2 Unix SMB/CIFS implementation.
4 Helpers to add users and groups to the DB
6 Copyright (C) Andrew Tridgell 2004
7 Copyright (C) Volker Lendecke 2004
8 Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2010
9 Copyright (C) Matthias Dieter Wallnöfer 2009
11 This program is free software; you can redistribute it and/or modify
12 it under the terms of the GNU General Public License as published by
13 the Free Software Foundation; either version 3 of the License, or
14 (at your option) any later version.
16 This program is distributed in the hope that it will be useful,
17 but WITHOUT ANY WARRANTY; without even the implied warranty of
18 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
19 GNU General Public License for more details.
21 You should have received a copy of the GNU General Public License
22 along with this program. If not, see <http://www.gnu.org/licenses/>.
26 #include "dsdb/samdb/samdb.h"
27 #include "dsdb/common/util.h"
28 #include "../libds/common/flags.h"
29 #include "libcli/security/security.h"
31 #include "libds/common/flag_mapping.h"
33 /* Add a user, SAMR style, including the correct transaction
34 * semantics. Used by the SAMR server and by pdb_samba4 */
35 NTSTATUS
dsdb_add_user(struct ldb_context
*ldb
,
37 const char *account_name
,
43 struct ldb_message
*msg
;
45 const char *container
, *obj_class
=NULL
;
49 const char *attrs
[] = {
55 uint32_t user_account_control
;
56 struct ldb_dn
*account_dn
;
57 struct dom_sid
*account_sid
;
59 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
60 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
63 * Start a transaction, so we can query and do a subsequent atomic
67 ret
= ldb_transaction_start(ldb
);
68 if (ret
!= LDB_SUCCESS
) {
69 DEBUG(0,("Failed to start a transaction for user creation: %s\n",
72 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
75 /* check if the user already exists */
76 name
= samdb_search_string(ldb
, tmp_ctx
, NULL
,
78 "(&(sAMAccountName=%s)(objectclass=user))",
79 ldb_binary_encode_string(tmp_ctx
, account_name
));
81 ldb_transaction_cancel(ldb
);
83 return NT_STATUS_USER_EXISTS
;
86 cn_name
= talloc_strdup(tmp_ctx
, account_name
);
88 ldb_transaction_cancel(ldb
);
90 return NT_STATUS_NO_MEMORY
;
93 cn_name_len
= strlen(cn_name
);
94 if (cn_name_len
< 1) {
95 ldb_transaction_cancel(ldb
);
97 return NT_STATUS_INVALID_PARAMETER
;
100 msg
= ldb_msg_new(tmp_ctx
);
102 ldb_transaction_cancel(ldb
);
103 talloc_free(tmp_ctx
);
104 return NT_STATUS_NO_MEMORY
;
107 /* This must be one of these values *only* */
108 if (acct_flags
== ACB_NORMAL
) {
109 container
= "CN=Users";
112 } else if (acct_flags
== ACB_WSTRUST
) {
113 if (cn_name
[cn_name_len
- 1] != '$') {
114 ldb_transaction_cancel(ldb
);
115 return NT_STATUS_FOOBAR
;
117 cn_name
[cn_name_len
- 1] = '\0';
118 container
= "CN=Computers";
119 obj_class
= "computer";
121 } else if (acct_flags
== ACB_SVRTRUST
) {
122 if (cn_name
[cn_name_len
- 1] != '$') {
123 ldb_transaction_cancel(ldb
);
124 return NT_STATUS_FOOBAR
;
126 cn_name
[cn_name_len
- 1] = '\0';
127 container
= "OU=Domain Controllers";
128 obj_class
= "computer";
130 ldb_transaction_cancel(ldb
);
131 talloc_free(tmp_ctx
);
132 return NT_STATUS_INVALID_PARAMETER
;
135 /* add core elements to the ldb_message for the user */
136 msg
->dn
= ldb_dn_copy(msg
, ldb_get_default_basedn(ldb
));
137 if ( ! ldb_dn_add_child_fmt(msg
->dn
, "CN=%s,%s", cn_name
, container
)) {
138 ldb_transaction_cancel(ldb
);
139 talloc_free(tmp_ctx
);
140 return NT_STATUS_FOOBAR
;
143 ldb_msg_add_string(msg
, "sAMAccountName", account_name
);
144 ldb_msg_add_string(msg
, "objectClass", obj_class
);
146 /* create the user */
147 ret
= ldb_add(ldb
, msg
);
151 case LDB_ERR_ENTRY_ALREADY_EXISTS
:
152 ldb_transaction_cancel(ldb
);
153 DEBUG(0,("Failed to create user record %s: %s\n",
154 ldb_dn_get_linearized(msg
->dn
),
155 ldb_errstring(ldb
)));
156 talloc_free(tmp_ctx
);
157 return NT_STATUS_USER_EXISTS
;
158 case LDB_ERR_UNWILLING_TO_PERFORM
:
159 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
:
160 ldb_transaction_cancel(ldb
);
161 DEBUG(0,("Failed to create user record %s: %s\n",
162 ldb_dn_get_linearized(msg
->dn
),
163 ldb_errstring(ldb
)));
164 talloc_free(tmp_ctx
);
165 return NT_STATUS_ACCESS_DENIED
;
167 ldb_transaction_cancel(ldb
);
168 DEBUG(0,("Failed to create user record %s: %s\n",
169 ldb_dn_get_linearized(msg
->dn
),
170 ldb_errstring(ldb
)));
171 talloc_free(tmp_ctx
);
172 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
175 account_dn
= msg
->dn
;
177 /* retrieve the sid and account control bits for the user just created */
178 ret
= dsdb_search_one(ldb
, tmp_ctx
, &msg
,
179 account_dn
, LDB_SCOPE_BASE
, attrs
, 0, NULL
);
181 if (ret
!= LDB_SUCCESS
) {
182 ldb_transaction_cancel(ldb
);
183 DEBUG(0,("Can't locate the account we just created %s: %s\n",
184 ldb_dn_get_linearized(account_dn
), ldb_errstring(ldb
)));
185 talloc_free(tmp_ctx
);
186 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
188 account_sid
= samdb_result_dom_sid(tmp_ctx
, msg
, "objectSid");
189 if (account_sid
== NULL
) {
190 ldb_transaction_cancel(ldb
);
191 DEBUG(0,("Apparently we failed to get the objectSid of the just created account record %s\n",
192 ldb_dn_get_linearized(msg
->dn
)));
193 talloc_free(tmp_ctx
);
194 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
197 /* Change the account control to be the correct account type.
198 * The default is for a workstation account */
199 user_account_control
= ldb_msg_find_attr_as_uint(msg
, "userAccountControl", 0);
200 user_account_control
= (user_account_control
&
201 ~(UF_NORMAL_ACCOUNT
|
202 UF_INTERDOMAIN_TRUST_ACCOUNT
|
203 UF_WORKSTATION_TRUST_ACCOUNT
|
204 UF_SERVER_TRUST_ACCOUNT
));
205 user_account_control
|= ds_acb2uf(acct_flags
);
208 msg
= ldb_msg_new(tmp_ctx
);
210 ldb_transaction_cancel(ldb
);
211 talloc_free(tmp_ctx
);
212 return NT_STATUS_NO_MEMORY
;
215 msg
->dn
= account_dn
;
217 if (samdb_msg_add_uint(ldb
, tmp_ctx
, msg
,
218 "userAccountControl",
219 user_account_control
) != LDB_SUCCESS
) {
220 ldb_transaction_cancel(ldb
);
221 talloc_free(tmp_ctx
);
222 return NT_STATUS_NO_MEMORY
;
225 /* modify the samdb record */
226 ret
= dsdb_replace(ldb
, msg
, 0);
227 if (ret
!= LDB_SUCCESS
) {
228 DEBUG(0,("Failed to modify account record %s to set userAccountControl: %s\n",
229 ldb_dn_get_linearized(msg
->dn
),
230 ldb_errstring(ldb
)));
231 ldb_transaction_cancel(ldb
);
232 talloc_free(tmp_ctx
);
234 /* we really need samdb.c to return NTSTATUS */
235 return NT_STATUS_UNSUCCESSFUL
;
238 ret
= ldb_transaction_commit(ldb
);
239 if (ret
!= LDB_SUCCESS
) {
240 DEBUG(0,("Failed to commit transaction to add and modify account record %s: %s\n",
241 ldb_dn_get_linearized(msg
->dn
),
242 ldb_errstring(ldb
)));
243 talloc_free(tmp_ctx
);
244 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
246 *dn
= talloc_steal(mem_ctx
, account_dn
);
247 *sid
= talloc_steal(mem_ctx
, account_sid
);
248 talloc_free(tmp_ctx
);
253 called by samr_CreateDomainGroup and pdb_samba4
255 NTSTATUS
dsdb_add_domain_group(struct ldb_context
*ldb
,
257 const char *groupname
,
258 struct dom_sid
**sid
,
262 struct ldb_message
*msg
;
263 struct dom_sid
*group_sid
;
266 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
267 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
269 /* check if the group already exists */
270 name
= samdb_search_string(ldb
, tmp_ctx
, NULL
,
272 "(&(sAMAccountName=%s)(objectclass=group))",
273 ldb_binary_encode_string(tmp_ctx
, groupname
));
275 return NT_STATUS_GROUP_EXISTS
;
278 msg
= ldb_msg_new(tmp_ctx
);
280 return NT_STATUS_NO_MEMORY
;
283 /* add core elements to the ldb_message for the user */
284 msg
->dn
= ldb_dn_copy(tmp_ctx
, ldb_get_default_basedn(ldb
));
285 ldb_dn_add_child_fmt(msg
->dn
, "CN=%s,CN=Users", groupname
);
287 talloc_free(tmp_ctx
);
288 return NT_STATUS_NO_MEMORY
;
290 ldb_msg_add_string(msg
, "sAMAccountName", groupname
);
291 ldb_msg_add_string(msg
, "objectClass", "group");
293 /* create the group */
294 ret
= ldb_add(ldb
, msg
);
298 case LDB_ERR_ENTRY_ALREADY_EXISTS
:
299 DEBUG(0,("Failed to create group record %s: %s\n",
300 ldb_dn_get_linearized(msg
->dn
),
301 ldb_errstring(ldb
)));
302 talloc_free(tmp_ctx
);
303 return NT_STATUS_GROUP_EXISTS
;
304 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
:
305 DEBUG(0,("Failed to create group record %s: %s\n",
306 ldb_dn_get_linearized(msg
->dn
),
307 ldb_errstring(ldb
)));
308 talloc_free(tmp_ctx
);
309 return NT_STATUS_ACCESS_DENIED
;
311 DEBUG(0,("Failed to create group record %s: %s\n",
312 ldb_dn_get_linearized(msg
->dn
),
313 ldb_errstring(ldb
)));
314 talloc_free(tmp_ctx
);
315 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
318 /* retrieve the sid for the group just created */
319 group_sid
= samdb_search_dom_sid(ldb
, tmp_ctx
,
320 msg
->dn
, "objectSid", NULL
);
321 if (group_sid
== NULL
) {
322 return NT_STATUS_UNSUCCESSFUL
;
325 *dn
= talloc_steal(mem_ctx
, msg
->dn
);
326 *sid
= talloc_steal(mem_ctx
, group_sid
);
327 talloc_free(tmp_ctx
);
331 NTSTATUS
dsdb_add_domain_alias(struct ldb_context
*ldb
,
333 const char *alias_name
,
334 struct dom_sid
**sid
,
338 struct ldb_message
*msg
;
339 struct dom_sid
*alias_sid
;
342 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
343 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
345 /* Check if alias already exists */
346 name
= samdb_search_string(ldb
, tmp_ctx
, NULL
,
348 "(sAMAccountName=%s)(objectclass=group))",
349 ldb_binary_encode_string(mem_ctx
, alias_name
));
352 talloc_free(tmp_ctx
);
353 return NT_STATUS_ALIAS_EXISTS
;
356 msg
= ldb_msg_new(tmp_ctx
);
358 talloc_free(tmp_ctx
);
359 return NT_STATUS_NO_MEMORY
;
362 /* add core elements to the ldb_message for the alias */
363 msg
->dn
= ldb_dn_copy(mem_ctx
, ldb_get_default_basedn(ldb
));
364 ldb_dn_add_child_fmt(msg
->dn
, "CN=%s,CN=Users", alias_name
);
366 talloc_free(tmp_ctx
);
367 return NT_STATUS_NO_MEMORY
;
370 ldb_msg_add_string(msg
, "sAMAccountName", alias_name
);
371 ldb_msg_add_string(msg
, "objectClass", "group");
372 samdb_msg_add_int(ldb
, mem_ctx
, msg
, "groupType", GTYPE_SECURITY_DOMAIN_LOCAL_GROUP
);
374 /* create the alias */
375 ret
= ldb_add(ldb
, msg
);
379 case LDB_ERR_ENTRY_ALREADY_EXISTS
:
380 talloc_free(tmp_ctx
);
381 return NT_STATUS_ALIAS_EXISTS
;
382 case LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS
:
383 talloc_free(tmp_ctx
);
384 return NT_STATUS_ACCESS_DENIED
;
386 DEBUG(0,("Failed to create alias record %s: %s\n",
387 ldb_dn_get_linearized(msg
->dn
),
388 ldb_errstring(ldb
)));
389 talloc_free(tmp_ctx
);
390 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
393 /* retrieve the sid for the alias just created */
394 alias_sid
= samdb_search_dom_sid(ldb
, tmp_ctx
,
395 msg
->dn
, "objectSid", NULL
);
397 *dn
= talloc_steal(mem_ctx
, msg
->dn
);
398 *sid
= talloc_steal(mem_ctx
, alias_sid
);
399 talloc_free(tmp_ctx
);
404 /* Return the members of this group (which may be a domain group or an alias) */
405 NTSTATUS
dsdb_enum_group_mem(struct ldb_context
*ldb
,
408 struct dom_sid
**members_out
,
409 unsigned int *pnum_members
)
411 struct ldb_message
*msg
;
414 struct dom_sid
*members
;
415 struct ldb_message_element
*member_el
;
416 const char *attrs
[] = { "member", NULL
};
418 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
419 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
421 ret
= dsdb_search_one(ldb
, tmp_ctx
, &msg
, dn
, LDB_SCOPE_BASE
, attrs
,
422 DSDB_SEARCH_SHOW_EXTENDED_DN
, NULL
);
423 if (ret
== LDB_ERR_NO_SUCH_OBJECT
) {
424 talloc_free(tmp_ctx
);
425 return NT_STATUS_OBJECT_NAME_NOT_FOUND
;
427 if (ret
!= LDB_SUCCESS
) {
428 DEBUG(1, ("dsdb_enum_group_mem: dsdb_search for %s failed: %s\n",
429 ldb_dn_get_linearized(dn
), ldb_errstring(ldb
)));
430 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
433 member_el
= ldb_msg_find_element(msg
, "member");
437 talloc_free(tmp_ctx
);
441 members
= talloc_array(mem_ctx
, struct dom_sid
, member_el
->num_values
);
442 if (members
== NULL
) {
443 return NT_STATUS_NO_MEMORY
;
447 for (i
=0; i
<member_el
->num_values
; i
++) {
448 struct ldb_dn
*member_dn
= ldb_dn_from_ldb_val(tmp_ctx
, ldb
,
449 &member_el
->values
[i
]);
450 if (!member_dn
|| !ldb_dn_validate(member_dn
)) {
451 DEBUG(1, ("Could not parse %*.*s as a DN\n",
452 (int)member_el
->values
[i
].length
,
453 (int)member_el
->values
[i
].length
,
454 (const char *)member_el
->values
[i
].data
));
455 talloc_free(tmp_ctx
);
456 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
459 status
= dsdb_get_extended_dn_sid(member_dn
, &members
[j
],
461 if (NT_STATUS_EQUAL(status
, NT_STATUS_OBJECT_NAME_NOT_FOUND
)) {
462 /* If we fail finding a SID then this is no error since
463 * it could be a non SAM object - e.g. a contact */
465 } else if (!NT_STATUS_IS_OK(status
)) {
466 DEBUG(1, ("When parsing DN '%s' we failed to parse it's SID component, so we cannot fetch the membership: %s\n",
467 ldb_dn_get_extended_linearized(tmp_ctx
, member_dn
, 1),
469 talloc_free(tmp_ctx
);
476 *members_out
= talloc_steal(mem_ctx
, members
);
478 talloc_free(tmp_ctx
);
482 NTSTATUS
dsdb_lookup_rids(struct ldb_context
*ldb
,
484 const struct dom_sid
*domain_sid
,
485 unsigned int num_rids
,
488 enum lsa_SidType
*lsa_attrs
)
490 const char *attrs
[] = { "sAMAccountType", "sAMAccountName", NULL
};
491 unsigned int i
, num_mapped
;
493 TALLOC_CTX
*tmp_ctx
= talloc_new(mem_ctx
);
494 NT_STATUS_HAVE_NO_MEMORY(tmp_ctx
);
498 for (i
=0; i
<num_rids
; i
++) {
499 struct ldb_message
*msg
;
504 lsa_attrs
[i
] = SID_NAME_UNKNOWN
;
506 dn
= ldb_dn_new_fmt(tmp_ctx
, ldb
, "<SID=%s>",
507 dom_sid_string(tmp_ctx
,
508 dom_sid_add_rid(tmp_ctx
, domain_sid
,
511 talloc_free(tmp_ctx
);
512 return NT_STATUS_NO_MEMORY
;
514 rc
= dsdb_search_one(ldb
, tmp_ctx
, &msg
, dn
, LDB_SCOPE_BASE
, attrs
, 0, "samAccountName=*");
515 if (rc
== LDB_ERR_NO_SUCH_OBJECT
) {
517 } else if (rc
!= LDB_SUCCESS
) {
518 talloc_free(tmp_ctx
);
519 return NT_STATUS_INTERNAL_DB_CORRUPTION
;
522 names
[i
] = ldb_msg_find_attr_as_string(msg
, "samAccountName", NULL
);
523 if (names
[i
] == NULL
) {
524 DEBUG(10, ("no samAccountName\n"));
527 talloc_steal(names
, names
[i
]);
528 attr
= ldb_msg_find_attr_as_uint(msg
, "samAccountType", 0);
529 lsa_attrs
[i
] = ds_atype_map(attr
);
530 if (lsa_attrs
[i
] == SID_NAME_UNKNOWN
) {
535 talloc_free(tmp_ctx
);
537 if (num_mapped
== 0) {
538 return NT_STATUS_NONE_MAPPED
;
540 if (num_mapped
< num_rids
) {
541 return STATUS_SOME_UNMAPPED
;