summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source4/dsdb/samdb/ldb_modules/acl.c34
1 files changed, 18 insertions, 16 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/acl.c b/source4/dsdb/samdb/ldb_modules/acl.c
index ec21db35b6..b8fab552e1 100644
--- a/source4/dsdb/samdb/ldb_modules/acl.c
+++ b/source4/dsdb/samdb/ldb_modules/acl.c
@@ -1072,8 +1072,24 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req)
const struct ldb_message_element *el = &msg->elements[i];
const struct dsdb_attribute *attr;
- attr = dsdb_attribute_by_lDAPDisplayName(schema,
- el->name);
+ /*
+ * This basic attribute existence check with the right errorcode
+ * is needed since this module is the first one which requests
+ * schema attribute information.
+ * The complete attribute checking is done in the
+ * "objectclass_attrs" module behind this one.
+ *
+ * NOTE: "clearTextPassword" is not defined in the schema.
+ */
+ attr = dsdb_attribute_by_lDAPDisplayName(schema, el->name);
+ if (!attr && ldb_attr_cmp("clearTextPassword", el->name) != 0) {
+ ldb_asprintf_errstring(ldb, "acl_modify: attribute '%s' "
+ "on entry '%s' was not found in the schema!",
+ req->op.mod.message->elements[i].name,
+ ldb_dn_get_linearized(req->op.mod.message->dn));
+ ret = LDB_ERR_NO_SUCH_ATTRIBUTE;
+ goto fail;
+ }
if (ldb_attr_cmp("nTSecurityDescriptor", el->name) == 0) {
uint32_t sd_flags = dsdb_request_sd_flags(req, NULL);
@@ -1150,20 +1166,6 @@ static int acl_modify(struct ldb_module *module, struct ldb_request *req)
struct object_tree *root = NULL;
struct object_tree *new_node = NULL;
- /* This basic attribute existence check with the right errorcode
- * is needed since this module is the first one which requests
- * schema attribute information.
- * The complete attribute checking is done in the
- * "objectclass_attrs" module behind this one.
- */
- if (!attr) {
- ldb_asprintf_errstring(ldb, "acl_modify: attribute '%s' on entry '%s' was not found in the schema!",
- el->name,
- ldb_dn_get_linearized(msg->dn));
- ret = LDB_ERR_NO_SUCH_ATTRIBUTE;
- goto fail;
- }
-
if (!insert_in_object_tree(tmp_ctx, guid, SEC_ADS_WRITE_PROP,
&root, &new_node)) {
talloc_free(tmp_ctx);