s4-drs: add the magic DRS SPNs on AddEntry

When a DsAddEntry is used to create a nTDSDSA object we need to also
create the SPNs for the NTDS GUID in the servers machine account.

diff --git a/source4/dsdb/repl/replicated_objects.c b/source4/dsdb/repl/replicated_objects.c
index 459c7b5455d45aa2f858f4b9a2880a83f66bad01..ecf2856eb580b07988aa55ecc698818c7ede7379 100644 (file)
--- a/source4/dsdb/repl/replicated_objects.c
+++ b/source4/dsdb/repl/replicated_objects.c
@@ -319,19 +319,6 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
                                               msg->num_elements);
        W_ERROR_HAVE_NO_MEMORY(msg->elements);
 
-       /*
-        * TODO:
-        *
-        * The DsAddEntry() call which creates a nTDSDSA object,
-        * also adds a servicePrincipalName in the following form
-        * to the computer account of the new domain controller
-        * referenced by the "serverReferenece" attribute.
-        *
-        * E3514235-4B06-11D1-AB04-00C04FC2DCD2/<new-ntdsdsa-object-guid-as-string>/<domain-dns-name>
-        *
-        * also note that the "serverReference" isn't added to the new object!
-        */
-
        for (i=0; i < msg->num_elements; i++) {
                struct drsuapi_DsReplicaAttribute *a;
                struct ldb_message_element *e;
@@ -343,7 +330,9 @@ static WERROR dsdb_convert_object(struct ldb_context *ldb,
                W_ERROR_NOT_OK_RETURN(status);
        }
 
+
        *_msg = msg;
+
        return WERR_OK;
 }
 
@@ -396,11 +385,6 @@ WERROR dsdb_origin_objects_commit(struct ldb_context *ldb,
                           num_objects);
        W_ERROR_HAVE_NO_MEMORY(objects);
 
-       ret = ldb_transaction_start(ldb);
-       if (ret != 0) {
-               goto cancel;
-       }
-
        for (i=0; i < num_objects; i++) {
                struct dom_sid *sid = NULL;
                ret = ldb_add(ldb, objects[i]);
@@ -422,11 +406,6 @@ WERROR dsdb_origin_objects_commit(struct ldb_context *ldb,
                }
        }
 
-       ret = ldb_transaction_commit(ldb);
-       if (ret != 0) {
-               goto cancel;
-       }
-
        talloc_free(objects);
 
        *_num = num_objects;

diff --git a/source4/rpc_server/drsuapi/addentry.c b/source4/rpc_server/drsuapi/addentry.c
index 8d94a2949d30a392c97fbfddbdfdb6858debdf8a..ab190e1a7951ebad21f67ecd41e381daadfbcedc 100644 (file)
--- a/source4/rpc_server/drsuapi/addentry.c
+++ b/source4/rpc_server/drsuapi/addentry.c
@@ -31,6 +31,96 @@
 #include "auth/auth.h"
 #include "rpc_server/drsuapi/dcesrv_drsuapi.h"
 
+
+/*
+  add special SPNs needed for DRS replication to machine accounts when
+  an AddEntry is done to create a nTDSDSA object
+ */
+static WERROR drsuapi_add_SPNs(struct drsuapi_bind_state *b_state,
+                              struct dcesrv_call_state *dce_call, TALLOC_CTX *mem_ctx,
+                              const struct drsuapi_DsReplicaObjectListItem *first_object)
+{
+       int ret;
+       const struct drsuapi_DsReplicaObjectListItem *obj;
+       const char *attrs[] = { "serverReference", "objectGUID", NULL };
+
+       for (obj = first_object; obj; obj=obj->next_object) {
+               const char *dn_string = obj->object.identifier->dn;
+               struct ldb_dn *dn = ldb_dn_new(mem_ctx, b_state->sam_ctx, dn_string);
+               struct ldb_result *res;
+               struct ldb_dn *ref_dn;
+               struct GUID ntds_guid;
+               struct ldb_message *msg;
+               struct ldb_message_element *el;
+               const char *ntds_guid_str;
+               const char *dom_string;
+
+               ret = ldb_search(b_state->sam_ctx, mem_ctx, &res,
+                                dn, LDB_SCOPE_BASE, attrs,
+                                "(objectClass=ntDSDSA)");
+               if (ret != LDB_SUCCESS || res->count < 1) {
+                       DEBUG(0,(__location__ ": Failed to find dn '%s'\n", dn_string));
+                       return WERR_DS_DRA_INTERNAL_ERROR;
+               }
+
+               ref_dn = samdb_result_dn(b_state->sam_ctx, mem_ctx, res->msgs[0], "serverReference", NULL);
+               if (ref_dn == NULL) {
+                       /* we only add SPNs for objects with a
+                          serverReference */
+                       continue;
+               }
+
+               ntds_guid = samdb_result_guid(res->msgs[0], "objectGUID");
+
+               ntds_guid_str = GUID_string(res, &ntds_guid);
+
+               dom_string = lp_realm(dce_call->conn->dce_ctx->lp_ctx);
+
+               /*
+                * construct a modify request to add the new SPNs to
+                * the machine account
+                */
+               msg = ldb_msg_new(mem_ctx);
+               if (msg == NULL) {
+                       return WERR_NOMEM;
+               }
+
+               msg->dn = ref_dn;
+               ret = ldb_msg_add_empty(msg, "servicePrincipalName",
+                                       LDB_FLAG_MOD_ADD, &el);
+               if (ret != LDB_SUCCESS) {
+                       return WERR_NOMEM;
+               }
+
+               el->num_values = 2;
+               el->values = talloc_array(el, struct ldb_val, 2);
+               if (el->values == NULL) {
+                       return WERR_NOMEM;
+               }
+               /* the magic constant is the GUID of the DRSUAPI RPC
+                  interface */
+               el->values[0].data = (uint8_t *)talloc_asprintf(el->values, 
+                                                               "E3514235-4B06-11D1-AB04-00C04FC2DCD2/%s/%s", 
+                                                               ntds_guid_str, dom_string);
+               el->values[0].length = strlen((char *)el->values[0].data);
+               el->values[1].data = (uint8_t *)talloc_asprintf(el->values, "ldap/%s/%s", 
+                                                               ntds_guid_str, dom_string);
+               el->values[1].length = strlen((char *)el->values[0].data);
+
+               ret = ldb_modify(b_state->sam_ctx, msg);
+               if (ret != LDB_SUCCESS) {
+                       DEBUG(0,(__location__ ": Failed to add SPNs - %s\n",
+                                ldb_errstring(b_state->sam_ctx)));
+                       return WERR_DS_DRA_INTERNAL_ERROR;
+               }
+       }
+       
+       return WERR_OK;
+}
+
+
+
+
 /* 
   drsuapi_DsAddEntry
 */
@@ -42,6 +132,8 @@ WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX
        struct dcesrv_handle *h;
        uint32_t num = 0;
        struct drsuapi_DsReplicaObjectIdentifier2 *ids = NULL;
+       int ret;
+       const struct drsuapi_DsReplicaObjectListItem *first_object;
 
        if (DEBUGLVL(4)) {
                NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsAddEntry, NDR_IN, r);
@@ -59,14 +151,23 @@ WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
        switch (r->in.level) {
        case 2:
+               ret = ldb_transaction_start(b_state->sam_ctx);
+               if (ret != LDB_SUCCESS) {
+                       return WERR_DS_DRA_INTERNAL_ERROR;
+               }
+
+
+               first_object = &r->in.req->req2.first_object;
+
                status = dsdb_origin_objects_commit(b_state->sam_ctx,
                                                    mem_ctx,
-                                                   &r->in.req->req2.first_object,
+                                                   first_object,
                                                    &num,
                                                    &ids);
                if (!W_ERROR_IS_OK(status)) {
                        r->out.ctr->ctr3.error->info1.status = status;
-                       W_ERROR_NOT_OK_RETURN(status);
+                       ldb_transaction_cancel(b_state->sam_ctx);
+                       return status;
                }
 
                r->out.ctr->ctr3.count = num;
@@ -74,8 +175,23 @@ WERROR dcesrv_drsuapi_DsAddEntry(struct dcesrv_call_state *dce_call, TALLOC_CTX
 
                return WERR_OK;
        default:
-               break;
+               return WERR_FOOBAR;
+       }
+
+       /* if any of the added entries are nTDSDSA objects then we
+        * need to add the SPNs to the machine account
+        */
+       status = drsuapi_add_SPNs(b_state, dce_call, mem_ctx, first_object);
+       if (!W_ERROR_IS_OK(status)) {
+               r->out.ctr->ctr3.error->info1.status = status;
+               ldb_transaction_cancel(b_state->sam_ctx);
+               return status;
+       }
+
+       ret = ldb_transaction_commit(b_state->sam_ctx);
+       if (ret != LDB_SUCCESS) {
+               return WERR_DS_DRA_INTERNAL_ERROR;
        }
 
-       return WERR_FOOBAR;
+       return WERR_OK;
 }