2 Unix SMB/CIFS implementation.
4 implement the DsAddEntry call
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Andrew Tridgell 2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "dsdb/common/util.h"
27 #include "param/param.h"
28 #include "libcli/security/security.h"
29 #include "libcli/security/session.h"
30 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
31 #include "librpc/gen_ndr/ndr_drsuapi.h"
34 add special SPNs needed for DRS replication to machine accounts when
35 an AddEntry is done to create a nTDSDSA object
37 static WERROR drsuapi_add_SPNs(struct drsuapi_bind_state *b_state,
38 struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
39 const struct drsuapi_DsReplicaObjectListItem *first_object)
42 const struct drsuapi_DsReplicaObjectListItem *obj;
43 const char *attrs[] = { "serverReference", "objectGUID", NULL };
45 for (obj = first_object; obj; obj=obj->next_object) {
46 const char *dn_string = obj->object.identifier->dn;
47 struct ldb_dn *dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, dn_string);
48 struct ldb_result *res, *res2;
49 struct ldb_dn *ref_dn;
50 struct GUID ntds_guid;
51 struct ldb_message *msg;
52 struct ldb_message_element *el;
53 const char *ntds_guid_str;
54 const char *dom_string;
55 const char *attrs2[] = { "dNSHostName", "cn", NULL };
56 const char *dNSHostName, *cn;
58 DEBUG(6,(__location__ ": Adding SPNs for %s\n",
59 ldb_dn_get_linearized(dn)));
61 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res,
62 dn, LDB_SCOPE_BASE, attrs,
63 "(objectClass=ntDSDSA)");
64 if (ret != LDB_SUCCESS) {
65 DEBUG(0,(__location__ ": Failed to find dn '%s'\n", dn_string));
66 return WERR_DS_DRA_INTERNAL_ERROR;
70 /* we only add SPNs for nTDSDSA objects */
74 ref_dn = samdb_result_dn(b_state->sam_ctx, mem_ctx, res->msgs[0], "serverReference", NULL);
76 /* we only add SPNs for objects with a
81 DEBUG(6,(__location__ ": serverReference %s\n",
82 ldb_dn_get_linearized(ref_dn)));
84 ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
86 ntds_guid_str = GUID_string(res, &ntds_guid);
88 dom_string = lpcfg_dnsdomain(dce_call->conn->dce_ctx->lp_ctx);
90 /* get the dNSHostName and cn */
91 ret = ldb_search(b_state->sam_ctx, mem_ctx, &res2,
92 ref_dn, LDB_SCOPE_BASE, attrs2, NULL);
93 if (ret != LDB_SUCCESS) {
94 DEBUG(0,(__location__ ": Failed to find ref_dn '%s'\n",
95 ldb_dn_get_linearized(ref_dn)));
96 return WERR_DS_DRA_INTERNAL_ERROR;
99 dNSHostName = ldb_msg_find_attr_as_string(res2->msgs[0], "dNSHostName", NULL);
100 cn = ldb_msg_find_attr_as_string(res2->msgs[0], "cn", NULL);
103 * construct a modify request to add the new SPNs to
104 * the machine account
106 msg = ldb_msg_new(mem_ctx);
112 ret = ldb_msg_add_empty(msg, "servicePrincipalName",
113 LDB_FLAG_MOD_ADD, &el);
114 if (ret != LDB_SUCCESS) {
119 ldb_msg_add_steal_string(msg, "servicePrincipalName",
120 talloc_asprintf(el->values,
121 "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
122 ntds_guid_str, dom_string));
123 ldb_msg_add_steal_string(msg, "servicePrincipalName",
124 talloc_asprintf(el->values, "ldap/%s._msdcs.%s",
125 ntds_guid_str, dom_string));
127 ldb_msg_add_steal_string(msg, "servicePrincipalName",
128 talloc_asprintf(el->values, "ldap/%s", cn));
131 ldb_msg_add_steal_string(msg, "servicePrincipalName",
132 talloc_asprintf(el->values, "ldap/%s", dNSHostName));
134 if (el->num_values < 2) {
138 ret = dsdb_modify(b_state->sam_ctx, msg, DSDB_MODIFY_PERMISSIVE);
139 if (ret != LDB_SUCCESS) {
140 DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
141 ldb_errstring(b_state->sam_ctx)));
142 return WERR_DS_DRA_INTERNAL_ERROR;
155 WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
156 struct drsuapi_DsAddEntry *r)
159 struct drsuapi_bind_state *b_state;
160 struct dcesrv_handle *h;
162 struct drsuapi_DsReplicaObjectIdentifier2 *ids = NULL;
164 const struct drsuapi_DsReplicaObjectListItem *first_object;
167 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry, NDR_IN, r);
170 /* TODO: check which out level the client supports */
172 ZERO_STRUCTP(r->out.ctr);
173 *r->out.level_out = 3;
174 r->out.ctr->ctr3.err_ver = 1;
175 r->out.ctr->ctr3.err_data = talloc_zero(mem_ctx, union drsuapi_DsAddEntry_ErrData);
177 DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
180 status = drs_security_level_check(dce_call, "DsAddEntry", SECURITY_DOMAIN_CONTROLLER, NULL);
181 if (!W_ERROR_IS_OK(status)) {
185 switch (r->in.level) {
187 ret = ldb_transaction_start(b_state->sam_ctx);
188 if (ret != LDB_SUCCESS) {
189 return WERR_DS_DRA_INTERNAL_ERROR;
193 first_object = &r->in.req->req2.first_object;
195 status = dsdb_origin_objects_commit(b_state->sam_ctx,
200 if (!W_ERROR_IS_OK(status)) {
201 r->out.ctr->ctr3.err_data->v1.status = status;
202 ldb_transaction_cancel(b_state->sam_ctx);
203 DEBUG(0,(__location__ ": DsAddEntry failed - %s\n", win_errstr(status)));
207 r->out.ctr->ctr3.count = num;
208 r->out.ctr->ctr3.objects = ids;
215 /* if any of the added entries are nTDSDSA objects then we
216 * need to add the SPNs to the machine account
218 status = drsuapi_add_SPNs(b_state, dce_call, mem_ctx, first_object);
219 if (!W_ERROR_IS_OK(status)) {
220 r->out.ctr->ctr3.err_data->v1.status = status;
221 ldb_transaction_cancel(b_state->sam_ctx);
222 DEBUG(0,(__location__ ": DsAddEntry add SPNs failed - %s\n", win_errstr(status)));
226 ret = ldb_transaction_commit(b_state->sam_ctx);
227 if (ret != LDB_SUCCESS) {
228 DEBUG(0,(__location__ ": DsAddEntry commit failed: %s\n",
229 ldb_errstring(b_state->sam_ctx)));
230 return WERR_DS_DRA_INTERNAL_ERROR;