s4-dsdb Add module to send only 'simple' DNs to OpenLDAP backends

If we send the full extended DN, then we risk standards-complient LDAP
servers rejecting it as invalid.  Only the DN portion is needed to
resolve the record in any case, and any SID or GUID componenets have
already been evaluated into the DN.

Andrew Bartlett

diff --git a/source4/dsdb/samdb/ldb_modules/samba_dsdb.c b/source4/dsdb/samdb/ldb_modules/samba_dsdb.c
index 4d0f9465b029f6f262251727ae74b57c5590141b..9536981393768ff27a15481f78eb8b7cfde04b36 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/samba_dsdb.c
+++ b/source4/dsdb/samdb/ldb_modules/samba_dsdb.c
@@ -209,9 +209,9 @@ static int samba_dsdb_init(struct ldb_module *module)
 
        const char **backend_modules;
        static const char *fedora_ds_backend_modules[] = {
-               "nsuniqueid", "paged_searches", NULL };
+               "nsuniqueid", "paged_searches", "simple_dn", NULL };
        static const char *openldap_backend_modules[] = {
-               "entryuuid", "paged_searches", NULL };
+               "entryuuid", "paged_searches", "simple_dn", NULL };
 
        static const char *samba_dsdb_attrs[] = { "backendType", "serverRole", NULL };
        const char *backendType, *serverRole;

diff --git a/source4/dsdb/samdb/ldb_modules/simple_dn.c b/source4/dsdb/samdb/ldb_modules/simple_dn.c
new file mode 100644 (file)
index 0000000..d863290
--- /dev/null
+++ b/source4/dsdb/samdb/ldb_modules/simple_dn.c
@@ -0,0 +1,73 @@
+/*
+   ldb database library
+
+   Copyright (C) Andrew Bartlett 2010
+
+   This program is free software; you can redistribute it and/or modify
+   it under the terms of the GNU General Public License as published by
+   the Free Software Foundation; either version 3 of the License, or
+   (at your option) any later version.
+
+   This program is distributed in the hope that it will be useful,
+   but WITHOUT ANY WARRANTY; without even the implied warranty of
+   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+   GNU General Public License for more details.
+
+   You should have received a copy of the GNU General Public License
+   along with this program.  If not, see <http://www.gnu.org/licenses/>.
+*/
+/*
+ *  Name: ldb
+ *
+ *  Component: ldb dn simplification module
+ *
+ *  Description: Module to strip off extended componenets from search DNs (not accepted by OpenLDAP backends)
+ *
+ *  Author: Andrew Bartlett
+ */
+
+
+
+#include "includes.h"
+#include "ldb_module.h"
+#include "dsdb/samdb/ldb_modules/util.h"
+
+/* search */
+static int simple_dn_search(struct ldb_module *module, struct ldb_request *req)
+{
+       struct ldb_context *ldb;
+       struct ldb_request *down_req;
+       struct ldb_dn *new_base;
+       int ret;
+
+       ldb = ldb_module_get_ctx(module);
+
+       new_base = ldb_dn_copy(req, req->op.search.base);
+       if (!new_base) {
+               ldb_module_oom(module);
+       }
+
+       ldb_dn_remove_extended_components(new_base);
+
+       ret = ldb_build_search_req_ex(&down_req,
+                                     ldb, req,
+                                     new_base,
+                                     req->op.search.scope,
+                                     req->op.search.tree,
+                                     req->op.search.attrs,
+                                     req->controls,
+                                     req, dsdb_next_callback,
+                                     req);
+       LDB_REQ_SET_LOCATION(down_req);
+       if (ret != LDB_SUCCESS) {
+               return ldb_operr(ldb);
+       }
+       talloc_steal(down_req, new_base);
+
+       return ldb_next_request(module, down_req);
+}
+
+_PUBLIC_ const struct ldb_module_ops ldb_simple_dn_module_ops = {
+       .name              = "simple_dn",
+       .search = simple_dn_search
+};

diff --git a/source4/dsdb/samdb/ldb_modules/wscript_build b/source4/dsdb/samdb/ldb_modules/wscript_build
index f6b1e9cdc5b75755d87f922827666c2b9fdb5590..e6f69561638763ab0196c3591aa8f7ac00b6d8a7 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/wscript_build
+++ b/source4/dsdb/samdb/ldb_modules/wscript_build
@@ -350,3 +350,11 @@ bld.SAMBA_MODULE('ldb_aclread',
        internal_module=False,
        deps='talloc LIBEVENTS LIBSECURITY SAMDB',
        )
+
+bld.SAMBA_MODULE('ldb_simple_dn',
+       source='simple_dn.c',
+       subsystem='ldb',
+       init_function='LDB_MODULE(simple_dn)',
+       internal_module=False,
+       deps='talloc DSDB_MODULE_HELPERS'
+       )