4 LDAP semantics mapping module
6 Copyright (C) Jelmer Vernooij 2005
7 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2006
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 This module relies on ldb_map to do all the real work, but performs
25 some of the trivial mappings between AD semantics and that provided
26 by OpenLDAP and similar servers.
30 #include "ldb/include/ldb.h"
31 #include "ldb/include/ldb_private.h"
32 #include "ldb/include/ldb_errors.h"
33 #include "ldb/ldb_map/ldb_map.h"
35 #include "librpc/gen_ndr/ndr_misc.h"
36 #include "librpc/ndr/libndr.h"
37 #include "dsdb/samdb/samdb.h"
39 struct entryuuid_private {
40 struct ldb_context *ldb;
41 struct ldb_dn **base_dns;
44 static struct ldb_val encode_guid(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
47 NTSTATUS status = GUID_from_data_blob(val, &guid);
48 enum ndr_err_code ndr_err;
49 struct ldb_val out = data_blob(NULL, 0);
51 if (!NT_STATUS_IS_OK(status)) {
54 ndr_err = ndr_push_struct_blob(&out, ctx, NULL, &guid,
55 (ndr_push_flags_fn_t)ndr_push_GUID);
56 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
63 static struct ldb_val guid_always_string(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
65 struct ldb_val out = data_blob(NULL, 0);
67 NTSTATUS status = GUID_from_data_blob(val, &guid);
68 if (!NT_STATUS_IS_OK(status)) {
71 return data_blob_string_const(GUID_string(ctx, &guid));
74 static struct ldb_val encode_ns_guid(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
77 NTSTATUS status = NS_GUID_from_string((char *)val->data, &guid);
78 enum ndr_err_code ndr_err;
79 struct ldb_val out = data_blob(NULL, 0);
81 if (!NT_STATUS_IS_OK(status)) {
84 ndr_err = ndr_push_struct_blob(&out, ctx, NULL, &guid,
85 (ndr_push_flags_fn_t)ndr_push_GUID);
86 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
93 static struct ldb_val guid_ns_string(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
95 struct ldb_val out = data_blob(NULL, 0);
97 NTSTATUS status = GUID_from_data_blob(val, &guid);
98 if (!NT_STATUS_IS_OK(status)) {
101 return data_blob_string_const(NS_GUID_string(ctx, &guid));
104 /* The backend holds binary sids, so just copy them back */
105 static struct ldb_val val_copy(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
107 struct ldb_val out = data_blob(NULL, 0);
108 ldb_handler_copy(module->ldb, ctx, val, &out);
113 /* Ensure we always convert sids into binary, so the backend doesn't have to know about both forms */
114 static struct ldb_val sid_always_binary(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
116 struct ldb_val out = data_blob(NULL, 0);
117 const struct ldb_schema_attribute *a = ldb_schema_attribute_by_name(module->ldb, "objectSid");
119 if (a->syntax->canonicalise_fn(module->ldb, ctx, val, &out) != LDB_SUCCESS) {
120 return data_blob(NULL, 0);
126 /* Ensure we always convert objectCategory into a DN */
127 static struct ldb_val objectCategory_always_dn(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
130 struct ldb_val out = data_blob(NULL, 0);
131 const struct ldb_schema_attribute *a = ldb_schema_attribute_by_name(module->ldb, "objectCategory");
133 dn = ldb_dn_from_ldb_val(ctx, module->ldb, val);
134 if (dn && ldb_dn_validate(dn)) {
136 return val_copy(module, ctx, val);
140 if (a->syntax->canonicalise_fn(module->ldb, ctx, val, &out) != LDB_SUCCESS) {
141 return data_blob(NULL, 0);
147 static struct ldb_val normalise_to_signed32(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
149 long long int signed_ll = strtoll((const char *)val->data, NULL, 10);
150 if (signed_ll >= 0x80000000LL) {
153 uint32_t unsigned_int;
155 .unsigned_int = strtoul((const char *)val->data, NULL, 10)
158 struct ldb_val out = data_blob_string_const(talloc_asprintf(ctx, "%d", u.signed_int));
161 return val_copy(module, ctx, val);
164 static struct ldb_val usn_to_entryCSN(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
167 unsigned long long usn = strtoull((const char *)val->data, NULL, 10);
168 time_t t = (usn >> 24);
169 out = data_blob_string_const(talloc_asprintf(ctx, "%s#%06x#00#000000", ldb_timestring(ctx, t), (unsigned int)(usn & 0xFFFFFF)));
173 static unsigned long long entryCSN_to_usn_int(TALLOC_CTX *ctx, const struct ldb_val *val)
175 char *entryCSN = talloc_strdup(ctx, (const char *)val->data);
178 unsigned long long usn;
183 p = strchr(entryCSN, '#');
198 usn = strtol(mod_per_sec, NULL, 16);
200 t = ldb_string_to_time(entryCSN);
202 usn = usn | ((unsigned long long)t <<24);
206 static struct ldb_val entryCSN_to_usn(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
209 unsigned long long usn = entryCSN_to_usn_int(ctx, val);
210 out = data_blob_string_const(talloc_asprintf(ctx, "%lld", usn));
214 static struct ldb_val usn_to_timestamp(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
217 unsigned long long usn = strtoull((const char *)val->data, NULL, 10);
218 time_t t = (usn >> 24);
219 out = data_blob_string_const(ldb_timestring(ctx, t));
223 static struct ldb_val timestamp_to_usn(struct ldb_module *module, TALLOC_CTX *ctx, const struct ldb_val *val)
227 unsigned long long usn;
229 t = ldb_string_to_time((const char *)val->data);
231 usn = ((unsigned long long)t <<24);
233 out = data_blob_string_const(talloc_asprintf(ctx, "%lld", usn));
238 static const struct ldb_map_attribute entryuuid_attributes[] =
242 .local_name = "objectGUID",
246 .remote_name = "entryUUID",
247 .convert_local = guid_always_string,
248 .convert_remote = encode_guid,
254 .local_name = "invocationId",
258 .remote_name = "invocationId",
259 .convert_local = guid_always_string,
260 .convert_remote = encode_guid,
266 .local_name = "objectSid",
270 .remote_name = "objectSid",
271 .convert_local = sid_always_binary,
272 .convert_remote = val_copy,
277 .local_name = "name",
281 .remote_name = "samba4RDN"
286 .local_name = "whenCreated",
290 .remote_name = "createTimestamp"
295 .local_name = "whenChanged",
299 .remote_name = "modifyTimestamp"
304 .local_name = "objectClasses",
308 .remote_name = "samba4ObjectClasses"
313 .local_name = "dITContentRules",
317 .remote_name = "samba4DITContentRules"
322 .local_name = "attributeTypes",
326 .remote_name = "samba4AttributeTypes"
331 .local_name = "objectCategory",
335 .remote_name = "objectCategory",
336 .convert_local = objectCategory_always_dn,
337 .convert_remote = val_copy,
342 .local_name = "distinguishedName",
346 .remote_name = "entryDN"
351 .local_name = "groupType",
355 .remote_name = "groupType",
356 .convert_local = normalise_to_signed32,
357 .convert_remote = val_copy,
362 .local_name = "sAMAccountType",
366 .remote_name = "sAMAccountType",
367 .convert_local = normalise_to_signed32,
368 .convert_remote = val_copy,
373 .local_name = "usnChanged",
377 .remote_name = "entryCSN",
378 .convert_local = usn_to_entryCSN,
379 .convert_remote = entryCSN_to_usn
384 .local_name = "usnCreated",
388 .remote_name = "createTimestamp",
389 .convert_local = usn_to_timestamp,
390 .convert_remote = timestamp_to_usn,
403 /* This objectClass conflicts with builtin classes on OpenLDAP */
404 const struct ldb_map_objectclass entryuuid_objectclasses[] =
407 .local_name = "subSchema",
408 .remote_name = "samba4SubSchema"
415 /* These things do not show up in wildcard searches in OpenLDAP, but
416 * we need them to show up in the AD-like view */
417 static const char * const entryuuid_wildcard_attributes[] = {
427 static const struct ldb_map_attribute nsuniqueid_attributes[] =
431 .local_name = "objectGUID",
435 .remote_name = "nsuniqueid",
436 .convert_local = guid_ns_string,
437 .convert_remote = encode_ns_guid,
443 .local_name = "objectSid",
447 .remote_name = "objectSid",
448 .convert_local = sid_always_binary,
449 .convert_remote = val_copy,
454 .local_name = "whenCreated",
458 .remote_name = "createTimestamp"
463 .local_name = "whenChanged",
467 .remote_name = "modifyTimestamp"
472 .local_name = "objectCategory",
476 .remote_name = "objectCategory",
477 .convert_local = objectCategory_always_dn,
478 .convert_remote = val_copy,
483 .local_name = "distinguishedName",
487 .remote_name = "entryDN"
492 .local_name = "groupType",
496 .remote_name = "groupType",
497 .convert_local = normalise_to_signed32,
498 .convert_remote = val_copy,
503 .local_name = "sAMAccountType",
507 .remote_name = "sAMAccountType",
508 .convert_local = normalise_to_signed32,
509 .convert_remote = val_copy,
514 .local_name = "usnChanged",
518 .remote_name = "modifyTimestamp",
519 .convert_local = usn_to_timestamp,
520 .convert_remote = timestamp_to_usn,
525 .local_name = "usnCreated",
529 .remote_name = "createTimestamp",
530 .convert_local = usn_to_timestamp,
531 .convert_remote = timestamp_to_usn,
544 /* These things do not show up in wildcard searches in OpenLDAP, but
545 * we need them to show up in the AD-like view */
546 static const char * const nsuniqueid_wildcard_attributes[] = {
555 /* the context init function */
556 static int entryuuid_init(struct ldb_module *module)
559 ret = ldb_map_init(module, entryuuid_attributes, entryuuid_objectclasses, entryuuid_wildcard_attributes, "samba4Top", NULL);
560 if (ret != LDB_SUCCESS)
563 return ldb_next_init(module);
566 /* the context init function */
567 static int nsuniqueid_init(struct ldb_module *module)
570 ret = ldb_map_init(module, nsuniqueid_attributes, NULL, nsuniqueid_wildcard_attributes, "extensibleObject", NULL);
571 if (ret != LDB_SUCCESS)
574 return ldb_next_init(module);
577 static int get_seq_callback(struct ldb_request *req,
578 struct ldb_reply *ares)
580 unsigned long long *seq = (unsigned long long *)req->context;
583 return ldb_request_done(req, LDB_ERR_OPERATIONS_ERROR);
585 if (ares->error != LDB_SUCCESS) {
586 return ldb_request_done(req, ares->error);
589 if (ares->type == LDB_REPLY_ENTRY) {
590 struct ldb_message_element *el = ldb_msg_find_element(ares->message, "contextCSN");
592 *seq = entryCSN_to_usn_int(ares, &el->values[0]);
596 if (ares->type == LDB_REPLY_DONE) {
597 return ldb_request_done(req, LDB_SUCCESS);
604 static int entryuuid_sequence_number(struct ldb_module *module, struct ldb_request *req)
607 struct map_private *map_private;
608 struct entryuuid_private *entryuuid_private;
609 unsigned long long seq_num = 0;
610 struct ldb_request *search_req;
612 const struct ldb_control *partition_ctrl;
613 const struct dsdb_control_current_partition *partition;
615 static const char *contextCSN_attr[] = {
619 struct ldb_seqnum_request *seq;
620 struct ldb_seqnum_result *seqr;
621 struct ldb_extended *ext;
623 seq = talloc_get_type(req->op.extended.data, struct ldb_seqnum_request);
625 map_private = talloc_get_type(module->private_data, struct map_private);
627 entryuuid_private = talloc_get_type(map_private->caller_private, struct entryuuid_private);
629 /* All this to get the DN of the parition, so we can search the right thing */
630 partition_ctrl = ldb_request_get_control(req, DSDB_CONTROL_CURRENT_PARTITION_OID);
631 if (!partition_ctrl) {
632 ldb_debug_set(module->ldb, LDB_DEBUG_FATAL,
633 "entryuuid_sequence_number: no current partition control found");
634 return LDB_ERR_CONSTRAINT_VIOLATION;
637 partition = talloc_get_type(partition_ctrl->data,
638 struct dsdb_control_current_partition);
639 SMB_ASSERT(partition && partition->version == DSDB_CONTROL_CURRENT_PARTITION_VERSION);
641 ret = ldb_build_search_req(&search_req, module->ldb, req,
642 partition->dn, LDB_SCOPE_BASE,
643 NULL, contextCSN_attr, NULL,
644 &seq_num, get_seq_callback,
646 if (ret != LDB_SUCCESS) {
650 ret = ldb_next_request(module, search_req);
652 if (ret == LDB_SUCCESS) {
653 ret = ldb_wait(search_req->handle, LDB_WAIT_ALL);
656 talloc_free(search_req);
657 if (ret != LDB_SUCCESS) {
661 ext = talloc_zero(req, struct ldb_extended);
663 return LDB_ERR_OPERATIONS_ERROR;
665 seqr = talloc_zero(req, struct ldb_seqnum_result);
668 return LDB_ERR_OPERATIONS_ERROR;
670 ext->oid = LDB_EXTENDED_SEQUENCE_NUMBER;
674 case LDB_SEQ_HIGHEST_SEQ:
675 seqr->seq_num = seq_num;
678 seqr->seq_num = seq_num;
681 case LDB_SEQ_HIGHEST_TIMESTAMP:
683 seqr->seq_num = (seq_num >> 24);
688 seqr->flags |= LDB_SEQ_TIMESTAMP_SEQUENCE;
689 seqr->flags |= LDB_SEQ_GLOBAL_SEQUENCE;
691 /* send request done */
692 return ldb_module_done(req, NULL, ext, LDB_SUCCESS);
695 static int entryuuid_extended(struct ldb_module *module, struct ldb_request *req)
697 if (strcmp(req->op.extended.oid, LDB_EXTENDED_SEQUENCE_NUMBER) == 0) {
698 return entryuuid_sequence_number(module, req);
701 return ldb_next_request(module, req);
704 _PUBLIC_ const struct ldb_module_ops ldb_entryuuid_module_ops = {
706 .init_context = entryuuid_init,
707 .extended = entryuuid_extended,
711 _PUBLIC_ const struct ldb_module_ops ldb_nsuniqueid_module_ops = {
712 .name = "nsuniqueid",
713 .init_context = nsuniqueid_init,
714 .extended = entryuuid_extended,