-/*
+/*
SAM ldb module
- Copyright (C) Simo Sorce 2004
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
-
- * NOTICE: this module is NOT released under the GNU LGPL license as
- * other ldb code. This module is release under the GNU GPL v3 or
- * later license.
+ Copyright (C) Simo Sorce 2004-2008
+ Copyright (C) Matthias Dieter Wallnöfer 2009-2010
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
-
+
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
-
+
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
#include "libcli/ldap/ldap_ndr.h"
-#include "lib/ldb/include/ldb_errors.h"
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_private.h"
+#include "ldb_module.h"
#include "dsdb/samdb/samdb.h"
+#include "dsdb/samdb/ldb_modules/util.h"
#include "libcli/security/security.h"
#include "librpc/gen_ndr/ndr_security.h"
-#include "util/util_ldb.h"
+#include "../lib/util/util_ldb.h"
+#include "ldb_wrap.h"
+#include "param/param.h"
+
+struct samldb_ctx;
+
+typedef int (*samldb_step_fn_t)(struct samldb_ctx *);
+
+struct samldb_step {
+ struct samldb_step *next;
+ samldb_step_fn_t fn;
+};
-int samldb_notice_sid(struct ldb_module *module,
- TALLOC_CTX *mem_ctx, const struct dom_sid *sid);
+struct samldb_ctx {
+ struct ldb_module *module;
+ struct ldb_request *req;
+
+ /* used for add operations */
+ const char *type;
+
+ /* the resulting message */
+ struct ldb_message *msg;
+
+ /* used in "samldb_find_for_defaultObjectCategory" */
+ struct ldb_dn *dn, *res_dn;
+
+ /* all the async steps necessary to complete the operation */
+ struct samldb_step *steps;
+ struct samldb_step *curstep;
+
+ /* If someone set an ares to forward controls and response back to the caller */
+ struct ldb_reply *ares;
+};
-static bool samldb_msg_add_sid(struct ldb_module *module, struct ldb_message *msg, const char *name, const struct dom_sid *sid)
+static struct samldb_ctx *samldb_ctx_init(struct ldb_module *module,
+ struct ldb_request *req)
{
- struct ldb_val v;
- enum ndr_err_code ndr_err;
+ struct ldb_context *ldb;
+ struct samldb_ctx *ac;
- ndr_err = ndr_push_struct_blob(&v, msg, NULL, sid,
- (ndr_push_flags_fn_t)ndr_push_dom_sid);
- if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
- return false;
+ ldb = ldb_module_get_ctx(module);
+
+ ac = talloc_zero(req, struct samldb_ctx);
+ if (ac == NULL) {
+ ldb_oom(ldb);
+ return NULL;
}
- return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
+
+ ac->module = module;
+ ac->req = req;
+
+ return ac;
}
-/*
- allocate a new id, attempting to do it atomically
- return 0 on failure, the id on success
-*/
-static int samldb_set_next_rid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
- struct ldb_dn *dn, uint32_t old_id, uint32_t new_id)
+static int samldb_add_step(struct samldb_ctx *ac, samldb_step_fn_t fn)
{
- struct ldb_message msg;
- int ret;
- struct ldb_val vals[2];
- struct ldb_message_element els[2];
+ struct samldb_step *step, *stepper;
- if (new_id == 0) {
- /* out of IDs ! */
- ldb_set_errstring(ldb, "Are we out of valid IDs ?\n");
- return LDB_ERR_OPERATIONS_ERROR;
+ step = talloc_zero(ac, struct samldb_step);
+ if (step == NULL) {
+ return ldb_oom(ldb_module_get_ctx(ac->module));
}
- /* we do a delete and add as a single operation. That prevents
- a race, in case we are not actually on a transaction db */
- ZERO_STRUCT(msg);
- msg.dn = ldb_dn_copy(mem_ctx, dn);
- if (!msg.dn) {
- ldb_oom(ldb);
- return LDB_ERR_OPERATIONS_ERROR;
+ step->fn = fn;
+
+ if (ac->steps == NULL) {
+ ac->steps = step;
+ ac->curstep = step;
+ } else {
+ if (ac->curstep == NULL)
+ return ldb_operr(ldb_module_get_ctx(ac->module));
+ for (stepper = ac->curstep; stepper->next != NULL;
+ stepper = stepper->next);
+ stepper->next = step;
}
- msg.num_elements = 2;
- msg.elements = els;
- els[0].num_values = 1;
- els[0].values = &vals[0];
- els[0].flags = LDB_FLAG_MOD_DELETE;
- els[0].name = talloc_strdup(mem_ctx, "nextRid");
- if (!els[0].name) {
- ldb_oom(ldb);
- return LDB_ERR_OPERATIONS_ERROR;
+ return LDB_SUCCESS;
+}
+
+static int samldb_first_step(struct samldb_ctx *ac)
+{
+ if (ac->steps == NULL) {
+ return ldb_operr(ldb_module_get_ctx(ac->module));
}
- els[1].num_values = 1;
- els[1].values = &vals[1];
- els[1].flags = LDB_FLAG_MOD_ADD;
- els[1].name = els[0].name;
+ ac->curstep = ac->steps;
+ return ac->curstep->fn(ac);
+}
- vals[0].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", old_id);
- if (!vals[0].data) {
- ldb_oom(ldb);
- return LDB_ERR_OPERATIONS_ERROR;
+static int samldb_next_step(struct samldb_ctx *ac)
+{
+ if (ac->curstep->next) {
+ ac->curstep = ac->curstep->next;
+ return ac->curstep->fn(ac);
}
- vals[0].length = strlen((char *)vals[0].data);
- vals[1].data = (uint8_t *)talloc_asprintf(mem_ctx, "%u", new_id);
- if (!vals[1].data) {
- ldb_oom(ldb);
- return LDB_ERR_OPERATIONS_ERROR;
+ /* we exit the samldb module here */
+ /* If someone set an ares to forward controls and response back to the caller, use them */
+ if (ac->ares) {
+ return ldb_module_done(ac->req, ac->ares->controls,
+ ac->ares->response, LDB_SUCCESS);
+ } else {
+ return ldb_module_done(ac->req, NULL, NULL, LDB_SUCCESS);
}
- vals[1].length = strlen((char *)vals[1].data);
+}
- ret = ldb_modify(ldb, &msg);
- return ret;
+
+/* sAMAccountName handling */
+
+static int samldb_generate_sAMAccountName(struct ldb_context *ldb, struct ldb_message *msg)
+{
+ char *name;
+
+ /* Format: $000000-000000000000 */
+
+ name = talloc_asprintf(msg, "$%.6X-%.6X%.6X",
+ (unsigned int)generate_random(),
+ (unsigned int)generate_random(),
+ (unsigned int)generate_random());
+ if (name == NULL) {
+ return ldb_oom(ldb);
+ }
+ return ldb_msg_add_steal_string(msg, "sAMAccountName", name);
}
-/*
- allocate a new id, attempting to do it atomically
- return 0 on failure, the id on success
-*/
-static int samldb_find_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
- struct ldb_dn *dn, uint32_t *old_rid)
+static int samldb_check_sAMAccountName(struct samldb_ctx *ac)
{
- const char * const attrs[2] = { "nextRid", NULL };
- struct ldb_result *res = NULL;
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+ const char *name;
+ int ret;
+
+ if (ldb_msg_find_element(ac->msg, "sAMAccountName") == NULL) {
+ ret = samldb_generate_sAMAccountName(ldb, ac->msg);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+
+ name = ldb_msg_find_attr_as_string(ac->msg, "sAMAccountName", NULL);
+ if (name == NULL) {
+ return ldb_operr(ldb);
+ }
+
+ ret = samdb_search_count(ldb, NULL, "(sAMAccountName=%s)",
+ ldb_binary_encode_string(ac, name));
+ if ((ret < 0) || (ret > 1)) {
+ return ldb_operr(ldb);
+ }
+ if (ret == 1) {
+ return LDB_ERR_ENTRY_ALREADY_EXISTS;
+ }
+
+ return samldb_next_step(ac);
+}
+
+/* sAMAccountType handling */
+
+static int samldb_check_sAMAccountType(struct samldb_ctx *ac)
+{
+ struct ldb_context *ldb;
+ unsigned int account_type;
+ unsigned int group_type;
+ unsigned int uac;
int ret;
- const char *str;
- ret = ldb_search(module->ldb, dn, LDB_SCOPE_BASE, "nextRid=*", attrs, &res);
- if (ret != LDB_SUCCESS) {
- return ret;
+ ldb = ldb_module_get_ctx(ac->module);
+
+ /* make sure sAMAccountType is not specified */
+ if (ldb_msg_find_element(ac->msg, "sAMAccountType") != NULL) {
+ ldb_asprintf_errstring(ldb,
+ "sAMAccountType must not be specified!");
+ return LDB_ERR_UNWILLING_TO_PERFORM;
}
- if (res->count != 1) {
- talloc_free(res);
- return LDB_ERR_OPERATIONS_ERROR;
+
+ if (strcmp("user", ac->type) == 0) {
+ uac = samdb_result_uint(ac->msg, "userAccountControl", 0);
+ if (uac == 0) {
+ ldb_asprintf_errstring(ldb,
+ "userAccountControl invalid!");
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ } else {
+ account_type = ds_uf2atype(uac);
+ ret = samdb_msg_add_uint(ldb,
+ ac->msg, ac->msg,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+ } else if (strcmp("group", ac->type) == 0) {
+ group_type = samdb_result_uint(ac->msg, "groupType", 0);
+ if (group_type == 0) {
+ ldb_asprintf_errstring(ldb,
+ "groupType invalid!\n");
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ } else {
+ account_type = ds_gtype2atype(group_type);
+ ret = samdb_msg_add_uint(ldb,
+ ac->msg, ac->msg,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
}
- str = ldb_msg_find_attr_as_string(res->msgs[0], "nextRid", NULL);
- if (str == NULL) {
- ldb_asprintf_errstring(module->ldb,
- "attribute nextRid not found in %s\n",
- ldb_dn_get_linearized(dn));
- talloc_free(res);
- return LDB_ERR_OPERATIONS_ERROR;
+ return samldb_next_step(ac);
+}
+
+/* primaryGroupID handling */
+
+static int samldb_check_primaryGroupID(struct samldb_ctx *ac)
+{
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+ struct ldb_dn *prim_group_dn;
+ uint32_t rid;
+ struct dom_sid *sid;
+ int ret;
+
+ rid = samdb_result_uint(ac->msg, "primaryGroupID", (uint32_t) -1);
+ if (rid == (uint32_t) -1) {
+ uint32_t uac = samdb_result_uint(ac->msg, "userAccountControl",
+ 0);
+
+ rid = ds_uf2prim_group_rid(uac);
+
+ ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+ "primaryGroupID", rid);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
}
- *old_rid = strtol(str, NULL, 0);
- talloc_free(res);
- return LDB_SUCCESS;
+ sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
+ if (sid == NULL) {
+ return ldb_operr(ldb);
+ }
+
+ prim_group_dn = samdb_search_dn(ldb, ac, NULL, "(objectSID=%s)",
+ dom_sid_string(ac, sid));
+ if (prim_group_dn == NULL) {
+ ldb_asprintf_errstring(ldb,
+ "Failed to find primary group with RID %u!",
+ rid);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+ return samldb_next_step(ac);
+}
+
+
+static bool samldb_msg_add_sid(struct ldb_message *msg,
+ const char *name,
+ const struct dom_sid *sid)
+{
+ struct ldb_val v;
+ enum ndr_err_code ndr_err;
+
+ ndr_err = ndr_push_struct_blob(&v, msg, sid,
+ (ndr_push_flags_fn_t)ndr_push_dom_sid);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ return false;
+ }
+ return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
}
-static int samldb_allocate_next_rid(struct ldb_module *module, TALLOC_CTX *mem_ctx,
- struct ldb_dn *dn, const struct dom_sid *dom_sid,
- struct dom_sid **new_sid)
+
+/* allocate a SID using our RID Set */
+static int samldb_allocate_sid(struct samldb_ctx *ac)
{
- struct dom_sid *obj_sid;
- uint32_t old_rid;
+ uint32_t rid;
+ struct dom_sid *sid;
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
int ret;
-
- ret = samldb_find_next_rid(module, mem_ctx, dn, &old_rid);
- if (ret) {
+
+ ret = ridalloc_allocate_rid(ac->module, &rid);
+ if (ret != LDB_SUCCESS) {
return ret;
}
-
- /* return the new object sid */
- obj_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid);
-
- *new_sid = dom_sid_add_rid(mem_ctx, dom_sid, old_rid + 1);
- if (!*new_sid) {
- return LDB_ERR_OPERATIONS_ERROR;
+
+ sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
+ if (sid == NULL) {
+ return ldb_module_oom(ac->module);
}
- ret = samldb_notice_sid(module, mem_ctx, *new_sid);
- if (ret != 0) {
- /* gah, there are conflicting sids.
- * This is a critical situation it means that someone messed up with
- * the DB and nextRid is not returning free RIDs, report an error
- * and refuse to create any user until the problem is fixed */
- ldb_asprintf_errstring(module->ldb,
- "Critical Error: unconsistent DB, unable to retireve an unique RID to generate a new SID: %s",
- ldb_errstring(module->ldb));
- return ret;
+ if ( ! samldb_msg_add_sid(ac->msg, "objectSid", sid)) {
+ return ldb_operr(ldb);
}
- return ret;
+
+ return samldb_next_step(ac);
}
-/* search the domain related to the provided dn
- allocate a new RID for the domain
- return the new sid string
-*/
-static int samldb_get_new_sid(struct ldb_module *module,
- TALLOC_CTX *mem_ctx, struct ldb_dn *obj_dn,
- struct ldb_dn *dom_dn,
- struct dom_sid **sid)
+/*
+ see if a krbtgt_number is available
+ */
+static bool samldb_krbtgtnumber_available(struct samldb_ctx *ac, unsigned krbtgt_number)
{
- const char * const attrs[2] = { "objectSid", NULL };
- struct ldb_result *res = NULL;
+ TALLOC_CTX *tmp_ctx = talloc_new(ac);
+ struct ldb_result *res;
+ const char *attrs[] = { NULL };
int ret;
- struct dom_sid *dom_sid;
- /* get the domain component part of the provided dn */
+ ret = dsdb_module_search(ac->module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
+ attrs, DSDB_FLAG_NEXT_MODULE,
+ "msDC-SecondaryKrbTgtNumber=%u", krbtgt_number);
+ if (ret == LDB_SUCCESS && res->count == 0) {
+ talloc_free(tmp_ctx);
+ return true;
+ }
+ talloc_free(tmp_ctx);
+ return false;
+}
- /* find the domain sid */
+/* special handling for add in RODC join */
+static int samldb_rodc_add(struct samldb_ctx *ac)
+{
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+ unsigned krbtgt_number, i_start, i;
+ int ret;
- ret = ldb_search(module->ldb, dom_dn, LDB_SCOPE_BASE, "objectSid=*", attrs, &res);
- if (ret != LDB_SUCCESS) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_get_new_sid: error retrieving domain sid from %s: %s!\n",
- ldb_dn_get_linearized(dom_dn),
- ldb_errstring(module->ldb));
- talloc_free(res);
- return ret;
+ /* find a unused msDC-SecondaryKrbTgtNumber */
+ i_start = generate_random() & 0xFFFF;
+ if (i_start == 0) {
+ i_start = 1;
}
- if (res->count != 1) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_get_new_sid: error retrieving domain sid from %s: not found!\n",
- ldb_dn_get_linearized(dom_dn));
- talloc_free(res);
- return LDB_ERR_CONSTRAINT_VIOLATION;
+ for (i=i_start; i<=0xFFFF; i++) {
+ if (samldb_krbtgtnumber_available(ac, i)) {
+ krbtgt_number = i;
+ goto found;
+ }
+ }
+ for (i=1; i<i_start; i++) {
+ if (samldb_krbtgtnumber_available(ac, i)) {
+ krbtgt_number = i;
+ goto found;
+ }
}
- dom_sid = samdb_result_dom_sid(res, res->msgs[0], "objectSid");
- if (dom_sid == NULL) {
- ldb_set_errstring(module->ldb, "samldb_get_new_sid: error parsing domain sid!\n");
- talloc_free(res);
- return LDB_ERR_CONSTRAINT_VIOLATION;
+ ldb_asprintf_errstring(ldb_module_get_ctx(ac->module),
+ "%08X: Unable to find available msDS-SecondaryKrbTgtNumber",
+ W_ERROR_V(WERR_NO_SYSTEM_RESOURCES));
+ return LDB_ERR_OTHER;
+
+found:
+ ret = ldb_msg_add_empty(ac->msg, "msDS-SecondaryKrbTgtNumber", LDB_FLAG_INTERNAL_DISABLE_VALIDATION, NULL);
+ if (ret != LDB_SUCCESS) {
+ return ldb_operr(ldb);
}
- /* allocate a new Rid for the domain */
- ret = samldb_allocate_next_rid(module, mem_ctx, dom_dn, dom_sid, sid);
- if (ret != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "Failed to increment nextRid of %s: %s\n", ldb_dn_get_linearized(dom_dn), ldb_errstring(module->ldb));
- talloc_free(res);
- return ret;
+ ret = ldb_msg_add_fmt(ac->msg, "msDS-SecondaryKrbTgtNumber", "%u", krbtgt_number);
+ if (ret != LDB_SUCCESS) {
+ return ldb_operr(ldb);
}
- talloc_free(res);
+ ret = ldb_msg_add_fmt(ac->msg, "sAMAccountName", "krbtgt_%u", krbtgt_number);
+ if (ret != LDB_SUCCESS) {
+ return ldb_operr(ldb);
+ }
- return ret;
+ return samldb_next_step(ac);
}
-/* If we are adding new users/groups, we need to update the nextRid
- * attribute to be 'above' all incoming users RIDs. This tries to
- * avoid clashes in future */
-
-int samldb_notice_sid(struct ldb_module *module,
- TALLOC_CTX *mem_ctx, const struct dom_sid *sid)
+static int samldb_find_for_defaultObjectCategory(struct samldb_ctx *ac)
{
- int ret;
- struct ldb_dn *dom_dn;
- struct dom_sid *dom_sid;
- const char *attrs[] = { NULL };
- struct ldb_result *dom_res;
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
struct ldb_result *res;
- uint32_t old_rid;
-
- /* find if this SID already exists */
- ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &res,
- NULL, LDB_SCOPE_SUBTREE, attrs,
- "(objectSid=%s)", ldap_encode_ndr_dom_sid(mem_ctx, sid));
- if (ret == LDB_SUCCESS) {
- if (res->count > 0) {
- talloc_free(res);
- ldb_asprintf_errstring(module->ldb,
- "Attempt to add record with SID %s rejected,"
- " because this SID is already in the database",
- dom_sid_string(mem_ctx, sid));
- /* We have a duplicate SID, we must reject the add */
+ const char *no_attrs[] = { NULL };
+ int ret;
+
+ ac->res_dn = NULL;
+
+ ret = dsdb_module_search(ac->module, ac, &res,
+ ac->dn, LDB_SCOPE_BASE, no_attrs,
+ DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT | DSDB_FLAG_NEXT_MODULE,
+ "(objectClass=classSchema)");
+ if (ret == LDB_ERR_NO_SUCH_OBJECT) {
+ /* Don't be pricky when the DN doesn't exist if we have the */
+ /* RELAX control specified */
+ if (ldb_request_get_control(ac->req,
+ LDB_CONTROL_RELAX_OID) == NULL) {
+ ldb_set_errstring(ldb,
+ "samldb_find_defaultObjectCategory: "
+ "Invalid DN for 'defaultObjectCategory'!");
return LDB_ERR_CONSTRAINT_VIOLATION;
}
- talloc_free(res);
- } else {
- ldb_asprintf_errstring(module->ldb,
- "samldb_notice_sid: error searching to see if sid %s is in use: %s\n",
- dom_sid_string(mem_ctx, sid),
- ldb_errstring(module->ldb));
+ }
+ if ((ret != LDB_ERR_NO_SUCH_OBJECT) && (ret != LDB_SUCCESS)) {
return ret;
}
- dom_sid = dom_sid_dup(mem_ctx, sid);
- if (!dom_sid) {
- return LDB_ERR_OPERATIONS_ERROR;
+ ac->res_dn = ac->dn;
+
+ return samldb_next_step(ac);
+}
+
+/**
+ * msDS-IntId attributeSchema attribute handling
+ * during LDB_ADD request processing
+ */
+static int samldb_add_handle_msDS_IntId(struct samldb_ctx *ac)
+{
+ int ret;
+ bool id_exists;
+ uint32_t msds_intid;
+ uint32_t system_flags;
+ struct ldb_context *ldb;
+ struct ldb_result *ldb_res;
+ struct ldb_dn *schema_dn;
+
+ ldb = ldb_module_get_ctx(ac->module);
+ schema_dn = ldb_get_schema_basedn(ldb);
+
+ /* replicated update should always go through */
+ if (ldb_request_get_control(ac->req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
+ return LDB_SUCCESS;
+ }
+
+ /* msDS-IntId is handled by system and should never be
+ * passed by clients */
+ if (ldb_msg_find_element(ac->msg, "msDS-IntId")) {
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+ /* do not generate msDS-IntId if Relax control is passed */
+ if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
+ return LDB_SUCCESS;
+ }
+
+ /* check Functional Level */
+ if (dsdb_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003) {
+ return LDB_SUCCESS;
+ }
+
+ /* check systemFlags for SCHEMA_BASE_OBJECT flag */
+ system_flags = ldb_msg_find_attr_as_uint(ac->msg, "systemFlags", 0);
+ if (system_flags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) {
+ return LDB_SUCCESS;
}
- /* get the domain component part of the provided SID */
- dom_sid->num_auths--;
- /* find the domain DN */
- ret = ldb_search_exp_fmt(module->ldb, mem_ctx, &dom_res,
- NULL, LDB_SCOPE_SUBTREE, attrs,
- "(&(objectSid=%s)(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain)))",
- ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
- if (ret == LDB_SUCCESS) {
- if (dom_res->count == 0) {
- talloc_free(dom_res);
- /* This isn't an operation on a domain we know about, so nothing to update */
- return LDB_SUCCESS;
+ /* Generate new value for msDs-IntId
+ * Value should be in 0x80000000..0xBFFFFFFF range */
+ msds_intid = generate_random() % 0X3FFFFFFF;
+ msds_intid += 0x80000000;
+
+ /* probe id values until unique one is found */
+ do {
+ msds_intid++;
+ if (msds_intid > 0xBFFFFFFF) {
+ msds_intid = 0x80000001;
}
- if (dom_res->count > 1) {
- talloc_free(dom_res);
- ldb_asprintf_errstring(module->ldb,
- "samldb_notice_sid: error retrieving domain from sid: duplicate (found %d) domain: %s!\n",
- dom_res->count, dom_sid_string(dom_res, dom_sid));
- return LDB_ERR_OPERATIONS_ERROR;
+ ret = dsdb_module_search(ac->module, ac,
+ &ldb_res,
+ schema_dn, LDB_SCOPE_ONELEVEL, NULL,
+ DSDB_FLAG_NEXT_MODULE,
+ "(msDS-IntId=%d)", msds_intid);
+ if (ret != LDB_SUCCESS) {
+ ldb_debug_set(ldb, LDB_DEBUG_ERROR,
+ __location__": Searching for msDS-IntId=%d failed - %s\n",
+ msds_intid,
+ ldb_errstring(ldb));
+ return ldb_operr(ldb);
}
- } else {
- ldb_asprintf_errstring(module->ldb,
- "samldb_notice_sid: error retrieving domain from sid: %s: %s\n",
- dom_sid_string(dom_res, dom_sid),
- ldb_errstring(module->ldb));
- return ret;
+ id_exists = (ldb_res->count > 0);
+
+ talloc_free(ldb_res);
+ } while(id_exists);
+
+ return ldb_msg_add_fmt(ac->msg, "msDS-IntId", "%d", msds_intid);
+}
+
+
+/*
+ * samldb_add_entry (async)
+ */
+
+static int samldb_add_entry_callback(struct ldb_request *req,
+ struct ldb_reply *ares)
+{
+ struct ldb_context *ldb;
+ struct samldb_ctx *ac;
+ int ret;
+
+ ac = talloc_get_type(req->context, struct samldb_ctx);
+ ldb = ldb_module_get_ctx(ac->module);
+
+ if (!ares) {
+ return ldb_module_done(ac->req, NULL, NULL,
+ LDB_ERR_OPERATIONS_ERROR);
}
- dom_dn = dom_res->msgs[0]->dn;
+ if (ares->type == LDB_REPLY_REFERRAL) {
+ return ldb_module_send_referral(ac->req, ares->referral);
+ }
- ret = samldb_find_next_rid(module, mem_ctx,
- dom_dn, &old_rid);
- if (ret) {
- talloc_free(dom_res);
- return ret;
+ if (ares->error != LDB_SUCCESS) {
+ return ldb_module_done(ac->req, ares->controls,
+ ares->response, ares->error);
+ }
+ if (ares->type != LDB_REPLY_DONE) {
+ ldb_set_errstring(ldb,
+ "Invalid reply type!\n");
+ return ldb_module_done(ac->req, NULL, NULL,
+ LDB_ERR_OPERATIONS_ERROR);
}
- if (old_rid <= sid->sub_auths[sid->num_auths - 1]) {
- ret = samldb_set_next_rid(module->ldb, mem_ctx, dom_dn, old_rid,
- sid->sub_auths[sid->num_auths - 1] + 1);
+ /* The caller may wish to get controls back from the add */
+ ac->ares = talloc_steal(ac, ares);
+
+ ret = samldb_next_step(ac);
+ if (ret != LDB_SUCCESS) {
+ return ldb_module_done(ac->req, NULL, NULL, ret);
}
- talloc_free(dom_res);
return ret;
}
-static int samldb_handle_sid(struct ldb_module *module,
- TALLOC_CTX *mem_ctx, struct ldb_message *msg2,
- struct ldb_dn *parent_dn)
+static int samldb_add_entry(struct samldb_ctx *ac)
{
+ struct ldb_context *ldb;
+ struct ldb_request *req;
int ret;
-
- struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg2, "objectSid");
- if (sid == NULL) {
- ret = samldb_get_new_sid(module, msg2, msg2->dn, parent_dn, &sid);
- if (ret != 0) {
- return ret;
- }
- if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
- talloc_free(sid);
- return LDB_ERR_OPERATIONS_ERROR;
- }
- talloc_free(sid);
- ret = LDB_SUCCESS;
+ ldb = ldb_module_get_ctx(ac->module);
+
+ ret = ldb_build_add_req(&req, ldb, ac,
+ ac->msg,
+ ac->req->controls,
+ ac, samldb_add_entry_callback,
+ ac->req);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+
+ return ldb_next_request(ac->module, req);
+}
+
+/*
+ * return true if msg carries an attributeSchema that is intended to be RODC
+ * filtered but is also a system-critical attribute.
+ */
+static bool check_rodc_critical_attribute(struct ldb_message *msg)
+{
+ uint32_t schemaFlagsEx, searchFlags, rodc_filtered_flags;
+
+ schemaFlagsEx = ldb_msg_find_attr_as_uint(msg, "schemaFlagsEx", 0);
+ searchFlags = ldb_msg_find_attr_as_uint(msg, "searchFlags", 0);
+ rodc_filtered_flags = (SEARCH_FLAG_RODC_ATTRIBUTE | SEARCH_FLAG_CONFIDENTIAL);
+
+ if ((schemaFlagsEx & SCHEMA_FLAG_ATTR_IS_CRITICAL) &&
+ ((searchFlags & rodc_filtered_flags) == rodc_filtered_flags)) {
+ return true;
} else {
- ret = samldb_notice_sid(module, msg2, sid);
+ return false;
}
- return ret;
}
-static int samldb_generate_samAccountName(struct ldb_module *module, TALLOC_CTX *mem_ctx,
- struct ldb_dn *dom_dn, char **name)
+
+static int samldb_fill_object(struct samldb_ctx *ac, const char *type)
{
- const char *attrs[] = { NULL };
- struct ldb_result *res;
+ struct ldb_context *ldb;
+ struct loadparm_context *lp_ctx;
+ enum sid_generator sid_generator;
int ret;
-
- /* Format: $000000-000000000000 */
-
- do {
- *name = talloc_asprintf(mem_ctx, "$%.6X-%.6X%.6X", (unsigned int)generate_random(), (unsigned int)generate_random(), (unsigned int)generate_random());
- /* TODO: Figure out exactly what this is meant to conflict with */
- ret = ldb_search_exp_fmt(module->ldb,
- mem_ctx, &res, dom_dn, LDB_SCOPE_SUBTREE, attrs,
- "samAccountName=%s",
- ldb_binary_encode_string(mem_ctx, *name));
- if (ret != LDB_SUCCESS) {
- ldb_asprintf_errstring(module->ldb, "samldb: Failure searching to determine if samAccountName %s is unique: %s",
- *name, ldb_errstring(module->ldb));
- return ret;
+ struct ldb_control *rodc_control;
+ struct dom_sid *sid;
+
+ ldb = ldb_module_get_ctx(ac->module);
+
+ /* Add informations for the different account types */
+ ac->type = type;
+ if (strcmp(ac->type, "user") == 0) {
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "userAccountControl", "546");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "badPwdCount", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "codePage", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "countryCode", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "badPasswordTime", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "lastLogoff", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "lastLogon", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "pwdLastSet", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "accountExpires", "9223372036854775807");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "logonCount", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ } else if (strcmp(ac->type, "group") == 0) {
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "groupType", "-2147483646");
+ if (ret != LDB_SUCCESS) return ret;
+ } else if (strcmp(ac->type, "classSchema") == 0) {
+ const struct ldb_val *rdn_value, *def_obj_cat_val;
+
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "rdnAttId", "cn");
+ if (ret != LDB_SUCCESS) return ret;
+
+ /* do not allow to mark an attributeSchema as RODC filtered if it
+ * is system-critical */
+ if (check_rodc_critical_attribute(ac->msg)) {
+ ldb_asprintf_errstring(ldb, "Refusing schema add of %s - cannot combine critical class with RODC filtering",
+ ldb_dn_get_linearized(ac->msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+
+ rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
+ if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
+ /* the RDN has prefix "CN" */
+ ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
+ samdb_cn_to_lDAPDisplayName(ac,
+ (const char *) rdn_value->data));
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
+ }
+
+ if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
+ struct GUID guid;
+ /* a new GUID */
+ guid = GUID_random();
+ ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
}
- if (res->count == 0) {
- talloc_free(res);
- /* Great. There are no conflicting users/groups/etc */
- return LDB_SUCCESS;
+ def_obj_cat_val = ldb_msg_find_ldb_val(ac->msg,
+ "defaultObjectCategory");
+ if (def_obj_cat_val != NULL) {
+ /* "defaultObjectCategory" has been set by the caller.
+ * Do some checks for consistency.
+ * NOTE: The real constraint check (that
+ * 'defaultObjectCategory' is the DN of the new
+ * objectclass or any parent of it) is still incomplete.
+ * For now we say that 'defaultObjectCategory' is valid
+ * if it exists and it is of objectclass "classSchema".
+ */
+ ac->dn = ldb_dn_from_ldb_val(ac, ldb, def_obj_cat_val);
+ if (ac->dn == NULL) {
+ ldb_set_errstring(ldb,
+ "Invalid DN for 'defaultObjectCategory'!");
+ return LDB_ERR_CONSTRAINT_VIOLATION;
+ }
} else {
- talloc_free(*name);
- /* gah, there is a conflicting name, lets move around the loop again... */
+ /* "defaultObjectCategory" has not been set by the
+ * caller. Use the entry DN for it. */
+ ac->dn = ac->msg->dn;
+
+ ret = samdb_msg_add_string(ldb, ac, ac->msg,
+ "defaultObjectCategory",
+ ldb_dn_get_linearized(ac->dn));
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
}
- } while (1);
-}
-static int samldb_fill_group_object(struct ldb_module *module, const struct ldb_message *msg,
- struct ldb_message **ret_msg)
-{
- int ret;
- unsigned int group_type;
- char *name;
- struct ldb_message *msg2;
- struct ldb_dn *dom_dn;
- const char *rdn_name;
- TALLOC_CTX *mem_ctx = talloc_new(msg);
- const char *errstr;
- if (!mem_ctx) {
+ ret = samldb_add_step(ac, samldb_add_entry);
+ if (ret != LDB_SUCCESS) return ret;
+
+ /* Now perform the checks for the 'defaultObjectCategory'. The
+ * lookup DN was already saved in "ac->dn" */
+ ret = samldb_add_step(ac, samldb_find_for_defaultObjectCategory);
+ if (ret != LDB_SUCCESS) return ret;
+
+ return samldb_first_step(ac);
+ } else if (strcmp(ac->type, "attributeSchema") == 0) {
+ const struct ldb_val *rdn_value;
+ rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
+ if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
+ /* the RDN has prefix "CN" */
+ ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
+ samdb_cn_to_lDAPDisplayName(ac,
+ (const char *) rdn_value->data));
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
+ }
+
+ /* do not allow to mark an attributeSchema as RODC filtered if it
+ * is system-critical */
+ if (check_rodc_critical_attribute(ac->msg)) {
+ ldb_asprintf_errstring(ldb, "Refusing schema add of %s - cannot combine critical attribute with RODC filtering",
+ ldb_dn_get_linearized(ac->msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "isSingleValued", "FALSE");
+ if (ret != LDB_SUCCESS) return ret;
+
+ if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
+ struct GUID guid;
+ /* a new GUID */
+ guid = GUID_random();
+ ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
+ }
+
+ /* handle msDS-IntID attribute */
+ ret = samldb_add_handle_msDS_IntId(ac);
+ if (ret != LDB_SUCCESS) return ret;
+
+ ret = samldb_add_step(ac, samldb_add_entry);
+ if (ret != LDB_SUCCESS) return ret;
+
+ return samldb_first_step(ac);
+ } else {
+ ldb_asprintf_errstring(ldb,
+ "Invalid entry type!");
return LDB_ERR_OPERATIONS_ERROR;
}
- /* build the new msg */
- msg2 = ldb_msg_copy(mem_ctx, msg);
- if (!msg2) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: ldb_msg_copy failed!\n");
- talloc_free(mem_ctx);
- return LDB_ERR_OPERATIONS_ERROR;
+ rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID);
+ if (rodc_control) {
+ /* see [MS-ADTS] 3.1.1.3.4.1.23 LDAP_SERVER_RODC_DCPROMO_OID */
+ rodc_control->critical = false;
+ ret = samldb_add_step(ac, samldb_rodc_add);
+ if (ret != LDB_SUCCESS) return ret;
}
- ret = samdb_copy_template(module->ldb, msg2,
- "group",
- &errstr);
- if (ret != 0) {
-
- talloc_free(mem_ctx);
- return ret;
+ /* check if we have a valid sAMAccountName */
+ ret = samldb_add_step(ac, samldb_check_sAMAccountName);
+ if (ret != LDB_SUCCESS) return ret;
+
+ /* check account_type/group_type */
+ ret = samldb_add_step(ac, samldb_check_sAMAccountType);
+ if (ret != LDB_SUCCESS) return ret;
+
+ /* check if we have a valid primary group ID */
+ if (strcmp(ac->type, "user") == 0) {
+ ret = samldb_add_step(ac, samldb_check_primaryGroupID);
+ if (ret != LDB_SUCCESS) return ret;
}
- rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+ lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
+ struct loadparm_context);
- if (strcasecmp(rdn_name, "cn") != 0) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_group_object: Bad RDN (%s) for group!\n", rdn_name);
- talloc_free(mem_ctx);
- return LDB_ERR_CONSTRAINT_VIOLATION;
+ /* don't allow objectSID to be specified without the RELAX control */
+ sid = samdb_result_dom_sid(ac, ac->msg, "objectSid");
+ if (sid && !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
+ !dsdb_module_am_system(ac->module)) {
+ ldb_asprintf_errstring(ldb, "No SID may be specified in user/group creation for %s",
+ ldb_dn_get_linearized(ac->msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
}
- ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
- if (ret != LDB_SUCCESS) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_fill_group_object: %s", errstr);
- return ret;
+ if (sid == NULL) {
+ sid_generator = lpcfg_sid_generator(lp_ctx);
+ if (sid_generator == SID_GENERATOR_INTERNAL) {
+ ret = samldb_add_step(ac, samldb_allocate_sid);
+ if (ret != LDB_SUCCESS) return ret;
+ }
}
- /* Generate a random name, if no samAccountName was supplied */
- if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
- ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
- if (ret != LDB_SUCCESS) {
- talloc_free(mem_ctx);
- return ret;
+ /* finally proceed with adding the entry */
+ ret = samldb_add_step(ac, samldb_add_entry);
+ if (ret != LDB_SUCCESS) return ret;
+
+ return samldb_first_step(ac);
+}
+
+static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx *ac)
+{
+ struct ldb_context *ldb;
+ struct dom_sid *sid;
+ int ret;
+
+ ldb = ldb_module_get_ctx(ac->module);
+
+ sid = samdb_result_dom_sid(ac->msg, ac->msg, "objectSid");
+ if (sid == NULL) {
+ sid = dom_sid_parse_talloc(ac->msg,
+ (const char *)ldb_dn_get_rdn_val(ac->msg->dn)->data);
+ if (sid == NULL) {
+ ldb_set_errstring(ldb,
+ "No valid SID found in "
+ "ForeignSecurityPrincipal CN!");
+ return LDB_ERR_CONSTRAINT_VIOLATION;
}
- ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
- if (ret) {
- talloc_free(mem_ctx);
- return ret;
+ if (! samldb_msg_add_sid(ac->msg, "objectSid", sid)) {
+ return ldb_operr(ldb);
}
}
-
- if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
- ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
- talloc_free(mem_ctx);
- return LDB_ERR_UNWILLING_TO_PERFORM;
+
+ /* finally proceed with adding the entry */
+ ret = samldb_add_step(ac, samldb_add_entry);
+ if (ret != LDB_SUCCESS) return ret;
+
+ return samldb_first_step(ac);
+}
+
+static int samldb_schema_info_update(struct samldb_ctx *ac)
+{
+ WERROR werr;
+ struct ldb_context *ldb;
+ struct dsdb_schema *schema;
+
+ /* replicated update should always go through */
+ if (ldb_request_get_control(ac->req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
+ return LDB_SUCCESS;
}
- group_type = samdb_result_uint(msg2, "groupType", 0);
- if (group_type == 0) {
- ldb_asprintf_errstring(module->ldb, "groupType invalid");
- talloc_free(mem_ctx);
- return LDB_ERR_UNWILLING_TO_PERFORM;
- } else {
- unsigned int account_type = samdb_gtype2atype(group_type);
- ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
- "sAMAccountType",
- account_type);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
+
+ /* do not update schemaInfo during provisioning */
+ if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
+ return LDB_SUCCESS;
}
- /* Manage SID allocation, conflicts etc */
- ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn);
+ ldb = ldb_module_get_ctx(ac->module);
+ schema = dsdb_get_schema(ldb, NULL);
+ if (!schema) {
+ ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+ "samldb_schema_info_update: no dsdb_schema loaded");
+ DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
+ return ldb_operr(ldb);
+ }
- if (ret == LDB_SUCCESS) {
- talloc_steal(msg, msg2);
- *ret_msg = msg2;
+ werr = dsdb_module_schema_info_update(ac->module, schema, DSDB_FLAG_NEXT_MODULE);
+ if (!W_ERROR_IS_OK(werr)) {
+ ldb_debug_set(ldb, LDB_DEBUG_FATAL,
+ "samldb_schema_info_update: "
+ "dsdb_module_schema_info_update failed with %s",
+ win_errstr(werr));
+ DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
+ return ldb_operr(ldb);
}
- talloc_free(mem_ctx);
- return ret;
+
+ return LDB_SUCCESS;
}
-static int samldb_fill_user_or_computer_object(struct ldb_module *module, const struct ldb_message *msg, struct ldb_message **ret_msg)
+
+static int samldb_prim_group_change(struct samldb_ctx *ac)
{
+ struct ldb_context *ldb;
+ const char * attrs[] = { "primaryGroupID", "memberOf", NULL };
+ struct ldb_result *res;
+ struct ldb_message_element *el;
+ struct ldb_message *msg;
+ uint32_t rid;
+ struct dom_sid *sid;
+ struct ldb_dn *prev_prim_group_dn, *new_prim_group_dn;
int ret;
- char *name;
- struct ldb_message *msg2;
- struct ldb_dn *dom_dn;
- const char *rdn_name;
- TALLOC_CTX *mem_ctx = talloc_new(msg);
- const char *errstr;
- unsigned int user_account_control;
- if (!mem_ctx) {
- return LDB_ERR_OPERATIONS_ERROR;
+
+ ldb = ldb_module_get_ctx(ac->module);
+
+ /* Fetch informations from the existing object */
+
+ ret = ldb_search(ldb, ac, &res, ac->msg->dn, LDB_SCOPE_BASE, attrs,
+ NULL);
+ if (ret != LDB_SUCCESS) {
+ return ret;
}
- /* build the new msg */
- msg2 = ldb_msg_copy(mem_ctx, msg);
- if (!msg2) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_user_or_computer_object: ldb_msg_copy failed!\n");
- talloc_free(mem_ctx);
- return LDB_ERR_OPERATIONS_ERROR;
+ /* Finds out the DN of the old primary group */
+
+ rid = samdb_result_uint(res->msgs[0], "primaryGroupID", (uint32_t) -1);
+ if (rid == (uint32_t) -1) {
+ /* User objects do always have a mandatory "primaryGroupID"
+ * attribute. If this doesn't exist then the object is of the
+ * wrong type. This is the exact Windows error code */
+ return LDB_ERR_OBJECT_CLASS_VIOLATION;
}
- ret = samdb_copy_template(module->ldb, msg2,
- "user",
- &errstr);
- if (ret) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_fill_user_or_computer_object: Error copying user template: %s\n",
- errstr);
- talloc_free(mem_ctx);
- return ret;
+ sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
+ if (sid == NULL) {
+ return ldb_operr(ldb);
+ }
+
+ prev_prim_group_dn = samdb_search_dn(ldb, ac, NULL, "(objectSID=%s)",
+ dom_sid_string(ac, sid));
+ if (prev_prim_group_dn == NULL) {
+ return ldb_operr(ldb);
}
- rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+ /* Finds out the DN of the new primary group */
- if (strcasecmp(rdn_name, "cn") != 0) {
- ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for user/computer, should be CN=!\n", rdn_name);
- talloc_free(mem_ctx);
- return LDB_ERR_CONSTRAINT_VIOLATION;
+ rid = samdb_result_uint(ac->msg, "primaryGroupID", (uint32_t) -1);
+ if (rid == (uint32_t) -1) {
+ /* we aren't affected of any primary group change */
+ return LDB_SUCCESS;
}
- ret = samdb_search_for_parent_domain(module->ldb, mem_ctx, msg2->dn, &dom_dn, &errstr);
- if (ret != LDB_SUCCESS) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_fill_user_or_computer_object: %s", errstr);
- return ret;
+ sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
+ if (sid == NULL) {
+ return ldb_operr(ldb);
}
- if (ldb_msg_find_element(msg2, "samAccountName") == NULL) {
- ret = samldb_generate_samAccountName(module, mem_ctx, dom_dn, &name);
+ new_prim_group_dn = samdb_search_dn(ldb, ac, NULL, "(objectSID=%s)",
+ dom_sid_string(ac, sid));
+ if (new_prim_group_dn == NULL) {
+ /* Here we know if the specified new primary group candidate is
+ * valid or not. */
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+ /* Only update the "member" attributes when we really do have a change */
+ if (ldb_dn_compare(new_prim_group_dn, prev_prim_group_dn) != 0) {
+ /* We need to be already a normal member of the new primary
+ * group in order to be successful. */
+ el = samdb_find_attribute(ldb, res->msgs[0], "memberOf",
+ ldb_dn_get_linearized(new_prim_group_dn));
+ if (el == NULL) {
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+ /* Remove the "member" attribute on the new primary group */
+ msg = talloc_zero(ac, struct ldb_message);
+ msg->dn = new_prim_group_dn;
+
+ ret = samdb_msg_add_delval(ldb, ac, msg, "member",
+ ldb_dn_get_linearized(ac->msg->dn));
if (ret != LDB_SUCCESS) {
- talloc_free(mem_ctx);
return ret;
}
- ret = samdb_find_or_add_attribute(module->ldb, msg2, "sAMAccountName", name);
- if (ret) {
- talloc_free(mem_ctx);
+
+ ret = dsdb_module_modify(ac->module, msg, DSDB_FLAG_NEXT_MODULE);
+ if (ret != LDB_SUCCESS) {
return ret;
}
- }
- if (ldb_msg_find_element(msg2, "sAMAccountType") != NULL) {
- ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
- talloc_free(mem_ctx);
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
- user_account_control = samdb_result_uint(msg2, "userAccountControl", 0);
- if (user_account_control == 0) {
- ldb_asprintf_errstring(module->ldb, "userAccountControl invalid");
- talloc_free(mem_ctx);
- return LDB_ERR_UNWILLING_TO_PERFORM;
- } else {
- unsigned int account_type = samdb_uf2atype(user_account_control);
- ret = samdb_msg_add_uint(module->ldb, msg2, msg2,
- "sAMAccountType",
- account_type);
+ /* Add a "member" attribute for the previous primary group */
+ msg = talloc_zero(ac, struct ldb_message);
+ msg->dn = prev_prim_group_dn;
+
+ ret = samdb_msg_add_addval(ldb, ac, msg, "member",
+ ldb_dn_get_linearized(ac->msg->dn));
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+
+ ret = dsdb_module_modify(ac->module, msg, DSDB_FLAG_NEXT_MODULE);
if (ret != LDB_SUCCESS) {
return ret;
}
}
- /* Manage SID allocation, conflicts etc */
- ret = samldb_handle_sid(module, mem_ctx, msg2, dom_dn);
+ return LDB_SUCCESS;
+}
- /* TODO: userAccountControl, badPwdCount, codePage, countryCode, badPasswordTime, lastLogoff, lastLogon, pwdLastSet, primaryGroupID, accountExpires, logonCount */
- if (ret == 0) {
- *ret_msg = msg2;
- talloc_steal(msg, msg2);
- }
- talloc_free(mem_ctx);
- return ret;
-}
-
-static int samldb_fill_foreignSecurityPrincipal_object(struct ldb_module *module, const struct ldb_message *msg,
- struct ldb_message **ret_msg)
+static int samldb_member_check(struct samldb_ctx *ac)
{
- struct ldb_message *msg2;
- const char *rdn_name;
- struct dom_sid *dom_sid;
+ struct ldb_context *ldb;
+ struct ldb_message_element *el;
+ struct ldb_dn *member_dn, *group_dn;
+ uint32_t prim_group_rid;
struct dom_sid *sid;
- const char *dom_attrs[] = { "name", NULL };
- struct ldb_message **dom_msgs;
- const char *errstr;
- int ret;
-
- TALLOC_CTX *mem_ctx = talloc_new(msg);
- if (!mem_ctx) {
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- /* build the new msg */
- msg2 = ldb_msg_copy(mem_ctx, msg);
- if (!msg2) {
- ldb_debug(module->ldb, LDB_DEBUG_FATAL, "samldb_fill_foreignSecurityPrincipal_object: ldb_msg_copy failed!\n");
- talloc_free(mem_ctx);
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- ret = samdb_copy_template(module->ldb, msg2,
- "ForeignSecurityPrincipal",
- &errstr);
- if (ret != 0) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_fill_foreignSecurityPrincipal_object: "
- "Error copying template: %s",
- errstr);
- talloc_free(mem_ctx);
- return ret;
- }
+ unsigned int i;
- rdn_name = ldb_dn_get_rdn_name(msg2->dn);
+ ldb = ldb_module_get_ctx(ac->module);
- if (strcasecmp(rdn_name, "cn") != 0) {
- ldb_asprintf_errstring(module->ldb, "Bad RDN (%s=) for ForeignSecurityPrincipal, should be CN=!", rdn_name);
- talloc_free(mem_ctx);
- return LDB_ERR_CONSTRAINT_VIOLATION;
+ el = ldb_msg_find_element(ac->msg, "member");
+ if (el == NULL) {
+ /* we aren't affected */
+ return LDB_SUCCESS;
}
- sid = samdb_result_dom_sid(msg2, msg, "objectSid");
- if (!sid) {
- /* Slightly different for the foreign sids. We don't want
- * domain SIDs ending up there, it would cause all sorts of
- * pain */
-
- sid = dom_sid_parse_talloc(msg2, (const char *)ldb_dn_get_rdn_val(msg2->dn)->data);
- if (!sid) {
- ldb_set_errstring(module->ldb, "No valid found SID in ForeignSecurityPrincipal CN!");
- talloc_free(mem_ctx);
- return LDB_ERR_CONSTRAINT_VIOLATION;
+ for (i = 0; i < el->num_values; i++) {
+ /* Denies to add "member"s to groups which are primary ones
+ * for them */
+ member_dn = ldb_dn_from_ldb_val(ac, ldb, &el->values[i]);
+ if (!ldb_dn_validate(member_dn)) {
+ return ldb_operr(ldb);
}
- if ( ! samldb_msg_add_sid(module, msg2, "objectSid", sid)) {
- talloc_free(sid);
- return LDB_ERR_OPERATIONS_ERROR;
+ prim_group_rid = samdb_search_uint(ldb, ac, (uint32_t) -1,
+ member_dn, "primaryGroupID",
+ NULL);
+ if (prim_group_rid == (uint32_t) -1) {
+ /* the member hasn't to be a user account -> therefore
+ * no check needed in this case. */
+ continue;
}
- dom_sid = dom_sid_dup(mem_ctx, sid);
- if (!dom_sid) {
- talloc_free(mem_ctx);
- return LDB_ERR_OPERATIONS_ERROR;
+ sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb),
+ prim_group_rid);
+ if (sid == NULL) {
+ return ldb_operr(ldb);
}
- /* get the domain component part of the provided SID */
- dom_sid->num_auths--;
- /* find the domain DN */
+ group_dn = samdb_search_dn(ldb, ac, NULL, "(objectSID=%s)",
+ dom_sid_string(ac, sid));
+ if (group_dn == NULL) {
+ return ldb_operr(ldb);
+ }
- ret = gendb_search(module->ldb,
- mem_ctx, NULL, &dom_msgs, dom_attrs,
- "(&(objectSid=%s)(objectclass=domain))",
- ldap_encode_ndr_dom_sid(mem_ctx, dom_sid));
- if (ret >= 1) {
- /* We don't really like the idea of foreign sids that are not foreign, but it happens */
- const char *name = samdb_result_string(dom_msgs[0], "name", NULL);
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "NOTE (strange but valid): Adding foreign SID record with SID %s, but this domian (%s) is already in the database",
- dom_sid_string(mem_ctx, sid), name);
- } else if (ret == -1) {
- ldb_asprintf_errstring(module->ldb,
- "samldb_fill_foreignSecurityPrincipal_object: error searching for a domain with this sid: %s\n",
- dom_sid_string(mem_ctx, dom_sid));
- talloc_free(dom_msgs);
- return LDB_ERR_OPERATIONS_ERROR;
+ if (ldb_dn_compare(group_dn, ac->msg->dn) == 0) {
+ return LDB_ERR_ENTRY_ALREADY_EXISTS;
}
}
- /* This isn't an operation on a domain we know about, so just
- * check for the SID, looking for duplicates via the common
- * code */
- ret = samldb_notice_sid(module, msg2, sid);
- if (ret == 0) {
- talloc_steal(msg, msg2);
- *ret_msg = msg2;
- }
-
- return ret;
+ return LDB_SUCCESS;
}
-/* add_record */
-
-/*
- * FIXME
- *
- * Actually this module is not async at all as it does a number of sync searches
- * in the process. It still to be decided how to deal with it properly so it is
- * left SYNC for now until we think of a good solution.
- */
+/* add */
static int samldb_add(struct ldb_module *module, struct ldb_request *req)
{
- const struct ldb_message *msg = req->op.add.message;
- struct ldb_message *msg2 = NULL;
- struct ldb_request *down_req;
+ struct ldb_context *ldb;
+ struct samldb_ctx *ac;
int ret;
- ldb_debug(module->ldb, LDB_DEBUG_TRACE, "samldb_add_record\n");
+ ldb = ldb_module_get_ctx(module);
+ ldb_debug(ldb, LDB_DEBUG_TRACE, "samldb_add\n");
- if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
+ /* do not manipulate our control entries */
+ if (ldb_dn_is_special(req->op.add.message->dn)) {
return ldb_next_request(module, req);
}
- /* is user or computer? */
- if ((samdb_find_attribute(module->ldb, msg, "objectclass", "user") != NULL) ||
- (samdb_find_attribute(module->ldb, msg, "objectclass", "computer") != NULL)) {
- /* add all relevant missing objects */
- ret = samldb_fill_user_or_computer_object(module, msg, &msg2);
- if (ret) {
- return ret;
- }
+ ac = samldb_ctx_init(module, req);
+ if (ac == NULL) {
+ return ldb_operr(ldb);
}
- /* is group? add all relevant missing objects */
- if ( ! msg2 ) {
- if (samdb_find_attribute(module->ldb, msg, "objectclass", "group") != NULL) {
- ret = samldb_fill_group_object(module, msg, &msg2);
- if (ret) {
- return ret;
- }
- }
+ /* build the new msg */
+ req->op.add.message = ac->msg = ldb_msg_copy_shallow(req,
+ req->op.add.message);
+ if (ac->msg == NULL) {
+ return ldb_operr(ldb);
}
- /* perhaps a foreignSecurityPrincipal? */
- if ( ! msg2 ) {
- if (samdb_find_attribute(module->ldb, msg, "objectclass", "foreignSecurityPrincipal") != NULL) {
- ret = samldb_fill_foreignSecurityPrincipal_object(module, msg, &msg2);
- if (ret) {
- return ret;
- }
- }
+ if (samdb_find_attribute(ldb, ac->msg,
+ "objectclass", "user") != NULL) {
+ return samldb_fill_object(ac, "user");
}
- if (msg2 == NULL) {
- return ldb_next_request(module, req);
+ if (samdb_find_attribute(ldb, ac->msg,
+ "objectclass", "group") != NULL) {
+ return samldb_fill_object(ac, "group");
}
- down_req = talloc(req, struct ldb_request);
- if (down_req == NULL) {
- return LDB_ERR_OPERATIONS_ERROR;
+ /* perhaps a foreignSecurityPrincipal? */
+ if (samdb_find_attribute(ldb, ac->msg,
+ "objectclass",
+ "foreignSecurityPrincipal") != NULL) {
+ return samldb_fill_foreignSecurityPrincipal_object(ac);
}
- *down_req = *req;
-
- down_req->op.add.message = talloc_steal(down_req, msg2);
+ if (samdb_find_attribute(ldb, ac->msg,
+ "objectclass", "classSchema") != NULL) {
+ ret = samldb_schema_info_update(ac);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(ac);
+ return ret;
+ }
- ldb_set_timeout_from_prev_req(module->ldb, req, down_req);
+ return samldb_fill_object(ac, "classSchema");
+ }
- /* go on with the call chain */
- ret = ldb_next_request(module, down_req);
+ if (samdb_find_attribute(ldb, ac->msg,
+ "objectclass", "attributeSchema") != NULL) {
+ ret = samldb_schema_info_update(ac);
+ if (ret != LDB_SUCCESS) {
+ talloc_free(ac);
+ return ret;
+ }
- /* do not free down_req as the call results may be linked to it,
- * it will be freed when the upper level request get freed */
- if (ret == LDB_SUCCESS) {
- req->handle = down_req->handle;
+ return samldb_fill_object(ac, "attributeSchema");
}
- return ret;
+ talloc_free(ac);
+
+ /* nothing matched, go on */
+ return ldb_next_request(module, req);
}
/* modify */
static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
{
- struct ldb_message *msg;
+ struct ldb_context *ldb;
+ struct samldb_ctx *ac;
struct ldb_message_element *el, *el2;
int ret;
- unsigned int group_type, user_account_control, account_type;
- if (ldb_dn_is_special(req->op.mod.message->dn)) { /* do not manipulate our control entries */
+ uint32_t account_type;
+
+ if (ldb_dn_is_special(req->op.mod.message->dn)) {
+ /* do not manipulate our control entries */
return ldb_next_request(module, req);
}
+ ldb = ldb_module_get_ctx(module);
+
if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
- ldb_asprintf_errstring(module->ldb, "sAMAccountType must not be specified");
+ ldb_asprintf_errstring(ldb,
+ "sAMAccountType must not be specified!");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
- el = ldb_msg_find_element(req->op.mod.message, "groupType");
- if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
- req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+ /* msDS-IntId is not allowed to be modified
+ * except when modification comes from replication */
+ if (ldb_msg_find_element(req->op.mod.message, "msDS-IntId")) {
+ if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
+ return LDB_ERR_CONSTRAINT_VIOLATION;
+ }
+ }
+
+ ac = samldb_ctx_init(module, req);
+ if (ac == NULL) {
+ return ldb_operr(ldb);
+ }
+
+ /* build the new msg */
+ req->op.mod.message = ac->msg = ldb_msg_copy_shallow(req,
+ req->op.mod.message);
+ if (ac->msg == NULL) {
+ return ldb_operr(ldb);
+ }
+
+ el = ldb_msg_find_element(ac->msg, "groupType");
+ if (el && (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+ uint32_t group_type;
group_type = strtoul((const char *)el->values[0].data, NULL, 0);
- account_type = samdb_gtype2atype(group_type);
- ret = samdb_msg_add_uint(module->ldb, msg, msg,
+ account_type = ds_gtype2atype(group_type);
+ ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
"sAMAccountType",
account_type);
if (ret != LDB_SUCCESS) {
return ret;
}
- el2 = ldb_msg_find_element(msg, "sAMAccountType");
+ el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
el2->flags = LDB_FLAG_MOD_REPLACE;
}
+ if (el && (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE)) {
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
- el = ldb_msg_find_element(req->op.mod.message, "userAccountControl");
- if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
- req->op.mod.message = msg = ldb_msg_copy_shallow(req, req->op.mod.message);
+ el = ldb_msg_find_element(ac->msg, "primaryGroupID");
+ if (el && (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+ ret = samldb_prim_group_change(ac);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+ if (el && (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE)) {
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
- user_account_control = strtoul((const char *)el->values[0].data, NULL, 0);
- account_type = samdb_uf2atype(user_account_control);
- ret = samdb_msg_add_uint(module->ldb, msg, msg,
+ el = ldb_msg_find_element(ac->msg, "userAccountControl");
+ if (el && (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+ uint32_t user_account_control;
+
+ user_account_control = strtoul((const char *)el->values[0].data,
+ NULL, 0);
+ account_type = ds_uf2atype(user_account_control);
+ ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
"sAMAccountType",
account_type);
if (ret != LDB_SUCCESS) {
return ret;
}
- el2 = ldb_msg_find_element(msg, "sAMAccountType");
+ el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
el2->flags = LDB_FLAG_MOD_REPLACE;
+
+ if (user_account_control & (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
+ ret = samdb_msg_add_string(ldb, ac->msg, ac->msg,
+ "isCriticalSystemObject",
+ "TRUE");
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(ac->msg,
+ "isCriticalSystemObject");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
+
+ /* DCs have primaryGroupID of DOMAIN_RID_DCS */
+ if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
+ uint32_t rid;
+ if (user_account_control & UF_SERVER_TRUST_ACCOUNT) {
+ rid = DOMAIN_RID_DCS;
+ } else {
+ /* read-only DC */
+ rid = DOMAIN_RID_READONLY_DCS;
+ }
+ ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+ "primaryGroupID", rid);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(ac->msg,
+ "primaryGroupID");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
+ }
+ }
+ }
+ if (el && (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE)) {
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+ el = ldb_msg_find_element(ac->msg, "member");
+ if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
+ ret = samldb_member_check(ac);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+
+ talloc_free(ac);
+
+ return ldb_next_request(module, req);
+}
+
+/* delete */
+
+static int samldb_prim_group_users_check(struct samldb_ctx *ac)
+{
+ struct ldb_context *ldb;
+ struct dom_sid *sid;
+ uint32_t rid;
+ NTSTATUS status;
+ int count;
+
+ ldb = ldb_module_get_ctx(ac->module);
+
+ /* Finds out the SID/RID of the SAM object */
+ sid = samdb_search_dom_sid(ldb, ac, ac->req->op.del.dn, "objectSID",
+ NULL);
+ if (sid == NULL) {
+ /* No SID - it might not be a SAM object - therefore ok */
+ return LDB_SUCCESS;
+ }
+ status = dom_sid_split_rid(ac, sid, NULL, &rid);
+ if (!NT_STATUS_IS_OK(status)) {
+ return ldb_operr(ldb);
+ }
+ if (rid == 0) {
+ /* Special object (security principal?) */
+ return LDB_SUCCESS;
+ }
+
+ /* Deny delete requests from groups which are primary ones */
+ count = samdb_search_count(ldb, NULL,
+ "(&(primaryGroupID=%u)(objectClass=user))",
+ rid);
+ if (count < 0) {
+ return ldb_operr(ldb);
+ }
+ if (count > 0) {
+ return LDB_ERR_ENTRY_ALREADY_EXISTS;
+ }
+
+ return LDB_SUCCESS;
+}
+
+static int samldb_delete(struct ldb_module *module, struct ldb_request *req)
+{
+ struct samldb_ctx *ac;
+ int ret;
+
+ if (ldb_dn_is_special(req->op.del.dn)) {
+ /* do not manipulate our control entries */
+ return ldb_next_request(module, req);
+ }
+
+ ac = samldb_ctx_init(module, req);
+ if (ac == NULL) {
+ return ldb_operr(ldb_module_get_ctx(module));
+ }
+
+ ret = samldb_prim_group_users_check(ac);
+ if (ret != LDB_SUCCESS) {
+ return ret;
}
+
+ talloc_free(ac);
+
return ldb_next_request(module, req);
}
+/* extended */
+
+static int samldb_extended_allocate_rid_pool(struct ldb_module *module, struct ldb_request *req)
+{
+ struct ldb_context *ldb = ldb_module_get_ctx(module);
+ struct dsdb_fsmo_extended_op *exop;
+ int ret;
+
+ exop = talloc_get_type(req->op.extended.data, struct dsdb_fsmo_extended_op);
+ if (!exop) {
+ ldb_debug(ldb, LDB_DEBUG_FATAL, "samldb_extended_allocate_rid_pool: invalid extended data\n");
+ return LDB_ERR_PROTOCOL_ERROR;
+ }
+
+ ret = ridalloc_allocate_rid_pool_fsmo(module, exop);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+
+ return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
+}
-static int samldb_init(struct ldb_module *module)
+static int samldb_extended(struct ldb_module *module, struct ldb_request *req)
{
- return ldb_next_init(module);
+ if (strcmp(req->op.extended.oid, DSDB_EXTENDED_ALLOCATE_RID_POOL) == 0) {
+ return samldb_extended_allocate_rid_pool(module, req);
+ }
+
+ return ldb_next_request(module, req);
}
+
_PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
.name = "samldb",
- .init_context = samldb_init,
.add = samldb_add,
- .modify = samldb_modify
+ .modify = samldb_modify,
+ .del = samldb_delete,
+ .extended = samldb_extended
};
+
git.samba.org / samba.git / blobdiff