2 Unix SMB/CIFS implementation.
4 interface functions for the sam database
6 Copyright (C) Andrew Tridgell 2004
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
25 struct auth_session_info
;
26 struct dsdb_control_current_partition
;
27 struct dsdb_extended_replicated_object
;
28 struct dsdb_extended_replicated_objects
;
29 struct loadparm_context
;
30 struct tevent_context
;
32 struct dsdb_trust_routing_table
;
34 #include "librpc/gen_ndr/security.h"
36 #include "lib/ldb-samba/ldif_handlers.h"
37 #include "librpc/gen_ndr/samr.h"
38 #include "librpc/gen_ndr/drsuapi.h"
39 #include "librpc/gen_ndr/drsblobs.h"
40 #include "dsdb/schema/schema.h"
41 #include "dsdb/samdb/samdb_proto.h"
42 #include "dsdb/common/dsdb_dn.h"
43 #include "dsdb/common/util_links.h"
44 #include "dsdb/common/proto.h"
45 #include "../libds/common/flags.h"
47 #define DSDB_CONTROL_CURRENT_PARTITION_OID "1.3.6.1.4.1.7165.4.3.2"
48 struct dsdb_control_current_partition
{
50 * this is the version of the dsdb_control_current_partition
51 * version 0: initial implementation
52 * version 1: got rid of backend and module fields
54 #define DSDB_CONTROL_CURRENT_PARTITION_VERSION 1
61 flags in dsdb_repl_flags to control replication logic
63 #define DSDB_REPL_FLAG_PRIORITISE_INCOMING 1
64 #define DSDB_REPL_FLAG_PARTIAL_REPLICA 2
65 #define DSDB_REPL_FLAG_ADD_NCNAME 4
66 #define DSDB_REPL_FLAG_EXPECT_NO_SECRETS 8
69 #define DSDB_CONTROL_REPLICATED_UPDATE_OID "1.3.6.1.4.1.7165.4.3.3"
71 #define DSDB_CONTROL_DN_STORAGE_FORMAT_OID "1.3.6.1.4.1.7165.4.3.4"
72 /* DSDB_CONTROL_DN_STORAGE_FORMAT_OID has NULL data and behaves very
73 * much like LDB_CONTROL_EXTENDED_DN_OID when the DB stores an
74 * extended DN, and otherwise returns normal DNs */
76 #define DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID "1.3.6.1.4.1.7165.4.3.8"
78 struct dsdb_control_password_change_status
{
80 uint32_t pwdProperties
;
81 uint32_t pwdHistoryLength
;
84 uint32_t minPwdLength
;
86 const char *netbios_domain
;
87 const char *dns_domain
;
90 enum samPwdChangeReason reject_reason
;
93 #define DSDB_CONTROL_PASSWORD_HASH_VALUES_OID "1.3.6.1.4.1.7165.4.3.9"
95 #define DSDB_CONTROL_PASSWORD_CHANGE_OID "1.3.6.1.4.1.7165.4.3.10"
96 struct dsdb_control_password_change
{
97 const struct samr_Password
*old_nt_pwd_hash
;
98 const struct samr_Password
*old_lm_pwd_hash
;
102 DSDB_CONTROL_APPLY_LINKS is internal to Samba4 - a token passed between repl_meta_data and linked_attributes modules
104 #define DSDB_CONTROL_APPLY_LINKS "1.3.6.1.4.1.7165.4.3.11"
107 * this should only be used for importing users from Samba3
109 #define DSDB_CONTROL_BYPASS_PASSWORD_HASH_OID "1.3.6.1.4.1.7165.4.3.12"
112 OID used to allow the replacement of replPropertyMetaData.
113 It is used when the current replmetadata needs to be edited.
115 #define DSDB_CONTROL_CHANGEREPLMETADATA_OID "1.3.6.1.4.1.7165.4.3.14"
117 /* passed when we want to get the behaviour of the non-global catalog port */
118 #define DSDB_CONTROL_NO_GLOBAL_CATALOG "1.3.6.1.4.1.7165.4.3.17"
120 /* passed when we want special behaviour for partial replicas */
121 #define DSDB_CONTROL_PARTIAL_REPLICA "1.3.6.1.4.1.7165.4.3.18"
123 /* passed when we want special behaviour for dbcheck */
124 #define DSDB_CONTROL_DBCHECK "1.3.6.1.4.1.7165.4.3.19"
126 /* passed when dbcheck wants to modify a read only replica (very special case) */
127 #define DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA "1.3.6.1.4.1.7165.4.3.19.1"
129 /* passed when importing plain text password on upgrades */
130 #define DSDB_CONTROL_PASSWORD_BYPASS_LAST_SET_OID "1.3.6.1.4.1.7165.4.3.20"
133 * passed from the descriptor module in order to
134 * store the recalucated nTSecurityDescriptor without
135 * modifying the replPropertyMetaData.
137 #define DSDB_CONTROL_SEC_DESC_PROPAGATION_OID "1.3.6.1.4.1.7165.4.3.21"
140 * passed when creating a interdomain trust account through LSA
141 * to relax constraints in the samldb ldb module.
143 #define DSDB_CONTROL_PERMIT_INTERDOMAIN_TRUST_UAC_OID "1.3.6.1.4.1.7165.4.3.23"
146 * Internal control to mark requests as being part of Tombstone restoring
147 * procedure - it requires slightly special behavior like:
148 * - a bit different security checks
149 * - restoring certain attributes to their default values, etc
151 #define DSDB_CONTROL_RESTORE_TOMBSTONE_OID "1.3.6.1.4.1.7165.4.3.24"
154 OID used to allow the replacement of replPropertyMetaData.
155 It is used when the current replmetadata needs only to be re-sorted, but not edited.
157 #define DSDB_CONTROL_CHANGEREPLMETADATA_RESORT_OID "1.3.6.1.4.1.7165.4.3.25"
160 * pass the default state of pwdLastSet between the "samldb" and "password_hash"
163 #define DSDB_CONTROL_PASSWORD_DEFAULT_LAST_SET_OID "1.3.6.1.4.1.7165.4.3.26"
166 * pass the userAccountControl changes between the "samldb" and "password_hash"
169 #define DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID "1.3.6.1.4.1.7165.4.3.27"
170 struct dsdb_control_password_user_account_control
{
171 uint32_t req_flags
; /* the flags given by the client request */
172 uint32_t old_flags
; /* the old flags stored (0 on add) */
173 uint32_t new_flags
; /* the new flags stored */
177 * Ignores strict checking when adding objects to samldb.
178 * This is used when provisioning, as checking all objects when added
179 * was slow due to an unindexed search.
181 #define DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID "1.3.6.1.4.1.7165.4.3.28"
183 /* passed when we want to thoroughly delete linked attributes */
184 #define DSDB_CONTROL_REPLMD_VANISH_LINKS "1.3.6.1.4.1.7165.4.3.29"
187 * lockoutTime is a replicated attribute, but must be modified before
188 * connectivity occurs to allow password lockouts.
190 #define DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE "1.3.6.1.4.1.7165.4.3.31"
192 #define DSDB_EXTENDED_REPLICATED_OBJECTS_OID "1.3.6.1.4.1.7165.4.4.1"
193 struct dsdb_extended_replicated_object
{
194 struct ldb_message
*msg
;
195 struct GUID object_guid
;
196 struct GUID
*parent_guid
;
197 const char *when_changed
;
198 struct replPropertyMetaDataBlob
*meta_data
;
200 /* Only used for internal processing in repl_meta_data */
201 struct ldb_dn
*last_known_parent
;
202 struct ldb_dn
*local_parent_dn
;
205 struct dsdb_extended_replicated_objects
{
207 * this is the version of the dsdb_extended_replicated_objects
208 * version 0: initial implementation
210 #define DSDB_EXTENDED_REPLICATED_OBJECTS_VERSION 3
213 /* DSDB_REPL_FLAG_* flags */
214 uint32_t dsdb_repl_flags
;
216 struct ldb_dn
*partition_dn
;
218 const struct repsFromTo1
*source_dsa
;
219 const struct drsuapi_DsReplicaCursor2CtrEx
*uptodateness_vector
;
221 uint32_t num_objects
;
222 struct dsdb_extended_replicated_object
*objects
;
224 uint32_t linked_attributes_count
;
225 struct drsuapi_DsReplicaLinkedAttribute
*linked_attributes
;
229 bool originating_updates
;
232 #define DSDB_EXTENDED_CREATE_PARTITION_OID "1.3.6.1.4.1.7165.4.4.4"
233 struct dsdb_create_partition_exop
{
234 struct ldb_dn
*new_dn
;
238 * the schema_dn is passed as struct ldb_dn in
239 * req->op.extended.data
241 #define DSDB_EXTENDED_SCHEMA_UPDATE_NOW_OID "1.3.6.1.4.1.7165.4.4.2"
243 #define DSDB_EXTENDED_SCHEMA_UPGRADE_IN_PROGRESS_OID "1.3.6.1.4.1.7165.4.4.6"
245 #define DSDB_OPENLDAP_DEREFERENCE_CONTROL "1.3.6.1.4.1.4203.666.5.16"
247 struct dsdb_openldap_dereference
{
248 const char *source_attribute
;
249 const char **dereference_attribute
;
252 struct dsdb_openldap_dereference_control
{
253 struct dsdb_openldap_dereference
**dereference
;
256 struct dsdb_openldap_dereference_result
{
257 const char *source_attribute
;
258 const char *dereferenced_dn
;
260 struct ldb_message_element
*attributes
;
263 struct dsdb_openldap_dereference_result_control
{
264 struct dsdb_openldap_dereference_result
**attributes
;
267 struct samldb_msds_intid_persistant
{
271 #define SAMLDB_MSDS_INTID_OPAQUE "SAMLDB_MSDS_INTID_OPAQUE"
273 #define DSDB_PARTITION_DN "@PARTITION"
274 #define DSDB_PARTITION_ATTR "partition"
276 #define DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME "dsdb_extended_dn_store_format"
277 struct dsdb_extended_dn_store_format
{
278 bool store_extended_dn_in_ldb
;
281 #define DSDB_OPAQUE_PARTITION_MODULE_MSG_OPAQUE_NAME "DSDB_OPAQUE_PARTITION_MODULE_MSG"
283 /* this takes a struct dsdb_fsmo_extended_op */
284 #define DSDB_EXTENDED_ALLOCATE_RID_POOL "1.3.6.1.4.1.7165.4.4.5"
286 struct dsdb_fsmo_extended_op
{
288 struct GUID destination_dsa_guid
;
291 /* this takes no data */
292 #define DSDB_EXTENDED_CREATE_OWN_RID_SET "1.3.6.1.4.1.7165.4.4.8"
294 /* this takes a struct dsdb_extended_allocate_rid */
295 #define DSDB_EXTENDED_ALLOCATE_RID "1.3.6.1.4.1.7165.4.4.9"
297 struct dsdb_extended_allocate_rid
{
302 * passed from the descriptor module in order to
303 * store the recalucated nTSecurityDescriptor without
304 * modifying the replPropertyMetaData.
306 #define DSDB_EXTENDED_SEC_DESC_PROPAGATION_OID "1.3.6.1.4.1.7165.4.4.7"
307 struct dsdb_extended_sec_desc_propagation_op
{
308 struct ldb_dn
*nc_root
;
313 #define DSDB_ACL_CHECKS_DIRSYNC_FLAG 0x1
314 #define DSDB_SAMDB_MINIMUM_ALLOWED_RID 1000
316 #define DSDB_METADATA_SCHEMA_SEQ_NUM "SCHEMA_SEQ_NUM"
319 * must be in LDB_FLAG_INTERNAL_MASK
320 * see also the values in lib/ldb/include/ldb_module.h
322 #define DSDB_FLAG_INTERNAL_FORCE_META_DATA 0x10000
324 #define SAMBA_COMPATIBLE_FEATURES_ATTR "compatibleFeatures"
325 #define SAMBA_REQUIRED_FEATURES_ATTR "requiredFeatures"
326 #define SAMBA_FEATURES_SUPPORTED_FLAG "@SAMBA_FEATURES_SUPPORTED"
328 #define SAMBA_SORTED_LINKS_FEATURE "sortedLinks"
330 #endif /* __SAMDB_H__ */