dsdb: Avoid calculating the PSO multiple times

[samba.git] / source4 / auth / sam.c

diff --git a/source4/auth/sam.c b/source4/auth/sam.c
index 22ec8cef2a1f057d9d3023946121120a61a91917..07cfbd06b3363659504580ce7518062e63f7e383 100644 (file)
--- a/source4/auth/sam.c
+++ b/source4/auth/sam.c
@@ -68,6 +68,14 @@ const char *server_attrs[] = {
 };
 
 const char *user_attrs[] = {
+       /*
+        * This ordering (having msDS-ResultantPSO first) is
+        * important.  By processing this attribute first it is
+        * available in the operational module for the other PSO
+        * attribute calcuations to use.
+        */
+       "msDS-ResultantPSO",
+
        KRBTGT_ATTRS,
 
        "logonHours",
@@ -103,7 +111,6 @@ const char *user_attrs[] = {
        "badPasswordTime",
        "lmPwdHistory",
        "ntPwdHistory",
-       "msDS-ResultantPSO",
        NULL,
 };