struct ldb_context *ldb = ldb_module_get_ctx(module);
struct auth_session_info *session_info
= (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
- return security_session_user_level(session_info);
+ return security_session_user_level(session_info, NULL);
}
static const char *user_name(TALLOC_CTX *mem_ctx, struct ldb_module *module)
if (next_deletion_state == OBJECT_REMOVED) {
struct auth_session_info *session_info =
(struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
- if (security_session_user_level(session_info) != SECURITY_SYSTEM) {
+ if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
ldb_asprintf_errstring(ldb, "Refusing to delete deleted object %s",
ldb_dn_get_linearized(old_msg->dn));
return LDB_ERR_UNWILLING_TO_PERFORM;
int ret;
const char *guid_string;
- if (security_session_user_level(session_info) != SECURITY_SYSTEM) {
+ if (security_session_user_level(session_info, NULL) != SECURITY_SYSTEM) {
ldb_asprintf_errstring(ldb, "rootdse: Insufficient rights for enableoptionalfeature");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
struct ldb_context *ldb = ldb_module_get_ctx(module);
struct auth_session_info *session_info
= (struct auth_session_info *)ldb_get_opaque(ldb, "sessionInfo");
- return security_session_user_level(session_info) == SECURITY_SYSTEM;
+ return security_session_user_level(session_info, NULL) == SECURITY_SYSTEM;
}
/*
#include "librpc/gen_ndr/security.h"
enum security_user_level {
- SECURITY_ANONYMOUS,
- SECURITY_USER,
- SECURITY_DOMAIN_CONTROLLER,
- SECURITY_ADMINISTRATOR,
- SECURITY_SYSTEM
+ SECURITY_ANONYMOUS = 0,
+ SECURITY_USER = 10,
+ SECURITY_RO_DOMAIN_CONTROLLER = 20,
+ SECURITY_DOMAIN_CONTROLLER = 30,
+ SECURITY_ADMINISTRATOR = 40,
+ SECURITY_SYSTEM = 50
};
struct auth_session_info;
return security_token_has_sid_string(token, SID_NT_ENTERPRISE_DCS);
}
-enum security_user_level security_session_user_level(struct auth_session_info *session_info)
+enum security_user_level security_session_user_level(struct auth_session_info *session_info,
+ const struct dom_sid *domain_sid)
{
if (!session_info) {
return SECURITY_ANONYMOUS;
return SECURITY_ADMINISTRATOR;
}
+ if (domain_sid &&
+ dom_sid_in_domain(domain_sid, session_info->security_token->user_sid)) {
+ uint32_t rid;
+ NTSTATUS status = dom_sid_split_rid(NULL, session_info->security_token->user_sid,
+ NULL, &rid);
+ if (NT_STATUS_IS_OK(status) && rid == DOMAIN_RID_ENTERPRISE_READONLY_DCS) {
+ return SECURITY_RO_DOMAIN_CONTROLLER;
+ }
+ }
+
if (security_token_has_enterprise_dcs(session_info->security_token)) {
return SECURITY_DOMAIN_CONTROLLER;
}
#include "param/param.h"
#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
#include "librpc/gen_ndr/ndr_drsuapi.h"
-
+#include "libcli/security/security.h"
/*
add special SPNs needed for DRS replication to machine accounts when
DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
b_state = h->data;
- status = drs_security_level_check(dce_call, "DsAddEntry");
+ status = drs_security_level_check(dce_call, "DsAddEntry", SECURITY_DOMAIN_CONTROLLER);
if (!W_ERROR_IS_OK(status)) {
return status;
}
W_ERROR_HAVE_NO_MEMORY(b_state);
/* if this is a DC connecting, give them system level access */
- werr = drs_security_level_check(dce_call, NULL);
+ werr = drs_security_level_check(dce_call, NULL, SECURITY_DOMAIN_CONTROLLER);
if (W_ERROR_IS_OK(werr)) {
DEBUG(3,(__location__ ": doing DsBind with system_session\n"));
auth_info = system_session(dce_call->conn->dce_ctx->lp_ctx);
{
WERROR status;
- status = drs_security_level_check(dce_call, "DsReplicaSync");
+ status = drs_security_level_check(dce_call, "DsReplicaSync", SECURITY_DOMAIN_CONTROLLER);
if (!W_ERROR_IS_OK(status)) {
return status;
}
*r->out.level_out = 1;
- status = drs_security_level_check(dce_call, "DsRemoveDSServer");
+ status = drs_security_level_check(dce_call, "DsRemoveDSServer", SECURITY_DOMAIN_CONTROLLER);
if (!W_ERROR_IS_OK(status)) {
return status;
}
struct drsuapi_DsExecuteKCC *r)
{
WERROR status;
- status = drs_security_level_check(dce_call, "DsExecuteKCC");
+ status = drs_security_level_check(dce_call, "DsExecuteKCC", SECURITY_DOMAIN_CONTROLLER);
if (!W_ERROR_IS_OK(status)) {
return status;
if (!lp_parm_bool(dce_call->conn->dce_ctx->lp_ctx, NULL,
"drs", "disable_sec_check", false)) {
- level = security_session_user_level(dce_call->conn->auth_state.session_info);
+ level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
if (level < SECURITY_ADMINISTRATOR) {
DEBUG(1,(__location__ ": Administrator access required for DsReplicaGetInfo\n"));
security_token_debug(2, dce_call->conn->auth_state.session_info->security_token);
const char * const *attrs,
const char *filter);
+enum security_user_level;
WERROR drs_security_level_check(struct dcesrv_call_state *dce_call,
- const char* call);
+ const char* call, enum security_user_level minimum_level);
void drsuapi_process_secret_attribute(struct drsuapi_DsReplicaAttribute *attr,
struct drsuapi_DsReplicaMetaData *meta_data);
return ret;
}
-WERROR drs_security_level_check(struct dcesrv_call_state *dce_call, const char* call)
+WERROR drs_security_level_check(struct dcesrv_call_state *dce_call,
+ const char* call,
+ enum security_user_level minimum_level)
{
enum security_user_level level;
return WERR_OK;
}
- level = security_session_user_level(dce_call->conn->auth_state.session_info);
- if (level < SECURITY_DOMAIN_CONTROLLER) {
+ level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
+ if (level < minimum_level) {
if (call) {
DEBUG(0,("%s refused for security token (level=%u)\n",
call, (unsigned)level));
#include "rpc_server/dcerpc_server.h"
#include "dsdb/samdb/samdb.h"
#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
+#include "libcli/security/security.h"
+#include "auth/session.h"
struct repsTo {
uint32_t count;
struct drsuapi_bind_state *b_state;
struct drsuapi_DsReplicaUpdateRefsRequest1 *req;
WERROR werr;
+ int ret;
+ enum security_user_level security_level;
DCESRV_PULL_HANDLE_WERR(h, r->in.bind_handle, DRSUAPI_BIND_HANDLE);
b_state = h->data;
- werr = drs_security_level_check(dce_call, "DsReplicaUpdateRefs");
+ werr = drs_security_level_check(dce_call, "DsReplicaUpdateRefs", SECURITY_RO_DOMAIN_CONTROLLER);
if (!W_ERROR_IS_OK(werr)) {
return werr;
}
req = &r->in.req.req1;
+ security_level = security_session_user_level(dce_call->conn->auth_state.session_info, NULL);
+ if (security_level < SECURITY_ADMINISTRATOR) {
+ /* check that they are using an invocationId that they own */
+ ret = dsdb_validate_invocation_id(b_state->sam_ctx,
+ &req->dest_dsa_guid,
+ dce_call->conn->auth_state.session_info->security_token->user_sid);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(0,(__location__ ": Refusing DsReplicaUpdateRefs for sid %s with GUID %s\n",
+ dom_sid_string(mem_ctx,
+ dce_call->conn->auth_state.session_info->security_token->user_sid),
+ GUID_string(mem_ctx, &req->dest_dsa_guid)));
+ return WERR_DS_DRA_ACCESS_DENIED;
+ }
+ }
+
return drsuapi_UpdateRefs(b_state, mem_ctx, req);
}
-
-
struct lsa_secret_state *secret_state = h->data;
/* Ensure user is permitted to delete this... */
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
struct lsa_EnumAccountRights r2;
char *dnstr;
- if (security_session_user_level(dce_call->conn->auth_state.session_info) <
+ if (security_session_user_level(dce_call->conn->auth_state.session_info, NULL) <
SECURITY_ADMINISTRATOR) {
DEBUG(0,("lsa_AddRemoveAccount refused for supplied security token\n"));
return NT_STATUS_ACCESS_DENIED;
DCESRV_PULL_HANDLE(policy_handle, r->in.handle, LSA_HANDLE_POLICY);
ZERO_STRUCTP(r->out.sec_handle);
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
return NT_STATUS_INVALID_PARAMETER;
}
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
DCESRV_PULL_HANDLE(h, r->in.sec_handle, LSA_HANDLE_SECRET);
/* Ensure user is permitted to read this... */
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
newh = dcesrv_handle_new(dce_call->context, HTYPE_REGKEY);
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
key = h->data;
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
key = h->data;
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
key = h->data;
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
DCESRV_PULL_HANDLE_FAULT(h, r->in.parent_handle, HTYPE_REGKEY);
key = h->data;
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
key = h->data;
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
key = h->data;
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR:
DCESRV_PULL_HANDLE_FAULT(h, r->in.handle, HTYPE_REGKEY);
key = h->data;
- switch (security_session_user_level(dce_call->conn->auth_state.session_info))
+ switch (security_session_user_level(dce_call->conn->auth_state.session_info, NULL))
{
case SECURITY_SYSTEM:
case SECURITY_ADMINISTRATOR: