struct ldb_reply *search_res;
+ struct ldb_message *update_msg;
+
struct dsdb_control_password_change_status *status;
struct dsdb_control_password_change *change;
bool change_status;
bool hash_values;
bool userPassword;
+ bool update_password;
+ bool update_lastset;
bool pwd_last_set_bypass;
};
{
struct ldb_context *ldb;
struct supplementalCredentialsBlob scb;
- struct supplementalCredentialsBlob _old_scb;
struct supplementalCredentialsBlob *old_scb = NULL;
/* Packages + (Kerberos-Newer-Keys, Kerberos, WDigest and CLEARTEXT) */
uint32_t num_names = 0;
return LDB_SUCCESS;
}
- /* if there's an old supplementaCredentials blob then parse it */
+ /* if there's an old supplementaCredentials blob then use it */
if (io->o.supplemental) {
- ndr_err = ndr_pull_struct_blob_all(io->o.supplemental, io->ac,
- &_old_scb,
- (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
- if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
- NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
- ldb_asprintf_errstring(ldb,
- "setup_supplemental_field: "
- "failed to pull old supplementalCredentialsBlob: %s",
- nt_errstr(status));
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- if (_old_scb.sub.signature == SUPPLEMENTAL_CREDENTIALS_SIGNATURE) {
- old_scb = &_old_scb;
+ if (io->o.scb.sub.signature == SUPPLEMENTAL_CREDENTIALS_SIGNATURE) {
+ old_scb = &io->o.scb;
} else {
ldb_debug(ldb, LDB_DEBUG_ERROR,
- "setup_supplemental_field: "
- "supplementalCredentialsBlob signature[0x%04X] expected[0x%04X]",
- _old_scb.sub.signature, SUPPLEMENTAL_CREDENTIALS_SIGNATURE);
+ "setup_supplemental_field: "
+ "supplementalCredentialsBlob "
+ "signature[0x%04X] expected[0x%04X]",
+ io->o.scb.sub.signature,
+ SUPPLEMENTAL_CREDENTIALS_SIGNATURE);
}
}
/* Per MS-SAMR 3.1.1.8.11.6 we create AES keys if our domain functionality level is 2008 or higher */
return LDB_SUCCESS;
}
+static int update_final_msg(struct setup_password_fields_io *io)
+{
+ struct ldb_context *ldb = ldb_module_get_ctx(io->ac->module);
+ int ret;
+ int el_flags = 0;
+
+ if (io->ac->req->operation == LDB_MODIFY) {
+ el_flags |= LDB_FLAG_MOD_REPLACE;
+ }
+
+ /* make sure we replace all the old attributes */
+ if (io->ac->update_password && el_flags != 0) {
+ ret = ldb_msg_add_empty(io->ac->update_msg,
+ "unicodePwd",
+ el_flags, NULL);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ ret = ldb_msg_add_empty(io->ac->update_msg,
+ "dBCSPwd",
+ el_flags, NULL);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ ret = ldb_msg_add_empty(io->ac->update_msg,
+ "ntPwdHistory",
+ el_flags, NULL);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ ret = ldb_msg_add_empty(io->ac->update_msg,
+ "lmPwdHistory",
+ el_flags, NULL);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ ret = ldb_msg_add_empty(io->ac->update_msg,
+ "supplementalCredentials",
+ el_flags, NULL);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+ if (io->ac->update_lastset && el_flags != 0) {
+ ret = ldb_msg_add_empty(io->ac->update_msg,
+ "pwdLastSet",
+ el_flags, NULL);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+
+ if (io->g.nt_hash != NULL) {
+ ret = samdb_msg_add_hash(ldb, io->ac,
+ io->ac->update_msg,
+ "unicodePwd",
+ io->g.nt_hash);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+ if (io->g.lm_hash != NULL) {
+ ret = samdb_msg_add_hash(ldb, io->ac,
+ io->ac->update_msg,
+ "dBCSPwd",
+ io->g.lm_hash);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+ if (io->g.nt_history_len > 0) {
+ ret = samdb_msg_add_hashes(ldb, io->ac,
+ io->ac->update_msg,
+ "ntPwdHistory",
+ io->g.nt_history,
+ io->g.nt_history_len);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+ if (io->g.lm_history_len > 0) {
+ ret = samdb_msg_add_hashes(ldb, io->ac,
+ io->ac->update_msg,
+ "lmPwdHistory",
+ io->g.lm_history,
+ io->g.lm_history_len);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+ if (io->g.supplemental.length > 0) {
+ ret = ldb_msg_add_value(io->ac->update_msg,
+ "supplementalCredentials",
+ &io->g.supplemental, NULL);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+ ret = samdb_msg_add_uint64(ldb, io->ac,
+ io->ac->update_msg,
+ "pwdLastSet",
+ io->g.last_set);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+
+ return LDB_SUCCESS;
+}
+
/*
* This is intended for use by the "password_hash" module since there
* password changes can be specified through one message element with the
}
static int setup_io(struct ph_context *ac,
- const struct ldb_message *orig_msg,
- const struct ldb_message *searched_msg,
+ const struct ldb_message *client_msg,
+ const struct ldb_message *existing_msg,
struct setup_password_fields_io *io)
{
const struct ldb_val *quoted_utf16, *old_quoted_utf16, *lm_hash, *old_lm_hash;
struct loadparm_context *lp_ctx = talloc_get_type(
ldb_get_opaque(ldb, "loadparm"), struct loadparm_context);
int ret;
+ const struct ldb_message *info_msg = NULL;
ZERO_STRUCTP(io);
/* Some operations below require kerberos contexts */
+ if (existing_msg != NULL) {
+ /*
+ * This is a modify operation
+ */
+ info_msg = existing_msg;
+ } else {
+ /*
+ * This is an add operation
+ */
+ info_msg = client_msg;
+ }
+
if (smb_krb5_init_context(ac,
(struct loadparm_context *)ldb_get_opaque(ldb, "loadparm"),
&io->smb_krb5_context) != 0) {
io->ac = ac;
- io->u.userAccountControl = ldb_msg_find_attr_as_uint(searched_msg,
+ io->u.userAccountControl = ldb_msg_find_attr_as_uint(info_msg,
"userAccountControl", 0);
- io->u.pwdLastSet = samdb_result_nttime(searched_msg, "pwdLastSet", 0);
- io->u.sAMAccountName = ldb_msg_find_attr_as_string(searched_msg,
+ if (info_msg == existing_msg) {
+ /*
+ * We only take pwdLastSet from the existing object
+ * otherwise we leave it as 0.
+ */
+ io->u.pwdLastSet = samdb_result_nttime(info_msg, "pwdLastSet", 0);
+ }
+ io->u.sAMAccountName = ldb_msg_find_attr_as_string(info_msg,
"sAMAccountName", NULL);
- io->u.user_principal_name = ldb_msg_find_attr_as_string(searched_msg,
+ io->u.user_principal_name = ldb_msg_find_attr_as_string(info_msg,
"userPrincipalName", NULL);
- io->u.is_computer = ldb_msg_check_string_attribute(searched_msg, "objectClass", "computer");
+ io->u.is_computer = ldb_msg_check_string_attribute(info_msg, "objectClass", "computer");
if (io->u.sAMAccountName == NULL) {
ldb_asprintf_errstring(ldb,
"setup_io: sAMAccountName attribute is missing on %s for attempted password set/change",
- ldb_dn_get_linearized(searched_msg->dn));
+ ldb_dn_get_linearized(info_msg->dn));
return LDB_ERR_CONSTRAINT_VIOLATION;
}
"on %s not allowed via LDAP. Use LSA or NETLOGON",
W_ERROR_V(WERR_ACCESS_DENIED),
ldb_strerror(ret),
- ldb_dn_get_linearized(searched_msg->dn));
+ ldb_dn_get_linearized(info_msg->dn));
return ret;
}
}
| UF_SERVER_TRUST_ACCOUNT));
if (ac->userPassword) {
- ret = msg_find_old_and_new_pwd_val(orig_msg, "userPassword",
+ ret = msg_find_old_and_new_pwd_val(client_msg, "userPassword",
ac->req->operation,
&io->n.cleartext_utf8,
&io->og.cleartext_utf8);
io->n.cleartext_utf8 = cleartext_utf8_blob;
}
- ret = msg_find_old_and_new_pwd_val(orig_msg, "clearTextPassword",
+ ret = msg_find_old_and_new_pwd_val(client_msg, "clearTextPassword",
ac->req->operation,
&io->n.cleartext_utf16,
&io->og.cleartext_utf16);
that would then be treated as a UTF16 password rather than
a nthash */
- ret = msg_find_old_and_new_pwd_val(orig_msg, "unicodePwd",
+ ret = msg_find_old_and_new_pwd_val(client_msg, "unicodePwd",
ac->req->operation,
"ed_utf16,
&old_quoted_utf16);
/* Handles the "dBCSPwd" attribute (LM hash) */
io->n.lm_hash = NULL; io->og.lm_hash = NULL;
- ret = msg_find_old_and_new_pwd_val(orig_msg, "dBCSPwd",
+ ret = msg_find_old_and_new_pwd_val(client_msg, "dBCSPwd",
ac->req->operation,
&lm_hash, &old_lm_hash);
if (ret != LDB_SUCCESS) {
&& (!io->n.nt_hash) && (!io->n.lm_hash)) {
ldb_asprintf_errstring(ldb,
"setup_io: "
- "It' not possible to delete the password (changes using the LAN Manager hash alone could be deactivated)!");
+ "It's not possible to delete the password (changes using the LAN Manager hash alone could be deactivated)!");
/* on "userPassword" and "clearTextPassword" we've to return
* something different, since these are virtual attributes */
- if ((ldb_msg_find_element(orig_msg, "userPassword") != NULL) ||
- (ldb_msg_find_element(orig_msg, "clearTextPassword") != NULL)) {
+ if ((ldb_msg_find_element(client_msg, "userPassword") != NULL) ||
+ (ldb_msg_find_element(client_msg, "clearTextPassword") != NULL)) {
return LDB_ERR_CONSTRAINT_VIOLATION;
}
return LDB_ERR_UNWILLING_TO_PERFORM;
return ldb_operr(ldb);
}
+ if (existing_msg != NULL) {
+ NTSTATUS status;
+
+ if (ac->pwd_reset) {
+ /* Get the old password from the database */
+ status = samdb_result_passwords_no_lockout(ac,
+ lp_ctx,
+ existing_msg,
+ &io->o.lm_hash,
+ &io->o.nt_hash);
+ } else {
+ /* Get the old password from the database */
+ status = samdb_result_passwords(ac,
+ lp_ctx,
+ existing_msg,
+ &io->o.lm_hash,
+ &io->o.nt_hash);
+ }
+
+ if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
+ return dsdb_module_werror(ac->module,
+ LDB_ERR_CONSTRAINT_VIOLATION,
+ WERR_ACCOUNT_LOCKED_OUT,
+ "Password change not permitted,"
+ " account locked out!");
+ }
+
+ if (!NT_STATUS_IS_OK(status)) {
+ /*
+ * This only happens if the database has gone weird,
+ * not if we are just missing the passwords
+ */
+ return ldb_operr(ldb);
+ }
+
+ io->o.nt_history_len = samdb_result_hashes(ac, existing_msg,
+ "ntPwdHistory",
+ &io->o.nt_history);
+ io->o.lm_history_len = samdb_result_hashes(ac, existing_msg,
+ "lmPwdHistory",
+ &io->o.lm_history);
+ io->o.supplemental = ldb_msg_find_ldb_val(existing_msg,
+ "supplementalCredentials");
+
+ if (io->o.supplemental != NULL) {
+ enum ndr_err_code ndr_err;
+
+ ndr_err = ndr_pull_struct_blob_all(io->o.supplemental, io->ac,
+ &io->o.scb,
+ (ndr_pull_flags_fn_t)ndr_pull_supplementalCredentialsBlob);
+ if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+ status = ndr_map_error2ntstatus(ndr_err);
+ ldb_asprintf_errstring(ldb,
+ "setup_io: failed to pull "
+ "old supplementalCredentialsBlob: %s",
+ nt_errstr(status));
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ }
+ }
+
return LDB_SUCCESS;
}
static struct ph_context *ph_init_context(struct ldb_module *module,
struct ldb_request *req,
- bool userPassword)
+ bool userPassword,
+ bool update_password)
{
struct ldb_context *ldb;
struct ph_context *ac;
ac->module = module;
ac->req = req;
ac->userPassword = userPassword;
+ ac->update_password = update_password;
+ ac->update_lastset = true;
return ac;
}
return ret;
}
-static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
+static int password_hash_needed(struct ldb_module *module,
+ struct ldb_request *req,
+ struct ph_context **_ac)
{
- struct ldb_context *ldb;
- struct ph_context *ac;
- struct ldb_message_element *userPasswordAttr, *clearTextPasswordAttr,
- *ntAttr, *lmAttr;
- int ret;
+ struct ldb_context *ldb = ldb_module_get_ctx(module);
+ const char *operation = NULL;
+ const struct ldb_message *msg = NULL;
+ struct ph_context *ac = NULL;
+ const char *passwordAttrs[] = {
+ "userPassword",
+ "clearTextPassword",
+ "unicodePwd",
+ "dBCSPwd",
+ NULL
+ };
+ const char **a = NULL;
+ unsigned int attr_cnt = 0;
struct ldb_control *bypass = NULL;
bool userPassword = dsdb_user_password_support(module, req, req);
+ bool update_password = false;
- ldb = ldb_module_get_ctx(module);
+ *_ac = NULL;
- ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_add\n");
+ ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_needed\n");
- if (ldb_dn_is_special(req->op.add.message->dn)) { /* do not manipulate our control entries */
+ switch (req->operation) {
+ case LDB_ADD:
+ operation = "add";
+ msg = req->op.add.message;
+ break;
+ case LDB_MODIFY:
+ operation = "modify";
+ msg = req->op.mod.message;
+ break;
+ default:
+ return ldb_next_request(module, req);
+ }
+
+ if (ldb_dn_is_special(msg->dn)) { /* do not manipulate our control entries */
return ldb_next_request(module, req);
}
if (bypass != NULL) {
/* Mark the "bypass" control as uncritical (done) */
bypass->critical = false;
- ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_add (bypassing)\n");
+ ldb_debug(ldb, LDB_DEBUG_TRACE,
+ "password_hash_needed(%s) (bypassing)\n",
+ operation);
return password_hash_bypass(module, req);
}
/* nobody must touch password histories and 'supplementalCredentials' */
- if (ldb_msg_find_element(req->op.add.message, "ntPwdHistory")) {
+ if (ldb_msg_find_element(msg, "ntPwdHistory")) {
return LDB_ERR_UNWILLING_TO_PERFORM;
}
- if (ldb_msg_find_element(req->op.add.message, "lmPwdHistory")) {
+ if (ldb_msg_find_element(msg, "lmPwdHistory")) {
return LDB_ERR_UNWILLING_TO_PERFORM;
}
- if (ldb_msg_find_element(req->op.add.message, "supplementalCredentials")) {
+ if (ldb_msg_find_element(msg, "supplementalCredentials")) {
return LDB_ERR_UNWILLING_TO_PERFORM;
}
- /* If no part of this touches the 'userPassword' OR 'clearTextPassword'
- * OR 'unicodePwd' OR 'dBCSPwd' we don't need to make any changes. */
+ /*
+ * If no part of this touches the 'userPassword' OR 'clearTextPassword'
+ * OR 'unicodePwd' OR 'dBCSPwd' we don't need to make any changes.
+ * For password changes/set there should be a 'delete' or a 'modify'
+ * on these attributes.
+ */
+ for (a = passwordAttrs; *a != NULL; a++) {
+ if ((!userPassword) && (ldb_attr_cmp(*a, "userPassword") == 0)) {
+ continue;
+ }
- userPasswordAttr = NULL;
- if (userPassword) {
- userPasswordAttr = ldb_msg_find_element(req->op.add.message,
- "userPassword");
- /* MS-ADTS 3.1.1.3.1.5.2 */
- if ((userPasswordAttr != NULL) &&
- (dsdb_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003)) {
- return LDB_ERR_CONSTRAINT_VIOLATION;
+ if (ldb_msg_find_element(msg, *a) != NULL) {
+ /* MS-ADTS 3.1.1.3.1.5.2 */
+ if ((ldb_attr_cmp(*a, "userPassword") == 0) &&
+ (dsdb_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003)) {
+ return LDB_ERR_CONSTRAINT_VIOLATION;
+ }
+
+ ++attr_cnt;
}
}
- clearTextPasswordAttr = ldb_msg_find_element(req->op.add.message, "clearTextPassword");
- ntAttr = ldb_msg_find_element(req->op.add.message, "unicodePwd");
- lmAttr = ldb_msg_find_element(req->op.add.message, "dBCSPwd");
- if ((!userPasswordAttr) && (!clearTextPasswordAttr) && (!ntAttr) && (!lmAttr)) {
+ if (attr_cnt > 0) {
+ update_password = true;
+ }
+
+ if (!update_password) {
return ldb_next_request(module, req);
}
+ ac = ph_init_context(module, req, userPassword, update_password);
+ if (!ac) {
+ DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
+ return ldb_operr(ldb);
+ }
+ ph_apply_controls(ac);
+
+ /*
+ * Make a copy in order to apply our modifications
+ * to the final update
+ */
+ ac->update_msg = ldb_msg_copy_shallow(ac, msg);
+ if (ac->update_msg == NULL) {
+ return ldb_oom(ldb);
+ }
+
+ /*
+ * Remove all password related attributes.
+ */
+ if (ac->userPassword) {
+ ldb_msg_remove_attr(ac->update_msg, "userPassword");
+ }
+ ldb_msg_remove_attr(ac->update_msg, "clearTextPassword");
+ ldb_msg_remove_attr(ac->update_msg, "unicodePwd");
+ ldb_msg_remove_attr(ac->update_msg, "ntPwdHistory");
+ ldb_msg_remove_attr(ac->update_msg, "dBCSPwd");
+ ldb_msg_remove_attr(ac->update_msg, "lmPwdHistory");
+ ldb_msg_remove_attr(ac->update_msg, "supplementalCredentials");
+ ldb_msg_remove_attr(ac->update_msg, "pwdLastSet");
+
+ *_ac = ac;
+ return LDB_SUCCESS;
+}
+
+static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
+{
+ struct ldb_context *ldb = ldb_module_get_ctx(module);
+ struct ph_context *ac = NULL;
+ int ret;
+
+ ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_add\n");
+
+ ret = password_hash_needed(module, req, &ac);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ if (ac == NULL) {
+ return ret;
+ }
+
/* Make sure we are performing the password set action on a (for us)
* valid object. Those are instances of either "user" and/or
* "inetOrgPerson". Otherwise continue with the submodules. */
if ((!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "user"))
&& (!ldb_msg_check_string_attribute(req->op.add.message, "objectClass", "inetOrgPerson"))) {
+ TALLOC_FREE(ac);
+
if (ldb_msg_find_element(req->op.add.message, "clearTextPassword") != NULL) {
ldb_set_errstring(ldb,
"'clearTextPassword' is only allowed on objects of class 'user' and/or 'inetOrgPerson'!");
return ldb_next_request(module, req);
}
- ac = ph_init_context(module, req, userPassword);
- if (ac == NULL) {
- DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
- return ldb_operr(ldb);
- }
- ph_apply_controls(ac);
-
/* get user domain data */
ret = build_domain_data_request(ac);
if (ret != LDB_SUCCESS) {
static int password_hash_add_do_add(struct ph_context *ac)
{
- struct ldb_context *ldb;
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
struct ldb_request *down_req;
- struct ldb_message *msg;
struct setup_password_fields_io io;
int ret;
/* Prepare the internal data structure containing the passwords */
- ret = setup_io(ac, ac->req->op.add.message, ac->req->op.add.message, &io);
+ ret = setup_io(ac, ac->req->op.add.message, NULL, &io);
if (ret != LDB_SUCCESS) {
return ret;
}
- ldb = ldb_module_get_ctx(ac->module);
-
- msg = ldb_msg_copy_shallow(ac, ac->req->op.add.message);
- if (msg == NULL) {
- return ldb_operr(ldb);
- }
-
- /* remove attributes that we just read into 'io' */
- if (ac->userPassword) {
- ldb_msg_remove_attr(msg, "userPassword");
- }
- ldb_msg_remove_attr(msg, "clearTextPassword");
- ldb_msg_remove_attr(msg, "unicodePwd");
- ldb_msg_remove_attr(msg, "dBCSPwd");
- ldb_msg_remove_attr(msg, "pwdLastSet");
-
ret = setup_password_fields(&io);
if (ret != LDB_SUCCESS) {
return ret;
return ret;
}
- if (io.g.nt_hash) {
- ret = samdb_msg_add_hash(ldb, ac, msg,
- "unicodePwd", io.g.nt_hash);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- if (io.g.lm_hash) {
- ret = samdb_msg_add_hash(ldb, ac, msg,
- "dBCSPwd", io.g.lm_hash);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- if (io.g.nt_history_len > 0) {
- ret = samdb_msg_add_hashes(ldb, ac, msg,
- "ntPwdHistory",
- io.g.nt_history,
- io.g.nt_history_len);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- if (io.g.lm_history_len > 0) {
- ret = samdb_msg_add_hashes(ldb, ac, msg,
- "lmPwdHistory",
- io.g.lm_history,
- io.g.lm_history_len);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- if (io.g.supplemental.length > 0) {
- ret = ldb_msg_add_value(msg, "supplementalCredentials",
- &io.g.supplemental, NULL);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- ret = samdb_msg_add_uint64(ldb, ac, msg,
- "pwdLastSet",
- io.g.last_set);
+ ret = update_final_msg(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = ldb_build_add_req(&down_req, ldb, ac,
- msg,
+ ac->update_msg,
ac->req->controls,
ac, ph_op_callback,
ac->req);
static int password_hash_modify(struct ldb_module *module, struct ldb_request *req)
{
- struct ldb_context *ldb;
- struct ph_context *ac;
+ struct ldb_context *ldb = ldb_module_get_ctx(module);
+ struct ph_context *ac = NULL;
const char *passwordAttrs[] = { "userPassword", "clearTextPassword",
"unicodePwd", "dBCSPwd", NULL }, **l;
- unsigned int attr_cnt, del_attr_cnt, add_attr_cnt, rep_attr_cnt;
+ unsigned int del_attr_cnt, add_attr_cnt, rep_attr_cnt;
struct ldb_message_element *passwordAttr;
struct ldb_message *msg;
struct ldb_request *down_req;
int ret;
- struct ldb_control *bypass = NULL;
- bool userPassword = dsdb_user_password_support(module, req, req);
-
- ldb = ldb_module_get_ctx(module);
+ unsigned int i = 0;
ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_modify\n");
- if (ldb_dn_is_special(req->op.mod.message->dn)) { /* do not manipulate our control entries */
- return ldb_next_request(module, req);
- }
-
- bypass = ldb_request_get_control(req,
- DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID);
- if (bypass != NULL) {
- /* Mark the "bypass" control as uncritical (done) */
- bypass->critical = false;
- ldb_debug(ldb, LDB_DEBUG_TRACE, "password_hash_modify (bypassing)\n");
- return password_hash_bypass(module, req);
- }
-
- /* nobody must touch password histories and 'supplementalCredentials' */
- if (ldb_msg_find_element(req->op.mod.message, "ntPwdHistory")) {
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
- if (ldb_msg_find_element(req->op.mod.message, "lmPwdHistory")) {
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
- if (ldb_msg_find_element(req->op.mod.message, "supplementalCredentials")) {
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
-
- /* If no part of this touches the 'userPassword' OR 'clearTextPassword'
- * OR 'unicodePwd' OR 'dBCSPwd' we don't need to make any changes.
- * For password changes/set there should be a 'delete' or a 'modify'
- * on these attributes. */
- attr_cnt = 0;
- for (l = passwordAttrs; *l != NULL; l++) {
- if ((!userPassword) && (ldb_attr_cmp(*l, "userPassword") == 0)) {
- continue;
- }
-
- if (ldb_msg_find_element(req->op.mod.message, *l) != NULL) {
- /* MS-ADTS 3.1.1.3.1.5.2 */
- if ((ldb_attr_cmp(*l, "userPassword") == 0) &&
- (dsdb_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003)) {
- return LDB_ERR_CONSTRAINT_VIOLATION;
- }
-
- ++attr_cnt;
- }
- }
- if (attr_cnt == 0) {
- return ldb_next_request(module, req);
+ ret = password_hash_needed(module, req, &ac);
+ if (ret != LDB_SUCCESS) {
+ return ret;
}
-
- ac = ph_init_context(module, req, userPassword);
- if (!ac) {
- DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
- return ldb_operr(ldb);
+ if (ac == NULL) {
+ return ret;
}
- ph_apply_controls(ac);
/* use a new message structure so that we can modify it */
msg = ldb_msg_copy_shallow(ac, req->op.mod.message);
return password_hash_mod_search_self(ac);
}
+ /*
+ * Now we apply all changes remaining in msg
+ * and remove them from our final update_msg
+ */
+
+ for (i = 0; i < msg->num_elements; i++) {
+ ldb_msg_remove_attr(ac->update_msg,
+ msg->elements[i].name);
+ }
+
ret = ldb_build_mod_req(&down_req, ldb, ac,
msg,
req->controls,
static int password_hash_mod_do_mod(struct ph_context *ac)
{
struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
- struct loadparm_context *lp_ctx =
- talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
- struct loadparm_context);
struct ldb_request *mod_req;
- struct ldb_message *msg;
- const struct ldb_message *orig_msg, *searched_msg;
struct setup_password_fields_io io;
int ret;
- NTSTATUS status;
-
- /* use a new message structure so that we can modify it */
- msg = ldb_msg_new(ac);
- if (msg == NULL) {
- return ldb_operr(ldb);
- }
-
- /* modify dn */
- msg->dn = ac->req->op.mod.message->dn;
-
- orig_msg = ac->req->op.mod.message;
- searched_msg = ac->search_res->message;
/* Prepare the internal data structure containing the passwords */
- ret = setup_io(ac, orig_msg, searched_msg, &io);
+ ret = setup_io(ac, ac->req->op.mod.message,
+ ac->search_res->message, &io);
if (ret != LDB_SUCCESS) {
return ret;
}
-
- if (io.ac->pwd_reset) {
- /* Get the old password from the database */
- status = samdb_result_passwords_no_lockout(io.ac,
- lp_ctx,
- discard_const_p(struct ldb_message, searched_msg),
- &io.o.lm_hash,
- &io.o.nt_hash);
- } else {
- /* Get the old password from the database */
- status = samdb_result_passwords(io.ac,
- lp_ctx,
- discard_const_p(struct ldb_message, searched_msg),
- &io.o.lm_hash, &io.o.nt_hash);
- }
-
- if (NT_STATUS_EQUAL(status, NT_STATUS_ACCOUNT_LOCKED_OUT)) {
- ldb_asprintf_errstring(ldb,
- "%08X: check_password: "
- "Password change not permitted, account locked out!",
- W_ERROR_V(WERR_ACCOUNT_LOCKED_OUT));
- return LDB_ERR_CONSTRAINT_VIOLATION;
- }
-
- if (!NT_STATUS_IS_OK(status)) {
- /*
- * This only happens if the database has gone weird,
- * not if we are just missing the passwords
- */
- return ldb_operr(ldb);
- }
-
- io.o.nt_history_len = samdb_result_hashes(io.ac, searched_msg, "ntPwdHistory", &io.o.nt_history);
- io.o.lm_history_len = samdb_result_hashes(io.ac, searched_msg, "lmPwdHistory", &io.o.lm_history);
- io.o.supplemental = ldb_msg_find_ldb_val(searched_msg, "supplementalCredentials");
ret = setup_password_fields(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
- /* make sure we replace all the old attributes */
- ret = ldb_msg_add_empty(msg, "unicodePwd", LDB_FLAG_MOD_REPLACE, NULL);
- ret = ldb_msg_add_empty(msg, "dBCSPwd", LDB_FLAG_MOD_REPLACE, NULL);
- ret = ldb_msg_add_empty(msg, "ntPwdHistory", LDB_FLAG_MOD_REPLACE, NULL);
- ret = ldb_msg_add_empty(msg, "lmPwdHistory", LDB_FLAG_MOD_REPLACE, NULL);
- ret = ldb_msg_add_empty(msg, "supplementalCredentials", LDB_FLAG_MOD_REPLACE, NULL);
- ret = ldb_msg_add_empty(msg, "pwdLastSet", LDB_FLAG_MOD_REPLACE, NULL);
-
- if (io.g.nt_hash) {
- ret = samdb_msg_add_hash(ldb, ac, msg,
- "unicodePwd", io.g.nt_hash);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- if (io.g.lm_hash) {
- ret = samdb_msg_add_hash(ldb, ac, msg,
- "dBCSPwd", io.g.lm_hash);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- if (io.g.nt_history_len > 0) {
- ret = samdb_msg_add_hashes(ldb, ac, msg,
- "ntPwdHistory",
- io.g.nt_history,
- io.g.nt_history_len);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- if (io.g.lm_history_len > 0) {
- ret = samdb_msg_add_hashes(ldb, ac, msg,
- "lmPwdHistory",
- io.g.lm_history,
- io.g.lm_history_len);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- if (io.g.supplemental.length > 0) {
- ret = ldb_msg_add_value(msg, "supplementalCredentials",
- &io.g.supplemental, NULL);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- ret = samdb_msg_add_uint64(ldb, ac, msg,
- "pwdLastSet",
- io.g.last_set);
+ ret = update_final_msg(&io);
if (ret != LDB_SUCCESS) {
return ret;
}
ret = ldb_build_mod_req(&mod_req, ldb, ac,
- msg,
+ ac->update_msg,
ac->req->controls,
ac, ph_op_callback,
ac->req);
git.samba.org / metze / samba / wip.git / blobdiff