source3/passdb/pdb_samba_dsdb.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    pdb glue module for direct access to the dsdb via LDB APIs
   4    Copyright (C) Volker Lendecke 2009-2011
   5    Copyright (C) Andrew Bartlett 2010-2012
   6    Copyright (C) Matthias Dieter Wallnöfer                 2009
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /* This module, is a port of Volker's pdb_ads to ldb and DSDB APIs */
  23
  24 #include "includes.h"
  25 #include "source3/include/passdb.h"
  26 #include "source4/dsdb/samdb/samdb.h"
  27 #include "ldb_errors.h"
  28 #include "libcli/security/dom_sid.h"
  29 #include "source4/winbind/idmap.h"
  30 #include "librpc/gen_ndr/ndr_security.h"
  31 #include "librpc/gen_ndr/ndr_drsblobs.h"
  32 #include "librpc/gen_ndr/ndr_lsa.h"
  33 #include "libds/common/flag_mapping.h"
  34 #include "source4/lib/events/events.h"
  35 #include "source4/auth/session.h"
  36 #include "source4/auth/system_session_proto.h"
  37 #include "lib/param/param.h"
  38 #include "source4/dsdb/common/util.h"
  39 #include "source3/include/secrets.h"
  40 #include "source4/auth/auth_sam.h"
  41 #include "auth/credentials/credentials.h"
  42 #include "lib/util/base64.h"
  43 #include "libcli/ldap/ldap_ndr.h"
  44 #include "lib/util/util_ldb.h"
  45
  46 struct pdb_samba_dsdb_state {
  47         struct tevent_context *ev;
  48         struct ldb_context *ldb;
  49         struct idmap_context *idmap_ctx;
  50         struct loadparm_context *lp_ctx;
  51 };
  52
  53 static NTSTATUS pdb_samba_dsdb_getsampwsid(struct pdb_methods *m,
  54                                     struct samu *sam_acct,
  55                                     const struct dom_sid *sid);
  56 static NTSTATUS pdb_samba_dsdb_getsamupriv(struct pdb_samba_dsdb_state *state,
  57                                     const char *filter,
  58                                     TALLOC_CTX *mem_ctx,
  59                                     struct ldb_message **pmsg);
  60 static bool pdb_samba_dsdb_sid_to_id(struct pdb_methods *m, const struct dom_sid *sid,
  61                                  struct unixid *id);
  62
  63 static bool pdb_samba_dsdb_pull_time(struct ldb_message *msg, const char *attr,
  64                               time_t *ptime)
  65 {
  66         uint64_t tmp;
  67         if (! ldb_msg_find_element(msg, attr)) {
  68                 return false;
  69         }
  70         tmp = ldb_msg_find_attr_as_uint64(msg, attr, 0);
  71         *ptime = nt_time_to_unix(tmp);
  72         return true;
  73 }
  74
  75 static struct pdb_domain_info *pdb_samba_dsdb_get_domain_info(
  76         struct pdb_methods *m, TALLOC_CTX *mem_ctx)
  77 {
  78         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
  79                 m->private_data, struct pdb_samba_dsdb_state);
  80         struct pdb_domain_info *info;
  81         struct dom_sid *domain_sid;
  82         struct ldb_dn *forest_dn, *domain_dn;
  83         struct ldb_result *dom_res = NULL;
  84         const char *dom_attrs[] = {
  85                 "objectSid",
  86                 "objectGUID",
  87                 "fSMORoleOwner",
  88                 NULL
  89         };
  90         char *p;
  91         int ret;
  92
  93         info = talloc(mem_ctx, struct pdb_domain_info);
  94         if (info == NULL) {
  95                 return NULL;
  96         }
  97
  98         domain_dn = ldb_get_default_basedn(state->ldb);
  99
 100         ret = ldb_search(state->ldb, info, &dom_res,
 101                          domain_dn, LDB_SCOPE_BASE, dom_attrs, NULL);
 102         if (ret != LDB_SUCCESS) {
 103                 goto fail;
 104         }
 105         if (dom_res->count != 1) {
 106                 goto fail;
 107         }
 108
 109         info->guid = samdb_result_guid(dom_res->msgs[0], "objectGUID");
 110
 111         domain_sid = samdb_result_dom_sid(state, dom_res->msgs[0], "objectSid");
 112         if (!domain_sid) {
 113                 goto fail;
 114         }
 115         info->sid = *domain_sid;
 116
 117         TALLOC_FREE(dom_res);
 118
 119         info->name = talloc_strdup(info, lpcfg_sam_name(state->lp_ctx));
 120         info->dns_domain = ldb_dn_canonical_string(info, domain_dn);
 121
 122         if (!info->dns_domain) {
 123                 goto fail;
 124         }
 125         p = strchr(info->dns_domain, '/');
 126         if (p) {
 127                 *p = '\0';
 128         }
 129
 130         forest_dn = ldb_get_root_basedn(state->ldb);
 131         if (!forest_dn) {
 132                 goto fail;
 133         }
 134
 135         info->dns_forest = ldb_dn_canonical_string(info, forest_dn);
 136         if (!info->dns_forest) {
 137                 goto fail;
 138         }
 139         p = strchr(info->dns_forest, '/');
 140         if (p) {
 141                 *p = '\0';
 142         }
 143
 144         return info;
 145
 146 fail:
 147         TALLOC_FREE(dom_res);
 148         TALLOC_FREE(info);
 149         return NULL;
 150 }
 151
 152 static struct ldb_message *pdb_samba_dsdb_get_samu_private(
 153         struct pdb_methods *m, struct samu *sam)
 154 {
 155         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 156                 m->private_data, struct pdb_samba_dsdb_state);
 157         struct ldb_message *msg;
 158         struct dom_sid_buf sidstr;
 159         char *filter;
 160         NTSTATUS status;
 161
 162         msg = (struct ldb_message *)
 163                 pdb_get_backend_private_data(sam, m);
 164
 165         if (msg != NULL) {
 166                 return talloc_get_type_abort(msg, struct ldb_message);
 167         }
 168
 169         filter = talloc_asprintf(
 170                 talloc_tos(),
 171                 "(&(objectsid=%s)(objectclass=user))",
 172                 dom_sid_str_buf(pdb_get_user_sid(sam), &sidstr));
 173         if (filter == NULL) {
 174                 return NULL;
 175         }
 176
 177         status = pdb_samba_dsdb_getsamupriv(state, filter, sam, &msg);
 178         TALLOC_FREE(filter);
 179         if (!NT_STATUS_IS_OK(status)) {
 180                 return NULL;
 181         }
 182
 183         return msg;
 184 }
 185
 186 static NTSTATUS pdb_samba_dsdb_init_sam_from_priv(struct pdb_methods *m,
 187                                            struct samu *sam,
 188                                            struct ldb_message *msg)
 189 {
 190         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 191                 m->private_data, struct pdb_samba_dsdb_state);
 192         TALLOC_CTX *frame = talloc_stackframe();
 193         NTSTATUS status = NT_STATUS_INTERNAL_DB_CORRUPTION;
 194         const char *str;
 195         time_t tmp_time;
 196         struct dom_sid *sid, group_sid;
 197         uint64_t n;
 198         const DATA_BLOB *blob;
 199
 200         str = ldb_msg_find_attr_as_string(msg, "samAccountName", NULL);
 201         if (str == NULL) {
 202                 DEBUG(10, ("no samAccountName\n"));
 203                 goto fail;
 204         }
 205         pdb_set_username(sam, str, PDB_SET);
 206
 207         if (pdb_samba_dsdb_pull_time(msg, "lastLogon", &tmp_time)) {
 208                 pdb_set_logon_time(sam, tmp_time, PDB_SET);
 209         }
 210         if (pdb_samba_dsdb_pull_time(msg, "lastLogoff", &tmp_time)) {
 211                 pdb_set_logoff_time(sam, tmp_time, PDB_SET);
 212         }
 213         if (pdb_samba_dsdb_pull_time(msg, "pwdLastSet", &tmp_time)) {
 214                 pdb_set_pass_last_set_time(sam, tmp_time, PDB_SET);
 215         }
 216         if (pdb_samba_dsdb_pull_time(msg, "accountExpires", &tmp_time)) {
 217                 pdb_set_kickoff_time(sam, tmp_time, PDB_SET);
 218         }
 219
 220         str = ldb_msg_find_attr_as_string(msg, "displayName",
 221                                             NULL);
 222         if (str != NULL) {
 223                 pdb_set_fullname(sam, str, PDB_SET);
 224         }
 225
 226         str = ldb_msg_find_attr_as_string(msg, "homeDirectory",
 227                                             NULL);
 228         if (str != NULL) {
 229                 pdb_set_homedir(sam, str, PDB_SET);
 230         }
 231
 232         str = ldb_msg_find_attr_as_string(msg, "homeDrive", NULL);
 233         if (str != NULL) {
 234                 pdb_set_dir_drive(sam, str, PDB_SET);
 235         }
 236
 237         str = ldb_msg_find_attr_as_string(msg, "scriptPath", NULL);
 238         if (str != NULL) {
 239                 pdb_set_logon_script(sam, str, PDB_SET);
 240         }
 241
 242         str = ldb_msg_find_attr_as_string(msg, "profilePath",
 243                                             NULL);
 244         if (str != NULL) {
 245                 pdb_set_profile_path(sam, str, PDB_SET);
 246         }
 247
 248         str = ldb_msg_find_attr_as_string(msg, "comment",
 249                                             NULL);
 250         if (str != NULL) {
 251                 pdb_set_comment(sam, str, PDB_SET);
 252         }
 253
 254         str = ldb_msg_find_attr_as_string(msg, "description",
 255                                             NULL);
 256         if (str != NULL) {
 257                 pdb_set_acct_desc(sam, str, PDB_SET);
 258         }
 259
 260         str = ldb_msg_find_attr_as_string(msg, "userWorkstations",
 261                                             NULL);
 262         if (str != NULL) {
 263                 pdb_set_workstations(sam, str, PDB_SET);
 264         }
 265
 266         blob = ldb_msg_find_ldb_val(msg, "userParameters");
 267         if (blob != NULL) {
 268                 str = base64_encode_data_blob(frame, *blob);
 269                 if (str == NULL) {
 270                         DEBUG(0, ("base64_encode_data_blob() failed\n"));
 271                         goto fail;
 272                 }
 273                 pdb_set_munged_dial(sam, str, PDB_SET);
 274         }
 275
 276         sid = samdb_result_dom_sid(talloc_tos(), msg, "objectSid");
 277         if (!sid) {
 278                 DEBUG(10, ("Could not pull SID\n"));
 279                 goto fail;
 280         }
 281         pdb_set_user_sid(sam, sid, PDB_SET);
 282
 283         n = samdb_result_acct_flags(msg, "msDS-User-Account-Control-Computed");
 284         if (n == 0) {
 285                 DEBUG(10, ("Could not pull userAccountControl\n"));
 286                 goto fail;
 287         }
 288         pdb_set_acct_ctrl(sam, n, PDB_SET);
 289
 290         blob = ldb_msg_find_ldb_val(msg, "unicodePwd");
 291         if (blob) {
 292                 if (blob->length != NT_HASH_LEN) {
 293                         DEBUG(0, ("Got NT hash of length %d, expected %d\n",
 294                                   (int)blob->length, NT_HASH_LEN));
 295                         goto fail;
 296                 }
 297                 pdb_set_nt_passwd(sam, blob->data, PDB_SET);
 298         }
 299
 300         blob = ldb_msg_find_ldb_val(msg, "dBCSPwd");
 301         if (blob) {
 302                 if (blob->length != LM_HASH_LEN) {
 303                         DEBUG(0, ("Got LM hash of length %d, expected %d\n",
 304                                   (int)blob->length, LM_HASH_LEN));
 305                         goto fail;
 306                 }
 307                 pdb_set_lanman_passwd(sam, blob->data, PDB_SET);
 308         }
 309
 310         n = ldb_msg_find_attr_as_uint(msg, "primaryGroupID", 0);
 311         if (n == 0) {
 312                 DEBUG(10, ("Could not pull primaryGroupID\n"));
 313                 goto fail;
 314         }
 315         sid_compose(&group_sid, samdb_domain_sid(state->ldb), n);
 316         pdb_set_group_sid(sam, &group_sid, PDB_SET);
 317
 318         status = NT_STATUS_OK;
 319 fail:
 320         TALLOC_FREE(frame);
 321         return status;
 322 }
 323
 324 static bool pdb_samba_dsdb_add_time(struct ldb_message *msg,
 325                                 const char *attrib, time_t t)
 326 {
 327         uint64_t nt_time;
 328
 329         unix_to_nt_time(&nt_time, t);
 330
 331         return ldb_msg_add_fmt(msg, attrib, "%llu", (unsigned long long) nt_time);
 332 }
 333
 334 static int pdb_samba_dsdb_replace_by_sam(struct pdb_samba_dsdb_state *state,
 335                                      bool (*need_update)(const struct samu *,
 336                                                          enum pdb_elements),
 337                                      struct ldb_dn *dn,
 338                                      struct samu *sam)
 339 {
 340         TALLOC_CTX *frame = talloc_stackframe();
 341         int ret = LDB_SUCCESS;
 342         const char *pw;
 343         struct ldb_message *msg;
 344         struct ldb_request *req;
 345         uint32_t dsdb_flags = 0;
 346         /* TODO: All fields :-) */
 347
 348         msg = ldb_msg_new(frame);
 349         if (!msg) {
 350                 talloc_free(frame);
 351                 return false;
 352         }
 353
 354         msg->dn = dn;
 355
 356         /* build modify request */
 357         ret = ldb_build_mod_req(&req, state->ldb, frame, msg, NULL, NULL,
 358                                 ldb_op_default_callback,
 359                                 NULL);
 360         if (ret != LDB_SUCCESS) {
 361                 talloc_free(frame);
 362                 return ret;
 363         }
 364
 365         /* If we set a plaintext password, the system will
 366          * force the pwdLastSet to now() */
 367         if (need_update(sam, PDB_PASSLASTSET)) {
 368                 dsdb_flags |= DSDB_PASSWORD_BYPASS_LAST_SET;
 369
 370                 ret |= pdb_samba_dsdb_add_time(msg, "pwdLastSet",
 371                                            pdb_get_pass_last_set_time(sam));
 372         }
 373
 374         pw = pdb_get_plaintext_passwd(sam);
 375         if (need_update(sam, PDB_PLAINTEXT_PW)) {
 376                 struct ldb_val pw_utf16;
 377                 if (pw == NULL) {
 378                         talloc_free(frame);
 379                         return LDB_ERR_OPERATIONS_ERROR;
 380                 }
 381
 382                 if (!convert_string_talloc(msg,
 383                                            CH_UNIX, CH_UTF16,
 384                                            pw, strlen(pw),
 385                                            (void *)&pw_utf16.data,
 386                                            &pw_utf16.length)) {
 387                         talloc_free(frame);
 388                         return LDB_ERR_OPERATIONS_ERROR;
 389                 }
 390                 ret |= ldb_msg_add_value(msg, "clearTextPassword", &pw_utf16, NULL);
 391         } else {
 392                 bool changed_lm_pw = false;
 393                 bool changed_nt_pw = false;
 394                 bool changed_history = false;
 395                 if (need_update(sam, PDB_LMPASSWD)) {
 396                         struct ldb_val val;
 397                         val.data = discard_const_p(uint8_t, pdb_get_lanman_passwd(sam));
 398                         if (!val.data) {
 399                                 samdb_msg_add_delete(state->ldb, msg, msg,
 400                                                      "dBCSPwd");
 401                         } else {
 402                                 val.length = LM_HASH_LEN;
 403                                 ret |= ldb_msg_add_value(msg, "dBCSPwd", &val, NULL);
 404                         }
 405                         changed_lm_pw = true;
 406                 }
 407                 if (need_update(sam, PDB_NTPASSWD)) {
 408                         struct ldb_val val;
 409                         val.data = discard_const_p(uint8_t, pdb_get_nt_passwd(sam));
 410                         if (!val.data) {
 411                                 samdb_msg_add_delete(state->ldb, msg, msg,
 412                                                      "unicodePwd");
 413                         } else {
 414                                 val.length = NT_HASH_LEN;
 415                                 ret |= ldb_msg_add_value(msg, "unicodePwd", &val, NULL);
 416                         }
 417                         changed_nt_pw = true;
 418                 }
 419
 420                 /* Try to ensure we don't get out of sync */
 421                 if (changed_lm_pw && !changed_nt_pw) {
 422                         samdb_msg_add_delete(state->ldb, msg, msg,
 423                                              "unicodePwd");
 424                 } else if (changed_nt_pw && !changed_lm_pw) {
 425                         samdb_msg_add_delete(state->ldb, msg, msg,
 426                                              "dBCSPwd");
 427                 }
 428                 if (changed_lm_pw || changed_nt_pw) {
 429                         samdb_msg_add_delete(state->ldb, msg, msg,
 430                                              "supplementalCredentials");
 431
 432                 }
 433
 434                 if (need_update(sam, PDB_PWHISTORY)) {
 435                         uint32_t current_hist_len;
 436                         const uint8_t *history = pdb_get_pw_history(sam, &current_hist_len);
 437
 438                         bool invalid_history = false;
 439                         struct samr_Password *history_hashes = talloc_array(talloc_tos(), struct samr_Password,
 440                                                                             current_hist_len);
 441                         if (!history) {
 442                                 invalid_history = true;
 443                         } else {
 444                                 unsigned int i;
 445                                 /* Parse the history into the correct format */
 446                                 for (i = 0; i < current_hist_len; i++) {
 447                                         if (!all_zero(&history[i*PW_HISTORY_ENTRY_LEN],
 448                                                       16)) {
 449                                                 /* If the history is in the old format, with a salted hash, then we can't migrate it to AD format */
 450                                                 invalid_history = true;
 451                                                 break;
 452                                         }
 453                                         /* Copy out the 2nd 16 bytes of the 32 byte password history, containing the NT hash */
 454                                         memcpy(history_hashes[i].hash,
 455                                                &history[(i*PW_HISTORY_ENTRY_LEN) + PW_HISTORY_SALT_LEN],
 456                                                sizeof(history_hashes[i].hash));
 457                                 }
 458                         }
 459                         if (invalid_history) {
 460                                 ret |= samdb_msg_add_delete(state->ldb, msg, msg,
 461                                                      "ntPwdHistory");
 462
 463                                 ret |= samdb_msg_add_delete(state->ldb, msg, msg,
 464                                                      "lmPwdHistory");
 465                         } else {
 466                                 ret |= samdb_msg_add_hashes(state->ldb, msg, msg,
 467                                                             "ntPwdHistory",
 468                                                             history_hashes,
 469                                                             current_hist_len);
 470                         }
 471                         changed_history = true;
 472                 }
 473                 if (changed_lm_pw || changed_nt_pw || changed_history) {
 474                         /* These attributes can only be modified directly by using a special control */
 475                         dsdb_flags |= DSDB_BYPASS_PASSWORD_HASH;
 476                 }
 477         }
 478
 479         /* PDB_USERSID is only allowed on ADD, handled in caller */
 480         if (need_update(sam, PDB_GROUPSID)) {
 481                 const struct dom_sid *sid = pdb_get_group_sid(sam);
 482                 uint32_t rid;
 483                 NTSTATUS status = dom_sid_split_rid(NULL, sid, NULL, &rid);
 484                 if (!NT_STATUS_IS_OK(status)) {
 485                         talloc_free(frame);
 486                         return LDB_ERR_OPERATIONS_ERROR;
 487                 }
 488                 if (!dom_sid_in_domain(samdb_domain_sid(state->ldb), sid)) {
 489                         talloc_free(frame);
 490                         return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
 491                 }
 492                 ret |= samdb_msg_add_uint(state->ldb, msg, msg, "primaryGroupID", rid);
 493         }
 494         if (need_update(sam, PDB_FULLNAME)) {
 495                 ret |= ldb_msg_add_string(msg, "displayName", pdb_get_fullname(sam));
 496         }
 497
 498         if (need_update(sam, PDB_SMBHOME)) {
 499                 ret |= ldb_msg_add_string(msg, "homeDirectory",
 500                                           pdb_get_homedir(sam));
 501         }
 502
 503         if (need_update(sam, PDB_PROFILE)) {
 504                 ret |= ldb_msg_add_string(msg, "profilePath",
 505                                           pdb_get_profile_path(sam));
 506         }
 507
 508         if (need_update(sam, PDB_DRIVE)) {
 509                 ret |= ldb_msg_add_string(msg, "homeDrive",
 510                                           pdb_get_dir_drive(sam));
 511         }
 512
 513         if (need_update(sam, PDB_LOGONSCRIPT)) {
 514                 ret |= ldb_msg_add_string(msg, "scriptPath",
 515                                           pdb_get_logon_script(sam));
 516         }
 517
 518         if (need_update(sam, PDB_KICKOFFTIME)) {
 519                 ret |= pdb_samba_dsdb_add_time(msg, "accountExpires",
 520                                         pdb_get_kickoff_time(sam));
 521         }
 522
 523         if (need_update(sam, PDB_LOGONTIME)) {
 524                 ret |= pdb_samba_dsdb_add_time(msg, "lastLogon",
 525                                         pdb_get_logon_time(sam));
 526         }
 527
 528         if (need_update(sam, PDB_LOGOFFTIME)) {
 529                 ret |= pdb_samba_dsdb_add_time(msg, "lastLogoff",
 530                                         pdb_get_logoff_time(sam));
 531         }
 532
 533         if (need_update(sam, PDB_USERNAME)) {
 534                 ret |= ldb_msg_add_string(msg, "samAccountName",
 535                                           pdb_get_username(sam));
 536         }
 537
 538         if (need_update(sam, PDB_HOURSLEN) || need_update(sam, PDB_HOURS)) {
 539                 struct ldb_val hours = data_blob_const(pdb_get_hours(sam), pdb_get_hours_len(sam));
 540                 ret |= ldb_msg_add_value(msg, "logonHours",
 541                                          &hours, NULL);
 542         }
 543
 544         if (need_update(sam, PDB_ACCTCTRL)) {
 545                 ret |= samdb_msg_add_acct_flags(state->ldb, msg, msg,
 546                                                 "userAccountControl", pdb_get_acct_ctrl(sam));
 547         }
 548
 549         if (need_update(sam, PDB_COMMENT)) {
 550                 ret |= ldb_msg_add_string(msg, "comment",
 551                                           pdb_get_comment(sam));
 552         }
 553
 554         if (need_update(sam, PDB_ACCTDESC)) {
 555                 ret |= ldb_msg_add_string(msg, "description",
 556                                           pdb_get_acct_desc(sam));
 557         }
 558
 559         if (need_update(sam, PDB_WORKSTATIONS)) {
 560                 ret |= ldb_msg_add_string(msg, "userWorkstations",
 561                                           pdb_get_workstations(sam));
 562         }
 563
 564         /* This will need work, it is actually a UTF8 'string' with internal NULLs, to handle TS parameters */
 565         if (need_update(sam, PDB_MUNGEDDIAL)) {
 566                 const char *base64_munged_dial = NULL;
 567
 568                 base64_munged_dial = pdb_get_munged_dial(sam);
 569                 if (base64_munged_dial != NULL && strlen(base64_munged_dial) > 0) {
 570                         struct ldb_val blob;
 571
 572                         blob = base64_decode_data_blob_talloc(msg,
 573                                                         base64_munged_dial);
 574                         if (blob.data == NULL) {
 575                                 DEBUG(0, ("Failed to decode userParameters from "
 576                                           "munged dialback string[%s] for %s\n",
 577                                           base64_munged_dial,
 578                                           ldb_dn_get_linearized(msg->dn)));
 579                                 talloc_free(frame);
 580                                 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
 581                         }
 582                         ret |= ldb_msg_add_steal_value(msg, "userParameters",
 583                                                        &blob);
 584                 }
 585         }
 586
 587         if (need_update(sam, PDB_COUNTRY_CODE)) {
 588                 ret |= ldb_msg_add_fmt(msg, "countryCode",
 589                                        "%i", (int)pdb_get_country_code(sam));
 590         }
 591
 592         if (need_update(sam, PDB_CODE_PAGE)) {
 593                 ret |= ldb_msg_add_fmt(msg, "codePage",
 594                                        "%i", (int)pdb_get_code_page(sam));
 595         }
 596
 597         /* Not yet handled here or not meaningful for modifies on a Samba_Dsdb backend:
 598         PDB_BAD_PASSWORD_TIME,
 599         PDB_CANCHANGETIME, - these are calculated per policy, not stored
 600         PDB_DOMAIN,
 601         PDB_NTUSERNAME, - this makes no sense, and never really did
 602         PDB_LOGONDIVS,
 603         PDB_USERSID, - Handled in pdb_samba_dsdb_add_sam_account()
 604         PDB_FIELDS_PRESENT,
 605         PDB_BAD_PASSWORD_COUNT,
 606         PDB_LOGON_COUNT,
 607         PDB_UNKNOWN6,
 608         PDB_BACKEND_PRIVATE_DATA,
 609
 610  */
 611         if (ret != LDB_SUCCESS) {
 612                 talloc_free(frame);
 613                 return LDB_ERR_OPERATIONS_ERROR;
 614         }
 615
 616         if (msg->num_elements == 0) {
 617                 talloc_free(frame);
 618                 /* Nothing to do, just return success */
 619                 return LDB_SUCCESS;
 620         }
 621
 622         ret = dsdb_replace(state->ldb, msg, dsdb_flags);
 623
 624         if (ret != LDB_SUCCESS) {
 625                 DEBUG(0,("Failed to modify account record %s to set user attributes: %s\n",
 626                          ldb_dn_get_linearized(msg->dn),
 627                          ldb_errstring(state->ldb)));
 628         }
 629
 630         talloc_free(frame);
 631         return ret;
 632 }
 633
 634 static NTSTATUS pdb_samba_dsdb_getsamupriv(struct pdb_samba_dsdb_state *state,
 635                                     const char *filter,
 636                                     TALLOC_CTX *mem_ctx,
 637                                     struct ldb_message **msg)
 638 {
 639         const char * attrs[] = {
 640                 "lastLogon", "lastLogoff", "pwdLastSet", "accountExpires",
 641                 "sAMAccountName", "displayName", "homeDirectory",
 642                 "homeDrive", "scriptPath", "profilePath", "description",
 643                 "userWorkstations", "comment", "userParameters", "objectSid",
 644                 "primaryGroupID", "userAccountControl",
 645                 "msDS-User-Account-Control-Computed", "logonHours",
 646                 "badPwdCount", "logonCount", "countryCode", "codePage",
 647                 "unicodePwd", "dBCSPwd", NULL };
 648
 649         int rc = dsdb_search_one(state->ldb, mem_ctx, msg, ldb_get_default_basedn(state->ldb), LDB_SCOPE_SUBTREE, attrs, 0, "%s", filter);
 650         if (rc != LDB_SUCCESS) {
 651                 DEBUG(10, ("ldap_search failed %s\n",
 652                            ldb_errstring(state->ldb)));
 653                 return NT_STATUS_LDAP(rc);
 654         }
 655
 656         return NT_STATUS_OK;
 657 }
 658
 659 static NTSTATUS pdb_samba_dsdb_getsampwfilter(struct pdb_methods *m,
 660                                           struct pdb_samba_dsdb_state *state,
 661                                           struct samu *sam_acct,
 662                                           const char *exp_fmt, ...)
 663                                           PRINTF_ATTRIBUTE(4,5);
 664
 665 static NTSTATUS pdb_samba_dsdb_getsampwfilter(struct pdb_methods *m,
 666                                           struct pdb_samba_dsdb_state *state,
 667                                           struct samu *sam_acct,
 668                                           const char *exp_fmt, ...)
 669 {
 670         struct ldb_message *priv;
 671         NTSTATUS status;
 672         va_list ap;
 673         char *expression = NULL;
 674         TALLOC_CTX *tmp_ctx = talloc_new(state);
 675         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 676
 677         va_start(ap, exp_fmt);
 678         expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
 679         va_end(ap);
 680
 681         if (!expression) {
 682                 talloc_free(tmp_ctx);
 683                 return NT_STATUS_NO_MEMORY;
 684         }
 685
 686         status = pdb_samba_dsdb_getsamupriv(state, expression, sam_acct, &priv);
 687         talloc_free(tmp_ctx);
 688         if (!NT_STATUS_IS_OK(status)) {
 689                 DEBUG(10, ("pdb_samba_dsdb_getsamupriv failed: %s\n",
 690                            nt_errstr(status)));
 691                 return status;
 692         }
 693
 694         status = pdb_samba_dsdb_init_sam_from_priv(m, sam_acct, priv);
 695         if (!NT_STATUS_IS_OK(status)) {
 696                 DEBUG(10, ("pdb_samba_dsdb_init_sam_from_priv failed: %s\n",
 697                            nt_errstr(status)));
 698                 TALLOC_FREE(priv);
 699                 return status;
 700         }
 701
 702         pdb_set_backend_private_data(sam_acct, priv, NULL, m, PDB_SET);
 703         return NT_STATUS_OK;
 704 }
 705
 706 static NTSTATUS pdb_samba_dsdb_getsampwnam(struct pdb_methods *m,
 707                                     struct samu *sam_acct,
 708                                     const char *username)
 709 {
 710         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 711                 m->private_data, struct pdb_samba_dsdb_state);
 712
 713         return pdb_samba_dsdb_getsampwfilter(m, state, sam_acct,
 714                                          "(&(samaccountname=%s)(objectclass=user))",
 715                                          username);
 716 }
 717
 718 static NTSTATUS pdb_samba_dsdb_getsampwsid(struct pdb_methods *m,
 719                                     struct samu *sam_acct,
 720                                     const struct dom_sid *sid)
 721 {
 722         NTSTATUS status;
 723         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 724                 m->private_data, struct pdb_samba_dsdb_state);
 725         struct dom_sid_buf buf;
 726
 727         status = pdb_samba_dsdb_getsampwfilter(m, state, sam_acct,
 728                                            "(&(objectsid=%s)(objectclass=user))",
 729                                            dom_sid_str_buf(sid, &buf));
 730         return status;
 731 }
 732
 733 static NTSTATUS pdb_samba_dsdb_create_user(struct pdb_methods *m,
 734                                     TALLOC_CTX *mem_ctx,
 735                                     const char *name, uint32_t acct_flags,
 736                                     uint32_t *rid)
 737 {
 738         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 739                 m->private_data, struct pdb_samba_dsdb_state);
 740         struct dom_sid *sid;
 741         struct ldb_dn *dn;
 742         NTSTATUS status;
 743         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 744         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 745
 746         /* Internally this uses transactions to ensure all the steps
 747          * happen or fail as one */
 748         status = dsdb_add_user(state->ldb, tmp_ctx, name, acct_flags, NULL,
 749                                &sid, &dn);
 750         if (!NT_STATUS_IS_OK(status)) {
 751                 talloc_free(tmp_ctx);
 752                 return status;
 753         }
 754         sid_peek_rid(sid, rid);
 755         talloc_free(tmp_ctx);
 756         return NT_STATUS_OK;
 757 }
 758
 759 static NTSTATUS pdb_samba_dsdb_delete_user(struct pdb_methods *m,
 760                                        TALLOC_CTX *mem_ctx,
 761                                        struct samu *sam)
 762 {
 763         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 764                 m->private_data, struct pdb_samba_dsdb_state);
 765         struct ldb_dn *dn;
 766         int rc;
 767         struct dom_sid_buf buf;
 768         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
 769         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 770
 771         dn = ldb_dn_new_fmt(
 772                 tmp_ctx,
 773                 state->ldb,
 774                 "<SID=%s>",
 775                 dom_sid_str_buf(pdb_get_user_sid(sam), &buf));
 776         if (!dn || !ldb_dn_validate(dn)) {
 777                 talloc_free(tmp_ctx);
 778                 return NT_STATUS_NO_MEMORY;
 779         }
 780         rc = ldb_delete(state->ldb, dn);
 781
 782         if (rc != LDB_SUCCESS) {
 783                 DEBUG(10, ("ldb_delete for %s failed: %s\n", ldb_dn_get_linearized(dn),
 784                            ldb_errstring(state->ldb)));
 785                 talloc_free(tmp_ctx);
 786                 return NT_STATUS_LDAP(rc);
 787         }
 788         talloc_free(tmp_ctx);
 789         return NT_STATUS_OK;
 790 }
 791
 792 /* This interface takes a fully populated struct samu and places it in
 793  * the database.  This is not implemented at this time as we need to
 794  * be careful around the creation of arbitary SIDs (ie, we must ensrue
 795  * they are not left in a RID pool */
 796 static NTSTATUS pdb_samba_dsdb_add_sam_account(struct pdb_methods *m,
 797                                         struct samu *sampass)
 798 {
 799         int ret;
 800         NTSTATUS status;
 801         struct ldb_dn *dn;
 802         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 803                 m->private_data, struct pdb_samba_dsdb_state);
 804         uint32_t acb_flags = pdb_get_acct_ctrl(sampass);
 805         const char *username = pdb_get_username(sampass);
 806         const struct dom_sid *user_sid = pdb_get_user_sid(sampass);
 807         TALLOC_CTX *tframe = talloc_stackframe();
 808
 809         acb_flags &= (ACB_NORMAL|ACB_WSTRUST|ACB_SVRTRUST|ACB_DOMTRUST);
 810
 811         ret = ldb_transaction_start(state->ldb);
 812         if (ret != LDB_SUCCESS) {
 813                 talloc_free(tframe);
 814                 return NT_STATUS_LOCK_NOT_GRANTED;
 815         }
 816
 817         status = dsdb_add_user(state->ldb, talloc_tos(), username,
 818                                acb_flags, user_sid, NULL, &dn);
 819         if (!NT_STATUS_IS_OK(status)) {
 820                 ldb_transaction_cancel(state->ldb);
 821                 talloc_free(tframe);
 822                 return status;
 823         }
 824
 825         ret = pdb_samba_dsdb_replace_by_sam(state, pdb_element_is_set_or_changed,
 826                                         dn, sampass);
 827         if (ret != LDB_SUCCESS) {
 828                 ldb_transaction_cancel(state->ldb);
 829                 talloc_free(tframe);
 830                 return dsdb_ldb_err_to_ntstatus(ret);
 831         }
 832
 833         ret = ldb_transaction_commit(state->ldb);
 834         if (ret != LDB_SUCCESS) {
 835                 DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
 836                          ldb_dn_get_linearized(dn),
 837                          ldb_errstring(state->ldb)));
 838                 talloc_free(tframe);
 839                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 840         }
 841         talloc_free(tframe);
 842         return NT_STATUS_OK;
 843 }
 844
 845 /*
 846  * Update the Samba_Dsdb LDB with the changes from a struct samu.
 847  *
 848  * This takes care not to update elements that have not been changed
 849  * by the caller
 850  */
 851 static NTSTATUS pdb_samba_dsdb_update_sam_account(struct pdb_methods *m,
 852                                            struct samu *sam)
 853 {
 854         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 855                 m->private_data, struct pdb_samba_dsdb_state);
 856         struct ldb_message *msg = pdb_samba_dsdb_get_samu_private(
 857                 m, sam);
 858         int ret;
 859
 860         ret = pdb_samba_dsdb_replace_by_sam(state, pdb_element_is_changed, msg->dn,
 861                                         sam);
 862         return dsdb_ldb_err_to_ntstatus(ret);
 863 }
 864
 865 static NTSTATUS pdb_samba_dsdb_delete_sam_account(struct pdb_methods *m,
 866                                            struct samu *username)
 867 {
 868         NTSTATUS status;
 869         TALLOC_CTX *tmp_ctx = talloc_new(NULL);
 870         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 871         status = pdb_samba_dsdb_delete_user(m, tmp_ctx, username);
 872         talloc_free(tmp_ctx);
 873         return status;
 874 }
 875
 876 static NTSTATUS pdb_samba_dsdb_rename_sam_account(struct pdb_methods *m,
 877                                            struct samu *oldname,
 878                                            const char *newname)
 879 {
 880         return NT_STATUS_NOT_IMPLEMENTED;
 881 }
 882
 883 /* This is not implemented, as this module is exptected to be used
 884  * with auth_samba_dsdb, and this is responible for login counters etc
 885  *
 886  */
 887 static NTSTATUS pdb_samba_dsdb_update_login_attempts(struct pdb_methods *m,
 888                                               struct samu *sam_acct,
 889                                               bool success)
 890 {
 891         return NT_STATUS_NOT_IMPLEMENTED;
 892 }
 893
 894 static NTSTATUS pdb_samba_dsdb_getgrfilter(struct pdb_methods *m,
 895                                            GROUP_MAP *map,
 896                                            const char *exp_fmt, ...)
 897                                            PRINTF_ATTRIBUTE(3,4);
 898
 899 static NTSTATUS pdb_samba_dsdb_getgrfilter(struct pdb_methods *m, GROUP_MAP *map,
 900                                     const char *exp_fmt, ...)
 901 {
 902         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
 903                 m->private_data, struct pdb_samba_dsdb_state);
 904         const char *attrs[] = { "objectClass", "objectSid", "description", "samAccountName", "groupType",
 905                                 NULL };
 906         struct ldb_message *msg;
 907         va_list ap;
 908         char *expression = NULL;
 909         struct dom_sid *sid;
 910         const char *str;
 911         int rc;
 912         struct id_map id_map;
 913         struct id_map *id_maps[2];
 914         TALLOC_CTX *tmp_ctx = talloc_stackframe();
 915         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
 916
 917         va_start(ap, exp_fmt);
 918         expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
 919         va_end(ap);
 920
 921         if (!expression) {
 922                 talloc_free(tmp_ctx);
 923                 return NT_STATUS_NO_MEMORY;
 924         }
 925
 926         rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, ldb_get_default_basedn(state->ldb), LDB_SCOPE_SUBTREE, attrs, 0, "%s", expression);
 927         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
 928                 talloc_free(tmp_ctx);
 929                 return NT_STATUS_NO_SUCH_GROUP;
 930         } else if (rc != LDB_SUCCESS) {
 931                 talloc_free(tmp_ctx);
 932                 DEBUG(10, ("dsdb_search_one failed %s\n",
 933                            ldb_errstring(state->ldb)));
 934                 return NT_STATUS_LDAP(rc);
 935         }
 936
 937         sid = samdb_result_dom_sid(tmp_ctx, msg, "objectSid");
 938         if (!sid) {
 939                 talloc_free(tmp_ctx);
 940                 DEBUG(10, ("Could not pull SID\n"));
 941                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 942         }
 943
 944         map->sid = *sid;
 945
 946         if (samdb_find_attribute(state->ldb, msg, "objectClass", "group")) {
 947                 NTSTATUS status;
 948                 uint32_t grouptype = ldb_msg_find_attr_as_uint(msg, "groupType", 0);
 949                 switch (grouptype) {
 950                 case GTYPE_SECURITY_BUILTIN_LOCAL_GROUP:
 951                 case GTYPE_SECURITY_DOMAIN_LOCAL_GROUP:
 952                         map->sid_name_use = SID_NAME_ALIAS;
 953                         break;
 954                 case GTYPE_SECURITY_GLOBAL_GROUP:
 955                         map->sid_name_use = SID_NAME_DOM_GRP;
 956                         break;
 957                 default:
 958                         talloc_free(tmp_ctx);
 959                         DEBUG(10, ("Could not pull groupType\n"));
 960                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 961                 }
 962
 963                 ZERO_STRUCT(id_map);
 964                 id_map.sid = sid;
 965                 id_maps[0] = &id_map;
 966                 id_maps[1] = NULL;
 967
 968                 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
 969
 970                 if (!NT_STATUS_IS_OK(status)) {
 971                         talloc_free(tmp_ctx);
 972                         return status;
 973                 }
 974                 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
 975                         map->gid = id_map.xid.id;
 976                 } else {
 977                         DEBUG(1, (__location__ "Did not get GUID when mapping SID for %s", expression));
 978                         talloc_free(tmp_ctx);
 979                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 980                 }
 981         } else if (samdb_find_attribute(state->ldb, msg, "objectClass", "user")) {
 982                 DEBUG(1, (__location__ "Got SID_NAME_USER when searching for a group with %s", expression));
 983                 talloc_free(tmp_ctx);
 984                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 985         }
 986
 987         str = ldb_msg_find_attr_as_string(msg, "samAccountName",
 988                                           NULL);
 989         if (str == NULL) {
 990                 talloc_free(tmp_ctx);
 991                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 992         }
 993         map->nt_name = talloc_strdup(map, str);
 994         if (!map->nt_name) {
 995                 talloc_free(tmp_ctx);
 996                 return NT_STATUS_NO_MEMORY;
 997         }
 998
 999         str = ldb_msg_find_attr_as_string(msg, "description",
1000                                             NULL);
1001         if (str != NULL) {
1002                 map->comment = talloc_strdup(map, str);
1003         } else {
1004                 map->comment = talloc_strdup(map, "");
1005         }
1006         if (!map->comment) {
1007                 talloc_free(tmp_ctx);
1008                 return NT_STATUS_NO_MEMORY;
1009         }
1010
1011         talloc_free(tmp_ctx);
1012         return NT_STATUS_OK;
1013 }
1014
1015 static NTSTATUS pdb_samba_dsdb_getgrsid(struct pdb_methods *m, GROUP_MAP *map,
1016                                  struct dom_sid sid)
1017 {
1018         char *filter;
1019         NTSTATUS status;
1020         struct dom_sid_buf buf;
1021
1022         filter = talloc_asprintf(talloc_tos(),
1023                                  "(&(objectsid=%s)(objectclass=group))",
1024                                  dom_sid_str_buf(&sid, &buf));
1025         if (filter == NULL) {
1026                 return NT_STATUS_NO_MEMORY;
1027         }
1028
1029         status = pdb_samba_dsdb_getgrfilter(m, map, "%s", filter);
1030         TALLOC_FREE(filter);
1031         return status;
1032 }
1033
1034 static NTSTATUS pdb_samba_dsdb_getgrgid(struct pdb_methods *m, GROUP_MAP *map,
1035                                  gid_t gid)
1036 {
1037         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1038                 m->private_data, struct pdb_samba_dsdb_state);
1039         NTSTATUS status;
1040         struct id_map id_map;
1041         struct id_map *id_maps[2];
1042         TALLOC_CTX *tmp_ctx = talloc_stackframe();
1043         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1044
1045         id_map.xid.id = gid;
1046         id_map.xid.type = ID_TYPE_GID;
1047         id_maps[0] = &id_map;
1048         id_maps[1] = NULL;
1049
1050         status = idmap_xids_to_sids(state->idmap_ctx, tmp_ctx, id_maps);
1051         if (!NT_STATUS_IS_OK(status)) {
1052                 talloc_free(tmp_ctx);
1053                 return status;
1054         }
1055         status = pdb_samba_dsdb_getgrsid(m, map, *id_map.sid);
1056         talloc_free(tmp_ctx);
1057         return status;
1058 }
1059
1060 static NTSTATUS pdb_samba_dsdb_getgrnam(struct pdb_methods *m, GROUP_MAP *map,
1061                                  const char *name)
1062 {
1063         char *filter;
1064         NTSTATUS status;
1065
1066         filter = talloc_asprintf(talloc_tos(),
1067                                  "(&(samaccountname=%s)(objectclass=group))",
1068                                  name);
1069         if (filter == NULL) {
1070                 return NT_STATUS_NO_MEMORY;
1071         }
1072
1073         status = pdb_samba_dsdb_getgrfilter(m, map, "%s", filter);
1074         TALLOC_FREE(filter);
1075         return status;
1076 }
1077
1078 static NTSTATUS pdb_samba_dsdb_create_dom_group(struct pdb_methods *m,
1079                                          TALLOC_CTX *mem_ctx, const char *name,
1080                                          uint32_t *rid)
1081 {
1082         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1083                 m->private_data, struct pdb_samba_dsdb_state);
1084         NTSTATUS status;
1085         struct dom_sid *sid;
1086         struct ldb_dn *dn;
1087         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1088         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1089
1090         status = dsdb_add_domain_group(state->ldb, tmp_ctx, name, &sid, &dn);
1091         if (!NT_STATUS_IS_OK(status)) {
1092                 talloc_free(tmp_ctx);
1093                 return status;
1094         }
1095
1096         sid_peek_rid(sid, rid);
1097         talloc_free(tmp_ctx);
1098         return NT_STATUS_OK;
1099 }
1100
1101 static NTSTATUS pdb_samba_dsdb_delete_dom_group(struct pdb_methods *m,
1102                                          TALLOC_CTX *mem_ctx, uint32_t rid)
1103 {
1104         const char *attrs[] = { NULL };
1105         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1106                 m->private_data, struct pdb_samba_dsdb_state);
1107         struct dom_sid sid;
1108         struct ldb_message *msg;
1109         struct ldb_dn *dn;
1110         int rc;
1111         struct dom_sid_buf buf;
1112         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1113         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1114
1115         sid_compose(&sid, samdb_domain_sid(state->ldb), rid);
1116
1117         if (ldb_transaction_start(state->ldb) != LDB_SUCCESS) {
1118                 DEBUG(0, ("Unable to start transaction in pdb_samba_dsdb_delete_dom_group()\n"));
1119                 return NT_STATUS_INTERNAL_ERROR;
1120         }
1121
1122         dn = ldb_dn_new_fmt(
1123                 tmp_ctx,
1124                 state->ldb,
1125                 "<SID=%s>",
1126                 dom_sid_str_buf(&sid, &buf));
1127         if (!dn || !ldb_dn_validate(dn)) {
1128                 talloc_free(tmp_ctx);
1129                 ldb_transaction_cancel(state->ldb);
1130                 return NT_STATUS_NO_MEMORY;
1131         }
1132         rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "objectclass=group");
1133         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1134                 talloc_free(tmp_ctx);
1135                 ldb_transaction_cancel(state->ldb);
1136                 return NT_STATUS_NO_SUCH_GROUP;
1137         }
1138         rc = ldb_delete(state->ldb, dn);
1139         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1140                 talloc_free(tmp_ctx);
1141                 ldb_transaction_cancel(state->ldb);
1142                 return NT_STATUS_NO_SUCH_GROUP;
1143         } else if (rc != LDB_SUCCESS) {
1144                 DEBUG(10, ("ldb_delete failed %s\n",
1145                            ldb_errstring(state->ldb)));
1146                 ldb_transaction_cancel(state->ldb);
1147                 return NT_STATUS_LDAP(rc);
1148         }
1149
1150         if (ldb_transaction_commit(state->ldb) != LDB_SUCCESS) {
1151                 DEBUG(0, ("Unable to commit transaction in pdb_samba_dsdb_delete_dom_group()\n"));
1152                 return NT_STATUS_INTERNAL_ERROR;
1153         }
1154         return NT_STATUS_OK;
1155 }
1156
1157 static NTSTATUS pdb_samba_dsdb_add_group_mapping_entry(struct pdb_methods *m,
1158                                                 GROUP_MAP *map)
1159 {
1160         return NT_STATUS_NOT_IMPLEMENTED;
1161 }
1162
1163 static NTSTATUS pdb_samba_dsdb_update_group_mapping_entry(struct pdb_methods *m,
1164                                                    GROUP_MAP *map)
1165 {
1166         return NT_STATUS_NOT_IMPLEMENTED;
1167 }
1168
1169 static NTSTATUS pdb_samba_dsdb_delete_group_mapping_entry(struct pdb_methods *m,
1170                                                    struct dom_sid sid)
1171 {
1172         return NT_STATUS_NOT_IMPLEMENTED;
1173 }
1174
1175 static NTSTATUS pdb_samba_dsdb_enum_group_mapping(struct pdb_methods *m,
1176                                            const struct dom_sid *sid,
1177                                            enum lsa_SidType sid_name_use,
1178                                            GROUP_MAP ***pp_rmap,
1179                                            size_t *p_num_entries,
1180                                            bool unix_only)
1181 {
1182         return NT_STATUS_NOT_IMPLEMENTED;
1183 }
1184
1185 static NTSTATUS pdb_samba_dsdb_enum_group_members(struct pdb_methods *m,
1186                                            TALLOC_CTX *mem_ctx,
1187                                            const struct dom_sid *group,
1188                                            uint32_t **pmembers,
1189                                            size_t *pnum_members)
1190 {
1191         unsigned int i, num_sids, num_members;
1192         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1193                 m->private_data, struct pdb_samba_dsdb_state);
1194         struct dom_sid *members_as_sids;
1195         struct dom_sid *dom_sid;
1196         uint32_t *members;
1197         struct ldb_dn *dn;
1198         NTSTATUS status;
1199         struct dom_sid_buf buf;
1200
1201         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1202         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1203
1204         dn = ldb_dn_new_fmt(
1205                 tmp_ctx,
1206                 state->ldb,
1207                 "<SID=%s>",
1208                 dom_sid_str_buf(group, &buf));
1209         if (!dn || !ldb_dn_validate(dn)) {
1210                 return NT_STATUS_NO_MEMORY;
1211         }
1212
1213         status = dsdb_enum_group_mem(state->ldb, tmp_ctx, dn, &members_as_sids, &num_sids);
1214         if (!NT_STATUS_IS_OK(status)) {
1215                 talloc_free(tmp_ctx);
1216                 return status;
1217         }
1218         status = dom_sid_split_rid(tmp_ctx, group, &dom_sid, NULL);
1219         if (!NT_STATUS_IS_OK(status)) {
1220                 talloc_free(tmp_ctx);
1221                 return status;
1222         }
1223
1224         *pmembers = members = talloc_array(mem_ctx, uint32_t, num_sids);
1225         if (*pmembers == NULL) {
1226                 TALLOC_FREE(tmp_ctx);
1227                 return NT_STATUS_NO_MEMORY;
1228         }
1229         num_members = 0;
1230
1231         for (i = 0; i < num_sids; i++) {
1232                 if (!dom_sid_in_domain(dom_sid, &members_as_sids[i])) {
1233                         continue;
1234                 }
1235                 status = dom_sid_split_rid(NULL, &members_as_sids[i],
1236                                            NULL, &members[num_members]);
1237                 if (!NT_STATUS_IS_OK(status)) {
1238                         talloc_free(tmp_ctx);
1239                         return status;
1240                 }
1241                 num_members++;
1242         }
1243         *pnum_members = num_members;
1244         return NT_STATUS_OK;
1245 }
1246
1247 /* Just convert the primary group SID into a group */
1248 static NTSTATUS fake_enum_group_memberships(struct pdb_samba_dsdb_state *state,
1249                                             TALLOC_CTX *mem_ctx,
1250                                             struct samu *user,
1251                                             struct dom_sid **pp_sids,
1252                                             gid_t **pp_gids,
1253                                             uint32_t *p_num_groups)
1254 {
1255         NTSTATUS status;
1256         size_t num_groups = 0;
1257         struct dom_sid *group_sids = NULL;
1258         gid_t *gids = NULL;
1259         TALLOC_CTX *tmp_ctx;
1260
1261         tmp_ctx = talloc_new(mem_ctx);
1262         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1263
1264         if (user->group_sid) {
1265                 struct id_map *id_maps[2];
1266                 struct id_map id_map;
1267
1268                 num_groups = 1;
1269
1270                 group_sids = talloc_array(tmp_ctx, struct dom_sid, num_groups);
1271                 if (group_sids == NULL) {
1272                         talloc_free(tmp_ctx);
1273                         return NT_STATUS_NO_MEMORY;
1274                 }
1275                 gids = talloc_array(tmp_ctx, gid_t, num_groups);
1276                 if (gids == NULL) {
1277                         talloc_free(tmp_ctx);
1278                         return NT_STATUS_NO_MEMORY;
1279                 }
1280
1281                 group_sids[0] = *user->group_sid;
1282
1283                 ZERO_STRUCT(id_map);
1284                 id_map.sid = &group_sids[0];
1285                 id_maps[0] = &id_map;
1286                 id_maps[1] = NULL;
1287
1288                 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
1289                 if (!NT_STATUS_IS_OK(status)) {
1290                         talloc_free(tmp_ctx);
1291                         return status;
1292                 }
1293                 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
1294                         gids[0] = id_map.xid.id;
1295                 } else {
1296                         struct dom_sid_buf buf1, buf2;
1297                         DEBUG(1, (__location__
1298                                   "Group %s, of which %s is a member, could not be converted to a GID\n",
1299                                   dom_sid_str_buf(&group_sids[0], &buf1),
1300                                   dom_sid_str_buf(&user->user_sid, &buf2)));
1301                         talloc_free(tmp_ctx);
1302                         /* We must error out, otherwise a user might
1303                          * avoid a DENY acl based on a group they
1304                          * missed out on */
1305                         return NT_STATUS_NO_SUCH_GROUP;
1306                 }
1307         }
1308
1309         *pp_sids = talloc_steal(mem_ctx, group_sids);
1310         *pp_gids = talloc_steal(mem_ctx, gids);
1311         *p_num_groups = num_groups;
1312         talloc_free(tmp_ctx);
1313         return NT_STATUS_OK;
1314 }
1315
1316 static NTSTATUS pdb_samba_dsdb_enum_group_memberships(struct pdb_methods *m,
1317                                                TALLOC_CTX *mem_ctx,
1318                                                struct samu *user,
1319                                                struct dom_sid **pp_sids,
1320                                                gid_t **pp_gids,
1321                                                uint32_t *p_num_groups)
1322 {
1323         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1324                 m->private_data, struct pdb_samba_dsdb_state);
1325         struct ldb_message *msg = pdb_samba_dsdb_get_samu_private(
1326                 m, user);
1327         const char *attrs[] = { "tokenGroups", NULL};
1328         struct ldb_message *tokengroups_msg;
1329         struct ldb_message_element *tokengroups;
1330         int i, rc;
1331         NTSTATUS status;
1332         unsigned int count = 0;
1333         size_t num_groups;
1334         struct dom_sid *group_sids;
1335         gid_t *gids;
1336         TALLOC_CTX *tmp_ctx;
1337
1338         if (msg == NULL) {
1339                 /* Fake up some things here */
1340                 return fake_enum_group_memberships(state,
1341                                                    mem_ctx,
1342                                                    user, pp_sids,
1343                                                    pp_gids, p_num_groups);
1344         }
1345
1346         tmp_ctx = talloc_new(mem_ctx);
1347         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1348
1349         rc = dsdb_search_one(state->ldb, tmp_ctx, &tokengroups_msg, msg->dn, LDB_SCOPE_BASE, attrs, 0, NULL);
1350
1351         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1352                 talloc_free(tmp_ctx);
1353                 return NT_STATUS_NO_SUCH_USER;
1354         } else if (rc != LDB_SUCCESS) {
1355                 DEBUG(10, ("dsdb_search_one failed %s\n",
1356                            ldb_errstring(state->ldb)));
1357                 talloc_free(tmp_ctx);
1358                 return NT_STATUS_LDAP(rc);
1359         }
1360
1361         tokengroups = ldb_msg_find_element(tokengroups_msg, "tokenGroups");
1362
1363         if (tokengroups) {
1364                 count = tokengroups->num_values;
1365         }
1366
1367         group_sids = talloc_array(tmp_ctx, struct dom_sid, count);
1368         if (group_sids == NULL) {
1369                 talloc_free(tmp_ctx);
1370                 return NT_STATUS_NO_MEMORY;
1371         }
1372         gids = talloc_array(tmp_ctx, gid_t, count);
1373         if (gids == NULL) {
1374                 talloc_free(tmp_ctx);
1375                 return NT_STATUS_NO_MEMORY;
1376         }
1377         num_groups = 0;
1378
1379         for (i=0; i<count; i++) {
1380                 struct id_map *id_maps[2];
1381                 struct id_map id_map;
1382                 struct ldb_val *v = &tokengroups->values[i];
1383                 enum ndr_err_code ndr_err
1384                         = ndr_pull_struct_blob(v, group_sids, &group_sids[num_groups],
1385                                                (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
1386                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1387                         talloc_free(tmp_ctx);
1388                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
1389                 }
1390
1391                 ZERO_STRUCT(id_map);
1392                 id_map.sid = &group_sids[num_groups];
1393                 id_maps[0] = &id_map;
1394                 id_maps[1] = NULL;
1395
1396                 status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
1397                 if (!NT_STATUS_IS_OK(status)) {
1398                         talloc_free(tmp_ctx);
1399                         return status;
1400                 }
1401                 if (id_map.xid.type == ID_TYPE_GID || id_map.xid.type == ID_TYPE_BOTH) {
1402                         gids[num_groups] = id_map.xid.id;
1403                 } else {
1404                         struct dom_sid_buf buf;
1405                         DEBUG(1, (__location__
1406                                   "Group %s, of which %s is a member, could not be converted to a GID\n",
1407                                   dom_sid_str_buf(&group_sids[num_groups],
1408                                                   &buf),
1409                                   ldb_dn_get_linearized(msg->dn)));
1410                         talloc_free(tmp_ctx);
1411                         /* We must error out, otherwise a user might
1412                          * avoid a DENY acl based on a group they
1413                          * missed out on */
1414                         return NT_STATUS_NO_SUCH_GROUP;
1415                 }
1416
1417                 num_groups += 1;
1418                 if (num_groups == count) {
1419                         break;
1420                 }
1421         }
1422
1423         *pp_sids = talloc_steal(mem_ctx, group_sids);
1424         *pp_gids = talloc_steal(mem_ctx, gids);
1425         *p_num_groups = num_groups;
1426         talloc_free(tmp_ctx);
1427         return NT_STATUS_OK;
1428 }
1429
1430 static NTSTATUS pdb_samba_dsdb_set_unix_primary_group(struct pdb_methods *m,
1431                                                TALLOC_CTX *mem_ctx,
1432                                                struct samu *user)
1433 {
1434         return NT_STATUS_NOT_IMPLEMENTED;
1435 }
1436
1437 static NTSTATUS pdb_samba_dsdb_mod_groupmem_by_sid(struct pdb_methods *m,
1438                                                TALLOC_CTX *mem_ctx,
1439                                                const struct dom_sid *groupsid,
1440                                                const struct dom_sid *membersid,
1441                                                int mod_op)
1442 {
1443         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1444                 m->private_data, struct pdb_samba_dsdb_state);
1445         struct ldb_message *msg;
1446         int ret;
1447         struct ldb_message_element *el;
1448         struct dom_sid_buf buf;
1449         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1450         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1451         msg = ldb_msg_new(tmp_ctx);
1452         if (msg == NULL) {
1453                 TALLOC_FREE(tmp_ctx);
1454                 return NT_STATUS_NO_MEMORY;
1455         }
1456
1457         msg->dn = ldb_dn_new_fmt(
1458                 msg,
1459                 state->ldb,
1460                 "<SID=%s>",
1461                 dom_sid_str_buf(groupsid, &buf));
1462         if (!msg->dn || !ldb_dn_validate(msg->dn)) {
1463                 talloc_free(tmp_ctx);
1464                 return NT_STATUS_NO_MEMORY;
1465         }
1466         ret = ldb_msg_add_fmt(
1467                 msg,
1468                 "member",
1469                 "<SID=%s>",
1470                 dom_sid_str_buf(membersid, &buf));
1471         if (ret != LDB_SUCCESS) {
1472                 talloc_free(tmp_ctx);
1473                 return NT_STATUS_NO_MEMORY;
1474         }
1475         el = ldb_msg_find_element(msg, "member");
1476         el->flags = mod_op;
1477
1478         /* No need for transactions here, the ldb auto-transaction
1479          * code will handle things for the single operation */
1480         ret = ldb_modify(state->ldb, msg);
1481         talloc_free(tmp_ctx);
1482         if (ret != LDB_SUCCESS) {
1483                 DEBUG(10, ("ldb_modify failed: %s\n",
1484                            ldb_errstring(state->ldb)));
1485                 if (ret == LDB_ERR_ATTRIBUTE_OR_VALUE_EXISTS) {
1486                         return NT_STATUS_MEMBER_IN_GROUP;
1487                 }
1488                 if (ret == LDB_ERR_NO_SUCH_ATTRIBUTE) {
1489                         return NT_STATUS_MEMBER_NOT_IN_GROUP;
1490                 }
1491                 return NT_STATUS_LDAP(ret);
1492         }
1493
1494         return NT_STATUS_OK;
1495 }
1496
1497 static NTSTATUS pdb_samba_dsdb_mod_groupmem(struct pdb_methods *m,
1498                                      TALLOC_CTX *mem_ctx,
1499                                      uint32_t grouprid, uint32_t memberrid,
1500                                      int mod_op)
1501 {
1502         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1503                 m->private_data, struct pdb_samba_dsdb_state);
1504         const struct dom_sid *dom_sid, *groupsid, *membersid;
1505         NTSTATUS status;
1506         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1507         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1508
1509         dom_sid = samdb_domain_sid(state->ldb);
1510
1511         groupsid = dom_sid_add_rid(tmp_ctx, dom_sid, grouprid);
1512         if (groupsid == NULL) {
1513                 TALLOC_FREE(tmp_ctx);
1514                 return NT_STATUS_NO_MEMORY;
1515         }
1516         membersid = dom_sid_add_rid(tmp_ctx, dom_sid, memberrid);
1517         if (membersid == NULL) {
1518                 TALLOC_FREE(tmp_ctx);
1519                 return NT_STATUS_NO_MEMORY;
1520         }
1521         status = pdb_samba_dsdb_mod_groupmem_by_sid(m, tmp_ctx, groupsid, membersid, mod_op);
1522         talloc_free(tmp_ctx);
1523         return status;
1524 }
1525
1526 static NTSTATUS pdb_samba_dsdb_add_groupmem(struct pdb_methods *m,
1527                                      TALLOC_CTX *mem_ctx,
1528                                      uint32_t group_rid, uint32_t member_rid)
1529 {
1530         return pdb_samba_dsdb_mod_groupmem(m, mem_ctx, group_rid, member_rid,
1531                                     LDB_FLAG_MOD_ADD);
1532 }
1533
1534 static NTSTATUS pdb_samba_dsdb_del_groupmem(struct pdb_methods *m,
1535                                      TALLOC_CTX *mem_ctx,
1536                                      uint32_t group_rid, uint32_t member_rid)
1537 {
1538         return pdb_samba_dsdb_mod_groupmem(m, mem_ctx, group_rid, member_rid,
1539                                        LDB_FLAG_MOD_DELETE);
1540 }
1541
1542 static NTSTATUS pdb_samba_dsdb_create_alias(struct pdb_methods *m,
1543                                      const char *name, uint32_t *rid)
1544 {
1545         TALLOC_CTX *frame = talloc_stackframe();
1546         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1547                 m->private_data, struct pdb_samba_dsdb_state);
1548         struct dom_sid *sid;
1549
1550         struct ldb_dn *dn;
1551         NTSTATUS status;
1552
1553         /* Internally this uses transactions to ensure all the steps
1554          * happen or fail as one */
1555         status = dsdb_add_domain_alias(state->ldb, frame, name, &sid, &dn);
1556         if (!NT_STATUS_IS_OK(status)) {
1557                 TALLOC_FREE(frame);
1558         }
1559
1560         sid_peek_rid(sid, rid);
1561         TALLOC_FREE(frame);
1562         return NT_STATUS_OK;
1563 }
1564
1565 static NTSTATUS pdb_samba_dsdb_delete_alias(struct pdb_methods *m,
1566                                      const struct dom_sid *sid)
1567 {
1568         const char *attrs[] = { NULL };
1569         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1570                 m->private_data, struct pdb_samba_dsdb_state);
1571         struct ldb_message *msg;
1572         struct ldb_dn *dn;
1573         int rc;
1574         struct dom_sid_buf buf;
1575         TALLOC_CTX *tmp_ctx = talloc_stackframe();
1576         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1577
1578         dn = ldb_dn_new_fmt(
1579                 tmp_ctx,
1580                 state->ldb,
1581                 "<SID=%s>",
1582                 dom_sid_str_buf(sid, &buf));
1583         if (!dn || !ldb_dn_validate(dn)) {
1584                 talloc_free(tmp_ctx);
1585                 return NT_STATUS_NO_MEMORY;
1586         }
1587
1588         if (ldb_transaction_start(state->ldb) != LDB_SUCCESS) {
1589                 DEBUG(0, ("Failed to start transaction in dsdb_add_domain_alias(): %s\n", ldb_errstring(state->ldb)));
1590                 talloc_free(tmp_ctx);
1591                 return NT_STATUS_INTERNAL_ERROR;
1592         }
1593
1594         rc = dsdb_search_one(state->ldb, tmp_ctx, &msg, dn, LDB_SCOPE_BASE, attrs, 0, "(objectclass=group)"
1595                              "(|(grouptype=%d)(grouptype=%d)))",
1596                              GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
1597                              GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1598         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1599                 talloc_free(tmp_ctx);
1600                 ldb_transaction_cancel(state->ldb);
1601                 return NT_STATUS_NO_SUCH_ALIAS;
1602         }
1603         rc = ldb_delete(state->ldb, dn);
1604         if (rc == LDB_ERR_NO_SUCH_OBJECT) {
1605                 talloc_free(tmp_ctx);
1606                 ldb_transaction_cancel(state->ldb);
1607                 return NT_STATUS_NO_SUCH_ALIAS;
1608         } else if (rc != LDB_SUCCESS) {
1609                 DEBUG(10, ("ldb_delete failed %s\n",
1610                            ldb_errstring(state->ldb)));
1611                 ldb_transaction_cancel(state->ldb);
1612                 talloc_free(tmp_ctx);
1613                 return NT_STATUS_LDAP(rc);
1614         }
1615
1616         if (ldb_transaction_commit(state->ldb) != LDB_SUCCESS) {
1617                 DEBUG(0, ("Failed to commit transaction in pdb_samba_dsdb_delete_alias(): %s\n",
1618                           ldb_errstring(state->ldb)));
1619                 talloc_free(tmp_ctx);
1620                 return NT_STATUS_INTERNAL_ERROR;
1621         }
1622
1623         talloc_free(tmp_ctx);
1624         return NT_STATUS_OK;
1625 }
1626
1627 #if 0
1628 static NTSTATUS pdb_samba_dsdb_set_aliasinfo(struct pdb_methods *m,
1629                                       const struct dom_sid *sid,
1630                                       struct acct_info *info)
1631 {
1632         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1633                 m->private_data, struct pdb_samba_dsdb_state);
1634         struct tldap_context *ld;
1635         const char *attrs[3] = { "objectSid", "description",
1636                                  "samAccountName" };
1637         struct ldb_message **msg;
1638         char *sidstr, *dn;
1639         int rc;
1640         struct tldap_mod *mods;
1641         int num_mods;
1642         bool ok;
1643
1644         ld = pdb_samba_dsdb_ld(state);
1645         if (ld == NULL) {
1646                 return NT_STATUS_LDAP(TLDAP_SERVER_DOWN);
1647         }
1648
1649         sidstr = sid_binstring(talloc_tos(), sid);
1650         NT_STATUS_HAVE_NO_MEMORY(sidstr);
1651
1652         rc = pdb_samba_dsdb_search_fmt(state, state->domaindn, TLDAP_SCOPE_SUB,
1653                                 attrs, ARRAY_SIZE(attrs), 0, talloc_tos(),
1654                                 &msg, "(&(objectSid=%s)(objectclass=group)"
1655                                 "(|(grouptype=%d)(grouptype=%d)))",
1656                                 sidstr, GTYPE_SECURITY_BUILTIN_LOCAL_GROUP,
1657                                 GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
1658         TALLOC_FREE(sidstr)
1659         if (rc != LDB_SUCCESS) {
1660                 DEBUG(10, ("ldap_search failed %s\n",
1661                            ldb_errstring(state->ldb)));
1662                 return NT_STATUS_LDAP(rc);
1663         }
1664         switch talloc_array_length(msg) {
1665         case 0:
1666                 return NT_STATUS_NO_SUCH_ALIAS;
1667         case 1:
1668                 break;
1669         default:
1670                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1671         }
1672
1673         if (!tldap_entry_dn(msg[0], &dn)) {
1674                 TALLOC_FREE(msg);
1675                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1676         }
1677
1678         mods = NULL;
1679         num_mods = 0;
1680         ok = true;
1681
1682         ok &= tldap_make_mod_fmt(
1683                 msg[0], msg, &num_mods, &mods, "description",
1684                 "%s", info->acct_desc);
1685         ok &= tldap_make_mod_fmt(
1686                 msg[0], msg, &num_mods, &mods, "samAccountName",
1687                 "%s", info->acct_name);
1688         if (!ok) {
1689                 TALLOC_FREE(msg);
1690                 return NT_STATUS_NO_MEMORY;
1691         }
1692         if (num_mods == 0) {
1693                 /* no change */
1694                 TALLOC_FREE(msg);
1695                 return NT_STATUS_OK;
1696         }
1697
1698         rc = tldap_modify(ld, dn, num_mods, mods, NULL, 0, NULL, 0);
1699         TALLOC_FREE(msg);
1700         if (rc != LDB_SUCCESS) {
1701                 DEBUG(10, ("ldap_modify failed: %s\n",
1702                            ldb_errstring(state->ldb)));
1703                 return NT_STATUS_LDAP(rc);
1704         }
1705         return NT_STATUS_OK;
1706 }
1707 #endif
1708 static NTSTATUS pdb_samba_dsdb_add_aliasmem(struct pdb_methods *m,
1709                                      const struct dom_sid *alias,
1710                                      const struct dom_sid *member)
1711 {
1712         NTSTATUS status;
1713         TALLOC_CTX *frame = talloc_stackframe();
1714         status = pdb_samba_dsdb_mod_groupmem_by_sid(m, frame, alias, member, LDB_FLAG_MOD_ADD);
1715         talloc_free(frame);
1716         return status;
1717 }
1718
1719 static NTSTATUS pdb_samba_dsdb_del_aliasmem(struct pdb_methods *m,
1720                                      const struct dom_sid *alias,
1721                                      const struct dom_sid *member)
1722 {
1723         NTSTATUS status;
1724         TALLOC_CTX *frame = talloc_stackframe();
1725         status = pdb_samba_dsdb_mod_groupmem_by_sid(m, frame, alias, member, LDB_FLAG_MOD_DELETE);
1726         talloc_free(frame);
1727         return status;
1728 }
1729
1730 static NTSTATUS pdb_samba_dsdb_enum_aliasmem(struct pdb_methods *m,
1731                                       const struct dom_sid *alias,
1732                                       TALLOC_CTX *mem_ctx,
1733                                       struct dom_sid **pmembers,
1734                                       size_t *pnum_members)
1735 {
1736         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1737                 m->private_data, struct pdb_samba_dsdb_state);
1738         struct ldb_dn *dn;
1739         unsigned int num_members;
1740         NTSTATUS status;
1741         struct dom_sid_buf buf;
1742         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1743         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1744
1745         dn = ldb_dn_new_fmt(
1746                 tmp_ctx,
1747                 state->ldb,
1748                 "<SID=%s>",
1749                 dom_sid_str_buf(alias, &buf));
1750         if (!dn || !ldb_dn_validate(dn)) {
1751                 return NT_STATUS_NO_MEMORY;
1752         }
1753
1754         status = dsdb_enum_group_mem(state->ldb, mem_ctx, dn, pmembers, &num_members);
1755         *pnum_members = num_members;
1756         if (NT_STATUS_IS_OK(status)) {
1757                 talloc_steal(mem_ctx, pmembers);
1758         }
1759         talloc_free(tmp_ctx);
1760         return status;
1761 }
1762
1763 static NTSTATUS pdb_samba_dsdb_enum_alias_memberships(struct pdb_methods *m,
1764                                                TALLOC_CTX *mem_ctx,
1765                                                const struct dom_sid *domain_sid,
1766                                                const struct dom_sid *members,
1767                                                size_t num_members,
1768                                                uint32_t **palias_rids,
1769                                                size_t *pnum_alias_rids)
1770 {
1771         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1772                 m->private_data, struct pdb_samba_dsdb_state);
1773         uint32_t *alias_rids = NULL;
1774         size_t num_alias_rids = 0;
1775         int i;
1776         struct dom_sid *groupSIDs = NULL;
1777         unsigned int num_groupSIDs = 0;
1778         char *filter;
1779         NTSTATUS status;
1780         const char *sid_dn;
1781         DATA_BLOB sid_blob;
1782
1783         TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
1784         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1785         /*
1786          * TODO: Get the filter right so that we only get the aliases from
1787          * either the SAM or BUILTIN
1788          */
1789
1790         filter = talloc_asprintf(tmp_ctx, "(&(objectClass=group)(groupType:1.2.840.113556.1.4.803:=%u))",
1791                                  GROUP_TYPE_BUILTIN_LOCAL_GROUP);
1792         if (filter == NULL) {
1793                 return NT_STATUS_NO_MEMORY;
1794         }
1795
1796         for (i = 0; i < num_members; i++) {
1797                 struct dom_sid_buf buf;
1798
1799                 sid_dn = talloc_asprintf(
1800                         tmp_ctx,
1801                         "<SID=%s>",
1802                         dom_sid_str_buf(&members[i], &buf));
1803                 if (sid_dn == NULL) {
1804                         TALLOC_FREE(tmp_ctx);
1805                         return NT_STATUS_NO_MEMORY;
1806                 }
1807
1808                 sid_blob = data_blob_string_const(sid_dn);
1809
1810                 status = dsdb_expand_nested_groups(state->ldb, &sid_blob, true, filter,
1811                                                    tmp_ctx, &groupSIDs, &num_groupSIDs);
1812                 if (!NT_STATUS_IS_OK(status)) {
1813                         talloc_free(tmp_ctx);
1814                         return status;
1815                 }
1816         }
1817
1818         alias_rids = talloc_array(mem_ctx, uint32_t, num_groupSIDs);
1819         if (alias_rids == NULL) {
1820                 talloc_free(tmp_ctx);
1821                 return NT_STATUS_NO_MEMORY;
1822         }
1823
1824         for (i=0; i<num_groupSIDs; i++) {
1825                 if (sid_peek_check_rid(domain_sid, &groupSIDs[i],
1826                                        &alias_rids[num_alias_rids])) {
1827                         num_alias_rids++;;
1828                 }
1829         }
1830
1831         *palias_rids = alias_rids;
1832         *pnum_alias_rids = num_alias_rids;
1833         return NT_STATUS_OK;
1834 }
1835
1836 static NTSTATUS pdb_samba_dsdb_lookup_rids(struct pdb_methods *m,
1837                                     const struct dom_sid *domain_sid,
1838                                     int num_rids,
1839                                     uint32_t *rids,
1840                                     const char **names,
1841                                     enum lsa_SidType *lsa_attrs)
1842 {
1843         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1844                 m->private_data, struct pdb_samba_dsdb_state);
1845         NTSTATUS status;
1846
1847         TALLOC_CTX *tmp_ctx;
1848
1849         if (num_rids == 0) {
1850                 return NT_STATUS_NONE_MAPPED;
1851         }
1852
1853         tmp_ctx = talloc_stackframe();
1854         NT_STATUS_HAVE_NO_MEMORY(tmp_ctx);
1855
1856         status = dsdb_lookup_rids(state->ldb, tmp_ctx, domain_sid, num_rids, rids, names, lsa_attrs);
1857         talloc_free(tmp_ctx);
1858         return status;
1859 }
1860
1861 static NTSTATUS pdb_samba_dsdb_lookup_names(struct pdb_methods *m,
1862                                      const struct dom_sid *domain_sid,
1863                                      int num_names,
1864                                      const char **pp_names,
1865                                      uint32_t *rids,
1866                                      enum lsa_SidType *attrs)
1867 {
1868         return NT_STATUS_NOT_IMPLEMENTED;
1869 }
1870
1871 static NTSTATUS pdb_samba_dsdb_get_account_policy(struct pdb_methods *m,
1872                                            enum pdb_policy_type type,
1873                                            uint32_t *value)
1874 {
1875         return account_policy_get(type, value)
1876                 ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1877 }
1878
1879 static NTSTATUS pdb_samba_dsdb_set_account_policy(struct pdb_methods *m,
1880                                            enum pdb_policy_type type,
1881                                            uint32_t value)
1882 {
1883         return account_policy_set(type, value)
1884                 ? NT_STATUS_OK : NT_STATUS_UNSUCCESSFUL;
1885 }
1886
1887 static NTSTATUS pdb_samba_dsdb_get_seq_num(struct pdb_methods *m,
1888                                     time_t *seq_num_out)
1889 {
1890         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1891                 m->private_data, struct pdb_samba_dsdb_state);
1892         uint64_t seq_num;
1893         int ret = ldb_sequence_number(state->ldb, LDB_SEQ_HIGHEST_SEQ, &seq_num);
1894         if (ret == LDB_SUCCESS) {
1895                 *seq_num_out = seq_num;
1896                 return NT_STATUS_OK;
1897         } else {
1898                 return NT_STATUS_UNSUCCESSFUL;
1899         }
1900 }
1901
1902 struct pdb_samba_dsdb_search_state {
1903         uint32_t acct_flags;
1904         struct samr_displayentry *entries;
1905         uint32_t num_entries;
1906         ssize_t array_size;
1907         uint32_t current;
1908 };
1909
1910 static bool pdb_samba_dsdb_next_entry(struct pdb_search *search,
1911                                struct samr_displayentry *entry)
1912 {
1913         struct pdb_samba_dsdb_search_state *state = talloc_get_type_abort(
1914                 search->private_data, struct pdb_samba_dsdb_search_state);
1915
1916         if (state->current == state->num_entries) {
1917                 return false;
1918         }
1919
1920         entry->idx = state->entries[state->current].idx;
1921         entry->rid = state->entries[state->current].rid;
1922         entry->acct_flags = state->entries[state->current].acct_flags;
1923
1924         entry->account_name = talloc_strdup(
1925                 search, state->entries[state->current].account_name);
1926         entry->fullname = talloc_strdup(
1927                 search, state->entries[state->current].fullname);
1928         entry->description = talloc_strdup(
1929                 search, state->entries[state->current].description);
1930
1931         state->current += 1;
1932         return true;
1933 }
1934
1935 static void pdb_samba_dsdb_search_end(struct pdb_search *search)
1936 {
1937         struct pdb_samba_dsdb_search_state *state = talloc_get_type_abort(
1938                 search->private_data, struct pdb_samba_dsdb_search_state);
1939         talloc_free(state);
1940 }
1941
1942 static bool pdb_samba_dsdb_search_filter(struct pdb_methods *m,
1943                                          struct pdb_search *search,
1944                                          struct pdb_samba_dsdb_search_state **pstate,
1945                                          const char *exp_fmt, ...)
1946                                          PRINTF_ATTRIBUTE(4, 5);
1947
1948 static bool pdb_samba_dsdb_search_filter(struct pdb_methods *m,
1949                                      struct pdb_search *search,
1950                                      struct pdb_samba_dsdb_search_state **pstate,
1951                                      const char *exp_fmt, ...)
1952 {
1953         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
1954                 m->private_data, struct pdb_samba_dsdb_state);
1955         struct pdb_samba_dsdb_search_state *sstate;
1956         const char * attrs[] = { "objectSid", "sAMAccountName", "displayName",
1957                                  "userAccountControl", "description", NULL };
1958         struct ldb_result *res;
1959         int i, rc, num_users;
1960
1961         va_list ap;
1962         char *expression = NULL;
1963
1964         TALLOC_CTX *tmp_ctx = talloc_stackframe();
1965         if (!tmp_ctx) {
1966                 return false;
1967         }
1968
1969         va_start(ap, exp_fmt);
1970         expression = talloc_vasprintf(tmp_ctx, exp_fmt, ap);
1971         va_end(ap);
1972
1973         if (!expression) {
1974                 talloc_free(tmp_ctx);
1975                 return LDB_ERR_OPERATIONS_ERROR;
1976         }
1977
1978         sstate = talloc_zero(tmp_ctx, struct pdb_samba_dsdb_search_state);
1979         if (sstate == NULL) {
1980                 talloc_free(tmp_ctx);
1981                 return false;
1982         }
1983
1984         rc = dsdb_search(state->ldb, tmp_ctx, &res, ldb_get_default_basedn(state->ldb), LDB_SCOPE_SUBTREE, attrs, 0, "%s", expression);
1985         if (rc != LDB_SUCCESS) {
1986                 talloc_free(tmp_ctx);
1987                 DEBUG(10, ("dsdb_search failed: %s\n",
1988                            ldb_errstring(state->ldb)));
1989                 return false;
1990         }
1991
1992         num_users = res->count;
1993
1994         sstate->entries = talloc_array(sstate, struct samr_displayentry,
1995                                        num_users);
1996         if (sstate->entries == NULL) {
1997                 talloc_free(tmp_ctx);
1998                 DEBUG(10, ("talloc failed\n"));
1999                 return false;
2000         }
2001
2002         sstate->num_entries = 0;
2003
2004         for (i=0; i<num_users; i++) {
2005                 struct samr_displayentry *e;
2006                 struct dom_sid *sid;
2007
2008                 e = &sstate->entries[sstate->num_entries];
2009
2010                 e->idx = sstate->num_entries;
2011                 sid = samdb_result_dom_sid(tmp_ctx, res->msgs[i], "objectSid");
2012                 if (!sid) {
2013                         talloc_free(tmp_ctx);
2014                         DEBUG(10, ("Could not pull SID\n"));
2015                         return false;
2016                 }
2017                 sid_peek_rid(sid, &e->rid);
2018
2019                 e->acct_flags = samdb_result_acct_flags(res->msgs[i], "userAccountControl");
2020                 e->account_name = ldb_msg_find_attr_as_string(
2021                         res->msgs[i], "samAccountName", NULL);
2022                 if (e->account_name == NULL) {
2023                         talloc_free(tmp_ctx);
2024                         return false;
2025                 }
2026                 e->fullname = ldb_msg_find_attr_as_string(
2027                         res->msgs[i], "displayName", "");
2028                 e->description = ldb_msg_find_attr_as_string(
2029                         res->msgs[i], "description", "");
2030
2031                 sstate->num_entries += 1;
2032                 if (sstate->num_entries >= num_users) {
2033                         break;
2034                 }
2035         }
2036         talloc_steal(sstate->entries, res->msgs);
2037         search->private_data = talloc_steal(search, sstate);
2038         search->next_entry = pdb_samba_dsdb_next_entry;
2039         search->search_end = pdb_samba_dsdb_search_end;
2040         *pstate = sstate;
2041         talloc_free(tmp_ctx);
2042         return true;
2043 }
2044
2045 static bool pdb_samba_dsdb_search_users(struct pdb_methods *m,
2046                                  struct pdb_search *search,
2047                                  uint32_t acct_flags)
2048 {
2049         struct pdb_samba_dsdb_search_state *sstate;
2050         bool ret;
2051
2052         ret = pdb_samba_dsdb_search_filter(m, search, &sstate, "(objectclass=user)");
2053         if (!ret) {
2054                 return false;
2055         }
2056         sstate->acct_flags = acct_flags;
2057         return true;
2058 }
2059
2060 static bool pdb_samba_dsdb_search_groups(struct pdb_methods *m,
2061                                   struct pdb_search *search)
2062 {
2063         struct pdb_samba_dsdb_search_state *sstate;
2064         bool ret;
2065
2066         ret = pdb_samba_dsdb_search_filter(m, search, &sstate,
2067                                        "(&(grouptype=%d)(objectclass=group))",
2068                                        GTYPE_SECURITY_GLOBAL_GROUP);
2069         if (!ret) {
2070                 return false;
2071         }
2072         sstate->acct_flags = 0;
2073         return true;
2074 }
2075
2076 static bool pdb_samba_dsdb_search_aliases(struct pdb_methods *m,
2077                                    struct pdb_search *search,
2078                                    const struct dom_sid *sid)
2079 {
2080         struct pdb_samba_dsdb_search_state *sstate;
2081         bool ret;
2082
2083         ret = pdb_samba_dsdb_search_filter(m, search, &sstate,
2084                                        "(&(grouptype=%d)(objectclass=group))",
2085                                        sid_check_is_builtin(sid)
2086                                        ? GTYPE_SECURITY_BUILTIN_LOCAL_GROUP
2087                                        : GTYPE_SECURITY_DOMAIN_LOCAL_GROUP);
2088         if (!ret) {
2089                 return false;
2090         }
2091         sstate->acct_flags = 0;
2092         return true;
2093 }
2094
2095 /*
2096  * Instead of taking a gid or uid, this function takes a pointer to a
2097  * unixid.
2098  *
2099  * This acts as an in-out variable so that the idmap functions can correctly
2100  * receive ID_TYPE_BOTH, and this function ensures cache details are filled
2101  * correctly rather than forcing the cache to store ID_TYPE_UID or ID_TYPE_GID.
2102  */
2103 static bool pdb_samba_dsdb_id_to_sid(struct pdb_methods *m, struct unixid *id,
2104                                      struct dom_sid *sid)
2105 {
2106         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2107                 m->private_data, struct pdb_samba_dsdb_state);
2108         NTSTATUS status;
2109         struct id_map id_map;
2110         struct id_map *id_maps[2];
2111         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2112         if (!tmp_ctx) {
2113                 return false;
2114         }
2115
2116         id_map.xid = *id;
2117         id_maps[0] = &id_map;
2118         id_maps[1] = NULL;
2119
2120         status = idmap_xids_to_sids(state->idmap_ctx, tmp_ctx, id_maps);
2121         if (!NT_STATUS_IS_OK(status)) {
2122                 talloc_free(tmp_ctx);
2123                 return false;
2124         }
2125
2126         if (id_map.xid.type != ID_TYPE_NOT_SPECIFIED) {
2127                 id->type = id_map.xid.type;
2128         }
2129         *sid = *id_map.sid;
2130         talloc_free(tmp_ctx);
2131         return true;
2132 }
2133
2134 static bool pdb_samba_dsdb_sid_to_id(struct pdb_methods *m, const struct dom_sid *sid,
2135                                  struct unixid *id)
2136 {
2137         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2138                 m->private_data, struct pdb_samba_dsdb_state);
2139         struct id_map id_map;
2140         struct id_map *id_maps[2];
2141         NTSTATUS status;
2142         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2143         if (!tmp_ctx) {
2144                 return false;
2145         }
2146
2147         ZERO_STRUCT(id_map);
2148         id_map.sid = discard_const_p(struct dom_sid, sid);
2149         id_maps[0] = &id_map;
2150         id_maps[1] = NULL;
2151
2152         status = idmap_sids_to_xids(state->idmap_ctx, tmp_ctx, id_maps);
2153         talloc_free(tmp_ctx);
2154         if (!NT_STATUS_IS_OK(status)) {
2155                 return false;
2156         }
2157         if (id_map.xid.type != ID_TYPE_NOT_SPECIFIED) {
2158                 *id = id_map.xid;
2159                 return true;
2160         }
2161         return false;
2162 }
2163
2164 static uint32_t pdb_samba_dsdb_capabilities(struct pdb_methods *m)
2165 {
2166         return PDB_CAP_STORE_RIDS | PDB_CAP_ADS | PDB_CAP_TRUSTED_DOMAINS_EX;
2167 }
2168
2169 static bool pdb_samba_dsdb_new_rid(struct pdb_methods *m, uint32_t *rid)
2170 {
2171         return false;
2172 }
2173
2174 static bool pdb_samba_dsdb_get_trusteddom_pw(struct pdb_methods *m,
2175                                       const char *domain, char** pwd,
2176                                       struct dom_sid *sid,
2177                                       time_t *pass_last_set_time)
2178 {
2179         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2180                 m->private_data, struct pdb_samba_dsdb_state);
2181         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2182         const char * const attrs[] = {
2183                 "securityIdentifier",
2184                 "flatName",
2185                 "trustPartner",
2186                 "trustAuthOutgoing",
2187                 "whenCreated",
2188                 "msDS-SupportedEncryptionTypes",
2189                 "trustAttributes",
2190                 "trustDirection",
2191                 "trustType",
2192                 NULL
2193         };
2194         struct ldb_message *msg;
2195         const struct ldb_val *password_val;
2196         int trust_direction_flags;
2197         int trust_type;
2198         int i;
2199         DATA_BLOB password_utf16;
2200         struct trustAuthInOutBlob password_blob;
2201         struct AuthenticationInformationArray *auth_array;
2202         char *password_talloc;
2203         size_t password_len;
2204         enum ndr_err_code ndr_err;
2205         NTSTATUS status;
2206         const char *netbios_domain = NULL;
2207         const struct dom_sid *domain_sid = NULL;
2208
2209         status = dsdb_trust_search_tdo(state->ldb, domain, NULL,
2210                                        attrs, tmp_ctx, &msg);
2211         if (!NT_STATUS_IS_OK(status)) {
2212                 /*
2213                  * This can be called to work out of a domain is
2214                  * trusted, rather than just to get the password
2215                  */
2216                 DEBUG(2, ("Failed to get trusted domain password for %s - %s.  "
2217                           "It may not be a trusted domain.\n", domain,
2218                           nt_errstr(status)));
2219                 TALLOC_FREE(tmp_ctx);
2220                 return false;
2221         }
2222
2223         netbios_domain = ldb_msg_find_attr_as_string(msg, "flatName", NULL);
2224         if (netbios_domain == NULL) {
2225                 DEBUG(2, ("Trusted domain %s has to flatName defined.\n",
2226                           domain));
2227                 TALLOC_FREE(tmp_ctx);
2228                 return false;
2229         }
2230
2231         domain_sid = samdb_result_dom_sid(tmp_ctx, msg, "securityIdentifier");
2232         if (domain_sid == NULL) {
2233                 DEBUG(2, ("Trusted domain %s has no securityIdentifier defined.\n",
2234                           domain));
2235                 TALLOC_FREE(tmp_ctx);
2236                 return false;
2237         }
2238
2239         trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
2240         if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
2241                 DEBUG(2, ("Trusted domain %s is is not an outbound trust.\n",
2242                           domain));
2243                 TALLOC_FREE(tmp_ctx);
2244                 return false;
2245         }
2246
2247         trust_type = ldb_msg_find_attr_as_int(msg, "trustType", 0);
2248         if (trust_type == LSA_TRUST_TYPE_MIT) {
2249                 DEBUG(1, ("Trusted domain %s is is not an AD trust "
2250                           "(trustType == LSA_TRUST_TYPE_MIT).\n",
2251                           domain));
2252                 TALLOC_FREE(tmp_ctx);
2253                 return false;
2254         }
2255
2256         password_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
2257         if (password_val == NULL) {
2258                 DEBUG(2, ("Failed to get trusted domain password for %s, "
2259                           "attribute trustAuthOutgoing not returned.\n", domain));
2260                 TALLOC_FREE(tmp_ctx);
2261                 return false;
2262         }
2263
2264         ndr_err = ndr_pull_struct_blob(password_val, tmp_ctx, &password_blob,
2265                                 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
2266         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2267                 DEBUG(0, ("Failed to get trusted domain password for %s, "
2268                           "attribute trustAuthOutgoing could not be parsed %s.\n",
2269                           domain,
2270                           ndr_map_error2string(ndr_err)));
2271                 TALLOC_FREE(tmp_ctx);
2272                 return false;
2273         }
2274
2275         auth_array = &password_blob.current;
2276
2277         for (i=0; i < auth_array->count; i++) {
2278                 if (auth_array->array[i].AuthType == TRUST_AUTH_TYPE_CLEAR) {
2279                         break;
2280                 }
2281         }
2282
2283         if (i == auth_array->count) {
2284                 DEBUG(0, ("Trusted domain %s does not have a "
2285                           "clear-text password stored\n",
2286                           domain));
2287                 TALLOC_FREE(tmp_ctx);
2288                 return false;
2289         }
2290
2291         password_utf16 = data_blob_const(auth_array->array[i].AuthInfo.clear.password,
2292                                          auth_array->array[i].AuthInfo.clear.size);
2293
2294         /*
2295          * In the future, make this function return a
2296          * cli_credentials that can store a MD4 hash with cli_credential_set_nt_hash()
2297          * but for now convert to UTF8 and fail if the string can not be converted.
2298          *
2299          * We can't safely convert the random strings windows uses into
2300          * utf8.
2301          */
2302         if (!convert_string_talloc(tmp_ctx,
2303                                    CH_UTF16MUNGED, CH_UTF8,
2304                                    password_utf16.data, password_utf16.length,
2305                                    (void *)&password_talloc,
2306                                    &password_len)) {
2307                 DEBUG(0, ("FIXME: Could not convert password for trusted domain %s"
2308                           " to UTF8. This may be a password set from Windows.\n",
2309                           domain));
2310                 TALLOC_FREE(tmp_ctx);
2311                 return false;
2312         }
2313         *pwd = SMB_STRNDUP(password_talloc, password_len);
2314         if (pass_last_set_time) {
2315                 *pass_last_set_time = nt_time_to_unix(auth_array->array[i].LastUpdateTime);
2316         }
2317
2318         if (sid != NULL) {
2319                 sid_copy(sid, domain_sid);
2320         }
2321
2322         TALLOC_FREE(tmp_ctx);
2323         return true;
2324 }
2325
2326 static NTSTATUS pdb_samba_dsdb_get_trusteddom_creds(struct pdb_methods *m,
2327                                                     const char *domain,
2328                                                     TALLOC_CTX *mem_ctx,
2329                                                     struct cli_credentials **_creds)
2330 {
2331         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2332                 m->private_data, struct pdb_samba_dsdb_state);
2333         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2334         const char * const attrs[] = {
2335                 "securityIdentifier",
2336                 "flatName",
2337                 "trustPartner",
2338                 "trustAuthOutgoing",
2339                 "whenCreated",
2340                 "msDS-SupportedEncryptionTypes",
2341                 "trustAttributes",
2342                 "trustDirection",
2343                 "trustType",
2344                 NULL
2345         };
2346         struct ldb_message *msg;
2347         const struct ldb_val *password_val;
2348         int trust_direction_flags;
2349         int trust_type;
2350         int i;
2351         DATA_BLOB password_utf16 = {};
2352         struct samr_Password *password_nt = NULL;
2353         uint32_t password_version = 0;
2354         DATA_BLOB old_password_utf16 = {};
2355         struct samr_Password *old_password_nt = NULL;
2356         struct trustAuthInOutBlob password_blob;
2357         enum ndr_err_code ndr_err;
2358         NTSTATUS status;
2359         time_t last_set_time = 0;
2360         struct cli_credentials *creds = NULL;
2361         bool ok;
2362         const char *my_netbios_name = NULL;
2363         const char *my_netbios_domain = NULL;
2364         const char *my_dns_domain = NULL;
2365         const char *netbios_domain = NULL;
2366         char *account_name = NULL;
2367         char *principal_name = NULL;
2368         const char *dns_domain = NULL;
2369
2370         status = dsdb_trust_search_tdo(state->ldb, domain, NULL,
2371                                        attrs, tmp_ctx, &msg);
2372         if (!NT_STATUS_IS_OK(status)) {
2373                 /*
2374                  * This can be called to work out of a domain is
2375                  * trusted, rather than just to get the password
2376                  */
2377                 DEBUG(2, ("Failed to get trusted domain password for %s - %s "
2378                           "It may not be a trusted domain.\n", domain,
2379                           nt_errstr(status)));
2380                 TALLOC_FREE(tmp_ctx);
2381                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2382         }
2383
2384         netbios_domain = ldb_msg_find_attr_as_string(msg, "flatName", NULL);
2385         if (netbios_domain == NULL) {
2386                 DEBUG(2, ("Trusted domain %s has to flatName defined.\n",
2387                           domain));
2388                 TALLOC_FREE(tmp_ctx);
2389                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2390         }
2391
2392         dns_domain = ldb_msg_find_attr_as_string(msg, "trustPartner", NULL);
2393
2394         trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
2395         if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
2396                 DEBUG(2, ("Trusted domain %s is is not an outbound trust.\n",
2397                           domain));
2398                 TALLOC_FREE(tmp_ctx);
2399                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2400         }
2401
2402         trust_type = ldb_msg_find_attr_as_int(msg, "trustType", 0);
2403         if (trust_type == LSA_TRUST_TYPE_MIT) {
2404                 DEBUG(1, ("Trusted domain %s is is not an AD trust "
2405                           "(trustType == LSA_TRUST_TYPE_MIT).\n",
2406                           domain));
2407                 TALLOC_FREE(tmp_ctx);
2408                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2409         }
2410
2411         password_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
2412         if (password_val == NULL) {
2413                 DEBUG(2, ("Failed to get trusted domain password for %s, "
2414                           "attribute trustAuthOutgoing not returned.\n", domain));
2415                 TALLOC_FREE(tmp_ctx);
2416                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2417         }
2418
2419         ndr_err = ndr_pull_struct_blob(password_val, tmp_ctx, &password_blob,
2420                                 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
2421         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2422                 DEBUG(0, ("Failed to get trusted domain password for %s, "
2423                           "attribute trustAuthOutgoing could not be parsed %s.\n",
2424                           domain,
2425                           ndr_map_error2string(ndr_err)));
2426                 TALLOC_FREE(tmp_ctx);
2427                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2428         }
2429
2430         for (i=0; i < password_blob.current.count; i++) {
2431                 struct AuthenticationInformation *a =
2432                         &password_blob.current.array[i];
2433
2434                 switch (a->AuthType) {
2435                 case TRUST_AUTH_TYPE_NONE:
2436                         break;
2437
2438                 case TRUST_AUTH_TYPE_VERSION:
2439                         password_version = a->AuthInfo.version.version;
2440                         break;
2441
2442                 case TRUST_AUTH_TYPE_CLEAR:
2443                         last_set_time = nt_time_to_unix(a->LastUpdateTime);
2444
2445                         password_utf16 = data_blob_const(a->AuthInfo.clear.password,
2446                                                          a->AuthInfo.clear.size);
2447                         password_nt = NULL;
2448                         break;
2449
2450                 case TRUST_AUTH_TYPE_NT4OWF:
2451                         if (password_utf16.length != 0) {
2452                                 break;
2453                         }
2454
2455                         last_set_time = nt_time_to_unix(a->LastUpdateTime);
2456
2457                         password_nt = &a->AuthInfo.nt4owf.password;
2458                         break;
2459                 }
2460         }
2461
2462         for (i=0; i < password_blob.previous.count; i++) {
2463                 struct AuthenticationInformation *a = &password_blob.previous.array[i];
2464
2465                 switch (a->AuthType) {
2466                 case TRUST_AUTH_TYPE_NONE:
2467                         break;
2468
2469                 case TRUST_AUTH_TYPE_VERSION:
2470                         break;
2471
2472                 case TRUST_AUTH_TYPE_CLEAR:
2473                         old_password_utf16 = data_blob_const(a->AuthInfo.clear.password,
2474                                                          a->AuthInfo.clear.size);
2475                         old_password_nt = NULL;
2476                         break;
2477
2478                 case TRUST_AUTH_TYPE_NT4OWF:
2479                         if (old_password_utf16.length != 0) {
2480                                 break;
2481                         }
2482
2483                         old_password_nt = &a->AuthInfo.nt4owf.password;
2484                         break;
2485                 }
2486         }
2487
2488         if (password_utf16.length == 0 && password_nt == NULL) {
2489                 DEBUG(0, ("Trusted domain %s does not have a "
2490                           "clear-text nor nt password stored\n",
2491                           domain));
2492                 TALLOC_FREE(tmp_ctx);
2493                 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
2494         }
2495
2496         my_netbios_name = lpcfg_netbios_name(state->lp_ctx);
2497         my_netbios_domain = lpcfg_workgroup(state->lp_ctx);
2498         my_dns_domain = lpcfg_dnsdomain(state->lp_ctx);
2499
2500         creds = cli_credentials_init(tmp_ctx);
2501         if (creds == NULL) {
2502                 TALLOC_FREE(tmp_ctx);
2503                 return NT_STATUS_NO_MEMORY;
2504         }
2505
2506         ok = cli_credentials_set_workstation(creds, my_netbios_name, CRED_SPECIFIED);
2507         if (!ok) {
2508                 TALLOC_FREE(tmp_ctx);
2509                 return NT_STATUS_NO_MEMORY;
2510         }
2511
2512         ok = cli_credentials_set_domain(creds, netbios_domain, CRED_SPECIFIED);
2513         if (!ok) {
2514                 TALLOC_FREE(tmp_ctx);
2515                 return NT_STATUS_NO_MEMORY;
2516         }
2517         ok = cli_credentials_set_realm(creds, dns_domain, CRED_SPECIFIED);
2518         if (!ok) {
2519                 TALLOC_FREE(tmp_ctx);
2520                 return NT_STATUS_NO_MEMORY;
2521         }
2522
2523         if (my_dns_domain != NULL && dns_domain != NULL) {
2524                 cli_credentials_set_secure_channel_type(creds, SEC_CHAN_DNS_DOMAIN);
2525                 account_name = talloc_asprintf(tmp_ctx, "%s.", my_dns_domain);
2526                 if (account_name == NULL) {
2527                         TALLOC_FREE(tmp_ctx);
2528                         return NT_STATUS_NO_MEMORY;
2529                 }
2530                 principal_name = talloc_asprintf(tmp_ctx, "%s$@%s", my_netbios_domain,
2531                                                  cli_credentials_get_realm(creds));
2532                 if (principal_name == NULL) {
2533                         TALLOC_FREE(tmp_ctx);
2534                         return NT_STATUS_NO_MEMORY;
2535                 }
2536         } else {
2537                 cli_credentials_set_secure_channel_type(creds, SEC_CHAN_DOMAIN);
2538                 account_name = talloc_asprintf(tmp_ctx, "%s$", my_netbios_domain);
2539                 if (account_name == NULL) {
2540                         TALLOC_FREE(tmp_ctx);
2541                         return NT_STATUS_NO_MEMORY;
2542                 }
2543                 principal_name = NULL;
2544         }
2545
2546         ok = cli_credentials_set_username(creds, account_name, CRED_SPECIFIED);
2547         if (!ok) {
2548                 TALLOC_FREE(tmp_ctx);
2549                 return NT_STATUS_NO_MEMORY;
2550         }
2551
2552         if (principal_name != NULL) {
2553                 ok = cli_credentials_set_principal(creds, principal_name,
2554                                                    CRED_SPECIFIED);
2555                 if (!ok) {
2556                         TALLOC_FREE(tmp_ctx);
2557                         return NT_STATUS_NO_MEMORY;
2558                 }
2559         }
2560
2561         if (old_password_nt != NULL) {
2562                 ok = cli_credentials_set_old_nt_hash(creds, old_password_nt);
2563                 if (!ok) {
2564                         TALLOC_FREE(tmp_ctx);
2565                         return NT_STATUS_NO_MEMORY;
2566                 }
2567         }
2568
2569         if (old_password_utf16.length > 0) {
2570                 ok = cli_credentials_set_old_utf16_password(creds,
2571                                                             &old_password_utf16);
2572                 if (!ok) {
2573                         TALLOC_FREE(tmp_ctx);
2574                         return NT_STATUS_NO_MEMORY;
2575                 }
2576         }
2577
2578         if (password_nt != NULL) {
2579                 ok = cli_credentials_set_nt_hash(creds, password_nt,
2580                                                  CRED_SPECIFIED);
2581                 if (!ok) {
2582                         TALLOC_FREE(tmp_ctx);
2583                         return NT_STATUS_NO_MEMORY;
2584                 }
2585         }
2586
2587         if (password_utf16.length > 0) {
2588                 ok = cli_credentials_set_utf16_password(creds,
2589                                                         &password_utf16,
2590                                                         CRED_SPECIFIED);
2591                 if (!ok) {
2592                         TALLOC_FREE(tmp_ctx);
2593                         return NT_STATUS_NO_MEMORY;
2594                 }
2595         }
2596
2597         cli_credentials_set_password_last_changed_time(creds, last_set_time);
2598         cli_credentials_set_kvno(creds, password_version);
2599
2600         if (password_utf16.length > 0 && dns_domain != NULL) {
2601                 /*
2602                  * Force kerberos if this is an active directory domain
2603                  */
2604                 cli_credentials_set_kerberos_state(creds,
2605                                                    CRED_MUST_USE_KERBEROS);
2606         } else  {
2607                 /*
2608                  * TODO: we should allow krb5 with the raw nt hash.
2609                  */
2610                 cli_credentials_set_kerberos_state(creds,
2611                                                    CRED_DONT_USE_KERBEROS);
2612         }
2613
2614         *_creds = talloc_move(mem_ctx, &creds);
2615         TALLOC_FREE(tmp_ctx);
2616         return NT_STATUS_OK;
2617 }
2618
2619 static bool pdb_samba_dsdb_set_trusteddom_pw(struct pdb_methods *m,
2620                                       const char* domain, const char* pwd,
2621                                       const struct dom_sid *sid)
2622 {
2623         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2624                 m->private_data, struct pdb_samba_dsdb_state);
2625         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2626         const char * const attrs[] = {
2627                 "trustAuthOutgoing",
2628                 "trustDirection",
2629                 "trustType",
2630                 NULL
2631         };
2632         struct ldb_message *msg = NULL;
2633         int trust_direction_flags;
2634         int trust_type;
2635         uint32_t i; /* The same type as old_blob.current.count */
2636         const struct ldb_val *old_val = NULL;
2637         struct trustAuthInOutBlob old_blob = {};
2638         uint32_t old_version = 0;
2639         uint32_t new_version = 0;
2640         DATA_BLOB new_utf16 = {};
2641         struct trustAuthInOutBlob new_blob = {};
2642         struct ldb_val new_val = {};
2643         struct timeval tv = timeval_current();
2644         NTTIME now = timeval_to_nttime(&tv);
2645         enum ndr_err_code ndr_err;
2646         NTSTATUS status;
2647         bool ok;
2648         int ret;
2649
2650         ret = ldb_transaction_start(state->ldb);
2651         if (ret != LDB_SUCCESS) {
2652                 DEBUG(2, ("Failed to start transaction.\n"));
2653                 TALLOC_FREE(tmp_ctx);
2654                 return false;
2655         }
2656
2657         ok = samdb_is_pdc(state->ldb);
2658         if (!ok) {
2659                 DEBUG(2, ("Password changes for domain %s are only allowed on a PDC.\n",
2660                           domain));
2661                 TALLOC_FREE(tmp_ctx);
2662                 ldb_transaction_cancel(state->ldb);
2663                 return false;
2664         }
2665
2666         status = dsdb_trust_search_tdo(state->ldb, domain, NULL,
2667                                        attrs, tmp_ctx, &msg);
2668         if (!NT_STATUS_IS_OK(status)) {
2669                 /*
2670                  * This can be called to work out of a domain is
2671                  * trusted, rather than just to get the password
2672                  */
2673                 DEBUG(2, ("Failed to get trusted domain password for %s - %s.  "
2674                           "It may not be a trusted domain.\n", domain,
2675                           nt_errstr(status)));
2676                 TALLOC_FREE(tmp_ctx);
2677                 ldb_transaction_cancel(state->ldb);
2678                 return false;
2679         }
2680
2681         trust_direction_flags = ldb_msg_find_attr_as_int(msg, "trustDirection", 0);
2682         if (!(trust_direction_flags & LSA_TRUST_DIRECTION_OUTBOUND)) {
2683                 DEBUG(2, ("Trusted domain %s is is not an outbound trust, can't set a password.\n",
2684                           domain));
2685                 TALLOC_FREE(tmp_ctx);
2686                 ldb_transaction_cancel(state->ldb);
2687                 return false;
2688         }
2689
2690         trust_type = ldb_msg_find_attr_as_int(msg, "trustType", 0);
2691         switch (trust_type) {
2692         case LSA_TRUST_TYPE_DOWNLEVEL:
2693         case LSA_TRUST_TYPE_UPLEVEL:
2694                 break;
2695         default:
2696                 DEBUG(0, ("Trusted domain %s is of type 0x%X - "
2697                           "password changes are not supported\n",
2698                           domain, (unsigned)trust_type));
2699                 TALLOC_FREE(tmp_ctx);
2700                 ldb_transaction_cancel(state->ldb);
2701                 return false;
2702         }
2703
2704         old_val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
2705         if (old_val != NULL) {
2706                 ndr_err = ndr_pull_struct_blob(old_val, tmp_ctx, &old_blob,
2707                                 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
2708                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2709                         DEBUG(0, ("Failed to get trusted domain password for %s, "
2710                                   "attribute trustAuthOutgoing could not be parsed %s.\n",
2711                                   domain,
2712                                   ndr_map_error2string(ndr_err)));
2713                         TALLOC_FREE(tmp_ctx);
2714                         ldb_transaction_cancel(state->ldb);
2715                         return false;
2716                 }
2717         }
2718
2719         for (i=0; i < old_blob.current.count; i++) {
2720                 struct AuthenticationInformation *a =
2721                         &old_blob.current.array[i];
2722
2723                 switch (a->AuthType) {
2724                 case TRUST_AUTH_TYPE_NONE:
2725                         break;
2726
2727                 case TRUST_AUTH_TYPE_VERSION:
2728                         old_version = a->AuthInfo.version.version;
2729                         break;
2730
2731                 case TRUST_AUTH_TYPE_CLEAR:
2732                         break;
2733
2734                 case TRUST_AUTH_TYPE_NT4OWF:
2735                         break;
2736                 }
2737         }
2738
2739         new_version = old_version + 1;
2740         ok = convert_string_talloc(tmp_ctx,
2741                                    CH_UNIX, CH_UTF16,
2742                                    pwd, strlen(pwd),
2743                                    (void *)&new_utf16.data,
2744                                    &new_utf16.length);
2745         if (!ok) {
2746                 DEBUG(0, ("Failed to generate new_utf16 password for  domain %s\n",
2747                           domain));
2748                 TALLOC_FREE(tmp_ctx);
2749                 ldb_transaction_cancel(state->ldb);
2750                 return false;
2751         }
2752
2753         if (new_utf16.length < 28) {
2754                 DEBUG(0, ("new_utf16[%zu] version[%u] for domain %s to short.\n",
2755                           new_utf16.length,
2756                           (unsigned)new_version,
2757                           domain));
2758                 TALLOC_FREE(tmp_ctx);
2759                 ldb_transaction_cancel(state->ldb);
2760                 return false;
2761         }
2762         if (new_utf16.length > 498) {
2763                 DEBUG(0, ("new_utf16[%zu] version[%u] for domain %s to long.\n",
2764                           new_utf16.length,
2765                           (unsigned)new_version,
2766                           domain));
2767                 TALLOC_FREE(tmp_ctx);
2768                 ldb_transaction_cancel(state->ldb);
2769                 return false;
2770         }
2771
2772         new_blob.count = MAX(old_blob.current.count, 2);
2773         new_blob.current.array = talloc_zero_array(tmp_ctx,
2774                                         struct AuthenticationInformation,
2775                                         new_blob.count);
2776         if (new_blob.current.array == NULL) {
2777                 DEBUG(0, ("talloc_zero_array(%u) failed\n",
2778                           (unsigned)new_blob.count));
2779                 TALLOC_FREE(tmp_ctx);
2780                 ldb_transaction_cancel(state->ldb);
2781                 return false;
2782         }
2783         new_blob.previous.array = talloc_zero_array(tmp_ctx,
2784                                         struct AuthenticationInformation,
2785                                         new_blob.count);
2786         if (new_blob.current.array == NULL) {
2787                 DEBUG(0, ("talloc_zero_array(%u) failed\n",
2788                           (unsigned)new_blob.count));
2789                 TALLOC_FREE(tmp_ctx);
2790                 ldb_transaction_cancel(state->ldb);
2791                 return false;
2792         }
2793
2794         for (i = 0; i < old_blob.current.count; i++) {
2795                 struct AuthenticationInformation *o =
2796                         &old_blob.current.array[i];
2797                 struct AuthenticationInformation *p =
2798                         &new_blob.previous.array[i];
2799
2800                 *p = *o;
2801                 new_blob.previous.count++;
2802         }
2803         for (; i < new_blob.count; i++) {
2804                 struct AuthenticationInformation *pi =
2805                         &new_blob.previous.array[i];
2806
2807                 if (i == 0) {
2808                         /*
2809                          * new_blob.previous is still empty so
2810                          * we'll do new_blob.previous = new_blob.current
2811                          * below.
2812                          */
2813                         break;
2814                 }
2815
2816                 pi->LastUpdateTime = now;
2817                 pi->AuthType = TRUST_AUTH_TYPE_NONE;
2818                 new_blob.previous.count++;
2819         }
2820
2821         for (i = 0; i < new_blob.count; i++) {
2822                 struct AuthenticationInformation *ci =
2823                         &new_blob.current.array[i];
2824
2825                 ci->LastUpdateTime = now;
2826                 switch (i) {
2827                 case 0:
2828                         ci->AuthType = TRUST_AUTH_TYPE_CLEAR;
2829                         ci->AuthInfo.clear.size = new_utf16.length;
2830                         ci->AuthInfo.clear.password = new_utf16.data;
2831                         break;
2832                 case 1:
2833                         ci->AuthType = TRUST_AUTH_TYPE_VERSION;
2834                         ci->AuthInfo.version.version = new_version;
2835                         break;
2836                 default:
2837                         ci->AuthType = TRUST_AUTH_TYPE_NONE;
2838                         break;
2839                 }
2840
2841                 new_blob.current.count++;
2842         }
2843
2844         if (new_blob.previous.count == 0) {
2845                 TALLOC_FREE(new_blob.previous.array);
2846                 new_blob.previous = new_blob.current;
2847         }
2848
2849         ndr_err = ndr_push_struct_blob(&new_val, tmp_ctx, &new_blob,
2850                         (ndr_push_flags_fn_t)ndr_push_trustAuthInOutBlob);
2851         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2852                 DEBUG(0, ("Failed to generate trustAuthOutgoing for "
2853                           "trusted domain password for %s: %s.\n",
2854                           domain, ndr_map_error2string(ndr_err)));
2855                 TALLOC_FREE(tmp_ctx);
2856                 ldb_transaction_cancel(state->ldb);
2857                 return false;
2858         }
2859
2860         msg->num_elements = 0;
2861         ret = ldb_msg_add_empty(msg, "trustAuthOutgoing",
2862                                 LDB_FLAG_MOD_REPLACE, NULL);
2863         if (ret != LDB_SUCCESS) {
2864                 DEBUG(0, ("ldb_msg_add_empty() failed\n"));
2865                 TALLOC_FREE(tmp_ctx);
2866                 ldb_transaction_cancel(state->ldb);
2867                 return false;
2868         }
2869         ret = ldb_msg_add_value(msg, "trustAuthOutgoing",
2870                                 &new_val, NULL);
2871         if (ret != LDB_SUCCESS) {
2872                 DEBUG(0, ("ldb_msg_add_value() failed\n"));
2873                 TALLOC_FREE(tmp_ctx);
2874                 ldb_transaction_cancel(state->ldb);
2875                 return false;
2876         }
2877
2878         ret = ldb_modify(state->ldb, msg);
2879         if (ret != LDB_SUCCESS) {
2880                 DEBUG(0, ("Failed to replace trustAuthOutgoing for "
2881                           "trusted domain password for %s: %s - %s\n",
2882                           domain, ldb_strerror(ret), ldb_errstring(state->ldb)));
2883                 TALLOC_FREE(tmp_ctx);
2884                 ldb_transaction_cancel(state->ldb);
2885                 return false;
2886         }
2887
2888         ret = ldb_transaction_commit(state->ldb);
2889         if (ret != LDB_SUCCESS) {
2890                 DEBUG(0, ("Failed to commit trustAuthOutgoing for "
2891                           "trusted domain password for %s: %s - %s\n",
2892                           domain, ldb_strerror(ret), ldb_errstring(state->ldb)));
2893                 TALLOC_FREE(tmp_ctx);
2894                 return false;
2895         }
2896
2897         DEBUG(1, ("Added new_version[%u] to trustAuthOutgoing for "
2898                   "trusted domain password for %s.\n",
2899                   (unsigned)new_version, domain));
2900         TALLOC_FREE(tmp_ctx);
2901         return true;
2902 }
2903
2904 static bool pdb_samba_dsdb_del_trusteddom_pw(struct pdb_methods *m,
2905                                       const char *domain)
2906 {
2907         return false;
2908 }
2909
2910 static NTSTATUS pdb_samba_dsdb_enum_trusteddoms(struct pdb_methods *m,
2911                                          TALLOC_CTX *mem_ctx,
2912                                          uint32_t *_num_domains,
2913                                          struct trustdom_info ***_domains)
2914 {
2915         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
2916                 m->private_data, struct pdb_samba_dsdb_state);
2917         TALLOC_CTX *tmp_ctx = talloc_stackframe();
2918         const char * const attrs[] = {
2919                 "securityIdentifier",
2920                 "flatName",
2921                 "trustDirection",
2922                 NULL
2923         };
2924         struct ldb_result *res = NULL;
2925         unsigned int i;
2926         struct trustdom_info **domains = NULL;
2927         NTSTATUS status;
2928         uint32_t di = 0;
2929
2930         *_num_domains = 0;
2931         *_domains = NULL;
2932
2933         status = dsdb_trust_search_tdos(state->ldb, NULL,
2934                                         attrs, tmp_ctx, &res);
2935         if (!NT_STATUS_IS_OK(status)) {
2936                 DBG_ERR("dsdb_trust_search_tdos() - %s ", nt_errstr(status));
2937                 TALLOC_FREE(tmp_ctx);
2938                 return status;
2939         }
2940
2941         if (res->count == 0) {
2942                 TALLOC_FREE(tmp_ctx);
2943                 return NT_STATUS_OK;
2944         }
2945
2946         domains = talloc_zero_array(tmp_ctx, struct trustdom_info *,
2947                                     res->count);
2948         if (domains == NULL) {
2949                 TALLOC_FREE(tmp_ctx);
2950                 return NT_STATUS_NO_MEMORY;
2951         }
2952
2953         for (i = 0; i < res->count; i++) {
2954                 struct ldb_message *msg = res->msgs[i];
2955                 struct trustdom_info *d = NULL;
2956                 const char *name = NULL;
2957                 struct dom_sid *sid = NULL;
2958                 uint32_t direction;
2959
2960                 d = talloc_zero(domains, struct trustdom_info);
2961                 if (d == NULL) {
2962                         TALLOC_FREE(tmp_ctx);
2963                         return NT_STATUS_NO_MEMORY;
2964                 }
2965
2966                 name = ldb_msg_find_attr_as_string(msg, "flatName", NULL);
2967                 if (name == NULL) {
2968                         TALLOC_FREE(tmp_ctx);
2969                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
2970                 }
2971                 sid = samdb_result_dom_sid(msg, msg, "securityIdentifier");
2972                 if (sid == NULL) {
2973                         continue;
2974                 }
2975
2976                 direction = ldb_msg_find_attr_as_uint(msg, "trustDirection", 0);
2977                 if (!(direction & LSA_TRUST_DIRECTION_OUTBOUND)) {
2978                         continue;
2979                 }
2980
2981                 d->name = talloc_strdup(d, name);
2982                 if (d->name == NULL) {
2983                         TALLOC_FREE(tmp_ctx);
2984                         return NT_STATUS_NO_MEMORY;
2985                 }
2986                 d->sid = *sid;
2987
2988                 domains[di++] = d;
2989         }
2990
2991         domains = talloc_realloc(domains, domains, struct trustdom_info *, di);
2992         *_domains = talloc_move(mem_ctx, &domains);
2993         *_num_domains = di;
2994         TALLOC_FREE(tmp_ctx);
2995         return NT_STATUS_OK;
2996 }
2997
2998 static NTSTATUS pdb_samba_dsdb_msg_to_trusted_domain(const struct ldb_message *msg,
2999                                                 TALLOC_CTX *mem_ctx,
3000                                                 struct pdb_trusted_domain **_d)
3001 {
3002         struct pdb_trusted_domain *d = NULL;
3003         const char *str = NULL;
3004         struct dom_sid *sid = NULL;
3005         const struct ldb_val *val = NULL;
3006         uint64_t val64;
3007
3008         *_d = NULL;
3009
3010         d = talloc_zero(mem_ctx, struct pdb_trusted_domain);
3011         if (d == NULL) {
3012                 return NT_STATUS_NO_MEMORY;
3013         }
3014
3015         str = ldb_msg_find_attr_as_string(msg, "flatName", NULL);
3016         if (str == NULL) {
3017                 TALLOC_FREE(d);
3018                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3019         }
3020         d->netbios_name = talloc_strdup(d, str);
3021         if (d->netbios_name == NULL) {
3022                 TALLOC_FREE(d);
3023                 return NT_STATUS_NO_MEMORY;
3024         }
3025
3026         str = ldb_msg_find_attr_as_string(msg, "trustPartner", NULL);
3027         if (str != NULL) {
3028                 d->domain_name = talloc_strdup(d, str);
3029                 if (d->domain_name == NULL) {
3030                         TALLOC_FREE(d);
3031                         return NT_STATUS_NO_MEMORY;
3032                 }
3033         }
3034
3035         sid = samdb_result_dom_sid(d, msg, "securityIdentifier");
3036         if (sid != NULL) {
3037                 d->security_identifier = *sid;
3038                 TALLOC_FREE(sid);
3039         }
3040
3041         val = ldb_msg_find_ldb_val(msg, "trustAuthOutgoing");
3042         if (val != NULL) {
3043                 d->trust_auth_outgoing = data_blob_dup_talloc(d, *val);
3044                 if (d->trust_auth_outgoing.data == NULL) {
3045                         TALLOC_FREE(d);
3046                         return NT_STATUS_NO_MEMORY;
3047                 }
3048         }
3049         val = ldb_msg_find_ldb_val(msg, "trustAuthIncoming");
3050         if (val != NULL) {
3051                 d->trust_auth_incoming = data_blob_dup_talloc(d, *val);
3052                 if (d->trust_auth_incoming.data == NULL) {
3053                         TALLOC_FREE(d);
3054                         return NT_STATUS_NO_MEMORY;
3055                 }
3056         }
3057
3058         d->trust_direction = ldb_msg_find_attr_as_uint(msg, "trustDirection", 0);
3059         d->trust_type = ldb_msg_find_attr_as_uint(msg, "trustType", 0);
3060         d->trust_attributes = ldb_msg_find_attr_as_uint(msg, "trustAttributes", 0);
3061
3062         val64 = ldb_msg_find_attr_as_uint64(msg, "trustPosixOffset", UINT64_MAX);
3063         if (val64 != UINT64_MAX) {
3064                 d->trust_posix_offset = talloc(d, uint32_t);
3065                 if (d->trust_posix_offset == NULL) {
3066                         TALLOC_FREE(d);
3067                         return NT_STATUS_NO_MEMORY;
3068                 }
3069                 *d->trust_posix_offset = (uint32_t)val64;
3070         }
3071
3072         val64 = ldb_msg_find_attr_as_uint64(msg, "msDS-SupportedEncryptionTypes", UINT64_MAX);
3073         if (val64 != UINT64_MAX) {
3074                 d->supported_enc_type = talloc(d, uint32_t);
3075                 if (d->supported_enc_type == NULL) {
3076                         TALLOC_FREE(d);
3077                         return NT_STATUS_NO_MEMORY;
3078                 }
3079                 *d->supported_enc_type = (uint32_t)val64;
3080         }
3081
3082         val = ldb_msg_find_ldb_val(msg, "msDS-TrustForestTrustInfo");
3083         if (val != NULL) {
3084                 d->trust_forest_trust_info = data_blob_dup_talloc(d, *val);
3085                 if (d->trust_forest_trust_info.data == NULL) {
3086                         TALLOC_FREE(d);
3087                         return NT_STATUS_NO_MEMORY;
3088                 }
3089         }
3090
3091         *_d = d;
3092         return NT_STATUS_OK;
3093 }
3094
3095 static NTSTATUS pdb_samba_dsdb_get_trusted_domain(struct pdb_methods *m,
3096                                                   TALLOC_CTX *mem_ctx,
3097                                                   const char *domain,
3098                                                   struct pdb_trusted_domain **td)
3099 {
3100         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
3101                 m->private_data, struct pdb_samba_dsdb_state);
3102         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3103         const char * const attrs[] = {
3104                 "securityIdentifier",
3105                 "flatName",
3106                 "trustPartner",
3107                 "trustAuthOutgoing",
3108                 "trustAuthIncoming",
3109                 "trustAttributes",
3110                 "trustDirection",
3111                 "trustType",
3112                 "trustPosixOffset",
3113                 "msDS-SupportedEncryptionTypes",
3114                 "msDS-TrustForestTrustInfo",
3115                 NULL
3116         };
3117         struct ldb_message *msg = NULL;
3118         struct pdb_trusted_domain *d = NULL;
3119         NTSTATUS status;
3120
3121         status = dsdb_trust_search_tdo(state->ldb, domain, NULL,
3122                                        attrs, tmp_ctx, &msg);
3123         if (!NT_STATUS_IS_OK(status)) {
3124                 DBG_ERR("dsdb_trust_search_tdo(%s) - %s ",
3125                         domain, nt_errstr(status));
3126                 TALLOC_FREE(tmp_ctx);
3127                 return status;
3128         }
3129
3130         status = pdb_samba_dsdb_msg_to_trusted_domain(msg, mem_ctx, &d);
3131         if (!NT_STATUS_IS_OK(status)) {
3132                 DBG_ERR("pdb_samba_dsdb_msg_to_trusted_domain(%s) - %s ",
3133                         domain, nt_errstr(status));
3134                 TALLOC_FREE(tmp_ctx);
3135                 return status;
3136         }
3137
3138         *td = d;
3139         TALLOC_FREE(tmp_ctx);
3140         return NT_STATUS_OK;
3141 }
3142
3143 static NTSTATUS pdb_samba_dsdb_get_trusted_domain_by_sid(struct pdb_methods *m,
3144                                                          TALLOC_CTX *mem_ctx,
3145                                                          struct dom_sid *sid,
3146                                                          struct pdb_trusted_domain **td)
3147 {
3148         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
3149                 m->private_data, struct pdb_samba_dsdb_state);
3150         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3151         const char * const attrs[] = {
3152                 "securityIdentifier",
3153                 "flatName",
3154                 "trustPartner",
3155                 "trustAuthOutgoing",
3156                 "trustAuthIncoming",
3157                 "trustAttributes",
3158                 "trustDirection",
3159                 "trustType",
3160                 "trustPosixOffset",
3161                 "msDS-SupportedEncryptionTypes",
3162                 "msDS-TrustForestTrustInfo",
3163                 NULL
3164         };
3165         struct ldb_message *msg = NULL;
3166         struct pdb_trusted_domain *d = NULL;
3167         struct dom_sid_buf buf;
3168         NTSTATUS status;
3169
3170         status = dsdb_trust_search_tdo_by_sid(state->ldb, sid,
3171                                               attrs, tmp_ctx, &msg);
3172         if (!NT_STATUS_IS_OK(status)) {
3173                 DBG_ERR("dsdb_trust_search_tdo_by_sid(%s) - %s ",
3174                         dom_sid_str_buf(sid, &buf),
3175                         nt_errstr(status));
3176                 TALLOC_FREE(tmp_ctx);
3177                 return status;
3178         }
3179
3180         status = pdb_samba_dsdb_msg_to_trusted_domain(msg, mem_ctx, &d);
3181         if (!NT_STATUS_IS_OK(status)) {
3182                 DBG_ERR("pdb_samba_dsdb_msg_to_trusted_domain(%s) - %s ",
3183                         dom_sid_str_buf(sid, &buf),
3184                         nt_errstr(status));
3185                 TALLOC_FREE(tmp_ctx);
3186                 return status;
3187         }
3188
3189         *td = d;
3190         TALLOC_FREE(tmp_ctx);
3191         return NT_STATUS_OK;
3192 }
3193
3194 static NTSTATUS add_trust_user(TALLOC_CTX *mem_ctx,
3195                                struct ldb_context *sam_ldb,
3196                                struct ldb_dn *base_dn,
3197                                const char *netbios_name,
3198                                struct trustAuthInOutBlob *taiob)
3199 {
3200         struct ldb_request *req = NULL;
3201         struct ldb_message *msg = NULL;
3202         struct ldb_dn *dn = NULL;
3203         uint32_t i;
3204         int ret;
3205         bool ok;
3206
3207         dn = ldb_dn_copy(mem_ctx, base_dn);
3208         if (dn == NULL) {
3209                 return NT_STATUS_NO_MEMORY;
3210         }
3211         ok = ldb_dn_add_child_fmt(dn, "cn=%s$,cn=users", netbios_name);
3212         if (!ok) {
3213                 return NT_STATUS_NO_MEMORY;
3214         }
3215
3216         msg = ldb_msg_new(mem_ctx);
3217         if (msg == NULL) {
3218                 return NT_STATUS_NO_MEMORY;
3219         }
3220         msg->dn = dn;
3221
3222         ret = ldb_msg_add_string(msg, "objectClass", "user");
3223         if (ret != LDB_SUCCESS) {
3224                 return NT_STATUS_NO_MEMORY;
3225         }
3226
3227         ret = ldb_msg_add_fmt(msg, "samAccountName", "%s$", netbios_name);
3228         if (ret != LDB_SUCCESS) {
3229                 return NT_STATUS_NO_MEMORY;
3230         }
3231
3232         ret = samdb_msg_add_uint(sam_ldb, msg, msg, "userAccountControl",
3233                                  UF_INTERDOMAIN_TRUST_ACCOUNT);
3234         if (ret != LDB_SUCCESS) {
3235                 return NT_STATUS_NO_MEMORY;
3236         }
3237
3238         for (i = 0; i < taiob->count; i++) {
3239                 struct AuthenticationInformation *auth_info =
3240                         &taiob->current.array[i];
3241                 const char *attribute = NULL;
3242                 struct ldb_val v;
3243
3244                 switch (taiob->current.array[i].AuthType) {
3245                 case TRUST_AUTH_TYPE_NT4OWF:
3246                         attribute = "unicodePwd";
3247                         v.data = (uint8_t *)&auth_info->AuthInfo.nt4owf.password;
3248                         v.length = 16;
3249                         break;
3250
3251                 case TRUST_AUTH_TYPE_CLEAR:
3252                         attribute = "clearTextPassword";
3253                         v.data = auth_info->AuthInfo.clear.password;
3254                         v.length = auth_info->AuthInfo.clear.size;
3255                         break;
3256
3257                 default:
3258                         continue;
3259                 }
3260
3261                 ret = ldb_msg_add_value(msg, attribute, &v, NULL);
3262                 if (ret != LDB_SUCCESS) {
3263                         return NT_STATUS_NO_MEMORY;
3264                 }
3265         }
3266
3267         /* create the trusted_domain user account */
3268         ret = ldb_build_add_req(&req, sam_ldb, mem_ctx, msg, NULL, NULL,
3269                                 ldb_op_default_callback, NULL);
3270         if (ret != LDB_SUCCESS) {
3271                 return NT_STATUS_NO_MEMORY;
3272         }
3273
3274         ret = ldb_request_add_control(
3275                 req, DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID,
3276                 false, NULL);
3277         if (ret != LDB_SUCCESS) {
3278                 return NT_STATUS_NO_MEMORY;
3279         }
3280
3281         ret = dsdb_autotransaction_request(sam_ldb, req);
3282         if (ret != LDB_SUCCESS) {
3283                 DEBUG(0,("Failed to create user record %s: %s\n",
3284                          ldb_dn_get_linearized(msg->dn),
3285                          ldb_errstring(sam_ldb)));
3286
3287                 switch (ret) {
3288                 case LDB_ERR_ENTRY_ALREADY_EXISTS:
3289                         return NT_STATUS_DOMAIN_EXISTS;
3290                 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
3291                         return NT_STATUS_ACCESS_DENIED;
3292                 default:
3293                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
3294                 }
3295         }
3296
3297         return NT_STATUS_OK;
3298 }
3299
3300 static NTSTATUS pdb_samba_dsdb_set_trusted_domain(struct pdb_methods *methods,
3301                                                   const char* domain,
3302                                                   const struct pdb_trusted_domain *td)
3303 {
3304         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
3305                 methods->private_data, struct pdb_samba_dsdb_state);
3306         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3307         bool in_txn = false;
3308         struct ldb_dn *base_dn = NULL;
3309         struct ldb_message *msg = NULL;
3310         const char *attrs[] = {
3311                 NULL
3312         };
3313         char *netbios_encoded = NULL;
3314         char *dns_encoded = NULL;
3315         char *sid_encoded = NULL;
3316         int ret;
3317         struct trustAuthInOutBlob taiob;
3318         enum ndr_err_code ndr_err;
3319         NTSTATUS status;
3320         bool ok;
3321
3322         base_dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(state->ldb));
3323         if (base_dn == NULL) {
3324                 TALLOC_FREE(tmp_ctx);
3325                 status = NT_STATUS_NO_MEMORY;
3326                 goto out;
3327         }
3328         /*
3329          * We expect S-1-5-21-A-B-C, but we don't
3330          * allow S-1-5-21-0-0-0 as this is used
3331          * for claims and compound identities.
3332          */
3333         ok = dom_sid_is_valid_account_domain(&td->security_identifier);
3334         if (!ok) {
3335                 status = NT_STATUS_INVALID_PARAMETER;
3336                 goto out;
3337         }
3338
3339         if (strequal(td->netbios_name, "BUILTIN")) {
3340                 status = NT_STATUS_INVALID_PARAMETER;
3341                 goto out;
3342         }
3343         if (strequal(td->domain_name, "BUILTIN")) {
3344                 status = NT_STATUS_INVALID_PARAMETER;
3345                 goto out;
3346         }
3347
3348         dns_encoded = ldb_binary_encode_string(tmp_ctx, td->domain_name);
3349         if (dns_encoded == NULL) {
3350                 status = NT_STATUS_NO_MEMORY;
3351                 goto out;
3352         }
3353         netbios_encoded = ldb_binary_encode_string(tmp_ctx, td->netbios_name);
3354         if (netbios_encoded == NULL) {
3355                 status =NT_STATUS_NO_MEMORY;
3356                 goto out;
3357         }
3358         sid_encoded = ldap_encode_ndr_dom_sid(tmp_ctx, &td->security_identifier);
3359         if (sid_encoded == NULL) {
3360                 status = NT_STATUS_NO_MEMORY;
3361                 goto out;
3362         }
3363
3364         ok = samdb_is_pdc(state->ldb);
3365         if (!ok) {
3366                 DBG_ERR("Adding TDO is only allowed on a PDC.\n");
3367                 TALLOC_FREE(tmp_ctx);
3368                 status = NT_STATUS_INVALID_DOMAIN_ROLE;
3369                 goto out;
3370         }
3371
3372         status = dsdb_trust_search_tdo(state->ldb,
3373                                        td->netbios_name,
3374                                        td->domain_name,
3375                                        attrs,
3376                                        tmp_ctx,
3377                                        &msg);
3378         if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
3379                 DBG_ERR("dsdb_trust_search_tdo returned %s\n",
3380                         nt_errstr(status));
3381                 status = NT_STATUS_INVALID_DOMAIN_STATE;
3382                 goto out;
3383         }
3384
3385         ret = ldb_transaction_start(state->ldb);
3386         if (ret != LDB_SUCCESS) {
3387                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
3388                 goto out;
3389         }
3390         in_txn = true;
3391
3392         msg = ldb_msg_new(tmp_ctx);
3393         if (msg == NULL) {
3394                 status = NT_STATUS_NO_MEMORY;
3395                 goto out;
3396         }
3397
3398         msg->dn = ldb_dn_copy(tmp_ctx, base_dn);
3399
3400         ok = ldb_dn_add_child_fmt(msg->dn, "cn=%s,cn=System", td->domain_name);
3401         if (!ok) {
3402                 status = NT_STATUS_NO_MEMORY;
3403                 goto out;
3404         }
3405
3406         ret = ldb_msg_add_string(msg, "objectClass", "trustedDomain");
3407         if (ret != LDB_SUCCESS) {
3408                 status = NT_STATUS_NO_MEMORY;
3409                 goto out;
3410         }
3411
3412         ret = ldb_msg_add_string(msg, "flatname", td->netbios_name);
3413         if (ret != LDB_SUCCESS) {
3414                 status = NT_STATUS_NO_MEMORY;
3415                 goto out;
3416         }
3417
3418         ret = ldb_msg_add_string(msg, "trustPartner", td->domain_name);
3419         if (ret != LDB_SUCCESS) {
3420                 status = NT_STATUS_NO_MEMORY;
3421                 goto out;
3422         }
3423
3424         ret = samdb_msg_add_dom_sid(state->ldb,
3425                                     tmp_ctx,
3426                                     msg,
3427                                     "securityIdentifier",
3428                                     &td->security_identifier);
3429         if (ret != LDB_SUCCESS) {
3430                 status = NT_STATUS_NO_MEMORY;
3431                 goto out;
3432         }
3433
3434         ret = samdb_msg_add_int(state->ldb,
3435                                 tmp_ctx,
3436                                 msg,
3437                                 "trustType",
3438                                 td->trust_type);
3439         if (ret != LDB_SUCCESS) {
3440                 status = NT_STATUS_NO_MEMORY;
3441                 goto out;
3442         }
3443
3444         ret = samdb_msg_add_int(state->ldb,
3445                                 tmp_ctx,
3446                                 msg,
3447                                 "trustAttributes",
3448                                 td->trust_attributes);
3449         if (ret != LDB_SUCCESS) {
3450                 status =NT_STATUS_NO_MEMORY;
3451                 goto out;
3452         }
3453
3454         ret = samdb_msg_add_int(state->ldb,
3455                                 tmp_ctx,
3456                                 msg,
3457                                 "trustDirection",
3458                                 td->trust_direction);
3459         if (ret != LDB_SUCCESS) {
3460                 status = NT_STATUS_NO_MEMORY;
3461                 goto out;
3462         }
3463
3464         if (td->trust_auth_incoming.data != NULL) {
3465                 ret = ldb_msg_add_value(msg,
3466                                         "trustAuthIncoming",
3467                                         &td->trust_auth_incoming,
3468                                         NULL);
3469                 if (ret != LDB_SUCCESS) {
3470                         status = NT_STATUS_NO_MEMORY;
3471                         goto out;
3472                 }
3473         }
3474         if (td->trust_auth_outgoing.data != NULL) {
3475                 ret = ldb_msg_add_value(msg,
3476                                         "trustAuthOutgoing",
3477                                         &td->trust_auth_outgoing,
3478                                         NULL);
3479                 if (ret != LDB_SUCCESS) {
3480                         status = NT_STATUS_NO_MEMORY;
3481                         goto out;
3482                 }
3483         }
3484
3485         /* create the trusted_domain */
3486         ret = ldb_add(state->ldb, msg);
3487         switch (ret) {
3488         case  LDB_SUCCESS:
3489                 break;
3490
3491         case  LDB_ERR_ENTRY_ALREADY_EXISTS:
3492                 DBG_ERR("Failed to create trusted domain record %s: %s\n",
3493                         ldb_dn_get_linearized(msg->dn),
3494                         ldb_errstring(state->ldb));
3495                 status = NT_STATUS_DOMAIN_EXISTS;
3496                 goto out;
3497
3498         case  LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
3499                 DBG_ERR("Failed to create trusted domain record %s: %s\n",
3500                         ldb_dn_get_linearized(msg->dn),
3501                         ldb_errstring(state->ldb));
3502                 status = NT_STATUS_ACCESS_DENIED;
3503                 goto out;
3504
3505         default:
3506                 DBG_ERR("Failed to create trusted domain record %s: %s\n",
3507                         ldb_dn_get_linearized(msg->dn),
3508                         ldb_errstring(state->ldb));
3509                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
3510                 goto out;
3511         }
3512
3513         ndr_err = ndr_pull_struct_blob(
3514                 &td->trust_auth_outgoing,
3515                 tmp_ctx,
3516                 &taiob,
3517                 (ndr_pull_flags_fn_t)ndr_pull_trustAuthInOutBlob);
3518         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
3519                 status = ndr_map_error2ntstatus(ndr_err);
3520                 goto out;
3521         }
3522
3523         if (td->trust_direction == LSA_TRUST_DIRECTION_INBOUND) {
3524                 status = add_trust_user(tmp_ctx,
3525                                         state->ldb,
3526                                         base_dn,
3527                                         td->netbios_name,
3528                                         &taiob);
3529                 if (!NT_STATUS_IS_OK(status)) {
3530                         goto out;
3531                 }
3532         }
3533
3534         ret = ldb_transaction_commit(state->ldb);
3535         if (ret != LDB_SUCCESS) {
3536                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3537         }
3538         in_txn = false;
3539
3540         /*
3541          * TODO: Notify winbindd that we have a new trust
3542          */
3543
3544         status = NT_STATUS_OK;
3545
3546 out:
3547         if (in_txn) {
3548                 ldb_transaction_cancel(state->ldb);
3549         }
3550         TALLOC_FREE(tmp_ctx);
3551         return status;
3552 }
3553
3554 static NTSTATUS delete_trust_user(TALLOC_CTX *mem_ctx,
3555                                   struct pdb_samba_dsdb_state *state,
3556                                   const char *trust_user)
3557 {
3558         const char *attrs[] = { "userAccountControl", NULL };
3559         struct ldb_message **msgs;
3560         uint32_t uac;
3561         int ret;
3562
3563         ret = gendb_search(state->ldb,
3564                            mem_ctx,
3565                            ldb_get_default_basedn(state->ldb),
3566                            &msgs,
3567                            attrs,
3568                            "samAccountName=%s$",
3569                            trust_user);
3570         if (ret > 1) {
3571                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3572         }
3573
3574         if (ret == 0) {
3575                 return NT_STATUS_OK;
3576         }
3577
3578         uac = ldb_msg_find_attr_as_uint(msgs[0],
3579                                         "userAccountControl",
3580                                         0);
3581         if (!(uac & UF_INTERDOMAIN_TRUST_ACCOUNT)) {
3582                 return NT_STATUS_OBJECT_NAME_COLLISION;
3583         }
3584
3585         ret = ldb_delete(state->ldb, msgs[0]->dn);
3586         switch (ret) {
3587         case LDB_SUCCESS:
3588                 break;
3589         case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS:
3590                 return NT_STATUS_ACCESS_DENIED;
3591         default:
3592                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
3593         }
3594
3595         return NT_STATUS_OK;
3596 }
3597
3598 static NTSTATUS pdb_samba_dsdb_del_trusted_domain(struct pdb_methods *methods,
3599                                                   const char *domain)
3600 {
3601         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
3602                 methods->private_data, struct pdb_samba_dsdb_state);
3603         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3604         struct pdb_trusted_domain *td = NULL;
3605         struct ldb_dn *tdo_dn = NULL;
3606         bool in_txn = false;
3607         NTSTATUS status;
3608         int ret;
3609         bool ok;
3610
3611         status = pdb_samba_dsdb_get_trusted_domain(methods,
3612                                                    tmp_ctx,
3613                                                    domain,
3614                                                    &td);
3615         if (!NT_STATUS_IS_OK(status)) {
3616                 if (!NT_STATUS_EQUAL(status, NT_STATUS_OBJECT_NAME_NOT_FOUND)) {
3617                         DBG_ERR("Searching TDO for %s returned %s\n",
3618                                 domain, nt_errstr(status));
3619                         return status;
3620                 }
3621                 DBG_NOTICE("No TDO object for %s\n", domain);
3622                 return NT_STATUS_OK;
3623         }
3624
3625         tdo_dn = ldb_dn_copy(tmp_ctx, ldb_get_default_basedn(state->ldb));
3626         if (tdo_dn == NULL) {
3627                 status = NT_STATUS_NO_MEMORY;
3628                 goto out;
3629         }
3630
3631         ok = ldb_dn_add_child_fmt(tdo_dn, "cn=%s,cn=System", domain);
3632         if (!ok) {
3633                 TALLOC_FREE(tmp_ctx);
3634                 status = NT_STATUS_NO_MEMORY;
3635                 goto out;
3636         }
3637
3638         ret = ldb_transaction_start(state->ldb);
3639         if (ret != LDB_SUCCESS) {
3640                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
3641                 goto out;
3642         }
3643         in_txn = true;
3644
3645         ret = ldb_delete(state->ldb, tdo_dn);
3646         if (ret != LDB_SUCCESS) {
3647                 status = NT_STATUS_INVALID_HANDLE;
3648                 goto out;
3649         }
3650
3651         if (td->trust_direction == LSA_TRUST_DIRECTION_INBOUND) {
3652                 status = delete_trust_user(tmp_ctx, state, domain);
3653                 if (!NT_STATUS_IS_OK(status)) {
3654                         goto out;
3655                 }
3656         }
3657
3658         ret = ldb_transaction_commit(state->ldb);
3659         if (ret != LDB_SUCCESS) {
3660                 status = NT_STATUS_INTERNAL_DB_CORRUPTION;
3661                 goto out;
3662         }
3663         in_txn = false;
3664
3665         status = NT_STATUS_OK;
3666
3667 out:
3668         if (in_txn) {
3669                 ldb_transaction_cancel(state->ldb);
3670         }
3671         TALLOC_FREE(tmp_ctx);
3672
3673         return status;
3674 }
3675
3676 static NTSTATUS pdb_samba_dsdb_enum_trusted_domains(struct pdb_methods *m,
3677                                                     TALLOC_CTX *mem_ctx,
3678                                                     uint32_t *_num_domains,
3679                                                     struct pdb_trusted_domain ***_domains)
3680 {
3681         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
3682                 m->private_data, struct pdb_samba_dsdb_state);
3683         TALLOC_CTX *tmp_ctx = talloc_stackframe();
3684         const char * const attrs[] = {
3685                 "securityIdentifier",
3686                 "flatName",
3687                 "trustPartner",
3688                 "trustAuthOutgoing",
3689                 "trustAuthIncoming",
3690                 "trustAttributes",
3691                 "trustDirection",
3692                 "trustType",
3693                 "trustPosixOffset",
3694                 "msDS-SupportedEncryptionTypes",
3695                 "msDS-TrustForestTrustInfo",
3696                 NULL
3697         };
3698         struct ldb_result *res = NULL;
3699         unsigned int i;
3700         struct pdb_trusted_domain **domains = NULL;
3701         NTSTATUS status;
3702         uint32_t di = 0;
3703
3704         *_num_domains = 0;
3705         *_domains = NULL;
3706
3707         status = dsdb_trust_search_tdos(state->ldb, NULL,
3708                                         attrs, tmp_ctx, &res);
3709         if (!NT_STATUS_IS_OK(status)) {
3710                 DBG_ERR("dsdb_trust_search_tdos() - %s ", nt_errstr(status));
3711                 TALLOC_FREE(tmp_ctx);
3712                 return status;
3713         }
3714
3715         if (res->count == 0) {
3716                 TALLOC_FREE(tmp_ctx);
3717                 return NT_STATUS_OK;
3718         }
3719
3720         domains = talloc_zero_array(tmp_ctx, struct pdb_trusted_domain *,
3721                                     res->count);
3722         if (domains == NULL) {
3723                 TALLOC_FREE(tmp_ctx);
3724                 return NT_STATUS_NO_MEMORY;
3725         }
3726
3727         for (i = 0; i < res->count; i++) {
3728                 struct ldb_message *msg = res->msgs[i];
3729                 struct pdb_trusted_domain *d = NULL;
3730
3731                 status = pdb_samba_dsdb_msg_to_trusted_domain(msg, domains, &d);
3732                 if (!NT_STATUS_IS_OK(status)) {
3733                         DBG_ERR("pdb_samba_dsdb_msg_to_trusted_domain() - %s ",
3734                                 nt_errstr(status));
3735                         TALLOC_FREE(tmp_ctx);
3736                         return status;
3737                 }
3738
3739                 domains[di++] = d;
3740         }
3741
3742         domains = talloc_realloc(domains, domains, struct pdb_trusted_domain *,
3743                                  di);
3744         *_domains = talloc_move(mem_ctx, &domains);
3745         *_num_domains = di;
3746         TALLOC_FREE(tmp_ctx);
3747         return NT_STATUS_OK;
3748 }
3749
3750 static bool pdb_samba_dsdb_is_responsible_for_wellknown(struct pdb_methods *m)
3751 {
3752         return true;
3753 }
3754
3755 static bool pdb_samba_dsdb_is_responsible_for_everything_else(struct pdb_methods *m)
3756 {
3757         return true;
3758 }
3759
3760 static void pdb_samba_dsdb_init_methods(struct pdb_methods *m)
3761 {
3762         m->name = "samba_dsdb";
3763         m->get_domain_info = pdb_samba_dsdb_get_domain_info;
3764         m->getsampwnam = pdb_samba_dsdb_getsampwnam;
3765         m->getsampwsid = pdb_samba_dsdb_getsampwsid;
3766         m->create_user = pdb_samba_dsdb_create_user;
3767         m->delete_user = pdb_samba_dsdb_delete_user;
3768         m->add_sam_account = pdb_samba_dsdb_add_sam_account;
3769         m->update_sam_account = pdb_samba_dsdb_update_sam_account;
3770         m->delete_sam_account = pdb_samba_dsdb_delete_sam_account;
3771         m->rename_sam_account = pdb_samba_dsdb_rename_sam_account;
3772         m->update_login_attempts = pdb_samba_dsdb_update_login_attempts;
3773         m->getgrsid = pdb_samba_dsdb_getgrsid;
3774         m->getgrgid = pdb_samba_dsdb_getgrgid;
3775         m->getgrnam = pdb_samba_dsdb_getgrnam;
3776         m->create_dom_group = pdb_samba_dsdb_create_dom_group;
3777         m->delete_dom_group = pdb_samba_dsdb_delete_dom_group;
3778         m->add_group_mapping_entry = pdb_samba_dsdb_add_group_mapping_entry;
3779         m->update_group_mapping_entry = pdb_samba_dsdb_update_group_mapping_entry;
3780         m->delete_group_mapping_entry = pdb_samba_dsdb_delete_group_mapping_entry;
3781         m->enum_group_mapping = pdb_samba_dsdb_enum_group_mapping;
3782         m->enum_group_members = pdb_samba_dsdb_enum_group_members;
3783         m->enum_group_memberships = pdb_samba_dsdb_enum_group_memberships;
3784         m->set_unix_primary_group = pdb_samba_dsdb_set_unix_primary_group;
3785         m->add_groupmem = pdb_samba_dsdb_add_groupmem;
3786         m->del_groupmem = pdb_samba_dsdb_del_groupmem;
3787         m->create_alias = pdb_samba_dsdb_create_alias;
3788         m->delete_alias = pdb_samba_dsdb_delete_alias;
3789         m->get_aliasinfo = pdb_default_get_aliasinfo;
3790         m->add_aliasmem = pdb_samba_dsdb_add_aliasmem;
3791         m->del_aliasmem = pdb_samba_dsdb_del_aliasmem;
3792         m->enum_aliasmem = pdb_samba_dsdb_enum_aliasmem;
3793         m->enum_alias_memberships = pdb_samba_dsdb_enum_alias_memberships;
3794         m->lookup_rids = pdb_samba_dsdb_lookup_rids;
3795         m->lookup_names = pdb_samba_dsdb_lookup_names;
3796         m->get_account_policy = pdb_samba_dsdb_get_account_policy;
3797         m->set_account_policy = pdb_samba_dsdb_set_account_policy;
3798         m->get_seq_num = pdb_samba_dsdb_get_seq_num;
3799         m->search_users = pdb_samba_dsdb_search_users;
3800         m->search_groups = pdb_samba_dsdb_search_groups;
3801         m->search_aliases = pdb_samba_dsdb_search_aliases;
3802         m->id_to_sid = pdb_samba_dsdb_id_to_sid;
3803         m->sid_to_id = pdb_samba_dsdb_sid_to_id;
3804         m->capabilities = pdb_samba_dsdb_capabilities;
3805         m->new_rid = pdb_samba_dsdb_new_rid;
3806         m->get_trusteddom_pw = pdb_samba_dsdb_get_trusteddom_pw;
3807         m->get_trusteddom_creds = pdb_samba_dsdb_get_trusteddom_creds;
3808         m->set_trusteddom_pw = pdb_samba_dsdb_set_trusteddom_pw;
3809         m->del_trusteddom_pw = pdb_samba_dsdb_del_trusteddom_pw;
3810         m->enum_trusteddoms = pdb_samba_dsdb_enum_trusteddoms;
3811         m->get_trusted_domain = pdb_samba_dsdb_get_trusted_domain;
3812         m->get_trusted_domain_by_sid = pdb_samba_dsdb_get_trusted_domain_by_sid;
3813         m->set_trusted_domain = pdb_samba_dsdb_set_trusted_domain;
3814         m->del_trusted_domain = pdb_samba_dsdb_del_trusted_domain;
3815         m->enum_trusted_domains = pdb_samba_dsdb_enum_trusted_domains;
3816         m->is_responsible_for_wellknown =
3817                                 pdb_samba_dsdb_is_responsible_for_wellknown;
3818         m->is_responsible_for_everything_else =
3819                                 pdb_samba_dsdb_is_responsible_for_everything_else;
3820 }
3821
3822 static void free_private_data(void **vp)
3823 {
3824         struct pdb_samba_dsdb_state *state = talloc_get_type_abort(
3825                 *vp, struct pdb_samba_dsdb_state);
3826         talloc_unlink(state, state->ldb);
3827         return;
3828 }
3829
3830 static NTSTATUS pdb_samba_dsdb_init_secrets(struct pdb_methods *m)
3831 {
3832         struct pdb_domain_info *dom_info;
3833         struct dom_sid stored_sid;
3834         struct GUID stored_guid;
3835         bool sid_exists_and_matches = false;
3836         bool guid_exists_and_matches = false;
3837         bool ret;
3838
3839         dom_info = pdb_samba_dsdb_get_domain_info(m, m);
3840         if (!dom_info) {
3841                 return NT_STATUS_UNSUCCESSFUL;
3842         }
3843
3844         ret = secrets_fetch_domain_sid(dom_info->name, &stored_sid);
3845         if (ret) {
3846                 if (dom_sid_equal(&stored_sid, &dom_info->sid)) {
3847                         sid_exists_and_matches = true;
3848                 }
3849         }
3850
3851         if (sid_exists_and_matches == false) {
3852                 secrets_clear_domain_protection(dom_info->name);
3853                 ret = secrets_store_domain_sid(dom_info->name,
3854                                                &dom_info->sid);
3855                 ret &= secrets_mark_domain_protected(dom_info->name);
3856                 if (!ret) {
3857                         goto done;
3858                 }
3859         }
3860
3861         ret = secrets_fetch_domain_guid(dom_info->name, &stored_guid);
3862         if (ret) {
3863                 if (GUID_equal(&stored_guid, &dom_info->guid)) {
3864                         guid_exists_and_matches = true;
3865                 }
3866         }
3867
3868         if (guid_exists_and_matches == false) {
3869                 secrets_clear_domain_protection(dom_info->name);
3870                 ret = secrets_store_domain_guid(dom_info->name,
3871                                                &dom_info->guid);
3872                 ret &= secrets_mark_domain_protected(dom_info->name);
3873                 if (!ret) {
3874                         goto done;
3875                 }
3876         }
3877
3878 done:
3879         TALLOC_FREE(dom_info);
3880         if (!ret) {
3881                 return NT_STATUS_UNSUCCESSFUL;
3882         }
3883         return NT_STATUS_OK;
3884 }
3885
3886 static NTSTATUS pdb_init_samba_dsdb(struct pdb_methods **pdb_method,
3887                              const char *location)
3888 {
3889         struct pdb_methods *m;
3890         struct pdb_samba_dsdb_state *state;
3891         NTSTATUS status;
3892         char *errstring = NULL;
3893         int ret;
3894
3895         if ( !NT_STATUS_IS_OK(status = make_pdb_method( &m )) ) {
3896                 return status;
3897         }
3898
3899         state = talloc_zero(m, struct pdb_samba_dsdb_state);
3900         if (state == NULL) {
3901                 goto nomem;
3902         }
3903         m->private_data = state;
3904         m->free_private_data = free_private_data;
3905         pdb_samba_dsdb_init_methods(m);
3906
3907         state->ev = s4_event_context_init(state);
3908         if (!state->ev) {
3909                 DEBUG(0, ("s4_event_context_init failed\n"));
3910                 goto nomem;
3911         }
3912
3913         state->lp_ctx = loadparm_init_s3(state, loadparm_s3_helpers());
3914         if (state->lp_ctx == NULL) {
3915                 DEBUG(0, ("loadparm_init_s3 failed\n"));
3916                 goto nomem;
3917         }
3918
3919         if (location == NULL) {
3920                 location = "sam.ldb";
3921         }
3922
3923         ret = samdb_connect_url(state,
3924                                 state->ev,
3925                                 state->lp_ctx,
3926                                 system_session(state->lp_ctx),
3927                                 0,
3928                                 location,
3929                                 NULL,
3930                                 &state->ldb,
3931                                 &errstring);
3932
3933         if (!state->ldb) {
3934                 DEBUG(0, ("samdb_connect failed: %s: %s\n",
3935                           errstring, ldb_strerror(ret)));
3936                 status = NT_STATUS_INTERNAL_ERROR;
3937                 goto fail;
3938         }
3939
3940         state->idmap_ctx = idmap_init(state, state->ev,
3941                                       state->lp_ctx);
3942         if (!state->idmap_ctx) {
3943                 DEBUG(0, ("idmap failed\n"));
3944                 status = NT_STATUS_INTERNAL_ERROR;
3945                 goto fail;
3946         }
3947
3948         status = pdb_samba_dsdb_init_secrets(m);
3949         if (!NT_STATUS_IS_OK(status)) {
3950                 DEBUG(10, ("pdb_samba_dsdb_init_secrets failed!\n"));
3951                 goto fail;
3952         }
3953
3954         *pdb_method = m;
3955         return NT_STATUS_OK;
3956 nomem:
3957         status = NT_STATUS_NO_MEMORY;
3958 fail:
3959         TALLOC_FREE(m);
3960         return status;
3961 }
3962
3963 NTSTATUS pdb_samba_dsdb_init(TALLOC_CTX *);
3964 NTSTATUS pdb_samba_dsdb_init(TALLOC_CTX *ctx)
3965 {
3966         NTSTATUS status = smb_register_passdb(PASSDB_INTERFACE_VERSION, "samba_dsdb",
3967                                               pdb_init_samba_dsdb);
3968         if (!NT_STATUS_IS_OK(status)) {
3969                 return status;
3970         }
3971         return smb_register_passdb(PASSDB_INTERFACE_VERSION, "samba4",
3972                                    pdb_init_samba_dsdb);
3973 }