| blob | 30f4fddc098cefa795655da9a0b414a05c1a641c |
1 /*
2 SAM ldb module
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005-2014
5 Copyright (C) Simo Sorce 2004-2008
6 Copyright (C) Matthias Dieter Wallnöfer 2009-2011
7 Copyright (C) Matthieu Patou 2012
8 Copyright (C) Catalyst.Net Ltd 2017
10 This program is free software; you can redistribute it and/or modify
11 it under the terms of the GNU General Public License as published by
12 the Free Software Foundation; either version 3 of the License, or
13 (at your option) any later version.
15 This program is distributed in the hope that it will be useful,
16 but WITHOUT ANY WARRANTY; without even the implied warranty of
17 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
18 GNU General Public License for more details.
20 You should have received a copy of the GNU General Public License
21 along with this program. If not, see <http://www.gnu.org/licenses/>.
22 */
24 /*
25 * Name: ldb
26 *
27 * Component: ldb samldb module
28 *
29 * Description: various internal DSDB triggers - most for SAM specific objects
30 *
31 * Author: Simo Sorce
32 */
57 #undef strcasecmp
61 SAMLDB_TYPE_USER,
62 SAMLDB_TYPE_GROUP,
63 SAMLDB_TYPE_CLASS,
64 SAMLDB_TYPE_ATTRIBUTE
65 };
71 samldb_step_fn_t fn;
72 };
78 /* used for add operations */
81 /*
82 * should we apply the need_trailing_dollar restriction to
83 * samAccountName
84 */
88 /* the resulting message */
91 /* used in "samldb_find_for_defaultObjectCategory" */
94 /* the SID to be assigned to the resulting account */
97 /* all the async steps necessary to complete the operation */
101 /* If someone set an ares to forward controls and response back to the caller */
103 };
107 {
117 }
123 }
126 {
132 }
145 }
148 }
151 {
154 }
158 }
161 {
165 }
167 /* We exit the samldb module here. If someone set an "ares" to forward
168 * controls and response back to the caller, use them. */
174 }
175 }
181 {
182 /*
183 * The steps we end up going through to get and check a single valued
184 * attribute.
185 */
193 attr,
199 }
201 /* we are not affected */
203 }
207 ldb,
213 ldb,
214 "samldb: new value for %s "
216 attr);
218 }
223 ldb,
225 attr);
227 }
232 }
237 {
248 }
250 /* the attribute wasn't found */
252 }
257 }
259 /*
260 * No other object should have the attribute with this value.
261 */
264 base_dn,
272 base_dn,
276 }
279 }
288 }
289 }
293 }
304 )
305 {
306 /*
307 * A very specific helper function for samldb_sam_account_upn_clash(),
308 * where we end up doing this same thing several times in a row.
309 */
317 }
319 base_dn,
333 "samldb: %s '%s' "
336 /* different errors for different attrs */
339 }
341 }
342 }
344 }
348 {
349 /*
350 * The rules here are based on
351 *
352 * https://social.technet.microsoft.com/wiki/contents/articles/11216.active-directory-requirements-for-creating-objects.aspx
353 *
354 * Windows considers UTF-8 sequences that map to "similar" characters
355 * (e.g. 'a', 'ā') to be the same sAMAccountName, and we don't. Names
356 * that are not valid UTF-8 *are* allowed.
357 *
358 * Additionally, Samba collapses multiple spaces, and Windows doesn't.
359 */
368 ldb,
369 "samldb: sAMAccountName contains invalid "
372 }
376 ldb,
377 "samldb: sAMAccountName contains invalid "
380 }
381 }
385 ldb,
388 }
392 ldb,
395 }
397 }
400 {
416 }
422 }
424 /* Not changing these things, so we're done */
426 }
433 }
436 /*
437 * note we take the last @ in the upn because the first (i.e.
438 * sAMAccountName equivalent) part can contain @.
439 *
440 * It is also OK (per Windows) for a UPN to have zero @s.
441 */
448 }
452 /*
453 * there is no @ in this UPN, so we treat the whole
454 * thing as a sAMAccountName for the purposes of a
455 * clash.
456 */
460 /*
461 * Now, this upn only implies a sAMAccountName if the
462 * realm is our realm. So we need to compare the tail
463 * of the upn to the realm.
464 */
468 /* implied_sam is not the implied
469 * sAMAccountName after all, because it is
470 * from a different realm. */
472 }
473 }
474 }
482 }
483 }
485 /*
486 * Now we have all of the actual and implied names, in which to search
487 * for conflicts.
488 */
497 }
502 }
503 }
512 }
513 }
522 }
523 }
531 }
532 }
536 }
539 /* This is run during an add or modify */
541 {
555 }
565 }
566 }
572 /*
573 * Error code munging to try and match what must be some quite
574 * strange code-paths in Windows
575 */
581 }
584 }
589 }
593 }
595 /* This does not permit a single $ */
598 "%08X: samldb: 'samAccountName' "
602 }
607 }
609 is_admin
613 /*
614 * Administrators are allowed to select strange names.
615 * This is poor practice but not prevented.
616 */
618 }
622 "%08X: samldb: 'samAccountName' "
626 }
629 "%08X: samldb: 'samAccountName' "
633 }
636 }
639 {
645 }
647 }
650 {
656 }
658 }
661 {
667 }
669 }
677 {
684 }
689 DSDB_FLAG_NEXT_MODULE,
695 linkID,
698 }
704 }
706 /* Find the next open forward linkID in the schema. */
710 {
716 /*
717 * Windows starts at about 0xB0000000 in order to stop potential
718 * collisions with future additions to the schema. We pass this
719 * around as a signed int sometimes, but this should be sufficient.
720 */
733 }
734 }
737 }
740 {
762 }
766 }
771 }
776 }
778 /*
779 * This OID indicates that the caller wants the linkID
780 * to be automatically generated. We therefore assign
781 * it the next open linkID.
782 */
788 }
792 new_linkID);
794 }
796 /*
797 * Using either the attributeID or lDAPDisplayName of
798 * another attribute in the linkID field indicates that
799 * we should make this the backlink of that attribute.
800 */
804 }
807 /*
808 * The attribute we're adding this as a backlink of must
809 * be a forward link.
810 */
813 }
817 /* Make sure that this backlink doesn't already exist. */
823 }
827 }
831 new_linkID);
833 }
841 }
842 }
850 {
857 DSDB_FLAG_NEXT_MODULE,
863 mapiid,
866 }
872 }
877 {
883 /* Windows' generation seems to start about here */
896 }
897 }
900 }
903 {
913 /*
914 * The mAPIID of a new attribute should be automatically generated
915 * if a specific OID is put as the mAPIID, as according to
916 * [MS-ADTS] 3.1.1.2.3.2.
917 */
930 }
934 }
939 }
947 }
953 }
961 }
962 }
964 /* sAMAccountName handling */
967 {
971 /*
972 * This is currently a Samba-only behaviour, to add a trailing
973 * $ even for the generated accounts.
974 */
977 /* Format: $000000-00000000000$ */
983 /* Format: $000000-000000000000 */
989 }
992 }
994 }
997 {
1004 }
1005 }
1010 }
1013 }
1019 {
1027 }
1029 }
1032 /* allocate a SID using our RID Set */
1034 {
1043 }
1048 }
1052 }
1057 }
1059 /*
1060 see if a krbtgt_number is available
1061 */
1064 {
1073 DSDB_FLAG_NEXT_MODULE,
1076 krbtgt_number);
1080 }
1083 }
1085 /* special handling for add in RODC join */
1087 {
1093 /* find a unused msDS-SecondaryKrbTgtNumber */
1097 }
1103 }
1104 }
1109 }
1110 }
1117 found:
1122 LDB_FLAG_INTERNAL_DISABLE_VALIDATION);
1125 }
1128 krbtgt_number);
1131 }
1136 }
1137 /*
1138 * Note that the password_hash module will ignore
1139 * this value and use it's own generate_secret_buffer()
1140 * that's why we can just use generate_random_buffer()
1141 * here.
1142 */
1147 }
1150 }
1153 {
1166 }
1168 /* Remove any user‐specified passwords. */
1171 /* Remove any user‐specified password IDs. */
1175 {
1176 DATA_BLOB pwd_id_blob = {};
1177 DATA_BLOB password_blob = {};
1180 /*
1181 * The account must have a SID allocated for us to be able to
1182 * derive its password.
1183 */
1187 }
1189 /* Calculate the password and ID blobs. */
1192 current_time,
1198 }
1203 /* Add the new password blob. */
1210 }
1212 /* Add the new password ID blob. */
1219 }
1220 }
1225 }
1227 out:
1229 }
1232 {
1242 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT
1247 /* Don't be pricky when the DN doesn't exist if we have the */
1248 /* RELAX control specified */
1252 "samldb_find_defaultObjectCategory: "
1255 }
1256 }
1259 }
1262 /* ensure the defaultObjectCategory has a full GUID */
1267 }
1271 LDB_SUCCESS) {
1273 }
1277 DSDB_FLAG_NEXT_MODULE,
1281 }
1282 }
1288 }
1290 /**
1291 * msDS-IntId attributeSchema attribute handling
1292 * during LDB_ADD request processing
1293 */
1295 {
1309 /* replicated update should always go through */
1311 DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1313 }
1315 /* msDS-IntId is handled by system and should never be
1316 * passed by clients */
1319 }
1321 /* do not generate msDS-IntId if Relax control is passed */
1324 }
1326 /* check Functional Level */
1329 }
1331 /* check systemFlags for SCHEMA_BASE_OBJECT flag */
1335 }
1342 }
1344 msds_intid_struct = (struct samldb_msds_intid_persistant*) ldb_get_opaque(ldb, SAMLDB_MSDS_INTID_OPAQUE);
1347 /* Generate new value for msDs-IntId
1348 * Value should be in 0x80000000..0xBFFFFFFF range */
1355 }
1357 /* probe id values until unique one is found */
1359 msds_intid++;
1362 }
1363 /*
1364 * We search in the schema if we have already this
1365 * intid (using dsdb_attribute_by_attributeID_id
1366 * because in the range 0x80000000 0xBFFFFFFF,
1367 * attributeID is a DSDB_ATTID_TYPE_INTID).
1368 *
1369 * If so generate another random value.
1370 *
1371 * We have to check the DB in case someone else has
1372 * modified the database while we are doing our
1373 * changes too (this case should be very very rare) in
1374 * order to be sure.
1375 */
1381 }
1387 DSDB_FLAG_NEXT_MODULE,
1393 msds_intid,
1396 }
1405 msds_intid);
1406 }
1409 /*
1410 * samldb_add_entry (async)
1411 */
1415 {
1425 LDB_ERR_OPERATIONS_ERROR);
1426 }
1430 }
1435 }
1439 LDB_ERR_OPERATIONS_ERROR);
1440 }
1442 /* The caller may wish to get controls back from the add */
1448 }
1450 }
1453 {
1468 }
1471 }
1473 /*
1474 * return true if msg carries an attributeSchema that is intended to be RODC
1475 * filtered but is also a system-critical attribute.
1476 */
1478 {
1483 rodc_filtered_flags = (SEARCH_FLAG_RODC_ATTRIBUTE
1491 }
1492 }
1496 {
1500 /* Add information for the different account types */
1504 LDB_CONTROL_RODC_DCPROMO_OID);
1506 /* see [MS-ADTS] 3.1.1.3.4.1.23 LDAP_SERVER_RODC_DCPROMO_OID */
1510 }
1516 }
1517 }
1519 /* check if we have a valid sAMAccountName */
1526 }
1529 /* check if we have a valid sAMAccountName */
1536 }
1543 /* As discussed with Microsoft through dochelp in April 2012 this is the behavior of windows*/
1547 }
1553 /* do not allow one to mark an attributeSchema as RODC filtered if it
1554 * is system-critical */
1556 ldb_asprintf_errstring(ldb, "Refusing schema add of %s - cannot combine critical class with RODC filtering",
1559 }
1564 }
1566 /* the RDN has prefix "CN" */
1573 }
1574 }
1578 NULL);
1583 {
1585 LDB_ERR_UNWILLING_TO_PERFORM,
1586 WERR_DS_INVALID_LDAP_DISPLAY_NAME,
1588 }
1592 /* a new GUID */
1598 }
1599 }
1604 /* "defaultObjectCategory" has been set by the caller.
1605 * Do some checks for consistency.
1606 * NOTE: The real constraint check (that
1607 * 'defaultObjectCategory' is the DN of the new
1608 * objectclass or any parent of it) is still incomplete.
1609 * For now we say that 'defaultObjectCategory' is valid
1610 * if it exists and it is of objectclass "classSchema".
1611 */
1617 }
1619 /* "defaultObjectCategory" has not been set by the
1620 * caller. Use the entry DN for it. */
1628 }
1629 }
1634 /* Now perform the checks for the 'defaultObjectCategory'. The
1635 * lookup DN was already saved in "ac->dn" */
1639 /* -2 is not a valid objectClassCategory so it means the attribute wasn't present */
1641 /* Windows 2003 does this*/
1645 }
1646 }
1648 }
1657 }
1659 /* the RDN has prefix "CN" */
1666 }
1667 }
1671 NULL);
1676 {
1678 LDB_ERR_UNWILLING_TO_PERFORM,
1679 WERR_DS_INVALID_LDAP_DISPLAY_NAME,
1681 }
1683 /* do not allow one to mark an attributeSchema as RODC filtered if it
1684 * is system-critical */
1690 }
1698 /* a new GUID */
1704 }
1705 }
1709 /*
1710 * No need to scream if there isn't as we have code later on
1711 * that will take care of it.
1712 */
1713 const struct dsdb_syntax *syntax = find_syntax_map_by_ad_oid((const char *)el->values[0].data);
1725 }
1726 }
1733 }
1734 }
1735 }
1736 }
1737 }
1739 /* handle msDS-IntID attribute */
1746 }
1752 }
1755 }
1758 {
1773 }
1778 }
1784 LDB_ERR_OBJECT_CLASS_VIOLATION,
1785 WERR_DS_MISSING_REQUIRED_ATT,
1787 }
1791 LDB_ERR_UNWILLING_TO_PERFORM,
1792 WERR_DS_ILLEGAL_MOD_OPERATION,
1794 }
1802 }
1803 }
1809 }
1816 }
1819 }
1820 }
1822 /* finally proceed with adding the entry */
1827 }
1830 {
1835 /* replicated update should always go through */
1837 DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1839 }
1841 /* do not update schemaInfo during provisioning */
1844 }
1853 }
1856 DSDB_FLAG_NEXT_MODULE|
1857 DSDB_FLAG_AS_SYSTEM,
1864 }
1867 }
1877 /*
1878 * "Objectclass" trigger (MS-SAMR 3.1.1.8.1)
1879 *
1880 * Has to be invoked on "add" operations on "user", "computer" and
1881 * "group" objects.
1882 * ac->msg contains the "add"
1883 * ac->type contains the object type (main objectclass)
1884 */
1886 {
1894 /* make sure that "sAMAccountType" is not specified */
1900 }
1902 /* Step 1: objectSid assignment */
1904 /* Don't allow the objectSid to be changed. But beside the RELAX
1905 * control we have also to guarantee that it can always be set with
1906 * SYSTEM permissions. This is needed for the "samba3sam" backend. */
1913 }
1915 /* but generate a new SID when we do have an add operations */
1919 }
1928 /* Step 1.2: Default values */
1932 is_computer_objectclass
1940 default_user_account_control
1942 }
1945 /* On add operations we might need to generate a
1946 * "userAccountControl" (if it isn't specified). */
1951 default_user_account_control);
1954 }
1957 }
1962 /* Step 1.3: "userAccountControl" -> "sAMAccountType" mapping */
1967 /*
1968 * "userAccountControl" = 0 or missing one of
1969 * the types means "UF_NORMAL_ACCOUNT"
1970 * or "UF_WORKSTATION_TRUST_ACCOUNT" (if a computer).
1971 * See MS-SAMR 3.1.1.8.10 point 8
1972 */
1974 user_account_control
1975 = default_user_account_control
1978 }
1980 /*
1981 * As per MS-SAMR 3.1.1.8.10 these flags have not to be set
1982 */
1986 }
1990 }
1993 raw_uac,
1994 user_account_control,
1996 is_computer_objectclass);
1999 }
2001 /*
2002 * Require, for non-admin modifications, a trailing $
2003 * for either objectclass=computer or a trust account
2004 * type in userAccountControl
2005 */
2009 }
2013 }
2015 /* add "sAMAccountType" attribute */
2019 }
2021 /* "isCriticalSystemObject" might be set */
2028 }
2034 }
2035 }
2037 /* Step 1.4: "userAccountControl" -> "primaryGroupID" mapping */
2044 }
2045 /*
2046 * Older AD deployments don't know about the
2047 * RODC group
2048 */
2053 }
2054 }
2055 }
2057 /* Step 1.5: Add additional flags when needed */
2058 /* Obviously this is done when the "userAccountControl"
2059 * has been generated here (tested against Windows
2060 * Server) */
2065 }
2069 user_account_control);
2072 }
2073 }
2075 }
2080 /* Step 2.2: Default values */
2082 GTYPE_SECURITY_GLOBAL_GROUP);
2088 /* Step 2.3: "groupType" -> "sAMAccountType" */
2096 /* The creation of builtin groups requires the
2097 * RELAX control */
2102 }
2103 }
2109 }
2112 account_type,
2113 LDB_FLAG_MOD_REPLACE);
2116 }
2117 }
2119 }
2126 }
2129 }
2131 /*
2132 * "Primary group ID" trigger (MS-SAMR 3.1.1.8.2)
2133 *
2134 * Has to be invoked on "add" and "modify" operations on "user" and "computer"
2135 * objects.
2136 * ac->msg contains the "add"/"modify" message
2137 */
2140 {
2150 }
2154 LDB_SCOPE_SUBTREE,
2161 }
2166 rid);
2168 }
2172 }
2175 {
2181 /* we aren't affected of any primary group set */
2188 }
2191 }
2194 {
2200 NULL };
2224 }
2227 /* we are not affected */
2229 }
2231 /* Fetch information from the existing object */
2237 }
2242 }
2246 /* Finds out the DN of the old primary group */
2251 /* User objects do always have a mandatory "primaryGroupID"
2252 * attribute. If this doesn't exist then the object is of the
2253 * wrong type. This is the exact Windows error code */
2255 }
2260 }
2262 /* Finds out the DN of the new primary group
2263 * Notice: in order to parse the primary group ID correctly we create
2264 * a temporary message here. */
2269 }
2273 }
2277 /* we aren't affected of any primary group change */
2279 }
2283 }
2287 "%08X: samldb: UF_SERVER_TRUST_ACCOUNT requires "
2290 DOMAIN_RID_DCS);
2292 }
2296 "%08X: samldb: UF_PARTIAL_SECRETS_ACCOUNT requires "
2299 DOMAIN_RID_READONLY_DCS);
2301 }
2305 LDB_SCOPE_SUBTREE,
2312 }
2315 }
2321 }
2325 LDB_SCOPE_SUBTREE,
2332 }
2334 /* Here we know if the specified new primary group candidate is
2335 * valid or not. */
2337 }
2340 /* The new primary group must not be domain-local. */
2344 LDB_ERR_UNWILLING_TO_PERFORM,
2345 WERR_MEMBER_NOT_IN_GROUP,
2347 }
2353 }
2355 /* We need to be already a normal member of the new primary
2356 * group in order to be successful. */
2358 new_prim_group_dn_ext_str);
2361 }
2363 /* Remove the "member" attribute on the new primary group */
2367 }
2373 }
2378 }
2381 /* Add a "member" attribute for the previous primary group */
2385 }
2391 }
2396 }
2400 }
2403 {
2410 }
2413 }
2417 {
2428 {
2432 },
2433 {
2436 .error_string = "Setting UF_PARTIAL_SECRETS_ACCOUNT only permitted with UF_WORKSTATION_TRUST_ACCOUNT"
2437 },
2438 {
2441 .error_string = "Setting UF_TRUSTED_FOR_DELEGATION not allowed with UF_PARTIAL_SECRETS_ACCOUNT"
2442 },
2443 {
2447 },
2448 {
2452 },
2453 {
2457 },
2458 {
2462 },
2463 };
2469 }
2470 }
2473 }
2485 }
2490 }
2491 }
2492 }
2493 }
2510 }
2511 }
2513 }
2515 /*
2516 * It would be best if these rules apply, always, but for now they
2517 * apply only to non-admins
2518 */
2524 {
2538 }
2540 is_admin
2544 /*
2545 * We want to allow changes to (eg) disable an account
2546 * that was created wrong, only checking the
2547 * objectclass if the account type changes.
2548 */
2551 }
2557 "%08X: samldb: UF_NORMAL_ACCOUNT "
2561 }
2567 "%08X: samldb: UF_INTERDOMAIN_TRUST_ACCOUNT "
2571 }
2576 /*
2577 * Modify of a user account account into a
2578 * workstation without objectclass computer
2579 * as an admin is still permitted, but not
2580 * to make an RODC
2581 */
2586 }
2588 "%08X: samldb: UF_WORKSTATION_TRUST_ACCOUNT "
2592 }
2598 "%08X: samldb: UF_SERVER_TRUST_ACCOUNT "
2602 }
2609 user_account_control);
2611 }
2613 }
2618 {
2625 domain_dn,
2626 sd_attrs,
2631 }
2634 }
2639 }
2644 }
2646 /**
2647 * Validate that the restriction in point 5 of MS-SAMR 3.1.1.8.10 userAccountControl is honoured
2648 *
2649 */
2654 {
2671 {
2674 .error_string = "Adding the UF_PASSWD_NOTREQD bit in userAccountControl requires the Update-Password-Not-Required-Bit right that was not given on the Domain object"
2675 },
2676 {
2679 .error_string = "Adding the UF_DONT_EXPIRE_PASSWD bit in userAccountControl requires the Unexpire-Password right that was not given on the Domain object"
2680 },
2681 {
2684 .error_string = "Adding the UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED bit in userAccountControl requires the Enable-Per-User-Reversibly-Encrypted-Password right that was not given on the Domain object"
2685 },
2686 {
2689 .error_string = "Adding the UF_SERVER_TRUST_ACCOUNT bit in userAccountControl requires the DS-Install-Replica right that was not given on the Domain object"
2690 },
2691 {
2694 .error_string = "Adding the UF_PARTIAL_SECRETS_ACCOUNT bit in userAccountControl requires the DS-Install-Replica right that was not given on the Domain object"
2695 },
2696 {
2699 .error_string = "Swapping UF_NORMAL_ACCOUNT to UF_WORKSTATION_TRUST_ACCOUNT requires the user to be a member of the domain admins group"
2700 },
2701 {
2704 .error_string = "Swapping UF_WORKSTATION_TRUST_ACCOUNT to UF_NORMAL_ACCOUNT requires the user to be a member of the domain admins group"
2705 },
2706 {
2709 .error_string = "Updating the UF_INTERDOMAIN_TRUST_ACCOUNT bit in userAccountControl is not permitted over LDAP. This bit is restricted to the LSA CreateTrustedDomain interface",
2711 },
2712 {
2716 .error_string = "Updating the UF_TRUSTED_FOR_DELEGATION bit in userAccountControl is not permitted without the SeEnableDelegationPrivilege"
2717 },
2718 {
2722 .error_string = "Updating the UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION bit in userAccountControl is not permitted without the SeEnableDelegationPrivilege"
2723 }
2725 };
2729 }
2735 }
2736 }
2739 }
2744 }
2749 }
2758 }
2759 }
2764 }
2770 }
2775 }
2780 objectclass,
2781 domain_sd,
2782 user_token,
2784 SEC_ADS_CONTROL_ACCESS,
2785 sid);
2788 }
2791 }
2792 }
2793 }
2810 }
2815 domain_dn,
2818 }
2819 }
2821 }
2829 {
2836 }
2838 user_account_control,
2839 user_account_control_old,
2840 is_computer_objectclass);
2843 }
2845 ret = samldb_check_user_account_control_acl(ac, sid, user_account_control, user_account_control_old);
2848 }
2854 }
2861 DSDB_CONTROL_PASSWORD_USER_ACCOUNT_CONTROL_OID,
2865 }
2868 }
2871 /**
2872 * This function is called on LDB modify operations. It performs some additions/
2873 * replaces on the current LDB message when "userAccountControl" changes.
2874 */
2876 {
2889 NTTIME old_lockoutTime;
2904 NULL
2905 };
2917 }
2924 }
2926 /* Create a temporary message for fetching the "userAccountControl" */
2930 }
2934 }
2939 /*
2940 * UF_LOCKOUT, UF_PASSWD_CANT_CHANGE and UF_PASSWORD_EXPIRED
2941 * are only generated and not stored. We ignore them almost
2942 * completely, along with unknown bits and UF_SCRIPT.
2943 *
2944 * The only exception is ACB_AUTOLOCK, which features in
2945 * clear_acb when the bit is cleared in this modify operation.
2946 *
2947 * MS-SAMR 2.2.1.13 UF_FLAG Codes states that some bits are
2948 * ignored by clients and servers
2949 */
2952 /* Fetch the old "userAccountControl" and "objectClass" */
2957 }
2961 }
2968 /*
2969 * When we do not have objectclass "computer" we cannot
2970 * switch to a workstation or (RO)DC
2971 */
2975 }
2980 }
2988 /*
2989 * "userAccountControl" = 0 or missing one of the
2990 * types means "UF_NORMAL_ACCOUNT". See MS-SAMR
2991 * 3.1.1.8.10 point 8
2992 */
2995 }
2999 }
3002 raw_uac,
3003 new_uac,
3004 old_uac,
3005 is_computer_objectclass);
3008 }
3028 }
3040 }
3045 LDB_FLAG_MOD_REPLACE);
3048 }
3049 }
3051 /* As per MS-SAMR 3.1.1.8.10 these flags have not to be set */
3053 /* "lockoutTime" reset as per MS-SAMR 3.1.1.8.10 */
3059 }
3060 }
3062 /*
3063 * "isCriticalSystemObject" might be set/changed
3064 *
3065 * Even a change from UF_NORMAL_ACCOUNT (implicitly FALSE) to
3066 * UF_WORKSTATION_TRUST_ACCOUNT (actually FALSE) triggers
3067 * creating the attribute.
3068 */
3072 LDB_FLAG_MOD_REPLACE);
3075 }
3076 }
3080 /* Older AD deployments don't know about the RODC group */
3085 }
3086 }
3090 LDB_FLAG_MOD_REPLACE);
3093 }
3094 }
3096 /* Propagate eventual "userAccountControl" attribute changes */
3099 new_uac);
3102 }
3106 LDB_FLAG_MOD_REPLACE,
3114 }
3117 }
3121 {
3132 }
3143 }
3148 }
3153 }
3157 objectclass,
3158 domain_sd,
3159 user_token,
3160 GUID_DRS_UNEXPIRE_PASSWORD,
3161 SEC_ADS_CONTROL_ACCESS,
3162 sid);
3165 }
3168 "Failed to %s %s: "
3169 "Setting pwdLastSet to -1 requires the "
3170 "Unexpire-Password right that was not given "
3172 operation,
3178 }
3180 /**
3181 * This function is called on LDB modify operations. It performs some additions/
3182 * replaces on the current LDB message when "pwdLastSet" changes.
3183 */
3185 {
3195 NULL
3196 };
3205 }
3212 }
3214 /* Create a temporary message for fetching the "userAccountControl" */
3218 }
3222 }
3226 /*
3227 * Setting -1 (0xFFFFFFFFFFFFFFFF) requires the Unexpire-Password right
3228 */
3231 }
3233 /* Fetch the "objectSid" */
3238 }
3242 }
3247 }
3250 }
3253 {
3255 NTTIME lockoutTime;
3267 }
3274 }
3276 /* Create a temporary message for fetching the "lockoutTime" */
3280 }
3284 }
3292 }
3294 /* lockoutTime == 0 resets badPwdCount */
3298 LDB_FLAG_MOD_REPLACE);
3301 }
3304 }
3307 {
3323 }
3326 /* we are not affected */
3328 }
3330 /* Create a temporary message for fetching the "groupType" */
3334 }
3338 }
3343 DSDB_FLAG_NEXT_MODULE |
3347 }
3351 }
3353 /* Group type switching isn't so easy as it seems: We can only
3354 * change in this directions: global <-> universal <-> local
3355 * On each step also the group type itself
3356 * (security/distribution) is variable. */
3362 /* change to "universal" allowed */
3368 }
3373 /* each change allowed */
3377 /* change to "universal" allowed */
3383 }
3388 /* we don't allow this "groupType" values */
3391 }
3392 }
3398 }
3403 }
3406 }
3409 {
3420 /* Fetch information from the existing object */
3426 }
3429 }
3434 }
3436 /* We've to walk over all modification entries and consider the "member"
3437 * ones. */
3441 }
3450 /* Deletes will be handled in
3451 * repl_meta_data, and deletes not
3452 * matching a member will return
3453 * LDB_ERR_UNWILLING_TO_PERFORM
3454 * there */
3456 }
3462 }
3464 /* Denies to add "member"s to groups which are primary
3465 * ones for them - in this case return
3466 * ERR_ENTRY_ALREADY_EXISTS. */
3472 /* member DN doesn't exist yet */
3474 }
3477 }
3478 prim_group_rid = ldb_msg_find_attr_as_uint(group_res->msgs[0], "primaryGroupID", (uint32_t)-1);
3480 /* the member hasn't to be a user account ->
3481 * therefore no check needed in this case. */
3483 }
3486 prim_group_rid);
3489 }
3496 }
3497 }
3498 }
3503 }
3505 /* SAM objects have special rules regarding the "description" attribute on
3506 * modify operations. */
3508 {
3515 /* Fetch information from the existing object */
3520 /* don't treat it specially ... let normal error codes
3521 happen from other places */
3524 }
3526 /* we didn't match the filter */
3529 }
3531 /* We've to walk over all modification entries and consider the
3532 * "description" ones. */
3537 }
3538 }
3543 }
3545 #define SPN_ALIAS_NONE 0
3546 #define SPN_ALIAS_LINK 1
3547 #define SPN_ALIAS_TARGET 2
3555 {
3556 /*
3557 * If you change the way this works, you should also look at changing
3558 * LDB_lookup_spn_alias() in source4/dsdb/samdb/cracknames.c, which
3559 * does some of the same work.
3560 *
3561 * In particular, note that sPNMappings are resolved on a first come,
3562 * first served basis. For example, if we have
3563 *
3564 * host=ldap,cifs
3565 * foo=ldap
3566 * cifs=host,alerter
3567 *
3568 * then 'ldap', 'cifs', and 'host' will resolve to 'host', and
3569 * 'alerter' will resolve to 'cifs'.
3570 *
3571 * If this resolution method is made more complicated, then the
3572 * cracknames function should also be changed.
3573 */
3584 NULL
3585 };
3592 }
3600 }
3606 }
3615 }
3622 }
3628 tmp_ctx,
3634 }
3640 }
3642 p++;
3645 /*
3646 * We need to return the reverse aliases for this one.
3647 *
3648 * typically, this means the service_class is "host"
3649 * and the mapping is "host=alerter,appmgmt,cisvc,..",
3650 * so we get "alerter", "appmgmt", etc in the list of
3651 * aliases.
3652 */
3654 /* There is one more field than there are commas */
3659 n++;
3661 }
3662 }
3667 }
3673 }
3677 }
3678 /*
3679 * We need to look along the list to see if service_class is
3680 * there; if so, we return a list of one item (probably "host").
3681 */
3687 p++;
3688 }
3694 }
3701 }
3703 }
3709 }
3716 {
3729 }
3732 tmp_ctx,
3734 base_dn,
3735 LDB_SCOPE_SUBTREE,
3736 empty_attrs,
3739 enc_candidate);
3742 }
3745 }
3752 {
3760 };
3765 }
3770 LDB_FLAG_MOD_DELETE,
3775 }
3781 }
3788 LDB_FLAG_MOD_ADD,
3793 }
3799 }
3811 }
3814 }
3821 {
3836 }
3838 /*
3839 * "dns/example.com/xxx" gives
3840 * service_class = "dns"
3841 * spn_tail = "example.com/xxx"
3842 */
3845 /* bad SPN */
3848 LDB_ERR_OPERATIONS_ERROR,
3850 }
3857 }
3861 tmp_ctx,
3862 service_class,
3869 }
3871 /*
3872 * we have the list of aliases, and now we need to combined them with
3873 * spn_tail and see if we can find the SPN.
3874 */
3882 spn_tail);
3886 }
3891 candidate);
3894 }
3899 }
3902 /*
3903 * We have found an existing SPN that matches the alias. That
3904 * is OK only if it is on the object we are trying to add to,
3905 * or if the SPN on the other side is a more generic alias for
3906 * this one and we also have rights to modify it.
3907 *
3908 * That is, we can put "host/X" and "cifs/X" on the same
3909 * object, but not on different objects, unless we put the
3910 * host/X on first, and could also change that object when we
3911 * add cifs/X. It is forbidden to add the objects in the other
3912 * order.
3913 *
3914 * The rationale for this is that adding "cifs/X" effectively
3915 * changes "host/X" by diverting traffic. If "host/X" can be
3916 * added after "cifs/X", a sneaky person could get "cifs/X" in
3917 * first, making "host/X" have less effect than intended.
3918 *
3919 * Note: we also can't have "host/X" and "Host/X" on the same
3920 * object, but that is not relevant here.
3921 */
3928 spn,
3929 target_dnstr,
3930 candidate,
3931 colliding_dnstr);
3934 /* we don't allow host/X if there is a
3935 * cifs/X */
3938 }
3940 tmp_ctx,
3941 candidate,
3942 colliding_dn);
3946 candidate,
3947 colliding_dnstr,
3948 spn,
3949 target_dnstr);
3953 spn);
3955 }
3959 }
3961 }
3965 }
3971 {
3981 }
3988 }
3993 /*
3994 * COMPARE_TRUE has special meaning here and we don't
3995 * want to return it by mistake.
3996 */
3998 }
4000 }
4001 /*
4002 * We have found this exact SPN. This is mostly harmless (depend on
4003 * ADD vs REPLACE) when the spn is being put on the object that
4004 * already has, so we let it through to succeed or fail as some other
4005 * module sees fit.
4006 */
4013 spn,
4014 colliding_dnstr,
4015 target_dnstr);
4018 spn);
4021 }
4027 }
4031 {
4032 /*
4033 * a 3 part servicePrincipalName has two slashes, like
4034 * ldap/example.com/DomainDNSZones.example.com.
4035 *
4036 * In krb5_parse_name_flags() we don't count "\/" as a slash (i.e.
4037 * escaped by a backslash), but this is not the behaviour of Windows
4038 * on setting a servicePrincipalName -- slashes are counted regardless
4039 * of backslashes.
4040 *
4041 * Accordingly, here we ignore backslashes. This will reject
4042 * multi-slash SPNs that krb5_parse_name_flags() would accept, and
4043 * allow ones in the form "a\/b" that it won't parse.
4044 */
4050 slashes++;
4052 /* at this point we don't care */
4054 }
4055 }
4056 }
4058 }
4061 /* Check that "servicePrincipalName" changes do not introduce a collision
4062 * globally. */
4065 {
4073 }
4086 }
4089 tmp_ctx,
4090 spn,
4095 }
4100 }
4103 tmp_ctx,
4104 spn,
4108 /* we have no sPNMappings, hence no aliases */
4110 }
4115 }
4117 }
4121 }
4125 /* This trigger adapts the "servicePrincipalName" attributes if the
4126 * "dNSHostName" and/or "sAMAccountName" attribute change(s) */
4128 {
4146 }
4154 }
4156 /* we are not affected */
4158 }
4160 /* Create a temporary message for fetching the "dNSHostName" */
4166 }
4170 }
4175 }
4183 }
4184 }
4186 /* Create a temporary message for fetching the "sAMAccountName" */
4194 }
4198 }
4209 }
4212 /* The "sAMAccountName" needs some additional trimming: we need
4213 * to remove the trailing "$"s if they exist. */
4217 }
4221 }
4224 }
4227 /* we cannot change when the old name is unknown */
4229 }
4232 /* The "dNSHostName" didn't change */
4234 }
4237 /* we cannot change when the old name is unknown */
4239 }
4242 /* The "sAMAccountName" didn't change */
4244 }
4247 /* Well, there are information missing (old name(s)) or the
4248 * names didn't change. We've nothing to do and can exit here */
4250 }
4252 /*
4253 * Potential "servicePrincipalName" changes in the same request have
4254 * to be handled before the update (Windows behaviour).
4255 *
4256 * We extract the SPN changes into a new message and run it through
4257 * the stack from this module, so that it subjects them to the SPN
4258 * checks we have here.
4259 */
4265 }
4272 }
4284 }
4286 }
4288 /* Fetch the "servicePrincipalName"s if any */
4293 }
4296 }
4299 /*
4300 * Yes, we do have "servicePrincipalName"s. First we update them
4301 * locally, that means we do always substitute the current
4302 * "dNSHostName" with the new one and/or "sAMAccountName"
4303 * without "$" with the new one and then we append the
4304 * modified "servicePrincipalName"s as a message element
4305 * replace to the modification request (Windows behaviour). We
4306 * need also to make sure that the values remain case-
4307 * insensitively unique.
4308 */
4314 }
4330 }
4336 }
4340 }
4346 }
4347 }
4349 /* Uniqueness check */
4354 }
4355 }
4358 }
4360 /*
4361 * append the new "servicePrincipalName" -
4362 * code derived from ldb_msg_add_value().
4363 *
4364 * Open coded to make it clear that we must
4365 * append to the MOD_REPLACE el created above.
4366 */
4372 }
4376 }
4377 }
4382 }
4384 /* This checks the "fSMORoleOwner" attributes */
4386 {
4401 }
4404 /* we are not affected */
4406 }
4409 }
4411 /* Create a temporary message for fetching the "fSMORoleOwner" */
4415 }
4419 }
4427 }
4429 /* Fetched DN has to reference a "nTDSDSA" entry */
4431 no_attrs,
4436 }
4441 }
4447 choose_error_code:
4448 /* this is just how it is */
4453 }
4454 }
4456 /*
4457 * Return zero if the number of zero bits in the address (looking from low to
4458 * high) is equal to or greater than the length minus the mask. Otherwise it
4459 * returns -1.
4460 */
4463 {
4464 /* <address> is an integer in big-endian form, <len> bits long. All
4465 bits between <mask> and <len> must be zero. */
4473 mask);
4476 "%02x%02x-%02x%02x-%02x%02x-%02x%02x-"
4482 mask);
4483 }
4488 }
4490 /* single address subnet.
4491 * In IPv4 all 255s is invalid by the bitmask != address rule
4492 * in MS-ADTS. IPv6 does not suffer.
4493 */
4500 }
4501 }
4503 }
4512 }
4513 }
4519 }
4521 /* According to MS-ADTS, the mask can't exactly equal the bitmask for
4522 * IPv4 (but this is fine for v6). That is 255.255.80.0/17 is bad,
4523 * because the bitmask implied by "/17" is 255.255.80.0.
4524 *
4525 * The bit_mask used in the previous check is the complement of what
4526 * we want here.
4527 */
4534 }
4535 }
4538 }
4539 }
4541 }
4548 {
4549 /*
4550 * Check that the address is in the canonical RFC5952 format for IPv6,
4551 * and lacks extra leading zeros for each dotted decimal for IPv4.
4552 * Handily this is what inet_ntop() gives you.
4553 */
4560 }
4564 /* If the address family is IPv6, and the address is in a
4565 certain range
4567 */
4570 "lying in a range that was once used for "
4571 "IPv4 embedding (that is, it might also be "
4573 address_redux));
4574 }
4576 }
4578 }
4582 /*
4583 * MS-ADTS v20150630 6.1.1.2.2.2.1 Subnet Object, refers to RFC1166 and
4584 * RFC2373. It specifies something seemingly indistinguishable from an RFC4632
4585 * CIDR address range without saying so explicitly. Here we follow the CIDR
4586 * spec.
4587 *
4588 * Return 0 on success, -1 on error.
4589 */
4591 {
4607 }
4609 /* there must be a '/' */
4613 }
4614 /* terminate the address for strchr, inet_pton */
4622 }
4627 }
4632 }
4637 }
4643 /* This seems to be an IPv4 address embedded in IPv6, which is
4644 icky. We don't support it. */
4646 cidr);
4653 }
4658 }
4660 /* looks like IPv4 */
4665 }
4670 }
4676 }
4678 /* This doesn't look like an IP address at all. */
4680 }
4685 error:
4688 }
4692 {
4702 }
4710 }
4716 }
4719 }
4723 {
4728 WERROR err;
4733 }
4739 }
4757 server_dn);
4758 }
4759 }
4762 }
4765 domain,
4768 }
4771 }
4773 /*
4774 * Restrict all access to sensitive attributes.
4775 *
4776 * We don't want to even inspect the values, so we can use the same
4777 * routine for ADD and MODIFY.
4778 *
4779 */
4782 {
4789 }
4794 }
4798 /*
4799 * sidHistory is restricted to the (not implemented
4800 * yet in Samba) DsAddSidHistory call (direct LDB access is
4801 * as SYSTEM so will bypass this).
4802 *
4803 * If you want to modify this, say to merge domains,
4804 * directly modify the sam.ldb as root.
4805 */
4807 "sidHistory "
4808 "(entry %s) cannot be created "
4812 }
4818 /*
4819 * msDS-SecondaryKrbTgtNumber allows the creator to
4820 * become an RODC, this is trusted as an RODC
4821 * account
4822 */
4826 }
4830 objectclass,
4831 domain_sd,
4832 user_token,
4833 GUID_DRS_DS_INSTALL_REPLICA,
4834 SEC_ADS_CONTROL_ACCESS,
4835 NULL);
4838 "msDS-SecondaryKrbTgtNumber "
4839 "(entry %s) cannot be created "
4840 "or changed without "
4844 }
4845 }
4849 /*
4850 * msDS-AllowedToDelegateTo is incredibly powerful,
4851 * given that it allows a server to become ANY USER on
4852 * the target server only listed by SPN so needs to be
4853 * protected just as the userAccountControl
4854 * UF_TRUSTED_FOR_DELEGATION is.
4855 */
4858 SEC_PRIV_ENABLE_DELEGATION);
4861 "msDS-AllowedToDelegateTo "
4862 "(entry %s) cannot be created "
4866 }
4867 }
4869 }
4870 /* add */
4872 {
4882 /* do not manipulate our control entries */
4885 }
4891 }
4896 "setting userParameters is not supported over LDAP, "
4900 }
4905 }
4907 /* build the new msg */
4914 }
4920 }
4927 }
4928 }
4932 /*
4933 * We need to check whether the SPN collides with an existing
4934 * one (anywhere) including via aliases.
4935 */
4939 }
4940 }
4949 }
4954 }
4957 }
4966 }
4969 }
4971 /* perhaps a foreignSecurityPrincipal? */
4976 }
4982 /* If in provision, these checks are too slow to do */
4987 }
4988 }
4993 }
4999 }
5002 }
5008 /* If in provision, these checks are too slow to do */
5013 }
5018 }
5023 }
5024 }
5029 }
5035 }
5038 }
5046 }
5047 /* We are just checking the value is valid, and there are no
5048 values to fill in. */
5049 }
5053 /* nothing matched, go on */
5055 }
5057 /* modify */
5059 {
5068 /* do not manipulate our control entries */
5070 }
5074 /*
5075 * we are going to need some special handling if in Undelete call.
5076 * Since tombstone_reanimate module will restore certain attributes,
5077 * we need to relax checks for: sAMAccountType, primaryGroupID
5078 */
5081 /* make sure that "objectSid" is not specified */
5088 }
5089 }
5091 /* make sure that "sAMAccountType" is not specified */
5097 }
5098 }
5099 /* make sure that "isCriticalSystemObject" is not specified */
5106 }
5107 }
5109 /* msDS-IntId is not allowed to be modified
5110 * except when modification comes from replication */
5113 DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
5115 }
5116 }
5121 "setting userParameters is not supported over LDAP, "
5125 }
5130 }
5132 /* build the new msg */
5139 }
5145 }
5153 }
5154 }
5155 }
5163 }
5164 }
5172 }
5173 }
5181 }
5182 }
5190 }
5191 }
5199 NULL };
5201 ac,
5204 attrs,
5209 }
5210 user_account_control
5225 }
5230 }
5231 }
5239 }
5240 }
5247 }
5248 }
5255 }
5262 }
5269 DSDB_CONTROL_DBCHECK_FIX_LINK_DN_SID);
5274 }
5275 }
5276 }
5283 }
5284 }
5290 /*
5291 * samldb_service_principal_names_change() might add SPN
5292 * changes to the request, so this must come before the SPN
5293 * uniqueness check below.
5294 *
5295 * Note we ALSO have to do the SPN uniqueness check inside
5296 * samldb_service_principal_names_change(), because it does a
5297 * subrequest to do requested SPN modifications *before* its
5298 * automatic ones are added.
5299 */
5303 }
5304 }
5308 /*
5309 * We need to check whether the SPN collides with an existing
5310 * one (anywhere) including via aliases.
5311 */
5316 }
5317 }
5324 }
5325 }
5330 /* Now perform the real modifications as a child request */
5335 req);
5339 }
5342 }
5346 /* no change which interests us, go on */
5348 }
5350 /* delete */
5353 {
5357 NTSTATUS status;
5366 /* Finds out the SID/RID of the SAM object */
5368 attrs,
5373 }
5377 }
5381 /* No SID - it might not be a SAM object - therefore ok */
5383 }
5387 }
5389 /* Special object (security principal?) */
5391 }
5392 /* do not allow deletion of well-known sids */
5396 }
5398 /* Deny delete requests from groups which are primary ones */
5402 DSDB_FLAG_NEXT_MODULE,
5407 }
5410 "Refusing to delete %s, as it "
5411 "is still the primaryGroupID "
5416 /*
5417 * Yes, this seems very wrong, but we have a test
5418 * for this exact error code in sam.py
5419 */
5421 }
5424 }
5427 {
5434 /* do not manipulate our control entries */
5436 }
5444 }
5449 }
5454 }
5459 }
5461 /* rename */
5466 {
5474 /* Skip the checks if old and new DN are the same, or if we have the
5475 * relax control specified or if the returned objects is already
5476 * deleted and needs only to be moved for consistency. */
5480 }
5483 }
5486 /*
5487 * check originating request if we are supposed
5488 * to "see" this record in first place.
5489 */
5492 }
5494 }
5496 /* Objects under CN=System */
5508 }
5512 /* LSA objects */
5520 }
5522 /* subnet objects */
5527 }
5528 }
5530 /* systemFlags */
5541 }
5548 /* Fetch name context */
5553 }
5561 }
5568 }
5572 /* Here we have to do more: control the
5573 * "ALLOW_LIMITED_MOVE" flag. This means that the
5574 * grand-grand-parents of two objects have to be equal
5575 * in order to perform the move (this is used for
5576 * moving "server" objects in the "sites" container). */
5592 }
5600 }
5601 }
5608 }
5616 }
5623 }
5624 }
5629 }
5634 {
5642 LDB_ERR_OPERATIONS_ERROR);
5643 }
5647 }
5651 /*
5652 * This is the root entry of the originating move
5653 * respectively rename request. It has been already
5654 * stored in the list using "subtree_rename_search()".
5655 * Only this one is subject to constraint checking.
5656 */
5662 ret);
5663 }
5667 /* ignore */
5672 /*
5673 * Great, no problem with the rename, so go ahead as
5674 * if we never were here
5675 */
5679 }
5683 }
5686 /* rename */
5688 {
5698 }
5705 }
5709 LDB_SCOPE_BASE,
5711 attrs,
5712 NULL,
5713 ac,
5714 samldb_rename_search_base_callback,
5715 req);
5719 }
5725 }
5728 }
5730 /* extended */
5732 static int samldb_extended_allocate_rid_pool(struct ldb_module *module, struct ldb_request *req)
5733 {
5744 }
5749 }
5752 }
5755 {
5766 }
5771 }
5774 }
5776 static int samldb_extended_create_own_rid_set(struct ldb_module *module, struct ldb_request *req)
5777 {
5786 }
5792 }
5795 }
5798 {
5801 }
5805 }
5809 }
5812 }
5822 };
5826 {
5829 }