s3-winbindd Only use SamLogonEx when we can get unencrypted session keys

This ensures that we have some check on the session keys being returned
as the RC4 cipher is not checksumed.

The check comes from the fact that the credentials chain is tied to
the netlgon session key, and so if the credentials check passes then
the netlogon session key will be correct, and so the user session key
will be correctly decrypted.

Andrew Bartlett

Signed-off-by: Matthieu Patou <mat@matws.net>
s3: If we can't do validation 6 or sam_logon_ex use sam_logon only

diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index 26fdc5a409a9bfad3ce463036eae1356e1e0fe89..b0b8e40417cd89b4962b1c3138f578d8bc9fb67d 100644 (file)
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -1365,7 +1365,7 @@ static NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
                        domain->can_do_validation6 = false;
                }
 
-               logon_fn = contact_domain->can_do_samlogon_ex
+               logon_fn = (contact_domain->can_do_samlogon_ex && domain->can_do_validation6)
                        ? rpccli_netlogon_sam_network_logon_ex
                        : rpccli_netlogon_sam_network_logon;
 
@@ -1989,7 +1989,7 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain,
                        domain->can_do_validation6 = false;
                }
 
-               logon_fn = contact_domain->can_do_samlogon_ex
+               logon_fn = (contact_domain->can_do_samlogon_ex && domain->can_do_validation6)
                        ? rpccli_netlogon_sam_network_logon_ex
                        : rpccli_netlogon_sam_network_logon;