svn commit: samba r21135 - in branches/SAMBA_4_0/source:
auth/credentials dsdb/samdb/ldb_modules scripting/ejs
scripting/libjs setup
abartlet at samba.org
abartlet at samba.org
Sun Feb 4 07:17:04 GMT 2007
Author: abartlet
Date: 2007-02-04 07:17:03 +0000 (Sun, 04 Feb 2007)
New Revision: 21135
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=21135
Log:
Instead of having hooks to update keytabs as an explicit thing, update
them as a hook on ldb modify, via a module.
This should allow the secrets.ldb to be edited by the admin, and to
have things update in the on-disk keytab just as an in-memory keytab
would.
This isn't really a dsdb plugin, but I don't have any other good ideas
about where to put it.
Andrew Bartlett
Added:
branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/update_keytab.c
branches/SAMBA_4_0/source/setup/secrets_init.ldif
Modified:
branches/SAMBA_4_0/source/auth/credentials/credentials.c
branches/SAMBA_4_0/source/auth/credentials/credentials_files.c
branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/config.mk
branches/SAMBA_4_0/source/scripting/ejs/smbcalls_creds.c
branches/SAMBA_4_0/source/scripting/libjs/provision.js
branches/SAMBA_4_0/source/setup/secrets.ldif
Changeset:
Modified: branches/SAMBA_4_0/source/auth/credentials/credentials.c
===================================================================
--- branches/SAMBA_4_0/source/auth/credentials/credentials.c 2007-02-03 17:46:32 UTC (rev 21134)
+++ branches/SAMBA_4_0/source/auth/credentials/credentials.c 2007-02-04 07:17:03 UTC (rev 21135)
@@ -349,8 +349,12 @@
{
if (obtained >= cred->password_obtained) {
cli_credentials_set_password(cred, NULL, obtained);
- cred->nt_hash = talloc(cred, struct samr_Password);
- *cred->nt_hash = *nt_hash;
+ if (nt_hash) {
+ cred->nt_hash = talloc(cred, struct samr_Password);
+ *cred->nt_hash = *nt_hash;
+ } else {
+ cred->nt_hash = NULL;
+ }
return True;
}
Modified: branches/SAMBA_4_0/source/auth/credentials/credentials_files.c
===================================================================
--- branches/SAMBA_4_0/source/auth/credentials/credentials_files.c 2007-02-03 17:46:32 UTC (rev 21134)
+++ branches/SAMBA_4_0/source/auth/credentials/credentials_files.c 2007-02-04 07:17:03 UTC (rev 21135)
@@ -169,12 +169,12 @@
* @retval NTSTATUS error detailing any failure
*/
NTSTATUS cli_credentials_set_secrets(struct cli_credentials *cred,
+ struct ldb_context *ldb,
const char *base,
const char *filter)
{
TALLOC_CTX *mem_ctx;
- struct ldb_context *ldb;
int ldb_ret;
struct ldb_message **msgs;
const char *attrs[] = {
@@ -209,13 +209,15 @@
mem_ctx = talloc_named(cred, 0, "cli_credentials fetch machine password");
- /* Local secrets are stored in secrets.ldb */
- ldb = secrets_db_connect(mem_ctx);
if (!ldb) {
- /* set anonymous as the fallback, if the machine account won't work */
- cli_credentials_set_anonymous(cred);
- DEBUG(1, ("Could not open secrets.ldb\n"));
- return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+ /* Local secrets are stored in secrets.ldb */
+ ldb = secrets_db_connect(mem_ctx);
+ if (!ldb) {
+ /* set anonymous as the fallback, if the machine account won't work */
+ cli_credentials_set_anonymous(cred);
+ DEBUG(1, ("Could not open secrets.ldb\n"));
+ return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
+ }
}
/* search for the secret record */
@@ -327,7 +329,7 @@
cred->machine_account_pending = False;
filter = talloc_asprintf(cred, SECRETS_PRIMARY_DOMAIN_FILTER,
cli_credentials_get_domain(cred));
- return cli_credentials_set_secrets(cred, SECRETS_PRIMARY_DOMAIN_DN,
+ return cli_credentials_set_secrets(cred, NULL, SECRETS_PRIMARY_DOMAIN_DN,
filter);
}
@@ -347,7 +349,7 @@
filter = talloc_asprintf(cred, SECRETS_KRBTGT_SEARCH,
cli_credentials_get_realm(cred),
cli_credentials_get_domain(cred));
- return cli_credentials_set_secrets(cred, SECRETS_PRINCIPALS_DN,
+ return cli_credentials_set_secrets(cred, NULL, SECRETS_PRINCIPALS_DN,
filter);
}
@@ -369,7 +371,7 @@
cli_credentials_get_realm(cred),
cli_credentials_get_domain(cred),
serviceprincipal);
- return cli_credentials_set_secrets(cred, SECRETS_PRINCIPALS_DN,
+ return cli_credentials_set_secrets(cred, NULL, SECRETS_PRINCIPALS_DN,
filter);
}
@@ -388,66 +390,3 @@
}
-NTSTATUS cli_credentials_update_all_keytabs(TALLOC_CTX *parent_ctx)
-{
- TALLOC_CTX *mem_ctx;
- int ldb_ret;
- struct ldb_context *ldb;
- struct ldb_message **msgs;
- const char *attrs[] = { NULL };
- struct cli_credentials *creds;
- const char *filter;
- NTSTATUS status;
- int i, ret;
-
- mem_ctx = talloc_new(parent_ctx);
- if (!mem_ctx) {
- return NT_STATUS_NO_MEMORY;
- }
-
- /* Local secrets are stored in secrets.ldb */
- ldb = secrets_db_connect(mem_ctx);
- if (!ldb) {
- DEBUG(1, ("Could not open secrets.ldb\n"));
- talloc_free(mem_ctx);
- return NT_STATUS_ACCESS_DENIED;
- }
-
- /* search for the secret record, but only of things we can
- * actually update */
- ldb_ret = gendb_search(ldb,
- mem_ctx, NULL,
- &msgs, attrs,
- "(&(objectClass=kerberosSecret)(|(secret=*)(ntPwdHash=*)))");
- if (ldb_ret == -1) {
- DEBUG(1, ("Error looking for kerberos type secrets to push into a keytab:: %s", ldb_errstring(ldb)));
- talloc_free(mem_ctx);
- return NT_STATUS_INTERNAL_DB_CORRUPTION;
- }
-
- for (i=0; i < ldb_ret; i++) {
- /* Make a credentials structure from it */
- creds = cli_credentials_init(mem_ctx);
- if (!creds) {
- DEBUG(1, ("cli_credentials_init failed!"));
- talloc_free(mem_ctx);
- return NT_STATUS_NO_MEMORY;
- }
- cli_credentials_set_conf(creds);
- filter = talloc_asprintf(mem_ctx, "dn=%s", ldb_dn_get_linearized(msgs[i]->dn));
- status = cli_credentials_set_secrets(creds, NULL, filter);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to read secrets for keytab update for %s\n",
- filter));
- continue;
- }
- ret = cli_credentials_update_keytab(creds);
- if (ret != 0) {
- DEBUG(1, ("Failed to update keytab for %s\n",
- filter));
- continue;
- }
- }
- return NT_STATUS_OK;
-}
-
Modified: branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/config.mk
===================================================================
--- branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/config.mk 2007-02-03 17:46:32 UTC (rev 21134)
+++ branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/config.mk 2007-02-04 07:17:03 UTC (rev 21135)
@@ -133,8 +133,7 @@
SUBSYSTEM = ldb
INIT_FUNCTION = password_hash_module_init
OBJ_FILES = password_hash.o
-PUBLIC_DEPENDENCIES = HEIMDAL_KRB5
-PRIVATE_DEPENDENCIES = HEIMDAL_HDB_KEYS LIBTALLOC
+PRIVATE_DEPENDENCIES = HEIMDAL_HDB_KEYS LIBTALLOC HEIMDAL_KRB5
#
# End MODULE ldb_password_hash
################################################
@@ -212,3 +211,16 @@
# End MODULE ldb_schema
################################################
+################################################
+# Start MODULE ldb_update_kt
+[MODULE::ldb_update_kt]
+SUBSYSTEM = ldb
+PRIVATE_DEPENDENCIES = LIBTALLOC CREDENTIALS_KRB5
+#Also depends on credentials, but that would loop
+INIT_FUNCTION = ldb_update_kt_init
+OBJ_FILES = \
+ update_keytab.o
+#
+# End MODULE ldb_update_kt
+################################################
+
Added: branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/update_keytab.c
===================================================================
--- branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/update_keytab.c 2007-02-03 17:46:32 UTC (rev 21134)
+++ branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/update_keytab.c 2007-02-04 07:17:03 UTC (rev 21135)
@@ -0,0 +1,189 @@
+/*
+ ldb database library
+
+ Copyright (C) Andrew Bartlett <abartlet at samba.org> 2007
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 2 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program; if not, write to the Free Software
+ Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+*/
+
+/*
+ * Name: ldb
+ *
+ * Component: ldb update_keytabs module
+ *
+ * Description: Update keytabs whenever their matching secret record changes
+ *
+ * Author: Andrew Bartlett
+ */
+
+#include "includes.h"
+#include "ldb/include/includes.h"
+#include "auth/credentials/credentials.h"
+#include "auth/credentials/credentials_krb5.h"
+#include "system/kerberos.h"
+
+struct dn_list {
+ struct cli_credentials *creds;
+ struct dn_list *prev, *next;
+};
+
+struct update_kt_private {
+ struct dn_list *changed_dns;
+};
+
+static int add_modified(struct ldb_module *module, struct ldb_dn *dn, BOOL delete) {
+ struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
+ struct dn_list *item = talloc(data->changed_dns? (void *)data->changed_dns: (void *)data, struct dn_list);
+ char *filter;
+ NTSTATUS status;
+ if (!item) {
+ ldb_oom(module->ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ item->creds = cli_credentials_init(item);
+ if (!item->creds) {
+ DEBUG(1, ("cli_credentials_init failed!"));
+ ldb_oom(module->ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ cli_credentials_set_conf(item->creds);
+ filter = talloc_asprintf(item, "(&(&(objectClass=kerberosSecret)(&(privateKeytab=*)(|(secret=*)(ntPwdHash=*))))(dn=%s))",
+ ldb_dn_get_linearized(dn));
+ status = cli_credentials_set_secrets(item->creds, module->ldb, NULL, filter);
+ talloc_free(filter);
+ if (NT_STATUS_IS_OK(status)) {
+ if (delete) {
+ /* Ensure we don't helpfully keep an old keytab entry */
+ cli_credentials_set_kvno(item->creds, cli_credentials_get_kvno(item->creds)+2);
+ /* Wipe passwords */
+ cli_credentials_set_nt_hash(item->creds, NULL,
+ CRED_SPECIFIED);
+ }
+ DLIST_ADD_END(data->changed_dns, item, struct dn_list *);
+ }
+ return LDB_SUCCESS;
+}
+
+/* add */
+static int update_kt_add(struct ldb_module *module, struct ldb_request *req)
+{
+ int ret;
+ ret = ldb_next_request(module, req);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return add_modified(module, req->op.add.message->dn, False);
+}
+
+/* modify */
+static int update_kt_modify(struct ldb_module *module, struct ldb_request *req)
+{
+ int ret;
+ ret = ldb_next_request(module, req);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return add_modified(module, req->op.mod.message->dn, False);
+}
+
+/* delete */
+static int update_kt_delete(struct ldb_module *module, struct ldb_request *req)
+{
+ int ret;
+ /* Before we delete it, record the details */
+ ret = add_modified(module, req->op.del.dn, True);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return ldb_next_request(module, req);
+}
+
+/* rename */
+static int update_kt_rename(struct ldb_module *module, struct ldb_request *req)
+{
+ int ret;
+ ret = ldb_next_request(module, req);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ return add_modified(module, req->op.rename.newdn, False);
+}
+
+/* end a transaction */
+static int update_kt_end_trans(struct ldb_module *module)
+{
+ struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
+
+ struct dn_list *p;
+ for (p=data->changed_dns; p; p = p->next) {
+ int kret;
+ kret = cli_credentials_update_keytab(p->creds);
+ if (kret != 0) {
+ talloc_free(data->changed_dns);
+ data->changed_dns = NULL;
+ ldb_asprintf_errstring(module->ldb, "Failed to update keytab: %s", error_message(kret));
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+ }
+
+ talloc_free(data->changed_dns);
+ data->changed_dns = NULL;
+ return ldb_next_end_trans(module);
+}
+
+/* end a transaction */
+static int update_kt_del_trans(struct ldb_module *module)
+{
+ struct update_kt_private *data = talloc_get_type(module->private_data, struct update_kt_private);
+
+ talloc_free(data->changed_dns);
+ data->changed_dns = NULL;
+
+ return ldb_next_end_trans(module);
+}
+
+static int update_kt_init(struct ldb_module *module)
+{
+ struct update_kt_private *data;
+
+ data = talloc(module, struct update_kt_private);
+ if (data == NULL) {
+ ldb_oom(module->ldb);
+ return LDB_ERR_OPERATIONS_ERROR;
+ }
+
+ module->private_data = data;
+ data->changed_dns = NULL;
+
+ return ldb_next_init(module);
+}
+
+static const struct ldb_module_ops update_kt_ops = {
+ .name = "update_keytab",
+ .init_context = update_kt_init,
+ .add = update_kt_add,
+ .modify = update_kt_modify,
+ .rename = update_kt_rename,
+ .del = update_kt_delete,
+ .end_transaction = update_kt_end_trans,
+ .del_transaction = update_kt_del_trans,
+};
+
+int ldb_update_kt_init(void)
+{
+ return ldb_register_module(&update_kt_ops);
+}
Modified: branches/SAMBA_4_0/source/scripting/ejs/smbcalls_creds.c
===================================================================
--- branches/SAMBA_4_0/source/scripting/ejs/smbcalls_creds.c 2007-02-03 17:46:32 UTC (rev 21134)
+++ branches/SAMBA_4_0/source/scripting/ejs/smbcalls_creds.c 2007-02-04 07:17:03 UTC (rev 21135)
@@ -266,23 +266,11 @@
return ejs_credentials_obj(obj, cmdline_credentials);
}
-static int ejs_credentials_update_all_keytabs(MprVarHandle eid, int argc, struct MprVar **argv)
-{
- if (!NT_STATUS_IS_OK(cli_credentials_update_all_keytabs(mprMemCtx()))) {
- mpr_Return(eid, mprCreateBoolVar(False));
- } else {
- mpr_Return(eid, mprCreateBoolVar(True));
- }
- return 0;
-}
-
-
/*
setup C functions that be called from ejs
*/
void smb_setup_ejs_credentials(void)
{
ejsDefineCFunction(-1, "credentials_init", ejs_credentials_init, NULL, MPR_VAR_SCRIPT_HANDLE);
- ejsDefineCFunction(-1, "credentials_update_all_keytabs", ejs_credentials_update_all_keytabs, NULL, MPR_VAR_SCRIPT_HANDLE);
}
Modified: branches/SAMBA_4_0/source/scripting/libjs/provision.js
===================================================================
--- branches/SAMBA_4_0/source/scripting/libjs/provision.js 2007-02-03 17:46:32 UTC (rev 21134)
+++ branches/SAMBA_4_0/source/scripting/libjs/provision.js 2007-02-04 07:17:03 UTC (rev 21135)
@@ -488,16 +488,14 @@
assert(ok);
message("Setting up " + paths.secrets + "\n");
- setup_ldb("secrets.ldif", info, paths.secrets);
+ setup_ldb("secrets_init.ldif", info, paths.secrets);
+ setup_ldb("secrets.ldif", info, paths.secrets, false);
+
tmp = lp.get("secrets database");
ok = lp.set("secrets database", paths.secrets);
assert(ok);
- message("Setting up keytabs\n");
- var keytab_ok = credentials_update_all_keytabs();
- assert(keytab_ok);
-
ok = lp.set("secrets database", tmp);
assert(ok);
@@ -547,13 +545,10 @@
setup_ldb("share.ldif", info, paths.shareconf);
}
- message("Setting up secrets.ldb\n");
- setup_ldb("secrets.ldif", info, paths.secrets);
+ message("Setting up " + paths.secrets + "\n");
+ setup_ldb("secrets_init.ldif", info, paths.secrets);
+ setup_ldb("secrets.ldif", info, paths.secrets, false);
- message("Setting up keytabs\n");
- var keytab_ok = credentials_update_all_keytabs();
- assert(keytab_ok);
-
message("Setting up hklm.ldb\n");
setup_ldb("hklm.ldif", info, paths.hklm);
Modified: branches/SAMBA_4_0/source/setup/secrets.ldif
===================================================================
--- branches/SAMBA_4_0/source/setup/secrets.ldif 2007-02-03 17:46:32 UTC (rev 21134)
+++ branches/SAMBA_4_0/source/setup/secrets.ldif 2007-02-04 07:17:03 UTC (rev 21135)
@@ -1,18 +1,3 @@
-dn: @INDEXLIST
- at IDXATTR: cn
- at IDXATTR: flatname
- at IDXATTR: realm
-
-dn: @ATTRIBUTES
-realm: CASE_INSENSITIVE
-flatname: CASE_INSENSITIVE
-sAMAccountName: CASE_INSENSITIVE
-
-#Add modules to the list to activate them by default
-#beware often order is important
-dn: @MODULES
- at LIST: operational
-
dn: CN=LSA Secrets
objectClass: top
objectClass: container
Added: branches/SAMBA_4_0/source/setup/secrets_init.ldif
===================================================================
--- branches/SAMBA_4_0/source/setup/secrets_init.ldif 2007-02-03 17:46:32 UTC (rev 21134)
+++ branches/SAMBA_4_0/source/setup/secrets_init.ldif 2007-02-04 07:17:03 UTC (rev 21135)
@@ -0,0 +1,15 @@
+dn: @INDEXLIST
+ at IDXATTR: cn
+ at IDXATTR: flatname
+ at IDXATTR: realm
+
+dn: @ATTRIBUTES
+realm: CASE_INSENSITIVE
+flatname: CASE_INSENSITIVE
+sAMAccountName: CASE_INSENSITIVE
+
+#Add modules to the list to activate them by default
+#beware often order is important
+dn: @MODULES
+ at LIST: update_keytab,operational,objectguid
+
More information about the samba-cvs
mailing list