2 Unix SMB/CIFS implementation.
3 Samba utility functions
5 Copyright (C) Andrew Tridgell 2004
6 Copyright (C) Volker Lendecke 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006
8 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "events/events.h"
27 #include "ldb_errors.h"
28 #include "../lib/util/util_ldb.h"
29 #include "../lib/crypto/crypto.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "libcli/security/security.h"
32 #include "librpc/gen_ndr/ndr_security.h"
33 #include "librpc/gen_ndr/ndr_misc.h"
34 #include "../libds/common/flags.h"
35 #include "dsdb/common/proto.h"
36 #include "libcli/ldap/ldap_ndr.h"
37 #include "param/param.h"
38 #include "libcli/auth/libcli_auth.h"
41 search the sam for the specified attributes in a specific domain, filter on
42 objectSid being in domain_sid.
44 int samdb_search_domain(struct ldb_context *sam_ldb,
46 struct ldb_dn *basedn,
47 struct ldb_message ***res,
48 const char * const *attrs,
49 const struct dom_sid *domain_sid,
50 const char *format, ...) _PRINTF_ATTRIBUTE(7,8)
56 count = gendb_search_v(sam_ldb, mem_ctx, basedn,
57 res, attrs, format, ap);
63 struct dom_sid *entry_sid;
65 entry_sid = samdb_result_dom_sid(mem_ctx, (*res)[i], "objectSid");
67 if ((entry_sid == NULL) ||
68 (!dom_sid_in_domain(domain_sid, entry_sid))) {
69 /* Delete that entry from the result set */
70 (*res)[i] = (*res)[count-1];
72 talloc_free(entry_sid);
75 talloc_free(entry_sid);
83 search the sam for a single string attribute in exactly 1 record
85 const char *samdb_search_string_v(struct ldb_context *sam_ldb,
87 struct ldb_dn *basedn,
88 const char *attr_name,
89 const char *format, va_list ap) _PRINTF_ATTRIBUTE(5,0)
92 const char *attrs[2] = { NULL, NULL };
93 struct ldb_message **res = NULL;
97 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
99 DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n",
100 attr_name, format, count));
107 return samdb_result_string(res[0], attr_name, NULL);
111 search the sam for a single string attribute in exactly 1 record
113 const char *samdb_search_string(struct ldb_context *sam_ldb,
115 struct ldb_dn *basedn,
116 const char *attr_name,
117 const char *format, ...) _PRINTF_ATTRIBUTE(5,6)
122 va_start(ap, format);
123 str = samdb_search_string_v(sam_ldb, mem_ctx, basedn, attr_name, format, ap);
129 struct ldb_dn *samdb_search_dn(struct ldb_context *sam_ldb,
131 struct ldb_dn *basedn,
132 const char *format, ...) _PRINTF_ATTRIBUTE(4,5)
136 struct ldb_message **res = NULL;
139 va_start(ap, format);
140 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, NULL, format, ap);
143 if (count != 1) return NULL;
145 ret = talloc_steal(mem_ctx, res[0]->dn);
152 search the sam for a dom_sid attribute in exactly 1 record
154 struct dom_sid *samdb_search_dom_sid(struct ldb_context *sam_ldb,
156 struct ldb_dn *basedn,
157 const char *attr_name,
158 const char *format, ...) _PRINTF_ATTRIBUTE(5,6)
162 struct ldb_message **res;
163 const char *attrs[2] = { NULL, NULL };
166 attrs[0] = attr_name;
168 va_start(ap, format);
169 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
172 DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n",
173 attr_name, format, count));
179 sid = samdb_result_dom_sid(mem_ctx, res[0], attr_name);
185 return the count of the number of records in the sam matching the query
187 int samdb_search_count(struct ldb_context *sam_ldb,
189 struct ldb_dn *basedn,
190 const char *format, ...) _PRINTF_ATTRIBUTE(4,5)
193 struct ldb_message **res;
194 const char * const attrs[] = { NULL };
197 va_start(ap, format);
198 ret = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
206 search the sam for a single integer attribute in exactly 1 record
208 uint_t samdb_search_uint(struct ldb_context *sam_ldb,
210 uint_t default_value,
211 struct ldb_dn *basedn,
212 const char *attr_name,
213 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
217 struct ldb_message **res;
218 const char *attrs[2] = { NULL, NULL };
220 attrs[0] = attr_name;
222 va_start(ap, format);
223 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
227 return default_value;
230 return samdb_result_uint(res[0], attr_name, default_value);
234 search the sam for a single signed 64 bit integer attribute in exactly 1 record
236 int64_t samdb_search_int64(struct ldb_context *sam_ldb,
238 int64_t default_value,
239 struct ldb_dn *basedn,
240 const char *attr_name,
241 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
245 struct ldb_message **res;
246 const char *attrs[2] = { NULL, NULL };
248 attrs[0] = attr_name;
250 va_start(ap, format);
251 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
255 return default_value;
258 return samdb_result_int64(res[0], attr_name, default_value);
262 search the sam for multipe records each giving a single string attribute
263 return the number of matches, or -1 on error
265 int samdb_search_string_multiple(struct ldb_context *sam_ldb,
267 struct ldb_dn *basedn,
269 const char *attr_name,
270 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
274 const char *attrs[2] = { NULL, NULL };
275 struct ldb_message **res = NULL;
277 attrs[0] = attr_name;
279 va_start(ap, format);
280 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
287 /* make sure its single valued */
288 for (i=0;i<count;i++) {
289 if (res[i]->num_elements != 1) {
290 DEBUG(1,("samdb: search for %s %s not single valued\n",
297 *strs = talloc_array(mem_ctx, const char *, count+1);
303 for (i=0;i<count;i++) {
304 (*strs)[i] = samdb_result_string(res[i], attr_name, NULL);
306 (*strs)[count] = NULL;
312 pull a uint from a result set.
314 uint_t samdb_result_uint(const struct ldb_message *msg, const char *attr, uint_t default_value)
316 return ldb_msg_find_attr_as_uint(msg, attr, default_value);
320 pull a (signed) int64 from a result set.
322 int64_t samdb_result_int64(const struct ldb_message *msg, const char *attr, int64_t default_value)
324 return ldb_msg_find_attr_as_int64(msg, attr, default_value);
328 pull a string from a result set.
330 const char *samdb_result_string(const struct ldb_message *msg, const char *attr,
331 const char *default_value)
333 return ldb_msg_find_attr_as_string(msg, attr, default_value);
336 struct ldb_dn *samdb_result_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
337 const char *attr, struct ldb_dn *default_value)
339 struct ldb_dn *ret_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, msg, attr);
341 return default_value;
347 pull a rid from a objectSid in a result set.
349 uint32_t samdb_result_rid_from_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
350 const char *attr, uint32_t default_value)
355 sid = samdb_result_dom_sid(mem_ctx, msg, attr);
357 return default_value;
359 rid = sid->sub_auths[sid->num_auths-1];
365 pull a dom_sid structure from a objectSid in a result set.
367 struct dom_sid *samdb_result_dom_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
370 const struct ldb_val *v;
372 enum ndr_err_code ndr_err;
373 v = ldb_msg_find_ldb_val(msg, attr);
377 sid = talloc(mem_ctx, struct dom_sid);
381 ndr_err = ndr_pull_struct_blob(v, sid, NULL, sid,
382 (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
383 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
391 pull a guid structure from a objectGUID in a result set.
393 struct GUID samdb_result_guid(const struct ldb_message *msg, const char *attr)
395 const struct ldb_val *v;
396 enum ndr_err_code ndr_err;
402 v = ldb_msg_find_ldb_val(msg, attr);
405 mem_ctx = talloc_named_const(NULL, 0, "samdb_result_guid");
406 if (!mem_ctx) return guid;
407 ndr_err = ndr_pull_struct_blob(v, mem_ctx, NULL, &guid,
408 (ndr_pull_flags_fn_t)ndr_pull_GUID);
409 talloc_free(mem_ctx);
410 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
418 pull a sid prefix from a objectSid in a result set.
419 this is used to find the domain sid for a user
421 struct dom_sid *samdb_result_sid_prefix(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
424 struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg, attr);
425 if (!sid || sid->num_auths < 1) return NULL;
431 pull a NTTIME in a result set.
433 NTTIME samdb_result_nttime(struct ldb_message *msg, const char *attr, NTTIME default_value)
435 return ldb_msg_find_attr_as_uint64(msg, attr, default_value);
439 * Windows stores 0 for lastLogoff.
440 * But when a MS DC return the lastLogoff (as Logoff Time)
441 * it returns 0x7FFFFFFFFFFFFFFF, not returning this value in this case
442 * cause windows 2008 and newer version to fail for SMB requests
444 NTTIME samdb_result_last_logoff(struct ldb_message *msg)
446 NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "lastLogoff",0);
449 ret = 0x7FFFFFFFFFFFFFFFULL;
455 * Windows uses both 0 and 9223372036854775807 (0x7FFFFFFFFFFFFFFFULL) to
456 * indicate an account doesn't expire.
458 * When Windows initially creates an account, it sets
459 * accountExpires = 9223372036854775807 (0x7FFFFFFFFFFFFFFF). However,
460 * when changing from an account having a specific expiration date to
461 * that account never expiring, it sets accountExpires = 0.
463 * Consolidate that logic here to allow clearer logic for account expiry in
464 * the rest of the code.
466 NTTIME samdb_result_account_expires(struct ldb_message *msg)
468 NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "accountExpires",
472 ret = 0x7FFFFFFFFFFFFFFFULL;
478 pull a uint64_t from a result set.
480 uint64_t samdb_result_uint64(struct ldb_message *msg, const char *attr, uint64_t default_value)
482 return ldb_msg_find_attr_as_uint64(msg, attr, default_value);
487 construct the allow_password_change field from the PwdLastSet attribute and the
488 domain password settings
490 NTTIME samdb_result_allow_password_change(struct ldb_context *sam_ldb,
492 struct ldb_dn *domain_dn,
493 struct ldb_message *msg,
496 uint64_t attr_time = samdb_result_uint64(msg, attr, 0);
499 if (attr_time == 0) {
503 minPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "minPwdAge", NULL);
505 /* yes, this is a -= not a += as minPwdAge is stored as the negative
506 of the number of 100-nano-seconds */
507 attr_time -= minPwdAge;
513 construct the force_password_change field from the PwdLastSet
514 attribute, the userAccountControl and the domain password settings
516 NTTIME samdb_result_force_password_change(struct ldb_context *sam_ldb,
518 struct ldb_dn *domain_dn,
519 struct ldb_message *msg)
521 uint64_t attr_time = samdb_result_uint64(msg, "pwdLastSet", 0);
522 uint32_t userAccountControl = samdb_result_uint64(msg, "userAccountControl", 0);
525 /* Machine accounts don't expire, and there is a flag for 'no expiry' */
526 if (!(userAccountControl & UF_NORMAL_ACCOUNT)
527 || (userAccountControl & UF_DONT_EXPIRE_PASSWD)) {
528 return 0x7FFFFFFFFFFFFFFFULL;
531 if (attr_time == 0) {
535 maxPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "maxPwdAge", NULL);
536 if (maxPwdAge == 0) {
537 return 0x7FFFFFFFFFFFFFFFULL;
539 attr_time -= maxPwdAge;
546 pull a samr_Password structutre from a result set.
548 struct samr_Password *samdb_result_hash(TALLOC_CTX *mem_ctx, const struct ldb_message *msg, const char *attr)
550 struct samr_Password *hash = NULL;
551 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
552 if (val && (val->length >= sizeof(hash->hash))) {
553 hash = talloc(mem_ctx, struct samr_Password);
554 memcpy(hash->hash, val->data, MIN(val->length, sizeof(hash->hash)));
560 pull an array of samr_Password structutres from a result set.
562 uint_t samdb_result_hashes(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
563 const char *attr, struct samr_Password **hashes)
566 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
573 count = val->length / 16;
578 *hashes = talloc_array(mem_ctx, struct samr_Password, count);
583 for (i=0;i<count;i++) {
584 memcpy((*hashes)[i].hash, (i*16)+(char *)val->data, 16);
590 NTSTATUS samdb_result_passwords(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, struct ldb_message *msg,
591 struct samr_Password **lm_pwd, struct samr_Password **nt_pwd)
593 struct samr_Password *lmPwdHash, *ntPwdHash;
596 num_nt = samdb_result_hashes(mem_ctx, msg, "unicodePwd", &ntPwdHash);
599 } else if (num_nt > 1) {
600 return NT_STATUS_INTERNAL_DB_CORRUPTION;
602 *nt_pwd = &ntPwdHash[0];
606 /* Ensure that if we have turned off LM
607 * authentication, that we never use the LM hash, even
609 if (lp_lanman_auth(lp_ctx)) {
611 num_lm = samdb_result_hashes(mem_ctx, msg, "dBCSPwd", &lmPwdHash);
614 } else if (num_lm > 1) {
615 return NT_STATUS_INTERNAL_DB_CORRUPTION;
617 *lm_pwd = &lmPwdHash[0];
627 pull a samr_LogonHours structutre from a result set.
629 struct samr_LogonHours samdb_result_logon_hours(TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr)
631 struct samr_LogonHours hours;
632 const int units_per_week = 168;
633 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
635 hours.bits = talloc_array(mem_ctx, uint8_t, units_per_week);
639 hours.units_per_week = units_per_week;
640 memset(hours.bits, 0xFF, units_per_week);
642 memcpy(hours.bits, val->data, MIN(val->length, units_per_week));
648 pull a set of account_flags from a result set.
650 This requires that the attributes:
655 uint32_t samdb_result_acct_flags(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
656 struct ldb_message *msg, struct ldb_dn *domain_dn)
658 uint32_t userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
659 uint32_t acct_flags = ds_uf2acb(userAccountControl);
660 NTTIME must_change_time;
663 must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx,
666 /* Test account expire time */
667 unix_to_nt_time(&now, time(NULL));
668 /* check for expired password */
669 if (must_change_time < now) {
670 acct_flags |= ACB_PW_EXPIRED;
675 struct lsa_BinaryString samdb_result_parameters(TALLOC_CTX *mem_ctx,
676 struct ldb_message *msg,
679 struct lsa_BinaryString s;
680 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
688 s.array = talloc_array(mem_ctx, uint16_t, val->length/2);
692 s.length = s.size = val->length/2;
693 memcpy(s.array, val->data, val->length);
698 /* Find an attribute, with a particular value */
700 /* The current callers of this function expect a very specific
701 * behaviour: In particular, objectClass subclass equivilance is not
702 * wanted. This means that we should not lookup the schema for the
703 * comparison function */
704 struct ldb_message_element *samdb_find_attribute(struct ldb_context *ldb,
705 const struct ldb_message *msg,
706 const char *name, const char *value)
709 struct ldb_message_element *el = ldb_msg_find_element(msg, name);
715 for (i=0;i<el->num_values;i++) {
716 if (ldb_attr_cmp(value, (char *)el->values[i].data) == 0) {
724 int samdb_find_or_add_value(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value)
726 if (samdb_find_attribute(ldb, msg, name, set_value) == NULL) {
727 return samdb_msg_add_string(ldb, msg, msg, name, set_value);
732 int samdb_find_or_add_attribute(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value)
734 struct ldb_message_element *el;
736 el = ldb_msg_find_element(msg, name);
741 return samdb_msg_add_string(ldb, msg, msg, name, set_value);
747 add a string element to a message
749 int samdb_msg_add_string(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
750 const char *attr_name, const char *str)
752 char *s = talloc_strdup(mem_ctx, str);
753 char *a = talloc_strdup(mem_ctx, attr_name);
754 if (s == NULL || a == NULL) {
755 return LDB_ERR_OPERATIONS_ERROR;
757 return ldb_msg_add_string(msg, a, s);
761 add a dom_sid element to a message
763 int samdb_msg_add_dom_sid(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
764 const char *attr_name, struct dom_sid *sid)
767 enum ndr_err_code ndr_err;
769 ndr_err = ndr_push_struct_blob(&v, mem_ctx,
770 lp_iconv_convenience(ldb_get_opaque(sam_ldb, "loadparm")),
772 (ndr_push_flags_fn_t)ndr_push_dom_sid);
773 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
776 return ldb_msg_add_value(msg, attr_name, &v, NULL);
781 add a delete element operation to a message
783 int samdb_msg_add_delete(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
784 const char *attr_name)
786 /* we use an empty replace rather than a delete, as it allows for
787 samdb_replace() to be used everywhere */
788 return ldb_msg_add_empty(msg, attr_name, LDB_FLAG_MOD_REPLACE, NULL);
792 add a add attribute value to a message
794 int samdb_msg_add_addval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
795 const char *attr_name, const char *value)
797 struct ldb_message_element *el;
800 a = talloc_strdup(mem_ctx, attr_name);
803 v = talloc_strdup(mem_ctx, value);
806 ret = ldb_msg_add_string(msg, a, v);
809 el = ldb_msg_find_element(msg, a);
812 el->flags = LDB_FLAG_MOD_ADD;
817 add a delete attribute value to a message
819 int samdb_msg_add_delval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
820 const char *attr_name, const char *value)
822 struct ldb_message_element *el;
825 a = talloc_strdup(mem_ctx, attr_name);
828 v = talloc_strdup(mem_ctx, value);
831 ret = ldb_msg_add_string(msg, a, v);
834 el = ldb_msg_find_element(msg, a);
837 el->flags = LDB_FLAG_MOD_DELETE;
842 add a int element to a message
844 int samdb_msg_add_int(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
845 const char *attr_name, int v)
847 const char *s = talloc_asprintf(mem_ctx, "%d", v);
848 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
852 add a uint_t element to a message
854 int samdb_msg_add_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
855 const char *attr_name, uint_t v)
857 const char *s = talloc_asprintf(mem_ctx, "%u", v);
858 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
862 add a (signed) int64_t element to a message
864 int samdb_msg_add_int64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
865 const char *attr_name, int64_t v)
867 const char *s = talloc_asprintf(mem_ctx, "%lld", (long long)v);
868 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
872 add a uint64_t element to a message
874 int samdb_msg_add_uint64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
875 const char *attr_name, uint64_t v)
877 const char *s = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)v);
878 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
882 add a samr_Password element to a message
884 int samdb_msg_add_hash(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
885 const char *attr_name, struct samr_Password *hash)
888 val.data = talloc_memdup(mem_ctx, hash->hash, 16);
893 return ldb_msg_add_value(msg, attr_name, &val, NULL);
897 add a samr_Password array to a message
899 int samdb_msg_add_hashes(TALLOC_CTX *mem_ctx, struct ldb_message *msg,
900 const char *attr_name, struct samr_Password *hashes, uint_t count)
904 val.data = talloc_array_size(mem_ctx, 16, count);
905 val.length = count*16;
909 for (i=0;i<count;i++) {
910 memcpy(i*16 + (char *)val.data, hashes[i].hash, 16);
912 return ldb_msg_add_value(msg, attr_name, &val, NULL);
916 add a acct_flags element to a message
918 int samdb_msg_add_acct_flags(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
919 const char *attr_name, uint32_t v)
921 return samdb_msg_add_uint(sam_ldb, mem_ctx, msg, attr_name, ds_acb2uf(v));
925 add a logon_hours element to a message
927 int samdb_msg_add_logon_hours(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
928 const char *attr_name, struct samr_LogonHours *hours)
931 val.length = hours->units_per_week / 8;
932 val.data = hours->bits;
933 return ldb_msg_add_value(msg, attr_name, &val, NULL);
937 add a parameters element to a message
939 int samdb_msg_add_parameters(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
940 const char *attr_name, struct lsa_BinaryString *parameters)
943 val.length = parameters->length * 2;
944 val.data = (uint8_t *)parameters->array;
945 return ldb_msg_add_value(msg, attr_name, &val, NULL);
948 add a general value element to a message
950 int samdb_msg_add_value(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
951 const char *attr_name, const struct ldb_val *val)
953 return ldb_msg_add_value(msg, attr_name, val, NULL);
957 sets a general value element to a message
959 int samdb_msg_set_value(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
960 const char *attr_name, const struct ldb_val *val)
962 struct ldb_message_element *el;
964 el = ldb_msg_find_element(msg, attr_name);
968 return ldb_msg_add_value(msg, attr_name, val, NULL);
972 set a string element in a message
974 int samdb_msg_set_string(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
975 const char *attr_name, const char *str)
977 struct ldb_message_element *el;
979 el = ldb_msg_find_element(msg, attr_name);
983 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, str);
987 replace elements in a record
989 int samdb_replace(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg)
993 /* mark all the message elements as LDB_FLAG_MOD_REPLACE */
994 for (i=0;i<msg->num_elements;i++) {
995 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
998 /* modify the samdb record */
999 return ldb_modify(sam_ldb, msg);
1003 return a default security descriptor
1005 struct security_descriptor *samdb_default_security_descriptor(TALLOC_CTX *mem_ctx)
1007 struct security_descriptor *sd;
1009 sd = security_descriptor_initialise(mem_ctx);
1014 struct ldb_dn *samdb_base_dn(struct ldb_context *sam_ctx)
1016 return ldb_get_default_basedn(sam_ctx);
1019 struct ldb_dn *samdb_config_dn(struct ldb_context *sam_ctx)
1021 return ldb_get_config_basedn(sam_ctx);
1024 struct ldb_dn *samdb_schema_dn(struct ldb_context *sam_ctx)
1026 return ldb_get_schema_basedn(sam_ctx);
1029 struct ldb_dn *samdb_root_dn(struct ldb_context *sam_ctx)
1031 return ldb_get_root_basedn(sam_ctx);
1034 struct ldb_dn *samdb_partitions_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1036 struct ldb_dn *new_dn;
1038 new_dn = ldb_dn_copy(mem_ctx, samdb_config_dn(sam_ctx));
1039 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Partitions")) {
1040 talloc_free(new_dn);
1046 struct ldb_dn *samdb_sites_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1048 struct ldb_dn *new_dn;
1050 new_dn = ldb_dn_copy(mem_ctx, samdb_config_dn(sam_ctx));
1051 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Sites")) {
1052 talloc_free(new_dn);
1059 work out the domain sid for the current open ldb
1061 const struct dom_sid *samdb_domain_sid(struct ldb_context *ldb)
1063 TALLOC_CTX *tmp_ctx;
1064 const struct dom_sid *domain_sid;
1065 const char *attrs[] = {
1069 struct ldb_result *res;
1072 /* see if we have a cached copy */
1073 domain_sid = (struct dom_sid *)ldb_get_opaque(ldb, "cache.domain_sid");
1078 tmp_ctx = talloc_new(ldb);
1079 if (tmp_ctx == NULL) {
1083 ret = ldb_search(ldb, tmp_ctx, &res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, attrs, "objectSid=*");
1085 if (ret != LDB_SUCCESS) {
1089 if (res->count != 1) {
1093 domain_sid = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSid");
1094 if (domain_sid == NULL) {
1098 /* cache the domain_sid in the ldb */
1099 if (ldb_set_opaque(ldb, "cache.domain_sid", discard_const_p(struct dom_sid, domain_sid)) != LDB_SUCCESS) {
1103 talloc_steal(ldb, domain_sid);
1104 talloc_free(tmp_ctx);
1109 DEBUG(1,("Failed to find domain_sid for open ldb\n"));
1110 talloc_free(tmp_ctx);
1114 bool samdb_set_domain_sid(struct ldb_context *ldb, const struct dom_sid *dom_sid_in)
1116 TALLOC_CTX *tmp_ctx;
1117 struct dom_sid *dom_sid_new;
1118 struct dom_sid *dom_sid_old;
1120 /* see if we have a cached copy */
1121 dom_sid_old = talloc_get_type(ldb_get_opaque(ldb,
1122 "cache.domain_sid"), struct dom_sid);
1124 tmp_ctx = talloc_new(ldb);
1125 if (tmp_ctx == NULL) {
1129 dom_sid_new = dom_sid_dup(tmp_ctx, dom_sid_in);
1134 /* cache the domain_sid in the ldb */
1135 if (ldb_set_opaque(ldb, "cache.domain_sid", dom_sid_new) != LDB_SUCCESS) {
1139 talloc_steal(ldb, dom_sid_new);
1140 talloc_free(tmp_ctx);
1141 talloc_free(dom_sid_old);
1146 DEBUG(1,("Failed to set our own cached domain SID in the ldb!\n"));
1147 talloc_free(tmp_ctx);
1151 /* Obtain the short name of the flexible single master operator
1152 * (FSMO), such as the PDC Emulator */
1153 const char *samdb_result_fsmo_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
1156 /* Format is cn=NTDS Settings,cn=<NETBIOS name of FSMO>,.... */
1157 struct ldb_dn *fsmo_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, msg, attr);
1158 const struct ldb_val *val = ldb_dn_get_component_val(fsmo_dn, 1);
1159 const char *name = ldb_dn_get_component_name(fsmo_dn, 1);
1161 if (!name || (ldb_attr_cmp(name, "cn") != 0)) {
1162 /* Ensure this matches the format. This gives us a
1163 * bit more confidence that a 'cn' value will be a
1168 return (char *)val->data;
1174 work out the ntds settings dn for the current open ldb
1176 struct ldb_dn *samdb_ntds_settings_dn(struct ldb_context *ldb)
1178 TALLOC_CTX *tmp_ctx;
1179 const char *root_attrs[] = { "dsServiceName", NULL };
1181 struct ldb_result *root_res;
1182 struct ldb_dn *settings_dn;
1184 /* see if we have a cached copy */
1185 settings_dn = (struct ldb_dn *)ldb_get_opaque(ldb, "cache.settings_dn");
1190 tmp_ctx = talloc_new(ldb);
1191 if (tmp_ctx == NULL) {
1195 ret = ldb_search(ldb, tmp_ctx, &root_res, ldb_dn_new(tmp_ctx, ldb, ""), LDB_SCOPE_BASE, root_attrs, NULL);
1197 DEBUG(1,("Searching for dsServiceName in rootDSE failed: %s\n",
1198 ldb_errstring(ldb)));
1202 if (root_res->count != 1) {
1206 settings_dn = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, root_res->msgs[0], "dsServiceName");
1208 /* cache the domain_sid in the ldb */
1209 if (ldb_set_opaque(ldb, "cache.settings_dn", settings_dn) != LDB_SUCCESS) {
1213 talloc_steal(ldb, settings_dn);
1214 talloc_free(tmp_ctx);
1219 DEBUG(1,("Failed to find our own NTDS Settings DN in the ldb!\n"));
1220 talloc_free(tmp_ctx);
1225 work out the ntds settings invocationId for the current open ldb
1227 const struct GUID *samdb_ntds_invocation_id(struct ldb_context *ldb)
1229 TALLOC_CTX *tmp_ctx;
1230 const char *attrs[] = { "invocationId", NULL };
1232 struct ldb_result *res;
1233 struct GUID *invocation_id;
1235 /* see if we have a cached copy */
1236 invocation_id = (struct GUID *)ldb_get_opaque(ldb, "cache.invocation_id");
1237 if (invocation_id) {
1238 return invocation_id;
1241 tmp_ctx = talloc_new(ldb);
1242 if (tmp_ctx == NULL) {
1246 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1251 if (res->count != 1) {
1255 invocation_id = talloc(tmp_ctx, struct GUID);
1256 if (!invocation_id) {
1260 *invocation_id = samdb_result_guid(res->msgs[0], "invocationId");
1262 /* cache the domain_sid in the ldb */
1263 if (ldb_set_opaque(ldb, "cache.invocation_id", invocation_id) != LDB_SUCCESS) {
1267 talloc_steal(ldb, invocation_id);
1268 talloc_free(tmp_ctx);
1270 return invocation_id;
1273 DEBUG(1,("Failed to find our own NTDS Settings invocationId in the ldb!\n"));
1274 talloc_free(tmp_ctx);
1278 bool samdb_set_ntds_invocation_id(struct ldb_context *ldb, const struct GUID *invocation_id_in)
1280 TALLOC_CTX *tmp_ctx;
1281 struct GUID *invocation_id_new;
1282 struct GUID *invocation_id_old;
1284 /* see if we have a cached copy */
1285 invocation_id_old = (struct GUID *)ldb_get_opaque(ldb,
1286 "cache.invocation_id");
1288 tmp_ctx = talloc_new(ldb);
1289 if (tmp_ctx == NULL) {
1293 invocation_id_new = talloc(tmp_ctx, struct GUID);
1294 if (!invocation_id_new) {
1298 *invocation_id_new = *invocation_id_in;
1300 /* cache the domain_sid in the ldb */
1301 if (ldb_set_opaque(ldb, "cache.invocation_id", invocation_id_new) != LDB_SUCCESS) {
1305 talloc_steal(ldb, invocation_id_new);
1306 talloc_free(tmp_ctx);
1307 talloc_free(invocation_id_old);
1312 DEBUG(1,("Failed to set our own cached invocationId in the ldb!\n"));
1313 talloc_free(tmp_ctx);
1318 work out the ntds settings objectGUID for the current open ldb
1320 const struct GUID *samdb_ntds_objectGUID(struct ldb_context *ldb)
1322 TALLOC_CTX *tmp_ctx;
1323 const char *attrs[] = { "objectGUID", NULL };
1325 struct ldb_result *res;
1326 struct GUID *ntds_guid;
1328 /* see if we have a cached copy */
1329 ntds_guid = (struct GUID *)ldb_get_opaque(ldb, "cache.ntds_guid");
1334 tmp_ctx = talloc_new(ldb);
1335 if (tmp_ctx == NULL) {
1339 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1344 if (res->count != 1) {
1348 ntds_guid = talloc(tmp_ctx, struct GUID);
1353 *ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
1355 /* cache the domain_sid in the ldb */
1356 if (ldb_set_opaque(ldb, "cache.ntds_guid", ntds_guid) != LDB_SUCCESS) {
1360 talloc_steal(ldb, ntds_guid);
1361 talloc_free(tmp_ctx);
1366 DEBUG(1,("Failed to find our own NTDS Settings objectGUID in the ldb!\n"));
1367 talloc_free(tmp_ctx);
1371 bool samdb_set_ntds_objectGUID(struct ldb_context *ldb, const struct GUID *ntds_guid_in)
1373 TALLOC_CTX *tmp_ctx;
1374 struct GUID *ntds_guid_new;
1375 struct GUID *ntds_guid_old;
1377 /* see if we have a cached copy */
1378 ntds_guid_old = (struct GUID *)ldb_get_opaque(ldb, "cache.ntds_guid");
1380 tmp_ctx = talloc_new(ldb);
1381 if (tmp_ctx == NULL) {
1385 ntds_guid_new = talloc(tmp_ctx, struct GUID);
1386 if (!ntds_guid_new) {
1390 *ntds_guid_new = *ntds_guid_in;
1392 /* cache the domain_sid in the ldb */
1393 if (ldb_set_opaque(ldb, "cache.ntds_guid", ntds_guid_new) != LDB_SUCCESS) {
1397 talloc_steal(ldb, ntds_guid_new);
1398 talloc_free(tmp_ctx);
1399 talloc_free(ntds_guid_old);
1404 DEBUG(1,("Failed to set our own cached invocationId in the ldb!\n"));
1405 talloc_free(tmp_ctx);
1410 work out the server dn for the current open ldb
1412 struct ldb_dn *samdb_server_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1414 return ldb_dn_get_parent(mem_ctx, samdb_ntds_settings_dn(ldb));
1418 work out the server dn for the current open ldb
1420 struct ldb_dn *samdb_server_site_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1422 struct ldb_dn *server_dn;
1423 struct ldb_dn *server_site_dn;
1425 server_dn = samdb_server_dn(ldb, mem_ctx);
1426 if (!server_dn) return NULL;
1428 server_site_dn = ldb_dn_get_parent(mem_ctx, server_dn);
1430 talloc_free(server_dn);
1431 return server_site_dn;
1435 work out if we are the PDC for the domain of the current open ldb
1437 bool samdb_is_pdc(struct ldb_context *ldb)
1439 const char *dom_attrs[] = { "fSMORoleOwner", NULL };
1441 struct ldb_result *dom_res;
1442 TALLOC_CTX *tmp_ctx;
1446 tmp_ctx = talloc_new(ldb);
1447 if (tmp_ctx == NULL) {
1448 DEBUG(1, ("talloc_new failed in samdb_is_pdc"));
1452 ret = ldb_search(ldb, tmp_ctx, &dom_res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, dom_attrs, NULL);
1454 DEBUG(1,("Searching for fSMORoleOwner in %s failed: %s\n",
1455 ldb_dn_get_linearized(ldb_get_default_basedn(ldb)),
1456 ldb_errstring(ldb)));
1459 if (dom_res->count != 1) {
1463 pdc = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, dom_res->msgs[0], "fSMORoleOwner");
1465 if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), pdc) == 0) {
1471 talloc_free(tmp_ctx);
1476 DEBUG(1,("Failed to find if we are the PDC for this ldb\n"));
1477 talloc_free(tmp_ctx);
1482 work out if we are a Global Catalog server for the domain of the current open ldb
1484 bool samdb_is_gc(struct ldb_context *ldb)
1486 const char *attrs[] = { "options", NULL };
1488 struct ldb_result *res;
1489 TALLOC_CTX *tmp_ctx;
1491 tmp_ctx = talloc_new(ldb);
1492 if (tmp_ctx == NULL) {
1493 DEBUG(1, ("talloc_new failed in samdb_is_pdc"));
1497 /* Query cn=ntds settings,.... */
1498 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1500 talloc_free(tmp_ctx);
1503 if (res->count != 1) {
1504 talloc_free(tmp_ctx);
1508 options = ldb_msg_find_attr_as_int(res->msgs[0], "options", 0);
1509 talloc_free(tmp_ctx);
1511 /* if options attribute has the 0x00000001 flag set, then enable the global catlog */
1512 if (options & 0x000000001) {
1518 /* Find a domain object in the parents of a particular DN. */
1519 int samdb_search_for_parent_domain(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
1520 struct ldb_dn **parent_dn, const char **errstring)
1522 TALLOC_CTX *local_ctx;
1523 struct ldb_dn *sdn = dn;
1524 struct ldb_result *res = NULL;
1526 const char *attrs[] = { NULL };
1528 local_ctx = talloc_new(mem_ctx);
1529 if (local_ctx == NULL) return LDB_ERR_OPERATIONS_ERROR;
1531 while ((sdn = ldb_dn_get_parent(local_ctx, sdn))) {
1532 ret = ldb_search(ldb, local_ctx, &res, sdn, LDB_SCOPE_BASE, attrs,
1533 "(|(|(objectClass=domain)(objectClass=builtinDomain))(objectClass=samba4LocalDomain))");
1534 if (ret == LDB_SUCCESS) {
1535 if (res->count == 1) {
1543 if (ret != LDB_SUCCESS) {
1544 *errstring = talloc_asprintf(mem_ctx, "Error searching for parent domain of %s, failed searching for %s: %s",
1545 ldb_dn_get_linearized(dn),
1546 ldb_dn_get_linearized(sdn),
1547 ldb_errstring(ldb));
1548 talloc_free(local_ctx);
1551 if (res->count != 1) {
1552 *errstring = talloc_asprintf(mem_ctx, "Invalid dn (%s), not child of a domain object",
1553 ldb_dn_get_linearized(dn));
1554 talloc_free(local_ctx);
1555 return LDB_ERR_CONSTRAINT_VIOLATION;
1558 *parent_dn = talloc_steal(mem_ctx, res->msgs[0]->dn);
1559 talloc_free(local_ctx);
1565 set the user password using plaintext, obeying any user or domain
1566 password restrictions
1568 note that this function doesn't actually store the result in the
1569 database, it just fills in the "mod" structure with ldb modify
1570 elements to setup the correct change when samdb_replace() is
1571 called. This allows the caller to combine the change with other
1572 changes (as is needed by some of the set user info levels)
1574 The caller should probably have a transaction wrapping this
1576 NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
1577 struct ldb_dn *user_dn,
1578 struct ldb_dn *domain_dn,
1579 struct ldb_message *mod,
1580 const DATA_BLOB *new_password,
1581 struct samr_Password *lmNewHash,
1582 struct samr_Password *ntNewHash,
1584 enum samr_RejectReason *reject_reason,
1585 struct samr_DomInfo1 **_dominfo)
1587 const char * const user_attrs[] = { "userAccountControl", "lmPwdHistory",
1589 "dBCSPwd", "unicodePwd",
1591 "pwdLastSet", NULL };
1592 const char * const domain_attrs[] = { "pwdProperties", "pwdHistoryLength",
1593 "maxPwdAge", "minPwdAge",
1594 "minPwdLength", NULL };
1597 uint_t minPwdLength, pwdProperties, pwdHistoryLength;
1598 uint_t userAccountControl;
1599 struct samr_Password *sambaLMPwdHistory, *sambaNTPwdHistory, *lmPwdHash, *ntPwdHash;
1600 struct samr_Password local_lmNewHash, local_ntNewHash;
1601 int sambaLMPwdHistory_len, sambaNTPwdHistory_len;
1602 struct dom_sid *domain_sid;
1603 struct ldb_message **res;
1606 time_t now = time(NULL);
1610 /* we need to know the time to compute password age */
1611 unix_to_nt_time(&now_nt, now);
1613 /* pull all the user parameters */
1614 count = gendb_search_dn(ctx, mem_ctx, user_dn, &res, user_attrs);
1616 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1618 userAccountControl = samdb_result_uint(res[0], "userAccountControl", 0);
1619 sambaLMPwdHistory_len = samdb_result_hashes(mem_ctx, res[0],
1620 "lmPwdHistory", &sambaLMPwdHistory);
1621 sambaNTPwdHistory_len = samdb_result_hashes(mem_ctx, res[0],
1622 "ntPwdHistory", &sambaNTPwdHistory);
1623 lmPwdHash = samdb_result_hash(mem_ctx, res[0], "dBCSPwd");
1624 ntPwdHash = samdb_result_hash(mem_ctx, res[0], "unicodePwd");
1625 pwdLastSet = samdb_result_uint64(res[0], "pwdLastSet", 0);
1627 /* Only non-trust accounts have restrictions (possibly this
1628 * test is the wrong way around, but I like to be restrictive
1630 restrictions = !(userAccountControl & (UF_INTERDOMAIN_TRUST_ACCOUNT
1631 |UF_WORKSTATION_TRUST_ACCOUNT
1632 |UF_SERVER_TRUST_ACCOUNT));
1635 /* pull the domain parameters */
1636 count = gendb_search_dn(ctx, mem_ctx, domain_dn, &res, domain_attrs);
1638 DEBUG(2, ("samdb_set_password: Domain DN %s is invalid, for user %s\n",
1639 ldb_dn_get_linearized(domain_dn),
1640 ldb_dn_get_linearized(user_dn)));
1641 return NT_STATUS_NO_SUCH_DOMAIN;
1644 /* work out the domain sid, and pull the domain from there */
1645 domain_sid = samdb_result_sid_prefix(mem_ctx, res[0], "objectSid");
1646 if (domain_sid == NULL) {
1647 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1650 count = gendb_search(ctx, mem_ctx, NULL, &res, domain_attrs,
1652 ldap_encode_ndr_dom_sid(mem_ctx, domain_sid));
1654 DEBUG(2, ("samdb_set_password: Could not find domain to match SID: %s, for user %s\n",
1655 dom_sid_string(mem_ctx, domain_sid),
1656 ldb_dn_get_linearized(user_dn)));
1657 return NT_STATUS_NO_SUCH_DOMAIN;
1661 pwdProperties = samdb_result_uint(res[0], "pwdProperties", 0);
1662 pwdHistoryLength = samdb_result_uint(res[0], "pwdHistoryLength", 0);
1663 minPwdLength = samdb_result_uint(res[0], "minPwdLength", 0);
1664 minPwdAge = samdb_result_int64(res[0], "minPwdAge", 0);
1666 if (userAccountControl & UF_PASSWD_NOTREQD) {
1667 /* see [MS-ADTS] 2.2.15 */
1672 struct samr_DomInfo1 *dominfo;
1673 /* on failure we need to fill in the reject reasons */
1674 dominfo = talloc(mem_ctx, struct samr_DomInfo1);
1675 if (dominfo == NULL) {
1676 return NT_STATUS_NO_MEMORY;
1678 dominfo->min_password_length = minPwdLength;
1679 dominfo->password_properties = pwdProperties;
1680 dominfo->password_history_length = pwdHistoryLength;
1681 dominfo->max_password_age = minPwdAge;
1682 dominfo->min_password_age = minPwdAge;
1683 *_dominfo = dominfo;
1686 if (restrictions && new_password) {
1689 /* check the various password restrictions */
1690 if (restrictions && minPwdLength > utf16_len_n(new_password->data, new_password->length) / 2) {
1691 if (reject_reason) {
1692 *reject_reason = SAMR_REJECT_TOO_SHORT;
1694 return NT_STATUS_PASSWORD_RESTRICTION;
1697 /* Create the NT hash */
1698 mdfour(local_ntNewHash.hash, new_password->data, new_password->length);
1700 ntNewHash = &local_ntNewHash;
1702 /* Only check complexity if we can convert it at all. Assuming unconvertable passwords are 'strong' */
1703 if (convert_string_talloc_convenience(mem_ctx, lp_iconv_convenience(ldb_get_opaque(ctx, "loadparm")),
1705 new_password->data, new_password->length,
1706 (void **)&new_pass, NULL, false)) {
1708 /* possibly check password complexity */
1709 if (restrictions && (pwdProperties & DOMAIN_PASSWORD_COMPLEX) &&
1710 !check_password_quality(new_pass)) {
1711 if (reject_reason) {
1712 *reject_reason = SAMR_REJECT_COMPLEXITY;
1714 return NT_STATUS_PASSWORD_RESTRICTION;
1717 /* compute the new lm hashes (for checking history - case insenitivly!) */
1718 if (E_deshash(new_pass, local_lmNewHash.hash)) {
1719 lmNewHash = &local_lmNewHash;
1724 if (restrictions && user_change) {
1725 /* are all password changes disallowed? */
1726 if (pwdProperties & DOMAIN_REFUSE_PASSWORD_CHANGE) {
1727 if (reject_reason) {
1728 *reject_reason = SAMR_REJECT_OTHER;
1730 return NT_STATUS_PASSWORD_RESTRICTION;
1733 /* can this user change password? */
1734 if (userAccountControl & UF_PASSWD_CANT_CHANGE) {
1735 if (reject_reason) {
1736 *reject_reason = SAMR_REJECT_OTHER;
1738 return NT_STATUS_PASSWORD_RESTRICTION;
1741 /* yes, this is a minus. The ages are in negative 100nsec units! */
1742 if (pwdLastSet - minPwdAge > now_nt) {
1743 if (reject_reason) {
1744 *reject_reason = SAMR_REJECT_OTHER;
1746 return NT_STATUS_PASSWORD_RESTRICTION;
1749 /* check the immediately past password */
1750 if (pwdHistoryLength > 0) {
1751 if (lmNewHash && lmPwdHash && memcmp(lmNewHash->hash, lmPwdHash->hash, 16) == 0) {
1752 if (reject_reason) {
1753 *reject_reason = SAMR_REJECT_IN_HISTORY;
1755 return NT_STATUS_PASSWORD_RESTRICTION;
1757 if (ntNewHash && ntPwdHash && memcmp(ntNewHash->hash, ntPwdHash->hash, 16) == 0) {
1758 if (reject_reason) {
1759 *reject_reason = SAMR_REJECT_IN_HISTORY;
1761 return NT_STATUS_PASSWORD_RESTRICTION;
1765 /* check the password history */
1766 sambaLMPwdHistory_len = MIN(sambaLMPwdHistory_len, pwdHistoryLength);
1767 sambaNTPwdHistory_len = MIN(sambaNTPwdHistory_len, pwdHistoryLength);
1769 for (i=0; lmNewHash && i<sambaLMPwdHistory_len;i++) {
1770 if (memcmp(lmNewHash->hash, sambaLMPwdHistory[i].hash, 16) == 0) {
1771 if (reject_reason) {
1772 *reject_reason = SAMR_REJECT_IN_HISTORY;
1774 return NT_STATUS_PASSWORD_RESTRICTION;
1777 for (i=0; ntNewHash && i<sambaNTPwdHistory_len;i++) {
1778 if (memcmp(ntNewHash->hash, sambaNTPwdHistory[i].hash, 16) == 0) {
1779 if (reject_reason) {
1780 *reject_reason = SAMR_REJECT_IN_HISTORY;
1782 return NT_STATUS_PASSWORD_RESTRICTION;
1787 #define CHECK_RET(x) do { if (x != 0) return NT_STATUS_NO_MEMORY; } while(0)
1789 /* the password is acceptable. Start forming the new fields */
1791 /* if we know the cleartext UTF16 password, then set it.
1792 * Modules in ldb will set all the appropriate
1794 CHECK_RET(ldb_msg_add_value(mod, "clearTextPassword", new_password, NULL));
1796 /* We don't have the cleartext, so delete the old one
1797 * and set what we have of the hashes */
1798 CHECK_RET(samdb_msg_add_delete(ctx, mem_ctx, mod, "clearTextPassword"));
1801 CHECK_RET(samdb_msg_add_hash(ctx, mem_ctx, mod, "dBCSPwd", lmNewHash));
1803 CHECK_RET(samdb_msg_add_delete(ctx, mem_ctx, mod, "dBCSPwd"));
1807 CHECK_RET(samdb_msg_add_hash(ctx, mem_ctx, mod, "unicodePwd", ntNewHash));
1809 CHECK_RET(samdb_msg_add_delete(ctx, mem_ctx, mod, "unicodePwd"));
1813 return NT_STATUS_OK;
1818 set the user password using plaintext, obeying any user or domain
1819 password restrictions
1821 This wrapper function takes a SID as input, rather than a user DN,
1822 and actually performs the password change
1825 NTSTATUS samdb_set_password_sid(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
1826 const struct dom_sid *user_sid,
1827 const DATA_BLOB *new_pass,
1828 struct samr_Password *lmNewHash,
1829 struct samr_Password *ntNewHash,
1831 enum samr_RejectReason *reject_reason,
1832 struct samr_DomInfo1 **_dominfo)
1835 struct ldb_dn *user_dn;
1836 struct ldb_message *msg;
1839 ret = ldb_transaction_start(ctx);
1841 DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(ctx)));
1842 return NT_STATUS_TRANSACTION_ABORTED;
1845 user_dn = samdb_search_dn(ctx, mem_ctx, NULL,
1846 "(&(objectSid=%s)(objectClass=user))",
1847 ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
1849 ldb_transaction_cancel(ctx);
1850 DEBUG(3, ("samdb_set_password_sid: SID %s not found in samdb, returning NO_SUCH_USER\n",
1851 dom_sid_string(mem_ctx, user_sid)));
1852 return NT_STATUS_NO_SUCH_USER;
1855 msg = ldb_msg_new(mem_ctx);
1857 ldb_transaction_cancel(ctx);
1858 return NT_STATUS_NO_MEMORY;
1861 msg->dn = ldb_dn_copy(msg, user_dn);
1863 ldb_transaction_cancel(ctx);
1864 return NT_STATUS_NO_MEMORY;
1867 nt_status = samdb_set_password(ctx, mem_ctx,
1870 lmNewHash, ntNewHash,
1871 user_change, /* This is a password set, not change */
1872 reject_reason, _dominfo);
1873 if (!NT_STATUS_IS_OK(nt_status)) {
1874 ldb_transaction_cancel(ctx);
1878 /* modify the samdb record */
1879 ret = samdb_replace(ctx, mem_ctx, msg);
1881 ldb_transaction_cancel(ctx);
1882 return NT_STATUS_ACCESS_DENIED;
1885 ret = ldb_transaction_commit(ctx);
1887 DEBUG(0,("Failed to commit transaction to change password on %s: %s\n",
1888 ldb_dn_get_linearized(msg->dn),
1889 ldb_errstring(ctx)));
1890 return NT_STATUS_TRANSACTION_ABORTED;
1892 return NT_STATUS_OK;
1897 NTSTATUS samdb_create_foreign_security_principal(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
1898 struct dom_sid *sid, struct ldb_dn **ret_dn)
1900 struct ldb_message *msg;
1901 struct ldb_dn *basedn;
1905 sidstr = dom_sid_string(mem_ctx, sid);
1906 NT_STATUS_HAVE_NO_MEMORY(sidstr);
1908 /* We might have to create a ForeignSecurityPrincipal, even if this user
1909 * is in our own domain */
1911 msg = ldb_msg_new(mem_ctx);
1913 return NT_STATUS_NO_MEMORY;
1916 /* TODO: Hmmm. This feels wrong. How do I find the base dn to
1917 * put the ForeignSecurityPrincipals? d_state->domain_dn does
1918 * not work, this is wrong for the Builtin domain, there's no
1919 * cn=For...,cn=Builtin,dc={BASEDN}. -- vl
1922 basedn = samdb_search_dn(sam_ctx, mem_ctx, NULL,
1923 "(&(objectClass=container)(cn=ForeignSecurityPrincipals))");
1925 if (basedn == NULL) {
1926 DEBUG(0, ("Failed to find DN for "
1927 "ForeignSecurityPrincipal container\n"));
1928 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1931 /* add core elements to the ldb_message for the alias */
1932 msg->dn = ldb_dn_copy(mem_ctx, basedn);
1933 if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s", sidstr))
1934 return NT_STATUS_NO_MEMORY;
1936 samdb_msg_add_string(sam_ctx, mem_ctx, msg,
1938 "foreignSecurityPrincipal");
1940 /* create the alias */
1941 ret = ldb_add(sam_ctx, msg);
1943 DEBUG(0,("Failed to create foreignSecurityPrincipal "
1945 ldb_dn_get_linearized(msg->dn),
1946 ldb_errstring(sam_ctx)));
1947 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1950 return NT_STATUS_OK;
1955 Find the DN of a domain, assuming it to be a dotted.dns name
1958 struct ldb_dn *samdb_dns_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char *dns_domain)
1961 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1962 const char *binary_encoded;
1963 const char **split_realm;
1970 split_realm = (const char **)str_list_make(tmp_ctx, dns_domain, ".");
1972 talloc_free(tmp_ctx);
1975 dn = ldb_dn_new(mem_ctx, ldb, NULL);
1976 for (i=0; split_realm[i]; i++) {
1977 binary_encoded = ldb_binary_encode_string(tmp_ctx, split_realm[i]);
1978 if (!ldb_dn_add_base_fmt(dn, "dc=%s", binary_encoded)) {
1979 DEBUG(2, ("Failed to add dc=%s element to DN %s\n",
1980 binary_encoded, ldb_dn_get_linearized(dn)));
1981 talloc_free(tmp_ctx);
1985 if (!ldb_dn_validate(dn)) {
1986 DEBUG(2, ("Failed to validated DN %s\n",
1987 ldb_dn_get_linearized(dn)));
1993 Find the DN of a domain, be it the netbios or DNS name
1996 struct ldb_dn *samdb_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
1997 const char *domain_name)
1999 const char * const domain_ref_attrs[] = {
2002 const char * const domain_ref2_attrs[] = {
2005 struct ldb_result *res_domain_ref;
2006 char *escaped_domain = ldb_binary_encode_string(mem_ctx, domain_name);
2007 /* find the domain's DN */
2008 int ret_domain = ldb_search(ldb, mem_ctx,
2010 samdb_partitions_dn(ldb, mem_ctx),
2013 "(&(nETBIOSName=%s)(objectclass=crossRef))",
2015 if (ret_domain != 0) {
2019 if (res_domain_ref->count == 0) {
2020 ret_domain = ldb_search(ldb, mem_ctx,
2022 samdb_dns_domain_to_dn(ldb, mem_ctx, domain_name),
2025 "(objectclass=domain)");
2026 if (ret_domain != 0) {
2030 if (res_domain_ref->count == 1) {
2031 return res_domain_ref->msgs[0]->dn;
2036 if (res_domain_ref->count > 1) {
2037 DEBUG(0,("Found %d records matching domain [%s]\n",
2038 ret_domain, domain_name));
2042 return samdb_result_dn(ldb, mem_ctx, res_domain_ref->msgs[0], "nCName", NULL);
2048 use a GUID to find a DN
2050 int dsdb_find_dn_by_guid(struct ldb_context *ldb,
2051 TALLOC_CTX *mem_ctx,
2052 const char *guid_str, struct ldb_dn **dn)
2055 struct ldb_result *res;
2056 const char *attrs[] = { NULL };
2057 struct ldb_request *search_req;
2059 struct ldb_search_options_control *options;
2061 expression = talloc_asprintf(mem_ctx, "objectGUID=%s", guid_str);
2063 DEBUG(0, (__location__ ": out of memory\n"));
2064 return LDB_ERR_OPERATIONS_ERROR;
2067 res = talloc_zero(mem_ctx, struct ldb_result);
2069 DEBUG(0, (__location__ ": out of memory\n"));
2070 return LDB_ERR_OPERATIONS_ERROR;
2073 ret = ldb_build_search_req(&search_req, ldb, mem_ctx,
2074 ldb_get_default_basedn(ldb),
2078 res, ldb_search_default_callback,
2080 if (ret != LDB_SUCCESS) {
2084 /* we need to cope with cross-partition links, so search for
2085 the GUID over all partitions */
2086 options = talloc(search_req, struct ldb_search_options_control);
2087 if (options == NULL) {
2088 DEBUG(0, (__location__ ": out of memory\n"));
2089 return LDB_ERR_OPERATIONS_ERROR;
2091 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
2093 ret = ldb_request_add_control(search_req,
2094 LDB_CONTROL_SEARCH_OPTIONS_OID,
2096 if (ret != LDB_SUCCESS) {
2100 ret = ldb_request(ldb, search_req);
2101 if (ret != LDB_SUCCESS) {
2105 ret = ldb_wait(search_req->handle, LDB_WAIT_ALL);
2106 if (ret != LDB_SUCCESS) {
2110 /* this really should be exactly 1, but there is a bug in the
2111 partitions module that can return two here with the
2112 search_options control set */
2113 if (res->count < 1) {
2114 return LDB_ERR_NO_SUCH_OBJECT;
2117 *dn = res->msgs[0]->dn;
2124 use a DN to find a GUID
2126 int dsdb_find_guid_by_dn(struct ldb_context *ldb,
2127 struct ldb_dn *dn, struct GUID *guid)
2130 struct ldb_result *res;
2131 const char *attrs[] = { "objectGUID" };
2132 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
2134 ret = ldb_search(ldb, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL);
2135 if (ret != LDB_SUCCESS) {
2136 talloc_free(tmp_ctx);
2139 *guid = samdb_result_guid(res->msgs[0], "objectGUID");
2140 talloc_free(tmp_ctx);