dsdb-descriptor: Do not do a subtree search unless we have child entries

This avoids a subtree search here in most cases where an object is deleted.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
dsdb: Rework subtree_rename module to use recursive LDB_SCOPE_ONELEVEL searches

This should be more efficient, particularly in the leaf node case when renaming and
deleting entries on large databases.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
dsdb-ridalloc: Rework ridalloc to return error strings where RID allocation fails

We now also only poke the RID manager once per request.

This may help track down why RID allocation can fail, as while we
never wait for the RID set to be created/updated, it may be the only
clue the admin gets as to why the async allocations were failing.

Andrew Bartlett

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
selftest: Ensure the DC has started and and got a RID set before we proceed

This avoids errors when a busy DC has not yet fetched a RID set, showing up
as flapping tests when users are created, such as the samr.large-dc test.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
dsdb: Add assert in drepl_take_FSMO_role

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
rpc_server-drsuapi: Improve comments and DEBUG lines

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
selftest: ensure samba4.rpc.samr.large-dc.two.samr.many is always tested

This test should now be more reliable with the over-allocation of
RID values now fixed.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
selftest: ensure samba4.nss.test.*using.*winbind is always tested

With the winbind fixes now in master this should be more reliable.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
dsdb/samdb: use RECYCLED it implies DELETED...

Signed-off-by: Stefan Metzmacher <metze@samba.org>
torture/drs: Expand an error message to aid debugging

Reviewed-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Stefan Metzmacher <metze@samba.org>
Autobuild-Date(master): Thu Jul 25 13:51:44 CEST 2013 on sn-devel-104
nsswitch: Add OPT_KRB5CCNAME to avoid an error message.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10048

Reviewed-by: Günther Deschner <gd@samba.org>

Autobuild-User(master): Andreas Schneider <asn@cryptomilk.org>
Autobuild-Date(master): Fri Jul 26 17:40:26 CEST 2013 on sn-devel-104
selftest: Print error message when smbd does not have ADS support

When smbd cannot be compiled with ADS support, setting up the s3member
environment fails with:

samba: using 'standard' process model
Samba can't provide environment 's3member' at /test/samba/selftest/target/Samba.pm line 44.
Can't use string ("UNKNOWN") as a HASH ref while "strict refs" in use at /test/samba/selftest/selftest.pl line 852.
samba: EOF on stdin - terminating

Add an explicit error message for the missing ADS support to make this
easier to debug and also avoid the warning about the hash reference:

samba: using 'standard' process model
Samba can't provide environment 's3member' at /test/samba/selftest/target/Samba.pm line 44.
Unable to setup environment s3member at /test/samba/selftest/selftest.pl line 851.
smbd does not have ADS support
samba: EOF on stdin - terminating

Signed-off-by: Christof Schmitt <christof.schmitt@us.ibm.com>
Reviewed-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Sat Jul 27 08:31:14 CEST 2013 on sn-devel-104
dns: Update TODO list

A lot of the todo items have been resolved, avoid confusing people.

Signed-off-by: Kai Blin <kai@samba.org>

Reviewed-by: Andrew Bartlett <abartlet@samba.org>

Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Mon Jul 29 09:12:17 CEST 2013 on sn-devel-104
s3:winbind: fix gid counting and error handling in the getgroups implementation

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
s3:winbind: fix the getgroups implementation to include the user sid's GID in case of ID_TYPE_BOTH

This is important for acl checks on the unix level where only a group ace
has been added to the ACL for the user sid, e.g. when accessing Files with
nfs or local unix processes.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
s3:winbind: change getgroups to only do one sids2xids call instead of many

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>
s3:winbind: add a warning DEBUG message when skipping a sid from the mapped GID list

This presents a potential security problem when ACLs contain DENY ACEs.

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>

Signed-off-by: Michael Adam <obnox@samba.org>
Signed-off-by: Stefan Metzmacher <metze@samba.org>

Autobuild-User(master): Michael Adam <obnox@samba.org>
Autobuild-Date(master): Mon Jul 29 14:42:27 CEST 2013 on sn-devel-104
dsdb: Prune deleted objects of links and extra attributes of replicated deletes

When an object is deleted, the links to be removed are not propogated,
you have to watch out for them manually!

We do this by calling back into the originating update delete code (ie
what is called if you ldb_delete() locally) so that any extra
attribute found locally and not on the remote server becomes removed
remotely too.

We currently do the same with links, but that isn't strictly correct,
but for now our getNCChanges server code filters these out, so only
the usn is bumped.

Andrew Bartlett

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>
dsdb/repl_meta_data: split out replmd_deletion_state()

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
dsdb: Ensure we always force deleted objects back under the deleted objects DN

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Stefan Metzmacher <metze@samba.org>