s3-auth consolidate create_local_token() into make_server_info_krb5()

This ensures that all callers don't need to each add builtin groups
and privileges to the user's token

Andrew Bartlett

diff --git a/source3/auth/user_krb5.c b/source3/auth/user_krb5.c
index 50716fd56b20e5e17e3af3f6532672b311915513..45e4d08d2cd48e09a0d5de9a3616aaef307d9c71 100644 (file)
--- a/source3/auth/user_krb5.c
+++ b/source3/auth/user_krb5.c
@@ -182,7 +182,7 @@ NTSTATUS make_server_info_krb5(TALLOC_CTX *mem_ctx,
                                char *username,
                                struct passwd *pw,
                                struct PAC_LOGON_INFO *logon_info,
-                               bool mapped_to_guest,
+                              bool mapped_to_guest, bool username_was_mapped,
                                struct auth_serversupplied_info **server_info)
 {
        NTSTATUS status;
@@ -256,7 +256,17 @@ NTSTATUS make_server_info_krb5(TALLOC_CTX *mem_ctx,
                        (*server_info)->info3->base.domain.string =
                                talloc_strdup((*server_info)->info3, ntdomain);
                }
+       }
+
+       (*server_info)->nss_token |= username_was_mapped;
 
+       if (!mapped_to_guest) {
+               status = create_local_token(*server_info);
+               if (!NT_STATUS_IS_OK(status)) {
+                       DEBUG(10,("failed to create local token: %s\n",
+                               nt_errstr(status)));
+                       return status;
+               }
        }
 
        return NT_STATUS_OK;

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 30774c7f181f13fd4319c54d487a9c61821903fd..1c00d058ce24502f3f5abc4b77c7d663bf6933e0 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -4803,13 +4803,13 @@ NTSTATUS get_user_from_kerberos_info(TALLOC_CTX *mem_ctx,
                                     char **username,
                                     struct passwd **_pw);
 NTSTATUS make_server_info_krb5(TALLOC_CTX *mem_ctx,
-                               char *ntuser,
-                               char *ntdomain,
-                               char *username,
-                               struct passwd *pw,
-                               struct PAC_LOGON_INFO *logon_info,
-                               bool mapped_to_guest,
-                               struct auth_serversupplied_info **server_info);
+                              char *ntuser,
+                              char *ntdomain,
+                              char *username,
+                              struct passwd *pw,
+                              struct PAC_LOGON_INFO *logon_info,
+                              bool mapped_to_guest, bool username_was_mapped,
+                              struct auth_serversupplied_info **server_info);
 
 /* The following definitions come from smbd/message.c  */
 

diff --git a/source3/rpc_server/dcesrv_gssapi.c b/source3/rpc_server/dcesrv_gssapi.c
index 60cfca9b86de225fea5f73ea7c3d7f2dbd5a2eb3..41ae542f268a60ba7cfa964415fb3ff87111d6ce 100644 (file)
--- a/source3/rpc_server/dcesrv_gssapi.c
+++ b/source3/rpc_server/dcesrv_gssapi.c
@@ -229,7 +229,7 @@ NTSTATUS gssapi_server_get_user_info(struct gse_context *gse_ctx,
 
        status = make_server_info_krb5(mem_ctx,
                                        ntuser, ntdomain, username, pw,
-                                       logon_info, is_guest, server_info);
+                                      logon_info, is_guest, is_mapped, server_info);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1, ("Failed to map kerberos pac to server info (%s)\n",
                          nt_errstr(status)));

diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index bb10902e4ea2687eb90f7cac54a8c1213623b1d7..110dab78868f017a9bedba02bf962946c491c523 100644 (file)
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -752,16 +752,6 @@ static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
                return status;
        }
 
-       if ((*session_info)->security_token == NULL) {
-               status = create_local_token(*session_info);
-               if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(1, ("Failed to create local user token (%s)\n",
-                                 nt_errstr(status)));
-                       status = NT_STATUS_ACCESS_DENIED;
-                       return status;
-               }
-       }
-
        /* TODO: this is what the ntlmssp code does with the session_key, check
         * it is ok with gssapi too */
        /*

diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index d9333502b877d8152b239742108566fc61ed7b95..028be3306ffb288efa93ddd8b46cff2e1797c54a 100644 (file)
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -369,6 +369,7 @@ static void reply_spnego_kerberos(struct smb_request *req,
        ret = make_server_info_krb5(mem_ctx,
                                    user, domain, real_username, pw,
                                    logon_info, map_domainuser_to_guest,
+                                   username_was_mapped,
                                    &server_info);
        if (!NT_STATUS_IS_OK(ret)) {
                DEBUG(1, ("make_server_info_krb5 failed!\n"));
@@ -379,25 +380,6 @@ static void reply_spnego_kerberos(struct smb_request *req,
                return;
        }
 
-       server_info->nss_token |= username_was_mapped;
-
-       /* we need to build the token for the user. make_server_info_guest()
-          already does this */
-
-       if ( !server_info->security_token ) {
-               ret = create_local_token( server_info );
-               if ( !NT_STATUS_IS_OK(ret) ) {
-                       DEBUG(10,("failed to create local token: %s\n",
-                               nt_errstr(ret)));
-                       data_blob_free(&ap_rep);
-                       data_blob_free(&session_key);
-                       TALLOC_FREE( mem_ctx );
-                       TALLOC_FREE( server_info );
-                       reply_nterror(req, nt_status_squash(ret));
-                       return;
-               }
-       }
-
        if (!is_partial_auth_vuid(sconn, sess_vuid)) {
                sess_vuid = register_initial_vuid(sconn);
        }

diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
index d1ebe9b673a31780b43761877ec1a0e40b944479..db1d8e816b5fd19b1927dd6f837f4895894145bc 100644 (file)
--- a/source3/smbd/smb2_sesssetup.c
+++ b/source3/smbd/smb2_sesssetup.c
@@ -234,29 +234,15 @@ static NTSTATUS smbd_smb2_session_setup_krb5(struct smbd_smb2_session *session,
        reload_services(smb2req->sconn->msg_ctx, smb2req->sconn->sock, true);
 
        status = make_server_info_krb5(session,
-                                       user, domain, real_username, pw,
-                                       logon_info, map_domainuser_to_guest,
-                                       &session->session_info);
+                                      user, domain, real_username, pw,
+                                      logon_info, map_domainuser_to_guest,
+                                      username_was_mapped,
+                                      &session->session_info);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(1, ("smb2: make_server_info_krb5 failed\n"));
                goto fail;
        }
 
-
-       session->session_info->nss_token |= username_was_mapped;
-
-       /* we need to build the token for the user. make_session_info_guest()
-          already does this */
-
-       if (!session->session_info->security_token ) {
-               status = create_local_token(session->session_info);
-               if (!NT_STATUS_IS_OK(status)) {
-                       DEBUG(10,("smb2: failed to create local token: %s\n",
-                               nt_errstr(status)));
-                       goto fail;
-               }
-       }
-
        if ((in_security_mode & SMB2_NEGOTIATE_SIGNING_REQUIRED) ||
             lp_server_signing() == Required) {
                session->do_signing = true;