4 Copyright (C) Andrew Bartlett 2010
5 Copyright (C) Andrew Tridgell 2010
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 add objectSid to users and groups using samba3 nextRid method
26 #include "libcli/ldap/ldap_ndr.h"
27 #include "ldb_module.h"
28 #include "dsdb/samdb/samdb.h"
29 #include "dsdb/samdb/ldb_modules/util.h"
30 #include "libcli/security/security.h"
31 #include "librpc/gen_ndr/ndr_security.h"
33 #include "param/param.h"
36 RID algorithm from pdb_ldap.c in source3/passdb/
37 (loosely based on Volkers code)
39 static int samba3sid_next_sid(struct ldb_module *module,
40 TALLOC_CTX *mem_ctx, char **sid)
42 TALLOC_CTX *tmp_ctx = talloc_new(mem_ctx);
43 struct ldb_result *res;
44 const char *attrs[] = { "sambaNextRid", "sambaNextUserRid",
45 "sambaNextGroupRid", "sambaSID", NULL };
47 struct ldb_context *ldb = ldb_module_get_ctx(module);
48 struct ldb_message *msg;
49 uint32_t sambaNextRid, sambaNextGroupRid, sambaNextUserRid, rid;
52 ret = dsdb_module_search(module, tmp_ctx, &res, NULL, LDB_SCOPE_SUBTREE,
54 DSDB_FLAG_NEXT_MODULE |
55 DSDB_SEARCH_SEARCH_ALL_PARTITIONS,
56 "(&(objectClass=sambaDomain)(sambaDomainName=%s))",
57 lpcfg_sam_name(ldb_get_opaque(ldb, "loadparm")));
58 if (ret != LDB_SUCCESS) {
59 ldb_asprintf_errstring(ldb,
61 ": Failed to find domain object - %s",
66 if (res->count != 1) {
67 ldb_asprintf_errstring(ldb,
69 ": Expected exactly 1 domain object - got %u",
72 return LDB_ERR_OPERATIONS_ERROR;
76 sambaNextRid = ldb_msg_find_attr_as_uint(msg, "sambaNextRid",
78 sambaNextUserRid = ldb_msg_find_attr_as_uint(msg, "sambaNextUserRid",
80 sambaNextGroupRid = ldb_msg_find_attr_as_uint(msg, "sambaNextGroupRid",
82 sambaSID = ldb_msg_find_attr_as_string(msg, "sambaSID", NULL);
84 if (sambaSID == NULL) {
85 ldb_asprintf_errstring(ldb,
87 ": No sambaSID in %s",
88 ldb_dn_get_linearized(msg->dn));
90 return LDB_ERR_OPERATIONS_ERROR;
93 /* choose the highest of the 3 - see pdb_ldap.c for an
96 if ((sambaNextUserRid != (uint32_t) -1) && (sambaNextUserRid > rid)) {
97 rid = sambaNextUserRid;
99 if ((sambaNextGroupRid != (uint32_t) -1) && (sambaNextGroupRid > rid)) {
100 rid = sambaNextGroupRid;
102 if (rid == (uint32_t) -1) {
103 ldb_asprintf_errstring(ldb,
105 ": No sambaNextRid in %s",
106 ldb_dn_get_linearized(msg->dn));
107 talloc_free(tmp_ctx);
108 return LDB_ERR_OPERATIONS_ERROR;
111 /* sambaNextRid is actually the previous RID .... */
114 (*sid) = talloc_asprintf(tmp_ctx, "%s-%u", sambaSID, rid);
116 talloc_free(tmp_ctx);
117 return ldb_module_oom(module);
120 ret = dsdb_module_constrainted_update_uint32(module, msg->dn,
122 &sambaNextRid, &rid);
123 if (ret != LDB_SUCCESS) {
124 ldb_asprintf_errstring(ldb,
126 ": Failed to update sambaNextRid - %s",
128 talloc_free(tmp_ctx);
132 talloc_steal(mem_ctx, *sid);
133 talloc_free(tmp_ctx);
140 static int samba3sid_add(struct ldb_module *module, struct ldb_request *req)
142 struct ldb_context *ldb;
144 const struct ldb_message *msg = req->op.add.message;
145 struct ldb_message *new_msg;
147 struct ldb_request *new_req;
149 ldb = ldb_module_get_ctx(module);
151 /* do not manipulate our control entries */
152 if (ldb_dn_is_special(req->op.add.message->dn)) {
153 return ldb_next_request(module, req);
156 if (!samdb_find_attribute(ldb, msg, "objectclass", "posixAccount") &&
157 !samdb_find_attribute(ldb, msg, "objectclass", "posixGroup")) {
158 /* its not a user or a group */
159 return ldb_next_request(module, req);
162 if (ldb_msg_find_element(msg, "sambaSID")) {
163 /* a SID was supplied */
164 return ldb_next_request(module, req);
167 new_msg = ldb_msg_copy_shallow(req, req->op.add.message);
169 return ldb_module_oom(module);
172 ret = samba3sid_next_sid(module, new_msg, &sid);
173 if (ret != LDB_SUCCESS) {
177 ret = ldb_msg_add_steal_string(new_msg, "sambaSID", sid);
178 if (ret != LDB_SUCCESS) {
182 ret = ldb_build_add_req(&new_req, ldb, req,
185 req, dsdb_next_callback,
187 LDB_REQ_SET_LOCATION(new_req);
188 if (ret != LDB_SUCCESS) {
192 return ldb_next_request(module, new_req);
195 static const struct ldb_module_ops ldb_samba3sid_module_ops = {
197 .add = samba3sid_add,
201 int ldb_samba3sid_module_init(const char *version)
203 LDB_MODULE_CHECK_VERSION(version);
204 return ldb_register_module(&ldb_samba3sid_module_ops);