Use work around for 'winbind use default domain' only if it is set

[metze/samba/wip.git] / source3 / auth / auth_util.c

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index b8f710c9efef0f8315f7363d4d5e071ddab9f70e..83c95a9d4d859b3e7c87d8613a5dd4df8fc36932 100644 (file)
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -33,6 +33,7 @@
 #include "../librpc/gen_ndr/ndr_auth.h"
 #include "../auth/auth_sam_reply.h"
 #include "../librpc/gen_ndr/idmap.h"
+#include "lib/param/loadparm.h"
 
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_AUTH
@@ -47,7 +48,7 @@ static int _smb_create_user(const char *domain, const char *unix_username, const
        char *add_script;
        int ret;
 
-       add_script = talloc_strdup(ctx, lp_adduser_script());
+       add_script = lp_adduser_script(ctx);
        if (!add_script || !*add_script) {
                return -1;
        }
@@ -416,8 +417,8 @@ static NTSTATUS log_nt_token(struct security_token *token)
        char *group_sidstr;
        size_t i;
 
-       if ((lp_log_nt_token_command() == NULL) ||
-           (strlen(lp_log_nt_token_command()) == 0)) {
+       if ((lp_log_nt_token_command(frame) == NULL) ||
+           (strlen(lp_log_nt_token_command(frame)) == 0)) {
                TALLOC_FREE(frame);
                return NT_STATUS_OK;
        }
@@ -430,7 +431,7 @@ static NTSTATUS log_nt_token(struct security_token *token)
        }
 
        command = talloc_string_sub(
-               frame, lp_log_nt_token_command(),
+               frame, lp_log_nt_token_command(frame),
                "%s", sid_string_talloc(frame, &token->sids[0]));
        command = talloc_string_sub(frame, command, "%t", group_sidstr);
 
@@ -843,7 +844,7 @@ static NTSTATUS get_guest_info3(TALLOC_CTX *mem_ctx,
        info3->base.rid = DOMAIN_RID_GUEST;
 
        /* Primary gid */
-       info3->base.primary_gid = BUILTIN_RID_GUESTS;
+       info3->base.primary_gid = DOMAIN_RID_GUESTS;
 
        /* Set as guest */
        info3->base.user_flags = NETLOGON_GUEST;
@@ -963,7 +964,9 @@ static NTSTATUS make_new_session_info_system(TALLOC_CTX *mem_ctx,
 
        server_info->utok.uid = sec_initial_uid();
        server_info->utok.gid = sec_initial_gid();
-       server_info->unix_name = talloc_strdup(server_info, uidtoname(server_info->utok.uid));
+       server_info->unix_name = talloc_asprintf(server_info,
+                                                "NT AUTHORITY%cSYSTEM",
+                                                *lp_winbind_separator());
 
        if (!server_info->unix_name) {
                status = NT_STATUS_NO_MEMORY;
@@ -1249,7 +1252,9 @@ static NTSTATUS check_account(TALLOC_CTX *mem_ctx, const char *domain,
        if (!lower_username) {
                return NT_STATUS_NO_MEMORY;
        }
-       strlower_m( lower_username );
+       if (!strlower_m( lower_username )) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
 
        orig_dom_user = talloc_asprintf(mem_ctx,
                                "%s%c%s",
@@ -1326,7 +1331,8 @@ struct passwd *smb_getpwnam( TALLOC_CTX *mem_ctx, const char *domuser,
                        /* make sure we get the case of the username correct */
                        /* work around 'winbind use default domain = yes' */
 
-                       if ( !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
+                       if ( lp_winbind_use_default_domain() &&
+                            !strchr_m( pw->pw_name, *lp_winbind_separator() ) ) {
                                char *domain;
 
                                /* split the domain and username into 2 strings */
@@ -1402,11 +1408,11 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
        char *found_username = NULL;
        const char *nt_domain;
        const char *nt_username;
+       struct dom_sid user_sid;
+       struct dom_sid group_sid;
        bool username_was_mapped;
        struct passwd *pwd;
        struct auth_serversupplied_info *result;
-       struct dom_sid *group_sid;
-       struct netr_SamInfo3 *i3;
 
        /* 
           Here is where we should check the list of
@@ -1414,6 +1420,15 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
           matches.
        */
 
+       if (!sid_compose(&user_sid, info3->base.domain_sid, info3->base.rid)) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       if (!sid_compose(&group_sid, info3->base.domain_sid,
+                        info3->base.primary_gid)) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
        nt_username = talloc_strdup(mem_ctx, info3->base.account_name.string);
        if (!nt_username) {
                /* If the server didn't give us one, just use the one we sent
@@ -1458,43 +1473,17 @@ NTSTATUS make_server_info_info3(TALLOC_CTX *mem_ctx,
        result->unix_name = talloc_strdup(result, found_username);
 
        /* copy in the info3 */
-       result->info3 = i3 = copy_netr_SamInfo3(result, info3);
+       result->info3 = copy_netr_SamInfo3(result, info3);
        if (result->info3 == NULL) {
                TALLOC_FREE(result);
                return NT_STATUS_NO_MEMORY;
        }
 
        /* Fill in the unix info we found on the way */
+
        result->utok.uid = pwd->pw_uid;
        result->utok.gid = pwd->pw_gid;
 
-       /* We can't just trust that the primary group sid sent us is something
-        * we can really use. Obtain the usable sid, and store the original
-        * one as an additional group if it had to be replaced */
-       nt_status = get_primary_group_sid(mem_ctx, found_username,
-                                         &pwd, &group_sid);
-       if (!NT_STATUS_IS_OK(nt_status)) {
-               TALLOC_FREE(result);
-               return nt_status;
-       }
-
-       /* store and check if it is the same we got originally */
-       sid_peek_rid(group_sid, &i3->base.primary_gid);
-       if (i3->base.primary_gid != info3->base.primary_gid) {
-               uint32_t n = i3->base.groups.count;
-               /* not the same, store the original as an additional group */
-               i3->base.groups.rids =
-                       talloc_realloc(i3, i3->base.groups.rids,
-                                       struct samr_RidWithAttribute, n + 1);
-               if (i3->base.groups.rids == NULL) {
-                       TALLOC_FREE(result);
-                       return NT_STATUS_NO_MEMORY;
-               }
-               i3->base.groups.rids[n].rid = info3->base.primary_gid;
-               i3->base.groups.rids[n].attributes = SE_GROUP_ENABLED;
-               i3->base.groups.count = n + 1;
-       }
-
        /* ensure we are never given NULL session keys */
 
        if (memcmp(info3->base.key.key, zeros, sizeof(zeros)) == 0) {