- static const char * const attrs[3] = { "nextRid", "name", NULL };
- struct ldb_request *req;
- NTSTATUS status;
- char *filter;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if (ac->sid == NULL) {
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- status = dom_sid_split_rid(ac, ac->sid, &ac->domain_sid, NULL);
- if (!NT_STATUS_IS_OK(status)) {
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- filter = talloc_asprintf(ac, "(&(objectSid=%s)(objectclass=domain))",
- ldap_encode_ndr_dom_sid(ac, ac->domain_sid));
- if (filter == NULL) {
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- ret = ldb_build_search_req(&req, ldb, ac,
- ldb_get_default_basedn(ldb),
- LDB_SCOPE_SUBTREE,
- filter, attrs,
- NULL,
- ac, samldb_foreign_notice_sid_callback,
- ac->req);
-
- if (ret != LDB_SUCCESS) {
- return ret;
- }
-
- return ldb_next_request(ac->module, req);
-}
-
-
-static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- ac->next_rid = 0;
-
- ac->sid = samdb_result_dom_sid(ac->msg, ac->msg, "objectSid");
- if (ac->sid == NULL) {
- ac->sid = dom_sid_parse_talloc(ac->msg,
- (const char *)ldb_dn_get_rdn_val(ac->msg->dn)->data);
- if (!ac->sid) {
- ldb_set_errstring(ldb,
- "No valid SID found in "
- "ForeignSecurityPrincipal CN!\n");
- talloc_free(ac);
- return LDB_ERR_CONSTRAINT_VIOLATION;
- }
- if ( ! samldb_msg_add_sid(ac->msg, "objectSid", ac->sid)) {
- talloc_free(ac);
- return LDB_ERR_OPERATIONS_ERROR;
- }
- }
-
- /* check if we need to notice this SID */
- ret = samldb_add_step(ac, samldb_foreign_notice_sid);
- if (ret != LDB_SUCCESS) return ret;
-
- /* finally proceed with adding the entry */
- ret = samldb_add_step(ac, samldb_add_entry);
- if (ret != LDB_SUCCESS) return ret;
-
- return samldb_first_step(ac);
-}
-
-static int samldb_check_rdn(struct ldb_module *module, struct ldb_dn *dn)
-{
- struct ldb_context *ldb;
- const char *rdn_name;
-
- ldb = ldb_module_get_ctx(module);
- rdn_name = ldb_dn_get_rdn_name(dn);
-
- if (strcasecmp(rdn_name, "cn") != 0) {
- ldb_asprintf_errstring(ldb,
- "Bad RDN (%s=) for samldb object, "
- "should be CN=!\n", rdn_name);
- return LDB_ERR_CONSTRAINT_VIOLATION;
- }
-
- return LDB_SUCCESS;
-}
-
-/*
- * samldb_sid_from_dn (async)
- */
-
-static int samldb_sid_from_dn(struct samldb_ctx *ac);
-
-static int samldb_sid_from_dn_callback(struct ldb_request *req,
- struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
- if (ares->error != LDB_SUCCESS) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- /* save entry */
- if (ac->res_sid != NULL) {
- /* one too many! */
- ldb_set_errstring(ldb,
- "Invalid number of results while searching "
- "for domain objects!\n");
- ret = LDB_ERR_OPERATIONS_ERROR;
- break;
- }
- ac->res_sid = samdb_result_dom_sid(ac, ares->message,
- "objectSid");
-
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
-
- /* found or not found, go on */
- ret = samldb_next_step(ac);
- break;
- }
-
-done:
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
-/* Finds the SID "res_sid" of an object with a given DN "dn" */
-static int samldb_sid_from_dn(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- static const char * const attrs[] = { "objectSid", NULL };
- struct ldb_request *req;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if (ac->dn == NULL)
- return LDB_ERR_OPERATIONS_ERROR;
-
- ret = ldb_build_search_req(&req, ldb, ac,
- ac->dn,
- LDB_SCOPE_BASE,
- NULL, attrs,
- NULL,
- ac, samldb_sid_from_dn_callback,
- ac->req);
- if (ret != LDB_SUCCESS)
- return ret;
-
- return ldb_next_request(ac->module, req);
-}
-
-/*
- * samldb_user_dn_to_prim_group_rid (async)
- */
-
-static int samldb_user_dn_to_prim_group_rid(struct samldb_ctx *ac);
-
-static int samldb_user_dn_to_prim_group_rid_callback(struct ldb_request *req,
- struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
- if (ares->error != LDB_SUCCESS) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- /* save entry */
- if (ac->prim_group_rid != 0) {
- /* one too many! */
- ldb_set_errstring(ldb,
- "Invalid number of results while searching "
- "for domain objects!\n");
- ret = LDB_ERR_OPERATIONS_ERROR;
- break;
- }
- ac->prim_group_rid = samdb_result_uint(ares->message,
- "primaryGroupID", ~0);
-
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
- if (ac->prim_group_rid == 0) {
- ldb_asprintf_errstring(ldb,
- "Unable to get the primary group RID!\n");
- ret = LDB_ERR_OPERATIONS_ERROR;
- break;
- }
-
- /* found, go on */
- ret = samldb_next_step(ac);
- break;
- }
-
-done:
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
-/* Locates the "primaryGroupID" attribute from a certain user specified as
- * "user_dn". Saves the result in "prim_group_rid". */
-static int samldb_user_dn_to_prim_group_rid(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- static const char * const attrs[] = { "primaryGroupID", NULL };
- struct ldb_request *req;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if (ac->user_dn == NULL)
- return LDB_ERR_OPERATIONS_ERROR;
-
- ret = ldb_build_search_req(&req, ldb, ac,
- ac->user_dn,
- LDB_SCOPE_BASE,
- NULL, attrs,
- NULL,
- ac, samldb_user_dn_to_prim_group_rid_callback,
- ac->req);
- if (ret != LDB_SUCCESS)
- return ret;
-
- return ldb_next_request(ac->module, req);
-}
-
-/*
- * samldb_prim_group_rid_to_users_cnt (async)
- */
-
-static int samldb_prim_group_rid_to_users_cnt(struct samldb_ctx *ac);
-
-static int samldb_prim_group_rid_to_users_cnt_callback(struct ldb_request *req,
- struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
- if (ares->error != LDB_SUCCESS) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- /* save entry */
- ++(ac->users_cnt);
-
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
-
- /* found or not found, go on */
- ret = samldb_next_step(ac);
- break;
- }
-
-done:
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
-/* Finds the amount of users which have the primary group "prim_group_rid" and
- * save the result in "users_cnt" */
-static int samldb_prim_group_rid_to_users_cnt(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- static const char * const attrs[] = { NULL };
- struct ldb_request *req;
- char *filter;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if ((ac->prim_group_rid == 0) || (ac->users_cnt != 0))
- return LDB_ERR_OPERATIONS_ERROR;
-
- filter = talloc_asprintf(ac, "(&(primaryGroupID=%u)(objectclass=user))",
- ac->prim_group_rid);
- if (filter == NULL)
- return LDB_ERR_OPERATIONS_ERROR;
-
- ret = ldb_build_search_req(&req, ldb, ac,
- ldb_get_default_basedn(ldb),
- LDB_SCOPE_SUBTREE,
- filter, attrs,
- NULL,
- ac,
- samldb_prim_group_rid_to_users_cnt_callback,
- ac->req);
- if (ret != LDB_SUCCESS)
- return ret;
-
- return ldb_next_request(ac->module, req);
-}
-
-/*
- * samldb_group_add_member (async)
- * samldb_group_del_member (async)
- */
-
-static int samldb_group_add_del_member_callback(struct ldb_request *req,
- struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
- if (ares->error != LDB_SUCCESS) {
- if (ares->error == LDB_ERR_NO_SUCH_ATTRIBUTE) {
- /* On error "NO_SUCH_ATTRIBUTE" (delete of an invalid
- * "member" attribute) return "UNWILLING_TO_PERFORM" */
- ares->error = LDB_ERR_UNWILLING_TO_PERFORM;
- }
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
- if (ares->type != LDB_REPLY_DONE) {
- ldb_set_errstring(ldb,
- "Invalid reply type!\n");
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
-
- ret = samldb_next_step(ac);
-
-done:
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
-/* Adds a member with DN "member_dn" to a group with DN "group_dn" */
-static int samldb_group_add_member(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- struct ldb_request *req;
- struct ldb_message *msg;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if ((ac->group_dn == NULL) || (ac->member_dn == NULL))
- return LDB_ERR_OPERATIONS_ERROR;
-
- msg = ldb_msg_new(ac);
- msg->dn = ac->group_dn;
- samdb_msg_add_addval(ldb, ac, msg, "member",
- ldb_dn_get_linearized(ac->member_dn));
-
- ret = ldb_build_mod_req(&req, ldb, ac,
- msg, NULL,
- ac, samldb_group_add_del_member_callback,
- ac->req);
- if (ret != LDB_SUCCESS)
- return ret;
-
- return ldb_next_request(ac->module, req);
-}
-
-/* Removes a member with DN "member_dn" from a group with DN "group_dn" */
-static int samldb_group_del_member(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- struct ldb_request *req;
- struct ldb_message *msg;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if ((ac->group_dn == NULL) || (ac->member_dn == NULL))
- return LDB_ERR_OPERATIONS_ERROR;
-
- msg = ldb_msg_new(ac);
- msg->dn = ac->group_dn;
- samdb_msg_add_delval(ldb, ac, msg, "member",
- ldb_dn_get_linearized(ac->member_dn));
-
- ret = ldb_build_mod_req(&req, ldb, ac,
- msg, NULL,
- ac, samldb_group_add_del_member_callback,
- ac->req);
- if (ret != LDB_SUCCESS)
- return ret;
-
- return ldb_next_request(ac->module, req);
-}
-
-
-static int samldb_prim_group_change_1(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- uint32_t rid;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- ac->user_dn = ac->msg->dn;
-
- rid = samdb_result_uint(ac->msg, "primaryGroupID", ~0);
- ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
- if (ac->sid == NULL)
- return LDB_ERR_OPERATIONS_ERROR;
- ac->res_dn = NULL;
-
- ac->prim_group_rid = 0;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_prim_group_change_2(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if (ac->res_dn != NULL)
- ac->new_prim_group_dn = ac->res_dn;
- else
- return LDB_ERR_UNWILLING_TO_PERFORM;
-
- ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb),
- ac->prim_group_rid);
- if (ac->sid == NULL)
- return LDB_ERR_OPERATIONS_ERROR;
- ac->res_dn = NULL;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_prim_group_change_4(struct samldb_ctx *ac);
-static int samldb_prim_group_change_5(struct samldb_ctx *ac);
-static int samldb_prim_group_change_6(struct samldb_ctx *ac);
-
-static int samldb_prim_group_change_3(struct samldb_ctx *ac)
-{
- int ret;
-
- if (ac->res_dn != NULL)
- ac->old_prim_group_dn = ac->res_dn;
- else
- return LDB_ERR_UNWILLING_TO_PERFORM;
-
- /* Only update when the primary group changed */
- if (ldb_dn_compare(ac->old_prim_group_dn, ac->new_prim_group_dn) != 0) {
- ac->member_dn = ac->user_dn;
- /* Remove the "member" attribute of the actual (new) primary
- * group */
-
- ret = samldb_add_step(ac, samldb_prim_group_change_4);
- if (ret != LDB_SUCCESS) return ret;
-
- ret = samldb_add_step(ac, samldb_group_del_member);
- if (ret != LDB_SUCCESS) return ret;
-
- /* Add a "member" attribute for the previous primary group */
-
- ret = samldb_add_step(ac, samldb_prim_group_change_5);
- if (ret != LDB_SUCCESS) return ret;
-
- ret = samldb_add_step(ac, samldb_group_add_member);
- if (ret != LDB_SUCCESS) return ret;
- }
-
- ret = samldb_add_step(ac, samldb_prim_group_change_6);
- if (ret != LDB_SUCCESS) return ret;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_prim_group_change_4(struct samldb_ctx *ac)
-{
- ac->group_dn = ac->new_prim_group_dn;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_prim_group_change_5(struct samldb_ctx *ac)
-{
- ac->group_dn = ac->old_prim_group_dn;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_prim_group_change_6(struct samldb_ctx *ac)
-{
- return ldb_next_request(ac->module, ac->req);
-}
-
-static int samldb_prim_group_change(struct samldb_ctx *ac)
-{