The branch, master has been updated
via 88e2fbaf95da3783e1ba41d55dd2fbd8b792126f (commit)
from d26c42f5bfd212c18d53f439030fd830ecab2cf3 (commit)
http://gitweb.samba.org/?p=samba.git;a=shortlog;h=master
- Log -----------------------------------------------------------------
commit 88e2fbaf95da3783e1ba41d55dd2fbd8b792126f
Author: Andrew Tridgell <tri...@samba.org>
Date: Fri Sep 11 15:15:39 2009 +1000
s4-drs: add the magic DRS SPNs on AddEntry
When a DsAddEntry is used to create a nTDSDSA object we need to also
create the SPNs for the NTDS GUID in the servers machine account.
-----------------------------------------------------------------------
Summary of changes:
source4/dsdb/repl/replicated_objects.c | 25 +------
source4/rpc_server/drsuapi/addentry.c | 124 ++++++++++++++++++++++++++++++-
2 files changed, 122 insertions(+), 27 deletions(-)
Changeset truncated at 500 lines:
diff --git a/source4/dsdb/repl/replicated_objects.c
b/source4/dsdb/repl/replicated_objects.c
index 459c7b5..ecf2856 100644
--- a/source4/dsdb/repl/replicated_objects.c
+++ b/source4/dsdb/repl/replicated_objects.c
@@ -319,19 +319,6 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
msg->num_elements);
W_ERROR_HAVE_NO_MEMORY(msg->elements);
- /*
- * TODO:
- *
- * The DsAddEntry() call which creates a nTDSDSA object,
- * also adds a servicePrincipalName in the following form
- * to the computer account of the new domain controller
- * referenced by the "serverReferenece" attribute.
- *
- *
E3514235-4B06-11D1-AB04-00C04FC2DCD2/<new-ntdsdsa-object-guid-as-string>/<domain-dns-name>
- *
- * also note that the "serverReference" isn't added to the new object!
- */
-
for (i=0; i < msg->num_elements; i++) {
struct drsuapi_DsReplicaAttribute *a;
struct ldb_message_element *e;
@@ -343,7 +330,9 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
W_ERROR_NOT_OK_RETURN(status);
}
+
*_msg = msg;
+
return WERR_OK;
}
@@ -396,11 +385,6 @@ WERROR dsdb_origin_objects_commit(struct ldb_context *ldb,
num_objects);
W_ERROR_HAVE_NO_MEMORY(objects);
- ret = ldb_transaction_start(ldb);
- if (ret != 0) {
- goto cancel;
- }
-
for (i=0; i < num_objects; i++) {
struct dom_sid *sid = NULL;
ret = ldb_add(ldb, objects[i]);
@@ -422,11 +406,6 @@ WERROR dsdb_origin_objects_commit(struct ldb_context *ldb,
}
}
- ret = ldb_transaction_commit(ldb);
- if (ret != 0) {
- goto cancel;
- }
-
talloc_free(objects);
*_num = num_objects;
diff --git a/source4/rpc_server/drsuapi/addentry.c
b/source4/rpc_server/drsuapi/addentry.c
index 8d94a29..ab190e1 100644
--- a/source4/rpc_server/drsuapi/addentry.c
+++ b/source4/rpc_server/drsuapi/addentry.c
@@ -31,6 +31,96 @@
#include "auth/auth.h"
#include "rpc_server/drsuapi/dcesrv_drsuapi.h"
+
+/*
+ add special SPNs needed for DRS replication to machine accounts when
+ an AddEntry is done to create a nTDSDSA object
+ */
+static WERROR drsuapi_add_SPNs(struct drsuapi_bind_state *b_state,
+ struct dcesrv_call_state *dce_call, TALLOC_CTX
*mem_ctx,
+ const struct drsuapi_DsReplicaObjectListItem
*first_object)
+{
+ int ret;
+ const struct drsuapi_DsReplicaObjectListItem *obj;
+ const char *attrs[] = { "serverReference", "objectGUID", NULL };
+
+ for (obj = first_object; obj; obj=obj->next_object) {
+ const char *dn_string = obj->object.identifier->dn;
+ struct ldb_dn *dn = ldb_dn_new(mem_ctx, b_state->sam_ctx,
dn_string);
+ struct ldb_result *res;
+ struct ldb_dn *ref_dn;
+ struct GUID ntds_guid;
+ struct ldb_message *msg;
+ struct ldb_message_element *el;
+ const char *ntds_guid_str;
+ const char *dom_string;
+
+ ret = ldb_search(b_state->sam_ctx, mem_ctx, &res,
+ dn, LDB_SCOPE_BASE, attrs,
+ "(objectClass=ntDSDSA)");
+ if (ret != LDB_SUCCESS || res->count < 1) {
+ DEBUG(0,(__location__ ": Failed to find dn '%s'\n",
dn_string));
+ return WERR_DS_DRA_INTERNAL_ERROR;
+ }
+
+ ref_dn = samdb_result_dn(b_state->sam_ctx, mem_ctx,
res->msgs[0], "serverReference", NULL);
+ if (ref_dn == NULL) {
+ /* we only add SPNs for objects with a
+ serverReference */
+ continue;
+ }
+
+ ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
+
+ ntds_guid_str = GUID_string(res, &ntds_guid);
+
+ dom_string = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
+
+ /*
+ * construct a modify request to add the new SPNs to
+ * the machine account
+ */
+ msg = ldb_msg_new(mem_ctx);
+ if (msg == NULL) {
+ return WERR_NOMEM;
+ }
+
+ msg->dn = ref_dn;
+ ret = ldb_msg_add_empty(msg, "servicePrincipalName",
+ LDB_FLAG_MOD_ADD, &el);
+ if (ret != LDB_SUCCESS) {
+ return WERR_NOMEM;
+ }
+
+ el->num_values = 2;
+ el->values = talloc_array(el, struct ldb_val, 2);
+ if (el->values == NULL) {
+ return WERR_NOMEM;
+ }
+ /* the magic constant is the GUID of the DRSUAPI RPC
+ interface */
+ el->values[0].data = (uint8_t *)talloc_asprintf(el->values,
+
"E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s",
+ ntds_guid_str,
dom_string);
+ el->values[0].length = strlen((char *)el->values[0].data);
+ el->values[1].data = (uint8_t *)talloc_asprintf(el->values,
"ldap/%s/%s",
+ ntds_guid_str,
dom_string);
+ el->values[1].length = strlen((char *)el->values[0].data);
+
+ ret = ldb_modify(b_state->sam_ctx, msg);
+ if (ret != LDB_SUCCESS) {
+ DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
+ ldb_errstring(b_state->sam_ctx)));
+ return WERR_DS_DRA_INTERNAL_ERROR;
+ }
+ }
+
+ return WERR_OK;
+}
+
+
+
+
/*
drsuapi_DsAddEntry
*/
@@ -42,6 +132,8 @@ WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state
*dce_call, TALLOC_CTX
struct dcesrv_handle *h;
uint32_t num = 0;
struct drsuapi_DsReplicaObjectIdentifier2 *ids = NULL;
+ int ret;
+ const struct drsuapi_DsReplicaObjectListItem *first_object;
if (DEBUGLVL(4)) {
NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry, NDR_IN, r);
@@ -59,14 +151,23 @@ WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state
*dce_call, TALLOC_CTX
switch (r->in.level) {
case 2:
+ ret = ldb_transaction_start(b_state->sam_ctx);
+ if (ret != LDB_SUCCESS) {
+ return WERR_DS_DRA_INTERNAL_ERROR;
+ }
+
+
+ first_object = &r->in.req->req2.first_object;
+
status = dsdb_origin_objects_commit(b_state->sam_ctx,
mem_ctx,
-
&r->in.req->req2.first_object,
+ first_object,
&num,
&ids);
if (!W_ERROR_IS_OK(status)) {
r->out.ctr->ctr3.error->info1.status = status;
- W_ERROR_NOT_OK_RETURN(status);
+ ldb_transaction_cancel(b_state->sam_ctx);
+ return status;
}
r->out.ctr->ctr3.count = num;
@@ -74,8 +175,23 @@ WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state
*dce_call, TALLOC_CTX
return WERR_OK;
default:
- break;
+ return WERR_FOOBAR;
+ }
+
+ /* if any of the added entries are nTDSDSA objects then we
+ * need to add the SPNs to the machine account
+ */
+ status = drsuapi_add_SPNs(b_state, dce_call, mem_ctx, first_object);
+ if (!W_ERROR_IS_OK(status)) {
+ r->out.ctr->ctr3.error->info1.status = status;
+ ldb_transaction_cancel(b_state->sam_ctx);
+ return status;
+ }
+
+ ret = ldb_transaction_commit(b_state->sam_ctx);
+ if (ret != LDB_SUCCESS) {
+ return WERR_DS_DRA_INTERNAL_ERROR;
}
- return WERR_FOOBAR;
+ return WERR_OK;
}
--
Samba Shared Repository
