source4/libnet/libnet_samsync_ldb.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Extract the user/system database from a remote SamSync server
   5
   6    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
   7    Copyright (C) Andrew Tridgell 2004
   8    Copyright (C) Volker Lendecke 2004
   9
  10    This program is free software; you can redistribute it and/or modify
  11    it under the terms of the GNU General Public License as published by
  12    the Free Software Foundation; either version 3 of the License, or
  13    (at your option) any later version.
  14
  15    This program is distributed in the hope that it will be useful,
  16    but WITHOUT ANY WARRANTY; without even the implied warranty of
  17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18    GNU General Public License for more details.
  19
  20    You should have received a copy of the GNU General Public License
  21    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24
  25 #include "includes.h"
  26 #include "libnet/libnet.h"
  27 #include "libcli/ldap/ldap_ndr.h"
  28 #include "dsdb/samdb/samdb.h"
  29 #include "auth/auth.h"
  30 #include "../lib/util/util_ldb.h"
  31 #include "librpc/gen_ndr/ndr_misc.h"
  32 #include "ldb_wrap.h"
  33 #include "libcli/security/security.h"
  34 #include "param/param.h"
  35
  36 struct samsync_ldb_secret {
  37         struct samsync_ldb_secret *prev, *next;
  38         DATA_BLOB secret;
  39         char *name;
  40         NTTIME mtime;
  41 };
  42
  43 struct samsync_ldb_trusted_domain {
  44         struct samsync_ldb_trusted_domain *prev, *next;
  45         struct dom_sid *sid;
  46         char *name;
  47 };
  48
  49 struct samsync_ldb_state {
  50         /* Values from the LSA lookup */
  51         const struct libnet_SamSync_state *samsync_state;
  52
  53         struct dom_sid *dom_sid[3];
  54         struct ldb_context *sam_ldb, *remote_ldb, *pdb;
  55         struct ldb_dn *base_dn[3];
  56         struct samsync_ldb_secret *secrets;
  57         struct samsync_ldb_trusted_domain *trusted_domains;
  58 };
  59
  60 /* This wrapper is needed for the "ADD_OR_DEL" macros */
  61 static int samdb_msg_add_string(struct ldb_context *sam_ldb,
  62                                 TALLOC_CTX *mem_ctx, struct ldb_message *msg,
  63                                 const char *attr_name, const char *str)
  64 {
  65         return ldb_msg_add_string(msg, attr_name, str);
  66 }
  67
  68 static NTSTATUS samsync_ldb_add_foreignSecurityPrincipal(TALLOC_CTX *mem_ctx,
  69                                                          struct samsync_ldb_state *state,
  70                                                          struct dom_sid *sid,
  71                                                          struct ldb_dn **fsp_dn,
  72                                                          char **error_string)
  73 {
  74         const char *sidstr = dom_sid_string(mem_ctx, sid);
  75         /* We assume that ForeignSecurityPrincipals are under the BASEDN of the main domain */
  76         struct ldb_dn *basedn = samdb_search_dn(state->sam_ldb, mem_ctx,
  77                                                 state->base_dn[SAM_DATABASE_DOMAIN],
  78                                                 "(&(objectClass=container)(cn=ForeignSecurityPrincipals))");
  79         struct ldb_message *msg;
  80         int ret;
  81
  82         if (!sidstr) {
  83                 return NT_STATUS_NO_MEMORY;
  84         }
  85
  86         if (basedn == NULL) {
  87                 *error_string = talloc_asprintf(mem_ctx,
  88                                                 "Failed to find DN for "
  89                                                 "ForeignSecurityPrincipal container under %s",
  90                                                 ldb_dn_get_linearized(state->base_dn[SAM_DATABASE_DOMAIN]));
  91                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
  92         }
  93
  94         msg = ldb_msg_new(mem_ctx);
  95         if (msg == NULL) {
  96                 return NT_STATUS_NO_MEMORY;
  97         }
  98
  99         /* add core elements to the ldb_message for the alias */
 100         msg->dn = basedn;
 101         if ( ! ldb_dn_add_child_fmt(msg->dn, "CN=%s", sidstr))
 102                 return NT_STATUS_UNSUCCESSFUL;
 103
 104         ldb_msg_add_string(msg, "objectClass", "foreignSecurityPrincipal");
 105
 106         *fsp_dn = msg->dn;
 107
 108         /* create the alias */
 109         ret = ldb_add(state->sam_ldb, msg);
 110         if (ret != LDB_SUCCESS) {
 111                 *error_string = talloc_asprintf(mem_ctx, "Failed to create foreignSecurityPrincipal "
 112                                                 "record %s: %s",
 113                                                 ldb_dn_get_linearized(msg->dn),
 114                                                 ldb_errstring(state->sam_ldb));
 115                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 116         }
 117         return NT_STATUS_OK;
 118 }
 119
 120 static NTSTATUS samsync_ldb_handle_domain(TALLOC_CTX *mem_ctx,
 121                                           struct samsync_ldb_state *state,
 122                                           enum netr_SamDatabaseID database,
 123                                           struct netr_DELTA_ENUM *delta,
 124                                           char **error_string)
 125 {
 126         struct netr_DELTA_DOMAIN *domain = delta->delta_union.domain;
 127         const char *domain_name = domain->domain_name.string;
 128         struct ldb_message *msg;
 129         int ret;
 130
 131         msg = ldb_msg_new(mem_ctx);
 132         if (msg == NULL) {
 133                 return NT_STATUS_NO_MEMORY;
 134         }
 135
 136         if (database == SAM_DATABASE_DOMAIN) {
 137                 struct ldb_dn *partitions_basedn;
 138                 const char *domain_attrs[] =  {"nETBIOSName", "nCName", NULL};
 139                 struct ldb_message **msgs_domain;
 140                 int ret_domain;
 141
 142                 partitions_basedn = samdb_partitions_dn(state->sam_ldb, mem_ctx);
 143
 144                 ret_domain = gendb_search(state->sam_ldb, mem_ctx, partitions_basedn, &msgs_domain, domain_attrs,
 145                                           "(&(&(nETBIOSName=%s)(objectclass=crossRef))(ncName=*))",
 146                                           domain_name);
 147                 if (ret_domain == -1) {
 148                         *error_string = talloc_asprintf(mem_ctx, "gendb_search for domain failed: %s", ldb_errstring(state->sam_ldb));
 149                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 150                 }
 151
 152                 if (ret_domain != 1) {
 153                         *error_string = talloc_asprintf(mem_ctx, "Failed to find existing domain record for %s: %d results", domain_name,
 154                                                         ret_domain);
 155                         return NT_STATUS_NO_SUCH_DOMAIN;
 156                 }
 157
 158                 state->base_dn[database] = samdb_result_dn(state->sam_ldb, state, msgs_domain[0], "nCName", NULL);
 159
 160                 if (state->dom_sid[database]) {
 161                         /* Update the domain sid with the incoming
 162                          * domain (found on LSA pipe, database sid may
 163                          * be random) */
 164                         ret = samdb_msg_add_dom_sid(state->sam_ldb,
 165                                                     mem_ctx,
 166                                                     msg,
 167                                                     "objectSid",
 168                                                     state->dom_sid[database]);
 169                         if (ret != LDB_SUCCESS) {
 170                                 return NT_STATUS_INTERNAL_ERROR;
 171                         }
 172                 } else {
 173                         /* Well, we will have to use the one from the database */
 174                         state->dom_sid[database] = samdb_search_dom_sid(state->sam_ldb, state,
 175                                                                         state->base_dn[database],
 176                                                                         "objectSid", NULL);
 177                         if (state->dom_sid[database] == NULL) {
 178                                 return NT_STATUS_INTERNAL_ERROR;
 179                         }
 180                 }
 181
 182                 if (state->samsync_state->domain_guid) {
 183                         struct ldb_val v;
 184                         NTSTATUS status;
 185                         status = GUID_to_ndr_blob(state->samsync_state->domain_guid, msg, &v);
 186                         if (!NT_STATUS_IS_OK(status)) {
 187                                 *error_string = talloc_asprintf(mem_ctx, "ndr_push of domain GUID failed!");
 188                                 return status;
 189                         }
 190
 191                         ret = ldb_msg_add_value(msg, "objectGUID", &v, NULL);
 192                         if (ret != LDB_SUCCESS) {
 193                                 return NT_STATUS_INTERNAL_ERROR;
 194                         }
 195                 }
 196         } else if (database == SAM_DATABASE_BUILTIN) {
 197                 /* work out the builtin_dn - useful for so many calls its worth
 198                    fetching here */
 199                 const char *dnstring = samdb_search_string(state->sam_ldb, mem_ctx, NULL,
 200                                                            "distinguishedName", "objectClass=builtinDomain");
 201                 state->base_dn[database] = ldb_dn_new(state, state->sam_ldb, dnstring);
 202                 if ( ! ldb_dn_validate(state->base_dn[database])) {
 203                         return NT_STATUS_INTERNAL_ERROR;
 204                 }
 205         } else {
 206                 /* PRIVs DB */
 207                 return NT_STATUS_INVALID_PARAMETER;
 208         }
 209
 210         msg->dn = talloc_reference(mem_ctx, state->base_dn[database]);
 211         if (!msg->dn) {
 212                 return NT_STATUS_NO_MEMORY;
 213         }
 214
 215         ldb_msg_add_string(msg, "oEMInformation",
 216                            domain->oem_information.string);
 217
 218         samdb_msg_add_int64(state->sam_ldb, mem_ctx,
 219                             msg, "forceLogoff", domain->force_logoff_time);
 220
 221         samdb_msg_add_uint(state->sam_ldb, mem_ctx,
 222                            msg, "minPwdLen", domain->min_password_length);
 223
 224         samdb_msg_add_int64(state->sam_ldb, mem_ctx,
 225                             msg, "maxPwdAge", domain->max_password_age);
 226
 227         samdb_msg_add_int64(state->sam_ldb, mem_ctx,
 228                             msg, "minPwdAge", domain->min_password_age);
 229
 230         samdb_msg_add_uint(state->sam_ldb, mem_ctx,
 231                            msg, "pwdHistoryLength", domain->password_history_length);
 232
 233         samdb_msg_add_uint64(state->sam_ldb, mem_ctx,
 234                              msg, "modifiedCount",
 235                              domain->sequence_num);
 236
 237         samdb_msg_add_uint64(state->sam_ldb, mem_ctx,
 238                              msg, "creationTime", domain->domain_create_time);
 239
 240         /* TODO: Account lockout, password properties */
 241
 242         ret = dsdb_replace(state->sam_ldb, msg, 0);
 243         if (ret != LDB_SUCCESS) {
 244                 *error_string = talloc_asprintf(mem_ctx,
 245                                                 "Failed to modify domain record %s: %s",
 246                                                 ldb_dn_get_linearized(msg->dn),
 247                                                 ldb_errstring(state->sam_ldb));
 248                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 249         }
 250         return NT_STATUS_OK;
 251 }
 252
 253 static NTSTATUS samsync_ldb_handle_user(TALLOC_CTX *mem_ctx,
 254                                         struct samsync_ldb_state *state,
 255                                         enum netr_SamDatabaseID database,
 256                                         struct netr_DELTA_ENUM *delta,
 257                                         char **error_string)
 258 {
 259         uint32_t rid = delta->delta_id_union.rid;
 260         struct netr_DELTA_USER *user = delta->delta_union.user;
 261         const char *container, *obj_class;
 262         char *cn_name;
 263         int cn_name_len;
 264         const struct dom_sid *user_sid;
 265         struct ldb_message *msg;
 266         struct ldb_message **msgs;
 267         struct ldb_message **remote_msgs = NULL;
 268         unsigned int i;
 269         int ret;
 270         uint32_t acb;
 271         bool add = false;
 272         const char *attrs[] = { NULL };
 273         /* we may change this to a global search, then fill in only the things not in ldap later */
 274         const char *remote_attrs[] = { "userPrincipalName", "servicePrincipalName",
 275                                        "msDS-KeyVersionNumber", "objectGUID", NULL};
 276
 277         user_sid = dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid);
 278         if (!user_sid) {
 279                 return NT_STATUS_NO_MEMORY;
 280         }
 281
 282         msg = ldb_msg_new(mem_ctx);
 283         if (msg == NULL) {
 284                 return NT_STATUS_NO_MEMORY;
 285         }
 286
 287         msg->dn = NULL;
 288         /* search for the user, by rid */
 289         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database],
 290                            &msgs, attrs, "(&(objectClass=user)(objectSid=%s))",
 291                            ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
 292
 293         if (ret == -1) {
 294                 *error_string = talloc_asprintf(mem_ctx, "LDB for user %s failed: %s",
 295                                                 dom_sid_string(mem_ctx, user_sid),
 296                                                 ldb_errstring(state->sam_ldb));
 297                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 298         } else if (ret == 0) {
 299                 add = true;
 300         } else if (ret > 1) {
 301                 *error_string = talloc_asprintf(mem_ctx, "More than one user with SID: %s in local LDB",
 302                                                 dom_sid_string(mem_ctx, user_sid));
 303                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 304         } else {
 305                 msg->dn = msgs[0]->dn;
 306                 talloc_steal(msg, msgs[0]->dn);
 307         }
 308
 309         /* and do the same on the remote database */
 310         if (state->remote_ldb) {
 311                 ret = gendb_search(state->remote_ldb, mem_ctx, state->base_dn[database],
 312                                    &remote_msgs, remote_attrs, "(&(objectClass=user)(objectSid=%s))",
 313                                    ldap_encode_ndr_dom_sid(mem_ctx, user_sid));
 314
 315                 if (ret == -1) {
 316                         *error_string = talloc_asprintf(mem_ctx, "remote LDAP for user %s failed: %s",
 317                                                         dom_sid_string(mem_ctx, user_sid),
 318                                                         ldb_errstring(state->remote_ldb));
 319                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 320                 } else if (ret == 0) {
 321                         *error_string = talloc_asprintf(mem_ctx, "User exists in samsync but not in remote LDAP domain! (base: %s, SID: %s)",
 322                                                         ldb_dn_get_linearized(state->base_dn[database]),
 323                                                         dom_sid_string(mem_ctx, user_sid));
 324                         return NT_STATUS_NO_SUCH_USER;
 325                 } else if (ret > 1) {
 326                         *error_string = talloc_asprintf(mem_ctx, "More than one user in remote LDAP domain with SID: %s",
 327                                                         dom_sid_string(mem_ctx, user_sid));
 328                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 329
 330                         /* Try to put things in the same location as the remote server */
 331                 } else if (add) {
 332                         msg->dn = talloc_steal(msg, remote_msgs[0]->dn);
 333                 }
 334         }
 335
 336         cn_name   = talloc_strdup(mem_ctx, user->account_name.string);
 337         NT_STATUS_HAVE_NO_MEMORY(cn_name);
 338         cn_name_len = strlen(cn_name);
 339
 340 #define ADD_OR_DEL(type, attrib, field) do {                            \
 341                 if (user->field) {                                      \
 342                         samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
 343                                                attrib, user->field);    \
 344                 } else if (!add) {                                      \
 345                         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
 346                                              attrib);                   \
 347                 }                                                       \
 348         } while (0);
 349
 350         ADD_OR_DEL(string, "samAccountName", account_name.string);
 351         ADD_OR_DEL(string, "displayName", full_name.string);
 352
 353         if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
 354                                   "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
 355                 return NT_STATUS_NO_MEMORY;
 356         }
 357
 358         ADD_OR_DEL(uint, "primaryGroupID", primary_gid);
 359         ADD_OR_DEL(string, "homeDirectory", home_directory.string);
 360         ADD_OR_DEL(string, "homeDrive", home_drive.string);
 361         ADD_OR_DEL(string, "scriptPath", logon_script.string);
 362         ADD_OR_DEL(string, "description", description.string);
 363         ADD_OR_DEL(string, "userWorkstations", workstations.string);
 364
 365         ADD_OR_DEL(uint64, "lastLogon", last_logon);
 366         ADD_OR_DEL(uint64, "lastLogoff", last_logoff);
 367
 368         if (samdb_msg_add_logon_hours(state->sam_ldb, mem_ctx, msg, "logonHours", &user->logon_hours) != 0) {
 369                 return NT_STATUS_NO_MEMORY;
 370         }
 371
 372         ADD_OR_DEL(uint, "badPwdCount", bad_password_count);
 373         ADD_OR_DEL(uint, "logonCount", logon_count);
 374
 375         ADD_OR_DEL(uint64, "pwdLastSet", last_password_change);
 376         ADD_OR_DEL(uint64, "accountExpires", acct_expiry);
 377
 378         if (samdb_msg_add_acct_flags(state->sam_ldb, mem_ctx, msg,
 379                                      "userAccountControl", user->acct_flags) != 0) {
 380                 return NT_STATUS_NO_MEMORY;
 381         }
 382
 383         if (user->lm_password_present) {
 384                 samdb_msg_add_hash(state->sam_ldb, mem_ctx, msg,
 385                                    "dBCSPwd", &user->lmpassword);
 386         } else if (!add) {
 387                 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
 388                                      "dBCSPwd");
 389         }
 390         if (user->nt_password_present) {
 391                 samdb_msg_add_hash(state->sam_ldb, mem_ctx, msg,
 392                                    "unicodePwd", &user->ntpassword);
 393         } else if (!add) {
 394                 samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
 395                                      "unicodePwd");
 396         }
 397
 398         ADD_OR_DEL(string, "comment", comment.string);
 399
 400         if (samdb_msg_add_parameters(state->sam_ldb, mem_ctx, msg, "userParameters", &user->parameters) != 0) {
 401                 return NT_STATUS_NO_MEMORY;
 402         }
 403
 404         ADD_OR_DEL(uint, "countryCode", country_code);
 405         ADD_OR_DEL(uint, "codePage", code_page);
 406
 407         ADD_OR_DEL(string, "profilePath", profile_path.string);
 408
 409 #undef ADD_OR_DEL
 410
 411         for (i=0; remote_attrs[i]; i++) {
 412                 struct ldb_message_element *el = ldb_msg_find_element(remote_msgs[0], remote_attrs[i]);
 413                 if (!el) {
 414                         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
 415                                              remote_attrs[i]);
 416                 } else {
 417                         ldb_msg_add(msg, el, LDB_FLAG_MOD_REPLACE);
 418                 }
 419         }
 420
 421         acb = user->acct_flags;
 422         if (acb & (ACB_WSTRUST)) {
 423                 cn_name[cn_name_len - 1] = '\0';
 424                 container = "Computers";
 425                 obj_class = "computer";
 426
 427         } else if (acb & ACB_SVRTRUST) {
 428                 if (cn_name[cn_name_len - 1] != '$') {
 429                         return NT_STATUS_FOOBAR;
 430                 }
 431                 cn_name[cn_name_len - 1] = '\0';
 432                 container = "Domain Controllers";
 433                 obj_class = "computer";
 434         } else {
 435                 container = "Users";
 436                 obj_class = "user";
 437         }
 438         if (add) {
 439                 ldb_msg_add_string(msg, "objectClass", obj_class);
 440                 if (!msg->dn) {
 441                         msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
 442                         ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
 443                         if (!msg->dn) {
 444                                 return NT_STATUS_NO_MEMORY;
 445                         }
 446                 }
 447
 448                 ret = ldb_add(state->sam_ldb, msg);
 449                 if (ret != LDB_SUCCESS) {
 450                         struct ldb_dn *first_try_dn = msg->dn;
 451                         /* Try again with the default DN */
 452                         if (!remote_msgs) {
 453                                 *error_string = talloc_asprintf(mem_ctx, "Failed to create user record.  Tried %s: %s",
 454                                                                 ldb_dn_get_linearized(first_try_dn),
 455                                                                 ldb_errstring(state->sam_ldb));
 456                                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 457                         } else {
 458                                 msg->dn = talloc_steal(msg, remote_msgs[0]->dn);
 459                                 ret = ldb_add(state->sam_ldb, msg);
 460                                 if (ret != LDB_SUCCESS) {
 461                                         *error_string = talloc_asprintf(mem_ctx, "Failed to create user record.  Tried both %s and %s: %s",
 462                                                                         ldb_dn_get_linearized(first_try_dn),
 463                                                                         ldb_dn_get_linearized(msg->dn),
 464                                                                         ldb_errstring(state->sam_ldb));
 465                                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 466                                 }
 467                         }
 468                 }
 469         } else {
 470                 ret = dsdb_replace(state->sam_ldb, msg, 0);
 471                 if (ret != LDB_SUCCESS) {
 472                         *error_string = talloc_asprintf(mem_ctx, "Failed to modify user record %s: %s",
 473                                                         ldb_dn_get_linearized(msg->dn),
 474                                                         ldb_errstring(state->sam_ldb));
 475                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 476                 }
 477         }
 478
 479         return NT_STATUS_OK;
 480 }
 481
 482 static NTSTATUS samsync_ldb_delete_user(TALLOC_CTX *mem_ctx,
 483                                         struct samsync_ldb_state *state,
 484                                         enum netr_SamDatabaseID database,
 485                                         struct netr_DELTA_ENUM *delta,
 486                                         char **error_string)
 487 {
 488         uint32_t rid = delta->delta_id_union.rid;
 489         struct ldb_message **msgs;
 490         int ret;
 491         const char *attrs[] = { NULL };
 492
 493         /* search for the user, by rid */
 494         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database],
 495                            &msgs, attrs, "(&(objectClass=user)(objectSid=%s))",
 496                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 497
 498         if (ret == -1) {
 499                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 500                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 501         } else if (ret == 0) {
 502                 return NT_STATUS_NO_SUCH_USER;
 503         } else if (ret > 1) {
 504                 *error_string = talloc_asprintf(mem_ctx, "More than one user with SID: %s",
 505                                                 dom_sid_string(mem_ctx,
 506                                                                dom_sid_add_rid(mem_ctx,
 507                                                                                state->dom_sid[database],
 508                                                                                rid)));
 509                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 510         }
 511
 512         ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
 513         if (ret != LDB_SUCCESS) {
 514                 *error_string = talloc_asprintf(mem_ctx, "Failed to delete user record %s: %s",
 515                                                 ldb_dn_get_linearized(msgs[0]->dn),
 516                                                 ldb_errstring(state->sam_ldb));
 517                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 518         }
 519
 520         return NT_STATUS_OK;
 521 }
 522
 523 static NTSTATUS samsync_ldb_handle_group(TALLOC_CTX *mem_ctx,
 524                                          struct samsync_ldb_state *state,
 525                                          enum netr_SamDatabaseID database,
 526                                          struct netr_DELTA_ENUM *delta,
 527                                          char **error_string)
 528 {
 529         uint32_t rid = delta->delta_id_union.rid;
 530         struct netr_DELTA_GROUP *group = delta->delta_union.group;
 531         const char *container, *obj_class;
 532         const char *cn_name;
 533
 534         struct ldb_message *msg;
 535         struct ldb_message **msgs;
 536         int ret;
 537         bool add = false;
 538         const char *attrs[] = { NULL };
 539
 540         msg = ldb_msg_new(mem_ctx);
 541         if (msg == NULL) {
 542                 return NT_STATUS_NO_MEMORY;
 543         }
 544
 545         /* search for the group, by rid */
 546         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 547                            "(&(objectClass=group)(objectSid=%s))",
 548                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 549
 550         if (ret == -1) {
 551                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 552                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 553         } else if (ret == 0) {
 554                 add = true;
 555         } else if (ret > 1) {
 556                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 557                                                 dom_sid_string(mem_ctx,
 558                                                                dom_sid_add_rid(mem_ctx,
 559                                                                                state->dom_sid[database],
 560                                                                                rid)));
 561                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 562         } else {
 563                 msg->dn = talloc_steal(msg, msgs[0]->dn);
 564         }
 565
 566         cn_name   = group->group_name.string;
 567
 568 #define ADD_OR_DEL(type, attrib, field) do {                            \
 569                 if (group->field) {                                     \
 570                         samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
 571                                                attrib, group->field);   \
 572                 } else if (!add) {                                      \
 573                         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
 574                                              attrib);                   \
 575                 }                                                       \
 576         } while (0);
 577
 578         ADD_OR_DEL(string, "samAccountName", group_name.string);
 579
 580         if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
 581                                   "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
 582                 return NT_STATUS_NO_MEMORY;
 583         }
 584
 585         ADD_OR_DEL(string, "description", description.string);
 586
 587 #undef ADD_OR_DEL
 588
 589         container = "Users";
 590         obj_class = "group";
 591
 592         if (add) {
 593                 ldb_msg_add_string(msg, "objectClass", obj_class);
 594                 msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
 595                 ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
 596                 if (!msg->dn) {
 597                         return NT_STATUS_NO_MEMORY;
 598                 }
 599
 600                 ret = ldb_add(state->sam_ldb, msg);
 601                 if (ret != LDB_SUCCESS) {
 602                         *error_string = talloc_asprintf(mem_ctx, "Failed to create group record %s: %s",
 603                                                         ldb_dn_get_linearized(msg->dn),
 604                                                         ldb_errstring(state->sam_ldb));
 605                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 606                 }
 607         } else {
 608                 ret = dsdb_replace(state->sam_ldb, msg, 0);
 609                 if (ret != LDB_SUCCESS) {
 610                         *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
 611                                                         ldb_dn_get_linearized(msg->dn),
 612                                                         ldb_errstring(state->sam_ldb));
 613                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 614                 }
 615         }
 616
 617         return NT_STATUS_OK;
 618 }
 619
 620 static NTSTATUS samsync_ldb_delete_group(TALLOC_CTX *mem_ctx,
 621                                          struct samsync_ldb_state *state,
 622                                          enum netr_SamDatabaseID database,
 623                                          struct netr_DELTA_ENUM *delta,
 624                                          char **error_string)
 625 {
 626         uint32_t rid = delta->delta_id_union.rid;
 627         struct ldb_message **msgs;
 628         int ret;
 629         const char *attrs[] = { NULL };
 630
 631         /* search for the group, by rid */
 632         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 633                            "(&(objectClass=group)(objectSid=%s))",
 634                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 635
 636         if (ret == -1) {
 637                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 638                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 639         } else if (ret == 0) {
 640                 return NT_STATUS_NO_SUCH_GROUP;
 641         } else if (ret > 1) {
 642                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 643                                                 dom_sid_string(mem_ctx,
 644                                                                dom_sid_add_rid(mem_ctx,
 645                                                                                state->dom_sid[database],
 646                                                                                rid)));
 647                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 648         }
 649
 650         ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
 651         if (ret != LDB_SUCCESS) {
 652                 *error_string = talloc_asprintf(mem_ctx, "Failed to delete group record %s: %s",
 653                                                 ldb_dn_get_linearized(msgs[0]->dn),
 654                                                 ldb_errstring(state->sam_ldb));
 655                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 656         }
 657
 658         return NT_STATUS_OK;
 659 }
 660
 661 static NTSTATUS samsync_ldb_handle_group_member(TALLOC_CTX *mem_ctx,
 662                                                 struct samsync_ldb_state *state,
 663                                                 enum netr_SamDatabaseID database,
 664                                                 struct netr_DELTA_ENUM *delta,
 665                                                 char **error_string)
 666 {
 667         uint32_t rid = delta->delta_id_union.rid;
 668         struct netr_DELTA_GROUP_MEMBER *delta_group_member = delta->delta_union.group_member;
 669         struct ldb_message *msg;
 670         struct ldb_message **msgs;
 671         int ret;
 672         const char *attrs[] = { NULL };
 673         const char *str_dn;
 674         uint32_t i;
 675
 676         msg = ldb_msg_new(mem_ctx);
 677         if (msg == NULL) {
 678                 return NT_STATUS_NO_MEMORY;
 679         }
 680
 681         /* search for the group, by rid */
 682         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 683                            "(&(objectClass=group)(objectSid=%s))",
 684                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 685
 686         if (ret == -1) {
 687                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 688                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 689         } else if (ret == 0) {
 690                 return NT_STATUS_NO_SUCH_GROUP;
 691         } else if (ret > 1) {
 692                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 693                                                 dom_sid_string(mem_ctx,
 694                                                                dom_sid_add_rid(mem_ctx,
 695                                                                                state->dom_sid[database],
 696                                                                                rid)));
 697                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 698         } else {
 699                 msg->dn = talloc_steal(msg, msgs[0]->dn);
 700         }
 701
 702         talloc_free(msgs);
 703
 704         for (i=0; i<delta_group_member->num_rids; i++) {
 705                 /* search for the group, by rid */
 706                 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 707                                    "(&(objectClass=user)(objectSid=%s))",
 708                                    ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], delta_group_member->rids[i])));
 709
 710                 if (ret == -1) {
 711                         *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 712                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 713                 } else if (ret == 0) {
 714                         return NT_STATUS_NO_SUCH_USER;
 715                 } else if (ret > 1) {
 716                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 717                 } else {
 718                         str_dn = ldb_dn_alloc_linearized(msg, msgs[0]->dn);
 719                         NT_STATUS_HAVE_NO_MEMORY(str_dn);
 720                         ret = ldb_msg_add_string(msg, "member", str_dn);
 721                         if (ret != LDB_SUCCESS) return NT_STATUS_NO_MEMORY;
 722                 }
 723
 724                 talloc_free(msgs);
 725         }
 726
 727         ret = dsdb_replace(state->sam_ldb, msg, 0);
 728         if (ret != LDB_SUCCESS) {
 729                 *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
 730                                                 ldb_dn_get_linearized(msg->dn),
 731                                                 ldb_errstring(state->sam_ldb));
 732                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 733         }
 734
 735         return NT_STATUS_OK;
 736 }
 737
 738 static NTSTATUS samsync_ldb_handle_alias(TALLOC_CTX *mem_ctx,
 739                                          struct samsync_ldb_state *state,
 740                                          enum netr_SamDatabaseID database,
 741                                          struct netr_DELTA_ENUM *delta,
 742                                          char **error_string)
 743 {
 744         uint32_t rid = delta->delta_id_union.rid;
 745         struct netr_DELTA_ALIAS *alias = delta->delta_union.alias;
 746         const char *container, *obj_class;
 747         const char *cn_name;
 748
 749         struct ldb_message *msg;
 750         struct ldb_message **msgs;
 751         int ret;
 752         bool add = false;
 753         const char *attrs[] = { NULL };
 754
 755         msg = ldb_msg_new(mem_ctx);
 756         if (msg == NULL) {
 757                 return NT_STATUS_NO_MEMORY;
 758         }
 759
 760         /* search for the alias, by rid */
 761         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 762                            "(&(objectClass=group)(objectSid=%s))",
 763                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 764
 765         if (ret == -1) {
 766                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 767                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 768         } else if (ret == 0) {
 769                 add = true;
 770         } else if (ret > 1) {
 771                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 772                                                 dom_sid_string(mem_ctx,
 773                                                                dom_sid_add_rid(mem_ctx,
 774                                                                                state->dom_sid[database],
 775                                                                                rid)));
 776                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 777         } else {
 778                 msg->dn = talloc_steal(mem_ctx, msgs[0]->dn);
 779         }
 780
 781         cn_name   = alias->alias_name.string;
 782
 783 #define ADD_OR_DEL(type, attrib, field) do {                            \
 784                 if (alias->field) {                                     \
 785                         samdb_msg_add_ ## type(state->sam_ldb, mem_ctx, msg, \
 786                                                attrib, alias->field);   \
 787                 } else if (!add) {                                      \
 788                         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg, \
 789                                              attrib);                   \
 790                 }                                                       \
 791         } while (0);
 792
 793         ADD_OR_DEL(string, "samAccountName", alias_name.string);
 794
 795         if (samdb_msg_add_dom_sid(state->sam_ldb, mem_ctx, msg,
 796                                   "objectSid", dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid))) {
 797                 return NT_STATUS_NO_MEMORY;
 798         }
 799
 800         ADD_OR_DEL(string, "description", description.string);
 801
 802 #undef ADD_OR_DEL
 803
 804         samdb_msg_add_uint(state->sam_ldb, mem_ctx, msg, "groupType", 0x80000004);
 805
 806         container = "Users";
 807         obj_class = "group";
 808
 809         if (add) {
 810                 ldb_msg_add_string(msg, "objectClass", obj_class);
 811                 msg->dn = ldb_dn_copy(mem_ctx, state->base_dn[database]);
 812                 ldb_dn_add_child_fmt(msg->dn, "CN=%s,CN=%s", cn_name, container);
 813                 if (!msg->dn) {
 814                         return NT_STATUS_NO_MEMORY;
 815                 }
 816
 817                 ret = ldb_add(state->sam_ldb, msg);
 818                 if (ret != LDB_SUCCESS) {
 819                         *error_string = talloc_asprintf(mem_ctx, "Failed to create alias record %s: %s",
 820                                                         ldb_dn_get_linearized(msg->dn),
 821                                                         ldb_errstring(state->sam_ldb));
 822                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 823                 }
 824         } else {
 825                 ret = dsdb_replace(state->sam_ldb, msg, 0);
 826                 if (ret != LDB_SUCCESS) {
 827                         *error_string = talloc_asprintf(mem_ctx, "Failed to modify alias record %s: %s",
 828                                                         ldb_dn_get_linearized(msg->dn),
 829                                                         ldb_errstring(state->sam_ldb));
 830                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 831                 }
 832         }
 833
 834         return NT_STATUS_OK;
 835 }
 836
 837 static NTSTATUS samsync_ldb_delete_alias(TALLOC_CTX *mem_ctx,
 838                                          struct samsync_ldb_state *state,
 839                                          enum netr_SamDatabaseID database,
 840                                          struct netr_DELTA_ENUM *delta,
 841                                          char **error_string)
 842 {
 843         uint32_t rid = delta->delta_id_union.rid;
 844         struct ldb_message **msgs;
 845         int ret;
 846         const char *attrs[] = { NULL };
 847
 848         /* search for the alias, by rid */
 849         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 850                            "(&(objectClass=group)(objectSid=%s))",
 851                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 852
 853         if (ret == -1) {
 854                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 855                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 856         } else if (ret == 0) {
 857                 return NT_STATUS_NO_SUCH_ALIAS;
 858         } else if (ret > 1) {
 859                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 860         }
 861
 862         ret = ldb_delete(state->sam_ldb, msgs[0]->dn);
 863         if (ret != LDB_SUCCESS) {
 864                 *error_string = talloc_asprintf(mem_ctx, "Failed to delete alias record %s: %s",
 865                                                 ldb_dn_get_linearized(msgs[0]->dn),
 866                                                 ldb_errstring(state->sam_ldb));
 867                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 868         }
 869
 870         return NT_STATUS_OK;
 871 }
 872
 873 static NTSTATUS samsync_ldb_handle_alias_member(TALLOC_CTX *mem_ctx,
 874                                                 struct samsync_ldb_state *state,
 875                                                 enum netr_SamDatabaseID database,
 876                                                 struct netr_DELTA_ENUM *delta,
 877                                                 char **error_string)
 878 {
 879         uint32_t rid = delta->delta_id_union.rid;
 880         struct netr_DELTA_ALIAS_MEMBER *alias_member = delta->delta_union.alias_member;
 881         struct ldb_message *msg;
 882         struct ldb_message **msgs;
 883         int ret;
 884         const char *attrs[] = { NULL };
 885         uint32_t i;
 886
 887         msg = ldb_msg_new(mem_ctx);
 888         if (msg == NULL) {
 889                 return NT_STATUS_NO_MEMORY;
 890         }
 891
 892         /* search for the alias, by rid */
 893         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[database], &msgs, attrs,
 894                            "(&(objectClass=group)(objectSid=%s))",
 895                            ldap_encode_ndr_dom_sid(mem_ctx, dom_sid_add_rid(mem_ctx, state->dom_sid[database], rid)));
 896
 897         if (ret == -1) {
 898                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 899                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 900         } else if (ret == 0) {
 901                 return NT_STATUS_NO_SUCH_GROUP;
 902         } else if (ret > 1) {
 903                 *error_string = talloc_asprintf(mem_ctx, "More than one group/alias with SID: %s",
 904                                                 dom_sid_string(mem_ctx,
 905                                                                dom_sid_add_rid(mem_ctx,
 906                                                                                state->dom_sid[database],
 907                                                                                rid)));
 908                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 909         } else {
 910                 msg->dn = talloc_steal(msg, msgs[0]->dn);
 911         }
 912
 913         talloc_free(msgs);
 914
 915         for (i=0; i<alias_member->sids.num_sids; i++) {
 916                 struct ldb_dn *alias_member_dn;
 917                 const char *str_dn;
 918                 /* search for members, in the top basedn (normal users are builtin aliases) */
 919                 ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[SAM_DATABASE_DOMAIN], &msgs, attrs,
 920                                    "(objectSid=%s)",
 921                                    ldap_encode_ndr_dom_sid(mem_ctx, alias_member->sids.sids[i].sid));
 922
 923                 if (ret == -1) {
 924                         *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
 925                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 926                 } else if (ret == 0) {
 927                         NTSTATUS nt_status;
 928                         nt_status = samsync_ldb_add_foreignSecurityPrincipal(mem_ctx, state,
 929                                                                              alias_member->sids.sids[i].sid,
 930                                                                              &alias_member_dn,
 931                                                                              error_string);
 932                         if (!NT_STATUS_IS_OK(nt_status)) {
 933                                 return nt_status;
 934                         }
 935                 } else if (ret > 1) {
 936                         return NT_STATUS_INTERNAL_DB_CORRUPTION;
 937                 } else {
 938                         alias_member_dn = msgs[0]->dn;
 939                 }
 940                 str_dn = ldb_dn_alloc_linearized(msg, alias_member_dn);
 941                 NT_STATUS_HAVE_NO_MEMORY(str_dn);
 942                 ret = ldb_msg_add_string(msg, "member", str_dn);
 943                 if (ret != LDB_SUCCESS) return NT_STATUS_NO_MEMORY;
 944
 945                 talloc_free(msgs);
 946         }
 947
 948         ret = dsdb_replace(state->sam_ldb, msg, 0);
 949         if (ret != LDB_SUCCESS) {
 950                 *error_string = talloc_asprintf(mem_ctx, "Failed to modify group record %s: %s",
 951                                                 ldb_dn_get_linearized(msg->dn),
 952                                                 ldb_errstring(state->sam_ldb));
 953                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
 954         }
 955
 956         return NT_STATUS_OK;
 957 }
 958
 959 static NTSTATUS samsync_ldb_handle_account(TALLOC_CTX *mem_ctx,
 960                                            struct samsync_ldb_state *state,
 961                                            enum netr_SamDatabaseID database,
 962                                            struct netr_DELTA_ENUM *delta,
 963                                            char **error_string)
 964 {
 965         struct dom_sid *sid = delta->delta_id_union.sid;
 966         struct netr_DELTA_ACCOUNT *account = delta->delta_union.account;
 967
 968         struct ldb_message *msg;
 969         int ret;
 970         uint32_t i;
 971         char *dnstr, *sidstr;
 972
 973         msg = ldb_msg_new(mem_ctx);
 974         if (msg == NULL) {
 975                 return NT_STATUS_NO_MEMORY;
 976         }
 977
 978         sidstr = dom_sid_string(msg, sid);
 979         NT_STATUS_HAVE_NO_MEMORY_AND_FREE(sidstr, msg);
 980
 981         dnstr = talloc_asprintf(msg, "sid=%s", sidstr);
 982         NT_STATUS_HAVE_NO_MEMORY_AND_FREE(dnstr, msg);
 983
 984         msg->dn = ldb_dn_new(msg, state->pdb, dnstr);
 985         NT_STATUS_HAVE_NO_MEMORY_AND_FREE(msg->dn, msg);
 986
 987         for (i=0; i< account->privilege_entries; i++) {
 988                 ldb_msg_add_string(msg, "privilege", account->privilege_name[i].string);
 989         }
 990
 991         ret = dsdb_replace(state->pdb, msg, 0);
 992         if (ret == LDB_ERR_NO_SUCH_OBJECT) {
 993                 if (samdb_msg_add_dom_sid(state->pdb, msg, msg, "objectSid", sid) != LDB_SUCCESS) {
 994                         talloc_free(msg);
 995                         return NT_STATUS_NO_MEMORY;
 996                 }
 997                 ldb_msg_add_string(msg, "comment", "added via samsync");
 998                 ret = ldb_add(state->pdb, msg);
 999         }
1000
1001         if (ret != LDB_SUCCESS) {
1002                 *error_string = talloc_asprintf(mem_ctx, "Failed to modify privilege record %s",
1003                                                 ldb_dn_get_linearized(msg->dn));
1004                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1005         }
1006
1007         return NT_STATUS_OK;
1008 }
1009
1010 static NTSTATUS samsync_ldb_delete_account(TALLOC_CTX *mem_ctx,
1011                                            struct samsync_ldb_state *state,
1012                                            enum netr_SamDatabaseID database,
1013                                            struct netr_DELTA_ENUM *delta,
1014                                            char **error_string)
1015 {
1016         struct dom_sid *sid = delta->delta_id_union.sid;
1017
1018         struct ldb_message *msg;
1019         struct ldb_message **msgs;
1020         int ret;
1021         const char *attrs[] = { NULL };
1022
1023         msg = ldb_msg_new(mem_ctx);
1024         if (msg == NULL) {
1025                 return NT_STATUS_NO_MEMORY;
1026         }
1027
1028         /* search for the account, by sid, in the top basedn */
1029         ret = gendb_search(state->sam_ldb, mem_ctx, state->base_dn[SAM_DATABASE_DOMAIN], &msgs, attrs,
1030                            "(objectSid=%s)",
1031                            ldap_encode_ndr_dom_sid(mem_ctx, sid));
1032
1033         if (ret == -1) {
1034                 *error_string = talloc_asprintf(mem_ctx, "gendb_search failed: %s", ldb_errstring(state->sam_ldb));
1035                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1036         } else if (ret == 0) {
1037                 return NT_STATUS_NO_SUCH_USER;
1038         } else if (ret > 1) {
1039                 *error_string = talloc_asprintf(mem_ctx, "More than one account with SID: %s",
1040                                                 dom_sid_string(mem_ctx, sid));
1041                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1042         } else {
1043                 msg->dn = talloc_steal(msg, msgs[0]->dn);
1044         }
1045
1046         samdb_msg_add_delete(state->sam_ldb, mem_ctx, msg,
1047                              "privilege");
1048
1049         ret = dsdb_replace(state->sam_ldb, msg, 0);
1050         if (ret != LDB_SUCCESS) {
1051                 *error_string = talloc_asprintf(mem_ctx, "Failed to modify privilege record %s",
1052                                                 ldb_dn_get_linearized(msg->dn));
1053                 return NT_STATUS_INTERNAL_DB_CORRUPTION;
1054         }
1055
1056         return NT_STATUS_OK;
1057 }
1058
1059 static NTSTATUS libnet_samsync_ldb_fn(TALLOC_CTX *mem_ctx,
1060                                       void *private_data,
1061                                       enum netr_SamDatabaseID database,
1062                                       struct netr_DELTA_ENUM *delta,
1063                                       char **error_string)
1064 {
1065         NTSTATUS nt_status = NT_STATUS_OK;
1066         struct samsync_ldb_state *state = talloc_get_type(private_data, struct samsync_ldb_state);
1067
1068         *error_string = NULL;
1069         switch (delta->delta_type) {
1070         case NETR_DELTA_DOMAIN:
1071         {
1072                 nt_status = samsync_ldb_handle_domain(mem_ctx,
1073                                                       state,
1074                                                       database,
1075                                                       delta,
1076                                                       error_string);
1077                 break;
1078         }
1079         case NETR_DELTA_USER:
1080         {
1081                 nt_status = samsync_ldb_handle_user(mem_ctx,
1082                                                     state,
1083                                                     database,
1084                                                     delta,
1085                                                     error_string);
1086                 break;
1087         }
1088         case NETR_DELTA_DELETE_USER:
1089         {
1090                 nt_status = samsync_ldb_delete_user(mem_ctx,
1091                                                     state,
1092                                                     database,
1093                                                     delta,
1094                                                     error_string);
1095                 break;
1096         }
1097         case NETR_DELTA_GROUP:
1098         {
1099                 nt_status = samsync_ldb_handle_group(mem_ctx,
1100                                                      state,
1101                                                      database,
1102                                                      delta,
1103                                                      error_string);
1104                 break;
1105         }
1106         case NETR_DELTA_DELETE_GROUP:
1107         {
1108                 nt_status = samsync_ldb_delete_group(mem_ctx,
1109                                                      state,
1110                                                      database,
1111                                                      delta,
1112                                                      error_string);
1113                 break;
1114         }
1115         case NETR_DELTA_GROUP_MEMBER:
1116         {
1117                 nt_status = samsync_ldb_handle_group_member(mem_ctx,
1118                                                             state,
1119                                                             database,
1120                                                             delta,
1121                                                             error_string);
1122                 break;
1123         }
1124         case NETR_DELTA_ALIAS:
1125         {
1126                 nt_status = samsync_ldb_handle_alias(mem_ctx,
1127                                                      state,
1128                                                      database,
1129                                                      delta,
1130                                                      error_string);
1131                 break;
1132         }
1133         case NETR_DELTA_DELETE_ALIAS:
1134         {
1135                 nt_status = samsync_ldb_delete_alias(mem_ctx,
1136                                                      state,
1137                                                      database,
1138                                                      delta,
1139                                                      error_string);
1140                 break;
1141         }
1142         case NETR_DELTA_ALIAS_MEMBER:
1143         {
1144                 nt_status = samsync_ldb_handle_alias_member(mem_ctx,
1145                                                             state,
1146                                                             database,
1147                                                             delta,
1148                                                             error_string);
1149                 break;
1150         }
1151         case NETR_DELTA_ACCOUNT:
1152         {
1153                 nt_status = samsync_ldb_handle_account(mem_ctx,
1154                                                        state,
1155                                                        database,
1156                                                        delta,
1157                                                        error_string);
1158                 break;
1159         }
1160         case NETR_DELTA_DELETE_ACCOUNT:
1161         {
1162                 nt_status = samsync_ldb_delete_account(mem_ctx,
1163                                                        state,
1164                                                        database,
1165                                                        delta,
1166                                                        error_string);
1167                 break;
1168         }
1169         default:
1170                 /* Can't dump them all right now */
1171                 break;
1172         }
1173         if (!NT_STATUS_IS_OK(nt_status) && !*error_string) {
1174                 *error_string = talloc_asprintf(mem_ctx, "Failed to handle samsync delta: %s", nt_errstr(nt_status));
1175         }
1176         return nt_status;
1177 }
1178
1179 static NTSTATUS libnet_samsync_ldb_init(TALLOC_CTX *mem_ctx,
1180                                         void *private_data,
1181                                         struct libnet_SamSync_state *samsync_state,
1182                                         char **error_string)
1183 {
1184         struct samsync_ldb_state *state = talloc_get_type(private_data, struct samsync_ldb_state);
1185         const char *server = dcerpc_server_name(samsync_state->netlogon_pipe);
1186         char *ldap_url;
1187
1188         state->samsync_state = samsync_state;
1189
1190         ZERO_STRUCT(state->dom_sid);
1191         if (state->samsync_state->domain_sid) {
1192                 state->dom_sid[SAM_DATABASE_DOMAIN] = dom_sid_dup(state, state->samsync_state->domain_sid);
1193         }
1194
1195         state->dom_sid[SAM_DATABASE_BUILTIN] = dom_sid_parse_talloc(state, SID_BUILTIN);
1196
1197         if (state->samsync_state->realm) {
1198                 if (!server || !*server) {
1199                         /* huh?  how do we not have a server name?  */
1200                         *error_string = talloc_strdup(mem_ctx, "No DCE/RPC server name available.  How did we connect?");
1201                         return NT_STATUS_INVALID_PARAMETER;
1202                 }
1203                 ldap_url = talloc_asprintf(state, "ldap://%s", server);
1204
1205                 state->remote_ldb = ldb_wrap_connect(mem_ctx,
1206                                                      NULL,
1207                                                      state->samsync_state->machine_net_ctx->lp_ctx,
1208                                                      ldap_url,
1209                                                      NULL, state->samsync_state->machine_net_ctx->cred,
1210                                                      0);
1211                 if (!state->remote_ldb) {
1212                         *error_string = talloc_asprintf(mem_ctx, "Failed to connect to remote LDAP server at %s (used to extract additional data in SamSync replication)", ldap_url);
1213                         return NT_STATUS_NO_LOGON_SERVERS;
1214                 }
1215         } else {
1216                 state->remote_ldb = NULL;
1217         }
1218         return NT_STATUS_OK;
1219 }
1220
1221 NTSTATUS libnet_samsync_ldb(struct libnet_context *ctx, TALLOC_CTX *mem_ctx, struct libnet_samsync_ldb *r)
1222 {
1223         NTSTATUS nt_status;
1224         struct libnet_SamSync r2;
1225         struct samsync_ldb_state *state = talloc(mem_ctx, struct samsync_ldb_state);
1226
1227         if (!state) {
1228                 return NT_STATUS_NO_MEMORY;
1229         }
1230
1231         state->secrets         = NULL;
1232         state->trusted_domains = NULL;
1233
1234         state->sam_ldb         = samdb_connect(mem_ctx,
1235                                                ctx->event_ctx,
1236                                                ctx->lp_ctx,
1237                                                r->in.session_info,
1238                                                    0);
1239         if (!state->sam_ldb) {
1240                 return NT_STATUS_INTERNAL_DB_ERROR;
1241         }
1242
1243         state->pdb             = privilege_connect(mem_ctx,
1244                                                    ctx->lp_ctx);
1245         if (!state->pdb) {
1246                 return NT_STATUS_INTERNAL_DB_ERROR;
1247         }
1248
1249         r2.out.error_string    = NULL;
1250         r2.in.binding_string   = r->in.binding_string;
1251         r2.in.init_fn          = libnet_samsync_ldb_init;
1252         r2.in.delta_fn         = libnet_samsync_ldb_fn;
1253         r2.in.fn_ctx           = state;
1254         r2.in.machine_account  = NULL; /* TODO:  Create a machine account, fill this in, and the delete it */
1255         nt_status              = libnet_SamSync_netlogon(ctx, state, &r2);
1256         r->out.error_string    = r2.out.error_string;
1257         talloc_steal(mem_ctx, r->out.error_string);
1258
1259         if (!NT_STATUS_IS_OK(nt_status)) {
1260                 talloc_free(state);
1261                 return nt_status;
1262         }
1263         talloc_free(state);
1264         return nt_status;
1265 }