Age | Commit message (Collapse) | Author | Files | Lines |
|
|
|
Using ldb unique indexes for samAccountName doesn't work with DRS as
the other DC may send us a deleted record (tombstone record), which
has the same samAccountName as an existing record. That would then
create two records in the same partition with the same samAccountName.
So we needed to put back the logic in samldb.c which explicitly
checked whether a samAccountName already exists on add
|
|
The previous code incorrectly assumed that attributes such as
subClassOf come over the wire as strings. In fact they come over as 32
bit integers which refer to goversIDs. We have to post-process these
as it sometimes happens that a governsID comes over the wire before
the record that defines what it means.
|
|
|
|
I tried hard to not change the program logic. Should fix bug #6439.
|
|
- LDB handles now all 32-bit integer attributes correctly (also with overflows)
according to the schema
- LDAP backends handle the attributes "groupType", "userAccountControl" and
"sAMAccountType" correctly. This handling doesn't yet use the schema but
the conversion file "simple_ldap.map.c" which contains them hardcoded.
Did also a refactoring of the conversion function there.
- Bug #6136 should be gone
|
|
|
|
|
|
|
|
|
|
|
|
We are probably still using more memory here than we need to. That
needs to be looked at.
|
|
Sadly it still segfaults at this stage
Andrew Bartlett
|
|
|
|
|
|
This is all working towards supporting the full WSPP schema without a
major performance penalty.
We now use binary searches when looking up classes and attributes. We
also avoid the loop loading the attributes into ldb, by adding a hook
to override the ldb attribute search function in a module. The
attributes can thus be loaded once, and then saved as part of the
global schema.
Also added support for a few more key attribute syntaxes, as needed
for the full schema.
|
|
or from ldb
|
|
The short-to-long name canonicalisation rules use the schema, so
clearly they won't work when loading it.
Andrew Bartlett
|
|
This search uses the index, and is not recursive, so should avoid the
major performance problem with the current sorted schema load.
The ad2oLschema code (recently moved to provision-backend) no longer
needs the schema to be sorted.
Andrew Bartlett
|
|
This avoids the need to assume that the schema is sorted on load,
which happens more often and is a major performace issue in the
Samba4's use of ldb.
Andrew Bartlett
|
|
This removes a level of indirection via external binaries in the
provision-backend code, and also makes better use of our internal code
for loading schema from an LDIF file.
Remaining to do: Sort the output again, as the load from LDIF is
unsorted (also needed because the normal LDB load from sorted input is too slow
anyway, and is only needed here).
Andrew Bartlett
|
|
This includes things such as allowed attributes, which were not
populated into the schema structure before.
Andrew Bartlett
|
|
|
|
consistency with Samba 3.
|
|
do not reference it from ldb.h
|
|
metze
|
|
The only 2 modules escaping the rule so far are rootdse and partitions
|
|
|
|
This matches the way we work with DN+Binary. We need this for the
OpenLDAP backend.
Andrew Bartlett
|
|
Until the extended DN work was compleated, there was no way to store
the additional metadata.
Andrew Bartlett
|
|
This should fix the OpenLDAP backend
|
|
metze
|
|
metze
|
|
This makes clear there's an value stored in the schema,
as they can be '0'.
metze
|
|
syntax is already known
metze
|
|
metze
|
|
|
|
make them wrappers around convert_string{,talloc}_convenience().
|
|
|
|
3.
|
|
|
|
This is not permitted in the AD aggregate schema, and more trouble
than it is worth in the OpenLDAP schema due to escaping issues.
Andrew Bartlett
|
|
A dITConentRules attribute (unlike objectClasses) must not contain a
'SUP'.
The ADSI layer in Windows would download the whole schema, and
validate it. Thanks to the team at Microsoft for very long debugging
session to find this.
Andrew Bartlett
|
|
The previous ldb_search() interface made it way too easy to leak results,
and being able to use a printf-like expression turns to be really useful.
|
|
This also tries to simplify the logic in the schema -> @ATTRIBUTES and
@INDEXES code.
Andrew Bartlett
(This used to be commit a383b8bf88a5681f9c9c6839ba645c872a735051)
|
|
I think it is just too complex and error prone to init and cancel
transactions during the module init code. Instead, this isn't prone
to races as it will always achieve a steady state (eventually), and
most cases will never do the write.
Andrew Bartlett
(This used to be commit d60977cc7f89f89f34187f310c91d1ab7db6ccf2)
|
|
I'm not sure if this fixes bug #5713, as this is not consistantly
reproducably on my equipment.
Andrew Bartlett
(This used to be commit 02d6645efc84179efd652dd29ab32f62ae310147)
|
|
(It instead ensured that only 'top' had a SUP keyword)
This clearly shows that 937b466266256d26d02cf8d48e72a26272fe8627 was
not a full or correct fix, but despite this I can no longer reproduce
the issue. Further investigation is required.
Andrew Bartlett
(This used to be commit 95a9e9b6b84866cd300b1d19915627c6718b4dde)
|
|
This bug is entitled 'Schema patch breaks interoperability with
Microsoft MMC consoles.', and it does so very spectacularly.
The issue is that we would include an entry:
objectClasses: ( 2.5.6.0 NAME 'top' SUP top ABSTRACT..
The MMC Active Directory Users and Computers snap in presumably
objected to the 'loop' this would present. The fixed entry is:
objectClasses: ( 2.5.6.0 NAME 'top' ABSTRACT
Thanks to Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de> for his
persistance in getting me to look at this.
Andrew Bartlett
(This used to be commit 937b466266256d26d02cf8d48e72a26272fe8627)
|
|
Something in the search stack adds a distinguisedName record, which
isn't in the message we generate. So we compare, fail and rewrite the
record - every time ldb starts up...
Andrew Bartlett
(This used to be commit 44775d1ed4a4b8edc66a06e2b3710aba6a0dd019)
|