summaryrefslogtreecommitdiffstats
path: root/source4/dsdb/samdb
Commit message (Collapse)AuthorAgeFilesLines
* acl: Fix typo: structrual -> structuralJelmer Vernooij2014-09-271-1/+1
| | | | | | Change-Id: I859f62042e16d146ab4cb1490ab725d2bfa06db1 Signed-off-by: Jelmer Vernooij <jelmer@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: improve debugging in DsCrackNameOneFilterAndrew Bartlett2014-09-011-1/+3
| | | | | | | | Change-Id: I64d8e1eb94d833dc8ebf18fecdf32a83470a087e Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-By: Jelmer Vernooij <jelmer@samba.org> 1
* dsdb: Permit creation of partitions of type INSTANCE_TYPE_UNINSTANTAndrew Bartlett2014-09-011-4/+15
| | | | | | | | | | | This is only allowed when we are creating the objects from a DsAddEntry call, not over LDAP. Change-Id: Ieec6b07556d58741ec04fede8bf9940811f12a62 Pair-programmed-with: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-By: Jelmer Vernooij <jelmer@samba.org>
* dsdb: Change acl module to look for instanceType flag rather than list of NCsAndrew Bartlett2014-09-012-15/+87
| | | | | | | | | | This avoids any DNs being a free pass beyond the ACL code, instead it is based on the CN=Partitions ACL. Andrew Bartlett Change-Id: Ib2f4abe0165e47fa4a71925d126c2eeec68df119 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4-dsdb/cracknames: free realm from smb_krb5_principal_get_realm().Günther Deschner2014-08-081-3/+4
| | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-dsdb/samdb: use smb_krb5_principal_get_comp_string in ldb ACL module.Günther Deschner2014-08-082-6/+9
| | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4-dsdb/samdb: use smb_krb5_make_principal for compatibility reasons with MIT.Günther Deschner2014-08-081-4/+5
| | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* messaging4: Change irpc_servers_by_name to NTSTATUSVolker Lendecke2014-07-211-5/+7
| | | | | | | | | | | | For me, counted arrays are easier to deal with than NULL-terminated ones. Here we also had a "server_id_is_disconnection" convention, which was not really obvious. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Mon Jul 21 20:28:53 CEST 2014 on sn-devel-104
* s4:dsdb/samldb: don't allow 'userParameters' to be modified over LDAP for nowStefan Metzmacher2014-07-091-0/+18
| | | | | | | | | | | | | | | | | For now it's safer to reject setting 'userParameters' via LDAP, as we'll not provide the same behavior as a Windows Server. If someone requires that feature please report this in the following bug reports! Bug: https://bugzilla.samba.org/show_bug.cgi?id=8077 Bug: https://bugzilla.samba.org/show_bug.cgi?id=10130 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Wed Jul 9 11:07:51 CEST 2014 on sn-devel-104
* s4:dsdb/repl_meta_data: make sure objectGUID can't be deletedStefan Metzmacher2014-07-091-3/+3
| | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=9763 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/extended_dn_in: don't force DSDB_SEARCH_SHOW_RECYCLEDStefan Metzmacher2014-07-091-17/+20
| | | | | | | | | | | | | We should take the controls the caller provided when we search for existing objects. A search with a basedn of '<GUID=....>' should result in LDB_ERR_NO_SUCH_OBJECT is the object has isDeleted=TRUE. Bug: https://bugzilla.samba.org/show_bug.cgi?id=10694 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/schema_load: make error message more verboseStefan Metzmacher2014-07-091-1/+2
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* secrets: Ensure we store the secureChannelType when written to secrets.ldbAndrew Bartlett2014-07-041-0/+1
| | | | | | | | | This will allow winbindd to know when we are an RODC without needing to dig into sam.ldb. Change-Id: Ibdfa37fe6269305ccc5db42479f4a8db5eea53f3 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@samba.org>
* dsdb: Do not refresh the schema using the wrong event contextAndrew Bartlett2014-06-112-83/+117
| | | | | | | | | | | | | | | | What we now do is have the refresh function and module be on a seperate object to the schema, only referring to the data and not excuting on the original ldb and event loop. That is, we never use another ldb context when calling the refresh function, by binding the refresh handler to the ldb and not the schema. Andrew Bartlett Change-Id: I5c323dda743cf5858badd01147fda6227599bc16 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* dsdb: Do not store a struct ldb_dn in struct schema_dataAndrew Bartlett2014-06-114-14/+21
| | | | | | | | | | | | The issue is that the DN contains a pointer to the ldb it belongs to, and if this is not kept around long enough, we might reference memory after it is de-allocated. Andrew Bartlett Change-Id: I040a6c37a3164b3309f370e32e598dd56b1a1bbb Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* Use GUID_equal in a few placesVolker Lendecke2014-06-101-1/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dsdb: Do not give an error is metadata.tdb does not yet existAndrew Bartlett2014-06-041-2/+2
| | | | | | Change-Id: I88ee188c776364fd66da388ce01fc9288aa2ded0 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* dsdb: Do not permit nested event loops when in a transaction, use a nested ↵Andrew Bartlett2014-05-061-13/+80
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | event context It is never safe to execute arbitary code inside a transaction - we need to get in and get out, not run other events for the rest of the server. This patch avoids that by creating a private event loop during transactions, so no unexpected operations fire, and returning the original one when we finish it. If an event fires during an LDB transaction, an unrelated operation can occur during the transaction, and if the transaction were to be cancelled, there would be a silent rollback (despite the client having been indicated success). Additionally, other processes could be called via IRPC that need to operate on the database but are locked out due to the ongoing transaction. Andrew Bartlett BUG: https://bugzilla.samba.org/show_bug.cgi?id=10582 Change-Id: I22322fc006e61d7291da17cdf6431416ebb7b30f Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Tue May 6 13:36:20 CEST 2014 on sn-devel-104
* dsdb: Rename private_data to rootdse_private_data in rootdseAndrew Bartlett2014-05-061-8/+8
| | | | | | | | Bug: https://bugzilla.samba.org/show_bug.cgi?id=10582 Change-Id: I349a2be67333ada86c19cd6d2ed283cd5bbeb2aa Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: Make it harder to corrupt the database by requiring DBCHECK or RELAX ↵Andrew Bartlett2014-05-031-9/+31
| | | | | | | | | | | | | | | for final object deletion This kind of deletion can cause us to then replicate back a partial object. We allow dbcheck to directly remove totally corrupt objects (missing an objectclass) by specifying both DBCHECK and RELAX, and the tombstone sweep after 180 days is done with the RELAX control. Andrew Bartlett Change-Id: Ic21f68e507ba9b65e035ca568430e35e2d001c7d Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:repl_meta_data: fix array assignment in replmd_process_linked_attribute()Stefan Metzmacher2014-05-021-2/+2
| | | | | | Change-Id: I10357236108f68ab749ba0e1f07558302c573887 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* kerberos: Remove un-used event context argument from smb_krb5_init_context()Andrew Bartlett2014-04-283-4/+0
| | | | | | | | | | | | | | | | | The event context here was only specified in the server or admin-tool context, which does not do network communication, so this only caused a talloc_reference() and never any useful result. The actual network communication code sets an event context directly before making the network call. Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Apr 28 02:24:57 CEST 2014 on sn-devel-104
* dsdb: Specify no event context to smb_krb5_init_context() in dsdbAndrew Bartlett2014-04-283-4/+6
| | | | | | | | | | These routines parse principals and generate keys only, no network communication is done. Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:dsdb/samldb: rework samldb_user_account_control_change()Stefan Metzmacher2014-04-021-99/+134
| | | | | | | | | | | | - Removing ACB_AUTOLOCK/UF_LOCKOUT from the effective userAccountControl flags (combined with msDS-User-Account-Control-Computed) results in lockoutTime=0 (implying badPadCount=0). - We also do more validation of the account type flags now. Change-Id: If7f224cf60920037a0ae19a10d116ac265771a4c Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/samldb: remove fantasy code from samldb_user_account_control_change()Stefan Metzmacher2014-04-021-10/+0
| | | | | | | | Setting UF_PASSWORD_EXPIRED doesn't reset "pwdLastSet" to "0"! Change-Id: I9e004195ad864b8b3fe036986b1087398d1f6fc5 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: Implement password lockout on LDAP password changesAndrew Bartlett2014-04-021-16/+134
| | | | | | | | | | | | | | | To do this, and have the badPwdCount update stick, we must abort, open, close and reopen transactions such that the badPwdCount update is in it's own transaction. To ensure the tests can confirm the correct behaviour here, we must output the Windows error code in the error message. Andrew Bartlett Change-Id: I5b1515b26b308301cf90ce8a3c848a3cedee85a2 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:dsdb/samldb: add let lockoutTime=0 reset badPwdCount=0Stefan Metzmacher2014-04-021-0/+57
| | | | | | | | See [MS-SAMR] 3.1.1.8.3 lockoutTime. Change-Id: Ic384a8e2b88c8e9eb1859df99ee09451ebd49fec Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dsdb: collapse wrong password and no-password-hash errors into one handlerAndrew Bartlett2014-04-021-25/+3
| | | | | | | | | | This avoids giving away too much information to an attacker. Andrew Bartlett Change-Id: Id0c0ec508304990e64e5d728396d0d0c1cd7f966 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: Put password lockout support in samdb_result_passwords()Andrew Bartlett2014-04-021-5/+16
| | | | | | | | | | | | This seems to be the best choke point to check for locked out accounts, as aside from the KDC, all the password authentication and change callers use it. Andrew Bartlett Change-Id: I0f21a79697cb8b08ef639445bd05a896a2c9ee1b Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb-operational: Implement msDS-UserPasswordExpiryTimeComputedAndrew Bartlett2014-04-021-1/+47
| | | | | | | | | | | | This assists in testing this aspect of msDS-User-Account-Control-Computed, and is exposed in AD for clients to query. Andrew Bartlett Change-Id: I10fd214b0585a16f8addb00c252f656419a03f4a Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb-operational: Implement msDS-User-Account-Control-ComputedAndrew Bartlett2014-04-021-1/+165
| | | | | | | | | | | This is needed to get consistent account lockout support across the whole server. Andrew Bartlett Change-Id: I2fa1e707d33f5567b6cb4e2b27e340fa9f40cee9 Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Signed-off-by: Stefan Metzmacher <metze@samba.org>
* dsdb-operational: Use a list for the extra attributes that may be requiredAndrew Bartlett2014-04-021-28/+52
| | | | | | Change-Id: Ifa2e006c9401e92e71d6588d6ea879c6f437cdd5 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* s4:dsdb/ldb_modules: avoid invalid pointer type warningsStefan Metzmacher2014-04-022-5/+4
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/ldb_modules: avoid str_list related const warningsStefan Metzmacher2014-04-022-3/+6
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:dsdb/ldb_modules: avoid declaration after code warningsStefan Metzmacher2014-04-022-2/+5
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* tdb_wrap: Remove tdb_wrap_open_ againVolker Lendecke2014-03-312-4/+4
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dsdb: Avoid passing lp_ctx to tdb_wrap_open in partition_metadata_openVolker Lendecke2014-03-311-3/+3
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dsdb: Avoid passing lp_ctx to tdb_wrap_open in schema_metadata_openVolker Lendecke2014-03-311-3/+3
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* dsdb: Improve missing objectClass handlingAndrew Bartlett2014-03-271-13/+13
| | | | | | | | | | | | | | This attempts to permit deletion of objects that have no objectClass to allow dbcheck to clean up a corrupt database. It is not complete, the replmd_replPropertyMetaDataCtr1_sort_and_verify() call will still fail, but this is as much as is safe to do without a way to replicate the original issue. Andrew Bartlett Change-Id: If0b6c7f18e8aee587e6b3b4af878a0145f5eac37 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: Improve errors and checks for missing objectClass valuesAndrew Bartlett2014-03-271-2/+9
| | | | | | Change-Id: I8c4ac679accc90748d20c9c86986b127c939fa75 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: Clarify how the DSDB_REPL_FLAG_PRIORITISE_INCOMING flag worksAndrew Bartlett2014-03-271-5/+13
| | | | | | Signed-off-by: Andrew Bartlett <abartlet@samba.org> Change-Id: Ib9f2f4ba417dbf0ee24b6e7db02d78a9bfe8850c Reviewed-by: Stefan Metzmacher <metze@samba.org>
* dsdb: Do checks for invalid renames in samldb, before repl_meta_dataAndrew Bartlett2014-03-262-238/+271
| | | | | | | | | | | | | | | | This ensures that conflict objects can be created in CN=System, and that we do not stop replication just because some other DC allowed a rename we do not like. This is achived by doing the work in the samldb module, which is above repl_meta_data in the stack. Andrew Bartlett Change-Id: I8c1a7d3e0fbd5a470cf1326cc055044ca885f7d9 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Guenter Kukkukk <kukks@samba.org> Tested-by: Guenter Kukkukk <kukks@samba.org>
* dsdb: Further assert that we always have an objectClass and an rDNAndrew Bartlett2014-03-171-32/+118
| | | | | | | | | | | | | | | | | | | | | | | We must have these two elements in a replPropertyMetaData for it to be valid. We may have to relax this for new partition creation, but for now we want to find and isolate the database corruption. The printing of the LDIF is moved above the checks to make it easier to diagnoise the failures when further reproduced. Based initially on a patch originally by Arvid Requate <requate@univention.de> Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Change-Id: I5f583d89e6d4c5e8e2d9667f336a0e8fd8347b25 Reviewed-on: https://gerrit.samba.org/164 Reviewed-by: Kamen Mazdrashki <kamenim@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Mar 17 06:44:17 CET 2014 on sn-devel-104
* dsdb: Ensure to sort replPropertyMetaData as UNSIGNED, not SIGNED quantitiesAndrew Bartlett2014-03-141-4/+18
| | | | | | | | | | | | | | enum is an int, and therefore signed. Some attributes have the high bit set. Andrew Bartlett Change-Id: I39a5499b7c6bbb763e15977d802cda8c69b94618 Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-on: https://gerrit.samba.org/163 Reviewed-by: Kamen Mazdrashki <kamenim@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Fri Mar 14 10:16:41 CET 2014 on sn-devel-104
* s4:samdb: respect SEARCH_FLAG_PRESERVEONDELETEArvid Requate2014-02-061-2/+7
| | | | | | | | | | | | According to MS-ADTS section 3.1.1.5.5.1.1 the searchFlags must be checked. Signed-off-by: Arvid Requate <requate@univention.de> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org> Autobuild-User(master): David Disseldorp <ddiss@samba.org> Autobuild-Date(master): Thu Feb 6 21:42:22 CET 2014 on sn-devel-104
* dsdb: Return LDB_ERR_INSUFFICIENT_ACCESS_RIGHTS rather than OPERATIONS_ERROR ↵Andrew Bartlett2014-02-051-4/+7
| | | | | | | | | | | | on EACCES and EPERM This makes provision errors clearer in Samba. Andrew Bartlett Reviewed-by: Garming Sam <garming@catalyst.net.nz> Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jelmer Vernooij <jelmer@samba.org>
* s4:dsdb fix compiler warningsChristian Ambach2013-12-121-1/+1
| | | | | | | about potentially uninitialized variables Signed-off-by: Christian Ambach <ambi@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:dsdb fix compiler warningsChristian Ambach2013-12-121-1/+1
| | | | | | | about potentially uninitialized variables Signed-off-by: Christian Ambach <ambi@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:dsdb fix compiler warningsChristian Ambach2013-12-121-1/+1
| | | | | | | about potentially uninitialized variables Signed-off-by: Christian Ambach <ambi@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* s4:dsdb fix compiler warningsChristian Ambach2013-12-121-1/+1
| | | | | | | about potentially uninitialized variables Signed-off-by: Christian Ambach <ambi@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
generated by cgit (git 2.34.1) at 2025-09-26 10:45:11 +0000