2 Unix SMB/CIFS implementation.
4 interface functions for the sam database
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 struct auth_session_info;
26 struct dsdb_control_current_partition;
27 struct dsdb_extended_replicated_object;
28 struct dsdb_extended_replicated_objects;
29 struct loadparm_context;
30 struct tevent_context;
32 struct dsdb_trust_routing_table;
34 #include "librpc/gen_ndr/security.h"
36 #include "lib/ldb-samba/ldif_handlers.h"
37 #include "librpc/gen_ndr/samr.h"
38 #include "librpc/gen_ndr/drsuapi.h"
39 #include "librpc/gen_ndr/drsblobs.h"
40 #include "dsdb/schema/schema.h"
41 #include "dsdb/samdb/samdb_proto.h"
42 #include "dsdb/common/dsdb_dn.h"
43 #include "dsdb/common/proto.h"
44 #include "../libds/common/flags.h"
46 #define DSDB_CONTROL_CURRENT_PARTITION_OID "1.3.6.1.4.1.7165.4.3.2"
47 struct dsdb_control_current_partition {
49 * this is the version of the dsdb_control_current_partition
50 * version 0: initial implementation
51 * version 1: got rid of backend and module fields
53 #define DSDB_CONTROL_CURRENT_PARTITION_VERSION 1
60 flags in dsdb_repl_flags to control replication logic
62 #define DSDB_REPL_FLAG_PRIORITISE_INCOMING 1
63 #define DSDB_REPL_FLAG_PARTIAL_REPLICA 2
64 #define DSDB_REPL_FLAG_ADD_NCNAME 4
65 #define DSDB_REPL_FLAG_EXPECT_NO_SECRETS 8
68 #define DSDB_CONTROL_REPLICATED_UPDATE_OID "1.3.6.1.4.1.7165.4.3.3"
69 struct dsdb_control_replicated_update {
70 uint32_t dsdb_repl_flags;
73 #define DSDB_CONTROL_DN_STORAGE_FORMAT_OID "1.3.6.1.4.1.7165.4.3.4"
74 /* DSDB_CONTROL_DN_STORAGE_FORMAT_OID has NULL data and behaves very
75 * much like LDB_CONTROL_EXTENDED_DN_OID when the DB stores an
76 * extended DN, and otherwise returns normal DNs */
78 #define DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID "1.3.6.1.4.1.7165.4.3.8"
80 struct dsdb_control_password_change_status {
82 uint32_t pwdProperties;
83 uint32_t pwdHistoryLength;
86 uint32_t minPwdLength;
88 const char *netbios_domain;
89 const char *dns_domain;
92 enum samPwdChangeReason reject_reason;
95 #define DSDB_CONTROL_PASSWORD_HASH_VALUES_OID "1.3.6.1.4.1.7165.4.3.9"
97 #define DSDB_CONTROL_PASSWORD_CHANGE_OID "1.3.6.1.4.1.7165.4.3.10"
98 struct dsdb_control_password_change {
99 const struct samr_Password *old_nt_pwd_hash;
100 const struct samr_Password *old_lm_pwd_hash;
104 DSDB_CONTROL_APPLY_LINKS is internal to Samba4 - a token passed between repl_meta_data and linked_attributes modules
106 #define DSDB_CONTROL_APPLY_LINKS "1.3.6.1.4.1.7165.4.3.11"
109 * this should only be used for importing users from Samba3
111 #define DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID "1.3.6.1.4.1.7165.4.3.12"
114 OID used to allow the replacement of replPropertyMetaData.
115 It is used when the current replmetadata needs to be edited.
117 #define DSDB_CONTROL_CHANGEREPLMETADATA_OID "1.3.6.1.4.1.7165.4.3.14"
119 /* passed when we want to get the behaviour of the non-global catalog port */
120 #define DSDB_CONTROL_NO_GLOBAL_CATALOG "1.3.6.1.4.1.7165.4.3.17"
122 /* passed when we want special behaviour for partial replicas */
123 #define DSDB_CONTROL_PARTIAL_REPLICA "1.3.6.1.4.1.7165.4.3.18"
125 /* passed when we want special behaviour for dbcheck */
126 #define DSDB_CONTROL_DBCHECK "1.3.6.1.4.1.7165.4.3.19"
128 /* passed when dbcheck wants to modify a read only replica (very special case) */
129 #define DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA "1.3.6.1.4.1.7165.4.3.19.1"
131 /* passed when importing plain text password on upgrades */
132 #define DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET_OID "1.3.6.1.4.1.7165.4.3.20"
135 * passed from the descriptor module in order to
136 * store the recalucated nTSecurityDescriptor without
137 * modifying the replPropertyMetaData.
139 #define DSDB_CONTROL_SEC_DESC_PROPAGATION_OID "1.3.6.1.4.1.7165.4.3.21"
142 * passed when creating a interdomain trust account through LSA
143 * to relax constraints in the samldb ldb module.
145 #define DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID "1.3.6.1.4.1.7165.4.3.23"
148 * Internal control to mark requests as being part of Tombstone restoring
149 * procedure - it requires slightly special behavior like:
150 * - a bit different security checks
151 * - restoring certain attributes to their default values, etc
153 #define DSDB_CONTROL_RESTORE_TOMBSTONE_OID "1.3.6.1.4.1.7165.4.3.24"
156 OID used to allow the replacement of replPropertyMetaData.
157 It is used when the current replmetadata needs only to be re-sorted, but not edited.
159 #define DSDB_CONTROL_CHANGEREPLMETADATA_RESORT_OID "1.3.6.1.4.1.7165.4.3.25"
162 * pass the default state of pwdLastSet between the "samldb" and "password_hash"
165 #define DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID "1.3.6.1.4.1.7165.4.3.26"
168 * pass the userAccountControl changes between the "samldb" and "password_hash"
171 #define DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID "1.3.6.1.4.1.7165.4.3.27"
172 struct dsdb_control_password_user_account_control {
173 uint32_t req_flags; /* the flags given by the client request */
174 uint32_t old_flags; /* the old flags stored (0 on add) */
175 uint32_t new_flags; /* the new flags stored */
179 * Ignores strict checking when adding objects to samldb.
180 * This is used when provisioning, as checking all objects when added
181 * was slow due to an unindexed search.
183 #define DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID "1.3.6.1.4.1.7165.4.3.28"
185 /* passed when we want to thoroughly delete linked attributes */
186 #define DSDB_CONTROL_REPLMD_VANISH_LINKS "1.3.6.1.4.1.7165.4.3.29"
188 #define DSDB_EXTENDED_REPLICATED_OBJECTS_OID "1.3.6.1.4.1.7165.4.4.1"
189 struct dsdb_extended_replicated_object {
190 struct ldb_message *msg;
191 struct GUID object_guid;
192 struct GUID *parent_guid;
193 const char *when_changed;
194 struct replPropertyMetaDataBlob *meta_data;
196 /* Only used for internal processing in repl_meta_data */
197 struct ldb_dn *last_known_parent;
198 struct ldb_dn *local_parent_dn;
201 struct dsdb_extended_replicated_objects {
203 * this is the version of the dsdb_extended_replicated_objects
204 * version 0: initial implementation
206 #define DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION 2
209 /* DSDB_REPL_FLAG_* flags */
210 uint32_t dsdb_repl_flags;
212 struct ldb_dn *partition_dn;
214 const struct repsFromTo1 *source_dsa;
215 const struct drsuapi_DsReplicaCursor2CtrEx *uptodateness_vector;
217 uint32_t num_objects;
218 struct dsdb_extended_replicated_object *objects;
220 uint32_t linked_attributes_count;
221 const struct drsuapi_DsReplicaLinkedAttribute *linked_attributes;
226 #define DSDB_EXTENDED_CREATE_PARTITION_OID "1.3.6.1.4.1.7165.4.4.4"
227 struct dsdb_create_partition_exop {
228 struct ldb_dn *new_dn;
232 * the schema_dn is passed as struct ldb_dn in
233 * req->op.extended.data
235 #define DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID "1.3.6.1.4.1.7165.4.4.2"
237 #define DSDB_EXTENDED_SCHEMA_UPGRADE_IN_PROGRESS_OID "1.3.6.1.4.1.7165.4.4.6"
239 #define DSDB_OPENLDAP_DEREFERENCE_CONTROL "1.3.6.1.4.1.4203.666.5.16"
241 struct dsdb_openldap_dereference {
242 const char *source_attribute;
243 const char **dereference_attribute;
246 struct dsdb_openldap_dereference_control {
247 struct dsdb_openldap_dereference **dereference;
250 struct dsdb_openldap_dereference_result {
251 const char *source_attribute;
252 const char *dereferenced_dn;
254 struct ldb_message_element *attributes;
257 struct dsdb_openldap_dereference_result_control {
258 struct dsdb_openldap_dereference_result **attributes;
261 struct samldb_msds_intid_persistant {
265 #define SAMLDB_MSDS_INTID_OPAQUE "SAMLDB_MSDS_INTID_OPAQUE"
267 #define DSDB_PARTITION_DN "@PARTITION"
268 #define DSDB_PARTITION_ATTR "partition"
270 #define DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME "dsdb_extended_dn_store_format"
271 struct dsdb_extended_dn_store_format {
272 bool store_extended_dn_in_ldb;
275 #define DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME "DSDB_OPAQUE_PARTITION_MODULE_MSG"
277 /* this takes a struct dsdb_fsmo_extended_op */
278 #define DSDB_EXTENDED_ALLOCATE_RID_POOL "1.3.6.1.4.1.7165.4.4.5"
280 struct dsdb_fsmo_extended_op {
282 struct GUID destination_dsa_guid;
286 * passed from the descriptor module in order to
287 * store the recalucated nTSecurityDescriptor without
288 * modifying the replPropertyMetaData.
290 #define DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID "1.3.6.1.4.1.7165.4.4.7"
291 struct dsdb_extended_sec_desc_propagation_op {
292 struct ldb_dn *nc_root;
297 #define DSDB_ACL_CHECKS_DIRSYNC_FLAG 0x1
298 #define DSDB_SAMDB_MINIMUM_ALLOWED_RID 1000
300 #define DSDB_METADATA_SCHEMA_SEQ_NUM "SCHEMA_SEQ_NUM"
303 * must be in LDB_FLAG_INTERNAL_MASK
304 * see also the values in lib/ldb/include/ldb_module.h
306 #define DSDB_FLAG_INTERNAL_FORCE_META_DATA 0x10000
308 #endif /* __SAMDB_H__ */