4 Copyright (C) Simo Sorce 2005-2008
5 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2007-2009
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 This program is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 * Component: ldb extended dn control module
26 * Description: this module builds a special dn for returned search
27 * results, and fixes some other aspects of the result (returned case issues)
35 #include "ldb/include/ldb.h"
36 #include "ldb/include/ldb_errors.h"
37 #include "ldb/include/ldb_module.h"
38 #include "libcli/security/dom_sid.h"
39 #include "librpc/gen_ndr/ndr_misc.h"
40 #include "librpc/gen_ndr/ndr_security.h"
41 #include "librpc/ndr/libndr.h"
42 #include "dsdb/samdb/samdb.h"
44 struct extended_dn_out_private
{
47 struct dsdb_openldap_dereference_control
*dereference_control
;
50 static bool is_attr_in_list(const char * const * attrs
, const char *attr
)
54 for (i
= 0; attrs
[i
]; i
++) {
55 if (ldb_attr_cmp(attrs
[i
], attr
) == 0)
62 static char **copy_attrs(void *mem_ctx
, const char * const * attrs
)
67 for (num
= 0; attrs
[num
]; num
++);
69 nattrs
= talloc_array(mem_ctx
, char *, num
+ 1);
70 if (!nattrs
) return NULL
;
72 for(i
= 0; i
< num
; i
++) {
73 nattrs
[i
] = talloc_strdup(nattrs
, attrs
[i
]);
84 static bool add_attrs(void *mem_ctx
, char ***attrs
, const char *attr
)
89 for (num
= 0; (*attrs
)[num
]; num
++);
91 nattrs
= talloc_realloc(mem_ctx
, *attrs
, char *, num
+ 2);
92 if (!nattrs
) return false;
96 nattrs
[num
] = talloc_strdup(nattrs
, attr
);
97 if (!nattrs
[num
]) return false;
99 nattrs
[num
+ 1] = NULL
;
104 /* Fix the DN so that the relative attribute names are in upper case so that the DN:
105 cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com becomes
106 CN=Adminstrator,CN=users,DC=samba,DC=example,DC=com
110 static int fix_dn(struct ldb_dn
*dn
)
113 char *upper_rdn_attr
;
115 for (i
=0; i
< ldb_dn_get_comp_num(dn
); i
++) {
116 /* We need the attribute name in upper case */
117 upper_rdn_attr
= strupper_talloc(dn
,
118 ldb_dn_get_component_name(dn
, i
));
119 if (!upper_rdn_attr
) {
120 return LDB_ERR_OPERATIONS_ERROR
;
123 /* And replace it with CN=foo (we need the attribute in upper case */
124 ret
= ldb_dn_set_component(dn
, i
, upper_rdn_attr
,
125 *ldb_dn_get_component_val(dn
, i
));
126 talloc_free(upper_rdn_attr
);
127 if (ret
!= LDB_SUCCESS
) {
134 /* Inject the extended DN components, so the DN cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com becomes
135 <GUID=541203ae-f7d6-47ef-8390-bfcf019f9583>;<SID=S-1-5-21-4177067393-1453636373-93818737-500>;cn=Adminstrator,cn=users,dc=samba,dc=example,dc=com */
137 static int inject_extended_dn_out(struct ldb_reply
*ares
,
138 struct ldb_context
*ldb
,
144 const DATA_BLOB
*guid_blob
;
145 const DATA_BLOB
*sid_blob
;
147 guid_blob
= ldb_msg_find_ldb_val(ares
->message
, "objectGUID");
148 sid_blob
= ldb_msg_find_ldb_val(ares
->message
, "objectSID");
151 ldb_set_errstring(ldb
, "Did not find objectGUID to inject into extended DN");
152 return LDB_ERR_OPERATIONS_ERROR
;
155 ret
= ldb_dn_set_extended_component(ares
->message
->dn
, "GUID", guid_blob
);
156 if (ret
!= LDB_SUCCESS
) {
160 ret
= ldb_dn_set_extended_component(ares
->message
->dn
, "SID", sid_blob
);
161 if (ret
!= LDB_SUCCESS
) {
167 ldb_msg_remove_attr(ares
->message
, "objectGUID");
170 if (sid_blob
&& remove_sid
) {
171 ldb_msg_remove_attr(ares
->message
, "objectSID");
177 static int handle_dereference_openldap(struct ldb_dn
*dn
,
178 struct dsdb_openldap_dereference_result
**dereference_attrs
,
179 const char *attr
, const DATA_BLOB
*val
)
181 const struct ldb_val
*entryUUIDblob
, *sid_blob
;
182 struct ldb_message fake_msg
; /* easier to use routines that expect an ldb_message */
185 fake_msg
.num_elements
= 0;
187 /* Look for this attribute in the returned control */
188 for (j
= 0; dereference_attrs
&& dereference_attrs
[j
]; j
++) {
189 struct ldb_val source_dn
= data_blob_string_const(dereference_attrs
[j
]->dereferenced_dn
);
190 if (ldb_attr_cmp(dereference_attrs
[j
]->source_attribute
, attr
) == 0
191 && data_blob_cmp(&source_dn
, val
) == 0) {
192 fake_msg
.num_elements
= dereference_attrs
[j
]->num_attributes
;
193 fake_msg
.elements
= dereference_attrs
[j
]->attributes
;
197 if (!fake_msg
.num_elements
) {
200 /* Look for an OpenLDAP entryUUID */
202 entryUUIDblob
= ldb_msg_find_ldb_val(&fake_msg
, "entryUUID");
205 struct ldb_val guid_blob
;
208 status
= GUID_from_data_blob(entryUUIDblob
, &guid
);
210 if (!NT_STATUS_IS_OK(status
)) {
211 return LDB_ERR_INVALID_DN_SYNTAX
;
213 status
= GUID_to_ndr_blob(&guid
, dn
, &guid_blob
);
214 if (!NT_STATUS_IS_OK(status
)) {
215 return LDB_ERR_INVALID_DN_SYNTAX
;
218 ldb_dn_set_extended_component(dn
, "GUID", &guid_blob
);
221 sid_blob
= ldb_msg_find_ldb_val(&fake_msg
, "objectSID");
223 /* Look for the objectSID */
225 ldb_dn_set_extended_component(dn
, "SID", sid_blob
);
230 static int handle_dereference_fds(struct ldb_dn
*dn
,
231 struct dsdb_openldap_dereference_result
**dereference_attrs
,
232 const char *attr
, const DATA_BLOB
*val
)
234 const struct ldb_val
*nsUniqueIdBlob
, *sidBlob
;
235 struct ldb_message fake_msg
; /* easier to use routines that expect an ldb_message */
238 fake_msg
.num_elements
= 0;
240 /* Look for this attribute in the returned control */
241 for (j
= 0; dereference_attrs
&& dereference_attrs
[j
]; j
++) {
242 struct ldb_val source_dn
= data_blob_string_const(dereference_attrs
[j
]->dereferenced_dn
);
243 if (ldb_attr_cmp(dereference_attrs
[j
]->source_attribute
, attr
) == 0
244 && data_blob_cmp(&source_dn
, val
) == 0) {
245 fake_msg
.num_elements
= dereference_attrs
[j
]->num_attributes
;
246 fake_msg
.elements
= dereference_attrs
[j
]->attributes
;
250 if (!fake_msg
.num_elements
) {
254 /* Look for the nsUniqueId */
256 nsUniqueIdBlob
= ldb_msg_find_ldb_val(&fake_msg
, "nsUniqueId");
257 if (nsUniqueIdBlob
) {
259 struct ldb_val guid_blob
;
262 status
= NS_GUID_from_string((char *)nsUniqueIdBlob
->data
, &guid
);
264 if (!NT_STATUS_IS_OK(status
)) {
265 return LDB_ERR_INVALID_DN_SYNTAX
;
267 status
= GUID_to_ndr_blob(&guid
, dn
, &guid_blob
);
268 if (!NT_STATUS_IS_OK(status
)) {
269 return LDB_ERR_INVALID_DN_SYNTAX
;
272 ldb_dn_set_extended_component(dn
, "GUID", &guid_blob
);
275 /* Look for the objectSID */
277 sidBlob
= ldb_msg_find_ldb_val(&fake_msg
, "sambaSID");
279 enum ndr_err_code ndr_err
;
281 struct ldb_val sid_blob
;
284 sid
= dom_sid_parse_length(NULL
, sidBlob
);
287 return LDB_ERR_INVALID_DN_SYNTAX
;
290 ndr_err
= ndr_push_struct_blob(&sid_blob
, NULL
, NULL
, sid
,
291 (ndr_push_flags_fn_t
)ndr_push_dom_sid
);
293 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err
)) {
294 return LDB_ERR_INVALID_DN_SYNTAX
;
297 ldb_dn_set_extended_component(dn
, "SID", &sid_blob
);
303 struct extended_search_context
{
304 struct ldb_module
*module
;
305 const struct dsdb_schema
*schema
;
306 struct ldb_request
*req
;
313 static int extended_callback(struct ldb_request
*req
, struct ldb_reply
*ares
,
314 int (*handle_dereference
)(struct ldb_dn
*dn
,
315 struct dsdb_openldap_dereference_result
**dereference_attrs
,
316 const char *attr
, const DATA_BLOB
*val
))
318 struct extended_search_context
*ac
;
319 struct ldb_control
*control
;
320 struct dsdb_openldap_dereference_result_control
*dereference_control
= NULL
;
323 struct ldb_message
*msg
= ares
->message
;
324 struct extended_dn_out_private
*p
;
325 struct ldb_context
*ldb
;
326 bool have_reveal_control
, checked_reveal_control
=false;
328 ac
= talloc_get_type(req
->context
, struct extended_search_context
);
329 p
= talloc_get_type(ldb_module_get_private(ac
->module
), struct extended_dn_out_private
);
330 ldb
= ldb_module_get_ctx(ac
->module
);
332 return ldb_module_done(ac
->req
, NULL
, NULL
,
333 LDB_ERR_OPERATIONS_ERROR
);
335 if (ares
->error
!= LDB_SUCCESS
) {
336 return ldb_module_done(ac
->req
, ares
->controls
,
337 ares
->response
, ares
->error
);
340 switch (ares
->type
) {
341 case LDB_REPLY_REFERRAL
:
342 return ldb_module_send_referral(ac
->req
, ares
->referral
);
345 return ldb_module_done(ac
->req
, ares
->controls
,
346 ares
->response
, LDB_SUCCESS
);
347 case LDB_REPLY_ENTRY
:
351 if (p
&& p
->normalise
) {
352 ret
= fix_dn(ares
->message
->dn
);
353 if (ret
!= LDB_SUCCESS
) {
354 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
359 /* for each record returned post-process to add any derived
360 attributes that have been asked for */
361 ret
= inject_extended_dn_out(ares
, ldb
,
362 ac
->extended_type
, ac
->remove_guid
,
364 if (ret
!= LDB_SUCCESS
) {
365 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
369 if ((p
&& p
->normalise
) || ac
->inject
) {
370 const struct ldb_val
*val
= ldb_msg_find_ldb_val(ares
->message
, "distinguishedName");
372 ldb_msg_remove_attr(ares
->message
, "distinguishedName");
374 ret
= ldb_msg_add_steal_string(ares
->message
, "distinguishedName",
375 ldb_dn_get_extended_linearized(ares
->message
, ares
->message
->dn
, ac
->extended_type
));
377 ret
= ldb_msg_add_linearized_dn(ares
->message
,
381 if (ret
!= LDB_SUCCESS
) {
383 return LDB_ERR_OPERATIONS_ERROR
;
388 if (p
&& p
->dereference
) {
389 control
= ldb_reply_get_control(ares
, DSDB_OPENLDAP_DEREFERENCE_CONTROL
);
391 if (control
&& control
->data
) {
392 dereference_control
= talloc_get_type(control
->data
, struct dsdb_openldap_dereference_result_control
);
396 /* Walk the returned elements (but only if we have a schema to
397 * interpret the list with) */
398 for (i
= 0; ac
->schema
&& i
< msg
->num_elements
; i
++) {
399 bool make_extended_dn
;
400 const struct dsdb_attribute
*attribute
;
401 attribute
= dsdb_attribute_by_lDAPDisplayName(ac
->schema
, msg
->elements
[i
].name
);
407 /* If we are also in 'normalise' mode, then
408 * fix the attribute names to be in the
410 msg
->elements
[i
].name
= talloc_strdup(msg
->elements
, attribute
->lDAPDisplayName
);
411 if (!msg
->elements
[i
].name
) {
413 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_ERR_OPERATIONS_ERROR
);
417 /* distinguishedName has been dealt with above */
418 if (ldb_attr_cmp(msg
->elements
[i
].name
, "distinguishedName") == 0) {
422 /* Look to see if this attributeSyntax is a DN */
423 if (dsdb_dn_oid_to_format(attribute
->syntax
->ldap_oid
) == DSDB_INVALID_DN
) {
427 make_extended_dn
= ac
->inject
;
429 /* Always show plain DN in case of Object(OR-Name) syntax */
430 if (make_extended_dn
) {
431 make_extended_dn
= (strcmp(attribute
->syntax
->ldap_oid
, DSDB_SYNTAX_OR_NAME
) != 0);
434 for (j
= 0; j
< msg
->elements
[i
].num_values
; j
++) {
437 struct dsdb_dn
*dsdb_dn
= NULL
;
438 struct ldb_val
*plain_dn
= &msg
->elements
[i
].values
[j
];
440 if (!checked_reveal_control
) {
441 have_reveal_control
=
442 ldb_request_get_control(req
, LDB_CONTROL_REVEAL_INTERNALS
) != NULL
;
443 checked_reveal_control
= true;
446 /* this is a fast method for detecting deleted
447 linked attributes, working on the unparsed
449 if (dsdb_dn_is_deleted_val(plain_dn
) && !have_reveal_control
) {
450 /* it's a deleted linked attribute,
451 and we don't have the reveal control */
452 memmove(&msg
->elements
[i
].values
[j
],
453 &msg
->elements
[i
].values
[j
+1],
454 (msg
->elements
[i
].num_values
-(j
+1))*sizeof(struct ldb_val
));
455 msg
->elements
[i
].num_values
--;
461 dsdb_dn
= dsdb_dn_parse(msg
, ldb
, plain_dn
, attribute
->syntax
->ldap_oid
);
463 if (!dsdb_dn
|| !ldb_dn_validate(dsdb_dn
->dn
)) {
464 ldb_asprintf_errstring(ldb
,
465 "could not parse %.*s in %s on %s as a %s DN",
466 (int)plain_dn
->length
, plain_dn
->data
,
467 msg
->elements
[i
].name
, ldb_dn_get_linearized(msg
->dn
),
468 attribute
->syntax
->ldap_oid
);
469 talloc_free(dsdb_dn
);
470 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_ERR_INVALID_DN_SYNTAX
);
474 /* don't let users see the internal extended
476 if (!have_reveal_control
) {
477 const char *accept
[] = { "GUID", "SID", "WKGUID", NULL
};
478 ldb_dn_extended_filter(dn
, accept
);
483 if (ret
!= LDB_SUCCESS
) {
484 talloc_free(dsdb_dn
);
485 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
489 /* If we are running in dereference mode (such
490 * as against OpenLDAP) then the DN in the msg
491 * above does not contain the extended values,
492 * and we need to look in the dereference
495 /* Look for this value in the attribute */
497 if (dereference_control
) {
498 ret
= handle_dereference(dn
,
499 dereference_control
->attributes
,
500 msg
->elements
[i
].name
,
501 &msg
->elements
[i
].values
[j
]);
502 if (ret
!= LDB_SUCCESS
) {
503 talloc_free(dsdb_dn
);
504 return ldb_module_done(ac
->req
, NULL
, NULL
, ret
);
508 if (make_extended_dn
) {
509 dn_str
= dsdb_dn_get_extended_linearized(msg
->elements
[i
].values
,
510 dsdb_dn
, ac
->extended_type
);
512 dn_str
= dsdb_dn_get_linearized(msg
->elements
[i
].values
,
518 talloc_free(dsdb_dn
);
519 return ldb_module_done(ac
->req
, NULL
, NULL
, LDB_ERR_OPERATIONS_ERROR
);
521 msg
->elements
[i
].values
[j
] = data_blob_string_const(dn_str
);
522 talloc_free(dsdb_dn
);
524 if (msg
->elements
[i
].num_values
== 0) {
525 /* we've deleted all of the values from this
526 * element - remove the element */
527 memmove(&msg
->elements
[i
],
529 (msg
->num_elements
-(i
+1))*sizeof(struct ldb_message_element
));
534 return ldb_module_send_entry(ac
->req
, msg
, ares
->controls
);
537 static int extended_callback_ldb(struct ldb_request
*req
, struct ldb_reply
*ares
)
539 return extended_callback(req
, ares
, NULL
);
542 static int extended_callback_openldap(struct ldb_request
*req
, struct ldb_reply
*ares
)
544 return extended_callback(req
, ares
, handle_dereference_openldap
);
547 static int extended_callback_fds(struct ldb_request
*req
, struct ldb_reply
*ares
)
549 return extended_callback(req
, ares
, handle_dereference_fds
);
552 static int extended_dn_out_search(struct ldb_module
*module
, struct ldb_request
*req
,
553 int (*callback
)(struct ldb_request
*req
, struct ldb_reply
*ares
))
555 struct ldb_control
*control
;
556 struct ldb_control
*storage_format_control
;
557 struct ldb_extended_dn_control
*extended_ctrl
= NULL
;
558 struct extended_search_context
*ac
;
559 struct ldb_request
*down_req
;
561 const char * const *const_attrs
;
562 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
565 struct extended_dn_out_private
*p
= talloc_get_type(ldb_module_get_private(module
), struct extended_dn_out_private
);
567 /* check if there's an extended dn control */
568 control
= ldb_request_get_control(req
, LDB_CONTROL_EXTENDED_DN_OID
);
569 if (control
&& control
->data
) {
570 extended_ctrl
= talloc_get_type(control
->data
, struct ldb_extended_dn_control
);
571 if (!extended_ctrl
) {
572 return LDB_ERR_PROTOCOL_ERROR
;
576 /* Look to see if, as we are in 'store DN+GUID+SID' mode, the
577 * client is after the storage format (to fill in linked
579 storage_format_control
= ldb_request_get_control(req
, DSDB_CONTROL_DN_STORAGE_FORMAT_OID
);
580 if (!control
&& storage_format_control
&& storage_format_control
->data
) {
581 extended_ctrl
= talloc_get_type(storage_format_control
->data
, struct ldb_extended_dn_control
);
582 if (!extended_ctrl
) {
583 ldb_set_errstring(ldb
, "extended_dn_out: extended_ctrl was of the wrong data type");
584 return LDB_ERR_PROTOCOL_ERROR
;
588 ac
= talloc_zero(req
, struct extended_search_context
);
591 return LDB_ERR_OPERATIONS_ERROR
;
595 ac
->schema
= dsdb_get_schema(ldb
);
598 ac
->remove_guid
= false;
599 ac
->remove_sid
= false;
601 const_attrs
= req
->op
.search
.attrs
;
603 /* We only need to do special processing if we were asked for
604 * the extended DN, or we are 'store DN+GUID+SID'
605 * (!dereference) mode. (This is the normal mode for LDB on
607 if (control
|| (storage_format_control
&& p
&& !p
->dereference
)) {
610 ac
->extended_type
= extended_ctrl
->type
;
612 ac
->extended_type
= 0;
615 /* check if attrs only is specified, in that case check wether we need to modify them */
616 if (req
->op
.search
.attrs
&& !is_attr_in_list(req
->op
.search
.attrs
, "*")) {
617 if (! is_attr_in_list(req
->op
.search
.attrs
, "objectGUID")) {
618 ac
->remove_guid
= true;
620 if (! is_attr_in_list(req
->op
.search
.attrs
, "objectSID")) {
621 ac
->remove_sid
= true;
623 if (ac
->remove_guid
|| ac
->remove_sid
) {
624 new_attrs
= copy_attrs(ac
, req
->op
.search
.attrs
);
625 if (new_attrs
== NULL
) {
627 return LDB_ERR_OPERATIONS_ERROR
;
630 if (ac
->remove_guid
) {
631 if (!add_attrs(ac
, &new_attrs
, "objectGUID"))
632 return LDB_ERR_OPERATIONS_ERROR
;
634 if (ac
->remove_sid
) {
635 if (!add_attrs(ac
, &new_attrs
, "objectSID"))
636 return LDB_ERR_OPERATIONS_ERROR
;
638 const_attrs
= (const char * const *)new_attrs
;
643 ret
= ldb_build_search_req_ex(&down_req
,
646 req
->op
.search
.scope
,
652 if (ret
!= LDB_SUCCESS
) {
656 /* mark extended DN and storage format controls as done */
658 control
->critical
= 0;
661 if (storage_format_control
) {
662 storage_format_control
->critical
= 0;
665 /* Add in dereference control, if we were asked to, we are
666 * using the 'dereference' mode (such as with an OpenLDAP
667 * backend) and have the control prepared */
668 if (control
&& p
&& p
->dereference
&& p
->dereference_control
) {
669 ret
= ldb_request_add_control(down_req
,
670 DSDB_OPENLDAP_DEREFERENCE_CONTROL
,
671 false, p
->dereference_control
);
672 if (ret
!= LDB_SUCCESS
) {
677 /* perform the search */
678 return ldb_next_request(module
, down_req
);
681 static int extended_dn_out_ldb_search(struct ldb_module
*module
, struct ldb_request
*req
)
683 return extended_dn_out_search(module
, req
, extended_callback_ldb
);
686 static int extended_dn_out_openldap_search(struct ldb_module
*module
, struct ldb_request
*req
)
688 return extended_dn_out_search(module
, req
, extended_callback_openldap
);
691 static int extended_dn_out_fds_search(struct ldb_module
*module
, struct ldb_request
*req
)
693 return extended_dn_out_search(module
, req
, extended_callback_fds
);
696 static int extended_dn_out_ldb_init(struct ldb_module
*module
)
700 struct extended_dn_out_private
*p
= talloc(module
, struct extended_dn_out_private
);
701 struct dsdb_extended_dn_store_format
*dn_format
;
703 ldb_module_set_private(module
, p
);
706 ldb_oom(ldb_module_get_ctx(module
));
707 return LDB_ERR_OPERATIONS_ERROR
;
710 dn_format
= talloc(p
, struct dsdb_extended_dn_store_format
);
713 ldb_oom(ldb_module_get_ctx(module
));
714 return LDB_ERR_OPERATIONS_ERROR
;
717 dn_format
->store_extended_dn_in_ldb
= true;
718 ret
= ldb_set_opaque(ldb_module_get_ctx(module
), DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME
, dn_format
);
719 if (ret
!= LDB_SUCCESS
) {
724 p
->dereference
= false;
725 p
->normalise
= false;
727 ret
= ldb_mod_register_control(module
, LDB_CONTROL_EXTENDED_DN_OID
);
728 if (ret
!= LDB_SUCCESS
) {
729 ldb_debug(ldb_module_get_ctx(module
), LDB_DEBUG_ERROR
,
730 "extended_dn_out: Unable to register control with rootdse!\n");
731 return LDB_ERR_OPERATIONS_ERROR
;
734 return ldb_next_init(module
);
737 static int extended_dn_out_dereference_init(struct ldb_module
*module
, const char *attrs
[])
741 struct extended_dn_out_private
*p
= talloc_zero(module
, struct extended_dn_out_private
);
742 struct dsdb_extended_dn_store_format
*dn_format
;
743 struct dsdb_openldap_dereference_control
*dereference_control
;
744 struct dsdb_attribute
*cur
;
745 struct ldb_context
*ldb
= ldb_module_get_ctx(module
);
746 struct dsdb_schema
*schema
;
748 ldb_module_set_private(module
, p
);
752 return LDB_ERR_OPERATIONS_ERROR
;
755 dn_format
= talloc(p
, struct dsdb_extended_dn_store_format
);
758 ldb_oom(ldb_module_get_ctx(module
));
759 return LDB_ERR_OPERATIONS_ERROR
;
762 dn_format
->store_extended_dn_in_ldb
= false;
764 ret
= ldb_set_opaque(ldb_module_get_ctx(module
), DSDB_EXTENDED_DN_STORE_FORMAT_OPAQUE_NAME
, dn_format
);
765 if (ret
!= LDB_SUCCESS
) {
770 p
->dereference
= true;
772 /* At the moment, servers that need dereference also need the
773 * DN and attribute names to be normalised */
776 ret
= ldb_mod_register_control(module
, LDB_CONTROL_EXTENDED_DN_OID
);
777 if (ret
!= LDB_SUCCESS
) {
778 ldb_debug(ldb
, LDB_DEBUG_ERROR
,
779 "extended_dn_out: Unable to register control with rootdse!\n");
780 return LDB_ERR_OPERATIONS_ERROR
;
783 ret
= ldb_next_init(module
);
785 if (ret
!= LDB_SUCCESS
) {
789 schema
= dsdb_get_schema(ldb
);
791 /* No schema on this DB (yet) */
795 p
->dereference_control
= dereference_control
796 = talloc_zero(p
, struct dsdb_openldap_dereference_control
);
798 if (!p
->dereference_control
) {
800 return LDB_ERR_OPERATIONS_ERROR
;
803 for (cur
= schema
->attributes
; cur
; cur
= cur
->next
) {
804 if (dsdb_dn_oid_to_format(cur
->syntax
->ldap_oid
) == DSDB_INVALID_DN
) {
807 dereference_control
->dereference
808 = talloc_realloc(p
, dereference_control
->dereference
,
809 struct dsdb_openldap_dereference
*, i
+ 2);
810 if (!dereference_control
) {
812 return LDB_ERR_OPERATIONS_ERROR
;
814 dereference_control
->dereference
[i
] = talloc(dereference_control
->dereference
,
815 struct dsdb_openldap_dereference
);
816 if (!dereference_control
->dereference
[i
]) {
818 return LDB_ERR_OPERATIONS_ERROR
;
820 dereference_control
->dereference
[i
]->source_attribute
= cur
->lDAPDisplayName
;
821 dereference_control
->dereference
[i
]->dereference_attribute
= attrs
;
823 dereference_control
->dereference
[i
] = NULL
;
828 static int extended_dn_out_openldap_init(struct ldb_module
*module
)
830 static const char *attrs
[] = {
836 return extended_dn_out_dereference_init(module
, attrs
);
839 static int extended_dn_out_fds_init(struct ldb_module
*module
)
841 static const char *attrs
[] = {
847 return extended_dn_out_dereference_init(module
, attrs
);
850 _PUBLIC_
const struct ldb_module_ops ldb_extended_dn_out_ldb_module_ops
= {
851 .name
= "extended_dn_out_ldb",
852 .search
= extended_dn_out_ldb_search
,
853 .init_context
= extended_dn_out_ldb_init
,
856 _PUBLIC_
const struct ldb_module_ops ldb_extended_dn_out_openldap_module_ops
= {
857 .name
= "extended_dn_out_openldap",
858 .search
= extended_dn_out_openldap_search
,
859 .init_context
= extended_dn_out_openldap_init
,
862 _PUBLIC_
const struct ldb_module_ops ldb_extended_dn_out_fds_module_ops
= {
863 .name
= "extended_dn_out_fds",
864 .search
= extended_dn_out_fds_search
,
865 .init_context
= extended_dn_out_fds_init
,