we can't use the unique index code for samAccountName

Using ldb unique indexes for samAccountName doesn't work with DRS as
the other DC may send us a deleted record (tombstone record), which
has the same samAccountName as an existing record. That would then
create two records in the same partition with the same samAccountName.

So we needed to put back the logic in samldb.c which explicitly
checked whether a samAccountName already exists on add

diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index dad5ff2e806375533b47e79fa54af9d83bc8d46f..8e21e38139b87a1b22398d47997740a97facd047 100644 (file)
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -467,20 +467,87 @@ static int samldb_generate_samAccountName(struct ldb_message *msg)
 }
 
 
-static int samldb_check_samAccountName(struct samldb_ctx *ac)
+static int samldb_check_samAccountName_callback(struct ldb_request *req,
+                                               struct ldb_reply *ares)
 {
+       struct samldb_ctx *ac;
        int ret;
+       
+       ac = talloc_get_type(req->context, struct samldb_ctx);
+       
+       if (ares->error != LDB_SUCCESS) {
+               return ldb_module_done(ac->req, ares->controls,
+                                       ares->response, ares->error);
+       }
+       
+       switch (ares->type) {
+       case LDB_REPLY_ENTRY:           
+               /* if we get an entry it means this samAccountName
+                * already exists */
+               return ldb_module_done(ac->req, NULL, NULL,
+                                       LDB_ERR_ENTRY_ALREADY_EXISTS);
+               
+       case LDB_REPLY_REFERRAL:
+               /* this should not happen */
+               return ldb_module_done(ac->req, NULL, NULL,
+                                       LDB_ERR_OPERATIONS_ERROR);
+               
+       case LDB_REPLY_DONE:
+               /* not found, go on */
+               talloc_free(ares);
+               ret = samldb_next_step(ac);
+               break;
+       }
+       
+       if (ret != LDB_SUCCESS) {
+               return ldb_module_done(ac->req, NULL, NULL, ret);
+       }
+       
+       return LDB_SUCCESS;
+}
 
-       if (ldb_msg_find_element(ac->msg, "samAccountName") == NULL) {
-               ret = samldb_generate_samAccountName(ac->msg);
-               if (ret != LDB_SUCCESS) {
-                       return ret;
-               }
+
+static int samldb_check_samAccountName(struct samldb_ctx *ac)
+{
+       struct ldb_context *ldb;
+       struct ldb_request *req;
+       const char *name;
+       char *filter;
+        int ret;
+       
+       ldb = ldb_module_get_ctx(ac->module);
+       
+        if (ldb_msg_find_element(ac->msg, "samAccountName") == NULL) {
+                ret = samldb_generate_samAccountName(ac->msg);
+                if (ret != LDB_SUCCESS) {
+                        return ret;
+                }
+        }
+       
+       name = ldb_msg_find_attr_as_string(ac->msg, "samAccountName", NULL);
+       if (name == NULL) {
+               return LDB_ERR_OPERATIONS_ERROR;
+       }
+       filter = talloc_asprintf(ac, "samAccountName=%s", ldb_binary_encode_string(ac, name));
+       if (filter == NULL) {
+               return LDB_ERR_OPERATIONS_ERROR;
        }
        
-       return samldb_next_step(ac);
+       ret = ldb_build_search_req(&req, ldb, ac,
+                                  ac->domain_dn, LDB_SCOPE_SUBTREE,
+                                  filter, NULL,
+                                  NULL,
+                                  ac, samldb_check_samAccountName_callback,
+                                  ac->req);
+       talloc_free(filter);
+       if (ret != LDB_SUCCESS) {
+               return ret;
+       }
+       ac->ares = NULL;
+       return ldb_next_request(ac->module, req);
 }
 
+
 static int samldb_check_samAccountType(struct samldb_ctx *ac)
 {
        struct ldb_context *ldb;

diff --git a/source4/dsdb/schema/schema_init.c b/source4/dsdb/schema/schema_init.c
index 2f63931494e6b4e73b46046557611e89064e1105..1084679f8ddf92d6c4db153cb48547ccaf30382e 100644 (file)
--- a/source4/dsdb/schema/schema_init.c
+++ b/source4/dsdb/schema/schema_init.c
@@ -589,7 +589,7 @@ WERROR dsdb_read_prefixes_from_ldb(TALLOC_CTX *mem_ctx, struct ldb_context *ldb,
  */
 static bool dsdb_schema_unique_attribute(const char *attr)
 {
-       const char *attrs[] = { "samAccountName", "objectGUID", "objectSID" , NULL };
+       const char *attrs[] = { "objectGUID", "objectSID" , NULL };
        int i;
        for (i=0;attrs[i];i++) {
                if (strcasecmp(attr, attrs[i]) == 0) {