summaryrefslogtreecommitdiff
path: root/source4
diff options
context:
space:
mode:
authorNadezhda Ivanova <nivanova@samba.org>2010-09-14 10:51:14 +0300
committerNadezhda Ivanova <nivanova@samba.org>2010-09-26 15:36:09 -0700
commit3d0e36bc87bd23e3d1bff7468db2eb99531d8d87 (patch)
tree487f7578915ab0cd49e79d3f26c63fa0cb593c23 /source4
parent5ffacff5c4a4799aacf97cbc28581f8e302c145c (diff)
downloadsamba-3d0e36bc87bd23e3d1bff7468db2eb99531d8d87.tar.gz
samba-3d0e36bc87bd23e3d1bff7468db2eb99531d8d87.tar.bz2
samba-3d0e36bc87bd23e3d1bff7468db2eb99531d8d87.zip
s4-ldap: Added a control to apply the access checks on read via LDAP
Diffstat (limited to 'source4')
-rw-r--r--source4/dsdb/samdb/samdb.h3
-rw-r--r--source4/ldap_server/ldap_backend.c1
-rw-r--r--source4/libcli/ldap/ldap_controls.c2
3 files changed, 6 insertions, 0 deletions
diff --git a/source4/dsdb/samdb/samdb.h b/source4/dsdb/samdb/samdb.h
index a3d8f7952d..4a9edbae10 100644
--- a/source4/dsdb/samdb/samdb.h
+++ b/source4/dsdb/samdb/samdb.h
@@ -192,4 +192,7 @@ struct dsdb_fsmo_extended_op {
struct GUID destination_dsa_guid;
};
+/* applied access checks on LDAP reads */
+#define DSDB_CONTROL_SEARCH_APPLY_ACCESS "1.3.6.1.4.1.7165.4.3.15"
+
#endif /* __SAMDB_H__ */
diff --git a/source4/ldap_server/ldap_backend.c b/source4/ldap_server/ldap_backend.c
index 6faaa30c2f..6a518e48a3 100644
--- a/source4/ldap_server/ldap_backend.c
+++ b/source4/ldap_server/ldap_backend.c
@@ -579,6 +579,7 @@ static NTSTATUS ldapsrv_SearchRequest(struct ldapsrv_call *call)
}
}
+ ldb_request_add_control(lreq, DSDB_CONTROL_SEARCH_APPLY_ACCESS, false, NULL);
ldb_set_timeout(samdb, lreq, req->timelimit);
ldb_ret = ldb_request(samdb, lreq);
diff --git a/source4/libcli/ldap/ldap_controls.c b/source4/libcli/ldap/ldap_controls.c
index 5244975dfc..b8becb8955 100644
--- a/source4/libcli/ldap/ldap_controls.c
+++ b/source4/libcli/ldap/ldap_controls.c
@@ -1166,6 +1166,8 @@ static const struct ldap_control_handler ldap_known_controls[] = {
{ "1.3.6.1.4.1.7165.4.3.7", NULL, NULL },
/* DSDB_CONTROL_PASSWORD_CHANGE_STATUS_OID is internal only, and has no network representation */
{ "1.3.6.1.4.1.7165.4.3.8", NULL, NULL },
+/* DSDB_CONTROL_SEARCH_APPLY_ACCESS is internal only, and has no network representation */
+ { "1.3.6.1.4.1.7165.4.3.15", NULL, NULL },
/* DSDB_EXTENDED_REPLICATED_OBJECTS_OID is internal only, and has no network representation */
{ "1.3.6.1.4.1.7165.4.4.1", NULL, NULL },
{ DSDB_OPENLDAP_DEREFERENCE_CONTROL, decode_openldap_dereference, encode_openldap_dereference},