#include "libds/common/flag_mapping.h"
struct samldb_ctx;
+enum samldb_add_type {
+ SAMLDB_TYPE_USER,
+ SAMLDB_TYPE_GROUP,
+ SAMLDB_TYPE_CLASS,
+ SAMLDB_TYPE_ATTRIBUTE
+};
typedef int (*samldb_step_fn_t)(struct samldb_ctx *);
struct ldb_request *req;
/* used for add operations */
- const char *type;
+ enum samldb_add_type type;
/* the resulting message */
struct ldb_message *msg;
}
ret = dsdb_module_search(ac->module, ac, &res,
- NULL, LDB_SCOPE_SUBTREE, noattrs,
+ ldb_get_default_basedn(ldb), LDB_SCOPE_SUBTREE, noattrs,
DSDB_FLAG_NEXT_MODULE,
ac->req,
"(sAMAccountName=%s)",
const char *no_attrs[] = { NULL };
int ret;
- ret = dsdb_module_search(ac->module, tmp_ctx, &res, NULL,
+ ret = dsdb_module_search(ac->module, tmp_ctx, &res,
+ ldb_get_default_basedn(ldb_module_get_ctx(ac->module)),
LDB_SCOPE_SUBTREE, no_attrs,
DSDB_FLAG_NEXT_MODULE,
ac->req,
return ret;
}
+ if (ret == LDB_SUCCESS) {
+ /* ensure the defaultObjectCategory has a full GUID */
+ struct ldb_message *m;
+ m = ldb_msg_new(ac->msg);
+ if (m == NULL) {
+ return ldb_oom(ldb);
+ }
+ m->dn = ac->msg->dn;
+ if (ldb_msg_add_string(m, "defaultObjectCategory",
+ ldb_dn_get_extended_linearized(m, res->msgs[0]->dn, 1)) !=
+ LDB_SUCCESS) {
+ return ldb_oom(ldb);
+ }
+ m->elements[0].flags = LDB_FLAG_MOD_REPLACE;
+
+ ret = dsdb_module_modify(ac->module, m,
+ DSDB_FLAG_NEXT_MODULE,
+ ac->req);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+
+
ac->res_dn = ac->dn;
return samldb_next_step(ac);
ares->response, ares->error);
}
if (ares->type != LDB_REPLY_DONE) {
- ldb_set_errstring(ldb,
- "Invalid reply type!\n");
+ ldb_asprintf_errstring(ldb, "Invalid LDB reply type %d", ares->type);
return ldb_module_done(ac->req, NULL, NULL,
LDB_ERR_OPERATIONS_ERROR);
}
int ret;
/* Add information for the different account types */
- if (strcmp(ac->type, "user") == 0) {
- struct ldb_control *rodc_control = ldb_request_get_control(ac->req,
- LDB_CONTROL_RODC_DCPROMO_OID);
- if (rodc_control != NULL) {
- /* see [MS-ADTS] 3.1.1.3.4.1.23 LDAP_SERVER_RODC_DCPROMO_OID */
- rodc_control->critical = false;
- ret = samldb_add_step(ac, samldb_rodc_add);
- if (ret != LDB_SUCCESS) return ret;
- }
-
- /* check if we have a valid sAMAccountName */
- ret = samldb_add_step(ac, samldb_check_sAMAccountName);
- if (ret != LDB_SUCCESS) return ret;
+ switch(ac->type) {
+ case SAMLDB_TYPE_USER: {
+ struct ldb_control *rodc_control = ldb_request_get_control(ac->req,
+ LDB_CONTROL_RODC_DCPROMO_OID);
+ if (rodc_control != NULL) {
+ /* see [MS-ADTS] 3.1.1.3.4.1.23 LDAP_SERVER_RODC_DCPROMO_OID */
+ rodc_control->critical = false;
+ ret = samldb_add_step(ac, samldb_rodc_add);
+ if (ret != LDB_SUCCESS) return ret;
+ }
- ret = samldb_add_step(ac, samldb_add_entry);
- if (ret != LDB_SUCCESS) return ret;
+ /* check if we have a valid sAMAccountName */
+ ret = samldb_add_step(ac, samldb_check_sAMAccountName);
+ if (ret != LDB_SUCCESS) return ret;
- } else if (strcmp(ac->type, "group") == 0) {
- /* check if we have a valid sAMAccountName */
- ret = samldb_add_step(ac, samldb_check_sAMAccountName);
- if (ret != LDB_SUCCESS) return ret;
+ ret = samldb_add_step(ac, samldb_add_entry);
+ if (ret != LDB_SUCCESS) return ret;
+ break;
+ }
- ret = samldb_add_step(ac, samldb_add_entry);
- if (ret != LDB_SUCCESS) return ret;
+ case SAMLDB_TYPE_GROUP: {
+ /* check if we have a valid sAMAccountName */
+ ret = samldb_add_step(ac, samldb_check_sAMAccountName);
+ if (ret != LDB_SUCCESS) return ret;
- } else if (strcmp(ac->type, "classSchema") == 0) {
- const struct ldb_val *rdn_value, *def_obj_cat_val;
+ ret = samldb_add_step(ac, samldb_add_entry);
+ if (ret != LDB_SUCCESS) return ret;
+ break;
+ }
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "rdnAttId", "cn");
- if (ret != LDB_SUCCESS) return ret;
+ case SAMLDB_TYPE_CLASS: {
+ const struct ldb_val *rdn_value, *def_obj_cat_val;
- /* do not allow to mark an attributeSchema as RODC filtered if it
- * is system-critical */
- if (check_rodc_critical_attribute(ac->msg)) {
- ldb_asprintf_errstring(ldb, "Refusing schema add of %s - cannot combine critical class with RODC filtering",
- ldb_dn_get_linearized(ac->msg->dn));
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "rdnAttId", "cn");
+ if (ret != LDB_SUCCESS) return ret;
- rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
- if (rdn_value == NULL) {
- return ldb_operr(ldb);
- }
- if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
- /* the RDN has prefix "CN" */
- ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
- samdb_cn_to_lDAPDisplayName(ac->msg,
- (const char *) rdn_value->data));
- if (ret != LDB_SUCCESS) {
- ldb_oom(ldb);
- return ret;
+ /* do not allow to mark an attributeSchema as RODC filtered if it
+ * is system-critical */
+ if (check_rodc_critical_attribute(ac->msg)) {
+ ldb_asprintf_errstring(ldb, "Refusing schema add of %s - cannot combine critical class with RODC filtering",
+ ldb_dn_get_linearized(ac->msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
}
- }
- if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
- struct GUID guid;
- /* a new GUID */
- guid = GUID_random();
- ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
- if (ret != LDB_SUCCESS) {
- ldb_oom(ldb);
- return ret;
+ rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
+ if (rdn_value == NULL) {
+ return ldb_operr(ldb);
+ }
+ if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
+ /* the RDN has prefix "CN" */
+ ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
+ samdb_cn_to_lDAPDisplayName(ac->msg,
+ (const char *) rdn_value->data));
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
}
- }
- def_obj_cat_val = ldb_msg_find_ldb_val(ac->msg,
- "defaultObjectCategory");
- if (def_obj_cat_val != NULL) {
- /* "defaultObjectCategory" has been set by the caller.
- * Do some checks for consistency.
- * NOTE: The real constraint check (that
- * 'defaultObjectCategory' is the DN of the new
- * objectclass or any parent of it) is still incomplete.
- * For now we say that 'defaultObjectCategory' is valid
- * if it exists and it is of objectclass "classSchema".
- */
- ac->dn = ldb_dn_from_ldb_val(ac, ldb, def_obj_cat_val);
- if (ac->dn == NULL) {
- ldb_set_errstring(ldb,
- "Invalid DN for 'defaultObjectCategory'!");
- return LDB_ERR_CONSTRAINT_VIOLATION;
+ if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
+ struct GUID guid;
+ /* a new GUID */
+ guid = GUID_random();
+ ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
}
- } else {
- /* "defaultObjectCategory" has not been set by the
- * caller. Use the entry DN for it. */
- ac->dn = ac->msg->dn;
- ret = ldb_msg_add_string(ac->msg, "defaultObjectCategory",
- ldb_dn_alloc_linearized(ac->msg, ac->dn));
- if (ret != LDB_SUCCESS) {
- ldb_oom(ldb);
- return ret;
+ def_obj_cat_val = ldb_msg_find_ldb_val(ac->msg,
+ "defaultObjectCategory");
+ if (def_obj_cat_val != NULL) {
+ /* "defaultObjectCategory" has been set by the caller.
+ * Do some checks for consistency.
+ * NOTE: The real constraint check (that
+ * 'defaultObjectCategory' is the DN of the new
+ * objectclass or any parent of it) is still incomplete.
+ * For now we say that 'defaultObjectCategory' is valid
+ * if it exists and it is of objectclass "classSchema".
+ */
+ ac->dn = ldb_dn_from_ldb_val(ac, ldb, def_obj_cat_val);
+ if (ac->dn == NULL) {
+ ldb_set_errstring(ldb,
+ "Invalid DN for 'defaultObjectCategory'!");
+ return LDB_ERR_CONSTRAINT_VIOLATION;
+ }
+ } else {
+ /* "defaultObjectCategory" has not been set by the
+ * caller. Use the entry DN for it. */
+ ac->dn = ac->msg->dn;
+
+ ret = ldb_msg_add_string(ac->msg, "defaultObjectCategory",
+ ldb_dn_alloc_linearized(ac->msg, ac->dn));
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
}
- }
- ret = samldb_add_step(ac, samldb_add_entry);
- if (ret != LDB_SUCCESS) return ret;
+ ret = samldb_add_step(ac, samldb_add_entry);
+ if (ret != LDB_SUCCESS) return ret;
- /* Now perform the checks for the 'defaultObjectCategory'. The
- * lookup DN was already saved in "ac->dn" */
- ret = samldb_add_step(ac, samldb_find_for_defaultObjectCategory);
- if (ret != LDB_SUCCESS) return ret;
+ /* Now perform the checks for the 'defaultObjectCategory'. The
+ * lookup DN was already saved in "ac->dn" */
+ ret = samldb_add_step(ac, samldb_find_for_defaultObjectCategory);
+ if (ret != LDB_SUCCESS) return ret;
+ break;
+ }
- } else if (strcmp(ac->type, "attributeSchema") == 0) {
- const struct ldb_val *rdn_value;
- rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
- if (rdn_value == NULL) {
- return ldb_operr(ldb);
- }
- if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
- /* the RDN has prefix "CN" */
- ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
- samdb_cn_to_lDAPDisplayName(ac->msg,
- (const char *) rdn_value->data));
- if (ret != LDB_SUCCESS) {
- ldb_oom(ldb);
- return ret;
+ case SAMLDB_TYPE_ATTRIBUTE: {
+ const struct ldb_val *rdn_value;
+ rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
+ if (rdn_value == NULL) {
+ return ldb_operr(ldb);
+ }
+ if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
+ /* the RDN has prefix "CN" */
+ ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
+ samdb_cn_to_lDAPDisplayName(ac->msg,
+ (const char *) rdn_value->data));
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
}
- }
- /* do not allow to mark an attributeSchema as RODC filtered if it
- * is system-critical */
- if (check_rodc_critical_attribute(ac->msg)) {
- ldb_asprintf_errstring(ldb,
- "samldb: refusing schema add of %s - cannot combine critical attribute with RODC filtering",
- ldb_dn_get_linearized(ac->msg->dn));
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
+ /* do not allow to mark an attributeSchema as RODC filtered if it
+ * is system-critical */
+ if (check_rodc_critical_attribute(ac->msg)) {
+ ldb_asprintf_errstring(ldb,
+ "samldb: refusing schema add of %s - cannot combine critical attribute with RODC filtering",
+ ldb_dn_get_linearized(ac->msg->dn));
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "isSingleValued", "FALSE");
- if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "isSingleValued", "FALSE");
+ if (ret != LDB_SUCCESS) return ret;
- if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
- struct GUID guid;
- /* a new GUID */
- guid = GUID_random();
- ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
- if (ret != LDB_SUCCESS) {
- ldb_oom(ldb);
- return ret;
+ if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
+ struct GUID guid;
+ /* a new GUID */
+ guid = GUID_random();
+ ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
+ if (ret != LDB_SUCCESS) {
+ ldb_oom(ldb);
+ return ret;
+ }
}
- }
- /* handle msDS-IntID attribute */
- ret = samldb_add_handle_msDS_IntId(ac);
- if (ret != LDB_SUCCESS) return ret;
+ /* handle msDS-IntID attribute */
+ ret = samldb_add_handle_msDS_IntId(ac);
+ if (ret != LDB_SUCCESS) return ret;
- ret = samldb_add_step(ac, samldb_add_entry);
- if (ret != LDB_SUCCESS) return ret;
+ ret = samldb_add_step(ac, samldb_add_entry);
+ if (ret != LDB_SUCCESS) return ret;
+ break;
+ }
- } else {
- ldb_asprintf_errstring(ldb,
- "Invalid entry type!");
- return LDB_ERR_OPERATIONS_ERROR;
+ default:
+ ldb_asprintf_errstring(ldb,
+ "Invalid entry type!");
+ return LDB_ERR_OPERATIONS_ERROR;
+ break;
}
return samldb_first_step(ac);
}
ret = dsdb_module_schema_info_update(ac->module, schema,
- DSDB_FLAG_NEXT_MODULE, ac->req);
+ DSDB_FLAG_NEXT_MODULE|
+ DSDB_FLAG_AS_SYSTEM,
+ ac->req);
if (ret != LDB_SUCCESS) {
ldb_asprintf_errstring(ldb,
"samldb_schema_info_update: dsdb_module_schema_info_update failed with %s",
static int samldb_objectclass_trigger(struct samldb_ctx *ac)
{
struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
- struct loadparm_context *lp_ctx = talloc_get_type(ldb_get_opaque(ldb,
- "loadparm"), struct loadparm_context);
+ void *skip_allocate_sids = ldb_get_opaque(ldb,
+ "skip_allocate_sids");
struct ldb_message_element *el, *el2;
- enum sid_generator sid_generator;
struct dom_sid *sid;
int ret;
}
/* but generate a new SID when we do have an add operations */
- if ((sid == NULL) && (ac->req->operation == LDB_ADD)) {
- sid_generator = lpcfg_sid_generator(lp_ctx);
- if (sid_generator == SID_GENERATOR_INTERNAL) {
- ret = samldb_add_step(ac, samldb_allocate_sid);
- if (ret != LDB_SUCCESS) return ret;
- }
+ if ((sid == NULL) && (ac->req->operation == LDB_ADD) && !skip_allocate_sids) {
+ ret = samldb_add_step(ac, samldb_allocate_sid);
+ if (ret != LDB_SUCCESS) return ret;
}
- if (strcmp(ac->type, "user") == 0) {
- bool uac_generated = false;
+ switch(ac->type) {
+ case SAMLDB_TYPE_USER: {
+ bool uac_generated = false;
- /* Step 1.2: Default values */
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "accountExpires", "9223372036854775807");
- if (ret != LDB_SUCCESS) return ret;
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "badPasswordTime", "0");
- if (ret != LDB_SUCCESS) return ret;
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "badPwdCount", "0");
- if (ret != LDB_SUCCESS) return ret;
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "codePage", "0");
- if (ret != LDB_SUCCESS) return ret;
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "countryCode", "0");
- if (ret != LDB_SUCCESS) return ret;
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "lastLogoff", "0");
- if (ret != LDB_SUCCESS) return ret;
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "lastLogon", "0");
- if (ret != LDB_SUCCESS) return ret;
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "logonCount", "0");
- if (ret != LDB_SUCCESS) return ret;
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "pwdLastSet", "0");
- if (ret != LDB_SUCCESS) return ret;
+ /* Step 1.2: Default values */
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "accountExpires", "9223372036854775807");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "badPasswordTime", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "badPwdCount", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "codePage", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "countryCode", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "lastLogoff", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "lastLogon", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "logonCount", "0");
+ if (ret != LDB_SUCCESS) return ret;
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "pwdLastSet", "0");
+ if (ret != LDB_SUCCESS) return ret;
- /* On add operations we might need to generate a
- * "userAccountControl" (if it isn't specified). */
- el = ldb_msg_find_element(ac->msg, "userAccountControl");
- if ((el == NULL) && (ac->req->operation == LDB_ADD)) {
- ret = samdb_msg_set_uint(ldb, ac->msg, ac->msg,
- "userAccountControl",
- UF_NORMAL_ACCOUNT);
- if (ret != LDB_SUCCESS) {
- return ret;
+ /* On add operations we might need to generate a
+ * "userAccountControl" (if it isn't specified). */
+ el = ldb_msg_find_element(ac->msg, "userAccountControl");
+ if ((el == NULL) && (ac->req->operation == LDB_ADD)) {
+ ret = samdb_msg_set_uint(ldb, ac->msg, ac->msg,
+ "userAccountControl",
+ UF_NORMAL_ACCOUNT);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ uac_generated = true;
}
- uac_generated = true;
- }
- el = ldb_msg_find_element(ac->msg, "userAccountControl");
- if (el != NULL) {
- uint32_t user_account_control, account_type;
+ el = ldb_msg_find_element(ac->msg, "userAccountControl");
+ if (el != NULL) {
+ uint32_t user_account_control, account_type;
- /* Step 1.3: "userAccountControl" -> "sAMAccountType" mapping */
- user_account_control = ldb_msg_find_attr_as_uint(ac->msg,
- "userAccountControl",
- 0);
+ /* Step 1.3: "userAccountControl" -> "sAMAccountType" mapping */
+ user_account_control = ldb_msg_find_attr_as_uint(ac->msg,
+ "userAccountControl",
+ 0);
- /* Temporary duplicate accounts aren't allowed */
- if ((user_account_control & UF_TEMP_DUPLICATE_ACCOUNT) != 0) {
- return LDB_ERR_OTHER;
- }
+ /* Temporary duplicate accounts aren't allowed */
+ if ((user_account_control & UF_TEMP_DUPLICATE_ACCOUNT) != 0) {
+ return LDB_ERR_OTHER;
+ }
- /* Workstation and (read-only) DC objects do need objectclass "computer" */
- if ((samdb_find_attribute(ldb, ac->msg,
- "objectclass", "computer") == NULL) &&
- (user_account_control &
- (UF_SERVER_TRUST_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT))) {
- ldb_set_errstring(ldb,
- "samldb: Requested account type does need objectclass 'computer'!");
- return LDB_ERR_OBJECT_CLASS_VIOLATION;
- }
+ /* Workstation and (read-only) DC objects do need objectclass "computer" */
+ if ((samdb_find_attribute(ldb, ac->msg,
+ "objectclass", "computer") == NULL) &&
+ (user_account_control &
+ (UF_SERVER_TRUST_ACCOUNT | UF_WORKSTATION_TRUST_ACCOUNT))) {
+ ldb_set_errstring(ldb,
+ "samldb: Requested account type does need objectclass 'computer'!");
+ return LDB_ERR_OBJECT_CLASS_VIOLATION;
+ }
- account_type = ds_uf2atype(user_account_control);
- if (account_type == 0) {
- ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
- ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
- "sAMAccountType",
- account_type);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
- el2->flags = LDB_FLAG_MOD_REPLACE;
-
- /* "isCriticalSystemObject" might be set */
- if (user_account_control &
- (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
- ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
- "TRUE");
- if (ret != LDB_SUCCESS) {
- return ret;
+ account_type = ds_uf2atype(user_account_control);
+ if (account_type == 0) {
+ ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
+ return LDB_ERR_UNWILLING_TO_PERFORM;
}
- el2 = ldb_msg_find_element(ac->msg,
- "isCriticalSystemObject");
- el2->flags = LDB_FLAG_MOD_REPLACE;
- } else if (user_account_control & UF_WORKSTATION_TRUST_ACCOUNT) {
- ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
- "FALSE");
+ ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+ "sAMAccountType",
+ account_type);
if (ret != LDB_SUCCESS) {
return ret;
}
- el2 = ldb_msg_find_element(ac->msg,
- "isCriticalSystemObject");
+ el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
el2->flags = LDB_FLAG_MOD_REPLACE;
- }
-
- /* Step 1.4: "userAccountControl" -> "primaryGroupID" mapping */
- if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
- uint32_t rid = ds_uf2prim_group_rid(user_account_control);
- /*
- * Older AD deployments don't know about the
- * RODC group
- */
- if (rid == DOMAIN_RID_READONLY_DCS) {
- ret = samldb_prim_group_tester(ac, rid);
+ /* "isCriticalSystemObject" might be set */
+ if (user_account_control &
+ (UF_SERVER_TRUST_ACCOUNT | UF_PARTIAL_SECRETS_ACCOUNT)) {
+ ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+ "TRUE");
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(ac->msg,
+ "isCriticalSystemObject");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
+ } else if (user_account_control & UF_WORKSTATION_TRUST_ACCOUNT) {
+ ret = ldb_msg_add_string(ac->msg, "isCriticalSystemObject",
+ "FALSE");
if (ret != LDB_SUCCESS) {
return ret;
}
+ el2 = ldb_msg_find_element(ac->msg,
+ "isCriticalSystemObject");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
}
- ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
- "primaryGroupID", rid);
- if (ret != LDB_SUCCESS) {
- return ret;
- }
- el2 = ldb_msg_find_element(ac->msg,
- "primaryGroupID");
- el2->flags = LDB_FLAG_MOD_REPLACE;
- }
+ /* Step 1.4: "userAccountControl" -> "primaryGroupID" mapping */
+ if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
+ uint32_t rid = ds_uf2prim_group_rid(user_account_control);
+
+ /*
+ * Older AD deployments don't know about the
+ * RODC group
+ */
+ if (rid == DOMAIN_RID_READONLY_DCS) {
+ ret = samldb_prim_group_tester(ac, rid);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
- /* Step 1.5: Add additional flags when needed */
- /* Obviously this is done when the "userAccountControl"
- * has been generated here (tested against Windows
- * Server) */
- if (uac_generated) {
- user_account_control |= UF_ACCOUNTDISABLE;
- user_account_control |= UF_PASSWD_NOTREQD;
+ ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+ "primaryGroupID", rid);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(ac->msg,
+ "primaryGroupID");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
+ }
- ret = samdb_msg_set_uint(ldb, ac->msg, ac->msg,
- "userAccountControl",
- user_account_control);
- if (ret != LDB_SUCCESS) {
- return ret;
+ /* Step 1.5: Add additional flags when needed */
+ /* Obviously this is done when the "userAccountControl"
+ * has been generated here (tested against Windows
+ * Server) */
+ if (uac_generated) {
+ user_account_control |= UF_ACCOUNTDISABLE;
+ user_account_control |= UF_PASSWD_NOTREQD;
+
+ ret = samdb_msg_set_uint(ldb, ac->msg, ac->msg,
+ "userAccountControl",
+ user_account_control);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
}
}
- }
-
- } else if (strcmp(ac->type, "group") == 0) {
- const char *tempstr;
+ break;
+ }
+ case SAMLDB_TYPE_GROUP: {
+ const char *tempstr;
+
+ /* Step 2.2: Default values */
+ tempstr = talloc_asprintf(ac->msg, "%d",
+ GTYPE_SECURITY_GLOBAL_GROUP);
+ if (tempstr == NULL) return ldb_operr(ldb);
+ ret = samdb_find_or_add_attribute(ldb, ac->msg,
+ "groupType", tempstr);
+ if (ret != LDB_SUCCESS) return ret;
- /* Step 2.2: Default values */
- tempstr = talloc_asprintf(ac->msg, "%d",
- GTYPE_SECURITY_GLOBAL_GROUP);
- if (tempstr == NULL) return ldb_operr(ldb);
- ret = samdb_find_or_add_attribute(ldb, ac->msg,
- "groupType", tempstr);
- if (ret != LDB_SUCCESS) return ret;
+ /* Step 2.3: "groupType" -> "sAMAccountType" */
+ el = ldb_msg_find_element(ac->msg, "groupType");
+ if (el != NULL) {
+ uint32_t group_type, account_type;
- /* Step 2.3: "groupType" -> "sAMAccountType" */
- el = ldb_msg_find_element(ac->msg, "groupType");
- if (el != NULL) {
- uint32_t group_type, account_type;
+ group_type = ldb_msg_find_attr_as_uint(ac->msg,
+ "groupType", 0);
- group_type = ldb_msg_find_attr_as_uint(ac->msg,
- "groupType", 0);
+ /* The creation of builtin groups requires the
+ * RELAX control */
+ if (group_type == GTYPE_SECURITY_BUILTIN_LOCAL_GROUP) {
+ if (ldb_request_get_control(ac->req,
+ LDB_CONTROL_RELAX_OID) == NULL) {
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+ }
- /* The creation of builtin groups requires the
- * RELAX control */
- if (group_type == GTYPE_SECURITY_BUILTIN_LOCAL_GROUP) {
- if (ldb_request_get_control(ac->req,
- LDB_CONTROL_RELAX_OID) == NULL) {
+ account_type = ds_gtype2atype(group_type);
+ if (account_type == 0) {
+ ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
return LDB_ERR_UNWILLING_TO_PERFORM;
}
+ ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+ "sAMAccountType",
+ account_type);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
+ el2->flags = LDB_FLAG_MOD_REPLACE;
}
-
- account_type = ds_gtype2atype(group_type);
- if (account_type == 0) {
- ldb_set_errstring(ldb, "samldb: Unrecognized account type!");
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
- ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
- "sAMAccountType",
- account_type);
- if (ret != LDB_SUCCESS) {
- return ret;
+ break;
}
- el2 = ldb_msg_find_element(ac->msg, "sAMAccountType");
- el2->flags = LDB_FLAG_MOD_REPLACE;
- }
+
+ default:
+ ldb_asprintf_errstring(ldb,
+ "Invalid entry type!");
+ return LDB_ERR_OPERATIONS_ERROR;
+ break;
}
return LDB_SUCCESS;
return ldb_operr(ldb);
}
- ret = dsdb_module_search(ac->module, ac, &res, NULL, LDB_SCOPE_SUBTREE,
+ ret = dsdb_module_search(ac->module, ac, &res,
+ ldb_get_default_basedn(ldb),
+ LDB_SCOPE_SUBTREE,
noattrs, DSDB_FLAG_NEXT_MODULE,
ac->req,
"(objectSid=%s)",
return LDB_SUCCESS;
}
- ret = dsdb_module_search(ac->module, ac, &group_res, NULL, LDB_SCOPE_SUBTREE,
+ ret = dsdb_module_search(ac->module, ac, &group_res,
+ ldb_get_default_basedn(ldb),
+ LDB_SCOPE_SUBTREE,
noattrs, DSDB_FLAG_NEXT_MODULE,
ac->req,
"(objectSid=%s)",
return ldb_operr(ldb);
}
- ret = dsdb_module_search(ac->module, ac, &group_res, NULL, LDB_SCOPE_SUBTREE,
+ ret = dsdb_module_search(ac->module, ac, &group_res,
+ ldb_get_default_basedn(ldb),
+ LDB_SCOPE_SUBTREE,
noattrs, DSDB_FLAG_NEXT_MODULE,
ac->req,
"(objectSid=%s)",
talloc_free(tmp_msg);
ret = dsdb_module_search_dn(ac->module, ac, &res, ac->msg->dn, attrs,
- DSDB_FLAG_NEXT_MODULE, ac->req);
+ DSDB_FLAG_NEXT_MODULE |
+ DSDB_SEARCH_SHOW_DELETED, ac->req);
if (ret != LDB_SUCCESS) {
return ret;
}
/* Make sure that a "sAMAccountName" is only used once */
- ret = dsdb_module_search(ac->module, ac, &res, NULL, LDB_SCOPE_SUBTREE, no_attrs,
+ ret = dsdb_module_search(ac->module, ac, &res,
+ ldb_get_default_basedn(ldb),
+ LDB_SCOPE_SUBTREE, no_attrs,
DSDB_FLAG_NEXT_MODULE, ac->req,
"(sAMAccountName=%s)", enc_str);
if (ret != LDB_SUCCESS) {
struct ldb_result *res;
struct dom_sid *group_sid;
unsigned int i, j;
- int cnt;
int ret;
/* Fetch information from the existing object */
el = &ac->msg->elements[i];
for (j = 0; j < el->num_values; j++) {
- struct ldb_message_element *mo;
struct ldb_result *group_res;
const char *group_attrs[] = { "primaryGroupID" , NULL };
uint32_t prim_group_rid;
+ if (LDB_FLAG_MOD_TYPE(el->flags) == LDB_FLAG_MOD_DELETE) {
+ /* Deletes will be handled in
+ * repl_meta_data, and deletes not
+ * matching a member will return
+ * LDB_ERR_UNWILLING_TO_PERFORM
+ * there */
+ continue;
+ }
+
member_dn = ldb_dn_from_ldb_val(ac, ldb,
&el->values[j]);
if (!ldb_dn_validate(member_dn)) {
return ldb_operr(ldb);
}
- /* The "member" attribute can be modified with the
- * following restrictions (beside a valid DN):
- *
- * - "add" operations can only be performed when the
- * member still doesn't exist - if not then return
- * ERR_ENTRY_ALREADY_EXISTS (not
- * ERR_ATTRIBUTE_OR_VALUE_EXISTS!)
- * - "delete" operations can only be performed when the
- * member does exist - if not then return
- * ERR_UNWILLING_TO_PERFORM (not
- * ERR_NO_SUCH_ATTRIBUTE!)
- * - primary group check
- */
- mo = samdb_find_attribute(ldb, res->msgs[0], "member",
- ldb_dn_get_linearized(member_dn));
- if (mo == NULL) {
- cnt = 0;
- } else {
- cnt = 1;
- }
-
- if ((cnt > 0) && (LDB_FLAG_MOD_TYPE(el->flags)
- == LDB_FLAG_MOD_ADD)) {
- return LDB_ERR_ENTRY_ALREADY_EXISTS;
- }
- if ((cnt == 0) && LDB_FLAG_MOD_TYPE(el->flags)
- == LDB_FLAG_MOD_DELETE) {
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
-
/* Denies to add "member"s to groups which are primary
* ones for them - in this case return
* ERR_ENTRY_ALREADY_EXISTS. */
}
if (dom_sid_equal(group_sid, sid)) {
+ ldb_asprintf_errstring(ldb,
+ "samldb: member %s already set via primaryGroupID %u",
+ ldb_dn_get_linearized(member_dn), prim_group_rid);
return LDB_ERR_ENTRY_ALREADY_EXISTS;
}
}
if (samdb_find_attribute(ldb, ac->msg,
"objectclass", "user") != NULL) {
- ac->type = "user";
+ ac->type = SAMLDB_TYPE_USER;
ret = samldb_prim_group_trigger(ac);
if (ret != LDB_SUCCESS) {
if (samdb_find_attribute(ldb, ac->msg,
"objectclass", "group") != NULL) {
- ac->type = "group";
+ ac->type = SAMLDB_TYPE_GROUP;
ret = samldb_objectclass_trigger(ac);
if (ret != LDB_SUCCESS) {
return ret;
}
- ac->type = "classSchema";
+ ac->type = SAMLDB_TYPE_CLASS;
return samldb_fill_object(ac);
}
return ret;
}
- ac->type = "attributeSchema";
+ ac->type = SAMLDB_TYPE_ATTRIBUTE;
return samldb_fill_object(ac);
}
/* make sure that "objectSid" is not specified */
el = ldb_msg_find_element(req->op.mod.message, "objectSid");
if (el != NULL) {
- ldb_set_errstring(ldb,
- "samldb: objectSid must not be specified!");
- return LDB_ERR_UNWILLING_TO_PERFORM;
+ if (ldb_request_get_control(req, LDB_CONTROL_PROVISION_OID) == NULL) {
+ ldb_set_errstring(ldb,
+ "samldb: objectSid must not be specified!");
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
}
/* make sure that "sAMAccountType" is not specified */
el = ldb_msg_find_element(req->op.mod.message, "sAMAccountType");
NTSTATUS status;
int ret;
struct ldb_result *res;
- const char *attrs[] = { "objectSid", NULL };
+ const char *attrs[] = { "objectSid", "isDeleted", NULL };
const char *noattrs[] = { NULL };
ldb = ldb_module_get_ctx(ac->module);
/* Finds out the SID/RID of the SAM object */
- ret = dsdb_module_search_dn(ac->module, ac, &res, ac->req->op.del.dn, attrs, DSDB_FLAG_NEXT_MODULE, ac->req);
+ ret = dsdb_module_search_dn(ac->module, ac, &res, ac->req->op.del.dn,
+ attrs,
+ DSDB_FLAG_NEXT_MODULE | DSDB_SEARCH_SHOW_DELETED,
+ ac->req);
if (ret != LDB_SUCCESS) {
return ret;
}
+ if (ldb_msg_check_string_attribute(res->msgs[0], "isDeleted", "TRUE")) {
+ return LDB_SUCCESS;
+ }
+
sid = samdb_result_dom_sid(ac, res->msgs[0], "objectSid");
if (sid == NULL) {
/* No SID - it might not be a SAM object - therefore ok */
}
/* Deny delete requests from groups which are primary ones */
- ret = dsdb_module_search(ac->module, ac, &res, NULL, LDB_SCOPE_SUBTREE, noattrs,
+ ret = dsdb_module_search(ac->module, ac, &res,
+ ldb_get_default_basedn(ldb),
+ LDB_SCOPE_SUBTREE, noattrs,
DSDB_FLAG_NEXT_MODULE,
ac->req,
"(&(primaryGroupID=%u)(objectClass=user))", rid);
git.samba.org / mat / samba.git / blobdiff