Author: abartlet Date: 2007-08-07 09:01:08 +0000 (Tue, 07 Aug 2007) New Revision: 24263
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=24263 Log: Fix bug 4846 (unable to copy users in MMC Active Directory Users and Computers). We now generate a security descriptor for each object, when it is created. This seems to keep MMC happy. The next step is to honour it. Andrew Bartlett Modified: branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/objectclass.c branches/SAMBA_4_0/testprogs/ejs/ldap.js Changeset: Modified: branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/objectclass.c =================================================================== --- branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/objectclass.c 2007-08-07 05:58:47 UTC (rev 24262) +++ branches/SAMBA_4_0/source/dsdb/samdb/ldb_modules/objectclass.c 2007-08-07 09:01:08 UTC (rev 24263) @@ -35,6 +35,11 @@ #include "ldb/include/ldb_private.h" #include "dsdb/samdb/samdb.h" #include "lib/util/dlinklist.h" +#include "librpc/ndr/libndr.h" +#include "librpc/gen_ndr/ndr_security.h" +#include "libcli/security/security.h" +#include "auth/auth.h" + struct oc_context { enum oc_step {OC_DO_REQ, OC_SEARCH_SELF, OC_DO_MOD} step; @@ -196,6 +201,39 @@ return LDB_SUCCESS; } +DATA_BLOB *get_sd(struct ldb_module *module, TALLOC_CTX *mem_ctx, + const struct dsdb_class *objectclass) +{ + NTSTATUS status; + DATA_BLOB *linear_sd; + struct auth_session_info *session_info + = ldb_get_opaque(module->ldb, "sessionInfo"); + struct security_descriptor *sd = sddl_decode(mem_ctx, + objectclass->defaultSecurityDescriptor, + samdb_domain_sid(module->ldb)); + if (!session_info || !session_info->security_token) { + return NULL; + } + + sd->owner_sid = session_info->security_token->user_sid; + sd->group_sid = session_info->security_token->group_sid; + + linear_sd = talloc(mem_ctx, DATA_BLOB); + if (!linear_sd) { + return NULL; + } + + status = ndr_push_struct_blob(linear_sd, mem_ctx, sd, + (ndr_push_flags_fn_t)ndr_push_security_descriptor); + + if (!NT_STATUS_IS_OK(status)) { + return NULL; + } + + return linear_sd; + +} + static int objectclass_add(struct ldb_module *module, struct ldb_request *req) { struct ldb_message_element *objectclass_element; @@ -266,12 +304,18 @@ talloc_free(mem_ctx); return ret; } - /* Last one */ - if (schema && !current->next && !ldb_msg_find_element(msg, "objectCategory")) { + /* Last one is the critical one */ + if (schema && !current->next) { const struct dsdb_class *objectclass = dsdb_class_by_lDAPDisplayName(schema, current->objectclass); if (objectclass) { - ldb_msg_add_string(msg, "objectCategory", objectclass->defaultObjectCategory); + if (!ldb_msg_find_element(msg, "objectCategory")) { + ldb_msg_add_string(msg, "objectCategory", objectclass->defaultObjectCategory); + } + if (!ldb_msg_find_element(msg, "ntSecurityDescriptor")) { + DATA_BLOB *sd = get_sd(module, mem_ctx, objectclass); + ldb_msg_add_steal_value(msg, "ntSecurityDescriptor", sd); + } } } } Modified: branches/SAMBA_4_0/testprogs/ejs/ldap.js =================================================================== --- branches/SAMBA_4_0/testprogs/ejs/ldap.js 2007-08-07 05:58:47 UTC (rev 24262) +++ branches/SAMBA_4_0/testprogs/ejs/ldap.js 2007-08-07 09:01:08 UTC (rev 24263) @@ -258,7 +258,7 @@ assert(res.msgs[0].objectCategory == "cn=Person,cn=Schema,cn=Configuration," + base_dn); assert(res.msgs[0].sAMAccountType == 805306368); // assert(res[0].userAccountControl == 546); - + println("Testing ldb.search for (&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))"); var res2 = ldb.search("(&(cn=ldaptestuser)(objectCategory=cn=person,cn=schema,cn=configuration," + base_dn + "))"); if (res2.error != 0 || res2.msgs.length != 1) { @@ -439,8 +439,9 @@ // assert(res.msgs[0].userAccountControl == 4098); + var attrs = new Array("cn", "name", "objectClass", "objectGUID", "whenCreated", "ntSecurityDescriptor"); println("Testing ldb.search for (&(cn=ldaptestUSer2)(objectClass=user))"); - var res = ldb.search("(&(cn=ldaptestUSer2)(objectClass=user))"); + var res = ldb.search("(&(cn=ldaptestUSer2)(objectClass=user))", base_dn, ldb.SCOPE_SUBTREE, attrs); if (res.error != 0 || res.msgs.length != 1) { println("Could not find (&(cn=ldaptestUSer2)(objectClass=user))"); assert(res.error == 0); @@ -456,6 +457,7 @@ assert(res.msgs[0].objectClass[3] == "user"); assert(res.msgs[0].objectGUID != undefined); assert(res.msgs[0].whenCreated != undefined); + assert(res.msgs[0].ntSecurityDescriptor != undefined); ok = ldb.del(res.msgs[0].dn); if (ok.error != 0) {
