn") != 0) {
- ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for ForeignSecurityPrincipal, should be CN=!", rdn->name);
+ if (strcasecmp(rdn_name, "cn") != 0) {
+ ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for ForeignSecurityPrincipal, should be CN=!", rdn_name);
talloc_free(mem_ctx);
return LDB_ERR_CONSTRAINT_VIOLATION;
}
- /* Slightly different for the foreign sids. We don't want
- * domain SIDs ending up there, it would cause all sorts of
- * pain */
-
- sid = dom_sid_parse_talloc(msg2, (const char *)rdn->value.data);
+ sid = samdb_result_dom_sid(msg2, msg, "objectSid");
if (!sid) {
- ldb_set_errstring(module->ldb, "No valid found SID in ForeignSecurityPrincipal CN!");
- talloc_free(mem_ctx);
- return LDB_ERR_CONSTRAINT_VIOLATION;
- }
+ /* Slightly different for the foreign sids. We don't want
+ * domain SIDs ending up there, it would cause all sorts of
+ * pain */
- if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
- talloc_free(sid);
- return LDB_ERR_OPERATIONS_ERROR;
- }
+ sid = dom_sid_parse_talloc(msg2, (const char *)ldb_dn_get_rdn_val(msg2->dn)->data);
+ if (!sid) {
+ ldb_set_errstring(module->ldb, "No valid found SID in ForeignSecurityPrincipal CN!");
+ talloc_free(mem_ctx);
+ return LDB_ERR_CONSTRAINT_VIOLATION;
+ }
- dom_sid = dom_sid_dup(mem_ctx, sid);
- if (!dom_sid) {
- talloc_free(mem_ctx);
- return LDB_ERR_OPERATIONS_ERROR;
- }
- /* get the domain component part of the provided SID */
- dom_sid->num_auths--;
+ if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
+ talloc_free(sid);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
- /* find the domain DN */
+ dom_sid = dom_sid_dup(mem_ctx, sid);
+ if (!dom_sid) {
+ talloc_free(mem_ctx);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ /* get the domain component part of the provided SID */
+ dom_sid->num_auths--;
- ret = gendb_search(module->ldb,
- mem_ctx, NULL, &dom_msgs, dom_attrs,
- "(&(objectSid=%s)(objectclass=domain))",
- ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
- if (ret >= 1) {
- /* We don't really like the idea of foreign sids that are not foreign, but it happens */
- const char *name = samdb_result_string(dom_msgs[0], "name", NULL);
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "NOTE (strange but valid): Adding foreign SID record with SID %s, but this domian (%s) is already in the database",
- dom_sid_string(mem_ctx, sid), name);
- } else if (ret == -1) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_fill_foreignSecurityPrincipal_object: error searching for a domain with this sid: %s\n",
- dom_sid_string(mem_ctx, dom_sid));
- talloc_free(dom_msgs);
- return LDB_ERR_OPERATIONS_ERROR;
+ /* find the domain DN */
+
+ ret = gendb_search(module->ldb,
+ mem_ctx, NULL, &dom_msgs, dom_attrs,
+ "(&(objectSid=%s)(objectclass=domain))",
+ ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
+ if (ret >= 1) {
+ /* We don't really like the idea of foreign sids that are not foreign, but it happens */
+ const char *name = samdb_result_string(dom_msgs[0], "name", NULL);
+ ldb_debug(module->ldb, LDB_DEBUG_TRACE, "NOTE (strange but valid): Adding foreign SID record with SID %s, but this domian (%s) is already in the database",
+ dom_sid_string(mem_ctx, sid), name);
+ } else if (ret == -1) {
+ ldb_asprintf_errstring(module->ldb,
+ "samldb_fill_foreignSecurityPrincipal_object: error searching for a domain with this sid: %s\n",
+ dom_sid_string(mem_ctx, dom_sid));
+ talloc_free(dom_msgs);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
}
/* This isn't an operation on a domain we know about, so just
}
/* is user or computer? */
- if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) ||
+ if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) ||
(samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
/* add all relevant missing objects */
ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
return ldb_next_request(module, req);
}
- down_req = talloc(module, struct ldb_request);
+ down_req = talloc(req, struct ldb_request);
if (down_req == NULL) {
return LDB_ERR_OPERATIONS_ERROR;
}
return ret;
}
+/* modify */
+static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
+{
+ struct ldb_message *msg;
+ struct ldb_message_element *el, *el2;
+ int ret;
+ unsigned int group_type, user_account_control, account_type;
+ if (ldb_dn_is_special(req->op.mod.message->dn)) { /* do not manipulate our control entries */
+ return ldb_next_request(module, req);
+ }
+
+ if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
+ ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+ el = ldb_msg_find_element(req->op.mod.message, "groupType");
+ if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+ req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+
+ group_type = strtoul((const char *)el->values[0].data, NULL, 0);
+ account_type = samdb_gtype2atype(group_type);
+ ret = samdb_msg_add_uint(module->ldb, msg, msg,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(msg, "sAMAccountType");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
+ }
+
+ el = ldb_msg_find_element(req->op.mod.message, "userAccountControl");
+ if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+ req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+
+ user_account_control = strtoul((const char *)el->values[0].data, NULL, 0);
+ account_type = samdb_uf2atype(user_account_control);
+ ret = samdb_msg_add_uint(module->ldb, msg, msg,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(msg, "sAMAccountType");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
+ }
+ return ldb_next_request(module, req);
+}
+
+
static int samldb_init(struct ldb_module *module)
{
return ldb_next_init(module);
}
-static const struct ldb_module_ops samldb_ops = {
+_PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
.name = "samldb",
.init_context = samldb_init,
.add = samldb_add,
+ .modify = samldb_modify
};
-
-
-int samldb_module_init(void)
-{
- return ldb_register_module(&samldb_ops);
-}