sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00
Code

rodc: Allow local RODC changes with version 0

Browse Source 
These changes will get clobbered by RWDCs through replication. This
behaviour is required for lockoutTime to enforce the password lockout
locally on the RODC (and is consistent with Windows).

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Garming Sam 2017-03-24 10:24:21 +13:00 committed by Garming Sam
parent a6f62a4c0b
commit 1cfabd663d
3 changed files with 20 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
source4/dsdb/samdb/ldb_modules/repl_meta_data.c
View File

@ -235,7 +235,6 @@ static bool replmd_check_urgent_attribute(const struct ldb_message_element *el)
return false;
}
static int replmd_replicated_apply_isDeleted(struct replmd_replicated_request *ar);
/*
@ -1506,6 +1505,7 @@ static int replmd_update_rpmd_element(struct ldb_context *ldb,
md1 = &omd->ctr.ctr1.array[i];
md1->version++;
md1->attid = attid;
if (md1->attid == DRSUAPI_ATTID_isDeleted) {
const struct ldb_val *rdn_val = ldb_dn_get_rdn_val(msg->dn);
const char* rdn;
@ -1532,6 +1532,15 @@ static int replmd_update_rpmd_element(struct ldb_context *ldb,
md1->originating_usn = *seq_num;
md1->local_usn = *seq_num;
if (ldb_request_get_control(req, DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE) != NULL) {
/* Force version to 0 to be overriden later via replication */
bool am_rodc = false;
int ret = samdb_rodc(ldb, &am_rodc);
if (ret == LDB_SUCCESS && am_rodc) {
md1->version = 0;
}
}
return LDB_SUCCESS;
}
@ -1837,7 +1846,8 @@ static int replmd_update_rpmd(struct ldb_module *module,
/*if we are RODC and this is a DRSR update then its ok*/
if (!ldb_request_get_control(req, DSDB_CONTROL_REPLICATED_UPDATE_OID)
&& !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)) {
&& !ldb_request_get_control(req, DSDB_CONTROL_DBCHECK_MODIFY_RO_REPLICA)
&& !ldb_request_get_control(req, DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE)) {
unsigned instanceType;
ret = samdb_rodc(ldb, rodc);

6
source4/dsdb/samdb/samdb.h
View File

@ -183,6 +183,12 @@ struct dsdb_control_password_user_account_control {
/* passed when we want to thoroughly delete linked attributes */
#define DSDB_CONTROL_REPLMD_VANISH_LINKS "1.3.6.1.4.1.7165.4.3.29"
/*
* lockoutTime is a replicated attribute, but must be modified before
* connectivity occurs to allow password lockouts.
*/
#define DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE "1.3.6.1.4.1.7165.4.3.31"
#define DSDB_EXTENDED_REPLICATED_OBJECTS_OID "1.3.6.1.4.1.7165.4.4.1"
struct dsdb_extended_replicated_object {
struct ldb_message *msg;

2
source4/setup/schema_samba4.ldif
View File

@ -222,6 +222,8 @@
#Allocated: DSDB_CONTROL_SKIP_DUPLICATES_CHECK_OID 1.3.6.1.4.1.7165.4.3.28
#Allocated: DSDB_CONTROL_REPLMD_VANISH_LINKS 1.3.6.1.4.1.7165.4.3.29
#Allocated: LDB_CONTROL_RECALCULATE_RDN_OID 1.3.6.1.4.1.7165.4.3.30
#Allocated: DSDB_CONTROL_FORCE_RODC_LOCAL_CHANGE 1.3.6.1.4.1.7165.4.3.31
# Extended 1.3.6.1.4.1.7165.4.4.x
#Allocated: DSDB_EXTENDED_REPLICATED_OBJECTS_OID 1.3.6.1.4.1.7165.4.4.1