[SCM] Samba Shared Repository - branch master updated
Matthias Dieter Wallnöfer
mdw at samba.org
Sun Sep 12 11:22:15 MDT 2010
The branch, master has been updated
via 4a29415 s4:ldap.py - tests the primary group detection by the "userAccountControl"
via 4fd8ce4 s4:setup/provision_self_join.ldif - now the samldb LDB module detects automatically that this is a DC account
via 7f42415 s4:samldb LDB module - "samldb_check_primaryGroupID" - support RID derivation from "userAccountControl"
via 1e52e72 libds:flag_mapping.c - introduce a call which maps the "userAccountControl" to the default primary group RID
via 2fb111f libds:flag_mapping.c - fix counter variable types
via 22d4243 s4:samldb LDB module - free the "ac" context after the delete checks
via 1d94bb3 s4:samldb LDB module - simplify the message handling on add and modify operations
via 79f22e5 s4:samldb LDB module - move "samldb_prim_group_users_check" more down to see that it is only in use by the delete operation
via bb1da64 s4:samldb LDB module - add a comment to mark the beginning of the extended operation handler
via dad7cda s4:samldb LDB module - refactor "samldb_find_for_defaultObjectCategory" to be again synchronous
via 6aca09b s4:samldb LDB module - refactor the "primaryGroupID" check on user creation
via e1de425 s4:samldb LDB module - get rid of the SID context variable
via 79a98b8 s4:samldb LDB module - use also here the real attribute denomination "sAMAccountName"
via 0eb281d s4:samldb LDB module - rename "check_SamAccountType" into "check_sAMAccountType"
via 4ef9760 s4:samldb LDB module - make "samldb_check_sAMAccountName" synchronous again
via 64af772 s4:fsmo.py - fix an obvious typo
from adfa071 s3: Remove a nesting level in winbindd_dual_pam_chauthtok
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 4a2941535d8a34c533ddbadccd4df9aec4539639
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 19:11:26 2010 +0200
s4:ldap.py - tests the primary group detection by the "userAccountControl"
commit 4fd8ce42ce429111d70d078c1e12bc20dec0af05
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 18:39:50 2010 +0200
s4:setup/provision_self_join.ldif - now the samldb LDB module detects automatically that this is a DC account
commit 7f424155e62d04d23bb1c825ecd546eed18725e0
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 18:26:06 2010 +0200
s4:samldb LDB module - "samldb_check_primaryGroupID" - support RID derivation from "userAccountControl"
Specified in MS-SAMR 3.1.1.8.1 and probably fixes also bug #7441.
commit 1e52e72e409a3a5b52e4f75b985122ac94d8aa4a
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 18:00:21 2010 +0200
libds:flag_mapping.c - introduce a call which maps the "userAccountControl" to the default primary group RID
commit 2fb111f7313ddd3bf5f4eee0a54284b201100605
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 17:49:47 2010 +0200
libds:flag_mapping.c - fix counter variable types
commit 22d42432acb158a7b0ebb4faee3aebd53a494efd
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 15:05:19 2010 +0200
s4:samldb LDB module - free the "ac" context after the delete checks
commit 1d94bb3ad4d9c6de3b77ed4690a54ebf2399cc0d
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 14:38:11 2010 +0200
s4:samldb LDB module - simplify the message handling on add and modify operations
We perform always only one shallow copy operation of the message on the "req"
context. This allows to free the "ac" context when we've prepared all our
changes.
commit 79f22e5d700c5ffb6c0f0d64ad701558aa53bf57
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 14:41:53 2010 +0200
s4:samldb LDB module - move "samldb_prim_group_users_check" more down to see that it is only in use by the delete operation
add and modify helpers will stay on the top of the add and modify operation
since they will likely be shared as much as possible.
commit bb1da645ed1005b5e77dd3e013af93b0f027d51e
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 14:40:17 2010 +0200
s4:samldb LDB module - add a comment to mark the beginning of the extended operation handler
commit dad7cdad2261b8b860a67ecfdcb027ff9a7985db
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 13:14:36 2010 +0200
s4:samldb LDB module - refactor "samldb_find_for_defaultObjectCategory" to be again synchronous
Also to make it easier to comprehend
commit 6aca09b0b723d0116c0038e4e43a13a77b68deca
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 12:54:31 2010 +0200
s4:samldb LDB module - refactor the "primaryGroupID" check on user creation
This looks more straight-forward now.
commit e1de425cb8734fb7be1e17cfb22ebd95d9b4df9a
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 12:53:37 2010 +0200
s4:samldb LDB module - get rid of the SID context variable
Since we get more and more rid of async stuff we don't need this in the context
anymore.
commit 79a98b893aa098b3ed822647e2cdb1d471f4901b
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 12:31:41 2010 +0200
s4:samldb LDB module - use also here the real attribute denomination "sAMAccountName"
Purely cosmetic - but nicer to read
commit 0eb281d8f210200025aecb478f818b659ad5b546
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 12:29:21 2010 +0200
s4:samldb LDB module - rename "check_SamAccountType" into "check_sAMAccountType"
And a small cosmetic change.
I like to have the real attribute names in the function denominations
commit 4ef9760db170bf2ec2aa277426d07c345dd7848b
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 12:25:55 2010 +0200
s4:samldb LDB module - make "samldb_check_sAMAccountName" synchronous again
To make it more understandable
commit 64af772b38ca4109a4bd47e228b602f1f74e61bc
Author: Matthias Dieter Wallnöfer <mdw at samba.org>
Date: Sun Sep 12 15:05:46 2010 +0200
s4:fsmo.py - fix an obvious typo
-----------------------------------------------------------------------
Summary of changes:
libds/common/flag_mapping.c | 18 +-
source4/dsdb/samdb/ldb_modules/samldb.c | 584 ++++++++-----------------
source4/dsdb/tests/python/ldap.py | 49 ++-
source4/scripting/python/samba/netcmd/fsmo.py | 2 +-
source4/setup/provision_self_join.ldif | 1 -
5 files changed, 245 insertions(+), 409 deletions(-)
Changeset truncated at 500 lines:
diff --git a/libds/common/flag_mapping.c b/libds/common/flag_mapping.c
index 429ccac..dfe6199 100644
--- a/libds/common/flag_mapping.c
+++ b/libds/common/flag_mapping.c
@@ -4,6 +4,7 @@
Copyright (C) Stefan (metze) Metzmacher 2002
Copyright (C) Andrew Tridgell 2004
+ Copyright (C) Matthias Dieter Wallnöfer 2010
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
@@ -54,7 +55,8 @@ static const struct {
uint32_t ds_acb2uf(uint32_t acb)
{
- uint32_t i, ret = 0;
+ unsigned int i;
+ uint32_t ret = 0;
for (i=0;i<ARRAY_SIZE(acct_flags_map);i++) {
if (acct_flags_map[i].acb & acb) {
ret |= acct_flags_map[i].uf;
@@ -68,7 +70,7 @@ translated the UserFlags (userAccountControl) to ACB_CTRL Flags
*/
uint32_t ds_uf2acb(uint32_t uf)
{
- uint32_t i;
+ unsigned int i;
uint32_t ret = 0;
for (i=0;i<ARRAY_SIZE(acct_flags_map);i++) {
if (acct_flags_map[i].uf & uf) {
@@ -144,3 +146,15 @@ enum lsa_SidType ds_atype_map(uint32_t atype)
}
return SID_NAME_UNKNOWN;
}
+
+/* get the default primary group RID for a given userAccountControl
+ * (informations according to MS-SAMR 3.1.1.8.1) */
+uint32_t ds_uf2prim_group_rid(uint32_t uf)
+{
+ uint32_t prim_group_rid = DOMAIN_RID_USERS;
+
+ if (uf & UF_SERVER_TRUST_ACCOUNT) prim_group_rid = DOMAIN_RID_DCS;
+ else if (uf & UF_WORKSTATION_TRUST_ACCOUNT) prim_group_rid = DOMAIN_RID_DOMAIN_MEMBERS;
+
+ return prim_group_rid;
+}
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index e657381..7fa27e8 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -59,15 +59,8 @@ struct samldb_ctx {
/* the resulting message */
struct ldb_message *msg;
- /* holds the entry SID */
- struct dom_sid *sid;
-
- /* holds a generic dn */
- struct ldb_dn *dn;
-
- /* used in conjunction with "sid" in "samldb_dn_from_sid" and
- * "samldb_find_for_defaultObjectCategory" */
- struct ldb_dn *res_dn;
+ /* used in "samldb_find_for_defaultObjectCategory" */
+ struct ldb_dn *dn, *res_dn;
/* all the async steps necessary to complete the operation */
struct samldb_step *steps;
@@ -149,7 +142,10 @@ static int samldb_next_step(struct samldb_ctx *ac)
}
}
-static int samldb_generate_samAccountName(struct ldb_context *ldb, struct ldb_message *msg)
+
+/* sAMAccountName handling */
+
+static int samldb_generate_sAMAccountName(struct ldb_context *ldb, struct ldb_message *msg)
{
char *name;
@@ -162,96 +158,42 @@ static int samldb_generate_samAccountName(struct ldb_context *ldb, struct ldb_me
if (name == NULL) {
return ldb_oom(ldb);
}
- return ldb_msg_add_steal_string(msg, "samAccountName", name);
+ return ldb_msg_add_steal_string(msg, "sAMAccountName", name);
}
-/*
- * samldb_check_samAccountName (async)
- */
-
-static int samldb_check_samAccountName_callback(struct ldb_request *req,
- struct ldb_reply *ares)
+static int samldb_check_sAMAccountName(struct samldb_ctx *ac)
{
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
-
- if (ares->error != LDB_SUCCESS) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- /* if we get an entry it means this samAccountName
- * already exists */
- return ldb_module_done(ac->req, NULL, NULL,
- LDB_ERR_ENTRY_ALREADY_EXISTS);
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_DONE:
- /* not found, go on */
- talloc_free(ares);
- ret = samldb_next_step(ac);
- break;
- }
-
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
-static int samldb_check_samAccountName(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- struct ldb_request *req;
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
const char *name;
- char *filter;
int ret;
- ldb = ldb_module_get_ctx(ac->module);
-
- if (ldb_msg_find_element(ac->msg, "samAccountName") == NULL) {
- ret = samldb_generate_samAccountName(ldb, ac->msg);
+ if (ldb_msg_find_element(ac->msg, "sAMAccountName") == NULL) {
+ ret = samldb_generate_sAMAccountName(ldb, ac->msg);
if (ret != LDB_SUCCESS) {
return ret;
}
}
- name = ldb_msg_find_attr_as_string(ac->msg, "samAccountName", NULL);
+ name = ldb_msg_find_attr_as_string(ac->msg, "sAMAccountName", NULL);
if (name == NULL) {
return ldb_operr(ldb);
}
- filter = talloc_asprintf(ac, "samAccountName=%s",
+
+ ret = samdb_search_count(ldb, NULL, "(sAMAccountName=%s)",
ldb_binary_encode_string(ac, name));
- if (filter == NULL) {
+ if ((ret < 0) || (ret > 1)) {
return ldb_operr(ldb);
}
-
- ret = ldb_build_search_req(&req, ldb, ac,
- ldb_get_default_basedn(ldb),
- LDB_SCOPE_SUBTREE,
- filter, NULL,
- NULL,
- ac, samldb_check_samAccountName_callback,
- ac->req);
- talloc_free(filter);
- if (ret != LDB_SUCCESS) {
- return ret;
+ if (ret == 1) {
+ return LDB_ERR_ENTRY_ALREADY_EXISTS;
}
- return ldb_next_request(ac->module, req);
+
+ return samldb_next_step(ac);
}
+/* sAMAccountType handling */
-static int samldb_check_samAccountType(struct samldb_ctx *ac)
+static int samldb_check_sAMAccountType(struct samldb_ctx *ac)
{
struct ldb_context *ldb;
unsigned int account_type;
@@ -284,9 +226,7 @@ static int samldb_check_samAccountType(struct samldb_ctx *ac)
return ret;
}
}
- } else
- if (strcmp("group", ac->type) == 0) {
-
+ } else if (strcmp("group", ac->type) == 0) {
group_type = samdb_result_uint(ac->msg, "groupType", 0);
if (group_type == 0) {
ldb_asprintf_errstring(ldb,
@@ -307,6 +247,48 @@ static int samldb_check_samAccountType(struct samldb_ctx *ac)
return samldb_next_step(ac);
}
+/* primaryGroupID handling */
+
+static int samldb_check_primaryGroupID(struct samldb_ctx *ac)
+{
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+ struct ldb_dn *prim_group_dn;
+ uint32_t rid;
+ struct dom_sid *sid;
+ int ret;
+
+ rid = samdb_result_uint(ac->msg, "primaryGroupID", (uint32_t) -1);
+ if (rid == (uint32_t) -1) {
+ uint32_t uac = samdb_result_uint(ac->msg, "userAccountControl",
+ 0);
+
+ rid = ds_uf2prim_group_rid(uac);
+
+ ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
+ "primaryGroupID", rid);
+ if (ret != LDB_SUCCESS) {
+ return ret;
+ }
+ }
+
+ sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
+ if (sid == NULL) {
+ return ldb_operr(ldb);
+ }
+
+ prim_group_dn = samdb_search_dn(ldb, ac, NULL, "(objectSID=%s)",
+ dom_sid_string(ac, sid));
+ if (prim_group_dn == NULL) {
+ ldb_asprintf_errstring(ldb,
+ "Failed to find primary group with RID %u!",
+ rid);
+ return LDB_ERR_UNWILLING_TO_PERFORM;
+ }
+
+ return samldb_next_step(ac);
+}
+
+
static bool samldb_msg_add_sid(struct ldb_message *msg,
const char *name,
const struct dom_sid *sid)
@@ -327,20 +309,21 @@ static bool samldb_msg_add_sid(struct ldb_message *msg,
static int samldb_allocate_sid(struct samldb_ctx *ac)
{
uint32_t rid;
- int ret;
+ struct dom_sid *sid;
struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+ int ret;
ret = ridalloc_allocate_rid(ac->module, &rid);
if (ret != LDB_SUCCESS) {
return ret;
}
- ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
- if (ac->sid == NULL) {
+ sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
+ if (sid == NULL) {
return ldb_module_oom(ac->module);
}
- if ( ! samldb_msg_add_sid(ac->msg, "objectSid", ac->sid)) {
+ if ( ! samldb_msg_add_sid(ac->msg, "objectSid", sid)) {
return ldb_operr(ldb);
}
@@ -410,7 +393,7 @@ found:
return ldb_operr(ldb);
}
- ret = ldb_msg_add_fmt(ac->msg, "samAccountName", "krbtgt_%u", krbtgt_number);
+ ret = ldb_msg_add_fmt(ac->msg, "sAMAccountName", "krbtgt_%u", krbtgt_number);
if (ret != LDB_SUCCESS) {
return ldb_operr(ldb);
}
@@ -418,233 +401,37 @@ found:
return samldb_next_step(ac);
}
-/*
- * samldb_dn_from_sid (async)
- */
-
-static int samldb_dn_from_sid(struct samldb_ctx *ac);
-
-static int samldb_dn_from_sid_callback(struct ldb_request *req,
- struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
- if (ares->error != LDB_SUCCESS) {
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- /* save entry */
- if (ac->res_dn != NULL) {
- /* one too many! */
- ldb_set_errstring(ldb,
- "Invalid number of results while searching "
- "for domain objects!");
- ret = LDB_ERR_OPERATIONS_ERROR;
- break;
- }
- ac->res_dn = ldb_dn_copy(ac, ares->message->dn);
-
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
-
- /* found or not found, go on */
- ret = samldb_next_step(ac);
- break;
- }
-
-done:
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
-/* Finds the DN "res_dn" of an object with a given SID "sid" */
-static int samldb_dn_from_sid(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- static const char * const attrs[] = { NULL };
- struct ldb_request *req;
- char *filter;
- int ret;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- if (ac->sid == NULL)
- return ldb_operr(ldb);
-
- filter = talloc_asprintf(ac, "(objectSid=%s)",
- ldap_encode_ndr_dom_sid(ac, ac->sid));
- if (filter == NULL)
- return ldb_oom(ldb);
-
- ret = ldb_build_search_req(&req, ldb, ac,
- ldb_get_default_basedn(ldb),
- LDB_SCOPE_SUBTREE,
- filter, attrs,
- NULL,
- ac, samldb_dn_from_sid_callback,
- ac->req);
- if (ret != LDB_SUCCESS)
- return ret;
-
- return ldb_next_request(ac->module, req);
-}
-
-
-static int samldb_check_primaryGroupID_1(struct samldb_ctx *ac)
-{
- struct ldb_context *ldb;
- uint32_t rid;
-
- ldb = ldb_module_get_ctx(ac->module);
-
- rid = samdb_result_uint(ac->msg, "primaryGroupID", ~0);
- ac->sid = dom_sid_add_rid(ac, samdb_domain_sid(ldb), rid);
- if (ac->sid == NULL)
- return ldb_operr(ldb);
- ac->res_dn = NULL;
-
- return samldb_next_step(ac);
-}
-
-static int samldb_check_primaryGroupID_2(struct samldb_ctx *ac)
-{
- if (ac->res_dn == NULL) {
- struct ldb_context *ldb;
- ldb = ldb_module_get_ctx(ac->module);
- ldb_asprintf_errstring(ldb,
- "Failed to find group sid %s!",
- dom_sid_string(ac->sid, ac->sid));
- return LDB_ERR_UNWILLING_TO_PERFORM;
- }
-
- return samldb_next_step(ac);
-}
-
-
-/*
- * samldb_find_for_defaultObjectCategory (async)
- */
-
-static int samldb_find_for_defaultObjectCategory_callback(struct ldb_request *req,
- struct ldb_reply *ares)
-{
- struct ldb_context *ldb;
- struct samldb_ctx *ac;
- int ret;
-
- ac = talloc_get_type(req->context, struct samldb_ctx);
- ldb = ldb_module_get_ctx(ac->module);
-
- if (!ares) {
- ret = LDB_ERR_OPERATIONS_ERROR;
- goto done;
- }
- if (ares->error != LDB_SUCCESS) {
- if (ares->error == LDB_ERR_NO_SUCH_OBJECT) {
- if (ldb_request_get_control(ac->req,
- LDB_CONTROL_RELAX_OID) != NULL) {
- /* Don't be pricky when the DN doesn't exist */
- /* if we have the RELAX control specified */
- ac->res_dn = req->op.search.base;
- return samldb_next_step(ac);
- } else {
- ldb_set_errstring(ldb,
- "samldb_find_defaultObjectCategory: "
- "Invalid DN for 'defaultObjectCategory'!");
- ares->error = LDB_ERR_CONSTRAINT_VIOLATION;
- }
- }
-
- return ldb_module_done(ac->req, ares->controls,
- ares->response, ares->error);
- }
-
- switch (ares->type) {
- case LDB_REPLY_ENTRY:
- ac->res_dn = talloc_steal(ac, ares->message->dn);
-
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_REFERRAL:
- /* ignore */
- talloc_free(ares);
- ret = LDB_SUCCESS;
- break;
-
- case LDB_REPLY_DONE:
- talloc_free(ares);
-
- if (ac->res_dn != NULL) {
- /* when found go on */
- ret = samldb_next_step(ac);
- } else {
- ret = LDB_ERR_OPERATIONS_ERROR;
- }
- break;
- }
-
-done:
- if (ret != LDB_SUCCESS) {
- return ldb_module_done(ac->req, NULL, NULL, ret);
- }
-
- return LDB_SUCCESS;
-}
-
static int samldb_find_for_defaultObjectCategory(struct samldb_ctx *ac)
{
- struct ldb_context *ldb;
- struct ldb_request *req;
- static const char *no_attrs[] = { NULL };
+ struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
+ struct ldb_result *res;
+ const char *no_attrs[] = { NULL };
int ret;
--
Samba Shared Repository
More information about the samba-cvs
mailing list