2 Unix SMB/CIFS implementation.
3 Samba utility functions
5 Copyright (C) Andrew Tridgell 2004
6 Copyright (C) Volker Lendecke 2004
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006
8 Copyright (C) Jelmer Vernooij <jelmer@samba.org> 2007
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 #include "events/events.h"
27 #include "ldb_errors.h"
28 #include "../lib/util/util_ldb.h"
29 #include "../lib/crypto/crypto.h"
30 #include "dsdb/samdb/samdb.h"
31 #include "libcli/security/security.h"
32 #include "librpc/gen_ndr/ndr_security.h"
33 #include "librpc/gen_ndr/ndr_misc.h"
34 #include "../libds/common/flags.h"
35 #include "dsdb/common/proto.h"
36 #include "libcli/ldap/ldap_ndr.h"
37 #include "param/param.h"
38 #include "libcli/auth/libcli_auth.h"
39 #include "librpc/gen_ndr/ndr_drsblobs.h"
40 #include "system/locale.h"
43 search the sam for the specified attributes in a specific domain, filter on
44 objectSid being in domain_sid.
46 int samdb_search_domain(struct ldb_context *sam_ldb,
48 struct ldb_dn *basedn,
49 struct ldb_message ***res,
50 const char * const *attrs,
51 const struct dom_sid *domain_sid,
52 const char *format, ...) _PRINTF_ATTRIBUTE(7,8)
58 count = gendb_search_v(sam_ldb, mem_ctx, basedn,
59 res, attrs, format, ap);
65 struct dom_sid *entry_sid;
67 entry_sid = samdb_result_dom_sid(mem_ctx, (*res)[i], "objectSid");
69 if ((entry_sid == NULL) ||
70 (!dom_sid_in_domain(domain_sid, entry_sid))) {
71 /* Delete that entry from the result set */
72 (*res)[i] = (*res)[count-1];
74 talloc_free(entry_sid);
77 talloc_free(entry_sid);
85 search the sam for a single string attribute in exactly 1 record
87 const char *samdb_search_string_v(struct ldb_context *sam_ldb,
89 struct ldb_dn *basedn,
90 const char *attr_name,
91 const char *format, va_list ap) _PRINTF_ATTRIBUTE(5,0)
94 const char *attrs[2] = { NULL, NULL };
95 struct ldb_message **res = NULL;
99 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
101 DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n",
102 attr_name, format, count));
109 return samdb_result_string(res[0], attr_name, NULL);
113 search the sam for a single string attribute in exactly 1 record
115 const char *samdb_search_string(struct ldb_context *sam_ldb,
117 struct ldb_dn *basedn,
118 const char *attr_name,
119 const char *format, ...) _PRINTF_ATTRIBUTE(5,6)
124 va_start(ap, format);
125 str = samdb_search_string_v(sam_ldb, mem_ctx, basedn, attr_name, format, ap);
131 struct ldb_dn *samdb_search_dn(struct ldb_context *sam_ldb,
133 struct ldb_dn *basedn,
134 const char *format, ...) _PRINTF_ATTRIBUTE(4,5)
138 struct ldb_message **res = NULL;
141 va_start(ap, format);
142 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, NULL, format, ap);
145 if (count != 1) return NULL;
147 ret = talloc_steal(mem_ctx, res[0]->dn);
154 search the sam for a dom_sid attribute in exactly 1 record
156 struct dom_sid *samdb_search_dom_sid(struct ldb_context *sam_ldb,
158 struct ldb_dn *basedn,
159 const char *attr_name,
160 const char *format, ...) _PRINTF_ATTRIBUTE(5,6)
164 struct ldb_message **res;
165 const char *attrs[2] = { NULL, NULL };
168 attrs[0] = attr_name;
170 va_start(ap, format);
171 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
174 DEBUG(1,("samdb: search for %s %s not single valued (count=%d)\n",
175 attr_name, format, count));
181 sid = samdb_result_dom_sid(mem_ctx, res[0], attr_name);
187 return the count of the number of records in the sam matching the query
189 int samdb_search_count(struct ldb_context *sam_ldb,
190 struct ldb_dn *basedn,
191 const char *format, ...) _PRINTF_ATTRIBUTE(3,4)
194 struct ldb_message **res;
195 const char *attrs[] = { NULL };
197 TALLOC_CTX *tmp_ctx = talloc_new(sam_ldb);
199 va_start(ap, format);
200 ret = gendb_search_v(sam_ldb, tmp_ctx, basedn, &res, attrs, format, ap);
202 talloc_free(tmp_ctx);
209 search the sam for a single integer attribute in exactly 1 record
211 uint_t samdb_search_uint(struct ldb_context *sam_ldb,
213 uint_t default_value,
214 struct ldb_dn *basedn,
215 const char *attr_name,
216 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
220 struct ldb_message **res;
221 const char *attrs[2] = { NULL, NULL };
223 attrs[0] = attr_name;
225 va_start(ap, format);
226 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
230 return default_value;
233 return samdb_result_uint(res[0], attr_name, default_value);
237 search the sam for a single signed 64 bit integer attribute in exactly 1 record
239 int64_t samdb_search_int64(struct ldb_context *sam_ldb,
241 int64_t default_value,
242 struct ldb_dn *basedn,
243 const char *attr_name,
244 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
248 struct ldb_message **res;
249 const char *attrs[2] = { NULL, NULL };
251 attrs[0] = attr_name;
253 va_start(ap, format);
254 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
258 return default_value;
261 return samdb_result_int64(res[0], attr_name, default_value);
265 search the sam for multipe records each giving a single string attribute
266 return the number of matches, or -1 on error
268 int samdb_search_string_multiple(struct ldb_context *sam_ldb,
270 struct ldb_dn *basedn,
272 const char *attr_name,
273 const char *format, ...) _PRINTF_ATTRIBUTE(6,7)
277 const char *attrs[2] = { NULL, NULL };
278 struct ldb_message **res = NULL;
280 attrs[0] = attr_name;
282 va_start(ap, format);
283 count = gendb_search_v(sam_ldb, mem_ctx, basedn, &res, attrs, format, ap);
290 /* make sure its single valued */
291 for (i=0;i<count;i++) {
292 if (res[i]->num_elements != 1) {
293 DEBUG(1,("samdb: search for %s %s not single valued\n",
300 *strs = talloc_array(mem_ctx, const char *, count+1);
306 for (i=0;i<count;i++) {
307 (*strs)[i] = samdb_result_string(res[i], attr_name, NULL);
309 (*strs)[count] = NULL;
315 pull a uint from a result set.
317 uint_t samdb_result_uint(const struct ldb_message *msg, const char *attr, uint_t default_value)
319 return ldb_msg_find_attr_as_uint(msg, attr, default_value);
323 pull a (signed) int64 from a result set.
325 int64_t samdb_result_int64(const struct ldb_message *msg, const char *attr, int64_t default_value)
327 return ldb_msg_find_attr_as_int64(msg, attr, default_value);
331 pull a string from a result set.
333 const char *samdb_result_string(const struct ldb_message *msg, const char *attr,
334 const char *default_value)
336 return ldb_msg_find_attr_as_string(msg, attr, default_value);
339 struct ldb_dn *samdb_result_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
340 const char *attr, struct ldb_dn *default_value)
342 struct ldb_dn *ret_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, msg, attr);
344 return default_value;
350 pull a rid from a objectSid in a result set.
352 uint32_t samdb_result_rid_from_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
353 const char *attr, uint32_t default_value)
358 sid = samdb_result_dom_sid(mem_ctx, msg, attr);
360 return default_value;
362 rid = sid->sub_auths[sid->num_auths-1];
368 pull a dom_sid structure from a objectSid in a result set.
370 struct dom_sid *samdb_result_dom_sid(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
373 const struct ldb_val *v;
375 enum ndr_err_code ndr_err;
376 v = ldb_msg_find_ldb_val(msg, attr);
380 sid = talloc(mem_ctx, struct dom_sid);
384 ndr_err = ndr_pull_struct_blob(v, sid, NULL, sid,
385 (ndr_pull_flags_fn_t)ndr_pull_dom_sid);
386 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
394 pull a guid structure from a objectGUID in a result set.
396 struct GUID samdb_result_guid(const struct ldb_message *msg, const char *attr)
398 const struct ldb_val *v;
402 v = ldb_msg_find_ldb_val(msg, attr);
403 if (!v) return GUID_zero();
405 status = GUID_from_ndr_blob(v, &guid);
406 if (!NT_STATUS_IS_OK(status)) {
414 pull a sid prefix from a objectSid in a result set.
415 this is used to find the domain sid for a user
417 struct dom_sid *samdb_result_sid_prefix(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
420 struct dom_sid *sid = samdb_result_dom_sid(mem_ctx, msg, attr);
421 if (!sid || sid->num_auths < 1) return NULL;
427 pull a NTTIME in a result set.
429 NTTIME samdb_result_nttime(const struct ldb_message *msg, const char *attr,
430 NTTIME default_value)
432 return ldb_msg_find_attr_as_uint64(msg, attr, default_value);
436 * Windows stores 0 for lastLogoff.
437 * But when a MS DC return the lastLogoff (as Logoff Time)
438 * it returns 0x7FFFFFFFFFFFFFFF, not returning this value in this case
439 * cause windows 2008 and newer version to fail for SMB requests
441 NTTIME samdb_result_last_logoff(const struct ldb_message *msg)
443 NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "lastLogoff",0);
446 ret = 0x7FFFFFFFFFFFFFFFULL;
452 * Windows uses both 0 and 9223372036854775807 (0x7FFFFFFFFFFFFFFFULL) to
453 * indicate an account doesn't expire.
455 * When Windows initially creates an account, it sets
456 * accountExpires = 9223372036854775807 (0x7FFFFFFFFFFFFFFF). However,
457 * when changing from an account having a specific expiration date to
458 * that account never expiring, it sets accountExpires = 0.
460 * Consolidate that logic here to allow clearer logic for account expiry in
461 * the rest of the code.
463 NTTIME samdb_result_account_expires(const struct ldb_message *msg)
465 NTTIME ret = ldb_msg_find_attr_as_uint64(msg, "accountExpires",
469 ret = 0x7FFFFFFFFFFFFFFFULL;
475 pull a uint64_t from a result set.
477 uint64_t samdb_result_uint64(const struct ldb_message *msg, const char *attr,
478 uint64_t default_value)
480 return ldb_msg_find_attr_as_uint64(msg, attr, default_value);
485 construct the allow_password_change field from the PwdLastSet attribute and the
486 domain password settings
488 NTTIME samdb_result_allow_password_change(struct ldb_context *sam_ldb,
490 struct ldb_dn *domain_dn,
491 struct ldb_message *msg,
494 uint64_t attr_time = samdb_result_uint64(msg, attr, 0);
497 if (attr_time == 0) {
501 minPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "minPwdAge", NULL);
503 /* yes, this is a -= not a += as minPwdAge is stored as the negative
504 of the number of 100-nano-seconds */
505 attr_time -= minPwdAge;
511 construct the force_password_change field from the PwdLastSet
512 attribute, the userAccountControl and the domain password settings
514 NTTIME samdb_result_force_password_change(struct ldb_context *sam_ldb,
516 struct ldb_dn *domain_dn,
517 struct ldb_message *msg)
519 uint64_t attr_time = samdb_result_uint64(msg, "pwdLastSet", 0);
520 uint32_t userAccountControl = samdb_result_uint64(msg, "userAccountControl", 0);
523 /* Machine accounts don't expire, and there is a flag for 'no expiry' */
524 if (!(userAccountControl & UF_NORMAL_ACCOUNT)
525 || (userAccountControl & UF_DONT_EXPIRE_PASSWD)) {
526 return 0x7FFFFFFFFFFFFFFFULL;
529 if (attr_time == 0) {
533 maxPwdAge = samdb_search_int64(sam_ldb, mem_ctx, 0, domain_dn, "maxPwdAge", NULL);
534 if (maxPwdAge == 0) {
535 return 0x7FFFFFFFFFFFFFFFULL;
537 attr_time -= maxPwdAge;
544 pull a samr_Password structutre from a result set.
546 struct samr_Password *samdb_result_hash(TALLOC_CTX *mem_ctx, const struct ldb_message *msg, const char *attr)
548 struct samr_Password *hash = NULL;
549 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
550 if (val && (val->length >= sizeof(hash->hash))) {
551 hash = talloc(mem_ctx, struct samr_Password);
552 memcpy(hash->hash, val->data, MIN(val->length, sizeof(hash->hash)));
558 pull an array of samr_Password structutres from a result set.
560 uint_t samdb_result_hashes(TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
561 const char *attr, struct samr_Password **hashes)
564 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
570 count = val->length / 16;
575 *hashes = talloc_array(mem_ctx, struct samr_Password, count);
580 for (i=0;i<count;i++) {
581 memcpy((*hashes)[i].hash, (i*16)+(char *)val->data, 16);
587 NTSTATUS samdb_result_passwords(TALLOC_CTX *mem_ctx, struct loadparm_context *lp_ctx, struct ldb_message *msg,
588 struct samr_Password **lm_pwd, struct samr_Password **nt_pwd)
590 struct samr_Password *lmPwdHash, *ntPwdHash;
593 num_nt = samdb_result_hashes(mem_ctx, msg, "unicodePwd", &ntPwdHash);
596 } else if (num_nt > 1) {
597 return NT_STATUS_INTERNAL_DB_CORRUPTION;
599 *nt_pwd = &ntPwdHash[0];
603 /* Ensure that if we have turned off LM
604 * authentication, that we never use the LM hash, even
606 if (lp_lanman_auth(lp_ctx)) {
608 num_lm = samdb_result_hashes(mem_ctx, msg, "dBCSPwd", &lmPwdHash);
611 } else if (num_lm > 1) {
612 return NT_STATUS_INTERNAL_DB_CORRUPTION;
614 *lm_pwd = &lmPwdHash[0];
624 pull a samr_LogonHours structutre from a result set.
626 struct samr_LogonHours samdb_result_logon_hours(TALLOC_CTX *mem_ctx, struct ldb_message *msg, const char *attr)
628 struct samr_LogonHours hours;
629 const int units_per_week = 168;
630 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
632 hours.bits = talloc_array(mem_ctx, uint8_t, units_per_week);
636 hours.units_per_week = units_per_week;
637 memset(hours.bits, 0xFF, units_per_week);
639 memcpy(hours.bits, val->data, MIN(val->length, units_per_week));
645 pull a set of account_flags from a result set.
647 This requires that the attributes:
652 uint32_t samdb_result_acct_flags(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
653 struct ldb_message *msg, struct ldb_dn *domain_dn)
655 uint32_t userAccountControl = ldb_msg_find_attr_as_uint(msg, "userAccountControl", 0);
656 uint32_t acct_flags = ds_uf2acb(userAccountControl);
657 NTTIME must_change_time;
660 must_change_time = samdb_result_force_password_change(sam_ctx, mem_ctx,
663 /* Test account expire time */
664 unix_to_nt_time(&now, time(NULL));
665 /* check for expired password */
666 if (must_change_time < now) {
667 acct_flags |= ACB_PW_EXPIRED;
672 struct lsa_BinaryString samdb_result_parameters(TALLOC_CTX *mem_ctx,
673 struct ldb_message *msg,
676 struct lsa_BinaryString s;
677 const struct ldb_val *val = ldb_msg_find_ldb_val(msg, attr);
685 s.array = talloc_array(mem_ctx, uint16_t, val->length/2);
689 s.length = s.size = val->length/2;
690 memcpy(s.array, val->data, val->length);
695 /* Find an attribute, with a particular value */
697 /* The current callers of this function expect a very specific
698 * behaviour: In particular, objectClass subclass equivilance is not
699 * wanted. This means that we should not lookup the schema for the
700 * comparison function */
701 struct ldb_message_element *samdb_find_attribute(struct ldb_context *ldb,
702 const struct ldb_message *msg,
703 const char *name, const char *value)
706 struct ldb_message_element *el = ldb_msg_find_element(msg, name);
712 for (i=0;i<el->num_values;i++) {
713 if (ldb_attr_cmp(value, (char *)el->values[i].data) == 0) {
721 int samdb_find_or_add_value(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value)
723 if (samdb_find_attribute(ldb, msg, name, set_value) == NULL) {
724 return samdb_msg_add_string(ldb, msg, msg, name, set_value);
729 int samdb_find_or_add_attribute(struct ldb_context *ldb, struct ldb_message *msg, const char *name, const char *set_value)
731 struct ldb_message_element *el;
733 el = ldb_msg_find_element(msg, name);
738 return samdb_msg_add_string(ldb, msg, msg, name, set_value);
744 add a string element to a message
746 int samdb_msg_add_string(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
747 const char *attr_name, const char *str)
749 char *s = talloc_strdup(mem_ctx, str);
750 char *a = talloc_strdup(mem_ctx, attr_name);
751 if (s == NULL || a == NULL) {
752 return LDB_ERR_OPERATIONS_ERROR;
754 return ldb_msg_add_string(msg, a, s);
758 add a dom_sid element to a message
760 int samdb_msg_add_dom_sid(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
761 const char *attr_name, struct dom_sid *sid)
764 enum ndr_err_code ndr_err;
766 ndr_err = ndr_push_struct_blob(&v, mem_ctx,
767 lp_iconv_convenience(ldb_get_opaque(sam_ldb, "loadparm")),
769 (ndr_push_flags_fn_t)ndr_push_dom_sid);
770 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
773 return ldb_msg_add_value(msg, attr_name, &v, NULL);
778 add a delete element operation to a message
780 int samdb_msg_add_delete(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
781 const char *attr_name)
783 /* we use an empty replace rather than a delete, as it allows for
784 samdb_replace() to be used everywhere */
785 return ldb_msg_add_empty(msg, attr_name, LDB_FLAG_MOD_REPLACE, NULL);
789 add a add attribute value to a message
791 int samdb_msg_add_addval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
792 const char *attr_name, const char *value)
794 struct ldb_message_element *el;
797 a = talloc_strdup(mem_ctx, attr_name);
800 v = talloc_strdup(mem_ctx, value);
803 ret = ldb_msg_add_string(msg, a, v);
806 el = ldb_msg_find_element(msg, a);
809 el->flags = LDB_FLAG_MOD_ADD;
814 add a delete attribute value to a message
816 int samdb_msg_add_delval(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
817 const char *attr_name, const char *value)
819 struct ldb_message_element *el;
822 a = talloc_strdup(mem_ctx, attr_name);
825 v = talloc_strdup(mem_ctx, value);
828 ret = ldb_msg_add_string(msg, a, v);
831 el = ldb_msg_find_element(msg, a);
834 el->flags = LDB_FLAG_MOD_DELETE;
839 add a int element to a message
841 int samdb_msg_add_int(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
842 const char *attr_name, int v)
844 const char *s = talloc_asprintf(mem_ctx, "%d", v);
845 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
849 add a uint_t element to a message
851 int samdb_msg_add_uint(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
852 const char *attr_name, uint_t v)
854 const char *s = talloc_asprintf(mem_ctx, "%u", v);
855 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
859 add a (signed) int64_t element to a message
861 int samdb_msg_add_int64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
862 const char *attr_name, int64_t v)
864 const char *s = talloc_asprintf(mem_ctx, "%lld", (long long)v);
865 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
869 add a uint64_t element to a message
871 int samdb_msg_add_uint64(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
872 const char *attr_name, uint64_t v)
874 const char *s = talloc_asprintf(mem_ctx, "%llu", (unsigned long long)v);
875 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, s);
879 add a samr_Password element to a message
881 int samdb_msg_add_hash(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
882 const char *attr_name, struct samr_Password *hash)
885 val.data = talloc_memdup(mem_ctx, hash->hash, 16);
890 return ldb_msg_add_value(msg, attr_name, &val, NULL);
894 add a samr_Password array to a message
896 int samdb_msg_add_hashes(TALLOC_CTX *mem_ctx, struct ldb_message *msg,
897 const char *attr_name, struct samr_Password *hashes, uint_t count)
901 val.data = talloc_array_size(mem_ctx, 16, count);
902 val.length = count*16;
906 for (i=0;i<count;i++) {
907 memcpy(i*16 + (char *)val.data, hashes[i].hash, 16);
909 return ldb_msg_add_value(msg, attr_name, &val, NULL);
913 add a acct_flags element to a message
915 int samdb_msg_add_acct_flags(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
916 const char *attr_name, uint32_t v)
918 return samdb_msg_add_uint(sam_ldb, mem_ctx, msg, attr_name, ds_acb2uf(v));
922 add a logon_hours element to a message
924 int samdb_msg_add_logon_hours(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
925 const char *attr_name, struct samr_LogonHours *hours)
928 val.length = hours->units_per_week / 8;
929 val.data = hours->bits;
930 return ldb_msg_add_value(msg, attr_name, &val, NULL);
934 add a parameters element to a message
936 int samdb_msg_add_parameters(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
937 const char *attr_name, struct lsa_BinaryString *parameters)
940 val.length = parameters->length * 2;
941 val.data = (uint8_t *)parameters->array;
942 return ldb_msg_add_value(msg, attr_name, &val, NULL);
945 add a general value element to a message
947 int samdb_msg_add_value(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
948 const char *attr_name, const struct ldb_val *val)
950 return ldb_msg_add_value(msg, attr_name, val, NULL);
954 sets a general value element to a message
956 int samdb_msg_set_value(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
957 const char *attr_name, const struct ldb_val *val)
959 struct ldb_message_element *el;
961 el = ldb_msg_find_element(msg, attr_name);
965 return ldb_msg_add_value(msg, attr_name, val, NULL);
969 set a string element in a message
971 int samdb_msg_set_string(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg,
972 const char *attr_name, const char *str)
974 struct ldb_message_element *el;
976 el = ldb_msg_find_element(msg, attr_name);
980 return samdb_msg_add_string(sam_ldb, mem_ctx, msg, attr_name, str);
984 replace elements in a record
986 int samdb_replace(struct ldb_context *sam_ldb, TALLOC_CTX *mem_ctx, struct ldb_message *msg)
990 /* mark all the message elements as LDB_FLAG_MOD_REPLACE */
991 for (i=0;i<msg->num_elements;i++) {
992 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
995 /* modify the samdb record */
996 return ldb_modify(sam_ldb, msg);
1000 * Handle ldb_request in transaction
1002 static int dsdb_autotransaction_request(struct ldb_context *sam_ldb,
1003 struct ldb_request *req)
1007 ret = ldb_transaction_start(sam_ldb);
1008 if (ret != LDB_SUCCESS) {
1012 ret = ldb_request(sam_ldb, req);
1013 if (ret == LDB_SUCCESS) {
1014 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
1017 if (ret == LDB_SUCCESS) {
1018 return ldb_transaction_commit(sam_ldb);
1020 ldb_transaction_cancel(sam_ldb);
1026 * replace elements in a record using LDB_CONTROL_AS_SYSTEM
1027 * used to skip access checks on operations
1028 * that are performed by the system
1030 int samdb_replace_as_system(struct ldb_context *sam_ldb,
1031 TALLOC_CTX *mem_ctx,
1032 struct ldb_message *msg)
1036 struct ldb_request *req = NULL;
1038 /* mark all the message elements as LDB_FLAG_MOD_REPLACE */
1039 for (i=0;i<msg->num_elements;i++) {
1040 msg->elements[i].flags = LDB_FLAG_MOD_REPLACE;
1044 ldb_ret = ldb_msg_sanity_check(sam_ldb, msg);
1045 if (ldb_ret != LDB_SUCCESS) {
1049 ldb_ret = ldb_build_mod_req(&req, sam_ldb, mem_ctx,
1053 ldb_op_default_callback,
1056 if (ldb_ret != LDB_SUCCESS) {
1061 ldb_ret = ldb_request_add_control(req, LDB_CONTROL_AS_SYSTEM_OID, false, NULL);
1062 if (ldb_ret != LDB_SUCCESS) {
1067 /* do request and auto start a transaction */
1068 ldb_ret = dsdb_autotransaction_request(sam_ldb, req);
1075 return a default security descriptor
1077 struct security_descriptor *samdb_default_security_descriptor(TALLOC_CTX *mem_ctx)
1079 struct security_descriptor *sd;
1081 sd = security_descriptor_initialise(mem_ctx);
1086 struct ldb_dn *samdb_base_dn(struct ldb_context *sam_ctx)
1088 return ldb_get_default_basedn(sam_ctx);
1091 struct ldb_dn *samdb_config_dn(struct ldb_context *sam_ctx)
1093 return ldb_get_config_basedn(sam_ctx);
1096 struct ldb_dn *samdb_schema_dn(struct ldb_context *sam_ctx)
1098 return ldb_get_schema_basedn(sam_ctx);
1101 struct ldb_dn *samdb_aggregate_schema_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1103 struct ldb_dn *schema_dn = ldb_get_schema_basedn(sam_ctx);
1104 struct ldb_dn *aggregate_dn;
1109 aggregate_dn = ldb_dn_copy(mem_ctx, schema_dn);
1110 if (!aggregate_dn) {
1113 if (!ldb_dn_add_child_fmt(aggregate_dn, "CN=Aggregate")) {
1116 return aggregate_dn;
1119 struct ldb_dn *samdb_root_dn(struct ldb_context *sam_ctx)
1121 return ldb_get_root_basedn(sam_ctx);
1124 struct ldb_dn *samdb_partitions_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1126 struct ldb_dn *new_dn;
1128 new_dn = ldb_dn_copy(mem_ctx, samdb_config_dn(sam_ctx));
1129 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Partitions")) {
1130 talloc_free(new_dn);
1136 struct ldb_dn *samdb_sites_dn(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx)
1138 struct ldb_dn *new_dn;
1140 new_dn = ldb_dn_copy(mem_ctx, samdb_config_dn(sam_ctx));
1141 if ( ! ldb_dn_add_child_fmt(new_dn, "CN=Sites")) {
1142 talloc_free(new_dn);
1149 work out the domain sid for the current open ldb
1151 const struct dom_sid *samdb_domain_sid(struct ldb_context *ldb)
1153 TALLOC_CTX *tmp_ctx;
1154 const struct dom_sid *domain_sid;
1155 const char *attrs[] = {
1159 struct ldb_result *res;
1162 /* see if we have a cached copy */
1163 domain_sid = (struct dom_sid *)ldb_get_opaque(ldb, "cache.domain_sid");
1168 tmp_ctx = talloc_new(ldb);
1169 if (tmp_ctx == NULL) {
1173 ret = ldb_search(ldb, tmp_ctx, &res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, attrs, "objectSid=*");
1175 if (ret != LDB_SUCCESS) {
1179 if (res->count != 1) {
1183 domain_sid = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSid");
1184 if (domain_sid == NULL) {
1188 /* cache the domain_sid in the ldb */
1189 if (ldb_set_opaque(ldb, "cache.domain_sid", discard_const_p(struct dom_sid, domain_sid)) != LDB_SUCCESS) {
1193 talloc_steal(ldb, domain_sid);
1194 talloc_free(tmp_ctx);
1199 DEBUG(1,("Failed to find domain_sid for open ldb\n"));
1200 talloc_free(tmp_ctx);
1204 bool samdb_set_domain_sid(struct ldb_context *ldb, const struct dom_sid *dom_sid_in)
1206 TALLOC_CTX *tmp_ctx;
1207 struct dom_sid *dom_sid_new;
1208 struct dom_sid *dom_sid_old;
1210 /* see if we have a cached copy */
1211 dom_sid_old = talloc_get_type(ldb_get_opaque(ldb,
1212 "cache.domain_sid"), struct dom_sid);
1214 tmp_ctx = talloc_new(ldb);
1215 if (tmp_ctx == NULL) {
1219 dom_sid_new = dom_sid_dup(tmp_ctx, dom_sid_in);
1224 /* cache the domain_sid in the ldb */
1225 if (ldb_set_opaque(ldb, "cache.domain_sid", dom_sid_new) != LDB_SUCCESS) {
1229 talloc_steal(ldb, dom_sid_new);
1230 talloc_free(tmp_ctx);
1231 talloc_free(dom_sid_old);
1236 DEBUG(1,("Failed to set our own cached domain SID in the ldb!\n"));
1237 talloc_free(tmp_ctx);
1241 /* Obtain the short name of the flexible single master operator
1242 * (FSMO), such as the PDC Emulator */
1243 const char *samdb_result_fsmo_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const struct ldb_message *msg,
1246 /* Format is cn=NTDS Settings,cn=<NETBIOS name of FSMO>,.... */
1247 struct ldb_dn *fsmo_dn = ldb_msg_find_attr_as_dn(ldb, mem_ctx, msg, attr);
1248 const struct ldb_val *val = ldb_dn_get_component_val(fsmo_dn, 1);
1249 const char *name = ldb_dn_get_component_name(fsmo_dn, 1);
1251 if (!name || (ldb_attr_cmp(name, "cn") != 0)) {
1252 /* Ensure this matches the format. This gives us a
1253 * bit more confidence that a 'cn' value will be a
1258 return (char *)val->data;
1264 work out the ntds settings dn for the current open ldb
1266 struct ldb_dn *samdb_ntds_settings_dn(struct ldb_context *ldb)
1268 TALLOC_CTX *tmp_ctx;
1269 const char *root_attrs[] = { "dsServiceName", NULL };
1271 struct ldb_result *root_res;
1272 struct ldb_dn *settings_dn;
1274 /* see if we have a cached copy */
1275 settings_dn = (struct ldb_dn *)ldb_get_opaque(ldb, "cache.settings_dn");
1280 tmp_ctx = talloc_new(ldb);
1281 if (tmp_ctx == NULL) {
1285 ret = ldb_search(ldb, tmp_ctx, &root_res, ldb_dn_new(tmp_ctx, ldb, ""), LDB_SCOPE_BASE, root_attrs, NULL);
1287 DEBUG(1,("Searching for dsServiceName in rootDSE failed: %s\n",
1288 ldb_errstring(ldb)));
1292 if (root_res->count != 1) {
1296 settings_dn = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, root_res->msgs[0], "dsServiceName");
1298 /* cache the domain_sid in the ldb */
1299 if (ldb_set_opaque(ldb, "cache.settings_dn", settings_dn) != LDB_SUCCESS) {
1303 talloc_steal(ldb, settings_dn);
1304 talloc_free(tmp_ctx);
1309 DEBUG(1,("Failed to find our own NTDS Settings DN in the ldb!\n"));
1310 talloc_free(tmp_ctx);
1315 work out the ntds settings invocationId for the current open ldb
1317 const struct GUID *samdb_ntds_invocation_id(struct ldb_context *ldb)
1319 TALLOC_CTX *tmp_ctx;
1320 const char *attrs[] = { "invocationId", NULL };
1322 struct ldb_result *res;
1323 struct GUID *invocation_id;
1325 /* see if we have a cached copy */
1326 invocation_id = (struct GUID *)ldb_get_opaque(ldb, "cache.invocation_id");
1327 if (invocation_id) {
1328 return invocation_id;
1331 tmp_ctx = talloc_new(ldb);
1332 if (tmp_ctx == NULL) {
1336 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1341 if (res->count != 1) {
1345 invocation_id = talloc(tmp_ctx, struct GUID);
1346 if (!invocation_id) {
1350 *invocation_id = samdb_result_guid(res->msgs[0], "invocationId");
1352 /* cache the domain_sid in the ldb */
1353 if (ldb_set_opaque(ldb, "cache.invocation_id", invocation_id) != LDB_SUCCESS) {
1357 talloc_steal(ldb, invocation_id);
1358 talloc_free(tmp_ctx);
1360 return invocation_id;
1363 DEBUG(1,("Failed to find our own NTDS Settings invocationId in the ldb!\n"));
1364 talloc_free(tmp_ctx);
1368 bool samdb_set_ntds_invocation_id(struct ldb_context *ldb, const struct GUID *invocation_id_in)
1370 TALLOC_CTX *tmp_ctx;
1371 struct GUID *invocation_id_new;
1372 struct GUID *invocation_id_old;
1374 /* see if we have a cached copy */
1375 invocation_id_old = (struct GUID *)ldb_get_opaque(ldb,
1376 "cache.invocation_id");
1378 tmp_ctx = talloc_new(ldb);
1379 if (tmp_ctx == NULL) {
1383 invocation_id_new = talloc(tmp_ctx, struct GUID);
1384 if (!invocation_id_new) {
1388 *invocation_id_new = *invocation_id_in;
1390 /* cache the domain_sid in the ldb */
1391 if (ldb_set_opaque(ldb, "cache.invocation_id", invocation_id_new) != LDB_SUCCESS) {
1395 talloc_steal(ldb, invocation_id_new);
1396 talloc_free(tmp_ctx);
1397 talloc_free(invocation_id_old);
1402 DEBUG(1,("Failed to set our own cached invocationId in the ldb!\n"));
1403 talloc_free(tmp_ctx);
1408 work out the ntds settings objectGUID for the current open ldb
1410 const struct GUID *samdb_ntds_objectGUID(struct ldb_context *ldb)
1412 TALLOC_CTX *tmp_ctx;
1413 const char *attrs[] = { "objectGUID", NULL };
1415 struct ldb_result *res;
1416 struct GUID *ntds_guid;
1418 /* see if we have a cached copy */
1419 ntds_guid = (struct GUID *)ldb_get_opaque(ldb, "cache.ntds_guid");
1424 tmp_ctx = talloc_new(ldb);
1425 if (tmp_ctx == NULL) {
1429 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1434 if (res->count != 1) {
1438 ntds_guid = talloc(tmp_ctx, struct GUID);
1443 *ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
1445 /* cache the domain_sid in the ldb */
1446 if (ldb_set_opaque(ldb, "cache.ntds_guid", ntds_guid) != LDB_SUCCESS) {
1450 talloc_steal(ldb, ntds_guid);
1451 talloc_free(tmp_ctx);
1456 DEBUG(1,("Failed to find our own NTDS Settings objectGUID in the ldb!\n"));
1457 talloc_free(tmp_ctx);
1461 bool samdb_set_ntds_objectGUID(struct ldb_context *ldb, const struct GUID *ntds_guid_in)
1463 TALLOC_CTX *tmp_ctx;
1464 struct GUID *ntds_guid_new;
1465 struct GUID *ntds_guid_old;
1467 /* see if we have a cached copy */
1468 ntds_guid_old = (struct GUID *)ldb_get_opaque(ldb, "cache.ntds_guid");
1470 tmp_ctx = talloc_new(ldb);
1471 if (tmp_ctx == NULL) {
1475 ntds_guid_new = talloc(tmp_ctx, struct GUID);
1476 if (!ntds_guid_new) {
1480 *ntds_guid_new = *ntds_guid_in;
1482 /* cache the domain_sid in the ldb */
1483 if (ldb_set_opaque(ldb, "cache.ntds_guid", ntds_guid_new) != LDB_SUCCESS) {
1487 talloc_steal(ldb, ntds_guid_new);
1488 talloc_free(tmp_ctx);
1489 talloc_free(ntds_guid_old);
1494 DEBUG(1,("Failed to set our own cached invocationId in the ldb!\n"));
1495 talloc_free(tmp_ctx);
1500 work out the server dn for the current open ldb
1502 struct ldb_dn *samdb_server_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1504 return ldb_dn_get_parent(mem_ctx, samdb_ntds_settings_dn(ldb));
1508 work out the server dn for the current open ldb
1510 struct ldb_dn *samdb_server_site_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1512 struct ldb_dn *server_dn;
1513 struct ldb_dn *server_site_dn;
1515 server_dn = samdb_server_dn(ldb, mem_ctx);
1516 if (!server_dn) return NULL;
1518 server_site_dn = ldb_dn_get_parent(mem_ctx, server_dn);
1520 talloc_free(server_dn);
1521 return server_site_dn;
1524 const char *samdb_server_site_name(struct ldb_context *ldb, TALLOC_CTX *mem_ctx)
1526 const struct ldb_val *val = ldb_dn_get_rdn_val(samdb_server_site_dn(ldb, mem_ctx));
1529 return (const char *) val->data;
1535 work out if we are the PDC for the domain of the current open ldb
1537 bool samdb_is_pdc(struct ldb_context *ldb)
1539 const char *dom_attrs[] = { "fSMORoleOwner", NULL };
1541 struct ldb_result *dom_res;
1542 TALLOC_CTX *tmp_ctx;
1546 tmp_ctx = talloc_new(ldb);
1547 if (tmp_ctx == NULL) {
1548 DEBUG(1, ("talloc_new failed in samdb_is_pdc"));
1552 ret = ldb_search(ldb, tmp_ctx, &dom_res, ldb_get_default_basedn(ldb), LDB_SCOPE_BASE, dom_attrs, NULL);
1554 DEBUG(1,("Searching for fSMORoleOwner in %s failed: %s\n",
1555 ldb_dn_get_linearized(ldb_get_default_basedn(ldb)),
1556 ldb_errstring(ldb)));
1559 if (dom_res->count != 1) {
1563 pdc = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, dom_res->msgs[0], "fSMORoleOwner");
1565 if (ldb_dn_compare(samdb_ntds_settings_dn(ldb), pdc) == 0) {
1571 talloc_free(tmp_ctx);
1576 DEBUG(1,("Failed to find if we are the PDC for this ldb\n"));
1577 talloc_free(tmp_ctx);
1582 work out if we are a Global Catalog server for the domain of the current open ldb
1584 bool samdb_is_gc(struct ldb_context *ldb)
1586 const char *attrs[] = { "options", NULL };
1588 struct ldb_result *res;
1589 TALLOC_CTX *tmp_ctx;
1591 tmp_ctx = talloc_new(ldb);
1592 if (tmp_ctx == NULL) {
1593 DEBUG(1, ("talloc_new failed in samdb_is_pdc"));
1597 /* Query cn=ntds settings,.... */
1598 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
1600 talloc_free(tmp_ctx);
1603 if (res->count != 1) {
1604 talloc_free(tmp_ctx);
1608 options = ldb_msg_find_attr_as_int(res->msgs[0], "options", 0);
1609 talloc_free(tmp_ctx);
1611 /* if options attribute has the 0x00000001 flag set, then enable the global catlog */
1612 if (options & 0x000000001) {
1618 /* Find a domain object in the parents of a particular DN. */
1619 int samdb_search_for_parent_domain(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
1620 struct ldb_dn **parent_dn, const char **errstring)
1622 TALLOC_CTX *local_ctx;
1623 struct ldb_dn *sdn = dn;
1624 struct ldb_result *res = NULL;
1626 const char *attrs[] = { NULL };
1628 local_ctx = talloc_new(mem_ctx);
1629 if (local_ctx == NULL) return LDB_ERR_OPERATIONS_ERROR;
1631 while ((sdn = ldb_dn_get_parent(local_ctx, sdn))) {
1632 ret = ldb_search(ldb, local_ctx, &res, sdn, LDB_SCOPE_BASE, attrs,
1633 "(|(objectClass=domain)(objectClass=builtinDomain))");
1634 if (ret == LDB_SUCCESS) {
1635 if (res->count == 1) {
1643 if (ret != LDB_SUCCESS) {
1644 *errstring = talloc_asprintf(mem_ctx, "Error searching for parent domain of %s, failed searching for %s: %s",
1645 ldb_dn_get_linearized(dn),
1646 ldb_dn_get_linearized(sdn),
1647 ldb_errstring(ldb));
1648 talloc_free(local_ctx);
1651 if (res->count != 1) {
1652 *errstring = talloc_asprintf(mem_ctx, "Invalid dn (%s), not child of a domain object",
1653 ldb_dn_get_linearized(dn));
1654 DEBUG(0,(__location__ ": %s\n", *errstring));
1655 talloc_free(local_ctx);
1656 return LDB_ERR_CONSTRAINT_VIOLATION;
1659 *parent_dn = talloc_steal(mem_ctx, res->msgs[0]->dn);
1660 talloc_free(local_ctx);
1666 * Performs checks on a user password (plaintext UNIX format - attribute
1667 * "password"). The remaining parameters have to be extracted from the domain
1670 * Result codes from "enum samr_ValidationStatus" (consider "samr.idl")
1672 enum samr_ValidationStatus samdb_check_password(const DATA_BLOB *password,
1673 const uint32_t pwdProperties,
1674 const uint32_t minPwdLength)
1676 /* checks if the "minPwdLength" property is satisfied */
1677 if (minPwdLength > password->length)
1678 return SAMR_VALIDATION_STATUS_PWD_TOO_SHORT;
1680 /* checks the password complexity */
1681 if (((pwdProperties & DOMAIN_PASSWORD_COMPLEX) != 0)
1682 && (password->data != NULL)
1683 && (!check_password_quality((const char *) password->data)))
1684 return SAMR_VALIDATION_STATUS_NOT_COMPLEX_ENOUGH;
1686 return SAMR_VALIDATION_STATUS_SUCCESS;
1690 * Sets the user password using plaintext UTF16 (attribute "new_password") or
1691 * LM (attribute "lmNewHash") or NT (attribute "ntNewHash") hash. Also pass
1692 * as parameter if it's a user change or not ("userChange"). The "rejectReason"
1693 * gives some more informations if the changed failed.
1695 * The caller should have a LDB transaction wrapping this.
1697 * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION,
1698 * NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
1699 * NT_STATUS_PASSWORD_RESTRICTION
1701 NTSTATUS samdb_set_password(struct ldb_context *ctx, TALLOC_CTX *mem_ctx,
1702 struct ldb_dn *user_dn, struct ldb_dn *domain_dn,
1703 struct ldb_message *mod,
1704 const DATA_BLOB *new_password,
1705 struct samr_Password *param_lmNewHash,
1706 struct samr_Password *param_ntNewHash,
1708 enum samPwdChangeReason *reject_reason,
1709 struct samr_DomInfo1 **_dominfo)
1711 const char * const user_attrs[] = { "userAccountControl",
1714 "dBCSPwd", "unicodePwd",
1716 "pwdLastSet", NULL };
1717 const char * const domain_attrs[] = { "minPwdLength", "pwdProperties",
1719 "maxPwdAge", "minPwdAge", NULL };
1721 uint32_t minPwdLength, pwdProperties, pwdHistoryLength;
1722 int64_t maxPwdAge, minPwdAge;
1723 uint32_t userAccountControl;
1724 struct samr_Password *sambaLMPwdHistory, *sambaNTPwdHistory,
1725 *lmPwdHash, *ntPwdHash, *lmNewHash, *ntNewHash;
1726 struct samr_Password local_lmNewHash, local_ntNewHash;
1727 int sambaLMPwdHistory_len, sambaNTPwdHistory_len;
1728 struct dom_sid *domain_sid;
1729 struct ldb_message **res;
1732 time_t now = time(NULL);
1736 /* we need to know the time to compute password age */
1737 unix_to_nt_time(&now_nt, now);
1739 /* pull all the user parameters */
1740 count = gendb_search_dn(ctx, mem_ctx, user_dn, &res, user_attrs);
1742 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1744 userAccountControl = samdb_result_uint(res[0], "userAccountControl", 0);
1745 sambaLMPwdHistory_len = samdb_result_hashes(mem_ctx, res[0],
1746 "lmPwdHistory", &sambaLMPwdHistory);
1747 sambaNTPwdHistory_len = samdb_result_hashes(mem_ctx, res[0],
1748 "ntPwdHistory", &sambaNTPwdHistory);
1749 lmPwdHash = samdb_result_hash(mem_ctx, res[0], "dBCSPwd");
1750 ntPwdHash = samdb_result_hash(mem_ctx, res[0], "unicodePwd");
1751 pwdLastSet = samdb_result_uint64(res[0], "pwdLastSet", 0);
1753 /* Copy parameters */
1754 lmNewHash = param_lmNewHash;
1755 ntNewHash = param_ntNewHash;
1757 /* Only non-trust accounts have restrictions (possibly this
1758 * test is the wrong way around, but I like to be restrictive
1760 restrictions = !(userAccountControl & (UF_INTERDOMAIN_TRUST_ACCOUNT
1761 |UF_WORKSTATION_TRUST_ACCOUNT
1762 |UF_SERVER_TRUST_ACCOUNT));
1764 if (domain_dn != NULL) {
1765 /* pull the domain parameters */
1766 count = gendb_search_dn(ctx, mem_ctx, domain_dn, &res,
1769 DEBUG(2, ("samdb_set_password: Domain DN %s is invalid, for user %s\n",
1770 ldb_dn_get_linearized(domain_dn),
1771 ldb_dn_get_linearized(user_dn)));
1772 return NT_STATUS_NO_SUCH_DOMAIN;
1775 /* work out the domain sid, and pull the domain from there */
1776 domain_sid = samdb_result_sid_prefix(mem_ctx, res[0],
1778 if (domain_sid == NULL) {
1779 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1782 count = gendb_search(ctx, mem_ctx, NULL, &res, domain_attrs,
1784 ldap_encode_ndr_dom_sid(mem_ctx, domain_sid));
1786 DEBUG(2, ("samdb_set_password: Could not find domain to match SID: %s, for user %s\n",
1787 dom_sid_string(mem_ctx, domain_sid),
1788 ldb_dn_get_linearized(user_dn)));
1789 return NT_STATUS_NO_SUCH_DOMAIN;
1793 minPwdLength = samdb_result_uint(res[0], "minPwdLength", 0);
1794 pwdProperties = samdb_result_uint(res[0], "pwdProperties", 0);
1795 pwdHistoryLength = samdb_result_uint(res[0], "pwdHistoryLength", 0);
1796 maxPwdAge = samdb_result_int64(res[0], "maxPwdAge", 0);
1797 minPwdAge = samdb_result_int64(res[0], "minPwdAge", 0);
1799 if ((userAccountControl & UF_PASSWD_NOTREQD) != 0) {
1800 /* see [MS-ADTS] 2.2.15 */
1804 if (_dominfo != NULL) {
1805 struct samr_DomInfo1 *dominfo;
1806 /* on failure we need to fill in the reject reasons */
1807 dominfo = talloc(mem_ctx, struct samr_DomInfo1);
1808 if (dominfo == NULL) {
1809 return NT_STATUS_NO_MEMORY;
1811 dominfo->min_password_length = minPwdLength;
1812 dominfo->password_properties = pwdProperties;
1813 dominfo->password_history_length = pwdHistoryLength;
1814 dominfo->max_password_age = maxPwdAge;
1815 dominfo->min_password_age = minPwdAge;
1816 *_dominfo = dominfo;
1819 if ((restrictions != 0) && (new_password != 0)) {
1822 /* checks if the "minPwdLength" property is satisfied */
1823 if ((restrictions != 0)
1824 && (minPwdLength > utf16_len_n(
1825 new_password->data, new_password->length)/2)) {
1826 if (reject_reason) {
1827 *reject_reason = SAM_PWD_CHANGE_PASSWORD_TOO_SHORT;
1829 return NT_STATUS_PASSWORD_RESTRICTION;
1832 /* Create the NT hash */
1833 mdfour(local_ntNewHash.hash, new_password->data,
1834 new_password->length);
1836 ntNewHash = &local_ntNewHash;
1838 /* Only check complexity if we can convert it at all. Assuming unconvertable passwords are 'strong' */
1839 if (convert_string_talloc_convenience(mem_ctx,
1840 lp_iconv_convenience(ldb_get_opaque(ctx, "loadparm")),
1842 new_password->data, new_password->length,
1843 (void **)&new_pass, NULL, false)) {
1845 /* checks the password complexity */
1846 if ((restrictions != 0)
1848 & DOMAIN_PASSWORD_COMPLEX) != 0)
1849 && (!check_password_quality(new_pass))) {
1850 if (reject_reason) {
1851 *reject_reason = SAM_PWD_CHANGE_NOT_COMPLEX;
1853 return NT_STATUS_PASSWORD_RESTRICTION;
1856 /* compute the new lm hashes (for checking history - case insenitivly!) */
1857 if (E_deshash(new_pass, local_lmNewHash.hash)) {
1858 lmNewHash = &local_lmNewHash;
1863 if ((restrictions != 0) && user_change) {
1864 /* are all password changes disallowed? */
1865 if ((pwdProperties & DOMAIN_REFUSE_PASSWORD_CHANGE) != 0) {
1866 if (reject_reason) {
1867 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
1869 return NT_STATUS_PASSWORD_RESTRICTION;
1872 /* can this user change the password? */
1873 if ((userAccountControl & UF_PASSWD_CANT_CHANGE) != 0) {
1874 if (reject_reason) {
1875 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
1877 return NT_STATUS_PASSWORD_RESTRICTION;
1880 /* Password minimum age: yes, this is a minus. The ages are in negative 100nsec units! */
1881 if (pwdLastSet - minPwdAge > now_nt) {
1882 if (reject_reason) {
1883 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
1885 return NT_STATUS_PASSWORD_RESTRICTION;
1888 /* check the immediately past password */
1889 if (pwdHistoryLength > 0) {
1890 if (lmNewHash && lmPwdHash && memcmp(lmNewHash->hash,
1891 lmPwdHash->hash, 16) == 0) {
1892 if (reject_reason) {
1893 *reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1895 return NT_STATUS_PASSWORD_RESTRICTION;
1897 if (ntNewHash && ntPwdHash && memcmp(ntNewHash->hash,
1898 ntPwdHash->hash, 16) == 0) {
1899 if (reject_reason) {
1900 *reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1902 return NT_STATUS_PASSWORD_RESTRICTION;
1906 /* check the password history */
1907 sambaLMPwdHistory_len = MIN(sambaLMPwdHistory_len,
1909 sambaNTPwdHistory_len = MIN(sambaNTPwdHistory_len,
1912 for (i=0; lmNewHash && i<sambaLMPwdHistory_len;i++) {
1913 if (memcmp(lmNewHash->hash, sambaLMPwdHistory[i].hash,
1915 if (reject_reason) {
1916 *reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1918 return NT_STATUS_PASSWORD_RESTRICTION;
1921 for (i=0; ntNewHash && i<sambaNTPwdHistory_len;i++) {
1922 if (memcmp(ntNewHash->hash, sambaNTPwdHistory[i].hash,
1924 if (reject_reason) {
1925 *reject_reason = SAM_PWD_CHANGE_PWD_IN_HISTORY;
1927 return NT_STATUS_PASSWORD_RESTRICTION;
1932 #define CHECK_RET(x) do { if (x != 0) return NT_STATUS_NO_MEMORY; } while(0)
1934 /* the password is acceptable. Start forming the new fields */
1935 if (new_password != NULL) {
1936 /* if we know the cleartext UTF16 password, then set it.
1937 * Modules in ldb will set all the appropriate
1939 CHECK_RET(ldb_msg_add_value(mod, "clearTextPassword", new_password, NULL));
1941 /* we don't have the cleartext, so set what we have of the
1945 CHECK_RET(samdb_msg_add_hash(ctx, mem_ctx, mod, "dBCSPwd", lmNewHash));
1949 CHECK_RET(samdb_msg_add_hash(ctx, mem_ctx, mod, "unicodePwd", ntNewHash));
1953 if (reject_reason) {
1954 *reject_reason = SAM_PWD_CHANGE_NO_ERROR;
1956 return NT_STATUS_OK;
1961 * Sets the user password using plaintext UTF16 (attribute "new_password") or
1962 * LM (attribute "lmNewHash") or NT (attribute "ntNewHash") hash. Also pass
1963 * as parameter if it's a user change or not ("userChange"). The "rejectReason"
1964 * gives some more informations if the changed failed.
1966 * This wrapper function for "samdb_set_password" takes a SID as input rather
1969 * This call encapsulates a new LDB transaction for changing the password;
1970 * therefore the user hasn't to start a new one.
1972 * Results: NT_STATUS_OK, NT_STATUS_INTERNAL_DB_CORRUPTION,
1973 * NT_STATUS_INVALID_PARAMETER, NT_STATUS_UNSUCCESSFUL,
1974 * NT_STATUS_PASSWORD_RESTRICTION
1976 NTSTATUS samdb_set_password_sid(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
1977 const struct dom_sid *user_sid,
1978 const DATA_BLOB *new_password,
1979 struct samr_Password *lmNewHash,
1980 struct samr_Password *ntNewHash,
1982 enum samPwdChangeReason *reject_reason,
1983 struct samr_DomInfo1 **_dominfo)
1986 struct ldb_dn *user_dn;
1987 struct ldb_message *msg;
1990 ret = ldb_transaction_start(ldb);
1991 if (ret != LDB_SUCCESS) {
1992 DEBUG(1, ("Failed to start transaction: %s\n", ldb_errstring(ldb)));
1993 return NT_STATUS_TRANSACTION_ABORTED;
1996 user_dn = samdb_search_dn(ldb, mem_ctx, NULL,
1997 "(&(objectSid=%s)(objectClass=user))",
1998 ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
2000 ldb_transaction_cancel(ldb);
2001 DEBUG(3, ("samdb_set_password_sid: SID %s not found in samdb, returning NO_SUCH_USER\n",
2002 dom_sid_string(mem_ctx, user_sid)));
2003 return NT_STATUS_NO_SUCH_USER;
2006 msg = ldb_msg_new(mem_ctx);
2008 ldb_transaction_cancel(ldb);
2009 talloc_free(user_dn);
2010 return NT_STATUS_NO_MEMORY;
2013 msg->dn = ldb_dn_copy(msg, user_dn);
2015 ldb_transaction_cancel(ldb);
2016 talloc_free(user_dn);
2018 return NT_STATUS_NO_MEMORY;
2021 nt_status = samdb_set_password(ldb, mem_ctx,
2024 lmNewHash, ntNewHash,
2026 reject_reason, _dominfo);
2027 if (!NT_STATUS_IS_OK(nt_status)) {
2028 ldb_transaction_cancel(ldb);
2029 talloc_free(user_dn);
2034 /* modify the samdb record */
2035 ret = samdb_replace(ldb, mem_ctx, msg);
2036 if (ret != LDB_SUCCESS) {
2037 ldb_transaction_cancel(ldb);
2038 talloc_free(user_dn);
2040 return NT_STATUS_ACCESS_DENIED;
2045 ret = ldb_transaction_commit(ldb);
2046 if (ret != LDB_SUCCESS) {
2047 DEBUG(0,("Failed to commit transaction to change password on %s: %s\n",
2048 ldb_dn_get_linearized(user_dn),
2049 ldb_errstring(ldb)));
2050 talloc_free(user_dn);
2051 return NT_STATUS_TRANSACTION_ABORTED;
2054 talloc_free(user_dn);
2055 return NT_STATUS_OK;
2059 NTSTATUS samdb_create_foreign_security_principal(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx,
2060 struct dom_sid *sid, struct ldb_dn **ret_dn)
2062 struct ldb_message *msg;
2063 struct ldb_dn *basedn;
2067 sidstr = dom_sid_string(mem_ctx, sid);
2068 NT_STATUS_HAVE_NO_MEMORY(sidstr);
2070 /* We might have to create a ForeignSecurityPrincipal, even if this user
2071 * is in our own domain */
2073 msg = ldb_msg_new(mem_ctx);
2075 return NT_STATUS_NO_MEMORY;
2078 /* TODO: Hmmm. This feels wrong. How do I find the base dn to
2079 * put the ForeignSecurityPrincipals? d_state->domain_dn does
2080 * not work, this is wrong for the Builtin domain, there's no
2081 * cn=For...,cn=Builtin,dc={BASEDN}. -- vl
2084 basedn = samdb_search_dn(sam_ctx, mem_ctx, NULL,
2085 "(&(objectClass=container)(cn=ForeignSecurityPrincipals))");
2087 if (basedn == NULL) {
2088 DEBUG(0, ("Failed to find DN for "
2089 "ForeignSecurityPrincipal container\n"));
2090 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2093 /* add core elements to the ldb_message for the alias */
2094 msg->dn = ldb_dn_copy(mem_ctx, basedn);
2095 if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s", sidstr))
2096 return NT_STATUS_NO_MEMORY;
2098 samdb_msg_add_string(sam_ctx, mem_ctx, msg,
2100 "foreignSecurityPrincipal");
2102 /* create the alias */
2103 ret = ldb_add(sam_ctx, msg);
2105 DEBUG(0,("Failed to create foreignSecurityPrincipal "
2107 ldb_dn_get_linearized(msg->dn),
2108 ldb_errstring(sam_ctx)));
2109 return NT_STATUS_INTERNAL_DB_CORRUPTION;
2112 return NT_STATUS_OK;
2117 Find the DN of a domain, assuming it to be a dotted.dns name
2120 struct ldb_dn *samdb_dns_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx, const char *dns_domain)
2123 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
2124 const char *binary_encoded;
2125 const char **split_realm;
2132 split_realm = (const char **)str_list_make(tmp_ctx, dns_domain, ".");
2134 talloc_free(tmp_ctx);
2137 dn = ldb_dn_new(mem_ctx, ldb, NULL);
2138 for (i=0; split_realm[i]; i++) {
2139 binary_encoded = ldb_binary_encode_string(tmp_ctx, split_realm[i]);
2140 if (!ldb_dn_add_base_fmt(dn, "dc=%s", binary_encoded)) {
2141 DEBUG(2, ("Failed to add dc=%s element to DN %s\n",
2142 binary_encoded, ldb_dn_get_linearized(dn)));
2143 talloc_free(tmp_ctx);
2147 if (!ldb_dn_validate(dn)) {
2148 DEBUG(2, ("Failed to validated DN %s\n",
2149 ldb_dn_get_linearized(dn)));
2155 Find the DN of a domain, be it the netbios or DNS name
2158 struct ldb_dn *samdb_domain_to_dn(struct ldb_context *ldb, TALLOC_CTX *mem_ctx,
2159 const char *domain_name)
2161 const char * const domain_ref_attrs[] = {
2164 const char * const domain_ref2_attrs[] = {
2167 struct ldb_result *res_domain_ref;
2168 char *escaped_domain = ldb_binary_encode_string(mem_ctx, domain_name);
2169 /* find the domain's DN */
2170 int ret_domain = ldb_search(ldb, mem_ctx,
2172 samdb_partitions_dn(ldb, mem_ctx),
2175 "(&(nETBIOSName=%s)(objectclass=crossRef))",
2177 if (ret_domain != 0) {
2181 if (res_domain_ref->count == 0) {
2182 ret_domain = ldb_search(ldb, mem_ctx,
2184 samdb_dns_domain_to_dn(ldb, mem_ctx, domain_name),
2187 "(objectclass=domain)");
2188 if (ret_domain != 0) {
2192 if (res_domain_ref->count == 1) {
2193 return res_domain_ref->msgs[0]->dn;
2198 if (res_domain_ref->count > 1) {
2199 DEBUG(0,("Found %d records matching domain [%s]\n",
2200 ret_domain, domain_name));
2204 return samdb_result_dn(ldb, mem_ctx, res_domain_ref->msgs[0], "nCName", NULL);
2210 use a GUID to find a DN
2212 int dsdb_find_dn_by_guid(struct ldb_context *ldb,
2213 TALLOC_CTX *mem_ctx,
2214 const char *guid_str, struct ldb_dn **dn)
2217 struct ldb_result *res;
2218 const char *attrs[] = { NULL };
2219 struct ldb_request *search_req;
2221 struct ldb_search_options_control *options;
2223 expression = talloc_asprintf(mem_ctx, "objectGUID=%s", guid_str);
2225 DEBUG(0, (__location__ ": out of memory\n"));
2226 return LDB_ERR_OPERATIONS_ERROR;
2229 res = talloc_zero(mem_ctx, struct ldb_result);
2231 DEBUG(0, (__location__ ": out of memory\n"));
2232 return LDB_ERR_OPERATIONS_ERROR;
2235 ret = ldb_build_search_req(&search_req, ldb, mem_ctx,
2236 ldb_get_default_basedn(ldb),
2240 res, ldb_search_default_callback,
2242 if (ret != LDB_SUCCESS) {
2246 /* we need to cope with cross-partition links, so search for
2247 the GUID over all partitions */
2248 options = talloc(search_req, struct ldb_search_options_control);
2249 if (options == NULL) {
2250 DEBUG(0, (__location__ ": out of memory\n"));
2251 return LDB_ERR_OPERATIONS_ERROR;
2253 options->search_options = LDB_SEARCH_OPTION_PHANTOM_ROOT;
2255 ret = ldb_request_add_control(search_req, LDB_CONTROL_EXTENDED_DN_OID, true, NULL);
2256 if (ret != LDB_SUCCESS) {
2260 ret = ldb_request_add_control(search_req,
2261 LDB_CONTROL_SEARCH_OPTIONS_OID,
2263 if (ret != LDB_SUCCESS) {
2267 ret = ldb_request(ldb, search_req);
2268 if (ret != LDB_SUCCESS) {
2272 ret = ldb_wait(search_req->handle, LDB_WAIT_ALL);
2273 if (ret != LDB_SUCCESS) {
2277 /* this really should be exactly 1, but there is a bug in the
2278 partitions module that can return two here with the
2279 search_options control set */
2280 if (res->count < 1) {
2281 return LDB_ERR_NO_SUCH_OBJECT;
2284 *dn = res->msgs[0]->dn;
2290 search for attrs on one DN, allowing for deleted objects
2292 int dsdb_search_dn_with_deleted(struct ldb_context *ldb,
2293 TALLOC_CTX *mem_ctx,
2294 struct ldb_result **_res,
2295 struct ldb_dn *basedn,
2296 const char * const *attrs)
2299 struct ldb_request *req;
2300 TALLOC_CTX *tmp_ctx;
2301 struct ldb_result *res;
2303 tmp_ctx = talloc_new(mem_ctx);
2305 res = talloc_zero(tmp_ctx, struct ldb_result);
2307 return LDB_ERR_OPERATIONS_ERROR;
2310 ret = ldb_build_search_req(&req, ldb, tmp_ctx,
2317 ldb_search_default_callback,
2319 if (ret != LDB_SUCCESS) {
2320 talloc_free(tmp_ctx);
2324 ret = ldb_request_add_control(req, LDB_CONTROL_SHOW_DELETED_OID, true, NULL);
2325 if (ret != LDB_SUCCESS) {
2329 ret = ldb_request(ldb, req);
2330 if (ret == LDB_SUCCESS) {
2331 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
2335 *_res = talloc_steal(mem_ctx, res);
2341 use a DN to find a GUID
2343 int dsdb_find_guid_by_dn(struct ldb_context *ldb,
2344 struct ldb_dn *dn, struct GUID *guid)
2347 struct ldb_result *res;
2348 const char *attrs[] = { "objectGUID", NULL };
2349 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
2351 ret = dsdb_search_dn_with_deleted(ldb, tmp_ctx, &res, dn, attrs);
2352 if (ret != LDB_SUCCESS) {
2353 talloc_free(tmp_ctx);
2356 if (res->count < 1) {
2357 talloc_free(tmp_ctx);
2358 return LDB_ERR_NO_SUCH_OBJECT;
2360 *guid = samdb_result_guid(res->msgs[0], "objectGUID");
2361 talloc_free(tmp_ctx);
2368 adds the given GUID to the given ldb_message. This value is added
2369 for the given attr_name (may be either "objectGUID" or "parentGUID").
2371 int dsdb_msg_add_guid(struct ldb_message *msg,
2373 const char *attr_name)
2378 TALLOC_CTX *tmp_ctx = talloc_init("dsdb_msg_add_guid");
2380 status = GUID_to_ndr_blob(guid, tmp_ctx, &v);
2381 if (!NT_STATUS_IS_OK(status)) {
2382 ret = LDB_ERR_OPERATIONS_ERROR;
2386 ret = ldb_msg_add_steal_value(msg, attr_name, &v);
2387 if (ret != LDB_SUCCESS) {
2388 DEBUG(4,(__location__ ": Failed to add %s to the message\n",
2396 talloc_free(tmp_ctx);
2403 use a DN to find a SID
2405 int dsdb_find_sid_by_dn(struct ldb_context *ldb,
2406 struct ldb_dn *dn, struct dom_sid *sid)
2409 struct ldb_result *res;
2410 const char *attrs[] = { "objectSID", NULL };
2411 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
2416 ret = dsdb_search_dn_with_deleted(ldb, tmp_ctx, &res, dn, attrs);
2417 if (ret != LDB_SUCCESS) {
2418 talloc_free(tmp_ctx);
2421 if (res->count < 1) {
2422 talloc_free(tmp_ctx);
2423 return LDB_ERR_NO_SUCH_OBJECT;
2425 s = samdb_result_dom_sid(tmp_ctx, res->msgs[0], "objectSID");
2427 talloc_free(tmp_ctx);
2428 return LDB_ERR_NO_SUCH_OBJECT;
2431 talloc_free(tmp_ctx);
2438 load a repsFromTo blob list for a given partition GUID
2439 attr must be "repsFrom" or "repsTo"
2441 WERROR dsdb_loadreps(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
2442 const char *attr, struct repsFromToBlob **r, uint32_t *count)
2444 const char *attrs[] = { attr, NULL };
2445 struct ldb_result *res = NULL;
2446 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
2448 struct ldb_message_element *el;
2453 if (ldb_search(sam_ctx, tmp_ctx, &res, dn, LDB_SCOPE_BASE, attrs, NULL) != LDB_SUCCESS ||
2455 DEBUG(0,("dsdb_loadreps: failed to read partition object\n"));
2456 talloc_free(tmp_ctx);
2457 return WERR_DS_DRA_INTERNAL_ERROR;
2460 el = ldb_msg_find_element(res->msgs[0], attr);
2462 /* it's OK to be empty */
2463 talloc_free(tmp_ctx);
2467 *count = el->num_values;
2468 *r = talloc_array(mem_ctx, struct repsFromToBlob, *count);
2470 talloc_free(tmp_ctx);
2471 return WERR_DS_DRA_INTERNAL_ERROR;
2474 for (i=0; i<(*count); i++) {
2475 enum ndr_err_code ndr_err;
2476 ndr_err = ndr_pull_struct_blob(&el->values[i],
2477 mem_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
2479 (ndr_pull_flags_fn_t)ndr_pull_repsFromToBlob);
2480 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2481 talloc_free(tmp_ctx);
2482 return WERR_DS_DRA_INTERNAL_ERROR;
2486 talloc_free(tmp_ctx);
2492 save the repsFromTo blob list for a given partition GUID
2493 attr must be "repsFrom" or "repsTo"
2495 WERROR dsdb_savereps(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
2496 const char *attr, struct repsFromToBlob *r, uint32_t count)
2498 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
2499 struct ldb_message *msg;
2500 struct ldb_message_element *el;
2503 msg = ldb_msg_new(tmp_ctx);
2505 if (ldb_msg_add_empty(msg, attr, LDB_FLAG_MOD_REPLACE, &el) != LDB_SUCCESS) {
2509 el->values = talloc_array(msg, struct ldb_val, count);
2514 for (i=0; i<count; i++) {
2516 enum ndr_err_code ndr_err;
2518 ndr_err = ndr_push_struct_blob(&v, tmp_ctx, lp_iconv_convenience(ldb_get_opaque(sam_ctx, "loadparm")),
2520 (ndr_push_flags_fn_t)ndr_push_repsFromToBlob);
2521 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2529 if (ldb_modify(sam_ctx, msg) != LDB_SUCCESS) {
2530 DEBUG(0,("Failed to store %s - %s\n", attr, ldb_errstring(sam_ctx)));
2534 talloc_free(tmp_ctx);
2539 talloc_free(tmp_ctx);
2540 return WERR_DS_DRA_INTERNAL_ERROR;
2545 load the uSNHighest attribute from the @REPLCHANGED object for a
2548 int dsdb_load_partition_usn(struct ldb_context *ldb, struct ldb_dn *dn, uint64_t *uSN)
2550 struct ldb_request *req;
2552 TALLOC_CTX *tmp_ctx = talloc_new(ldb);
2553 struct dsdb_control_current_partition *p_ctrl;
2554 struct ldb_result *res;
2556 res = talloc_zero(tmp_ctx, struct ldb_result);
2558 talloc_free(tmp_ctx);
2559 return LDB_ERR_OPERATIONS_ERROR;
2562 ret = ldb_build_search_req(&req, ldb, tmp_ctx,
2563 ldb_dn_new(tmp_ctx, ldb, "@REPLCHANGED"),
2567 res, ldb_search_default_callback,
2569 if (ret != LDB_SUCCESS) {
2570 talloc_free(tmp_ctx);
2574 p_ctrl = talloc(req, struct dsdb_control_current_partition);
2575 if (p_ctrl == NULL) {
2577 return LDB_ERR_OPERATIONS_ERROR;
2579 p_ctrl->version = DSDB_CONTROL_CURRENT_PARTITION_VERSION;
2583 ret = ldb_request_add_control(req,
2584 DSDB_CONTROL_CURRENT_PARTITION_OID,
2586 if (ret != LDB_SUCCESS) {
2587 talloc_free(tmp_ctx);
2591 /* Run the new request */
2592 ret = ldb_request(ldb, req);
2594 if (ret == LDB_SUCCESS) {
2595 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
2598 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2599 /* it hasn't been created yet, which means
2600 an implicit value of zero */
2602 talloc_free(tmp_ctx);
2606 if (ret != LDB_SUCCESS) {
2607 talloc_free(tmp_ctx);
2611 if (res->count < 1) {
2614 *uSN = ldb_msg_find_attr_as_uint64(res->msgs[0], "uSNHighest", 0);
2617 talloc_free(tmp_ctx);
2623 save the uSNHighest attribute in the @REPLCHANGED object for a
2626 int dsdb_save_partition_usn(struct ldb_context *ldb, struct ldb_dn *dn, uint64_t uSN)
2628 struct ldb_request *req;
2629 struct ldb_message *msg;
2630 struct dsdb_control_current_partition *p_ctrl;
2633 msg = ldb_msg_new(ldb);
2635 return LDB_ERR_OPERATIONS_ERROR;
2638 msg->dn = ldb_dn_new(msg, ldb, "@REPLCHANGED");
2639 if (msg->dn == NULL) {
2641 return LDB_ERR_OPERATIONS_ERROR;
2644 ret = ldb_msg_add_fmt(msg, "uSNHighest", "%llu", (unsigned long long)uSN);
2645 if (ret != LDB_SUCCESS) {
2649 msg->elements[0].flags = LDB_FLAG_MOD_REPLACE;
2652 p_ctrl = talloc(msg, struct dsdb_control_current_partition);
2653 if (p_ctrl == NULL) {
2655 return LDB_ERR_OPERATIONS_ERROR;
2657 p_ctrl->version = DSDB_CONTROL_CURRENT_PARTITION_VERSION;
2660 ret = ldb_build_mod_req(&req, ldb, msg,
2663 NULL, ldb_op_default_callback,
2666 if (ret != LDB_SUCCESS) {
2671 ret = ldb_request_add_control(req,
2672 DSDB_CONTROL_CURRENT_PARTITION_OID,
2674 if (ret != LDB_SUCCESS) {
2679 /* Run the new request */
2680 ret = ldb_request(ldb, req);
2682 if (ret == LDB_SUCCESS) {
2683 ret = ldb_wait(req->handle, LDB_WAIT_ALL);
2685 if (ret == LDB_ERR_NO_SUCH_OBJECT) {
2686 ret = ldb_build_add_req(&req, ldb, msg,
2689 NULL, ldb_op_default_callback,
2699 int drsuapi_DsReplicaCursor2_compare(const struct drsuapi_DsReplicaCursor2 *c1,
2700 const struct drsuapi_DsReplicaCursor2 *c2)
2702 return GUID_compare(&c1->source_dsa_invocation_id, &c2->source_dsa_invocation_id);
2706 see if we are a RODC
2708 TODO: This should take a sam_ctx, and lookup the right object (with
2711 bool samdb_rodc(struct loadparm_context *lp_ctx)
2713 return lp_parm_bool(lp_ctx, NULL, "repl", "RODC", false);
2718 return NTDS options flags. See MS-ADTS 7.1.1.2.2.1.2.1.1
2720 flags are DS_NTDS_OPTION_*
2722 int samdb_ntds_options(struct ldb_context *ldb, uint32_t *options)
2724 TALLOC_CTX *tmp_ctx;
2725 const char *attrs[] = { "options", NULL };
2727 struct ldb_result *res;
2729 tmp_ctx = talloc_new(ldb);
2730 if (tmp_ctx == NULL) {
2734 ret = ldb_search(ldb, tmp_ctx, &res, samdb_ntds_settings_dn(ldb), LDB_SCOPE_BASE, attrs, NULL);
2739 if (res->count != 1) {
2743 *options = samdb_result_uint(res->msgs[0], "options", 0);
2745 talloc_free(tmp_ctx);
2750 DEBUG(1,("Failed to find our own NTDS Settings objectGUID in the ldb!\n"));
2751 talloc_free(tmp_ctx);
2752 return LDB_ERR_NO_SUCH_OBJECT;
2756 * Function which generates a "lDAPDisplayName" attribute from a "CN" one.
2757 * Algorithm implemented according to MS-ADTS 3.1.1.2.3.4
2759 const char *samdb_cn_to_lDAPDisplayName(TALLOC_CTX *mem_ctx, const char *cn)
2761 char **tokens, *ret;
2764 tokens = str_list_make(mem_ctx, cn, " -_");
2768 /* "tolower()" and "toupper()" should also work properly on 0x00 */
2769 tokens[0][0] = tolower(tokens[0][0]);
2770 for (i = 1; i < str_list_length((const char **)tokens); i++)
2771 tokens[i][0] = toupper(tokens[i][0]);
2773 ret = talloc_strdup(mem_ctx, tokens[0]);
2774 for (i = 1; i < str_list_length((const char **)tokens); i++)
2775 ret = talloc_asprintf_append_buffer(ret, "%s", tokens[i]);
2777 talloc_free(tokens);
2783 return domain functional level
2784 returns DS_DOMAIN_FUNCTION_*
2786 int dsdb_functional_level(struct ldb_context *ldb)
2788 int *domainFunctionality =
2789 talloc_get_type(ldb_get_opaque(ldb, "domainFunctionality"), int);
2790 if (!domainFunctionality) {
2791 DEBUG(0,(__location__ ": WARNING: domainFunctionality not setup\n"));
2792 return DS_DOMAIN_FUNCTION_2000;
2794 return *domainFunctionality;
2798 set a GUID in an extended DN structure
2800 int dsdb_set_extended_dn_guid(struct ldb_dn *dn, const struct GUID *guid, const char *component_name)
2806 status = GUID_to_ndr_blob(guid, dn, &v);
2807 if (!NT_STATUS_IS_OK(status)) {
2808 return LDB_ERR_INVALID_ATTRIBUTE_SYNTAX;
2811 ret = ldb_dn_set_extended_component(dn, component_name, &v);
2817 return a GUID from a extended DN structure
2819 NTSTATUS dsdb_get_extended_dn_guid(struct ldb_dn *dn, struct GUID *guid, const char *component_name)
2821 const struct ldb_val *v;
2823 v = ldb_dn_get_extended_component(dn, component_name);
2825 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2828 return GUID_from_ndr_blob(v, guid);
2832 return a uint64_t from a extended DN structure
2834 NTSTATUS dsdb_get_extended_dn_uint64(struct ldb_dn *dn, uint64_t *val, const char *component_name)
2836 const struct ldb_val *v;
2839 v = ldb_dn_get_extended_component(dn, component_name);
2841 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2843 s = talloc_strndup(dn, (const char *)v->data, v->length);
2844 NT_STATUS_HAVE_NO_MEMORY(s);
2846 *val = strtoull(s, NULL, 0);
2849 return NT_STATUS_OK;
2853 return a NTTIME from a extended DN structure
2855 NTSTATUS dsdb_get_extended_dn_nttime(struct ldb_dn *dn, NTTIME *nttime, const char *component_name)
2857 return dsdb_get_extended_dn_uint64(dn, nttime, component_name);
2861 return a uint32_t from a extended DN structure
2863 NTSTATUS dsdb_get_extended_dn_uint32(struct ldb_dn *dn, uint32_t *val, const char *component_name)
2865 const struct ldb_val *v;
2868 v = ldb_dn_get_extended_component(dn, component_name);
2870 return NT_STATUS_OBJECT_NAME_NOT_FOUND;
2873 s = talloc_strndup(dn, (const char *)v->data, v->length);
2874 NT_STATUS_HAVE_NO_MEMORY(s);
2876 *val = strtoul(s, NULL, 0);
2879 return NT_STATUS_OK;
2883 return true if a ldb_val containing a DN in storage form is deleted
2885 bool dsdb_dn_is_deleted_val(struct ldb_val *val)
2887 /* this relies on the sort order and exact format of
2888 linearized extended DNs */
2889 if (val->length >= 12 &&
2890 strncmp((const char *)val->data, "<DELETED=1>;", 12) == 0) {
2897 return true if a ldb_val containing a DN in storage form is
2898 in the upgraded w2k3 linked attribute format
2900 bool dsdb_dn_is_upgraded_link_val(struct ldb_val *val)
2902 return memmem(val->data, val->length, "<RMD_ADDTIME=", 13) != NULL;
2906 return a DN for a wellknown GUID
2908 int dsdb_wellknown_dn(struct ldb_context *samdb, TALLOC_CTX *mem_ctx,
2909 struct ldb_dn *nc_root, const char *wk_guid,
2910 struct ldb_dn **wkguid_dn)
2912 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
2913 const char *attrs[] = { NULL };
2916 struct ldb_result *res;
2918 /* construct the magic WKGUID DN */
2919 dn = ldb_dn_new_fmt(tmp_ctx, samdb, "<WKGUID=%s,%s>",
2920 wk_guid, ldb_dn_get_linearized(nc_root));
2922 talloc_free(tmp_ctx);
2923 return LDB_ERR_OPERATIONS_ERROR;
2926 ret = dsdb_search_dn_with_deleted(samdb, tmp_ctx, &res, dn, attrs);
2927 if (ret != LDB_SUCCESS) {
2928 talloc_free(tmp_ctx);
2932 (*wkguid_dn) = talloc_steal(mem_ctx, res->msgs[0]->dn);
2933 talloc_free(tmp_ctx);
2938 static int dsdb_dn_compare_ptrs(struct ldb_dn **dn1, struct ldb_dn **dn2)
2940 return ldb_dn_compare(*dn1, *dn2);
2944 find a NC root given a DN within the NC
2946 int dsdb_find_nc_root(struct ldb_context *samdb, TALLOC_CTX *mem_ctx, struct ldb_dn *dn,
2947 struct ldb_dn **nc_root)
2949 const char *root_attrs[] = { "namingContexts", NULL };
2950 TALLOC_CTX *tmp_ctx;
2952 struct ldb_message_element *el;
2953 struct ldb_result *root_res;
2955 struct ldb_dn **nc_dns;
2957 tmp_ctx = talloc_new(samdb);
2958 if (tmp_ctx == NULL) {
2959 return LDB_ERR_OPERATIONS_ERROR;
2962 ret = ldb_search(samdb, tmp_ctx, &root_res,
2963 ldb_dn_new(tmp_ctx, samdb, ""), LDB_SCOPE_BASE, root_attrs, NULL);
2965 DEBUG(1,("Searching for namingContexts in rootDSE failed: %s\n", ldb_errstring(samdb)));
2966 talloc_free(tmp_ctx);
2970 el = ldb_msg_find_element(root_res->msgs[0], "namingContexts");
2972 DEBUG(1,("Finding namingContexts element in root_res failed: %s\n",
2973 ldb_errstring(samdb)));
2974 talloc_free(tmp_ctx);
2975 return LDB_ERR_NO_SUCH_ATTRIBUTE;
2978 nc_dns = talloc_array(tmp_ctx, struct ldb_dn *, el->num_values);
2980 talloc_free(tmp_ctx);
2981 return LDB_ERR_OPERATIONS_ERROR;
2984 for (i=0; i<el->num_values; i++) {
2985 nc_dns[i] = ldb_dn_from_ldb_val(nc_dns, samdb, &el->values[i]);
2986 if (nc_dns[i] == NULL) {
2987 talloc_free(tmp_ctx);
2988 return LDB_ERR_OPERATIONS_ERROR;
2992 qsort(nc_dns, el->num_values, sizeof(nc_dns[0]), (comparison_fn_t)dsdb_dn_compare_ptrs);
2994 for (i=0; i<el->num_values; i++) {
2995 if (ldb_dn_compare_base(nc_dns[i], dn) == 0) {
2996 (*nc_root) = talloc_steal(mem_ctx, nc_dns[i]);
2997 talloc_free(tmp_ctx);
3002 talloc_free(tmp_ctx);
3003 return LDB_ERR_NO_SUCH_OBJECT;
3008 find the deleted objects DN for any object, by looking for the NC
3009 root, then looking up the wellknown GUID
3011 int dsdb_get_deleted_objects_dn(struct ldb_context *ldb,
3012 TALLOC_CTX *mem_ctx, struct ldb_dn *obj_dn,
3013 struct ldb_dn **do_dn)
3015 struct ldb_dn *nc_root;
3018 ret = dsdb_find_nc_root(ldb, mem_ctx, obj_dn, &nc_root);
3019 if (ret != LDB_SUCCESS) {
3023 ret = dsdb_wellknown_dn(ldb, mem_ctx, nc_root, DS_GUID_DELETED_OBJECTS_CONTAINER, do_dn);
3024 talloc_free(nc_root);
3029 return the tombstoneLifetime, in days
3031 int dsdb_tombstone_lifetime(struct ldb_context *ldb, uint32_t *lifetime)
3034 dn = samdb_config_dn(ldb);
3036 return LDB_ERR_NO_SUCH_OBJECT;
3038 dn = ldb_dn_copy(ldb, dn);
3040 return LDB_ERR_OPERATIONS_ERROR;
3042 /* see MS-ADTS section 7.1.1.2.4.1.1. There doesn't appear to
3043 be a wellknown GUID for this */
3044 if (!ldb_dn_add_child_fmt(dn, "CN=Directory Service,CN=Windows NT")) {
3046 return LDB_ERR_OPERATIONS_ERROR;
3049 *lifetime = samdb_search_uint(ldb, dn, 180, dn, "tombstoneLifetime", "objectClass=nTDSService");