s4:drsuapi RPC server - fix "enum security_user_level" warning on Tru64
[nivanova/samba-autobuild/.git] / source4 / rpc_server / drsuapi / addentry.c
1 /* 
2    Unix SMB/CIFS implementation.
3
4    implement the DsAddEntry call
5
6    Copyright (C) Stefan Metzmacher 2009
7    Copyright (C) Andrew Tridgell   2009
8    
9    This program is free software; you can redistribute it and/or modify
10    it under the terms of the GNU General Public License as published by
11    the Free Software Foundation; either version 3 of the License, or
12    (at your option) any later version.
13    
14    This program is distributed in the hope that it will be useful,
15    but WITHOUT ANY WARRANTY; without even the implied warranty of
16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
17    GNU General Public License for more details.
18    
19    You should have received a copy of the GNU General Public License
20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "dsdb/common/util.h"
27 #include "param/param.h"
28 #include "libcli/security/security.h"
29 #include "libcli/security/session.h"
30 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
31 #include "librpc/gen_ndr/ndr_drsuapi.h"
32
33 /*
34   add special SPNs needed for DRS replication to machine accounts when
35   an AddEntry is done to create a nTDSDSA object
36  */
37 static WERROR drsuapi_add_SPNs(struct drsuapi_bind_state *b_state,
38                                struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
39                                const struct drsuapi_DsReplicaObjectListItem *first_object)
40 {
41         int ret;
42         const struct drsuapi_DsReplicaObjectListItem *obj;
43         const char *attrs[] = { "serverReference", "objectGUID", NULL };
44
45         for (obj = first_object; obj; obj=obj->next_object) {
46                 const char *dn_string = obj->object.identifier->dn;
47                 struct ldb_dn *dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, dn_string);
48                 struct ldb_result *res, *res2;
49                 struct ldb_dn *ref_dn;
50                 struct GUID ntds_guid;
51                 struct ldb_message *msg;
52                 struct ldb_message_element *el;
53                 const char *ntds_guid_str;
54                 const char *dom_string;
55                 const char *attrs2[] = { "dNSHostName", "cn", NULL };
56                 const char *dNSHostName, *cn;
57
58                 DEBUG(6,(__location__ ": Adding SPNs for %s\n", 
59                          ldb_dn_get_linearized(dn)));
60                  
61                 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res,
62                                  dn, LDB_SCOPE_BASE, attrs,
63                                  "(objectClass=ntDSDSA)");
64                 if (ret != LDB_SUCCESS || res->count < 1) {
65                         DEBUG(0,(__location__ ": Failed to find dn '%s'\n", dn_string));
66                         return WERR_DS_DRA_INTERNAL_ERROR;
67                 }
68
69                 ref_dn = samdb_result_dn(b_state->sam_ctx, mem_ctx, res->msgs[0], "serverReference", NULL);
70                 if (ref_dn == NULL) {
71                         /* we only add SPNs for objects with a
72                            serverReference */
73                         continue;
74                 }
75
76                 DEBUG(6,(__location__ ": serverReference %s\n", 
77                          ldb_dn_get_linearized(ref_dn)));
78
79                 ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
80
81                 ntds_guid_str = GUID_string(res, &ntds_guid);
82
83                 dom_string = lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx);
84
85                 /* get the dNSHostName and cn */
86                 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res2,
87                                  ref_dn, LDB_SCOPE_BASE, attrs2, NULL);
88                 if (ret != LDB_SUCCESS) {
89                         DEBUG(0,(__location__ ": Failed to find ref_dn '%s'\n",
90                                  ldb_dn_get_linearized(ref_dn)));
91                         return WERR_DS_DRA_INTERNAL_ERROR;
92                 }
93
94                 dNSHostName = ldb_msg_find_attr_as_string(res2->msgs[0], "dNSHostName", NULL);
95                 cn = ldb_msg_find_attr_as_string(res2->msgs[0], "cn", NULL);
96
97                 /*
98                  * construct a modify request to add the new SPNs to
99                  * the machine account
100                  */
101                 msg = ldb_msg_new(mem_ctx);
102                 if (msg == NULL) {
103                         return WERR_NOMEM;
104                 }
105
106                 msg->dn = ref_dn;
107                 ret = ldb_msg_add_empty(msg, "servicePrincipalName",
108                                         LDB_FLAG_MOD_ADD, &el);
109                 if (ret != LDB_SUCCESS) {
110                         return WERR_NOMEM;
111                 }
112
113
114                 ldb_msg_add_steal_string(msg, "servicePrincipalName",
115                                          talloc_asprintf(el->values,
116                                                          "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
117                                                          ntds_guid_str, dom_string));
118                 ldb_msg_add_steal_string(msg, "servicePrincipalName",
119                                          talloc_asprintf(el->values, "ldap/%s._msdcs.%s",
120                                                          ntds_guid_str, dom_string));
121                 if (cn) {
122                         ldb_msg_add_steal_string(msg, "servicePrincipalName",
123                                                  talloc_asprintf(el->values, "ldap/%s", cn));
124                 }
125                 if (dNSHostName) {
126                         ldb_msg_add_steal_string(msg, "servicePrincipalName",
127                                                  talloc_asprintf(el->values, "ldap/%s", dNSHostName));
128                 }
129                 if (el->num_values < 2) {
130                         return WERR_NOMEM;
131                 }
132
133                 ret = dsdb_modify(b_state->sam_ctx, msg, DSDB_MODIFY_PERMISSIVE);
134                 if (ret != LDB_SUCCESS) {
135                         DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
136                                  ldb_errstring(b_state->sam_ctx)));
137                         return WERR_DS_DRA_INTERNAL_ERROR;
138                 }
139         }
140         
141         return WERR_OK;
142 }
143
144
145
146
147 /* 
148   drsuapi_DsAddEntry
149 */
150 WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
151                                  struct drsuapi_DsAddEntry *r)
152 {
153         WERROR status;
154         struct drsuapi_bind_state *b_state;
155         struct dcesrv_handle *h;
156         uint32_t num = 0;
157         struct drsuapi_DsReplicaObjectIdentifier2 *ids = NULL;
158         int ret;
159         const struct drsuapi_DsReplicaObjectListItem *first_object;
160
161         if (DEBUGLVL(4)) {
162                 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry, NDR_IN, r);
163         }
164
165         /* TODO: check which out level the client supports */
166
167         ZERO_STRUCTP(r->out.ctr);
168         *r->out.level_out = 3;
169         r->out.ctr->ctr3.err_ver = 1;
170         r->out.ctr->ctr3.err_data = talloc_zero(mem_ctx, union drsuapi_DsAddEntry_ErrData);
171
172         DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
173         b_state = h->data;
174
175         status = drs_security_level_check(dce_call, "DsAddEntry", SECURITY_DOMAIN_CONTROLLER, NULL);
176         if (!W_ERROR_IS_OK(status)) {
177                 return status;
178         }
179
180         switch (r->in.level) {
181         case 2:
182                 ret = ldb_transaction_start(b_state->sam_ctx);
183                 if (ret != LDB_SUCCESS) {
184                         return WERR_DS_DRA_INTERNAL_ERROR;
185                 }
186
187
188                 first_object = &r->in.req->req2.first_object;
189
190                 status = dsdb_origin_objects_commit(b_state->sam_ctx,
191                                                     mem_ctx,
192                                                     first_object,
193                                                     &num,
194                                                     &ids);
195                 if (!W_ERROR_IS_OK(status)) {
196                         r->out.ctr->ctr3.err_data->v1.status = status;
197                         ldb_transaction_cancel(b_state->sam_ctx);
198                         DEBUG(0,(__location__ ": DsAddEntry failed - %s\n", win_errstr(status)));
199                         return status;
200                 }
201
202                 r->out.ctr->ctr3.count = num;
203                 r->out.ctr->ctr3.objects = ids;
204
205                 break;
206         default:
207                 return WERR_FOOBAR;
208         }
209
210         /* if any of the added entries are nTDSDSA objects then we
211          * need to add the SPNs to the machine account
212          */
213         status = drsuapi_add_SPNs(b_state, dce_call, mem_ctx, first_object);
214         if (!W_ERROR_IS_OK(status)) {
215                 r->out.ctr->ctr3.err_data->v1.status = status;
216                 ldb_transaction_cancel(b_state->sam_ctx);
217                 DEBUG(0,(__location__ ": DsAddEntry add SPNs failed - %s\n", win_errstr(status)));
218                 return status;
219         }
220
221         ret = ldb_transaction_commit(b_state->sam_ctx);
222         if (ret != LDB_SUCCESS) {
223                 DEBUG(0,(__location__ ": DsAddEntry commit failed: %s\n",
224                          ldb_errstring(b_state->sam_ctx)));
225                 return WERR_DS_DRA_INTERNAL_ERROR;
226         }
227
228         return WERR_OK;
229 }