summaryrefslogtreecommitdiff
path: root/source4/dsdb
AgeCommit message (Collapse)AuthorFilesLines
2009-07-05Fix some nonempty blank linesVolker Lendecke1-78/+76
2009-07-02we can't use the unique index code for samAccountNameAndrew Tridgell2-8/+75
Using ldb unique indexes for samAccountName doesn't work with DRS as the other DC may send us a deleted record (tombstone record), which has the same samAccountName as an existing record. That would then create two records in the same partition with the same samAccountName. So we needed to put back the logic in samldb.c which explicitly checked whether a samAccountName already exists on add
2009-07-02decrypt all objects in a DRS record, not just the first oneAndrew Tridgell1-2/+5
We found this as an object came across from w2k3 with zero values, which caused a segv when we tried to decrypt the first value
2009-07-02fixed the pull of drs schema elementsAndrew Tridgell3-33/+108
The previous code incorrectly assumed that attributes such as subClassOf come over the wire as strings. In fact they come over as 32 bit integers which refer to goversIDs. We have to post-process these as it sometimes happens that a governsID comes over the wire before the record that defines what it means.
2009-07-01fixed the reference to the global_schemaAndrew Tridgell1-2/+3
2009-06-30s4:ldb Allow rootdse module to build without ldb_private.hAndrew Bartlett1-1/+2
It seems quite reasonable to allow modules to re-initialise the set of cached DNs on the ldb context. Andrew Bartlett
2009-06-30s4: dsdb Avoid using the internal ldb_private.h headerAndrew Bartlett4-117/+120
This job is not complete (the partition module remains a unfinished task), but now we do use the private ldb headers much less. Andrew Bartlett
2009-06-30s4:dsdb Explain the parsing steps for userPrincipalName cracknames callsAndrew Bartlett1-0/+4
2009-06-29Correct some typos in the LDB partition moduleMatthias Dieter Wallnöfer1-5/+5
2009-06-29SAMDB: Don't check for "sAMAccountName" twiceMatthias Dieter Wallnöfer1-1/+0
2009-06-29Enhancement of "simple ldap map" with "systemFlags" attributeMatthias Dieter Wallnöfer1-0/+22
Enhance the simple ldap map to support also the "systemFlags" attribute in the correct way.
2009-06-19Fixed some uninitialised variablesMatthias Dieter Wallnöfer1-8/+5
I tried hard to not change the program logic. Should fix bug #6439.
2009-06-19Correct handling of 32-bit integer attributes in SAMBA 4Matthias Dieter Wallnöfer2-13/+28
- LDB handles now all 32-bit integer attributes correctly (also with overflows) according to the schema - LDAP backends handle the attributes "groupType", "userAccountControl" and "sAMAccountType" correctly. This handling doesn't yet use the schema but the conversion file "simple_ldap.map.c" which contains them hardcoded. Did also a refactoring of the conversion function there. - Bug #6136 should be gone
2009-06-18dsdb: Fix build against system ldb.Jelmer Vernooij3-3/+3
2009-06-18Fix build with system LDB.Jelmer Vernooij1-1/+1
2009-06-12s4:heimdal: import lorikeet-heimdal-200906080040 (commit ↵Andrew Bartlett1-9/+9
904d0124b46eed7a8ad6e5b73e892ff34b6865ba) Also including the supporting changes required to pass make test A number of heimdal functions and constants have changed since we last imported a tree (for the better, but inconvenient for us). Andrew Bartlett
2009-06-06Fix some nonempty blank linesVolker Lendecke1-41/+37
2009-06-02Fix more unresolved symbols.Jelmer Vernooij2-10/+11
2009-06-02Fix dependencies when using shared libraries.Jelmer Vernooij1-1/+1
2009-06-01we don't need the unique checks in the samldb code nowAndrew Tridgell1-162/+2
These attributes now use the unique indexing flag
2009-06-01mark samAccountName, objectGUID and objectSID as unique indexedAndrew Tridgell1-0/+20
2009-05-28Merge branch 'master' of ssh://git.samba.org/data/git/sambaAndrew Tridgell2-2/+2
2009-05-28enable one-level indexing in sam.ldbAndrew Tridgell1-0/+5
2009-05-26s4:ldb_modules: Correct typos.Andrew Kroeger2-2/+2
2009-05-25fixed interpretation of ACB_PWNOTREQAndrew Tridgell1-1/+6
This bit actually means that we should ignore the minimum password length field for this user. It doesn't mean that the password should be seen as empty
2009-05-14dsdb:schema Use str_list_make_empty() to create an empty listAndrew Bartlett1-5/+5
2009-04-22s4:ldb: fix extrasemi compile warningBjörn Jacke1-1/+1
2009-04-22s4:ldb: do talloc_free and return NULL when we have no matches to returnBjörn Jacke1-0/+4
2009-04-14Move DRSUAPI per-attribute decryption into a common fileAndrew Bartlett2-159/+4
This file (contining metze's decryption routines) is now also be used by Samba3's DRSUAPI implementation Andrew Bartlett
2009-04-09make the memory usage of possibleInferiors much more efficientAndrew Tridgell1-20/+31
2009-04-09fixed the possibleInferiors calculation so it now passes the testAndrew Tridgell2-27/+28
We are probably still using more memory here than we need to. That needs to be looked at.
2009-04-09slightly nicer output in our possibleInferiors test codeAndrew Tridgell1-2/+2
2009-04-09hook the new possibleInferiors calculation into the schemaAndrew Tridgell1-14/+77
We now generate possibleInferiors at startup, and return it when requested
2009-04-08Make the schema_inferiors generation code to compileAndrew Bartlett4-70/+101
Sadly it still segfaults at this stage Andrew Bartlett
2009-04-07first cut at a C version of the possible inferiors codeAndrew Tridgell1-0/+172
2009-04-03s4:schema Don't free mem_ctx before it is initilisedAndrew Bartlett1-1/+0
2009-04-02major upgrade to the ldb attribute handlingAndrew Tridgell5-115/+325
This is all working towards supporting the full WSPP schema without a major performance penalty. We now use binary searches when looking up classes and attributes. We also avoid the loop loading the attributes into ldb, by adding a hook to override the ldb attribute search function in a module. The attributes can thus be loaded once, and then saved as part of the global schema. Also added support for a few more key attribute syntaxes, as needed for the full schema.
2009-03-31possibleInferiors is a generated attribute - we can't pull it over DRSAndrew Tridgell1-2/+0
or from ldb
2009-03-31Merge branch 'master' into wspp-schemaAndrew Tridgell1-14/+49
2009-03-31use the prepare_commit op in the partition codeAndrew Tridgell1-14/+49
This makes multi-partition ldb's much safer
2009-03-31Merge branch 'master' into wspp-schemaAndrew Tridgell1-0/+246
2009-03-27added a --wspp optionAndrew Tridgell1-4/+7
Adding --wspp to possibleInferiors.py forces it to use the WSPP documented algorithm, which doesn't match windows behaviour
2009-03-26fixed possibleinferiors.py so it matches windows behaviourAndrew Tridgell1-39/+127
This test code builds the possibleInferiors for every class in the schema on a target machine, and compares it to the servers possibleInferiors attribute. The MS-ADTS spec describes how to calculate possibleInferiors for a object, but it seems to have some bugs. The spec says that we need to use AUXCLASSES, and it does not mention the use of the SUBCLASS tree. In trying to match windows behaviour, I found that I needed to ignore the AUXCLASSES and build a SUBCLASSES tree.
2009-03-24the start of a possibleInferiors test suiteAndrew Tridgell1-0/+155
we haven't implemented possibleInferiors yet. This test is meant to help us understand how it works. It tries to construct possibleInferiors via searches on other attributes, and compares it to the servers constructed possibleInferiors attribute for each class in the servers schema. see [MS-ADTS] section 3.1.1.4.5.21
2009-03-20Merge branch 'master' of ssh://git.samba.org/data/git/samba into wspp-schemaAndrew Bartlett2-6/+86
2009-03-17added support for parentGUIDAndrew Tridgell1-5/+84
This is made up of 4 parts: 1) change our schema to include the parentGUID attribute type 2) in the add hook in the objectclass module, get the objectGUID of the parent and add it to the message as parentGUID 3) in the rename hook in the objectclass module, get the objectGUID of the new parent, and insert an async modify request after the renmam is done 4) added a simple test suite
2009-03-16s4:password_hash Only store the LM hash if 'lanman auth = yes'Andrew Bartlett1-1/+2
The clients that do only lanman auth are on their way out, the passwords are case insensitive, it does not support unicode and we should not store such a poor hash of the password if we can avoid it. Andrew Bartlett
2009-03-11s4:schema Don't rely on objectCategory 'magic' when loading the schemaAndrew Bartlett1-2/+2
The short-to-long name canonicalisation rules use the schema, so clearly they won't work when loading it. Andrew Bartlett
2009-03-06Load the schema with a more efficient single searchAndrew Bartlett1-93/+15
This search uses the index, and is not recursive, so should avoid the major performance problem with the current sorted schema load. The ad2oLschema code (recently moved to provision-backend) no longer needs the schema to be sorted. Andrew Bartlett
2009-03-06Sort output of schema for OpenLDAP during conversionAndrew Bartlett1-98/+132
This avoids the need to assume that the schema is sorted on load, which happens more often and is a major performace issue in the Samba4's use of ldb. Andrew Bartlett