s4:objectclass LDB module - consider the "instanceType" when adding NCs

This is requested by MS-ADTS 3.1.1.5.2.2 (NC add operation).

diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c
index b71f91f18560b64384bb31d6f2bd33f285608cfc..44d8889dd50f56fe2a7fee67c35d9bef02681ab9 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/objectclass.c
+++ b/source4/dsdb/samdb/ldb_modules/objectclass.c
@@ -374,11 +374,14 @@ static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
                return ldb_next_request(module, req);
        }
 
-       /* An add operation on the root basedn has a special handling when the
-        * relax control isn't specified. */
-       if (ldb_dn_compare(ldb_get_root_basedn(ldb), req->op.add.message->dn) == 0) {
-               if (ldb_request_get_control(req,
-                                           LDB_CONTROL_RELAX_OID) == NULL) {
+       /* An add operation on the basedn without "NC-add" operation isn't
+        * allowed. */
+       if (ldb_dn_compare(ldb_get_default_basedn(ldb), req->op.add.message->dn) == 0) {
+               unsigned int instanceType;
+
+               instanceType = ldb_msg_find_attr_as_uint(req->op.add.message,
+                                                        "instanceType", 0);
+               if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
                        /* When we are trying to readd the root basedn then
                         * this is denied, but with an interesting mechanism:
                         * there is generated a referral with the last
@@ -457,15 +460,20 @@ static int objectclass_do_add(struct oc_context *ac)
        /* Check if we have a valid parent - this check is needed since
         * we don't get a LDB_ERR_NO_SUCH_OBJECT error. */
        if (ac->search_res == NULL) {
-               if (ldb_dn_compare(ldb_get_root_basedn(ldb), msg->dn) == 0) {
-                       /* Allow the tree to be started but don't keep any
-                        * error strings - they're meaningless. */
-                       ldb_set_errstring(ldb, NULL);
-               } else {
+               unsigned int instanceType;
+
+               /* An add operation on partition DNs without "NC-add" operation
+                * isn't allowed. */
+               instanceType = ldb_msg_find_attr_as_uint(ac->req->op.add.message,
+                                                        "instanceType", 0);
+               if (!(instanceType & INSTANCE_TYPE_IS_NC_HEAD)) {
                        ldb_asprintf_errstring(ldb, "objectclass: Cannot add %s, parent does not exist!", 
                                               ldb_dn_get_linearized(msg->dn));
                        return LDB_ERR_NO_SUCH_OBJECT;
                }
+
+               /* Don't keep any error messages - we've to add a partition */
+               ldb_set_errstring(ldb, NULL);
        } else {
                /* Fix up the DN to be in the standard form, taking
                 * particular care to match the parent DN */