s4:dsdb Don't reload the schema against OpenLDAP backend

The schema should be considered read-only when we are using the OL
backend, as we can't update the backend schema in real time anyway.

Andrew Bartlett

1 files changed, 9 insertions, 3 deletions

diff --git a/source4/dsdb/samdb/ldb_modules/schema_load.c b/source4/dsdb/samdb/ldb_modules/schema_load.c
index 15420181ba..28c02099d3 100644
--- a/source4/dsdb/samdb/ldb_modules/schema_load.c
+++ b/source4/dsdb/samdb/ldb_modules/schema_load.c
@@ -225,9 +225,15 @@ static int dsdb_schema_from_db(struct ldb_module *module, struct ldb_dn *schema_
 	}
 
 	(*schema)->refresh_in_progress = true;
-	(*schema)->refresh_fn = dsdb_schema_refresh;
-	(*schema)->loaded_from_module = module;
-	(*schema)->loaded_usn = current_usn;
+
+	/* If we have the readOnlySchema opaque, then don't check for
+	 * runtime schema updates, as they are not permitted (we would
+	 * have to update the backend server schema too */
+	if (!ldb_get_opaque(ldb, "readOnlySchema")) {
+		(*schema)->refresh_fn = dsdb_schema_refresh;
+		(*schema)->loaded_from_module = module;
+		(*schema)->loaded_usn = current_usn;
+	}
 
 	/* "dsdb_set_schema()" steals schema into the ldb_context */
 	ret = dsdb_set_schema(ldb, (*schema));