s4-ldap: Ldap server now loads connection limits with a system session ldb

Modified the server to use an ldb connected to with a system session, to avoid problems
if the user does not have read permission on the attributes ldap server needs to read.

diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index 946e1bf3b7dca0eee0d7865dd94a9c7489b223dc..40475f08a4e27b47d617243df04794b0bf4b6d86 100644 (file)
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -229,6 +229,7 @@ static void ldapsrv_conn_init_timeout(struct tevent_context *ev,
 static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
 {
        TALLOC_CTX *tmp_ctx;
+       struct ldb_context *ldb;
        const char *attrs[] = { "configurationNamingContext", NULL };
        const char *attrs2[] = { "lDAPAdminLimits", NULL };
        struct ldb_message_element *el;
@@ -245,18 +246,21 @@ static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
        conn->limits.max_page_size = 1000;
        conn->limits.search_timeout = 120;
 
-
        tmp_ctx = talloc_new(conn);
        if (tmp_ctx == NULL) {
                return -1;
        }
 
-       basedn = ldb_dn_new(tmp_ctx, conn->ldb, NULL);
+       /* Connect to ldb as system to read parameters */
+       ldb = samdb_connect(conn->service, conn->service->task->event_ctx,
+                           conn->lp_ctx, system_session(conn->lp_ctx));
+
+       basedn = ldb_dn_new(tmp_ctx, ldb, NULL);
        if ( ! ldb_dn_validate(basedn)) {
                goto failed;
        }
 
-       ret = ldb_search(conn->ldb, tmp_ctx, &res, basedn, LDB_SCOPE_BASE, attrs, NULL);
+       ret = ldb_search(ldb, tmp_ctx, &res, basedn, LDB_SCOPE_BASE, attrs, NULL);
        if (ret != LDB_SUCCESS) {
                goto failed;
        }
@@ -265,7 +269,7 @@ static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
                goto failed;
        }
 
-       conf_dn = ldb_msg_find_attr_as_dn(conn->ldb, tmp_ctx, res->msgs[0], "configurationNamingContext");
+       conf_dn = ldb_msg_find_attr_as_dn(ldb, tmp_ctx, res->msgs[0], "configurationNamingContext");
        if (conf_dn == NULL) {
                goto failed;
        }
@@ -276,7 +280,7 @@ static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
                goto failed;
        }
 
-       ret = ldb_search(conn->ldb, tmp_ctx, &res, policy_dn, LDB_SCOPE_BASE, attrs2, NULL);
+       ret = ldb_search(ldb, tmp_ctx, &res, policy_dn, LDB_SCOPE_BASE, attrs2, NULL);
        if (ret != LDB_SUCCESS) {
                goto failed;
        }
@@ -315,11 +319,12 @@ static int ldapsrv_load_limits(struct ldapsrv_connection *conn)
                        continue;
                }
        }
-
+       talloc_unlink(conn->service, ldb);
        return 0;
 
 failed:
        DEBUG(0, ("Failed to load ldap server query policies\n"));
+       talloc_unlink(conn->service, ldb);
        talloc_free(tmp_ctx);
        return -1;
 }