diff options
| author | Andrew Tridgell <tridge@samba.org> | 2010-08-17 11:13:59 +1000 |
|---|---|---|
| committer | Andrew Tridgell <tridge@samba.org> | 2010-08-17 21:21:50 +1000 |
| commit | 527042f78bc1672ca9a2f766b232165fb2a81d9f (patch) | |
| tree | 59abc0f592af198173e1fc2cc7322f79e839b5de /source4/dsdb | |
| parent | 974279b67de6aa346f961b4546bfa556b4ab7ece (diff) | |
| download | samba-527042f78bc1672ca9a2f766b232165fb2a81d9f.tar.gz samba-527042f78bc1672ca9a2f766b232165fb2a81d9f.tar.bz2 samba-527042f78bc1672ca9a2f766b232165fb2a81d9f.zip | |
s4-dsdb: support LDB_CONTROL_RODC_DCPROMO_OID for nTDSDSA add
this control disables the system only check for nTDSDSA add operations
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4/dsdb')
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/objectclass.c | 25 |
1 files changed, 24 insertions, 1 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/objectclass.c b/source4/dsdb/samdb/ldb_modules/objectclass.c index 548d51e614..cd45963f37 100644 --- a/source4/dsdb/samdb/ldb_modules/objectclass.c +++ b/source4/dsdb/samdb/ldb_modules/objectclass.c @@ -432,6 +432,27 @@ static int objectclass_add(struct ldb_module *module, struct ldb_request *req) return ldb_next_request(ac->module, search_req); } + +/* + check if this is a special RODC nTDSDSA add + */ +static bool check_rodc_ntdsdsa_add(struct oc_context *ac, + const struct dsdb_class *objectclass) +{ + struct ldb_control *rodc_control; + + if (strcasecmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) { + return false; + } + rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID); + if (!rodc_control) { + return false; + } + + rodc_control->critical = false; + return true; +} + static int objectclass_do_add(struct oc_context *ac) { struct ldb_context *ldb; @@ -566,7 +587,9 @@ static int objectclass_do_add(struct oc_context *ac) return LDB_ERR_NAMING_VIOLATION; } - if (objectclass->systemOnly && !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) { + if (objectclass->systemOnly && + !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) && + !check_rodc_ntdsdsa_add(ac, objectclass)) { ldb_asprintf_errstring(ldb, "objectClass %s is systemOnly, rejecting creation of %s", objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)); return LDB_ERR_UNWILLING_TO_PERFORM; |