summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source4/dsdb/samdb/ldb_modules/password_hash.c52
1 files changed, 37 insertions, 15 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/password_hash.c b/source4/dsdb/samdb/ldb_modules/password_hash.c
index 731b8e9922..83bee2fe3e 100644
--- a/source4/dsdb/samdb/ldb_modules/password_hash.c
+++ b/source4/dsdb/samdb/ldb_modules/password_hash.c
@@ -98,9 +98,9 @@ struct ph_context {
struct dsdb_control_password_change *change;
bool pwd_reset;
-
bool change_status;
bool hash_values;
+ bool userPassword;
};
@@ -1686,15 +1686,18 @@ static int setup_io(struct ph_context *ac,
io->u.restrictions = 0;
}
- ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, "userPassword",
- ac->req->operation,
- &io->n.cleartext_utf8,
- &io->og.cleartext_utf8);
- if (ret != LDB_SUCCESS) {
- ldb_asprintf_errstring(ldb,
- "setup_io: "
- "it's only allowed to set the old password once!");
- return ret;
+ if (ac->userPassword) {
+ ret = samdb_msg_find_old_and_new_ldb_val(orig_msg,
+ "userPassword",
+ ac->req->operation,
+ &io->n.cleartext_utf8,
+ &io->og.cleartext_utf8);
+ if (ret != LDB_SUCCESS) {
+ ldb_asprintf_errstring(ldb,
+ "setup_io: "
+ "it's only allowed to set the old password once!");
+ return ret;
+ }
}
ret = samdb_msg_find_old_and_new_ldb_val(orig_msg, "clearTextPassword",
@@ -1967,7 +1970,8 @@ static int setup_io(struct ph_context *ac,
}
static struct ph_context *ph_init_context(struct ldb_module *module,
- struct ldb_request *req)
+ struct ldb_request *req,
+ bool userPassword)
{
struct ldb_context *ldb;
struct ph_context *ac;
@@ -1982,6 +1986,7 @@ static struct ph_context *ph_init_context(struct ldb_module *module,
ac->module = module;
ac->req = req;
+ ac->userPassword = userPassword;
return ac;
}
@@ -2227,6 +2232,7 @@ static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
*ntAttr, *lmAttr;
int ret;
struct ldb_control *bypass = NULL;
+ bool userPassword = true;
ldb = ldb_module_get_ctx(module);
@@ -2265,7 +2271,11 @@ static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
/* If no part of this touches the 'userPassword' OR 'clearTextPassword'
* OR 'unicodePwd' OR 'dBCSPwd' we don't need to make any changes. */
- userPasswordAttr = ldb_msg_find_element(req->op.add.message, "userPassword");
+ userPasswordAttr = NULL;
+ if (userPassword) {
+ userPasswordAttr = ldb_msg_find_element(req->op.add.message,
+ "userPassword");
+ }
clearTextPasswordAttr = ldb_msg_find_element(req->op.add.message, "clearTextPassword");
ntAttr = ldb_msg_find_element(req->op.add.message, "unicodePwd");
lmAttr = ldb_msg_find_element(req->op.add.message, "dBCSPwd");
@@ -2289,7 +2299,7 @@ static int password_hash_add(struct ldb_module *module, struct ldb_request *req)
return ldb_next_request(module, req);
}
- ac = ph_init_context(module, req);
+ ac = ph_init_context(module, req, userPassword);
if (ac == NULL) {
DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
return ldb_operr(ldb);
@@ -2327,7 +2337,9 @@ static int password_hash_add_do_add(struct ph_context *ac)
}
/* remove attributes that we just read into 'io' */
- ldb_msg_remove_attr(msg, "userPassword");
+ if (ac->userPassword) {
+ ldb_msg_remove_attr(msg, "userPassword");
+ }
ldb_msg_remove_attr(msg, "clearTextPassword");
ldb_msg_remove_attr(msg, "unicodePwd");
ldb_msg_remove_attr(msg, "dBCSPwd");
@@ -2414,6 +2426,7 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r
struct ldb_request *down_req;
int ret;
struct ldb_control *bypass = NULL;
+ bool userPassword = true;
ldb = ldb_module_get_ctx(module);
@@ -2455,6 +2468,10 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r
* on these attributes. */
attr_cnt = 0;
for (l = passwordAttrs; *l != NULL; l++) {
+ if ((!userPassword) && (ldb_attr_cmp(*l, "userPassword") == 0)) {
+ continue;
+ }
+
if (ldb_msg_find_element(req->op.mod.message, *l) != NULL) {
++attr_cnt;
}
@@ -2463,7 +2480,7 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r
return ldb_next_request(module, req);
}
- ac = ph_init_context(module, req);
+ ac = ph_init_context(module, req, userPassword);
if (!ac) {
DEBUG(0,(__location__ ": %s\n", ldb_errstring(ldb)));
return ldb_operr(ldb);
@@ -2491,6 +2508,11 @@ static int password_hash_modify(struct ldb_module *module, struct ldb_request *r
add_attr_cnt = 0;
rep_attr_cnt = 0;
for (l = passwordAttrs; *l != NULL; l++) {
+ if ((!ac->userPassword) &&
+ (ldb_attr_cmp(*l, "userPassword") == 0)) {
+ continue;
+ }
+
while ((passwordAttr = ldb_msg_find_element(msg, *l)) != NULL) {
if (LDB_FLAG_MOD_TYPE(passwordAttr->flags) == LDB_FLAG_MOD_DELETE) {
++del_attr_cnt;