diff options
| author | Günther Deschner <gd@samba.org> | 2005-10-21 12:50:39 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 11:05:09 -0500 |
| commit | 0698148b44aeb471137b2f516f09fb9653085511 (patch) | |
| tree | 883b9c1c4ee307010d90ebb6a1b185bb84eed843 /source3/include | |
| parent | cd310c19cefddc799ec5f8b374bc9c5ea9dec5f1 (diff) | |
| download | samba-0698148b44aeb471137b2f516f09fb9653085511.tar.gz samba-0698148b44aeb471137b2f516f09fb9653085511.tar.bz2 samba-0698148b44aeb471137b2f516f09fb9653085511.zip | |
r11242: use LDAP bitwise machting rule when searching for groups in ADS.
This avoids that each time a full-group-dump is requested from ADS; the
bitwise match allows to only query those groups we are interested in.
The ADS LDAP server changed to RFC compliant behaviour when decoding the ldap
filter with extensible match in the latest SPs (fixes). From the patch:
/* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
* rollup-fixes:
*
* According to Section 5.1(4) of RFC 2251 if a value of a type is it's
* default value, it MUST be absent. In case of extensible matching the
* "dnattr" boolean defaults to FALSE and so it must be only be present
* when set to TRUE.
*
* When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
* filter using bitwise matching rule then a buggy AD fails to decode
* the extensible match. As a workaround set it to TRUE and thereby add
* the dnAttributes "dn" field to cope with those older AD versions.
* It should not harm and won't put any additional load on the AD since
* none of the dn components have a bitmask-attribute.
*
* Thanks to Ralf Haferkamp for input and testing */
Guenther
(This used to be commit db38ed6be607d08515920d46fb8a12f8cb4ddd6e)
Diffstat (limited to 'source3/include')
| -rw-r--r-- | source3/include/ads.h | 28 |
1 files changed, 25 insertions, 3 deletions
diff --git a/source3/include/ads.h b/source3/include/ads.h index d2eeaab4d8..decb823ea9 100644 --- a/source3/include/ads.h +++ b/source3/include/ads.h @@ -98,6 +98,10 @@ typedef void **ADS_MODLIST; #define ADS_ATTR_SFU_HOMEDIR_OID "1.2.840.113556.1.6.18.1.344" #define ADS_ATTR_SFU_SHELL_OID "1.2.840.113556.1.6.18.1.312" +/* ldap bitwise searches */ +#define ADS_LDAP_MATCHING_RULE_BIT_AND "1.2.840.113556.1.4.803" +#define ADS_LDAP_MATCHING_RULE_BIT_OR "1.2.840.113556.1.4.804" + /* UserFlags for userAccountControl */ #define UF_SCRIPT 0x00000001 #define UF_ACCOUNTDISABLE 0x00000002 @@ -186,9 +190,27 @@ typedef void **ADS_MODLIST; #define ATYPE_LOCAL_GROUP ATYPE_SECURITY_LOCAL_GROUP /* 0x20000000 536870912 */ /* groupType */ -#define GTYPE_SECURITY_BUILTIN_LOCAL_GROUP 0x80000005 /* -2147483643 */ -#define GTYPE_SECURITY_DOMAIN_LOCAL_GROUP 0x80000004 /* -2147483644 */ -#define GTYPE_SECURITY_GLOBAL_GROUP 0x80000002 /* -2147483646 */ +#define GROUP_TYPE_BUILTIN_LOCAL_GROUP 0x00000001 +#define GROUP_TYPE_ACCOUNT_GROUP 0x00000002 +#define GROUP_TYPE_RESOURCE_GROUP 0x00000004 +#define GROUP_TYPE_UNIVERSAL_GROUP 0x00000008 +#define GROUP_TYPE_APP_BASIC_GROUP 0x00000010 +#define GROUP_TYPE_APP_QUERY_GROUP 0x00000020 +#define GROUP_TYPE_SECURITY_ENABLED 0x80000000 + +#define GTYPE_SECURITY_BUILTIN_LOCAL_GROUP ( /* 0x80000005 -2147483643 */ \ + GROUP_TYPE_BUILTIN_LOCAL_GROUP| \ + GROUP_TYPE_RESOURCE_GROUP| \ + GROUP_TYPE_SECURITY_ENABLED \ + ) +#define GTYPE_SECURITY_DOMAIN_LOCAL_GROUP ( /* 0x80000004 -2147483644 */ \ + GROUP_TYPE_RESOURCE_GROUP| \ + GROUP_TYPE_SECURITY_ENABLED \ + ) +#define GTYPE_SECURITY_GLOBAL_GROUP ( /* 0x80000002 -2147483646 */ \ + GROUP_TYPE_ACCOUNT_GROUP| \ + GROUP_TYPE_SECURITY_ENABLED \ + ) #define GTYPE_DISTRIBUTION_GLOBAL_GROUP 0x00000002 /* 2 */ #define GTYPE_DISTRIBUTION_DOMAIN_LOCAL_GROUP 0x00000004 /* 4 */ #define GTYPE_DISTRIBUTION_UNIVERSAL_GROUP 0x00000008 /* 8 */ |