sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-09 08:58:35 +03:00
Code

s4-dsdb: support LDB_CONTROL_RODC_DCPROMO_OID for nTDSDSA add

Browse Source 
this control disables the system only check for nTDSDSA add operations

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Andrew Tridgell 2010-08-17 11:13:59 +10:00
parent 974279b67d
commit 527042f78b
1 changed files with 24 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
source4/dsdb/samdb/ldb_modules/objectclass.c
View File

@ -432,6 +432,27 @@ static int objectclass_add(struct ldb_module *module, struct ldb_request *req)
return ldb_next_request(ac->module, search_req); return ldb_next_request(ac->module, search_req);
} }
/*
check if this is a special RODC nTDSDSA add
*/
static bool check_rodc_ntdsdsa_add(struct oc_context *ac,
const struct dsdb_class *objectclass)
{
struct ldb_control *rodc_control;
if (strcasecmp(objectclass->lDAPDisplayName, "nTDSDSA") != 0) {
return false;
}
rodc_control = ldb_request_get_control(ac->req, LDB_CONTROL_RODC_DCPROMO_OID);
if (!rodc_control) {
return false;
}
rodc_control->critical = false;
return true;
}
static int objectclass_do_add(struct oc_context *ac) static int objectclass_do_add(struct oc_context *ac)
{ {
struct ldb_context *ldb; struct ldb_context *ldb;
@ -566,7 +587,9 @@ static int objectclass_do_add(struct oc_context *ac)
return LDB_ERR_NAMING_VIOLATION; return LDB_ERR_NAMING_VIOLATION;
} }
if (objectclass->systemOnly && !ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID)) { if (objectclass->systemOnly &&
!ldb_request_get_control(ac->req, LDB_CONTROL_RELAX_OID) &&
!check_rodc_ntdsdsa_add(ac, objectclass)) {
ldb_asprintf_errstring(ldb, "objectClass %s is systemOnly, rejecting creation of %s", ldb_asprintf_errstring(ldb, "objectClass %s is systemOnly, rejecting creation of %s",
objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn)); objectclass->lDAPDisplayName, ldb_dn_get_linearized(msg->dn));
return LDB_ERR_UNWILLING_TO_PERFORM; return LDB_ERR_UNWILLING_TO_PERFORM;