Blame SOURCES/0005-join-add-all-attributes-while-creating-computer-obje.patch

776d17
From e9198751411d11785ac6e7e533d63911b6e51326 Mon Sep 17 00:00:00 2001
776d17
From: Sumit Bose <sbose@redhat.com>
776d17
Date: Mon, 11 Jun 2018 09:44:49 +0200
776d17
Subject: [PATCH 5/7] join: add all attributes while creating computer object
776d17
776d17
It is possible to create special accounts which can only join a computer
776d17
to a domain but is not allowed to do any further operations which the
776d17
computer object. As a result if such an account is used during the join
776d17
only the ldapadd operation is permitted but not any later ldapmodify
776d17
operation. To create the computer object correctly in this case all
776d17
attributes must be added while the object is created and not later.
776d17
776d17
Related to https://bugzilla.redhat.com/show_bug.cgi?id=1542354
776d17
---
776d17
 library/adenroll.c | 52 +++++++++++++++++++++++++++++++++++++++++++++++-----
776d17
 1 file changed, 47 insertions(+), 5 deletions(-)
776d17
776d17
diff --git a/library/adenroll.c b/library/adenroll.c
776d17
index 1ed94f2..3f8d017 100644
776d17
--- a/library/adenroll.c
776d17
+++ b/library/adenroll.c
776d17
@@ -573,7 +573,7 @@ calculate_enctypes (adcli_enroll *enroll, char **enctype)
776d17
 	is_2008_or_later = adcli_conn_server_has_capability (enroll->conn, ADCLI_CAP_V60_OID);
776d17
 
776d17
 	/* In 2008 or later, use the msDS-supportedEncryptionTypes attribute */
776d17
-	if (is_2008_or_later) {
776d17
+	if (is_2008_or_later && enroll->computer_attributes != NULL) {
776d17
 		value = _adcli_ldap_parse_value (ldap, enroll->computer_attributes,
776d17
 		                                 "msDS-supportedEncryptionTypes");
776d17
 
776d17
@@ -618,7 +618,6 @@ calculate_enctypes (adcli_enroll *enroll, char **enctype)
776d17
 	return ADCLI_SUCCESS;
776d17
 }
776d17
 
776d17
-
776d17
 static adcli_result
776d17
 create_computer_account (adcli_enroll *enroll,
776d17
                          LDAP *ldap)
776d17
@@ -628,22 +627,65 @@ create_computer_account (adcli_enroll *enroll,
776d17
 	char *vals_sAMAccountName[] = { enroll->computer_sam, NULL };
776d17
 	LDAPMod sAMAccountName = { LDAP_MOD_ADD, "sAMAccountName", { vals_sAMAccountName, } };
776d17
 	char *vals_userAccountControl[] = { "69632", NULL }; /* WORKSTATION_TRUST_ACCOUNT | DONT_EXPIRE_PASSWD */
776d17
-	LDAPMod userAccountControl = { LDAP_MOD_REPLACE, "userAccountControl", { vals_userAccountControl, } };
776d17
+	LDAPMod userAccountControl = { LDAP_MOD_ADD, "userAccountControl", { vals_userAccountControl, } };
776d17
+	char *vals_supportedEncryptionTypes[] = { NULL, NULL };
776d17
+	LDAPMod encTypes = { LDAP_MOD_ADD, "msDS-supportedEncryptionTypes", { vals_supportedEncryptionTypes, } };
776d17
+	char *vals_dNSHostName[] = { enroll->host_fqdn, NULL };
776d17
+	LDAPMod dNSHostName = { LDAP_MOD_ADD, "dNSHostName", { vals_dNSHostName, } };
776d17
+	char *vals_operatingSystem[] = { enroll->os_name, NULL };
776d17
+	LDAPMod operatingSystem = { LDAP_MOD_ADD, "operatingSystem", { vals_operatingSystem, } };
776d17
+	char *vals_operatingSystemVersion[] = { enroll->os_version, NULL };
776d17
+	LDAPMod operatingSystemVersion = { LDAP_MOD_ADD, "operatingSystemVersion", { vals_operatingSystemVersion, } };
776d17
+	char *vals_operatingSystemServicePack[] = { enroll->os_service_pack, NULL };
776d17
+	LDAPMod operatingSystemServicePack = { LDAP_MOD_ADD, "operatingSystemServicePack", { vals_operatingSystemServicePack, } };
776d17
+	char *vals_userPrincipalName[] = { enroll->user_principal, NULL };
776d17
+	LDAPMod userPrincipalName = { LDAP_MOD_ADD, "userPrincipalName", { vals_userPrincipalName, }, };
776d17
+	LDAPMod servicePrincipalName = { LDAP_MOD_ADD, "servicePrincipalName", { enroll->service_principals, } };
776d17
+
776d17
+	char *val = NULL;
776d17
 
776d17
 	int ret;
776d17
+	size_t c;
776d17
+	size_t m;
776d17
 
776d17
-	LDAPMod *mods[] = {
776d17
+	LDAPMod *all_mods[] = {
776d17
 		&objectClass,
776d17
 		&sAMAccountName,
776d17
 		&userAccountControl,
776d17
-		NULL,
776d17
+		&encTypes,
776d17
+		&dNSHostName,
776d17
+		&operatingSystem,
776d17
+		&operatingSystemVersion,
776d17
+		&operatingSystemServicePack,
776d17
+		&userPrincipalName,
776d17
+		&servicePrincipalName,
776d17
+		NULL
776d17
 	};
776d17
 
776d17
+	size_t mods_count = sizeof (all_mods) / sizeof (LDAPMod *);
776d17
+	LDAPMod *mods[mods_count];
776d17
+
776d17
 	if (adcli_enroll_get_trusted_for_delegation (enroll)) {
776d17
 		vals_userAccountControl[0] = "593920"; /* WORKSTATION_TRUST_ACCOUNT | DONT_EXPIRE_PASSWD | TRUSTED_FOR_DELEGATION */
776d17
 	}
776d17
 
776d17
+	ret = calculate_enctypes (enroll, &val;;
776d17
+	if (ret != ADCLI_SUCCESS) {
776d17
+		return ret;
776d17
+	}
776d17
+	vals_supportedEncryptionTypes[0] = val;
776d17
+
776d17
+	m = 0;
776d17
+	for (c = 0; c < mods_count - 1; c++) {
776d17
+		/* Skip empty LDAP sttributes */
776d17
+		if (all_mods[c]->mod_vals.modv_strvals[0] != NULL) {
776d17
+			mods[m++] = all_mods[c];
776d17
+		}
776d17
+	}
776d17
+	mods[m] = NULL;
776d17
+
776d17
 	ret = ldap_add_ext_s (ldap, enroll->computer_dn, mods, NULL, NULL);
776d17
+	free (val);
776d17
 
776d17
 	/*
776d17
 	 * Hand to head. This is really dumb... AD returns
776d17
-- 
776d17
2.14.4
776d17