From 635996e97cbd401fee344c8d6e2ffd8b3cb47522 Mon Sep 17 00:00:00 2001 From: Matthias Dieter Wallnöfer Date: Wed, 6 Oct 2010 14:16:17 +0200 Subject: s4:samldb LDB module - use the new "objectclass_trigger" for add operations Additionally clean up "samldb_fill_object" which is now much easier to comprehend. --- source4/dsdb/samdb/ldb_modules/samldb.c | 175 ++++++-------------------------- 1 file changed, 33 insertions(+), 142 deletions(-) diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c index 56b2c43c28..2321600b19 100644 --- a/source4/dsdb/samdb/ldb_modules/samldb.c +++ b/source4/dsdb/samdb/ldb_modules/samldb.c @@ -192,62 +192,6 @@ static int samldb_check_sAMAccountName(struct samldb_ctx *ac) return samldb_next_step(ac); } -/* sAMAccountType handling */ - -static int samldb_check_sAMAccountType(struct samldb_ctx *ac) -{ - struct ldb_context *ldb; - unsigned int account_type; - unsigned int group_type; - unsigned int uac; - int ret; - - ldb = ldb_module_get_ctx(ac->module); - - /* make sure sAMAccountType is not specified */ - if (ldb_msg_find_element(ac->msg, "sAMAccountType") != NULL) { - ldb_asprintf_errstring(ldb, - "sAMAccountType must not be specified!"); - return LDB_ERR_UNWILLING_TO_PERFORM; - } - - if (strcmp("user", ac->type) == 0) { - uac = samdb_result_uint(ac->msg, "userAccountControl", 0); - if (uac == 0) { - ldb_asprintf_errstring(ldb, - "userAccountControl invalid!"); - return LDB_ERR_UNWILLING_TO_PERFORM; - } else { - account_type = ds_uf2atype(uac); - ret = samdb_msg_add_uint(ldb, - ac->msg, ac->msg, - "sAMAccountType", - account_type); - if (ret != LDB_SUCCESS) { - return ret; - } - } - } else if (strcmp("group", ac->type) == 0) { - group_type = samdb_result_uint(ac->msg, "groupType", 0); - if (group_type == 0) { - ldb_asprintf_errstring(ldb, - "groupType invalid!\n"); - return LDB_ERR_UNWILLING_TO_PERFORM; - } else { - account_type = ds_gtype2atype(group_type); - ret = samdb_msg_add_uint(ldb, - ac->msg, ac->msg, - "sAMAccountType", - account_type); - if (ret != LDB_SUCCESS) { - return ret; - } - } - } - - return samldb_next_step(ac); -} - /* primaryGroupID handling */ static int samldb_check_primaryGroupID(struct samldb_ctx *ac) @@ -615,51 +559,35 @@ static bool check_rodc_critical_attribute(struct ldb_message *msg) static int samldb_fill_object(struct samldb_ctx *ac) { - struct ldb_context *ldb; - struct loadparm_context *lp_ctx; - enum sid_generator sid_generator; + struct ldb_context *ldb = ldb_module_get_ctx(ac->module); int ret; - struct ldb_control *rodc_control; - struct dom_sid *sid; - - ldb = ldb_module_get_ctx(ac->module); /* Add informations for the different account types */ if (strcmp(ac->type, "user") == 0) { - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "userAccountControl", "546"); - if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "badPwdCount", "0"); - if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "codePage", "0"); - if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "countryCode", "0"); - if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "badPasswordTime", "0"); - if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "lastLogoff", "0"); - if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "lastLogon", "0"); - if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "pwdLastSet", "0"); - if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "accountExpires", "9223372036854775807"); + struct ldb_control *rodc_control = ldb_request_get_control(ac->req, + LDB_CONTROL_RODC_DCPROMO_OID); + if (rodc_control != NULL) { + /* see [MS-ADTS] 3.1.1.3.4.1.23 LDAP_SERVER_RODC_DCPROMO_OID */ + rodc_control->critical = false; + ret = samldb_add_step(ac, samldb_rodc_add); + if (ret != LDB_SUCCESS) return ret; + } + + /* check if we have a valid sAMAccountName */ + ret = samldb_add_step(ac, samldb_check_sAMAccountName); if (ret != LDB_SUCCESS) return ret; - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "logonCount", "0"); + + ret = samldb_add_step(ac, samldb_add_entry); if (ret != LDB_SUCCESS) return ret; + } else if (strcmp(ac->type, "group") == 0) { - ret = samdb_find_or_add_attribute(ldb, ac->msg, - "groupType", "-2147483646"); + /* check if we have a valid sAMAccountName */ + ret = samldb_add_step(ac, samldb_check_sAMAccountName); if (ret != LDB_SUCCESS) return ret; + + ret = samldb_add_step(ac, samldb_add_entry); + if (ret != LDB_SUCCESS) return ret; + } else if (strcmp(ac->type, "classSchema") == 0) { const struct ldb_val *rdn_value, *def_obj_cat_val; @@ -675,7 +603,6 @@ static int samldb_fill_object(struct samldb_ctx *ac) return LDB_ERR_UNWILLING_TO_PERFORM; } - rdn_value = ldb_dn_get_rdn_val(ac->msg->dn); if (!ldb_msg_find_element(ac->msg, "lDAPDisplayName")) { /* the RDN has prefix "CN" */ @@ -738,7 +665,6 @@ static int samldb_fill_object(struct samldb_ctx *ac) ret = samldb_add_step(ac, samldb_find_for_defaultObjectCategory); if (ret != LDB_SUCCESS) return ret; - return samldb_first_step(ac); } else if (strcmp(ac->type, "attributeSchema") == 0) { const struct ldb_val *rdn_value; rdn_value = ldb_dn_get_rdn_val(ac->msg->dn); @@ -783,59 +709,12 @@ static int samldb_fill_object(struct samldb_ctx *ac) ret = samldb_add_step(ac, samldb_add_entry); if (ret != LDB_SUCCESS) return ret; - return samldb_first_step(ac); } else { ldb_asprintf_errstring(ldb, "Invalid entry type!"); return LDB_ERR_OPERATIONS_ERROR; } - rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID); - if (rodc_control) { - /* see [MS-ADTS] 3.1.1.3.4.1.23 LDAP_SERVER_RODC_DCPROMO_OID */ - rodc_control->critical = false; - ret = samldb_add_step(ac, samldb_rodc_add); - if (ret != LDB_SUCCESS) return ret; - } - - /* check if we have a valid sAMAccountName */ - ret = samldb_add_step(ac, samldb_check_sAMAccountName); - if (ret != LDB_SUCCESS) return ret; - - /* check account_type/group_type */ - ret = samldb_add_step(ac, samldb_check_sAMAccountType); - if (ret != LDB_SUCCESS) return ret; - - /* check if we have a valid primary group ID */ - if (strcmp(ac->type, "user") == 0) { - ret = samldb_add_step(ac, samldb_check_primaryGroupID); - if (ret != LDB_SUCCESS) return ret; - } - - lp_ctx = talloc_get_type(ldb_get_opaque(ldb, "loadparm"), - struct loadparm_context); - - /* don't allow objectSid to be specified without the RELAX control */ - sid = samdb_result_dom_sid(ac, ac->msg, "objectSid"); - if (sid && !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) && - !dsdb_module_am_system(ac->module)) { - ldb_asprintf_errstring(ldb, "No SID may be specified in user/group creation for %s", - ldb_dn_get_linearized(ac->msg->dn)); - return LDB_ERR_UNWILLING_TO_PERFORM; - } - - if (sid == NULL) { - sid_generator = lpcfg_sid_generator(lp_ctx); - if (sid_generator == SID_GENERATOR_INTERNAL) { - ret = samldb_add_step(ac, samldb_allocate_sid); - if (ret != LDB_SUCCESS) return ret; - } - } - - /* finally proceed with adding the entry */ - ret = samldb_add_step(ac, samldb_add_entry); - if (ret != LDB_SUCCESS) return ret; - return samldb_first_step(ac); } @@ -1280,12 +1159,24 @@ static int samldb_add(struct ldb_module *module, struct ldb_request *req) if (samdb_find_attribute(ldb, ac->msg, "objectclass", "user") != NULL) { ac->type = "user"; + + ret = samldb_objectclass_trigger(ac); + if (ret != LDB_SUCCESS) { + return ret; + } + return samldb_fill_object(ac); } if (samdb_find_attribute(ldb, ac->msg, "objectclass", "group") != NULL) { ac->type = "group"; + + ret = samldb_objectclass_trigger(ac); + if (ret != LDB_SUCCESS) { + return ret; + } + return samldb_fill_object(ac); } -- cgit