4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
5 Copyright (C) Simo Sorce 2004-2008
6 Copyright (C) Matthias Dieter Wallnöfer 2009
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 * Component: ldb samldb module
27 * Description: add embedded user/group creation functionality
33 #include "libcli/ldap/ldap_ndr.h"
34 #include "ldb_module.h"
35 #include "dsdb/samdb/samdb.h"
36 #include "dsdb/samdb/ldb_modules/util.h"
37 #include "libcli/security/security.h"
38 #include "librpc/gen_ndr/ndr_security.h"
39 #include "../lib/util/util_ldb.h"
41 #include "param/param.h"
45 typedef int (*samldb_step_fn_t
)(struct samldb_ctx
*);
48 struct samldb_step
*next
;
53 struct ldb_module
*module
;
54 struct ldb_request
*req
;
56 /* used for add operations */
59 /* the resulting message */
60 struct ldb_message
*msg
;
62 /* holds the entry SID */
65 /* holds a generic dn */
68 /* used in conjunction with "sid" in "samldb_dn_from_sid" */
69 struct ldb_dn
*res_dn
;
71 /* used in conjunction with "dn" in "samldb_sid_from_dn" */
72 struct dom_sid
*res_sid
;
74 /* used in "samldb_user_dn_to_prim_group_rid" */
75 uint32_t prim_group_rid
;
77 /* used in conjunction with "prim_group_rid" in
78 * "samldb_prim_group_rid_to_users_cnt" */
79 unsigned int users_cnt
;
81 /* used in "samldb_group_add_member" and "samldb_group_del_member" */
82 struct ldb_dn
*group_dn
;
83 struct ldb_dn
*member_dn
;
85 /* used in "samldb_primary_group_change" */
86 struct ldb_dn
*user_dn
;
87 struct ldb_dn
*old_prim_group_dn
, *new_prim_group_dn
;
89 /* generic counter - used in "samldb_member_check" */
92 /* all the async steps necessary to complete the operation */
93 struct samldb_step
*steps
;
94 struct samldb_step
*curstep
;
96 /* If someone set an ares to forward controls and response back to the caller */
97 struct ldb_reply
*ares
;
100 static struct samldb_ctx
*samldb_ctx_init(struct ldb_module
*module
,
101 struct ldb_request
*req
)
103 struct ldb_context
*ldb
;
104 struct samldb_ctx
*ac
;
106 ldb
= ldb_module_get_ctx(module
);
108 ac
= talloc_zero(req
, struct samldb_ctx
);
120 static int samldb_add_step(struct samldb_ctx
*ac
, samldb_step_fn_t fn
)
122 struct samldb_step
*step
, *stepper
;
124 step
= talloc_zero(ac
, struct samldb_step
);
126 return LDB_ERR_OPERATIONS_ERROR
;
131 if (ac
->steps
== NULL
) {
135 if (ac
->curstep
== NULL
)
136 return LDB_ERR_OPERATIONS_ERROR
;
137 for (stepper
= ac
->curstep
; stepper
->next
!= NULL
;
138 stepper
= stepper
->next
);
139 stepper
->next
= step
;
145 static int samldb_first_step(struct samldb_ctx
*ac
)
147 if (ac
->steps
== NULL
) {
148 return LDB_ERR_OPERATIONS_ERROR
;
151 ac
->curstep
= ac
->steps
;
152 return ac
->curstep
->fn(ac
);
155 static int samldb_next_step(struct samldb_ctx
*ac
)
157 if (ac
->curstep
->next
) {
158 ac
->curstep
= ac
->curstep
->next
;
159 return ac
->curstep
->fn(ac
);
162 /* we exit the samldb module here */
163 /* If someone set an ares to forward controls and response back to the caller, use them */
165 return ldb_module_done(ac
->req
, ac
->ares
->controls
,
166 ac
->ares
->response
, LDB_SUCCESS
);
168 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_SUCCESS
);
172 static int samldb_generate_samAccountName(struct ldb_message
*msg
)
176 /* Format: $000000-000000000000 */
178 name
= talloc_asprintf(msg
, "$%.6X-%.6X%.6X",
179 (unsigned int)generate_random(),
180 (unsigned int)generate_random(),
181 (unsigned int)generate_random());
183 return LDB_ERR_OPERATIONS_ERROR
;
185 return ldb_msg_add_steal_string(msg
, "samAccountName", name
);
189 * samldb_check_samAccountName (async)
192 static int samldb_check_samAccountName_callback(struct ldb_request
*req
,
193 struct ldb_reply
*ares
)
195 struct samldb_ctx
*ac
;
198 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
200 if (ares
->error
!= LDB_SUCCESS
) {
201 return ldb_module_done(ac
->req
, ares
->controls
,
202 ares
->response
, ares
->error
);
205 switch (ares
->type
) {
206 case LDB_REPLY_ENTRY
:
207 /* if we get an entry it means this samAccountName
209 return ldb_module_done(ac
->req
, NULL
, NULL
,
210 LDB_ERR_ENTRY_ALREADY_EXISTS
);
212 case LDB_REPLY_REFERRAL
:
219 /* not found, go on */
221 ret
= samldb_next_step(ac
);
225 if (ret
!= LDB_SUCCESS
) {
226 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
232 static int samldb_check_samAccountName(struct samldb_ctx
*ac
)
234 struct ldb_context
*ldb
;
235 struct ldb_request
*req
;
240 ldb
= ldb_module_get_ctx(ac
->module
);
242 if (ldb_msg_find_element(ac
->msg
, "samAccountName") == NULL
) {
243 ret
= samldb_generate_samAccountName(ac
->msg
);
244 if (ret
!= LDB_SUCCESS
) {
249 name
= ldb_msg_find_attr_as_string(ac
->msg
, "samAccountName", NULL
);
251 return LDB_ERR_OPERATIONS_ERROR
;
253 filter
= talloc_asprintf(ac
, "samAccountName=%s",
254 ldb_binary_encode_string(ac
, name
));
255 if (filter
== NULL
) {
256 return LDB_ERR_OPERATIONS_ERROR
;
259 ret
= ldb_build_search_req(&req
, ldb
, ac
,
260 samdb_base_dn(ldb
), LDB_SCOPE_SUBTREE
,
263 ac
, samldb_check_samAccountName_callback
,
266 if (ret
!= LDB_SUCCESS
) {
269 return ldb_next_request(ac
->module
, req
);
273 static int samldb_check_samAccountType(struct samldb_ctx
*ac
)
275 struct ldb_context
*ldb
;
276 unsigned int account_type
;
277 unsigned int group_type
;
281 ldb
= ldb_module_get_ctx(ac
->module
);
283 /* make sure sAMAccountType is not specified */
284 if (ldb_msg_find_element(ac
->msg
, "sAMAccountType") != NULL
) {
285 ldb_asprintf_errstring(ldb
,
286 "sAMAccountType must not be specified!");
287 return LDB_ERR_UNWILLING_TO_PERFORM
;
290 if (strcmp("user", ac
->type
) == 0) {
291 uac
= samdb_result_uint(ac
->msg
, "userAccountControl", 0);
293 ldb_asprintf_errstring(ldb
,
294 "userAccountControl invalid!");
295 return LDB_ERR_UNWILLING_TO_PERFORM
;
297 account_type
= ds_uf2atype(uac
);
298 ret
= samdb_msg_add_uint(ldb
,
302 if (ret
!= LDB_SUCCESS
) {
307 if (strcmp("group", ac
->type
) == 0) {
309 group_type
= samdb_result_uint(ac
->msg
, "groupType", 0);
310 if (group_type
== 0) {
311 ldb_asprintf_errstring(ldb
,
312 "groupType invalid!\n");
313 return LDB_ERR_UNWILLING_TO_PERFORM
;
315 account_type
= ds_gtype2atype(group_type
);
316 ret
= samdb_msg_add_uint(ldb
,
320 if (ret
!= LDB_SUCCESS
) {
326 return samldb_next_step(ac
);
329 static bool samldb_msg_add_sid(struct ldb_message
*msg
,
331 const struct dom_sid
*sid
)
334 enum ndr_err_code ndr_err
;
336 ndr_err
= ndr_push_struct_blob(&v
, msg
, NULL
, sid
,
337 (ndr_push_flags_fn_t
)ndr_push_dom_sid
);
338 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
341 return (ldb_msg_add_value(msg
, name
, &v
, NULL
) == 0);
345 /* allocate a SID using our RID Set */
346 static int samldb_allocate_sid(struct samldb_ctx
*ac
)
350 struct ldb_context
*ldb
= ldb_module_get_ctx(ac
->module
);
352 ret
= ridalloc_allocate_rid(ac
->module
, &rid
);
353 if (ret
!= LDB_SUCCESS
) {
357 ac
->sid
= dom_sid_add_rid(ac
, samdb_domain_sid(ldb
), rid
);
358 if (ac
->sid
== NULL
) {
359 ldb_module_oom(ac
->module
);
360 return LDB_ERR_OPERATIONS_ERROR
;
363 if ( ! samldb_msg_add_sid(ac
->msg
, "objectSid", ac
->sid
)) {
364 return LDB_ERR_OPERATIONS_ERROR
;
367 return samldb_next_step(ac
);
371 * samldb_dn_from_sid (async)
374 static int samldb_dn_from_sid(struct samldb_ctx
*ac
);
376 static int samldb_dn_from_sid_callback(struct ldb_request
*req
,
377 struct ldb_reply
*ares
)
379 struct ldb_context
*ldb
;
380 struct samldb_ctx
*ac
;
383 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
384 ldb
= ldb_module_get_ctx(ac
->module
);
387 ret
= LDB_ERR_OPERATIONS_ERROR
;
390 if (ares
->error
!= LDB_SUCCESS
) {
391 return ldb_module_done(ac
->req
, ares
->controls
,
392 ares
->response
, ares
->error
);
395 switch (ares
->type
) {
396 case LDB_REPLY_ENTRY
:
398 if (ac
->res_dn
!= NULL
) {
400 ldb_set_errstring(ldb
,
401 "Invalid number of results while searching "
402 "for domain objects!");
403 ret
= LDB_ERR_OPERATIONS_ERROR
;
406 ac
->res_dn
= ldb_dn_copy(ac
, ares
->message
->dn
);
412 case LDB_REPLY_REFERRAL
:
421 /* found or not found, go on */
422 ret
= samldb_next_step(ac
);
427 if (ret
!= LDB_SUCCESS
) {
428 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
434 /* Finds the DN "res_dn" of an object with a given SID "sid" */
435 static int samldb_dn_from_sid(struct samldb_ctx
*ac
)
437 struct ldb_context
*ldb
;
438 static const char * const attrs
[] = { NULL
};
439 struct ldb_request
*req
;
443 ldb
= ldb_module_get_ctx(ac
->module
);
446 return LDB_ERR_OPERATIONS_ERROR
;
448 filter
= talloc_asprintf(ac
, "(objectSid=%s)",
449 ldap_encode_ndr_dom_sid(ac
, ac
->sid
));
451 return LDB_ERR_OPERATIONS_ERROR
;
453 ret
= ldb_build_search_req(&req
, ldb
, ac
,
454 ldb_get_default_basedn(ldb
),
458 ac
, samldb_dn_from_sid_callback
,
460 if (ret
!= LDB_SUCCESS
)
463 return ldb_next_request(ac
->module
, req
);
467 static int samldb_check_primaryGroupID_1(struct samldb_ctx
*ac
)
469 struct ldb_context
*ldb
;
472 ldb
= ldb_module_get_ctx(ac
->module
);
474 rid
= samdb_result_uint(ac
->msg
, "primaryGroupID", ~0);
475 ac
->sid
= dom_sid_add_rid(ac
, samdb_domain_sid(ldb
), rid
);
477 return LDB_ERR_OPERATIONS_ERROR
;
480 return samldb_next_step(ac
);
483 static int samldb_check_primaryGroupID_2(struct samldb_ctx
*ac
)
485 if (ac
->res_dn
== NULL
) {
486 struct ldb_context
*ldb
;
487 ldb
= ldb_module_get_ctx(ac
->module
);
488 ldb_asprintf_errstring(ldb
,
489 "Failed to find group sid %s!",
490 dom_sid_string(ac
->sid
, ac
->sid
));
491 return LDB_ERR_UNWILLING_TO_PERFORM
;
494 return samldb_next_step(ac
);
499 * samldb_set_defaultObjectCategory_callback (async)
502 static int samldb_set_defaultObjectCategory_callback(struct ldb_request
*req
,
503 struct ldb_reply
*ares
)
505 struct ldb_context
*ldb
;
506 struct samldb_ctx
*ac
;
509 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
510 ldb
= ldb_module_get_ctx(ac
->module
);
513 ret
= LDB_ERR_OPERATIONS_ERROR
;
516 if (ares
->error
!= LDB_SUCCESS
) {
517 return ldb_module_done(ac
->req
, ares
->controls
,
518 ares
->response
, ares
->error
);
520 if (ares
->type
!= LDB_REPLY_DONE
) {
521 ldb_set_errstring(ldb
,
522 "Invalid reply type!");
523 ret
= LDB_ERR_OPERATIONS_ERROR
;
527 ret
= samldb_next_step(ac
);
530 if (ret
!= LDB_SUCCESS
) {
531 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
537 static int samldb_set_defaultObjectCategory(struct samldb_ctx
*ac
)
539 struct ldb_context
*ldb
;
540 struct ldb_message
*msg
;
541 struct ldb_request
*req
;
544 ldb
= ldb_module_get_ctx(ac
->module
);
546 /* (Re)set the default object category to have it set to the DN in the
548 msg
= ldb_msg_new(ac
);
549 msg
->dn
= ac
->msg
->dn
;
550 ldb_msg_add_empty(msg
, "defaultObjectCategory",
551 LDB_FLAG_MOD_REPLACE
, NULL
);
552 ldb_msg_add_steal_string(msg
, "defaultObjectCategory",
553 ldb_dn_alloc_linearized(msg
, ac
->dn
));
555 ret
= ldb_build_mod_req(&req
, ldb
, ac
,
558 samldb_set_defaultObjectCategory_callback
,
560 if (ret
!= LDB_SUCCESS
) {
565 return ldb_next_request(ac
->module
, req
);
569 * samldb_find_for_defaultObjectCategory (async)
572 static int samldb_find_for_defaultObjectCategory_callback(struct ldb_request
*req
,
573 struct ldb_reply
*ares
)
575 struct ldb_context
*ldb
;
576 struct samldb_ctx
*ac
;
579 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
580 ldb
= ldb_module_get_ctx(ac
->module
);
583 ret
= LDB_ERR_OPERATIONS_ERROR
;
586 if (ares
->error
!= LDB_SUCCESS
) {
587 if (ares
->error
== LDB_ERR_NO_SUCH_OBJECT
) {
588 if (ldb_request_get_control(ac
->req
,
589 LDB_CONTROL_RELAX_OID
) != NULL
) {
590 /* Don't be pricky when the DN doesn't exist */
591 /* if we have the RELAX control specified */
592 ac
->dn
= req
->op
.search
.base
;
593 return samldb_next_step(ac
);
595 ldb_set_errstring(ldb
,
596 "samldb_find_defaultObjectCategory: "
597 "Invalid DN for 'defaultObjectCategory'!");
598 ares
->error
= LDB_ERR_CONSTRAINT_VIOLATION
;
602 return ldb_module_done(ac
->req
, ares
->controls
,
603 ares
->response
, ares
->error
);
606 switch (ares
->type
) {
607 case LDB_REPLY_ENTRY
:
608 ac
->dn
= talloc_steal(ac
, ares
->message
->dn
);
613 case LDB_REPLY_REFERRAL
:
622 if (ac
->dn
!= NULL
) {
623 /* when found go on */
624 ret
= samldb_next_step(ac
);
626 ret
= LDB_ERR_OPERATIONS_ERROR
;
632 if (ret
!= LDB_SUCCESS
) {
633 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
639 static int samldb_find_for_defaultObjectCategory(struct samldb_ctx
*ac
)
641 struct ldb_context
*ldb
;
642 struct ldb_request
*req
;
643 static const char *no_attrs
[] = { NULL
};
645 const struct ldb_val
*val
;
646 struct ldb_dn
*def_obj_cat_dn
;
648 ldb
= ldb_module_get_ctx(ac
->module
);
652 val
= ldb_msg_find_ldb_val(ac
->msg
, "defaultObjectCategory");
654 /* "defaultObjectCategory" has been set by the caller. Do some
655 * checks for consistency.
656 * NOTE: The real constraint check (that 'defaultObjectCategory'
657 * is the DN of the new objectclass or any parent of it) is
659 * For now we say that 'defaultObjectCategory' is valid if it
660 * exists and it is of objectclass "classSchema". */
661 def_obj_cat_dn
= ldb_dn_from_ldb_val(ac
, ldb
, val
);
662 if (def_obj_cat_dn
== NULL
) {
663 ldb_set_errstring(ldb
,
664 "samldb_find_defaultObjectCategory: Invalid DN "
665 "for 'defaultObjectCategory'!");
666 return LDB_ERR_CONSTRAINT_VIOLATION
;
669 /* "defaultObjectCategory" has not been set by the caller. Use
670 * the entry DN for it. */
671 def_obj_cat_dn
= ac
->msg
->dn
;
674 ret
= ldb_build_search_req(&req
, ldb
, ac
,
675 def_obj_cat_dn
, LDB_SCOPE_BASE
,
676 "objectClass=classSchema", no_attrs
,
678 ac
, samldb_find_for_defaultObjectCategory_callback
,
680 if (ret
!= LDB_SUCCESS
) {
684 ret
= dsdb_request_add_controls(req
,
685 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT
);
686 if (ret
!= LDB_SUCCESS
) {
690 return ldb_next_request(ac
->module
, req
);
694 * msDS-IntId attributeSchema attribute handling
695 * during LDB_ADD request processing
697 static int samldb_add_handle_msDS_IntId(struct samldb_ctx
*ac
)
702 uint32_t system_flags
;
703 struct ldb_context
*ldb
;
704 struct ldb_result
*ldb_res
;
705 struct ldb_dn
*schema_dn
;
707 ldb
= ldb_module_get_ctx(ac
->module
);
708 schema_dn
= ldb_get_schema_basedn(ldb
);
710 /* replicated update should always go through */
711 if (ldb_request_get_control(ac
->req
, DSDB_CONTROL_REPLICATED_UPDATE_OID
)) {
715 /* msDS-IntId is handled by system and should never be
716 * passed by clients */
717 if (ldb_msg_find_element(ac
->msg
, "msDS-IntId")) {
718 return LDB_ERR_UNWILLING_TO_PERFORM
;
721 /* do not generate msDS-IntId if Relax control is passed */
722 if (ldb_request_get_control(ac
->req
, LDB_CONTROL_RELAX_OID
)) {
726 /* check Functional Level */
727 if (dsdb_functional_level(ldb
) < DS_DOMAIN_FUNCTION_2003
) {
731 /* check systemFlags for SCHEMA_BASE_OBJECT flag */
732 system_flags
= ldb_msg_find_attr_as_uint(ac
->msg
, "systemFlags", 0);
733 if (system_flags
& SYSTEM_FLAG_SCHEMA_BASE_OBJECT
) {
737 /* Generate new value for msDs-IntId
738 * Value should be in 0x80000000..0xBFFFFFFF range */
739 msds_intid
= generate_random() % 0X3FFFFFFF;
740 msds_intid
+= 0x80000000;
742 /* probe id values until unique one is found */
745 if (msds_intid
> 0xBFFFFFFF) {
746 msds_intid
= 0x80000001;
749 ret
= dsdb_module_search(ac
->module
, ac
,
751 schema_dn
, LDB_SCOPE_ONELEVEL
, NULL
, 0,
752 "(msDS-IntId=%d)", msds_intid
);
753 if (ret
!= LDB_SUCCESS
) {
754 ldb_debug_set(ldb
, LDB_DEBUG_ERROR
,
755 __location__
": Searching for msDS-IntId=%d failed - %s\n",
758 return LDB_ERR_OPERATIONS_ERROR
;
760 id_exists
= (ldb_res
->count
> 0);
762 talloc_free(ldb_res
);
765 return ldb_msg_add_fmt(ac
->msg
, "msDS-IntId", "%d", msds_intid
);
770 * samldb_add_entry (async)
773 static int samldb_add_entry_callback(struct ldb_request
*req
,
774 struct ldb_reply
*ares
)
776 struct ldb_context
*ldb
;
777 struct samldb_ctx
*ac
;
780 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
781 ldb
= ldb_module_get_ctx(ac
->module
);
784 return ldb_module_done(ac
->req
, NULL
, NULL
,
785 LDB_ERR_OPERATIONS_ERROR
);
787 if (ares
->error
!= LDB_SUCCESS
) {
788 return ldb_module_done(ac
->req
, ares
->controls
,
789 ares
->response
, ares
->error
);
791 if (ares
->type
!= LDB_REPLY_DONE
) {
792 ldb_set_errstring(ldb
,
793 "Invalid reply type!\n");
794 return ldb_module_done(ac
->req
, NULL
, NULL
,
795 LDB_ERR_OPERATIONS_ERROR
);
798 /* The caller may wish to get controls back from the add */
799 ac
->ares
= talloc_steal(ac
, ares
);
801 ret
= samldb_next_step(ac
);
802 if (ret
!= LDB_SUCCESS
) {
803 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
808 static int samldb_add_entry(struct samldb_ctx
*ac
)
810 struct ldb_context
*ldb
;
811 struct ldb_request
*req
;
814 ldb
= ldb_module_get_ctx(ac
->module
);
816 ret
= ldb_build_add_req(&req
, ldb
, ac
,
819 ac
, samldb_add_entry_callback
,
821 if (ret
!= LDB_SUCCESS
) {
825 return ldb_next_request(ac
->module
, req
);
829 static int samldb_fill_object(struct samldb_ctx
*ac
, const char *type
)
831 struct ldb_context
*ldb
;
832 struct loadparm_context
*lp_ctx
;
833 enum sid_generator sid_generator
;
836 ldb
= ldb_module_get_ctx(ac
->module
);
838 /* Add informations for the different account types */
840 if (strcmp(ac
->type
, "user") == 0) {
841 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
842 "userAccountControl", "546");
843 if (ret
!= LDB_SUCCESS
) return ret
;
844 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
846 if (ret
!= LDB_SUCCESS
) return ret
;
847 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
849 if (ret
!= LDB_SUCCESS
) return ret
;
850 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
852 if (ret
!= LDB_SUCCESS
) return ret
;
853 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
854 "badPasswordTime", "0");
855 if (ret
!= LDB_SUCCESS
) return ret
;
856 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
858 if (ret
!= LDB_SUCCESS
) return ret
;
859 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
861 if (ret
!= LDB_SUCCESS
) return ret
;
862 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
864 if (ret
!= LDB_SUCCESS
) return ret
;
865 if (!ldb_msg_find_element(ac
->msg
, "primaryGroupID")) {
866 ret
= samdb_msg_add_uint(ldb
, ac
->msg
, ac
->msg
,
867 "primaryGroupID", DOMAIN_RID_USERS
);
868 if (ret
!= LDB_SUCCESS
) return ret
;
870 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
871 "accountExpires", "9223372036854775807");
872 if (ret
!= LDB_SUCCESS
) return ret
;
873 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
875 if (ret
!= LDB_SUCCESS
) return ret
;
876 } else if (strcmp(ac
->type
, "group") == 0) {
877 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
878 "groupType", "-2147483646");
879 if (ret
!= LDB_SUCCESS
) return ret
;
880 } else if (strcmp(ac
->type
, "classSchema") == 0) {
881 const struct ldb_val
*rdn_value
;
883 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
885 if (ret
!= LDB_SUCCESS
) return ret
;
887 rdn_value
= ldb_dn_get_rdn_val(ac
->msg
->dn
);
888 if (!ldb_msg_find_element(ac
->msg
, "lDAPDisplayName")) {
889 /* the RDN has prefix "CN" */
890 ret
= ldb_msg_add_string(ac
->msg
, "lDAPDisplayName",
891 samdb_cn_to_lDAPDisplayName(ac
,
892 (const char *) rdn_value
->data
));
893 if (ret
!= LDB_SUCCESS
) {
899 if (!ldb_msg_find_element(ac
->msg
, "schemaIDGUID")) {
902 guid
= GUID_random();
903 ret
= dsdb_msg_add_guid(ac
->msg
, &guid
, "schemaIDGUID");
904 if (ret
!= LDB_SUCCESS
) {
910 ret
= samldb_add_step(ac
, samldb_add_entry
);
911 if (ret
!= LDB_SUCCESS
) return ret
;
913 ret
= samldb_add_step(ac
, samldb_find_for_defaultObjectCategory
);
914 if (ret
!= LDB_SUCCESS
) return ret
;
916 ret
= samldb_add_step(ac
, samldb_set_defaultObjectCategory
);
917 if (ret
!= LDB_SUCCESS
) return ret
;
919 return samldb_first_step(ac
);
920 } else if (strcmp(ac
->type
, "attributeSchema") == 0) {
921 const struct ldb_val
*rdn_value
;
922 rdn_value
= ldb_dn_get_rdn_val(ac
->msg
->dn
);
923 if (!ldb_msg_find_element(ac
->msg
, "lDAPDisplayName")) {
924 /* the RDN has prefix "CN" */
925 ret
= ldb_msg_add_string(ac
->msg
, "lDAPDisplayName",
926 samdb_cn_to_lDAPDisplayName(ac
,
927 (const char *) rdn_value
->data
));
928 if (ret
!= LDB_SUCCESS
) {
934 ret
= samdb_find_or_add_attribute(ldb
, ac
->msg
,
935 "isSingleValued", "FALSE");
936 if (ret
!= LDB_SUCCESS
) return ret
;
938 if (!ldb_msg_find_element(ac
->msg
, "schemaIDGUID")) {
941 guid
= GUID_random();
942 ret
= dsdb_msg_add_guid(ac
->msg
, &guid
, "schemaIDGUID");
943 if (ret
!= LDB_SUCCESS
) {
949 /* handle msDS-IntID attribute */
950 ret
= samldb_add_handle_msDS_IntId(ac
);
951 if (ret
!= LDB_SUCCESS
) return ret
;
953 ret
= samldb_add_step(ac
, samldb_add_entry
);
954 if (ret
!= LDB_SUCCESS
) return ret
;
956 return samldb_first_step(ac
);
958 ldb_asprintf_errstring(ldb
,
959 "Invalid entry type!");
960 return LDB_ERR_OPERATIONS_ERROR
;
963 /* check if we have a valid samAccountName */
964 ret
= samldb_add_step(ac
, samldb_check_samAccountName
);
965 if (ret
!= LDB_SUCCESS
) return ret
;
967 /* check account_type/group_type */
968 ret
= samldb_add_step(ac
, samldb_check_samAccountType
);
969 if (ret
!= LDB_SUCCESS
) return ret
;
971 /* check if we have a valid primary group ID */
972 if (strcmp(ac
->type
, "user") == 0) {
973 ret
= samldb_add_step(ac
, samldb_check_primaryGroupID_1
);
974 if (ret
!= LDB_SUCCESS
) return ret
;
975 ret
= samldb_add_step(ac
, samldb_dn_from_sid
);
976 if (ret
!= LDB_SUCCESS
) return ret
;
977 ret
= samldb_add_step(ac
, samldb_check_primaryGroupID_2
);
978 if (ret
!= LDB_SUCCESS
) return ret
;
981 lp_ctx
= talloc_get_type(ldb_get_opaque(ldb
, "loadparm"),
982 struct loadparm_context
);
984 /* don't allow objectSID to be specified without the RELAX control */
985 ac
->sid
= samdb_result_dom_sid(ac
, ac
->msg
, "objectSid");
986 if (ac
->sid
&& !ldb_request_get_control(ac
->req
, LDB_CONTROL_RELAX_OID
) &&
987 !dsdb_module_am_system(ac
->module
)) {
988 ldb_asprintf_errstring(ldb
, "No SID may be specified in user/group creation for %s",
989 ldb_dn_get_linearized(ac
->msg
->dn
));
990 return LDB_ERR_UNWILLING_TO_PERFORM
;
994 sid_generator
= lp_sid_generator(lp_ctx
);
995 if (sid_generator
== SID_GENERATOR_INTERNAL
) {
996 ret
= samldb_add_step(ac
, samldb_allocate_sid
);
997 if (ret
!= LDB_SUCCESS
) return ret
;
1001 /* finally proceed with adding the entry */
1002 ret
= samldb_add_step(ac
, samldb_add_entry
);
1003 if (ret
!= LDB_SUCCESS
) return ret
;
1005 return samldb_first_step(ac
);
1008 static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx
*ac
)
1010 struct ldb_context
*ldb
;
1013 ldb
= ldb_module_get_ctx(ac
->module
);
1015 ac
->sid
= samdb_result_dom_sid(ac
->msg
, ac
->msg
, "objectSid");
1016 if (ac
->sid
== NULL
) {
1017 ac
->sid
= dom_sid_parse_talloc(ac
->msg
,
1018 (const char *)ldb_dn_get_rdn_val(ac
->msg
->dn
)->data
);
1020 ldb_set_errstring(ldb
,
1021 "No valid SID found in "
1022 "ForeignSecurityPrincipal CN!");
1024 return LDB_ERR_CONSTRAINT_VIOLATION
;
1026 if ( ! samldb_msg_add_sid(ac
->msg
, "objectSid", ac
->sid
)) {
1028 return LDB_ERR_OPERATIONS_ERROR
;
1032 /* finally proceed with adding the entry */
1033 ret
= samldb_add_step(ac
, samldb_add_entry
);
1034 if (ret
!= LDB_SUCCESS
) return ret
;
1036 return samldb_first_step(ac
);
1039 static int samldb_check_rdn(struct ldb_module
*module
, struct ldb_dn
*dn
)
1041 struct ldb_context
*ldb
;
1042 const char *rdn_name
;
1044 ldb
= ldb_module_get_ctx(module
);
1045 rdn_name
= ldb_dn_get_rdn_name(dn
);
1047 if (strcasecmp(rdn_name
, "cn") != 0) {
1048 ldb_asprintf_errstring(ldb
,
1049 "Bad RDN (%s=) for samldb object, "
1050 "should be CN=!", rdn_name
);
1051 return LDB_ERR_CONSTRAINT_VIOLATION
;
1058 * samldb_sid_from_dn (async)
1061 static int samldb_sid_from_dn(struct samldb_ctx
*ac
);
1063 static int samldb_sid_from_dn_callback(struct ldb_request
*req
,
1064 struct ldb_reply
*ares
)
1066 struct ldb_context
*ldb
;
1067 struct samldb_ctx
*ac
;
1070 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
1071 ldb
= ldb_module_get_ctx(ac
->module
);
1074 ret
= LDB_ERR_OPERATIONS_ERROR
;
1077 if (ares
->error
!= LDB_SUCCESS
) {
1078 return ldb_module_done(ac
->req
, ares
->controls
,
1079 ares
->response
, ares
->error
);
1082 switch (ares
->type
) {
1083 case LDB_REPLY_ENTRY
:
1085 if (ac
->res_sid
!= NULL
) {
1087 ldb_set_errstring(ldb
,
1088 "Invalid number of results while searching "
1089 "for domain objects!");
1090 ret
= LDB_ERR_OPERATIONS_ERROR
;
1093 ac
->res_sid
= samdb_result_dom_sid(ac
, ares
->message
,
1100 case LDB_REPLY_REFERRAL
:
1106 case LDB_REPLY_DONE
:
1109 /* found or not found, go on */
1110 ret
= samldb_next_step(ac
);
1115 if (ret
!= LDB_SUCCESS
) {
1116 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1122 /* Finds the SID "res_sid" of an object with a given DN "dn" */
1123 static int samldb_sid_from_dn(struct samldb_ctx
*ac
)
1125 struct ldb_context
*ldb
;
1126 static const char * const attrs
[] = { "objectSid", NULL
};
1127 struct ldb_request
*req
;
1130 ldb
= ldb_module_get_ctx(ac
->module
);
1133 return LDB_ERR_OPERATIONS_ERROR
;
1135 ret
= ldb_build_search_req(&req
, ldb
, ac
,
1140 ac
, samldb_sid_from_dn_callback
,
1142 if (ret
!= LDB_SUCCESS
)
1145 return ldb_next_request(ac
->module
, req
);
1149 * samldb_user_dn_to_prim_group_rid (async)
1152 static int samldb_user_dn_to_prim_group_rid(struct samldb_ctx
*ac
);
1154 static int samldb_user_dn_to_prim_group_rid_callback(struct ldb_request
*req
,
1155 struct ldb_reply
*ares
)
1157 struct ldb_context
*ldb
;
1158 struct samldb_ctx
*ac
;
1161 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
1162 ldb
= ldb_module_get_ctx(ac
->module
);
1165 ret
= LDB_ERR_OPERATIONS_ERROR
;
1168 if (ares
->error
!= LDB_SUCCESS
) {
1169 return ldb_module_done(ac
->req
, ares
->controls
,
1170 ares
->response
, ares
->error
);
1173 switch (ares
->type
) {
1174 case LDB_REPLY_ENTRY
:
1176 if (ac
->prim_group_rid
!= 0) {
1178 ldb_set_errstring(ldb
,
1179 "Invalid number of results while searching "
1180 "for domain objects!");
1181 ret
= LDB_ERR_OPERATIONS_ERROR
;
1184 ac
->prim_group_rid
= samdb_result_uint(ares
->message
,
1185 "primaryGroupID", ~0);
1191 case LDB_REPLY_REFERRAL
:
1197 case LDB_REPLY_DONE
:
1199 if (ac
->prim_group_rid
== 0) {
1200 ldb_asprintf_errstring(ldb
,
1201 "Unable to get the primary group RID!");
1202 ret
= LDB_ERR_OPERATIONS_ERROR
;
1207 ret
= samldb_next_step(ac
);
1212 if (ret
!= LDB_SUCCESS
) {
1213 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1219 /* Locates the "primaryGroupID" attribute from a certain user specified as
1220 * "user_dn". Saves the result in "prim_group_rid". */
1221 static int samldb_user_dn_to_prim_group_rid(struct samldb_ctx
*ac
)
1223 struct ldb_context
*ldb
;
1224 static const char * const attrs
[] = { "primaryGroupID", NULL
};
1225 struct ldb_request
*req
;
1228 ldb
= ldb_module_get_ctx(ac
->module
);
1230 if (ac
->user_dn
== NULL
)
1231 return LDB_ERR_OPERATIONS_ERROR
;
1233 ret
= ldb_build_search_req(&req
, ldb
, ac
,
1238 ac
, samldb_user_dn_to_prim_group_rid_callback
,
1240 if (ret
!= LDB_SUCCESS
)
1243 return ldb_next_request(ac
->module
, req
);
1247 * samldb_prim_group_rid_to_users_cnt (async)
1250 static int samldb_prim_group_rid_to_users_cnt(struct samldb_ctx
*ac
);
1252 static int samldb_prim_group_rid_to_users_cnt_callback(struct ldb_request
*req
,
1253 struct ldb_reply
*ares
)
1255 struct ldb_context
*ldb
;
1256 struct samldb_ctx
*ac
;
1259 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
1260 ldb
= ldb_module_get_ctx(ac
->module
);
1263 ret
= LDB_ERR_OPERATIONS_ERROR
;
1266 if (ares
->error
!= LDB_SUCCESS
) {
1267 return ldb_module_done(ac
->req
, ares
->controls
,
1268 ares
->response
, ares
->error
);
1271 switch (ares
->type
) {
1272 case LDB_REPLY_ENTRY
:
1280 case LDB_REPLY_REFERRAL
:
1286 case LDB_REPLY_DONE
:
1289 /* found or not found, go on */
1290 ret
= samldb_next_step(ac
);
1295 if (ret
!= LDB_SUCCESS
) {
1296 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1302 /* Finds the amount of users which have the primary group "prim_group_rid" and
1303 * save the result in "users_cnt" */
1304 static int samldb_prim_group_rid_to_users_cnt(struct samldb_ctx
*ac
)
1306 struct ldb_context
*ldb
;
1307 static const char * const attrs
[] = { NULL
};
1308 struct ldb_request
*req
;
1312 ldb
= ldb_module_get_ctx(ac
->module
);
1314 if ((ac
->prim_group_rid
== 0) || (ac
->users_cnt
!= 0))
1315 return LDB_ERR_OPERATIONS_ERROR
;
1317 filter
= talloc_asprintf(ac
, "(&(primaryGroupID=%u)(objectclass=user))",
1318 ac
->prim_group_rid
);
1320 return LDB_ERR_OPERATIONS_ERROR
;
1322 ret
= ldb_build_search_req(&req
, ldb
, ac
,
1323 ldb_get_default_basedn(ldb
),
1328 samldb_prim_group_rid_to_users_cnt_callback
,
1330 if (ret
!= LDB_SUCCESS
)
1333 return ldb_next_request(ac
->module
, req
);
1337 * samldb_group_add_member (async)
1338 * samldb_group_del_member (async)
1341 static int samldb_group_add_del_member_callback(struct ldb_request
*req
,
1342 struct ldb_reply
*ares
)
1344 struct ldb_context
*ldb
;
1345 struct samldb_ctx
*ac
;
1348 ac
= talloc_get_type(req
->context
, struct samldb_ctx
);
1349 ldb
= ldb_module_get_ctx(ac
->module
);
1352 ret
= LDB_ERR_OPERATIONS_ERROR
;
1355 if (ares
->error
!= LDB_SUCCESS
) {
1356 if (ares
->error
== LDB_ERR_NO_SUCH_ATTRIBUTE
) {
1357 /* On error "NO_SUCH_ATTRIBUTE" (delete of an invalid
1358 * "member" attribute) return "UNWILLING_TO_PERFORM" */
1359 ares
->error
= LDB_ERR_UNWILLING_TO_PERFORM
;
1361 return ldb_module_done(ac
->req
, ares
->controls
,
1362 ares
->response
, ares
->error
);
1364 if (ares
->type
!= LDB_REPLY_DONE
) {
1365 ldb_set_errstring(ldb
,
1366 "Invalid reply type!");
1367 ret
= LDB_ERR_OPERATIONS_ERROR
;
1371 ret
= samldb_next_step(ac
);
1374 if (ret
!= LDB_SUCCESS
) {
1375 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
1381 /* Adds a member with DN "member_dn" to a group with DN "group_dn" */
1382 static int samldb_group_add_member(struct samldb_ctx
*ac
)
1384 struct ldb_context
*ldb
;
1385 struct ldb_request
*req
;
1386 struct ldb_message
*msg
;
1389 ldb
= ldb_module_get_ctx(ac
->module
);
1391 if ((ac
->group_dn
== NULL
) || (ac
->member_dn
== NULL
))
1392 return LDB_ERR_OPERATIONS_ERROR
;
1394 msg
= ldb_msg_new(ac
);
1395 msg
->dn
= ac
->group_dn
;
1396 samdb_msg_add_addval(ldb
, ac
, msg
, "member",
1397 ldb_dn_get_linearized(ac
->member_dn
));
1399 ret
= ldb_build_mod_req(&req
, ldb
, ac
,
1401 ac
, samldb_group_add_del_member_callback
,
1403 if (ret
!= LDB_SUCCESS
)
1406 return ldb_next_request(ac
->module
, req
);
1409 /* Removes a member with DN "member_dn" from a group with DN "group_dn" */
1410 static int samldb_group_del_member(struct samldb_ctx
*ac
)
1412 struct ldb_context
*ldb
;
1413 struct ldb_request
*req
;
1414 struct ldb_message
*msg
;
1417 ldb
= ldb_module_get_ctx(ac
->module
);
1419 if ((ac
->group_dn
== NULL
) || (ac
->member_dn
== NULL
))
1420 return LDB_ERR_OPERATIONS_ERROR
;
1422 msg
= ldb_msg_new(ac
);
1423 msg
->dn
= ac
->group_dn
;
1424 samdb_msg_add_delval(ldb
, ac
, msg
, "member",
1425 ldb_dn_get_linearized(ac
->member_dn
));
1427 ret
= ldb_build_mod_req(&req
, ldb
, ac
,
1429 ac
, samldb_group_add_del_member_callback
,
1431 if (ret
!= LDB_SUCCESS
)
1434 return ldb_next_request(ac
->module
, req
);
1438 static int samldb_prim_group_change_1(struct samldb_ctx
*ac
)
1440 struct ldb_context
*ldb
;
1443 ldb
= ldb_module_get_ctx(ac
->module
);
1445 ac
->user_dn
= ac
->msg
->dn
;
1447 rid
= samdb_result_uint(ac
->msg
, "primaryGroupID", ~0);
1448 ac
->sid
= dom_sid_add_rid(ac
, samdb_domain_sid(ldb
), rid
);
1449 if (ac
->sid
== NULL
)
1450 return LDB_ERR_OPERATIONS_ERROR
;
1453 ac
->prim_group_rid
= 0;
1455 return samldb_next_step(ac
);
1458 static int samldb_prim_group_change_2(struct samldb_ctx
*ac
)
1460 struct ldb_context
*ldb
;
1462 ldb
= ldb_module_get_ctx(ac
->module
);
1464 if (ac
->res_dn
!= NULL
)
1465 ac
->new_prim_group_dn
= ac
->res_dn
;
1467 return LDB_ERR_UNWILLING_TO_PERFORM
;
1469 ac
->sid
= dom_sid_add_rid(ac
, samdb_domain_sid(ldb
),
1470 ac
->prim_group_rid
);
1471 if (ac
->sid
== NULL
)
1472 return LDB_ERR_OPERATIONS_ERROR
;
1475 return samldb_next_step(ac
);
1478 static int samldb_prim_group_change_4(struct samldb_ctx
*ac
);
1479 static int samldb_prim_group_change_5(struct samldb_ctx
*ac
);
1480 static int samldb_prim_group_change_6(struct samldb_ctx
*ac
);
1482 static int samldb_prim_group_change_3(struct samldb_ctx
*ac
)
1486 if (ac
->res_dn
!= NULL
)
1487 ac
->old_prim_group_dn
= ac
->res_dn
;
1489 return LDB_ERR_UNWILLING_TO_PERFORM
;
1491 /* Only update when the primary group changed */
1492 if (ldb_dn_compare(ac
->old_prim_group_dn
, ac
->new_prim_group_dn
) != 0) {
1493 ac
->member_dn
= ac
->user_dn
;
1494 /* Remove the "member" attribute of the actual (new) primary
1497 ret
= samldb_add_step(ac
, samldb_prim_group_change_4
);
1498 if (ret
!= LDB_SUCCESS
) return ret
;
1500 ret
= samldb_add_step(ac
, samldb_group_del_member
);
1501 if (ret
!= LDB_SUCCESS
) return ret
;
1503 /* Add a "member" attribute for the previous primary group */
1505 ret
= samldb_add_step(ac
, samldb_prim_group_change_5
);
1506 if (ret
!= LDB_SUCCESS
) return ret
;
1508 ret
= samldb_add_step(ac
, samldb_group_add_member
);
1509 if (ret
!= LDB_SUCCESS
) return ret
;
1512 ret
= samldb_add_step(ac
, samldb_prim_group_change_6
);
1513 if (ret
!= LDB_SUCCESS
) return ret
;
1515 return samldb_next_step(ac
);
1518 static int samldb_prim_group_change_4(struct samldb_ctx
*ac
)
1520 ac
->group_dn
= ac
->new_prim_group_dn
;
1522 return samldb_next_step(ac
);
1525 static int samldb_prim_group_change_5(struct samldb_ctx
*ac
)
1527 ac
->group_dn
= ac
->old_prim_group_dn
;
1529 return samldb_next_step(ac
);
1532 static int samldb_prim_group_change_6(struct samldb_ctx
*ac
)
1534 return ldb_next_request(ac
->module
, ac
->req
);
1537 static int samldb_prim_group_change(struct samldb_ctx
*ac
)
1541 /* Finds out the DN of the new primary group */
1543 ret
= samldb_add_step(ac
, samldb_prim_group_change_1
);
1544 if (ret
!= LDB_SUCCESS
) return ret
;
1546 ret
= samldb_add_step(ac
, samldb_dn_from_sid
);
1547 if (ret
!= LDB_SUCCESS
) return ret
;
1549 ret
= samldb_add_step(ac
, samldb_user_dn_to_prim_group_rid
);
1550 if (ret
!= LDB_SUCCESS
) return ret
;
1552 /* Finds out the DN of the old primary group */
1554 ret
= samldb_add_step(ac
, samldb_prim_group_change_2
);
1555 if (ret
!= LDB_SUCCESS
) return ret
;
1557 ret
= samldb_add_step(ac
, samldb_dn_from_sid
);
1558 if (ret
!= LDB_SUCCESS
) return ret
;
1560 ret
= samldb_add_step(ac
, samldb_prim_group_change_3
);
1561 if (ret
!= LDB_SUCCESS
) return ret
;
1563 return samldb_first_step(ac
);
1567 static int samldb_member_check_1(struct samldb_ctx
*ac
)
1569 struct ldb_context
*ldb
;
1570 struct ldb_message_element
*el
;
1572 ldb
= ldb_module_get_ctx(ac
->module
);
1574 el
= ldb_msg_find_element(ac
->msg
, "member");
1576 ac
->user_dn
= ldb_dn_from_ldb_val(ac
, ldb
, &el
->values
[ac
->cnt
]);
1577 if (!ldb_dn_validate(ac
->user_dn
))
1578 return LDB_ERR_OPERATIONS_ERROR
;
1579 ac
->prim_group_rid
= 0;
1581 return samldb_next_step(ac
);
1584 static int samldb_member_check_2(struct samldb_ctx
*ac
)
1586 struct ldb_context
*ldb
;
1588 ldb
= ldb_module_get_ctx(ac
->module
);
1590 ac
->sid
= dom_sid_add_rid(ac
, samdb_domain_sid(ldb
),
1591 ac
->prim_group_rid
);
1592 if (ac
->sid
== NULL
)
1593 return LDB_ERR_OPERATIONS_ERROR
;
1596 return samldb_next_step(ac
);
1599 static int samldb_member_check_3(struct samldb_ctx
*ac
)
1601 if (ldb_dn_compare(ac
->res_dn
, ac
->msg
->dn
) == 0)
1602 return LDB_ERR_ENTRY_ALREADY_EXISTS
;
1606 return samldb_next_step(ac
);
1609 static int samldb_member_check_4(struct samldb_ctx
*ac
)
1611 return ldb_next_request(ac
->module
, ac
->req
);
1614 static int samldb_member_check(struct samldb_ctx
*ac
)
1616 struct ldb_message_element
*el
;
1619 el
= ldb_msg_find_element(ac
->msg
, "member");
1621 for (i
= 0; i
< el
->num_values
; i
++) {
1622 /* Denies to add "member"s to groups which are primary ones
1624 ret
= samldb_add_step(ac
, samldb_member_check_1
);
1625 if (ret
!= LDB_SUCCESS
) return ret
;
1627 ret
= samldb_add_step(ac
, samldb_user_dn_to_prim_group_rid
);
1628 if (ret
!= LDB_SUCCESS
) return ret
;
1630 ret
= samldb_add_step(ac
, samldb_member_check_2
);
1631 if (ret
!= LDB_SUCCESS
) return ret
;
1633 ret
= samldb_add_step(ac
, samldb_dn_from_sid
);
1634 if (ret
!= LDB_SUCCESS
) return ret
;
1636 ret
= samldb_add_step(ac
, samldb_member_check_3
);
1637 if (ret
!= LDB_SUCCESS
) return ret
;
1640 ret
= samldb_add_step(ac
, samldb_member_check_4
);
1641 if (ret
!= LDB_SUCCESS
) return ret
;
1643 return samldb_first_step(ac
);
1647 static int samldb_prim_group_users_check_1(struct samldb_ctx
*ac
)
1649 ac
->dn
= ac
->req
->op
.del
.dn
;
1652 return samldb_next_step(ac
);
1655 static int samldb_prim_group_users_check_2(struct samldb_ctx
*ac
)
1660 if (ac
->res_sid
== NULL
) {
1661 /* No SID - therefore ok here */
1662 return ldb_next_request(ac
->module
, ac
->req
);
1664 status
= dom_sid_split_rid(ac
, ac
->res_sid
, NULL
, &rid
);
1665 if (!NT_STATUS_IS_OK(status
))
1666 return LDB_ERR_OPERATIONS_ERROR
;
1669 /* Special object (security principal?) */
1670 return ldb_next_request(ac
->module
, ac
->req
);
1673 ac
->prim_group_rid
= rid
;
1676 return samldb_next_step(ac
);
1679 static int samldb_prim_group_users_check_3(struct samldb_ctx
*ac
)
1681 if (ac
->users_cnt
> 0)
1682 return LDB_ERR_ENTRY_ALREADY_EXISTS
;
1684 return ldb_next_request(ac
->module
, ac
->req
);
1687 static int samldb_prim_group_users_check(struct samldb_ctx
*ac
)
1691 /* Finds out the SID/RID of the domain object */
1693 ret
= samldb_add_step(ac
, samldb_prim_group_users_check_1
);
1694 if (ret
!= LDB_SUCCESS
) return ret
;
1696 ret
= samldb_add_step(ac
, samldb_sid_from_dn
);
1697 if (ret
!= LDB_SUCCESS
) return ret
;
1699 /* Deny delete requests from groups which are primary ones */
1701 ret
= samldb_add_step(ac
, samldb_prim_group_users_check_2
);
1702 if (ret
!= LDB_SUCCESS
) return ret
;
1704 ret
= samldb_add_step(ac
, samldb_prim_group_rid_to_users_cnt
);
1705 if (ret
!= LDB_SUCCESS
) return ret
;
1707 ret
= samldb_add_step(ac
, samldb_prim_group_users_check_3
);
1708 if (ret
!= LDB_SUCCESS
) return ret
;
1710 return samldb_first_step(ac
);
1715 static int samldb_add(struct ldb_module
*module
, struct ldb_request
*req
)
1717 struct ldb_context
*ldb
;
1718 struct samldb_ctx
*ac
;
1721 ldb
= ldb_module_get_ctx(module
);
1722 ldb_debug(ldb
, LDB_DEBUG_TRACE
, "samldb_add\n");
1724 /* do not manipulate our control entries */
1725 if (ldb_dn_is_special(req
->op
.add
.message
->dn
)) {
1726 return ldb_next_request(module
, req
);
1729 ac
= samldb_ctx_init(module
, req
);
1731 return LDB_ERR_OPERATIONS_ERROR
;
1734 /* build the new msg */
1735 ac
->msg
= ldb_msg_copy(ac
, ac
->req
->op
.add
.message
);
1738 ldb_debug(ldb
, LDB_DEBUG_FATAL
,
1739 "samldb_add: ldb_msg_copy failed!\n");
1740 return LDB_ERR_OPERATIONS_ERROR
;
1743 if (samdb_find_attribute(ldb
, ac
->msg
,
1744 "objectclass", "computer") != NULL
) {
1746 /* make sure the computer object also has the 'user'
1747 * objectclass so it will be handled by the next call */
1748 ret
= samdb_find_or_add_value(ldb
, ac
->msg
,
1749 "objectclass", "user");
1750 if (ret
!= LDB_SUCCESS
) {
1756 if (samdb_find_attribute(ldb
, ac
->msg
,
1757 "objectclass", "user") != NULL
) {
1759 ret
= samldb_check_rdn(module
, ac
->req
->op
.add
.message
->dn
);
1760 if (ret
!= LDB_SUCCESS
) {
1765 return samldb_fill_object(ac
, "user");
1768 if (samdb_find_attribute(ldb
, ac
->msg
,
1769 "objectclass", "group") != NULL
) {
1771 ret
= samldb_check_rdn(module
, ac
->req
->op
.add
.message
->dn
);
1772 if (ret
!= LDB_SUCCESS
) {
1777 return samldb_fill_object(ac
, "group");
1780 /* perhaps a foreignSecurityPrincipal? */
1781 if (samdb_find_attribute(ldb
, ac
->msg
,
1783 "foreignSecurityPrincipal") != NULL
) {
1785 ret
= samldb_check_rdn(module
, ac
->req
->op
.add
.message
->dn
);
1786 if (ret
!= LDB_SUCCESS
) {
1791 return samldb_fill_foreignSecurityPrincipal_object(ac
);
1794 if (samdb_find_attribute(ldb
, ac
->msg
,
1795 "objectclass", "classSchema") != NULL
) {
1797 ret
= samldb_check_rdn(module
, ac
->req
->op
.add
.message
->dn
);
1798 if (ret
!= LDB_SUCCESS
) {
1803 return samldb_fill_object(ac
, "classSchema");
1806 if (samdb_find_attribute(ldb
, ac
->msg
,
1807 "objectclass", "attributeSchema") != NULL
) {
1809 ret
= samldb_check_rdn(module
, ac
->req
->op
.add
.message
->dn
);
1810 if (ret
!= LDB_SUCCESS
) {
1815 return samldb_fill_object(ac
, "attributeSchema");
1820 /* nothing matched, go on */
1821 return ldb_next_request(module
, req
);
1825 static int samldb_modify(struct ldb_module
*module
, struct ldb_request
*req
)
1827 struct ldb_context
*ldb
;
1828 struct ldb_message
*msg
;
1829 struct ldb_message_element
*el
, *el2
;
1831 uint32_t account_type
;
1833 if (ldb_dn_is_special(req
->op
.mod
.message
->dn
)) {
1834 /* do not manipulate our control entries */
1835 return ldb_next_request(module
, req
);
1838 ldb
= ldb_module_get_ctx(module
);
1840 if (ldb_msg_find_element(req
->op
.mod
.message
, "sAMAccountType") != NULL
) {
1841 ldb_asprintf_errstring(ldb
,
1842 "sAMAccountType must not be specified!");
1843 return LDB_ERR_UNWILLING_TO_PERFORM
;
1846 /* msDS-IntId is not allowed to be modified
1847 * except when modification comes from replication */
1848 if (ldb_msg_find_element(req
->op
.mod
.message
, "msDS-IntId")) {
1849 if (!ldb_request_get_control(req
, DSDB_CONTROL_REPLICATED_UPDATE_OID
)) {
1850 return LDB_ERR_CONSTRAINT_VIOLATION
;
1854 /* TODO: do not modify original request, create a new one */
1856 el
= ldb_msg_find_element(req
->op
.mod
.message
, "groupType");
1857 if (el
&& el
->flags
& (LDB_FLAG_MOD_ADD
|LDB_FLAG_MOD_REPLACE
) && el
->num_values
== 1) {
1858 uint32_t group_type
;
1860 req
->op
.mod
.message
= msg
= ldb_msg_copy_shallow(req
,
1861 req
->op
.mod
.message
);
1863 group_type
= strtoul((const char *)el
->values
[0].data
, NULL
, 0);
1864 account_type
= ds_gtype2atype(group_type
);
1865 ret
= samdb_msg_add_uint(ldb
, msg
, msg
,
1868 if (ret
!= LDB_SUCCESS
) {
1871 el2
= ldb_msg_find_element(msg
, "sAMAccountType");
1872 el2
->flags
= LDB_FLAG_MOD_REPLACE
;
1875 el
= ldb_msg_find_element(req
->op
.mod
.message
, "primaryGroupID");
1876 if (el
&& el
->flags
& (LDB_FLAG_MOD_ADD
|LDB_FLAG_MOD_REPLACE
) && el
->num_values
== 1) {
1877 struct samldb_ctx
*ac
;
1879 ac
= samldb_ctx_init(module
, req
);
1881 return LDB_ERR_OPERATIONS_ERROR
;
1883 req
->op
.mod
.message
= ac
->msg
= ldb_msg_copy_shallow(req
,
1884 req
->op
.mod
.message
);
1886 return samldb_prim_group_change(ac
);
1889 el
= ldb_msg_find_element(req
->op
.mod
.message
, "userAccountControl");
1890 if (el
&& el
->flags
& (LDB_FLAG_MOD_ADD
|LDB_FLAG_MOD_REPLACE
) && el
->num_values
== 1) {
1891 uint32_t user_account_control
;
1893 req
->op
.mod
.message
= msg
= ldb_msg_copy_shallow(req
,
1894 req
->op
.mod
.message
);
1896 user_account_control
= strtoul((const char *)el
->values
[0].data
,
1898 account_type
= ds_uf2atype(user_account_control
);
1899 ret
= samdb_msg_add_uint(ldb
, msg
, msg
,
1902 if (ret
!= LDB_SUCCESS
) {
1905 el2
= ldb_msg_find_element(msg
, "sAMAccountType");
1906 el2
->flags
= LDB_FLAG_MOD_REPLACE
;
1908 if (user_account_control
& UF_SERVER_TRUST_ACCOUNT
) {
1909 ret
= samdb_msg_add_string(ldb
, msg
, msg
,
1910 "isCriticalSystemObject", "TRUE");
1911 if (ret
!= LDB_SUCCESS
) {
1914 el2
= ldb_msg_find_element(msg
, "isCriticalSystemObject");
1915 el2
->flags
= LDB_FLAG_MOD_REPLACE
;
1917 /* DCs have primaryGroupID of DOMAIN_RID_DCS */
1918 if (!ldb_msg_find_element(msg
, "primaryGroupID")) {
1919 ret
= samdb_msg_add_uint(ldb
, msg
, msg
,
1920 "primaryGroupID", DOMAIN_RID_DCS
);
1921 if (ret
!= LDB_SUCCESS
) {
1924 el2
= ldb_msg_find_element(msg
, "primaryGroupID");
1925 el2
->flags
= LDB_FLAG_MOD_REPLACE
;
1930 el
= ldb_msg_find_element(req
->op
.mod
.message
, "member");
1931 if (el
&& el
->flags
& (LDB_FLAG_MOD_ADD
|LDB_FLAG_MOD_REPLACE
) && el
->num_values
== 1) {
1932 struct samldb_ctx
*ac
;
1934 ac
= samldb_ctx_init(module
, req
);
1936 return LDB_ERR_OPERATIONS_ERROR
;
1938 req
->op
.mod
.message
= ac
->msg
= ldb_msg_copy_shallow(req
,
1939 req
->op
.mod
.message
);
1941 return samldb_member_check(ac
);
1944 /* nothing matched, go on */
1945 return ldb_next_request(module
, req
);
1949 static int samldb_delete(struct ldb_module
*module
, struct ldb_request
*req
)
1951 struct samldb_ctx
*ac
;
1953 if (ldb_dn_is_special(req
->op
.del
.dn
)) {
1954 /* do not manipulate our control entries */
1955 return ldb_next_request(module
, req
);
1958 ac
= samldb_ctx_init(module
, req
);
1960 return LDB_ERR_OPERATIONS_ERROR
;
1962 return samldb_prim_group_users_check(ac
);
1965 static int samldb_extended_allocate_rid_pool(struct ldb_module
*module
, struct ldb_request
*req
)
1967 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
1968 struct dsdb_fsmo_extended_op
*exop
;
1971 exop
= talloc_get_type(req
->op
.extended
.data
, struct dsdb_fsmo_extended_op
);
1973 ldb_debug(ldb
, LDB_DEBUG_FATAL
, "samldb_extended_allocate_rid_pool: invalid extended data\n");
1974 return LDB_ERR_PROTOCOL_ERROR
;
1977 ret
= ridalloc_allocate_rid_pool_fsmo(module
, exop
);
1978 if (ret
!= LDB_SUCCESS
) {
1982 return ldb_module_done(req
, NULL
, NULL
, LDB_SUCCESS
);
1985 static int samldb_extended(struct ldb_module
*module
, struct ldb_request
*req
)
1987 if (strcmp(req
->op
.extended
.oid
, DSDB_EXTENDED_ALLOCATE_RID_POOL
) == 0) {
1988 return samldb_extended_allocate_rid_pool(module
, req
);
1991 return ldb_next_request(module
, req
);
1995 _PUBLIC_
const struct ldb_module_ops ldb_samldb_module_ops
= {
1998 .modify
= samldb_modify
,
1999 .del
= samldb_delete
,
2000 .extended
= samldb_extended