2 Unix SMB/CIFS implementation.
4 implement the DsAddEntry call
6 Copyright (C) Stefan Metzmacher 2009
7 Copyright (C) Andrew Tridgell 2009
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "rpc_server/dcerpc_server.h"
25 #include "dsdb/samdb/samdb.h"
26 #include "dsdb/common/util.h"
27 #include "param/param.h"
28 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
29 #include "librpc/gen_ndr/ndr_drsuapi.h"
30 #include "libcli/security/security.h"
33 add special SPNs needed for DRS replication to machine accounts when
34 an AddEntry is done to create a nTDSDSA object
36 static WERROR
drsuapi_add_SPNs(struct drsuapi_bind_state
*b_state
,
37 struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
38 const struct drsuapi_DsReplicaObjectListItem
*first_object
)
41 const struct drsuapi_DsReplicaObjectListItem
*obj
;
42 const char *attrs
[] = { "serverReference", "objectGUID", NULL
};
44 for (obj
= first_object
; obj
; obj
=obj
->next_object
) {
45 const char *dn_string
= obj
->object
.identifier
->dn
;
46 struct ldb_dn
*dn
= ldb_dn_new(mem_ctx
, b_state
->sam_ctx
, dn_string
);
47 struct ldb_result
*res
, *res2
;
48 struct ldb_dn
*ref_dn
;
49 struct GUID ntds_guid
;
50 struct ldb_message
*msg
;
51 struct ldb_message_element
*el
;
52 const char *ntds_guid_str
;
53 const char *dom_string
;
54 const char *attrs2
[] = { "dNSHostName", "cn", NULL
};
55 const char *dNSHostName
, *cn
;
57 DEBUG(6,(__location__
": Adding SPNs for %s\n",
58 ldb_dn_get_linearized(dn
)));
60 ret
= ldb_search(b_state
->sam_ctx
, mem_ctx
, &res
,
61 dn
, LDB_SCOPE_BASE
, attrs
,
62 "(objectClass=ntDSDSA)");
63 if (ret
!= LDB_SUCCESS
|| res
->count
< 1) {
64 DEBUG(0,(__location__
": Failed to find dn '%s'\n", dn_string
));
65 return WERR_DS_DRA_INTERNAL_ERROR
;
68 ref_dn
= samdb_result_dn(b_state
->sam_ctx
, mem_ctx
, res
->msgs
[0], "serverReference", NULL
);
70 /* we only add SPNs for objects with a
75 DEBUG(6,(__location__
": serverReference %s\n",
76 ldb_dn_get_linearized(ref_dn
)));
78 ntds_guid
= samdb_result_guid(res
->msgs
[0], "objectGUID");
80 ntds_guid_str
= GUID_string(res
, &ntds_guid
);
82 dom_string
= lpcfg_dnsdomain(dce_call
->conn
->dce_ctx
->lp_ctx
);
84 /* get the dNSHostName and cn */
85 ret
= ldb_search(b_state
->sam_ctx
, mem_ctx
, &res2
,
86 ref_dn
, LDB_SCOPE_BASE
, attrs2
, NULL
);
87 if (ret
!= LDB_SUCCESS
) {
88 DEBUG(0,(__location__
": Failed to find ref_dn '%s'\n",
89 ldb_dn_get_linearized(ref_dn
)));
90 return WERR_DS_DRA_INTERNAL_ERROR
;
93 dNSHostName
= ldb_msg_find_attr_as_string(res2
->msgs
[0], "dNSHostName", NULL
);
94 cn
= ldb_msg_find_attr_as_string(res2
->msgs
[0], "cn", NULL
);
97 * construct a modify request to add the new SPNs to
100 msg
= ldb_msg_new(mem_ctx
);
106 ret
= ldb_msg_add_empty(msg
, "servicePrincipalName",
107 LDB_FLAG_MOD_ADD
, &el
);
108 if (ret
!= LDB_SUCCESS
) {
113 ldb_msg_add_steal_string(msg
, "servicePrincipalName",
114 talloc_asprintf(el
->values
,
115 "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
116 ntds_guid_str
, dom_string
));
117 ldb_msg_add_steal_string(msg
, "servicePrincipalName",
118 talloc_asprintf(el
->values
, "ldap/%s._msdcs.%s",
119 ntds_guid_str
, dom_string
));
121 ldb_msg_add_steal_string(msg
, "servicePrincipalName",
122 talloc_asprintf(el
->values
, "ldap/%s", cn
));
125 ldb_msg_add_steal_string(msg
, "servicePrincipalName",
126 talloc_asprintf(el
->values
, "ldap/%s", dNSHostName
));
128 if (el
->num_values
< 2) {
132 ret
= dsdb_modify(b_state
->sam_ctx
, msg
, DSDB_MODIFY_PERMISSIVE
);
133 if (ret
!= LDB_SUCCESS
) {
134 DEBUG(0,(__location__
": Failed to add SPNs - %s\n",
135 ldb_errstring(b_state
->sam_ctx
)));
136 return WERR_DS_DRA_INTERNAL_ERROR
;
149 WERROR
dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state
*dce_call
, TALLOC_CTX
*mem_ctx
,
150 struct drsuapi_DsAddEntry
*r
)
153 struct drsuapi_bind_state
*b_state
;
154 struct dcesrv_handle
*h
;
156 struct drsuapi_DsReplicaObjectIdentifier2
*ids
= NULL
;
158 const struct drsuapi_DsReplicaObjectListItem
*first_object
;
161 NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry
, NDR_IN
, r
);
164 /* TODO: check which out level the client supports */
166 ZERO_STRUCTP(r
->out
.ctr
);
167 *r
->out
.level_out
= 3;
168 r
->out
.ctr
->ctr3
.err_ver
= 1;
169 r
->out
.ctr
->ctr3
.err_data
= talloc_zero(mem_ctx
, union drsuapi_DsAddEntry_ErrData
);
171 DCESRV_PULL_HANDLE_WERR(h
, r
->in
.bind_handle
, DRSUAPI_BIND_HANDLE
);
174 status
= drs_security_level_check(dce_call
, "DsAddEntry", SECURITY_DOMAIN_CONTROLLER
);
175 if (!W_ERROR_IS_OK(status
)) {
179 switch (r
->in
.level
) {
181 ret
= ldb_transaction_start(b_state
->sam_ctx
);
182 if (ret
!= LDB_SUCCESS
) {
183 return WERR_DS_DRA_INTERNAL_ERROR
;
187 first_object
= &r
->in
.req
->req2
.first_object
;
189 status
= dsdb_origin_objects_commit(b_state
->sam_ctx
,
194 if (!W_ERROR_IS_OK(status
)) {
195 r
->out
.ctr
->ctr3
.err_data
->v1
.status
= status
;
196 ldb_transaction_cancel(b_state
->sam_ctx
);
197 DEBUG(0,(__location__
": DsAddEntry failed - %s\n", win_errstr(status
)));
201 r
->out
.ctr
->ctr3
.count
= num
;
202 r
->out
.ctr
->ctr3
.objects
= ids
;
209 /* if any of the added entries are nTDSDSA objects then we
210 * need to add the SPNs to the machine account
212 status
= drsuapi_add_SPNs(b_state
, dce_call
, mem_ctx
, first_object
);
213 if (!W_ERROR_IS_OK(status
)) {
214 r
->out
.ctr
->ctr3
.err_data
->v1
.status
= status
;
215 ldb_transaction_cancel(b_state
->sam_ctx
);
216 DEBUG(0,(__location__
": DsAddEntry add SPNs failed - %s\n", win_errstr(status
)));
220 ret
= ldb_transaction_commit(b_state
->sam_ctx
);
221 if (ret
!= LDB_SUCCESS
) {
222 DEBUG(0,(__location__
": DsAddEntry commit failed: %s\n",
223 ldb_errstring(b_state
->sam_ctx
)));
224 return WERR_DS_DRA_INTERNAL_ERROR
;