?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4/schema: Move msDS-IntId implementation to samldb.c module
[Samba/gebeck_regimport.git] / source4 / dsdb / samdb / ldb_modules / samldb.c
blob6420e05ba89fd81dd4c0456a936d3eeab45c5971
1 /*
2 SAM ldb module
3
4 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
5 Copyright (C) Simo Sorce 2004-2008
6 Copyright (C) Matthias Dieter Wallnöfer 2009
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 */
21
22 /*
23 * Name: ldb
24 *
25 * Component: ldb samldb module
26 *
27 * Description: add embedded user/group creation functionality
28 *
29 * Author: Simo Sorce
30 */
31
32 #include "includes.h"
33 #include "libcli/ldap/ldap_ndr.h"
34 #include "ldb_module.h"
35 #include "dsdb/samdb/samdb.h"
36 #include "dsdb/samdb/ldb_modules/util.h"
37 #include "libcli/security/security.h"
38 #include "librpc/gen_ndr/ndr_security.h"
39 #include "../lib/util/util_ldb.h"
40 #include "ldb_wrap.h"
41 #include "param/param.h"
42
43 struct samldb_ctx;
44
45 typedef int (*samldb_step_fn_t)(struct samldb_ctx *);
46
47 struct samldb_step {
48 struct samldb_step *next;
49 samldb_step_fn_t fn;
50 };
51
52 struct samldb_ctx {
53 struct ldb_module *module;
54 struct ldb_request *req;
55
56 /* used for add operations */
57 const char *type;
58
59 /* the resulting message */
60 struct ldb_message *msg;
61
62 /* holds the entry SID */
63 struct dom_sid *sid;
64
65 /* holds a generic dn */
66 struct ldb_dn *dn;
67
68 /* used in conjunction with "sid" in "samldb_dn_from_sid" */
69 struct ldb_dn *res_dn;
70
71 /* used in conjunction with "dn" in "samldb_sid_from_dn" */
72 struct dom_sid *res_sid;
73
74 /* used in "samldb_user_dn_to_prim_group_rid" */
75 uint32_t prim_group_rid;
76
77 /* used in conjunction with "prim_group_rid" in
78 * "samldb_prim_group_rid_to_users_cnt" */
79 unsigned int users_cnt;
80
81 /* used in "samldb_group_add_member" and "samldb_group_del_member" */
82 struct ldb_dn *group_dn;
83 struct ldb_dn *member_dn;
84
85 /* used in "samldb_primary_group_change" */
86 struct ldb_dn *user_dn;
87 struct ldb_dn *old_prim_group_dn, *new_prim_group_dn;
88
89 /* generic counter - used in "samldb_member_check" */
90 unsigned int cnt;
91
92 /* all the async steps necessary to complete the operation */
93 struct samldb_step *steps;
94 struct samldb_step *curstep;
95
96 /* If someone set an ares to forward controls and response back to the caller */
97 struct ldb_reply *ares;
98 };
99
100 static struct samldb_ctx *samldb_ctx_init(struct ldb_module *module,
101 struct ldb_request *req)
102 {
103 struct ldb_context *ldb;
104 struct samldb_ctx *ac;
105
106 ldb = ldb_module_get_ctx(module);
107
108 ac = talloc_zero(req, struct samldb_ctx);
109 if (ac == NULL) {
110 ldb_oom(ldb);
111 return NULL;
112 }
113
114 ac->module = module;
115 ac->req = req;
116
117 return ac;
118 }
119
120 static int samldb_add_step(struct samldb_ctx *ac, samldb_step_fn_t fn)
121 {
122 struct samldb_step *step, *stepper;
123
124 step = talloc_zero(ac, struct samldb_step);
125 if (step == NULL) {
126 return LDB_ERR_OPERATIONS_ERROR;
127 }
128
129 step->fn = fn;
130
131 if (ac->steps == NULL) {
132 ac->steps = step;
133 ac->curstep = step;
134 } else {
135 if (ac->curstep == NULL)
136 return LDB_ERR_OPERATIONS_ERROR;
137 for (stepper = ac->curstep; stepper->next != NULL;
138 stepper = stepper->next);
139 stepper->next = step;
140 }
141
142 return LDB_SUCCESS;
143 }
144
145 static int samldb_first_step(struct samldb_ctx *ac)
146 {
147 if (ac->steps == NULL) {
148 return LDB_ERR_OPERATIONS_ERROR;
149 }
150
151 ac->curstep = ac->steps;
152 return ac->curstep->fn(ac);
153 }
154
155 static int samldb_next_step(struct samldb_ctx *ac)
156 {
157 if (ac->curstep->next) {
158 ac->curstep = ac->curstep->next;
159 return ac->curstep->fn(ac);
160 }
161
162 /* we exit the samldb module here */
163 /* If someone set an ares to forward controls and response back to the caller, use them */
164 if (ac->ares) {
165 return ldb_module_done(ac->req, ac->ares->controls,
166 ac->ares->response, LDB_SUCCESS);
167 } else {
168 return ldb_module_done(ac->req, NULL, NULL, LDB_SUCCESS);
169 }
170 }
171
172 static int samldb_generate_samAccountName(struct ldb_message *msg)
173 {
174 char *name;
175
176 /* Format: $000000-000000000000 */
177
178 name = talloc_asprintf(msg, "$%.6X-%.6X%.6X",
179 (unsigned int)generate_random(),
180 (unsigned int)generate_random(),
181 (unsigned int)generate_random());
182 if (name == NULL) {
183 return LDB_ERR_OPERATIONS_ERROR;
184 }
185 return ldb_msg_add_steal_string(msg, "samAccountName", name);
186 }
187
188 /*
189 * samldb_check_samAccountName (async)
190 */
191
192 static int samldb_check_samAccountName_callback(struct ldb_request *req,
193 struct ldb_reply *ares)
194 {
195 struct samldb_ctx *ac;
196 int ret;
197
198 ac = talloc_get_type(req->context, struct samldb_ctx);
199
200 if (ares->error != LDB_SUCCESS) {
201 return ldb_module_done(ac->req, ares->controls,
202 ares->response, ares->error);
203 }
204
205 switch (ares->type) {
206 case LDB_REPLY_ENTRY:
207 /* if we get an entry it means this samAccountName
208 * already exists */
209 return ldb_module_done(ac->req, NULL, NULL,
210 LDB_ERR_ENTRY_ALREADY_EXISTS);
211
212 case LDB_REPLY_REFERRAL:
213 /* this should not happen */
214 return ldb_module_done(ac->req, NULL, NULL,
215 LDB_ERR_OPERATIONS_ERROR);
216
217 case LDB_REPLY_DONE:
218 /* not found, go on */
219 talloc_free(ares);
220 ret = samldb_next_step(ac);
221 break;
222 }
223
224 if (ret != LDB_SUCCESS) {
225 return ldb_module_done(ac->req, NULL, NULL, ret);
226 }
227
228 return LDB_SUCCESS;
229 }
230
231 static int samldb_check_samAccountName(struct samldb_ctx *ac)
232 {
233 struct ldb_context *ldb;
234 struct ldb_request *req;
235 const char *name;
236 char *filter;
237 int ret;
238
239 ldb = ldb_module_get_ctx(ac->module);
240
241 if (ldb_msg_find_element(ac->msg, "samAccountName") == NULL) {
242 ret = samldb_generate_samAccountName(ac->msg);
243 if (ret != LDB_SUCCESS) {
244 return ret;
245 }
246 }
247
248 name = ldb_msg_find_attr_as_string(ac->msg, "samAccountName", NULL);
249 if (name == NULL) {
250 return LDB_ERR_OPERATIONS_ERROR;
251 }
252 filter = talloc_asprintf(ac, "samAccountName=%s",
253 ldb_binary_encode_string(ac, name));
254 if (filter == NULL) {
255 return LDB_ERR_OPERATIONS_ERROR;
256 }
257
258 ret = ldb_build_search_req(&req, ldb, ac,
259 samdb_base_dn(ldb), LDB_SCOPE_SUBTREE,
260 filter, NULL,
261 NULL,
262 ac, samldb_check_samAccountName_callback,
263 ac->req);
264 talloc_free(filter);
265 if (ret != LDB_SUCCESS) {
266 return ret;
267 }
268 return ldb_next_request(ac->module, req);
269 }
270
271
272 static int samldb_check_samAccountType(struct samldb_ctx *ac)
273 {
274 struct ldb_context *ldb;
275 unsigned int account_type;
276 unsigned int group_type;
277 unsigned int uac;
278 int ret;
279
280 ldb = ldb_module_get_ctx(ac->module);
281
282 /* make sure sAMAccountType is not specified */
283 if (ldb_msg_find_element(ac->msg, "sAMAccountType") != NULL) {
284 ldb_asprintf_errstring(ldb,
285 "sAMAccountType must not be specified!");
286 return LDB_ERR_UNWILLING_TO_PERFORM;
287 }
288
289 if (strcmp("user", ac->type) == 0) {
290 uac = samdb_result_uint(ac->msg, "userAccountControl", 0);
291 if (uac == 0) {
292 ldb_asprintf_errstring(ldb,
293 "userAccountControl invalid!");
294 return LDB_ERR_UNWILLING_TO_PERFORM;
295 } else {
296 account_type = ds_uf2atype(uac);
297 ret = samdb_msg_add_uint(ldb,
298 ac->msg, ac->msg,
299 "sAMAccountType",
300 account_type);
301 if (ret != LDB_SUCCESS) {
302 return ret;
303 }
304 }
305 } else
306 if (strcmp("group", ac->type) == 0) {
307
308 group_type = samdb_result_uint(ac->msg, "groupType", 0);
309 if (group_type == 0) {
310 ldb_asprintf_errstring(ldb,
311 "groupType invalid!\n");
312 return LDB_ERR_UNWILLING_TO_PERFORM;
313 } else {
314 account_type = ds_gtype2atype(group_type);
315 ret = samdb_msg_add_uint(ldb,
316 ac->msg, ac->msg,
317 "sAMAccountType",
318 account_type);
319 if (ret != LDB_SUCCESS) {
320 return ret;
321 }
322 }
323 }
324
325 return samldb_next_step(ac);
326 }
327
328 static bool samldb_msg_add_sid(struct ldb_message *msg,
329 const char *name,
330 const struct dom_sid *sid)
331 {
332 struct ldb_val v;
333 enum ndr_err_code ndr_err;
334
335 ndr_err = ndr_push_struct_blob(&v, msg, NULL, sid,
336 (ndr_push_flags_fn_t)ndr_push_dom_sid);
337 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
338 return false;
339 }
340 return (ldb_msg_add_value(msg, name, &v, NULL) == 0);
341 }
342
343
344 /* allocate a SID using our RID Set */
345 static int samldb_allocate_sid(struct samldb_ctx *ac)
346 {
347 uint32_t rid;
348 int ret;
349 struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
350
351 ret = ridalloc_allocate_rid(ac->module, &rid);
352 if (ret != LDB_SUCCESS) {
353 return ret;
354 }
355
356 ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
357 if (ac->sid == NULL) {
358 ldb_module_oom(ac->module);
359 return LDB_ERR_OPERATIONS_ERROR;
360 }
361
362 if ( ! samldb_msg_add_sid(ac->msg, "objectSid", ac->sid)) {
363 return LDB_ERR_OPERATIONS_ERROR;
364 }
365
366 return samldb_next_step(ac);
367 }
368
369 /*
370 * samldb_dn_from_sid (async)
371 */
372
373 static int samldb_dn_from_sid(struct samldb_ctx *ac);
374
375 static int samldb_dn_from_sid_callback(struct ldb_request *req,
376 struct ldb_reply *ares)
377 {
378 struct ldb_context *ldb;
379 struct samldb_ctx *ac;
380 int ret;
381
382 ac = talloc_get_type(req->context, struct samldb_ctx);
383 ldb = ldb_module_get_ctx(ac->module);
384
385 if (!ares) {
386 ret = LDB_ERR_OPERATIONS_ERROR;
387 goto done;
388 }
389 if (ares->error != LDB_SUCCESS) {
390 return ldb_module_done(ac->req, ares->controls,
391 ares->response, ares->error);
392 }
393
394 switch (ares->type) {
395 case LDB_REPLY_ENTRY:
396 /* save entry */
397 if (ac->res_dn != NULL) {
398 /* one too many! */
399 ldb_set_errstring(ldb,
400 "Invalid number of results while searching "
401 "for domain objects!");
402 ret = LDB_ERR_OPERATIONS_ERROR;
403 break;
404 }
405 ac->res_dn = ldb_dn_copy(ac, ares->message->dn);
406
407 talloc_free(ares);
408 ret = LDB_SUCCESS;
409 break;
410
411 case LDB_REPLY_REFERRAL:
412 /* ignore */
413 talloc_free(ares);
414 ret = LDB_SUCCESS;
415 break;
416
417 case LDB_REPLY_DONE:
418 talloc_free(ares);
419
420 /* found or not found, go on */
421 ret = samldb_next_step(ac);
422 break;
423 }
424
425 done:
426 if (ret != LDB_SUCCESS) {
427 return ldb_module_done(ac->req, NULL, NULL, ret);
428 }
429
430 return LDB_SUCCESS;
431 }
432
433 /* Finds the DN "res_dn" of an object with a given SID "sid" */
434 static int samldb_dn_from_sid(struct samldb_ctx *ac)
435 {
436 struct ldb_context *ldb;
437 static const char * const attrs[] = { NULL };
438 struct ldb_request *req;
439 char *filter;
440 int ret;
441
442 ldb = ldb_module_get_ctx(ac->module);
443
444 if (ac->sid == NULL)
445 return LDB_ERR_OPERATIONS_ERROR;
446
447 filter = talloc_asprintf(ac, "(objectSid=%s)",
448 ldap_encode_ndr_dom_sid(ac, ac->sid));
449 if (filter == NULL)
450 return LDB_ERR_OPERATIONS_ERROR;
451
452 ret = ldb_build_search_req(&req, ldb, ac,
453 ldb_get_default_basedn(ldb),
454 LDB_SCOPE_SUBTREE,
455 filter, attrs,
456 NULL,
457 ac, samldb_dn_from_sid_callback,
458 ac->req);
459 if (ret != LDB_SUCCESS)
460 return ret;
461
462 return ldb_next_request(ac->module, req);
463 }
464
465
466 static int samldb_check_primaryGroupID_1(struct samldb_ctx *ac)
467 {
468 struct ldb_context *ldb;
469 uint32_t rid;
470
471 ldb = ldb_module_get_ctx(ac->module);
472
473 rid = samdb_result_uint(ac->msg, "primaryGroupID", ~0);
474 ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
475 if (ac->sid == NULL)
476 return LDB_ERR_OPERATIONS_ERROR;
477 ac->res_dn = NULL;
478
479 return samldb_next_step(ac);
480 }
481
482 static int samldb_check_primaryGroupID_2(struct samldb_ctx *ac)
483 {
484 if (ac->res_dn == NULL) {
485 struct ldb_context *ldb;
486 ldb = ldb_module_get_ctx(ac->module);
487 ldb_asprintf_errstring(ldb,
488 "Failed to find group sid %s!",
489 dom_sid_string(ac->sid, ac->sid));
490 return LDB_ERR_UNWILLING_TO_PERFORM;
491 }
492
493 return samldb_next_step(ac);
494 }
495
496
497 /*
498 * samldb_set_defaultObjectCategory_callback (async)
499 */
500
501 static int samldb_set_defaultObjectCategory_callback(struct ldb_request *req,
502 struct ldb_reply *ares)
503 {
504 struct ldb_context *ldb;
505 struct samldb_ctx *ac;
506 int ret;
507
508 ac = talloc_get_type(req->context, struct samldb_ctx);
509 ldb = ldb_module_get_ctx(ac->module);
510
511 if (!ares) {
512 ret = LDB_ERR_OPERATIONS_ERROR;
513 goto done;
514 }
515 if (ares->error != LDB_SUCCESS) {
516 return ldb_module_done(ac->req, ares->controls,
517 ares->response, ares->error);
518 }
519 if (ares->type != LDB_REPLY_DONE) {
520 ldb_set_errstring(ldb,
521 "Invalid reply type!");
522 ret = LDB_ERR_OPERATIONS_ERROR;
523 goto done;
524 }
525
526 ret = samldb_next_step(ac);
527
528 done:
529 if (ret != LDB_SUCCESS) {
530 return ldb_module_done(ac->req, NULL, NULL, ret);
531 }
532
533 return LDB_SUCCESS;
534 }
535
536 static int samldb_set_defaultObjectCategory(struct samldb_ctx *ac)
537 {
538 struct ldb_context *ldb;
539 struct ldb_message *msg;
540 struct ldb_request *req;
541 int ret;
542
543 ldb = ldb_module_get_ctx(ac->module);
544
545 /* (Re)set the default object category to have it set to the DN in the
546 * storage format */
547 msg = ldb_msg_new(ac);
548 msg->dn = ac->msg->dn;
549 ldb_msg_add_empty(msg, "defaultObjectCategory",
550 LDB_FLAG_MOD_REPLACE, NULL);
551 ldb_msg_add_steal_string(msg, "defaultObjectCategory",
552 ldb_dn_alloc_linearized(msg, ac->dn));
553
554 ret = ldb_build_mod_req(&req, ldb, ac,
555 msg, NULL,
556 ac,
557 samldb_set_defaultObjectCategory_callback,
558 ac->req);
559 if (ret != LDB_SUCCESS) {
560 talloc_free(msg);
561 return ret;
562 }
563
564 return ldb_next_request(ac->module, req);
565 }
566
567 /*
568 * samldb_find_for_defaultObjectCategory (async)
569 */
570
571 static int samldb_find_for_defaultObjectCategory_callback(struct ldb_request *req,
572 struct ldb_reply *ares)
573 {
574 struct ldb_context *ldb;
575 struct samldb_ctx *ac;
576 int ret;
577
578 ac = talloc_get_type(req->context, struct samldb_ctx);
579 ldb = ldb_module_get_ctx(ac->module);
580
581 if (!ares) {
582 ret = LDB_ERR_OPERATIONS_ERROR;
583 goto done;
584 }
585 if (ares->error != LDB_SUCCESS) {
586 if (ares->error == LDB_ERR_NO_SUCH_OBJECT) {
587 if (ldb_request_get_control(ac->req,
588 LDB_CONTROL_RELAX_OID) != NULL) {
589 /* Don't be pricky when the DN doesn't exist */
590 /* if we have the RELAX control specified */
591 ac->dn = req->op.search.base;
592 return samldb_next_step(ac);
593 } else {
594 ldb_set_errstring(ldb,
595 "samldb_find_defaultObjectCategory: "
596 "Invalid DN for 'defaultObjectCategory'!");
597 ares->error = LDB_ERR_CONSTRAINT_VIOLATION;
598 }
599 }
600
601 return ldb_module_done(ac->req, ares->controls,
602 ares->response, ares->error);
603 }
604
605 switch (ares->type) {
606 case LDB_REPLY_ENTRY:
607 ac->dn = talloc_steal(ac, ares->message->dn);
608
609 ret = LDB_SUCCESS;
610 break;
611
612 case LDB_REPLY_REFERRAL:
613 /* this should not happen */
614 talloc_free(ares);
615 ret = LDB_ERR_OPERATIONS_ERROR;
616 break;
617
618 case LDB_REPLY_DONE:
619 talloc_free(ares);
620
621 if (ac->dn != NULL) {
622 /* when found go on */
623 ret = samldb_next_step(ac);
624 } else {
625 ret = LDB_ERR_OPERATIONS_ERROR;
626 }
627 break;
628 }
629
630 done:
631 if (ret != LDB_SUCCESS) {
632 return ldb_module_done(ac->req, NULL, NULL, ret);
633 }
634
635 return LDB_SUCCESS;
636 }
637
638 static int samldb_find_for_defaultObjectCategory(struct samldb_ctx *ac)
639 {
640 struct ldb_context *ldb;
641 struct ldb_request *req;
642 static const char *no_attrs[] = { NULL };
643 int ret;
644 const struct ldb_val *val;
645 struct ldb_dn *def_obj_cat_dn;
646
647 ldb = ldb_module_get_ctx(ac->module);
648
649 ac->dn = NULL;
650
651 val = ldb_msg_find_ldb_val(ac->msg, "defaultObjectCategory");
652 if (val != NULL) {
653 /* "defaultObjectCategory" has been set by the caller. Do some
654 * checks for consistency.
655 * NOTE: The real constraint check (that 'defaultObjectCategory'
656 * is the DN of the new objectclass or any parent of it) is
657 * still incomplete.
658 * For now we say that 'defaultObjectCategory' is valid if it
659 * exists and it is of objectclass "classSchema". */
660 def_obj_cat_dn = ldb_dn_from_ldb_val(ac, ldb, val);
661 if (def_obj_cat_dn == NULL) {
662 ldb_set_errstring(ldb,
663 "samldb_find_defaultObjectCategory: Invalid DN "
664 "for 'defaultObjectCategory'!");
665 return LDB_ERR_CONSTRAINT_VIOLATION;
666 }
667 } else {
668 /* "defaultObjectCategory" has not been set by the caller. Use
669 * the entry DN for it. */
670 def_obj_cat_dn = ac->msg->dn;
671 }
672
673 ret = ldb_build_search_req(&req, ldb, ac,
674 def_obj_cat_dn, LDB_SCOPE_BASE,
675 "objectClass=classSchema", no_attrs,
676 NULL,
677 ac, samldb_find_for_defaultObjectCategory_callback,
678 ac->req);
679 if (ret != LDB_SUCCESS) {
680 return ret;
681 }
682
683 ret = dsdb_request_add_controls(req,
684 DSDB_SEARCH_SHOW_DN_IN_STORAGE_FORMAT);
685 if (ret != LDB_SUCCESS) {
686 return ret;
687 }
688
689 return ldb_next_request(ac->module, req);
690 }
691
692 /**
693 * msDS-IntId attributeSchema attribute handling
694 * during LDB_ADD request processing
695 */
696 static int samldb_add_handle_msDS_IntId(struct samldb_ctx *ac)
697 {
698 int ret;
699 bool id_exists;
700 uint32_t msds_intid;
701 uint32_t system_flags;
702 struct ldb_context *ldb;
703 struct ldb_result *ldb_res;
704 struct ldb_dn *schema_dn;
705
706 ldb = ldb_module_get_ctx(ac->module);
707 schema_dn = ldb_get_schema_basedn(ldb);
708
709 /* replicated update should always go through */
710 if (ldb_request_get_control(ac->req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
711 return LDB_SUCCESS;
712 }
713
714 /* msDS-IntId is handled by system and should never be
715 * passed by clients */
716 if (ldb_msg_find_element(ac->msg, "msDS-IntId")) {
717 return LDB_ERR_UNWILLING_TO_PERFORM;
718 }
719
720 /* do not generate msDS-IntId if Relax control is passed */
721 if (ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) {
722 return LDB_SUCCESS;
723 }
724
725 /* check Functional Level */
726 if (dsdb_functional_level(ldb) < DS_DOMAIN_FUNCTION_2003) {
727 return LDB_SUCCESS;
728 }
729
730 /* check systemFlags for SCHEMA_BASE_OBJECT flag */
731 system_flags = ldb_msg_find_attr_as_uint(ac->msg, "systemFlags", 0);
732 if (system_flags & SYSTEM_FLAG_SCHEMA_BASE_OBJECT) {
733 return LDB_SUCCESS;
734 }
735
736 /* Generate new value for msDs-IntId
737 * Value should be in 0x80000000..0xBFFFFFFF range */
738 msds_intid = generate_random() % 0X3FFFFFFF;
739 msds_intid += 0x80000000;
740
741 /* probe id values until unique one is found */
742 do {
743 msds_intid++;
744 if (msds_intid > 0xBFFFFFFF) {
745 msds_intid = 0x80000001;
746 }
747
748 ret = dsdb_module_search(ac->module, ac,
749 &ldb_res,
750 schema_dn, LDB_SCOPE_ONELEVEL, NULL, 0,
751 "(msDS-IntId=%d)", msds_intid);
752 if (ret != LDB_SUCCESS) {
753 ldb_debug_set(ldb, LDB_DEBUG_ERROR,
754 __location__": Searching for msDS-IntId=%d failed - %s\n",
755 msds_intid,
756 ldb_errstring(ldb));
757 return LDB_ERR_OPERATIONS_ERROR;
758 }
759 id_exists = (ldb_res->count > 0);
760
761 talloc_free(ldb_res);
762 } while(id_exists);
763
764 return ldb_msg_add_fmt(ac->msg, "msDS-IntId", "%d", msds_intid);
765 }
766
767
768 /*
769 * samldb_add_entry (async)
770 */
771
772 static int samldb_add_entry_callback(struct ldb_request *req,
773 struct ldb_reply *ares)
774 {
775 struct ldb_context *ldb;
776 struct samldb_ctx *ac;
777 int ret;
778
779 ac = talloc_get_type(req->context, struct samldb_ctx);
780 ldb = ldb_module_get_ctx(ac->module);
781
782 if (!ares) {
783 return ldb_module_done(ac->req, NULL, NULL,
784 LDB_ERR_OPERATIONS_ERROR);
785 }
786 if (ares->error != LDB_SUCCESS) {
787 return ldb_module_done(ac->req, ares->controls,
788 ares->response, ares->error);
789 }
790 if (ares->type != LDB_REPLY_DONE) {
791 ldb_set_errstring(ldb,
792 "Invalid reply type!\n");
793 return ldb_module_done(ac->req, NULL, NULL,
794 LDB_ERR_OPERATIONS_ERROR);
795 }
796
797 /* The caller may wish to get controls back from the add */
798 ac->ares = talloc_steal(ac, ares);
799
800 ret = samldb_next_step(ac);
801 if (ret != LDB_SUCCESS) {
802 return ldb_module_done(ac->req, NULL, NULL, ret);
803 }
804 return ret;
805 }
806
807 static int samldb_add_entry(struct samldb_ctx *ac)
808 {
809 struct ldb_context *ldb;
810 struct ldb_request *req;
811 int ret;
812
813 ldb = ldb_module_get_ctx(ac->module);
814
815 ret = ldb_build_add_req(&req, ldb, ac,
816 ac->msg,
817 ac->req->controls,
818 ac, samldb_add_entry_callback,
819 ac->req);
820 if (ret != LDB_SUCCESS) {
821 return ret;
822 }
823
824 return ldb_next_request(ac->module, req);
825 }
826
827
828 static int samldb_fill_object(struct samldb_ctx *ac, const char *type)
829 {
830 struct ldb_context *ldb;
831 struct loadparm_context *lp_ctx;
832 enum sid_generator sid_generator;
833 int ret;
834
835 ldb = ldb_module_get_ctx(ac->module);
836
837 /* Add informations for the different account types */
838 ac->type = type;
839 if (strcmp(ac->type, "user") == 0) {
840 ret = samdb_find_or_add_attribute(ldb, ac->msg,
841 "userAccountControl", "546");
842 if (ret != LDB_SUCCESS) return ret;
843 ret = samdb_find_or_add_attribute(ldb, ac->msg,
844 "badPwdCount", "0");
845 if (ret != LDB_SUCCESS) return ret;
846 ret = samdb_find_or_add_attribute(ldb, ac->msg,
847 "codePage", "0");
848 if (ret != LDB_SUCCESS) return ret;
849 ret = samdb_find_or_add_attribute(ldb, ac->msg,
850 "countryCode", "0");
851 if (ret != LDB_SUCCESS) return ret;
852 ret = samdb_find_or_add_attribute(ldb, ac->msg,
853 "badPasswordTime", "0");
854 if (ret != LDB_SUCCESS) return ret;
855 ret = samdb_find_or_add_attribute(ldb, ac->msg,
856 "lastLogoff", "0");
857 if (ret != LDB_SUCCESS) return ret;
858 ret = samdb_find_or_add_attribute(ldb, ac->msg,
859 "lastLogon", "0");
860 if (ret != LDB_SUCCESS) return ret;
861 ret = samdb_find_or_add_attribute(ldb, ac->msg,
862 "pwdLastSet", "0");
863 if (ret != LDB_SUCCESS) return ret;
864 if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
865 ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
866 "primaryGroupID", DOMAIN_RID_USERS);
867 if (ret != LDB_SUCCESS) return ret;
868 }
869 ret = samdb_find_or_add_attribute(ldb, ac->msg,
870 "accountExpires", "9223372036854775807");
871 if (ret != LDB_SUCCESS) return ret;
872 ret = samdb_find_or_add_attribute(ldb, ac->msg,
873 "logonCount", "0");
874 if (ret != LDB_SUCCESS) return ret;
875 } else if (strcmp(ac->type, "group") == 0) {
876 ret = samdb_find_or_add_attribute(ldb, ac->msg,
877 "groupType", "-2147483646");
878 if (ret != LDB_SUCCESS) return ret;
879 } else if (strcmp(ac->type, "classSchema") == 0) {
880 const struct ldb_val *rdn_value;
881
882 ret = samdb_find_or_add_attribute(ldb, ac->msg,
883 "rdnAttId", "cn");
884 if (ret != LDB_SUCCESS) return ret;
885
886 rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
887 if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
888 /* the RDN has prefix "CN" */
889 ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
890 samdb_cn_to_lDAPDisplayName(ac,
891 (const char *) rdn_value->data));
892 if (ret != LDB_SUCCESS) {
893 ldb_oom(ldb);
894 return ret;
895 }
896 }
897
898 if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
899 struct GUID guid;
900 /* a new GUID */
901 guid = GUID_random();
902 ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
903 if (ret != LDB_SUCCESS) {
904 ldb_oom(ldb);
905 return ret;
906 }
907 }
908
909 ret = samldb_add_step(ac, samldb_add_entry);
910 if (ret != LDB_SUCCESS) return ret;
911
912 ret = samldb_add_step(ac, samldb_find_for_defaultObjectCategory);
913 if (ret != LDB_SUCCESS) return ret;
914
915 ret = samldb_add_step(ac, samldb_set_defaultObjectCategory);
916 if (ret != LDB_SUCCESS) return ret;
917
918 return samldb_first_step(ac);
919 } else if (strcmp(ac->type, "attributeSchema") == 0) {
920 const struct ldb_val *rdn_value;
921 rdn_value = ldb_dn_get_rdn_val(ac->msg->dn);
922 if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) {
923 /* the RDN has prefix "CN" */
924 ret = ldb_msg_add_string(ac->msg, "lDAPDisplayName",
925 samdb_cn_to_lDAPDisplayName(ac,
926 (const char *) rdn_value->data));
927 if (ret != LDB_SUCCESS) {
928 ldb_oom(ldb);
929 return ret;
930 }
931 }
932
933 ret = samdb_find_or_add_attribute(ldb, ac->msg,
934 "isSingleValued", "FALSE");
935 if (ret != LDB_SUCCESS) return ret;
936
937 if (!ldb_msg_find_element(ac->msg, "schemaIDGUID")) {
938 struct GUID guid;
939 /* a new GUID */
940 guid = GUID_random();
941 ret = dsdb_msg_add_guid(ac->msg, &guid, "schemaIDGUID");
942 if (ret != LDB_SUCCESS) {
943 ldb_oom(ldb);
944 return ret;
945 }
946 }
947
948 /* handle msDS-IntID attribute */
949 ret = samldb_add_handle_msDS_IntId(ac);
950 if (ret != LDB_SUCCESS) return ret;
951
952 ret = samldb_add_step(ac, samldb_add_entry);
953 if (ret != LDB_SUCCESS) return ret;
954
955 return samldb_first_step(ac);
956 } else {
957 ldb_asprintf_errstring(ldb,
958 "Invalid entry type!");
959 return LDB_ERR_OPERATIONS_ERROR;
960 }
961
962 /* check if we have a valid samAccountName */
963 ret = samldb_add_step(ac, samldb_check_samAccountName);
964 if (ret != LDB_SUCCESS) return ret;
965
966 /* check account_type/group_type */
967 ret = samldb_add_step(ac, samldb_check_samAccountType);
968 if (ret != LDB_SUCCESS) return ret;
969
970 /* check if we have a valid primary group ID */
971 if (strcmp(ac->type, "user") == 0) {
972 ret = samldb_add_step(ac, samldb_check_primaryGroupID_1);
973 if (ret != LDB_SUCCESS) return ret;
974 ret = samldb_add_step(ac, samldb_dn_from_sid);
975 if (ret != LDB_SUCCESS) return ret;
976 ret = samldb_add_step(ac, samldb_check_primaryGroupID_2);
977 if (ret != LDB_SUCCESS) return ret;
978 }
979
980 lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"),
981 struct loadparm_context);
982
983 /* don't allow objectSID to be specified without the RELAX control */
984 ac->sid = samdb_result_dom_sid(ac, ac->msg, "objectSid");
985 if (ac->sid && !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
986 !dsdb_module_am_system(ac->module)) {
987 ldb_asprintf_errstring(ldb, "No SID may be specified in user/group creation for %s",
988 ldb_dn_get_linearized(ac->msg->dn));
989 return LDB_ERR_UNWILLING_TO_PERFORM;
990 }
991
992 if ( ! ac->sid) {
993 sid_generator = lp_sid_generator(lp_ctx);
994 if (sid_generator == SID_GENERATOR_INTERNAL) {
995 ret = samldb_add_step(ac, samldb_allocate_sid);
996 if (ret != LDB_SUCCESS) return ret;
997 }
998 }
999
1000 /* finally proceed with adding the entry */
1001 ret = samldb_add_step(ac, samldb_add_entry);
1002 if (ret != LDB_SUCCESS) return ret;
1003
1004 return samldb_first_step(ac);
1005 }
1006
1007 static int samldb_fill_foreignSecurityPrincipal_object(struct samldb_ctx *ac)
1008 {
1009 struct ldb_context *ldb;
1010 int ret;
1011
1012 ldb = ldb_module_get_ctx(ac->module);
1013
1014 ac->sid = samdb_result_dom_sid(ac->msg, ac->msg, "objectSid");
1015 if (ac->sid == NULL) {
1016 ac->sid = dom_sid_parse_talloc(ac->msg,
1017 (const char *)ldb_dn_get_rdn_val(ac->msg->dn)->data);
1018 if (!ac->sid) {
1019 ldb_set_errstring(ldb,
1020 "No valid SID found in "
1021 "ForeignSecurityPrincipal CN!");
1022 talloc_free(ac);
1023 return LDB_ERR_CONSTRAINT_VIOLATION;
1024 }
1025 if ( ! samldb_msg_add_sid(ac->msg, "objectSid", ac->sid)) {
1026 talloc_free(ac);
1027 return LDB_ERR_OPERATIONS_ERROR;
1028 }
1029 }
1030
1031 /* finally proceed with adding the entry */
1032 ret = samldb_add_step(ac, samldb_add_entry);
1033 if (ret != LDB_SUCCESS) return ret;
1034
1035 return samldb_first_step(ac);
1036 }
1037
1038 static int samldb_check_rdn(struct ldb_module *module, struct ldb_dn *dn)
1039 {
1040 struct ldb_context *ldb;
1041 const char *rdn_name;
1042
1043 ldb = ldb_module_get_ctx(module);
1044 rdn_name = ldb_dn_get_rdn_name(dn);
1045
1046 if (strcasecmp(rdn_name, "cn") != 0) {
1047 ldb_asprintf_errstring(ldb,
1048 "Bad RDN (%s=) for samldb object, "
1049 "should be CN=!", rdn_name);
1050 return LDB_ERR_CONSTRAINT_VIOLATION;
1051 }
1052
1053 return LDB_SUCCESS;
1054 }
1055
1056 /*
1057 * samldb_sid_from_dn (async)
1058 */
1059
1060 static int samldb_sid_from_dn(struct samldb_ctx *ac);
1061
1062 static int samldb_sid_from_dn_callback(struct ldb_request *req,
1063 struct ldb_reply *ares)
1064 {
1065 struct ldb_context *ldb;
1066 struct samldb_ctx *ac;
1067 int ret;
1068
1069 ac = talloc_get_type(req->context, struct samldb_ctx);
1070 ldb = ldb_module_get_ctx(ac->module);
1071
1072 if (!ares) {
1073 ret = LDB_ERR_OPERATIONS_ERROR;
1074 goto done;
1075 }
1076 if (ares->error != LDB_SUCCESS) {
1077 return ldb_module_done(ac->req, ares->controls,
1078 ares->response, ares->error);
1079 }
1080
1081 switch (ares->type) {
1082 case LDB_REPLY_ENTRY:
1083 /* save entry */
1084 if (ac->res_sid != NULL) {
1085 /* one too many! */
1086 ldb_set_errstring(ldb,
1087 "Invalid number of results while searching "
1088 "for domain objects!");
1089 ret = LDB_ERR_OPERATIONS_ERROR;
1090 break;
1091 }
1092 ac->res_sid = samdb_result_dom_sid(ac, ares->message,
1093 "objectSid");
1094
1095 talloc_free(ares);
1096 ret = LDB_SUCCESS;
1097 break;
1098
1099 case LDB_REPLY_REFERRAL:
1100 /* ignore */
1101 talloc_free(ares);
1102 ret = LDB_SUCCESS;
1103 break;
1104
1105 case LDB_REPLY_DONE:
1106 talloc_free(ares);
1107
1108 /* found or not found, go on */
1109 ret = samldb_next_step(ac);
1110 break;
1111 }
1112
1113 done:
1114 if (ret != LDB_SUCCESS) {
1115 return ldb_module_done(ac->req, NULL, NULL, ret);
1116 }
1117
1118 return LDB_SUCCESS;
1119 }
1120
1121 /* Finds the SID "res_sid" of an object with a given DN "dn" */
1122 static int samldb_sid_from_dn(struct samldb_ctx *ac)
1123 {
1124 struct ldb_context *ldb;
1125 static const char * const attrs[] = { "objectSid", NULL };
1126 struct ldb_request *req;
1127 int ret;
1128
1129 ldb = ldb_module_get_ctx(ac->module);
1130
1131 if (ac->dn == NULL)
1132 return LDB_ERR_OPERATIONS_ERROR;
1133
1134 ret = ldb_build_search_req(&req, ldb, ac,
1135 ac->dn,
1136 LDB_SCOPE_BASE,
1137 NULL, attrs,
1138 NULL,
1139 ac, samldb_sid_from_dn_callback,
1140 ac->req);
1141 if (ret != LDB_SUCCESS)
1142 return ret;
1143
1144 return ldb_next_request(ac->module, req);
1145 }
1146
1147 /*
1148 * samldb_user_dn_to_prim_group_rid (async)
1149 */
1150
1151 static int samldb_user_dn_to_prim_group_rid(struct samldb_ctx *ac);
1152
1153 static int samldb_user_dn_to_prim_group_rid_callback(struct ldb_request *req,
1154 struct ldb_reply *ares)
1155 {
1156 struct ldb_context *ldb;
1157 struct samldb_ctx *ac;
1158 int ret;
1159
1160 ac = talloc_get_type(req->context, struct samldb_ctx);
1161 ldb = ldb_module_get_ctx(ac->module);
1162
1163 if (!ares) {
1164 ret = LDB_ERR_OPERATIONS_ERROR;
1165 goto done;
1166 }
1167 if (ares->error != LDB_SUCCESS) {
1168 return ldb_module_done(ac->req, ares->controls,
1169 ares->response, ares->error);
1170 }
1171
1172 switch (ares->type) {
1173 case LDB_REPLY_ENTRY:
1174 /* save entry */
1175 if (ac->prim_group_rid != 0) {
1176 /* one too many! */
1177 ldb_set_errstring(ldb,
1178 "Invalid number of results while searching "
1179 "for domain objects!");
1180 ret = LDB_ERR_OPERATIONS_ERROR;
1181 break;
1182 }
1183 ac->prim_group_rid = samdb_result_uint(ares->message,
1184 "primaryGroupID", ~0);
1185
1186 talloc_free(ares);
1187 ret = LDB_SUCCESS;
1188 break;
1189
1190 case LDB_REPLY_REFERRAL:
1191 /* ignore */
1192 talloc_free(ares);
1193 ret = LDB_SUCCESS;
1194 break;
1195
1196 case LDB_REPLY_DONE:
1197 talloc_free(ares);
1198 if (ac->prim_group_rid == 0) {
1199 ldb_asprintf_errstring(ldb,
1200 "Unable to get the primary group RID!");
1201 ret = LDB_ERR_OPERATIONS_ERROR;
1202 break;
1203 }
1204
1205 /* found, go on */
1206 ret = samldb_next_step(ac);
1207 break;
1208 }
1209
1210 done:
1211 if (ret != LDB_SUCCESS) {
1212 return ldb_module_done(ac->req, NULL, NULL, ret);
1213 }
1214
1215 return LDB_SUCCESS;
1216 }
1217
1218 /* Locates the "primaryGroupID" attribute from a certain user specified as
1219 * "user_dn". Saves the result in "prim_group_rid". */
1220 static int samldb_user_dn_to_prim_group_rid(struct samldb_ctx *ac)
1221 {
1222 struct ldb_context *ldb;
1223 static const char * const attrs[] = { "primaryGroupID", NULL };
1224 struct ldb_request *req;
1225 int ret;
1226
1227 ldb = ldb_module_get_ctx(ac->module);
1228
1229 if (ac->user_dn == NULL)
1230 return LDB_ERR_OPERATIONS_ERROR;
1231
1232 ret = ldb_build_search_req(&req, ldb, ac,
1233 ac->user_dn,
1234 LDB_SCOPE_BASE,
1235 NULL, attrs,
1236 NULL,
1237 ac, samldb_user_dn_to_prim_group_rid_callback,
1238 ac->req);
1239 if (ret != LDB_SUCCESS)
1240 return ret;
1241
1242 return ldb_next_request(ac->module, req);
1243 }
1244
1245 /*
1246 * samldb_prim_group_rid_to_users_cnt (async)
1247 */
1248
1249 static int samldb_prim_group_rid_to_users_cnt(struct samldb_ctx *ac);
1250
1251 static int samldb_prim_group_rid_to_users_cnt_callback(struct ldb_request *req,
1252 struct ldb_reply *ares)
1253 {
1254 struct ldb_context *ldb;
1255 struct samldb_ctx *ac;
1256 int ret;
1257
1258 ac = talloc_get_type(req->context, struct samldb_ctx);
1259 ldb = ldb_module_get_ctx(ac->module);
1260
1261 if (!ares) {
1262 ret = LDB_ERR_OPERATIONS_ERROR;
1263 goto done;
1264 }
1265 if (ares->error != LDB_SUCCESS) {
1266 return ldb_module_done(ac->req, ares->controls,
1267 ares->response, ares->error);
1268 }
1269
1270 switch (ares->type) {
1271 case LDB_REPLY_ENTRY:
1272 /* save entry */
1273 ++(ac->users_cnt);
1274
1275 talloc_free(ares);
1276 ret = LDB_SUCCESS;
1277 break;
1278
1279 case LDB_REPLY_REFERRAL:
1280 /* ignore */
1281 talloc_free(ares);
1282 ret = LDB_SUCCESS;
1283 break;
1284
1285 case LDB_REPLY_DONE:
1286 talloc_free(ares);
1287
1288 /* found or not found, go on */
1289 ret = samldb_next_step(ac);
1290 break;
1291 }
1292
1293 done:
1294 if (ret != LDB_SUCCESS) {
1295 return ldb_module_done(ac->req, NULL, NULL, ret);
1296 }
1297
1298 return LDB_SUCCESS;
1299 }
1300
1301 /* Finds the amount of users which have the primary group "prim_group_rid" and
1302 * save the result in "users_cnt" */
1303 static int samldb_prim_group_rid_to_users_cnt(struct samldb_ctx *ac)
1304 {
1305 struct ldb_context *ldb;
1306 static const char * const attrs[] = { NULL };
1307 struct ldb_request *req;
1308 char *filter;
1309 int ret;
1310
1311 ldb = ldb_module_get_ctx(ac->module);
1312
1313 if ((ac->prim_group_rid == 0) || (ac->users_cnt != 0))
1314 return LDB_ERR_OPERATIONS_ERROR;
1315
1316 filter = talloc_asprintf(ac, "(&(primaryGroupID=%u)(objectclass=user))",
1317 ac->prim_group_rid);
1318 if (filter == NULL)
1319 return LDB_ERR_OPERATIONS_ERROR;
1320
1321 ret = ldb_build_search_req(&req, ldb, ac,
1322 ldb_get_default_basedn(ldb),
1323 LDB_SCOPE_SUBTREE,
1324 filter, attrs,
1325 NULL,
1326 ac,
1327 samldb_prim_group_rid_to_users_cnt_callback,
1328 ac->req);
1329 if (ret != LDB_SUCCESS)
1330 return ret;
1331
1332 return ldb_next_request(ac->module, req);
1333 }
1334
1335 /*
1336 * samldb_group_add_member (async)
1337 * samldb_group_del_member (async)
1338 */
1339
1340 static int samldb_group_add_del_member_callback(struct ldb_request *req,
1341 struct ldb_reply *ares)
1342 {
1343 struct ldb_context *ldb;
1344 struct samldb_ctx *ac;
1345 int ret;
1346
1347 ac = talloc_get_type(req->context, struct samldb_ctx);
1348 ldb = ldb_module_get_ctx(ac->module);
1349
1350 if (!ares) {
1351 ret = LDB_ERR_OPERATIONS_ERROR;
1352 goto done;
1353 }
1354 if (ares->error != LDB_SUCCESS) {
1355 if (ares->error == LDB_ERR_NO_SUCH_ATTRIBUTE) {
1356 /* On error "NO_SUCH_ATTRIBUTE" (delete of an invalid
1357 * "member" attribute) return "UNWILLING_TO_PERFORM" */
1358 ares->error = LDB_ERR_UNWILLING_TO_PERFORM;
1359 }
1360 return ldb_module_done(ac->req, ares->controls,
1361 ares->response, ares->error);
1362 }
1363 if (ares->type != LDB_REPLY_DONE) {
1364 ldb_set_errstring(ldb,
1365 "Invalid reply type!");
1366 ret = LDB_ERR_OPERATIONS_ERROR;
1367 goto done;
1368 }
1369
1370 ret = samldb_next_step(ac);
1371
1372 done:
1373 if (ret != LDB_SUCCESS) {
1374 return ldb_module_done(ac->req, NULL, NULL, ret);
1375 }
1376
1377 return LDB_SUCCESS;
1378 }
1379
1380 /* Adds a member with DN "member_dn" to a group with DN "group_dn" */
1381 static int samldb_group_add_member(struct samldb_ctx *ac)
1382 {
1383 struct ldb_context *ldb;
1384 struct ldb_request *req;
1385 struct ldb_message *msg;
1386 int ret;
1387
1388 ldb = ldb_module_get_ctx(ac->module);
1389
1390 if ((ac->group_dn == NULL) || (ac->member_dn == NULL))
1391 return LDB_ERR_OPERATIONS_ERROR;
1392
1393 msg = ldb_msg_new(ac);
1394 msg->dn = ac->group_dn;
1395 samdb_msg_add_addval(ldb, ac, msg, "member",
1396 ldb_dn_get_linearized(ac->member_dn));
1397
1398 ret = ldb_build_mod_req(&req, ldb, ac,
1399 msg, NULL,
1400 ac, samldb_group_add_del_member_callback,
1401 ac->req);
1402 if (ret != LDB_SUCCESS)
1403 return ret;
1404
1405 return ldb_next_request(ac->module, req);
1406 }
1407
1408 /* Removes a member with DN "member_dn" from a group with DN "group_dn" */
1409 static int samldb_group_del_member(struct samldb_ctx *ac)
1410 {
1411 struct ldb_context *ldb;
1412 struct ldb_request *req;
1413 struct ldb_message *msg;
1414 int ret;
1415
1416 ldb = ldb_module_get_ctx(ac->module);
1417
1418 if ((ac->group_dn == NULL) || (ac->member_dn == NULL))
1419 return LDB_ERR_OPERATIONS_ERROR;
1420
1421 msg = ldb_msg_new(ac);
1422 msg->dn = ac->group_dn;
1423 samdb_msg_add_delval(ldb, ac, msg, "member",
1424 ldb_dn_get_linearized(ac->member_dn));
1425
1426 ret = ldb_build_mod_req(&req, ldb, ac,
1427 msg, NULL,
1428 ac, samldb_group_add_del_member_callback,
1429 ac->req);
1430 if (ret != LDB_SUCCESS)
1431 return ret;
1432
1433 return ldb_next_request(ac->module, req);
1434 }
1435
1436
1437 static int samldb_prim_group_change_1(struct samldb_ctx *ac)
1438 {
1439 struct ldb_context *ldb;
1440 uint32_t rid;
1441
1442 ldb = ldb_module_get_ctx(ac->module);
1443
1444 ac->user_dn = ac->msg->dn;
1445
1446 rid = samdb_result_uint(ac->msg, "primaryGroupID", ~0);
1447 ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
1448 if (ac->sid == NULL)
1449 return LDB_ERR_OPERATIONS_ERROR;
1450 ac->res_dn = NULL;
1451
1452 ac->prim_group_rid = 0;
1453
1454 return samldb_next_step(ac);
1455 }
1456
1457 static int samldb_prim_group_change_2(struct samldb_ctx *ac)
1458 {
1459 struct ldb_context *ldb;
1460
1461 ldb = ldb_module_get_ctx(ac->module);
1462
1463 if (ac->res_dn != NULL)
1464 ac->new_prim_group_dn = ac->res_dn;
1465 else
1466 return LDB_ERR_UNWILLING_TO_PERFORM;
1467
1468 ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb),
1469 ac->prim_group_rid);
1470 if (ac->sid == NULL)
1471 return LDB_ERR_OPERATIONS_ERROR;
1472 ac->res_dn = NULL;
1473
1474 return samldb_next_step(ac);
1475 }
1476
1477 static int samldb_prim_group_change_4(struct samldb_ctx *ac);
1478 static int samldb_prim_group_change_5(struct samldb_ctx *ac);
1479 static int samldb_prim_group_change_6(struct samldb_ctx *ac);
1480
1481 static int samldb_prim_group_change_3(struct samldb_ctx *ac)
1482 {
1483 int ret;
1484
1485 if (ac->res_dn != NULL)
1486 ac->old_prim_group_dn = ac->res_dn;
1487 else
1488 return LDB_ERR_UNWILLING_TO_PERFORM;
1489
1490 /* Only update when the primary group changed */
1491 if (ldb_dn_compare(ac->old_prim_group_dn, ac->new_prim_group_dn) != 0) {
1492 ac->member_dn = ac->user_dn;
1493 /* Remove the "member" attribute of the actual (new) primary
1494 * group */
1495
1496 ret = samldb_add_step(ac, samldb_prim_group_change_4);
1497 if (ret != LDB_SUCCESS) return ret;
1498
1499 ret = samldb_add_step(ac, samldb_group_del_member);
1500 if (ret != LDB_SUCCESS) return ret;
1501
1502 /* Add a "member" attribute for the previous primary group */
1503
1504 ret = samldb_add_step(ac, samldb_prim_group_change_5);
1505 if (ret != LDB_SUCCESS) return ret;
1506
1507 ret = samldb_add_step(ac, samldb_group_add_member);
1508 if (ret != LDB_SUCCESS) return ret;
1509 }
1510
1511 ret = samldb_add_step(ac, samldb_prim_group_change_6);
1512 if (ret != LDB_SUCCESS) return ret;
1513
1514 return samldb_next_step(ac);
1515 }
1516
1517 static int samldb_prim_group_change_4(struct samldb_ctx *ac)
1518 {
1519 ac->group_dn = ac->new_prim_group_dn;
1520
1521 return samldb_next_step(ac);
1522 }
1523
1524 static int samldb_prim_group_change_5(struct samldb_ctx *ac)
1525 {
1526 ac->group_dn = ac->old_prim_group_dn;
1527
1528 return samldb_next_step(ac);
1529 }
1530
1531 static int samldb_prim_group_change_6(struct samldb_ctx *ac)
1532 {
1533 return ldb_next_request(ac->module, ac->req);
1534 }
1535
1536 static int samldb_prim_group_change(struct samldb_ctx *ac)
1537 {
1538 int ret;
1539
1540 /* Finds out the DN of the new primary group */
1541
1542 ret = samldb_add_step(ac, samldb_prim_group_change_1);
1543 if (ret != LDB_SUCCESS) return ret;
1544
1545 ret = samldb_add_step(ac, samldb_dn_from_sid);
1546 if (ret != LDB_SUCCESS) return ret;
1547
1548 ret = samldb_add_step(ac, samldb_user_dn_to_prim_group_rid);
1549 if (ret != LDB_SUCCESS) return ret;
1550
1551 /* Finds out the DN of the old primary group */
1552
1553 ret = samldb_add_step(ac, samldb_prim_group_change_2);
1554 if (ret != LDB_SUCCESS) return ret;
1555
1556 ret = samldb_add_step(ac, samldb_dn_from_sid);
1557 if (ret != LDB_SUCCESS) return ret;
1558
1559 ret = samldb_add_step(ac, samldb_prim_group_change_3);
1560 if (ret != LDB_SUCCESS) return ret;
1561
1562 return samldb_first_step(ac);
1563 }
1564
1565
1566 static int samldb_member_check_1(struct samldb_ctx *ac)
1567 {
1568 struct ldb_context *ldb;
1569 struct ldb_message_element *el;
1570
1571 ldb = ldb_module_get_ctx(ac->module);
1572
1573 el = ldb_msg_find_element(ac->msg, "member");
1574
1575 ac->user_dn = ldb_dn_from_ldb_val(ac, ldb, &el->values[ac->cnt]);
1576 if (!ldb_dn_validate(ac->user_dn))
1577 return LDB_ERR_OPERATIONS_ERROR;
1578 ac->prim_group_rid = 0;
1579
1580 return samldb_next_step(ac);
1581 }
1582
1583 static int samldb_member_check_2(struct samldb_ctx *ac)
1584 {
1585 struct ldb_context *ldb;
1586
1587 ldb = ldb_module_get_ctx(ac->module);
1588
1589 ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb),
1590 ac->prim_group_rid);
1591 if (ac->sid == NULL)
1592 return LDB_ERR_OPERATIONS_ERROR;
1593 ac->res_dn = NULL;
1594
1595 return samldb_next_step(ac);
1596 }
1597
1598 static int samldb_member_check_3(struct samldb_ctx *ac)
1599 {
1600 if (ldb_dn_compare(ac->res_dn, ac->msg->dn) == 0)
1601 return LDB_ERR_ENTRY_ALREADY_EXISTS;
1602
1603 ++(ac->cnt);
1604
1605 return samldb_next_step(ac);
1606 }
1607
1608 static int samldb_member_check_4(struct samldb_ctx *ac)
1609 {
1610 return ldb_next_request(ac->module, ac->req);
1611 }
1612
1613 static int samldb_member_check(struct samldb_ctx *ac)
1614 {
1615 struct ldb_message_element *el;
1616 int i, ret;
1617
1618 el = ldb_msg_find_element(ac->msg, "member");
1619 ac->cnt = 0;
1620 for (i = 0; i < el->num_values; i++) {
1621 /* Denies to add "member"s to groups which are primary ones
1622 * for them */
1623 ret = samldb_add_step(ac, samldb_member_check_1);
1624 if (ret != LDB_SUCCESS) return ret;
1625
1626 ret = samldb_add_step(ac, samldb_user_dn_to_prim_group_rid);
1627 if (ret != LDB_SUCCESS) return ret;
1628
1629 ret = samldb_add_step(ac, samldb_member_check_2);
1630 if (ret != LDB_SUCCESS) return ret;
1631
1632 ret = samldb_add_step(ac, samldb_dn_from_sid);
1633 if (ret != LDB_SUCCESS) return ret;
1634
1635 ret = samldb_add_step(ac, samldb_member_check_3);
1636 if (ret != LDB_SUCCESS) return ret;
1637 }
1638
1639 ret = samldb_add_step(ac, samldb_member_check_4);
1640 if (ret != LDB_SUCCESS) return ret;
1641
1642 return samldb_first_step(ac);
1643 }
1644
1645
1646 static int samldb_prim_group_users_check_1(struct samldb_ctx *ac)
1647 {
1648 ac->dn = ac->req->op.del.dn;
1649 ac->res_sid = NULL;
1650
1651 return samldb_next_step(ac);
1652 }
1653
1654 static int samldb_prim_group_users_check_2(struct samldb_ctx *ac)
1655 {
1656 NTSTATUS status;
1657 uint32_t rid;
1658
1659 if (ac->res_sid == NULL) {
1660 /* No SID - therefore ok here */
1661 return ldb_next_request(ac->module, ac->req);
1662 }
1663 status = dom_sid_split_rid(ac, ac->res_sid, NULL, &rid);
1664 if (!NT_STATUS_IS_OK(status))
1665 return LDB_ERR_OPERATIONS_ERROR;
1666
1667 if (rid == 0) {
1668 /* Special object (security principal?) */
1669 return ldb_next_request(ac->module, ac->req);
1670 }
1671
1672 ac->prim_group_rid = rid;
1673 ac->users_cnt = 0;
1674
1675 return samldb_next_step(ac);
1676 }
1677
1678 static int samldb_prim_group_users_check_3(struct samldb_ctx *ac)
1679 {
1680 if (ac->users_cnt > 0)
1681 return LDB_ERR_ENTRY_ALREADY_EXISTS;
1682
1683 return ldb_next_request(ac->module, ac->req);
1684 }
1685
1686 static int samldb_prim_group_users_check(struct samldb_ctx *ac)
1687 {
1688 int ret;
1689
1690 /* Finds out the SID/RID of the domain object */
1691
1692 ret = samldb_add_step(ac, samldb_prim_group_users_check_1);
1693 if (ret != LDB_SUCCESS) return ret;
1694
1695 ret = samldb_add_step(ac, samldb_sid_from_dn);
1696 if (ret != LDB_SUCCESS) return ret;
1697
1698 /* Deny delete requests from groups which are primary ones */
1699
1700 ret = samldb_add_step(ac, samldb_prim_group_users_check_2);
1701 if (ret != LDB_SUCCESS) return ret;
1702
1703 ret = samldb_add_step(ac, samldb_prim_group_rid_to_users_cnt);
1704 if (ret != LDB_SUCCESS) return ret;
1705
1706 ret = samldb_add_step(ac, samldb_prim_group_users_check_3);
1707 if (ret != LDB_SUCCESS) return ret;
1708
1709 return samldb_first_step(ac);
1710 }
1711
1712
1713 /* add */
1714 static int samldb_add(struct ldb_module *module, struct ldb_request *req)
1715 {
1716 struct ldb_context *ldb;
1717 struct samldb_ctx *ac;
1718 int ret;
1719
1720 ldb = ldb_module_get_ctx(module);
1721 ldb_debug(ldb, LDB_DEBUG_TRACE, "samldb_add\n");
1722
1723 /* do not manipulate our control entries */
1724 if (ldb_dn_is_special(req->op.add.message->dn)) {
1725 return ldb_next_request(module, req);
1726 }
1727
1728 ac = samldb_ctx_init(module, req);
1729 if (ac == NULL) {
1730 return LDB_ERR_OPERATIONS_ERROR;
1731 }
1732
1733 /* build the new msg */
1734 ac->msg = ldb_msg_copy(ac, ac->req->op.add.message);
1735 if (!ac->msg) {
1736 talloc_free(ac);
1737 ldb_debug(ldb, LDB_DEBUG_FATAL,
1738 "samldb_add: ldb_msg_copy failed!\n");
1739 return LDB_ERR_OPERATIONS_ERROR;
1740 }
1741
1742 if (samdb_find_attribute(ldb, ac->msg,
1743 "objectclass", "computer") != NULL) {
1744
1745 /* make sure the computer object also has the 'user'
1746 * objectclass so it will be handled by the next call */
1747 ret = samdb_find_or_add_value(ldb, ac->msg,
1748 "objectclass", "user");
1749 if (ret != LDB_SUCCESS) {
1750 talloc_free(ac);
1751 return ret;
1752 }
1753 }
1754
1755 if (samdb_find_attribute(ldb, ac->msg,
1756 "objectclass", "user") != NULL) {
1757
1758 ret = samldb_check_rdn(module, ac->req->op.add.message->dn);
1759 if (ret != LDB_SUCCESS) {
1760 talloc_free(ac);
1761 return ret;
1762 }
1763
1764 return samldb_fill_object(ac, "user");
1765 }
1766
1767 if (samdb_find_attribute(ldb, ac->msg,
1768 "objectclass", "group") != NULL) {
1769
1770 ret = samldb_check_rdn(module, ac->req->op.add.message->dn);
1771 if (ret != LDB_SUCCESS) {
1772 talloc_free(ac);
1773 return ret;
1774 }
1775
1776 return samldb_fill_object(ac, "group");
1777 }
1778
1779 /* perhaps a foreignSecurityPrincipal? */
1780 if (samdb_find_attribute(ldb, ac->msg,
1781 "objectclass",
1782 "foreignSecurityPrincipal") != NULL) {
1783
1784 ret = samldb_check_rdn(module, ac->req->op.add.message->dn);
1785 if (ret != LDB_SUCCESS) {
1786 talloc_free(ac);
1787 return ret;
1788 }
1789
1790 return samldb_fill_foreignSecurityPrincipal_object(ac);
1791 }
1792
1793 if (samdb_find_attribute(ldb, ac->msg,
1794 "objectclass", "classSchema") != NULL) {
1795
1796 ret = samldb_check_rdn(module, ac->req->op.add.message->dn);
1797 if (ret != LDB_SUCCESS) {
1798 talloc_free(ac);
1799 return ret;
1800 }
1801
1802 return samldb_fill_object(ac, "classSchema");
1803 }
1804
1805 if (samdb_find_attribute(ldb, ac->msg,
1806 "objectclass", "attributeSchema") != NULL) {
1807
1808 ret = samldb_check_rdn(module, ac->req->op.add.message->dn);
1809 if (ret != LDB_SUCCESS) {
1810 talloc_free(ac);
1811 return ret;
1812 }
1813
1814 return samldb_fill_object(ac, "attributeSchema");
1815 }
1816
1817 talloc_free(ac);
1818
1819 /* nothing matched, go on */
1820 return ldb_next_request(module, req);
1821 }
1822
1823 /* modify */
1824 static int samldb_modify(struct ldb_module *module, struct ldb_request *req)
1825 {
1826 struct ldb_context *ldb;
1827 struct ldb_message *msg;
1828 struct ldb_message_element *el, *el2;
1829 int ret;
1830 uint32_t account_type;
1831
1832 if (ldb_dn_is_special(req->op.mod.message->dn)) {
1833 /* do not manipulate our control entries */
1834 return ldb_next_request(module, req);
1835 }
1836
1837 ldb = ldb_module_get_ctx(module);
1838
1839 if (ldb_msg_find_element(req->op.mod.message, "sAMAccountType") != NULL) {
1840 ldb_asprintf_errstring(ldb,
1841 "sAMAccountType must not be specified!");
1842 return LDB_ERR_UNWILLING_TO_PERFORM;
1843 }
1844
1845 /* msDS-IntId is not allowed to be modified
1846 * except when modification comes from replication */
1847 if (ldb_msg_find_element(req->op.mod.message, "msDS-IntId")) {
1848 if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)) {
1849 return LDB_ERR_CONSTRAINT_VIOLATION;
1850 }
1851 }
1852
1853 /* TODO: do not modify original request, create a new one */
1854
1855 el = ldb_msg_find_element(req->op.mod.message, "groupType");
1856 if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
1857 uint32_t group_type;
1858
1859 req->op.mod.message = msg = ldb_msg_copy_shallow(req,
1860 req->op.mod.message);
1861
1862 group_type = strtoul((const char *)el->values[0].data, NULL, 0);
1863 account_type = ds_gtype2atype(group_type);
1864 ret = samdb_msg_add_uint(ldb, msg, msg,
1865 "sAMAccountType",
1866 account_type);
1867 if (ret != LDB_SUCCESS) {
1868 return ret;
1869 }
1870 el2 = ldb_msg_find_element(msg, "sAMAccountType");
1871 el2->flags = LDB_FLAG_MOD_REPLACE;
1872 }
1873
1874 el = ldb_msg_find_element(req->op.mod.message, "primaryGroupID");
1875 if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
1876 struct samldb_ctx *ac;
1877
1878 ac = samldb_ctx_init(module, req);
1879 if (ac == NULL)
1880 return LDB_ERR_OPERATIONS_ERROR;
1881
1882 req->op.mod.message = ac->msg = ldb_msg_copy_shallow(req,
1883 req->op.mod.message);
1884
1885 return samldb_prim_group_change(ac);
1886 }
1887
1888 el = ldb_msg_find_element(req->op.mod.message, "userAccountControl");
1889 if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
1890 uint32_t user_account_control;
1891
1892 req->op.mod.message = msg = ldb_msg_copy_shallow(req,
1893 req->op.mod.message);
1894
1895 user_account_control = strtoul((const char *)el->values[0].data,
1896 NULL, 0);
1897 account_type = ds_uf2atype(user_account_control);
1898 ret = samdb_msg_add_uint(ldb, msg, msg,
1899 "sAMAccountType",
1900 account_type);
1901 if (ret != LDB_SUCCESS) {
1902 return ret;
1903 }
1904 el2 = ldb_msg_find_element(msg, "sAMAccountType");
1905 el2->flags = LDB_FLAG_MOD_REPLACE;
1906
1907 if (user_account_control & UF_SERVER_TRUST_ACCOUNT) {
1908 ret = samdb_msg_add_string(ldb, msg, msg,
1909 "isCriticalSystemObject", "TRUE");
1910 if (ret != LDB_SUCCESS) {
1911 return ret;
1912 }
1913 el2 = ldb_msg_find_element(msg, "isCriticalSystemObject");
1914 el2->flags = LDB_FLAG_MOD_REPLACE;
1915
1916 /* DCs have primaryGroupID of DOMAIN_RID_DCS */
1917 if (!ldb_msg_find_element(msg, "primaryGroupID")) {
1918 ret = samdb_msg_add_uint(ldb, msg, msg,
1919 "primaryGroupID", DOMAIN_RID_DCS);
1920 if (ret != LDB_SUCCESS) {
1921 return ret;
1922 }
1923 el2 = ldb_msg_find_element(msg, "primaryGroupID");
1924 el2->flags = LDB_FLAG_MOD_REPLACE;
1925 }
1926 }
1927 }
1928
1929 el = ldb_msg_find_element(req->op.mod.message, "member");
1930 if (el && el->flags & (LDB_FLAG_MOD_ADD|LDB_FLAG_MOD_REPLACE) && el->num_values == 1) {
1931 struct samldb_ctx *ac;
1932
1933 ac = samldb_ctx_init(module, req);
1934 if (ac == NULL)
1935 return LDB_ERR_OPERATIONS_ERROR;
1936
1937 req->op.mod.message = ac->msg = ldb_msg_copy_shallow(req,
1938 req->op.mod.message);
1939
1940 return samldb_member_check(ac);
1941 }
1942
1943 /* nothing matched, go on */
1944 return ldb_next_request(module, req);
1945 }
1946
1947 /* delete */
1948 static int samldb_delete(struct ldb_module *module, struct ldb_request *req)
1949 {
1950 struct samldb_ctx *ac;
1951
1952 if (ldb_dn_is_special(req->op.del.dn)) {
1953 /* do not manipulate our control entries */
1954 return ldb_next_request(module, req);
1955 }
1956
1957 ac = samldb_ctx_init(module, req);
1958 if (ac == NULL)
1959 return LDB_ERR_OPERATIONS_ERROR;
1960
1961 return samldb_prim_group_users_check(ac);
1962 }
1963
1964 static int samldb_extended_allocate_rid_pool(struct ldb_module *module, struct ldb_request *req)
1965 {
1966 struct ldb_context *ldb = ldb_module_get_ctx(module);
1967 struct dsdb_fsmo_extended_op *exop;
1968 int ret;
1969
1970 exop = talloc_get_type(req->op.extended.data, struct dsdb_fsmo_extended_op);
1971 if (!exop) {
1972 ldb_debug(ldb, LDB_DEBUG_FATAL, "samldb_extended_allocate_rid_pool: invalid extended data\n");
1973 return LDB_ERR_PROTOCOL_ERROR;
1974 }
1975
1976 ret = ridalloc_allocate_rid_pool_fsmo(module, exop);
1977 if (ret != LDB_SUCCESS) {
1978 return ret;
1979 }
1980
1981 return ldb_module_done(req, NULL, NULL, LDB_SUCCESS);
1982 }
1983
1984 static int samldb_extended(struct ldb_module *module, struct ldb_request *req)
1985 {
1986 if (strcmp(req->op.extended.oid, DSDB_EXTENDED_ALLOCATE_RID_POOL) == 0) {
1987 return samldb_extended_allocate_rid_pool(module, req);
1988 }
1989
1990 return ldb_next_request(module, req);
1991 }
1992
1993
1994 _PUBLIC_ const struct ldb_module_ops ldb_samldb_module_ops = {
1995 .name = "samldb",
1996 .add = samldb_add,
1997 .modify = samldb_modify,
1998 .del = samldb_delete,
1999 .extended = samldb_extended
2000 };
2001
reg import