2 Unix SMB/CIFS implementation.
4 implement the DsAddEntry call
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Andrew Tridgell 2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "librpc/gen_ndr/ndr_drsuapi.h"
25 #include "rpc_server/dcerpc_server.h"
26 #include "rpc_server/common/common.h"
27 #include "dsdb/samdb/samdb.h"
28 #include "lib/ldb/include/ldb_errors.h"
29 #include "param/param.h"
30 #include "librpc/gen_ndr/ndr_drsblobs.h"
31 #include "auth/auth.h"
32 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
33 #include "libcli/security/security.h"
37 add special SPNs needed for DRS replication to machine accounts when
38 an AddEntry is done to create a nTDSDSA object
40 static WERROR
drsuapi_add_SPNs(struct drsuapi_bind_state
*b_state
,
41 struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
42 const struct drsuapi_DsReplicaObjectListItem
*first_object
)
45 const struct drsuapi_DsReplicaObjectListItem
*obj
;
46 const char *attrs
[] = { "serverReference", "objectGUID", NULL
};
48 for (obj
= first_object
; obj
; obj
=obj
->next_object
) {
49 const char *dn_string
= obj
->object
.identifier
->dn
;
50 struct ldb_dn
*dn
= ldb_dn_new(mem_ctx
, b_state
->sam_ctx
, dn_string
);
51 struct ldb_result
*res
;
52 struct ldb_dn
*ref_dn
;
53 struct GUID ntds_guid
;
54 struct ldb_message
*msg
;
55 struct ldb_message_element
*el
;
56 const char *ntds_guid_str
;
57 const char *dom_string
;
59 ret
= ldb_search(b_state
->sam_ctx
, mem_ctx
, &res
,
60 dn
, LDB_SCOPE_BASE
, attrs
,
61 "(objectClass=ntDSDSA)");
62 if (ret
!= LDB_SUCCESS
|| res
->count
< 1) {
63 DEBUG(0,(__location__
": Failed to find dn '%s'\n", dn_string
));
64 return WERR_DS_DRA_INTERNAL_ERROR
;
67 ref_dn
= samdb_result_dn(b_state
->sam_ctx
, mem_ctx
, res
->msgs
[0], "serverReference", NULL
);
69 /* we only add SPNs for objects with a
74 ntds_guid
= samdb_result_guid(res
->msgs
[0], "objectGUID");
76 ntds_guid_str
= GUID_string(res
, &ntds_guid
);
78 dom_string
= lp_realm(dce_call
->conn
->dce_ctx
->lp_ctx
);
81 * construct a modify request to add the new SPNs to
84 msg
= ldb_msg_new(mem_ctx
);
90 ret
= ldb_msg_add_empty(msg
, "servicePrincipalName",
91 LDB_FLAG_MOD_ADD
, &el
);
92 if (ret
!= LDB_SUCCESS
) {
97 el
->values
= talloc_array(el
, struct ldb_val
, 2);
98 if (el
->values
== NULL
) {
101 /* the magic constant is the GUID of the DRSUAPI RPC
103 el
->values
[0].data
= (uint8_t *)talloc_asprintf(el
->values
,
104 "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
105 ntds_guid_str
, dom_string
);
106 el
->values
[0].length
= strlen((char *)el
->values
[0].data
);
107 el
->values
[1].data
= (uint8_t *)talloc_asprintf(el
->values
, "ldap/%s._msdcs.%s",
108 ntds_guid_str
, dom_string
);
109 el
->values
[1].length
= strlen((char *)el
->values
[1].data
);
111 ret
= ldb_modify(b_state
->sam_ctx
, msg
);
112 if (ret
!= LDB_SUCCESS
) {
113 DEBUG(0,(__location__
": Failed to add SPNs - %s\n",
114 ldb_errstring(b_state
->sam_ctx
)));
115 return WERR_DS_DRA_INTERNAL_ERROR
;
128 WERROR
dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
129 struct drsuapi_DsAddEntry
*r
)
132 struct drsuapi_bind_state
*b_state
;
133 struct dcesrv_handle
*h
;
135 struct drsuapi_DsReplicaObjectIdentifier2
*ids
= NULL
;
137 const struct drsuapi_DsReplicaObjectListItem
*first_object
;
140 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry
, NDR_IN
, r
);
143 /* TODO: check which out level the client supports */
145 ZERO_STRUCTP(r
->out
.ctr
);
146 *r
->out
.level_out
= 3;
147 r
->out
.ctr
->ctr3
.level
= 1;
148 r
->out
.ctr
->ctr3
.error
= talloc_zero(mem_ctx
, union drsuapi_DsAddEntryError
);
150 DCESRV_PULL_HANDLE_WERR(h
, r
->in
.bind_handle
, DRSUAPI_BIND_HANDLE
);
153 if (security_session_user_level(dce_call
->conn
->auth_state
.session_info
) <
154 SECURITY_DOMAIN_CONTROLLER
) {
155 DEBUG(0,("DsAddEntry refused for security token\n"));
156 return WERR_DS_DRA_ACCESS_DENIED
;
159 switch (r
->in
.level
) {
161 ret
= ldb_transaction_start(b_state
->sam_ctx
);
162 if (ret
!= LDB_SUCCESS
) {
163 return WERR_DS_DRA_INTERNAL_ERROR
;
167 first_object
= &r
->in
.req
->req2
.first_object
;
169 status
= dsdb_origin_objects_commit(b_state
->sam_ctx
,
174 if (!W_ERROR_IS_OK(status
)) {
175 r
->out
.ctr
->ctr3
.error
->info1
.status
= status
;
176 ldb_transaction_cancel(b_state
->sam_ctx
);
180 r
->out
.ctr
->ctr3
.count
= num
;
181 r
->out
.ctr
->ctr3
.objects
= ids
;
188 /* if any of the added entries are nTDSDSA objects then we
189 * need to add the SPNs to the machine account
191 status
= drsuapi_add_SPNs(b_state
, dce_call
, mem_ctx
, first_object
);
192 if (!W_ERROR_IS_OK(status
)) {
193 r
->out
.ctr
->ctr3
.error
->info1
.status
= status
;
194 ldb_transaction_cancel(b_state
->sam_ctx
);
198 ret
= ldb_transaction_commit(b_state
->sam_ctx
);
199 if (ret
!= LDB_SUCCESS
) {
200 return WERR_DS_DRA_INTERNAL_ERROR
;