s3: fix guest auth when winbindd is running

This fix is very subtle.  If a server is configured with "security = share"
and "guest ok = yes" and winbindd is running authorization will fail during
tree connect.

This is due to our inability to map the guest sid S-1-5-21-X-501 to a uid
through sid_to_uid().  Winbindd is unaware of the hard coded mapping
between this sid and whatever uid the name in lp_guestaccount() is assigned.
So sid_to_uid() fails and we exit create_token_from_username() without
ever calling pdb_getsampwsid() which IS aware of the hard coded mapping.

This patch just reorganizes the code, moving sid_to_uid() down to the
block of code in which it is needed, avoiding this early failure.

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 1f00e22a3c426ccc7f59fb470894216a97b03486..c39aa8501d28359d002e396bf8d55168b7094bd2 100644 (file)
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -806,7 +806,7 @@ NTSTATUS create_local_token(auth_serversupplied_info *server_info)
 }
 
 /*
- * Create an artificial NT token given just a username. (Initially indended
+ * Create an artificial NT token given just a username. (Initially intended
  * for force user)
  *
  * We go through lookup_name() to avoid problems we had with 'winbind use
@@ -859,12 +859,6 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
                goto done;
        }
 
-       if (!sid_to_uid(&user_sid, uid)) {
-               DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
-                         username, sid_string_dbg(&user_sid)));
-               goto done;
-       }
-
        if (sid_check_is_in_our_domain(&user_sid)) {
                bool ret;
 
@@ -922,6 +916,12 @@ NTSTATUS create_token_from_username(TALLOC_CTX *mem_ctx, const char *username,
 
        unix_user:
 
+               if (!sid_to_uid(&user_sid, uid)) {
+                       DEBUG(1, ("sid_to_uid for %s (%s) failed\n",
+                                 username, sid_string_dbg(&user_sid)));
+                       goto done;
+               }
+
                uid_to_unix_users_sid(*uid, &user_sid);
 
                pass = getpwuid_alloc(tmp_ctx, *uid);