s4:dsdb: Make use of DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS search flag

Signed-off-by: Jo Sutton <josutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index c16e6908ed3b37aaf3bcd39e50d2519996602093..010cc78e6692c4fa99898fd5ec25a19ccf9e5d92 100644 (file)
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -162,5 +162,4 @@
 #
 # GMSA tests
 #
-^samba\.tests\.krb5\.gmsa_tests\.samba\.tests\.krb5\.gmsa_tests\.GmsaTests\.test_authentication_triggers_keys_update\(ad_dc:local\)$
 ^samba\.tests\.krb5\.gmsa_tests\.samba\.tests\.krb5\.gmsa_tests\.GmsaTests\.test_retrieving_managed_password_triggers_keys_update\(ad_dc:local\)$

diff --git a/source3/passdb/pdb_samba_dsdb.c b/source3/passdb/pdb_samba_dsdb.c
index 067bcbbd53595330c94fbb83c05a6612370622f8..bc3fa743b08157c776f16450a7354d1a493e4ae3 100644 (file)
--- a/source3/passdb/pdb_samba_dsdb.c
+++ b/source3/passdb/pdb_samba_dsdb.c
@@ -662,6 +662,11 @@ static NTSTATUS pdb_samba_dsdb_getsamupriv(struct pdb_samba_dsdb_state *state,
                "codePage",
                "unicodePwd",
                "dBCSPwd",
+               /* Required for Group Managed Service Accounts. */
+               "msDS-ManagedPasswordId",
+               "msDS-ManagedPasswordInterval",
+               "objectClass",
+               "whenCreated",
                NULL};
 
        int rc = dsdb_search_one(state->ldb,
@@ -670,7 +675,7 @@ static NTSTATUS pdb_samba_dsdb_getsamupriv(struct pdb_samba_dsdb_state *state,
                                 ldb_get_default_basedn(state->ldb),
                                 LDB_SCOPE_SUBTREE,
                                 attrs,
-                                0,
+                                DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                 "%s",
                                 filter);
        if (rc != LDB_SUCCESS) {

diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index 2543c3566e2948e3936932f0becb05b53e37963a..1445adf226121c37908d5d70f532a8d4a137a79c 100644 (file)
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -832,6 +832,7 @@ out:
 NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
                                   TALLOC_CTX *mem_ctx, const char *principal,
                                   const char **attrs,
+                                  const uint32_t dsdb_flags,
                                   struct ldb_dn **domain_dn,
                                   struct ldb_message **msg)
 {
@@ -854,7 +855,7 @@ NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
        /* pull the user attributes */
        ret = dsdb_search_one(sam_ctx, tmp_ctx, msg, user_dn,
                              LDB_SCOPE_BASE, attrs,
-                             DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                             dsdb_flags | DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
                              "(objectClass=*)");
        if (ret != LDB_SUCCESS) {
                talloc_free(tmp_ctx);
@@ -892,7 +893,7 @@ NTSTATUS authsam_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
 
        if (principal) {
                nt_status = sam_get_results_principal(sam_ctx, tmp_ctx, principal,
-                                                     user_attrs, &domain_dn, &msg);
+                                                     user_attrs, DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS, &domain_dn, &msg);
                if (!NT_STATUS_IS_OK(nt_status)) {
                        talloc_free(tmp_ctx);
                        return nt_status;
@@ -903,7 +904,7 @@ NTSTATUS authsam_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
                /* pull the user attributes */
                ret = dsdb_search_one(sam_ctx, tmp_ctx, &msg, user_dn,
                                      LDB_SCOPE_BASE, user_attrs,
-                                     DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                                     DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                      "(objectClass=*)");
                if (ret == LDB_ERR_NO_SUCH_OBJECT) {
                        talloc_free(tmp_ctx);
@@ -1020,7 +1021,7 @@ NTSTATUS authsam_reread_user_logon_data(
                             &res,
                             user_msg->dn,
                             user_attrs,
-                            DSDB_SEARCH_SHOW_EXTENDED_DN);
+                            DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS);
        if (ret != LDB_SUCCESS) {
                DBG_ERR("Unable to re-read account control data for %s\n",
                        ldb_dn_get_linearized(user_msg->dn));
@@ -1542,7 +1543,7 @@ NTSTATUS authsam_search_account(TALLOC_CTX *mem_ctx, struct ldb_context *sam_ctx
        /* pull the user attributes */
        ret = dsdb_search_one(sam_ctx, mem_ctx, ret_msg, domain_dn, LDB_SCOPE_SUBTREE,
                              user_attrs,
-                             DSDB_SEARCH_SHOW_EXTENDED_DN,
+                             DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                              "(&(sAMAccountName=%s)(objectclass=user))",
                              account_name_encoded);
        if (ret == LDB_ERR_NO_SUCH_OBJECT) {

diff --git a/source4/kdc/db-glue.c b/source4/kdc/db-glue.c
index 744136a545f856e495a7511829ec9524abe2e60c..783602d8e0089c7e82d9aa782068181ed5eceeaa 100644 (file)
--- a/source4/kdc/db-glue.c
+++ b/source4/kdc/db-glue.c
@@ -2311,6 +2311,7 @@ static krb5_error_code samba_kdc_lookup_client(krb5_context context,
                                                TALLOC_CTX *mem_ctx,
                                                krb5_const_principal principal,
                                                const char **attrs,
+                                               const uint32_t dsdb_flags,
                                                struct ldb_dn **realm_dn,
                                                struct ldb_message **msg)
 {
@@ -2342,7 +2343,7 @@ static krb5_error_code samba_kdc_lookup_client(krb5_context context,
        }
 
        nt_status = sam_get_results_principal(kdc_db_ctx->samdb,
-                                             mem_ctx, principal_string, attrs,
+                                             mem_ctx, principal_string, attrs, dsdb_flags,
                                              realm_dn, msg);
        if (NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_SUCH_USER)) {
                krb5_principal fallback_principal = NULL;
@@ -2422,7 +2423,7 @@ static krb5_error_code samba_kdc_lookup_client(krb5_context context,
                        nt_status = sam_get_results_principal(kdc_db_ctx->samdb,
                                                              mem_ctx,
                                                              fallback_string,
-                                                             attrs,
+                                                             attrs, dsdb_flags,
                                                              realm_dn, msg);
                        SAFE_FREE(fallback_string);
                }
@@ -2455,7 +2456,7 @@ static krb5_error_code samba_kdc_fetch_client(krb5_context context,
        struct ldb_message *msg = NULL;
 
        ret = samba_kdc_lookup_client(context, kdc_db_ctx,
-                                     mem_ctx, principal, user_attrs,
+                                     mem_ctx, principal, user_attrs, DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                      &realm_dn, &msg);
        if (ret != 0) {
                return ret;
@@ -2545,7 +2546,7 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
                if (krbtgt_number == kdc_db_ctx->my_krbtgt_number) {
                        lret = dsdb_search_one(kdc_db_ctx->samdb, tmp_ctx,
                                               &msg, kdc_db_ctx->krbtgt_dn, LDB_SCOPE_BASE,
-                                              krbtgt_attrs, DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                                              krbtgt_attrs, DSDB_SEARCH_NO_GLOBAL_CATALOG | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                               "(objectClass=user)");
                } else {
                        /* We need to look up an RODC krbtgt (perhaps
@@ -2554,7 +2555,7 @@ static krb5_error_code samba_kdc_fetch_krbtgt(krb5_context context,
                        lret = dsdb_search_one(kdc_db_ctx->samdb, tmp_ctx,
                                               &msg, realm_dn, LDB_SCOPE_SUBTREE,
                                               krbtgt_attrs,
-                                              DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                                              DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                               "(&(objectClass=user)(msDS-SecondaryKrbTgtNumber=%u))", (unsigned)(krbtgt_number));
                }
 
@@ -2685,7 +2686,7 @@ static krb5_error_code samba_kdc_lookup_server(krb5_context context,
                                          mem_ctx,
                                          msg, user_dn, LDB_SCOPE_BASE,
                                          server_attrs,
-                                         DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                                         DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                          "(objectClass=*)");
                if (ldb_ret != LDB_SUCCESS) {
                        return SDB_ERR_NOENTRY;
@@ -2700,7 +2701,7 @@ static krb5_error_code samba_kdc_lookup_server(krb5_context context,
                 * not AS-REQ packets.
                 */
                return samba_kdc_lookup_client(context, kdc_db_ctx,
-                                              mem_ctx, principal, server_attrs,
+                                              mem_ctx, principal, server_attrs, DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                               realm_dn, msg);
        } else {
                /*
@@ -2790,7 +2791,7 @@ static krb5_error_code samba_kdc_lookup_server(krb5_context context,
                lret = dsdb_search_one(kdc_db_ctx->samdb, mem_ctx, msg,
                                       *realm_dn, LDB_SCOPE_SUBTREE,
                                       server_attrs,
-                                      DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                                      DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                       "%s", filter);
                if (lret == LDB_ERR_NO_SUCH_OBJECT) {
                        DBG_DEBUG("Failed to find an entry for %s filter:%s\n",
@@ -3215,7 +3216,7 @@ krb5_error_code samba_kdc_firstkey(krb5_context context,
 
        lret = dsdb_search(ldb_ctx, priv, &res,
                           priv->realm_dn, LDB_SCOPE_SUBTREE, user_attrs,
-                          DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                          DSDB_SEARCH_NO_GLOBAL_CATALOG | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                           "(objectClass=user)");
 
        if (lret != LDB_SUCCESS) {
@@ -3310,7 +3311,7 @@ samba_kdc_check_pkinit_ms_upn_match(krb5_context context,
 
        ret = samba_kdc_lookup_client(context, kdc_db_ctx,
                                      mem_ctx, certificate_principal,
-                                     ms_upn_check_attrs, &realm_dn, &msg);
+                                     ms_upn_check_attrs, 0, &realm_dn, &msg);
 
        if (ret != 0) {
                talloc_free(mem_ctx);
@@ -3771,7 +3772,7 @@ NTSTATUS samba_kdc_setup_db_ctx(TALLOC_CTX *mem_ctx, struct samba_kdc_base_conte
                                          ldb_get_default_basedn(kdc_db_ctx->samdb),
                                          LDB_SCOPE_SUBTREE,
                                          krbtgt_attrs,
-                                         DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                                         DSDB_SEARCH_NO_GLOBAL_CATALOG | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
                                          "(&(objectClass=user)(samAccountName=krbtgt))");
 
                if (ldb_ret != LDB_SUCCESS) {

diff --git a/source4/ntp_signd/ntp_signd.c b/source4/ntp_signd/ntp_signd.c
index e7ceba0f8a0db5c3930b6fbfcad0351159f44f9c..aee8c16087704ebeeca6b3a3f12f2a33784b42c9 100644 (file)
--- a/source4/ntp_signd/ntp_signd.c
+++ b/source4/ntp_signd/ntp_signd.c
@@ -31,6 +31,7 @@
 #include "libcli/util/tstream.h"
 #include "librpc/gen_ndr/ndr_ntp_signd.h"
 #include "param/param.h"
+#include "dsdb/common/util.h"
 #include "dsdb/samdb/samdb.h"
 #include "auth/auth.h"
 #include "libcli/security/security.h"
@@ -111,7 +112,17 @@ static NTSTATUS ntp_signd_process(struct ntp_signd_connection *ntp_signd_conn,
        struct signed_reply signed_reply;
        enum ndr_err_code ndr_err;
        struct ldb_result *res;
-       const char *attrs[] = { "unicodePwd", "userAccountControl", "cn", NULL };
+       static const char *attrs[] = {
+               "unicodePwd",
+               "userAccountControl",
+               "cn",
+               /* Required for Group Managed Service Accounts. */
+               "msDS-ManagedPasswordId",
+               "msDS-ManagedPasswordInterval",
+               "objectClass",
+               "objectSid",
+               "whenCreated",
+               NULL};
        gnutls_hash_hd_t hash_hnd = NULL;
        struct samr_Password *nt_hash;
        uint32_t user_account_control;
@@ -165,13 +176,14 @@ static NTSTATUS ntp_signd_process(struct ntp_signd_connection *ntp_signd_conn,
                                       sign_request.packet_id);
        }
 
-       ret = ldb_search(ntp_signd_conn->ntp_signd->samdb, mem_ctx,
-                                &res,
-                                ldb_get_default_basedn(ntp_signd_conn->ntp_signd->samdb),
-                                LDB_SCOPE_SUBTREE,
-                                attrs,
-                                "(&(objectSid=%s)(objectClass=user))",
-                                ldap_encode_ndr_dom_sid(mem_ctx, sid));
+       ret = dsdb_search(ntp_signd_conn->ntp_signd->samdb, mem_ctx,
+                         &res,
+                         ldb_get_default_basedn(ntp_signd_conn->ntp_signd->samdb),
+                         LDB_SCOPE_SUBTREE,
+                         attrs,
+                         DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
+                         "(&(objectSid=%s)(objectClass=user))",
+                         ldap_encode_ndr_dom_sid(mem_ctx, sid));
        if (ret != LDB_SUCCESS) {
                DEBUG(2, ("Failed to search for SID %s in SAM for NTP signing: "
                          "%s\n",

diff --git a/source4/ntp_signd/wscript_build b/source4/ntp_signd/wscript_build
index ec8a2e5b85aeeed377caafd32cd8d8fa1196edca..4349df04c5a0aca4847d67b1881c813b1f55bd42 100644 (file)
--- a/source4/ntp_signd/wscript_build
+++ b/source4/ntp_signd/wscript_build
@@ -4,8 +4,7 @@ bld.SAMBA_MODULE('service_ntp_signd',
        source='ntp_signd.c',
        subsystem='service',
        init_function='server_service_ntp_signd_init',
-       deps='samdb NDR_NTP_SIGND LIBTSOCKET LIBSAMBA_TSOCKET GNUTLS_HELPERS',
+       deps='samdb NDR_NTP_SIGND LIBTSOCKET LIBSAMBA_TSOCKET GNUTLS_HELPERS samdb-common',
        internal_module=False,
        enabled=bld.AD_DC_BUILD_IS_ENABLED()
        )
-

diff --git a/source4/rpc_server/netlogon/dcerpc_netlogon.c b/source4/rpc_server/netlogon/dcerpc_netlogon.c
index 729812acfd9f71ef7fa2d0d85fe36dcf2197bdb1..175ff532b4a49adc7f450cbcfac10db19223fe32 100644 (file)
--- a/source4/rpc_server/netlogon/dcerpc_netlogon.c
+++ b/source4/rpc_server/netlogon/dcerpc_netlogon.c
@@ -34,6 +34,7 @@
 #include "lib/messaging/irpc.h"
 #include "librpc/gen_ndr/ndr_irpc_c.h"
 #include "../libcli/ldap/ldap_ndr.h"
+#include "dsdb/common/util.h"
 #include "dsdb/samdb/ldb_modules/util.h"
 #include "lib/tsocket/tsocket.h"
 #include "librpc/gen_ndr/ndr_netlogon.h"
@@ -407,14 +408,19 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3_helper(
        struct samr_Password *curNtHash = NULL;
        struct samr_Password *prevNtHash = NULL;
        uint32_t user_account_control;
-       int num_records;
        struct ldb_message **msgs;
        NTSTATUS nt_status;
-       static const char *attrs[] = {"unicodePwd",
-                                     "userAccountControl",
-                                     "objectSid",
-                                     "samAccountName",
-                                     NULL};
+       static const char *attrs[] = {
+               "unicodePwd",
+               "userAccountControl",
+               "objectSid",
+               "samAccountName",
+               /* Required for Group Managed Service Accounts. */
+               "msDS-ManagedPasswordId",
+               "msDS-ManagedPasswordInterval",
+               "objectClass",
+               "whenCreated",
+               NULL};
        uint32_t server_flags = 0;
        uint32_t negotiate_flags = 0;
 
@@ -642,29 +648,33 @@ static NTSTATUS dcesrv_netr_ServerAuthenticate3_helper(
                *trust_account_for_search = r->in.account_name;
        }
 
-       /* pull the user attributes */
-       num_records = gendb_search(sam_ctx, mem_ctx, NULL, &msgs, attrs,
-                                  "(&(sAMAccountName=%s)(objectclass=user))",
-                                  ldb_binary_encode_string(mem_ctx,
-                                                           *trust_account_for_search));
-
-       if (num_records == 0) {
-               DEBUG(3,("Couldn't find user [%s] in samdb.\n",
+       {
+               struct ldb_result *res = NULL;
+               int ret;
+
+               /* pull the user attributes */
+               ret = dsdb_search(
+                       sam_ctx,
+                       mem_ctx,
+                       &res,
+                       ldb_get_default_basedn(sam_ctx),
+                       LDB_SCOPE_SUBTREE,
+                       attrs,
+                       DSDB_SEARCH_ONE_ONLY | DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
+                       "(&(sAMAccountName=%s)(objectclass=user))",
+                       ldb_binary_encode_string(mem_ctx,
+                                                *trust_account_for_search));
+               if (ret) {
+                       DEBUG(3,("Couldn't find user [%s] in samdb.\n",
                         log_escape(mem_ctx, r->in.account_name)));
-               return dcesrv_netr_ServerAuthenticate3_check_downgrade(
+                       return dcesrv_netr_ServerAuthenticate3_check_downgrade(
                                dce_call, r, pipe_state, negotiate_flags,
                                NULL, /* trust_account_in_db */
                                NT_STATUS_NO_TRUST_SAM_ACCOUNT);
-       }
+               }
 
-       if (num_records > 1) {
-               DEBUG(0,("Found %d records matching user [%s]\n",
-                        num_records,
-                        log_escape(mem_ctx, r->in.account_name)));
-               return dcesrv_netr_ServerAuthenticate3_check_downgrade(
-                               dce_call, r, pipe_state, negotiate_flags,
-                               NULL, /* trust_account_in_db */
-                               NT_STATUS_INTERNAL_DB_CORRUPTION);
+               msgs = talloc_steal(mem_ctx, res->msgs);
+               talloc_free(res);
        }
 
        *trust_account_in_db = ldb_msg_find_attr_as_string(msgs[0],
@@ -4418,10 +4428,16 @@ static NTSTATUS dcesrv_netr_ServerGetTrustInfo(struct dcesrv_call_state *dce_cal
        struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
        struct netlogon_creds_CredentialState *creds = NULL;
        struct ldb_context *sam_ctx = NULL;
-       const char * const attrs[] = {
+       static const char * const attrs[] = {
                "unicodePwd",
                "sAMAccountName",
                "userAccountControl",
+               /* Required for Group Managed Service Accounts. */
+               "msDS-ManagedPasswordId",
+               "msDS-ManagedPasswordInterval",
+               "objectClass",
+               "objectSid",
+               "whenCreated",
                NULL
        };
        struct ldb_message **res = NULL;
@@ -4476,11 +4492,25 @@ static NTSTATUS dcesrv_netr_ServerGetTrustInfo(struct dcesrv_call_state *dce_cal
                return NT_STATUS_NO_MEMORY;
        }
 
-       ret = gendb_search(sam_ctx, mem_ctx, NULL, &res, attrs,
-                          "(&(objectClass=user)(objectSid=%s))",
-                          asid);
-       if (ret != 1) {
-               return NT_STATUS_ACCOUNT_DISABLED;
+       {
+               struct ldb_result *result = NULL;
+
+               ret = dsdb_search(sam_ctx,
+                                 mem_ctx,
+                                 &result,
+                                 ldb_get_default_basedn(sam_ctx),
+                                 LDB_SCOPE_SUBTREE,
+                                 attrs,
+                                 DSDB_SEARCH_ONE_ONLY |
+                                         DSDB_SEARCH_UPDATE_MANAGED_PASSWORDS,
+                                 "(&(objectClass=user)(objectSid=%s))",
+                                 asid);
+               if (ret) {
+                       return NT_STATUS_ACCOUNT_DISABLED;
+               }
+
+               res = talloc_steal(mem_ctx, result->msgs);
+               talloc_free(result);
        }
 
        switch (creds->secure_channel_type) {

diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build
index 31ec4f60c9a6e114c3eebfb6eb5ef899a45e2c08..8cb898df6e4dee7770dd8f33083f830714041759 100644 (file)
--- a/source4/rpc_server/wscript_build
+++ b/source4/rpc_server/wscript_build
@@ -120,6 +120,7 @@ bld.SAMBA_MODULE('dcerpc_netlogon',
                       DSDB_MODULE_HELPERS
                       util_str_escape
                       DCERPC_SERVER_NETLOGON
+                      samdb-common
                       '''
                  )