s3-winbindd: Fix Bug #6711: trusts to windows 2008 (2008 r2) not working.

Winbindd should always try to use LSA via an schannel authenticated ncacn_ip_tcp
connection when talking to AD for LSA lookup calls.

In Samba <-> W2k8 interdomain trust scenarios, LookupSids3 and LookupNames4 via an
schannel ncacn_ip_tcp LSA connection are the *only* options to successfully resolve
sids and names.

Guenther
(cherry picked from commit 6a8ef6c424c52be861ed2a9806f917a64ec892a6)

diff --git a/source3/winbindd/winbindd.h b/source3/winbindd/winbindd.h
index 32af6565b141be8579f0a851c37f84571db03eba..16812d82a9eb5610bd63acbd3e367234d6f03353 100644 (file)
--- a/source3/winbindd/winbindd.h
+++ b/source3/winbindd/winbindd.h
@@ -183,6 +183,8 @@ struct winbindd_domain {
                                  * to False. This variable is around so that
                                  * we don't have to try _ex every time. */
 
+       bool can_do_ncacn_ip_tcp;
+
        /* Lookup methods for this domain (LDAP or RPC) */
        struct winbindd_methods *methods;
 

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index d2dbcb4194861c80b07f2201f444b061462588fe..46aa3d6d9d3f2f0321743b34283e2d14448b2f94 100644 (file)
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -1933,6 +1933,8 @@ done:
        DEBUG(5,("set_dc_type_and_flags_connect: domain %s is %srunning active directory.\n",
                  domain->name, domain->active_directory ? "" : "NOT "));
 
+       domain->can_do_ncacn_ip_tcp = domain->active_directory;
+
        TALLOC_FREE(cli);
 
        TALLOC_FREE(mem_ctx);

diff --git a/source3/winbindd/winbindd_rpc.c b/source3/winbindd/winbindd_rpc.c
index 8e1a985db9b6999ecf79bed75d0a7be3dff7c0b4..f176fb31370ef818c317a8b215ce471b2a32f1a8 100644 (file)
--- a/source3/winbindd/winbindd_rpc.c
+++ b/source3/winbindd/winbindd_rpc.c
@@ -1175,6 +1175,15 @@ static NTSTATUS msrpc_password_policy(struct winbindd_domain *domain,
        return result;
 }
 
+typedef NTSTATUS (*lookup_sids_fn_t)(struct rpc_pipe_client *cli,
+                                    TALLOC_CTX *mem_ctx,
+                                    struct policy_handle *pol,
+                                    int num_sids,
+                                    const DOM_SID *sids,
+                                    char ***pdomains,
+                                    char ***pnames,
+                                    enum lsa_SidType **ptypes);
+
 NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
                              struct winbindd_domain *domain,
                              uint32_t num_sids,
@@ -1187,12 +1196,23 @@ NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
        struct rpc_pipe_client *cli = NULL;
        struct policy_handle lsa_policy;
        unsigned int orig_timeout;
+       lookup_sids_fn_t lookup_sids_fn = rpccli_lsa_lookup_sids;
 
+       if (domain->can_do_ncacn_ip_tcp) {
+               status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
+               if (NT_STATUS_IS_OK(status)) {
+                       lookup_sids_fn = rpccli_lsa_lookup_sids3;
+                       goto lookup;
+               }
+               domain->can_do_ncacn_ip_tcp = false;
+       }
        status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
+
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
 
+ lookup:
        /*
         * This call can take a long time
         * allow the server to time out.
@@ -1200,9 +1220,14 @@ NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
         */
        orig_timeout = rpccli_set_timeout(cli, 35000);
 
-       status = rpccli_lsa_lookup_sids(cli, mem_ctx, &lsa_policy,
-                                       num_sids, sids, domains,
-                                       names, types);
+       status = lookup_sids_fn(cli,
+                               mem_ctx,
+                               &lsa_policy,
+                               num_sids,
+                               sids,
+                               domains,
+                               names,
+                               types);
 
        /* And restore our original timeout. */
        rpccli_set_timeout(cli, orig_timeout);
@@ -1214,6 +1239,16 @@ NTSTATUS winbindd_lookup_sids(TALLOC_CTX *mem_ctx,
        return status;
 }
 
+typedef NTSTATUS (*lookup_names_fn_t)(struct rpc_pipe_client *cli,
+                                     TALLOC_CTX *mem_ctx,
+                                     struct policy_handle *pol,
+                                     int num_names,
+                                     const char **names,
+                                     const char ***dom_names,
+                                     int level,
+                                     struct dom_sid **sids,
+                                     enum lsa_SidType **types);
+
 NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
                               struct winbindd_domain *domain,
                               uint32_t num_names,
@@ -1226,12 +1261,24 @@ NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
        struct rpc_pipe_client *cli = NULL;
        struct policy_handle lsa_policy;
        unsigned int orig_timeout;
+       lookup_names_fn_t lookup_names_fn = rpccli_lsa_lookup_names;
 
+       if (domain->can_do_ncacn_ip_tcp) {
+               status = cm_connect_lsa_tcp(domain, mem_ctx, &cli);
+               if (NT_STATUS_IS_OK(status)) {
+                       lookup_names_fn = rpccli_lsa_lookup_names4;
+                       goto lookup;
+               }
+               domain->can_do_ncacn_ip_tcp = false;
+       }
        status = cm_connect_lsa(domain, mem_ctx, &cli, &lsa_policy);
+
        if (!NT_STATUS_IS_OK(status)) {
                return status;
        }
 
+ lookup:
+
        /*
         * This call can take a long time
         * allow the server to time out.
@@ -1239,8 +1286,15 @@ NTSTATUS winbindd_lookup_names(TALLOC_CTX *mem_ctx,
         */
        orig_timeout = rpccli_set_timeout(cli, 35000);
 
-       status = rpccli_lsa_lookup_names(cli, mem_ctx, &lsa_policy, num_names,
-                                        names, domains, 1, sids, types);
+       status = lookup_names_fn(cli,
+                                mem_ctx,
+                                &lsa_policy,
+                                num_names,
+                                (const char **) names,
+                                domains,
+                                1,
+                                sids,
+                                types);
 
        /* And restore our original timeout. */
        rpccli_set_timeout(cli, orig_timeout);