diff options
| -rw-r--r-- | source4/dsdb/samdb/ldb_modules/password_hash.c | 52 |
1 files changed, 37 insertions, 15 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c index 731b8e9922..83bee2fe3e 100644 --- a/source4/dsdb/samdb/ldb_modules/password_hash.c +++ b/source4/dsdb/samdb/ldb_modules/password_hash.c @@ -98,9 +98,9 @@ struct ph_context { struct dsdb_control_password_change *change; bool pwd_reset; - bool change_status; bool hash_values; + bool userPassword; }; @@ -1686,15 +1686,18 @@ static int setup_io(struct ph_context *ac, io->u.restrictions = 0; } - ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, "userPassword", - ac->req->operation, - &io->n.cleartext_utf8, - &io->og.cleartext_utf8); - if (ret != LDB_SUCCESS) { - ldb_asprintf_errstring(ldb, - "setup_io: " - "it's only allowed to set the old password once!"); - return ret; + if (ac->userPassword) { + ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, + "userPassword", + ac->req->operation, + &io->n.cleartext_utf8, + &io->og.cleartext_utf8); + if (ret != LDB_SUCCESS) { + ldb_asprintf_errstring(ldb, + "setup_io: " + "it's only allowed to set the old password once!"); + return ret; + } } ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, "clearTextPassword", @@ -1967,7 +1970,8 @@ static int setup_io(struct ph_context *ac, } static struct ph_context *ph_init_context(struct ldb_module *module, - struct ldb_request *req) + struct ldb_request *req, + bool userPassword) { struct ldb_context *ldb; struct ph_context *ac; @@ -1982,6 +1986,7 @@ static struct ph_context *ph_init_context(struct ldb_module *module, ac->module = module; ac->req = req; + ac->userPassword = userPassword; return ac; } @@ -2227,6 +2232,7 @@ static int password_hash_add(struct ldb_module *module, struct ldb_request *req) *ntAttr, *lmAttr; int ret; struct ldb_control *bypass = NULL; + bool userPassword = true; ldb = ldb_module_get_ctx(module); @@ -2265,7 +2271,11 @@ static int password_hash_add(struct ldb_module *module, struct ldb_request *req) /* If no part of this touches the 'userPassword' OR 'clearTextPassword' * OR 'unicodePwd' OR 'dBCSPwd' we don't need to make any changes. */ - userPasswordAttr = ldb_msg_find_element(req->op.add.message, "userPassword"); + userPasswordAttr = NULL; + if (userPassword) { + userPasswordAttr = ldb_msg_find_element(req->op.add.message, + "userPassword"); + } clearTextPasswordAttr = ldb_msg_find_element(req->op.add.message, "clearTextPassword"); ntAttr = ldb_msg_find_element(req->op.add.message, "unicodePwd"); lmAttr = ldb_msg_find_element(req->op.add.message, "dBCSPwd"); @@ -2289,7 +2299,7 @@ static int password_hash_add(struct ldb_module *module, struct ldb_request *req) return ldb_next_request(module, req); } - ac = ph_init_context(module, req); + ac = ph_init_context(module, req, userPassword); if (ac == NULL) { DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb))); return ldb_operr(ldb); @@ -2327,7 +2337,9 @@ static int password_hash_add_do_add(struct ph_context *ac) } /* remove attributes that we just read into 'io' */ - ldb_msg_remove_attr(msg, "userPassword"); + if (ac->userPassword) { + ldb_msg_remove_attr(msg, "userPassword"); + } ldb_msg_remove_attr(msg, "clearTextPassword"); ldb_msg_remove_attr(msg, "unicodePwd"); ldb_msg_remove_attr(msg, "dBCSPwd"); @@ -2414,6 +2426,7 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r struct ldb_request *down_req; int ret; struct ldb_control *bypass = NULL; + bool userPassword = true; ldb = ldb_module_get_ctx(module); @@ -2455,6 +2468,10 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r * on these attributes. */ attr_cnt = 0; for (l = passwordAttrs; *l != NULL; l++) { + if ((!userPassword) && (ldb_attr_cmp(*l, "userPassword") == 0)) { + continue; + } + if (ldb_msg_find_element(req->op.mod.message, *l) != NULL) { ++attr_cnt; } @@ -2463,7 +2480,7 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r return ldb_next_request(module, req); } - ac = ph_init_context(module, req); + ac = ph_init_context(module, req, userPassword); if (!ac) { DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb))); return ldb_operr(ldb); @@ -2491,6 +2508,11 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r add_attr_cnt = 0; rep_attr_cnt = 0; for (l = passwordAttrs; *l != NULL; l++) { + if ((!ac->userPassword) && + (ldb_attr_cmp(*l, "userPassword") == 0)) { + continue; + } + while ((passwordAttr = ldb_msg_find_element(msg, *l)) != NULL) { if (LDB_FLAG_MOD_TYPE(passwordAttr->flags) == LDB_FLAG_MOD_DELETE) { ++del_attr_cnt; |