#include "includes.h"
#include "librpc/gen_ndr/ndr_netlogon.h"
-#include "librpc/gen_ndr/ndr_misc.h"
#include "librpc/gen_ndr/ndr_security.h"
-#include "lib/ldb/include/ldb.h"
-#include "lib/ldb/include/ldb_errors.h"
+#include "lib/events/events.h"
+#include "lib/ldb-samba/ldb_wrap.h"
+#include <ldb.h>
+#include <ldb_errors.h>
#include "libcli/security/security.h"
#include "libcli/auth/libcli_auth.h"
#include "libcli/ldap/ldap_ndr.h"
#include "system/time.h"
#include "system/filesys.h"
#include "ldb_wrap.h"
-#include "util/util_ldb.h"
+#include "../lib/util/util_ldb.h"
#include "dsdb/samdb/samdb.h"
-#include "dsdb/common/flags.h"
+#include "../libds/common/flags.h"
#include "param/param.h"
#include "lib/events/events.h"
-
-char *samdb_relative_path(struct ldb_context *ldb,
- TALLOC_CTX *mem_ctx,
- const char *name)
-{
- const char *base_url =
- (const char *)ldb_get_opaque(ldb, "ldb_url");
- char *path, *p, *full_name;
- if (name == NULL) {
- return NULL;
- }
- if (name[0] == 0 || name[0] == '/' || strstr(name, ":/")) {
- return talloc_strdup(mem_ctx, name);
- }
- path = talloc_strdup(mem_ctx, base_url);
- if (path == NULL) {
- return NULL;
- }
- if ( (p = strrchr(path, '/')) != NULL) {
- p[0] = '\0';
- full_name = talloc_asprintf(mem_ctx, "%s/%s", path, name);
- } else {
- full_name = talloc_asprintf(mem_ctx, "./%s", name);
- }
- talloc_free(path);
- return full_name;
-}
-
+#include "auth/credentials/credentials.h"
+#include "param/secrets.h"
+#include "auth/auth.h"
/*
- connect to the SAM database
+ connect to the SAM database specified by URL
return an opaque context pointer on success, or NULL on failure
*/
-struct ldb_context *samdb_connect(TALLOC_CTX *mem_ctx,
- struct event_context *ev_ctx,
+struct ldb_context *samdb_connect_url(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev_ctx,
struct loadparm_context *lp_ctx,
- struct auth_session_info *session_info)
+ struct auth_session_info *session_info,
+ unsigned int flags, const char *url)
{
struct ldb_context *ldb;
- ldb = ldb_wrap_connect(mem_ctx, ev_ctx, lp_ctx,
- lp_sam_url(lp_ctx), session_info,
- NULL, 0, NULL);
- if (!ldb) {
+ struct dsdb_schema *schema;
+ int ret;
+
+ ldb = ldb_wrap_find(url, ev_ctx, lp_ctx, session_info, NULL, flags);
+ if (ldb != NULL)
+ return talloc_reference(mem_ctx, ldb);
+
+ ldb = samba_ldb_init(mem_ctx, ev_ctx, lp_ctx, session_info, NULL);
+
+ if (ldb == NULL)
return NULL;
- }
- dsdb_make_schema_global(ldb);
- return ldb;
-}
-/*
- copy from a template record to a message
-*/
-int samdb_copy_template(struct ldb_context *ldb,
- struct ldb_message *msg, const char *name,
- const char **errstring)
-{
- struct ldb_result *res;
- struct ldb_message *t;
- int ret, i, j;
- struct ldb_context *templates_ldb;
- char *templates_ldb_path;
- struct ldb_dn *basedn;
- struct event_context *event_ctx;
- struct loadparm_context *lp_ctx;
-
- templates_ldb = talloc_get_type(ldb_get_opaque(ldb, "templates_ldb"), struct ldb_context);
-
- if (!templates_ldb) {
- templates_ldb_path = samdb_relative_path(ldb,
- msg,
- "templates.ldb");
- if (!templates_ldb_path) {
- *errstring = talloc_asprintf(msg, "samdb_copy_template: ERROR: Failed to contruct path for template db");
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- event_ctx = (struct event_context *)ldb_get_opaque(ldb, "EventContext");
- lp_ctx = (struct loadparm_context *)ldb_get_opaque(ldb, "loadparm");
-
- /* FIXME: need to remove this wehn we finally pass the event
- * context around in ldb */
- if (event_ctx == NULL) {
- event_ctx = event_context_init(templates_ldb);
- }
+ dsdb_set_global_schema(ldb);
- templates_ldb = ldb_wrap_connect(ldb, event_ctx, lp_ctx,
- templates_ldb_path, NULL,
- NULL, 0, NULL);
- talloc_free(templates_ldb_path);
- if (!templates_ldb) {
- *errstring = talloc_asprintf(msg, "samdb_copy_template: ERROR: Failed to connect to templates db at: %s",
- templates_ldb_path);
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- ret = ldb_set_opaque(ldb, "templates_ldb", templates_ldb);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- }
- *errstring = NULL;
-
- basedn = ldb_dn_new(templates_ldb, ldb, "cn=Templates");
- if (!ldb_dn_add_child_fmt(basedn, "CN=Template%s", name)) {
- talloc_free(basedn);
- *errstring = talloc_asprintf(msg, "samdb_copy_template: ERROR: Failed to contruct DN for template '%s'",
- name);
- return LDB_ERR_OPERATIONS_ERROR;
- }
-
- /* pull the template record */
- ret = ldb_search(templates_ldb, basedn, LDB_SCOPE_BASE, "distinguishedName=*", NULL, &res);
- talloc_free(basedn);
+ ret = samba_ldb_connect(ldb, lp_ctx, url, flags);
if (ret != LDB_SUCCESS) {
- *errstring = talloc_steal(msg, ldb_errstring(templates_ldb));
- return ret;
- }
- if (res->count != 1) {
- *errstring = talloc_asprintf(msg, "samdb_copy_template: ERROR: template '%s' matched %d records, expected 1",
- name,
- res->count);
- talloc_free(res);
- return LDB_ERR_OPERATIONS_ERROR;
+ talloc_free(ldb);
+ return NULL;
}
- t = res->msgs[0];
-
- for (i = 0; i < t->num_elements; i++) {
- struct ldb_message_element *el = &t->elements[i];
- /* some elements should not be copied from the template */
- if (ldb_attr_cmp(el->name, "cn") == 0 ||
- ldb_attr_cmp(el->name, "name") == 0 ||
- ldb_attr_cmp(el->name, "objectClass") == 0 ||
- ldb_attr_cmp(el->name, "sAMAccountName") == 0 ||
- ldb_attr_cmp(el->name, "sAMAccountName") == 0 ||
- ldb_attr_cmp(el->name, "distinguishedName") == 0 ||
- ldb_attr_cmp(el->name, "objectGUID") == 0) {
- continue;
- }
- for (j = 0; j < el->num_values; j++) {
- ret = samdb_find_or_add_attribute(ldb, msg, el->name,
- (char *)el->values[j].data);
- if (ret) {
- *errstring = talloc_asprintf(msg, "Adding attribute %s failed.", el->name);
- talloc_free(res);
- return ret;
- }
- }
+
+ schema = dsdb_get_schema(ldb, NULL);
+ /* make the resulting schema global */
+ if (schema) {
+ dsdb_make_schema_global(ldb, schema);
}
- talloc_free(res);
+ if (!ldb_wrap_add(url, ev_ctx, lp_ctx, session_info, NULL, flags, ldb)) {
+ talloc_free(ldb);
+ return NULL;
+ }
- return LDB_SUCCESS;
+ return ldb;
}
+/*
+ connect to the SAM database
+ return an opaque context pointer on success, or NULL on failure
+ */
+struct ldb_context *samdb_connect(TALLOC_CTX *mem_ctx,
+ struct tevent_context *ev_ctx,
+ struct loadparm_context *lp_ctx,
+ struct auth_session_info *session_info,
+ unsigned int flags)
+{
+ return samdb_connect_url(mem_ctx, ev_ctx, lp_ctx, session_info, flags, "sam.ldb");
+}
+
/****************************************************************************
Create the SID list for this user.
****************************************************************************/
NTSTATUS security_token_create(TALLOC_CTX *mem_ctx,
- struct event_context *ev_ctx,
struct loadparm_context *lp_ctx,
- struct dom_sid *user_sid,
- struct dom_sid *group_sid,
- int n_groupSIDs,
- struct dom_sid **groupSIDs,
- bool is_authenticated,
+ unsigned int num_sids,
+ struct dom_sid *sids,
+ uint32_t session_info_flags,
struct security_token **token)
{
struct security_token *ptoken;
- int i;
+ unsigned int i;
NTSTATUS status;
ptoken = security_token_initialise(mem_ctx);
NT_STATUS_HAVE_NO_MEMORY(ptoken);
- ptoken->sids = talloc_array(ptoken, struct dom_sid *, n_groupSIDs + 5);
+ ptoken->sids = talloc_array(ptoken, struct dom_sid, num_sids + 6 /* over-allocate */);
NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
- ptoken->user_sid = talloc_reference(ptoken, user_sid);
- ptoken->group_sid = talloc_reference(ptoken, group_sid);
- ptoken->privilege_mask = 0;
+ ptoken->num_sids = 0;
- ptoken->sids[0] = ptoken->user_sid;
- ptoken->sids[1] = ptoken->group_sid;
+ for (i = 0; i < num_sids; i++) {
+ size_t check_sid_idx;
+ for (check_sid_idx = 0;
+ check_sid_idx < ptoken->num_sids;
+ check_sid_idx++) {
+ if (dom_sid_equal(&ptoken->sids[check_sid_idx], &sids[i])) {
+ break;
+ }
+ }
+
+ if (check_sid_idx == ptoken->num_sids) {
+ ptoken->sids = talloc_realloc(ptoken, ptoken->sids, struct dom_sid, ptoken->num_sids + 1);
+ NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
+
+ ptoken->sids[ptoken->num_sids] = sids[i];
+ ptoken->num_sids++;
+ }
+ }
/*
- * Finally add the "standard" SIDs.
+ * Finally add the "standard" sids.
* The only difference between guest and "anonymous"
* is the addition of Authenticated_Users.
*/
- ptoken->sids[2] = dom_sid_parse_talloc(ptoken->sids, SID_WORLD);
- NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[2]);
- ptoken->sids[3] = dom_sid_parse_talloc(ptoken->sids, SID_NT_NETWORK);
- NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[3]);
- ptoken->num_sids = 4;
-
- if (is_authenticated) {
- ptoken->sids[4] = dom_sid_parse_talloc(ptoken->sids, SID_NT_AUTHENTICATED_USERS);
- NT_STATUS_HAVE_NO_MEMORY(ptoken->sids[4]);
+
+ if (session_info_flags & AUTH_SESSION_INFO_DEFAULT_GROUPS) {
+ ptoken->sids = talloc_realloc(ptoken, ptoken->sids, struct dom_sid, ptoken->num_sids + 2);
+ NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
+
+ if (!dom_sid_parse(SID_WORLD, &ptoken->sids[ptoken->num_sids])) {
+ return NT_STATUS_INTERNAL_ERROR;
+ }
ptoken->num_sids++;
- }
- for (i = 0; i < n_groupSIDs; i++) {
- size_t check_sid_idx;
- for (check_sid_idx = 1;
- check_sid_idx < ptoken->num_sids;
- check_sid_idx++) {
- if (dom_sid_equal(ptoken->sids[check_sid_idx], groupSIDs[i])) {
- break;
- }
+ if (!dom_sid_parse(SID_NT_NETWORK, &ptoken->sids[ptoken->num_sids])) {
+ return NT_STATUS_INTERNAL_ERROR;
}
+ ptoken->num_sids++;
+ }
- if (check_sid_idx == ptoken->num_sids) {
- ptoken->sids[ptoken->num_sids++] = talloc_reference(ptoken->sids, groupSIDs[i]);
+ if (session_info_flags & AUTH_SESSION_INFO_AUTHENTICATED) {
+ ptoken->sids = talloc_realloc(ptoken, ptoken->sids, struct dom_sid, ptoken->num_sids + 1);
+ NT_STATUS_HAVE_NO_MEMORY(ptoken->sids);
+
+ if (!dom_sid_parse(SID_NT_AUTHENTICATED_USERS, &ptoken->sids[ptoken->num_sids])) {
+ return NT_STATUS_INTERNAL_ERROR;
}
+ ptoken->num_sids++;
}
- /* setup the privilege mask for this token */
- status = samdb_privilege_setup(ev_ctx, lp_ctx, ptoken);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(ptoken);
- return status;
+ /* The caller may have requested simple privilages, for example if there isn't a local DB */
+ if (session_info_flags & AUTH_SESSION_INFO_SIMPLE_PRIVILEGES) {
+ /* Shortcuts to prevent recursion and avoid lookups */
+ if (ptoken->sids == NULL) {
+ ptoken->privilege_mask = 0;
+ } else if (security_token_is_system(ptoken)) {
+ ptoken->privilege_mask = ~0;
+ } else if (security_token_is_anonymous(ptoken)) {
+ ptoken->privilege_mask = 0;
+ } else if (security_token_has_builtin_administrators(ptoken)) {
+ ptoken->privilege_mask = ~0;
+ } else {
+ /* All other 'users' get a empty priv set so far */
+ ptoken->privilege_mask = 0;
+ }
+ } else {
+ /* setup the privilege mask for this token */
+ status = samdb_privilege_setup(lp_ctx, ptoken);
+ if (!NT_STATUS_IS_OK(status)) {
+ talloc_free(ptoken);
+ DEBUG(1,("Unable to access privileges database\n"));
+ return status;
+ }
}
- security_token_debug(10, ptoken);
+ security_token_debug(0, 10, ptoken);
*token = ptoken;
git.samba.org / metze / samba / wip.git / blobdiff