auth: Store group attributes in auth_user_info_dc
authorJoseph Sutton <josephsutton@catalyst.net.nz>
Tue, 27 Sep 2022 02:13:12 +0000 (15:13 +1300)
committerAndrew Bartlett <abartlet@samba.org>
Wed, 8 Feb 2023 00:03:39 +0000 (00:03 +0000)
commit7050e05742956bb75c4b27f39f97adc4d544e0f1
tree32cb1f3ecd162fb05726829be444442425b48ddd
parent53d72c87e6362e24eb922a5a9040e5d631c7fce4
auth: Store group attributes in auth_user_info_dc

Group expansion, performed in dsdb_expand_nested_groups(), now
incorporates a check of the type of each group. Those that are resource
groups receive the SE_GROUP_RESOURCE bit in the attributes which are now
carried alongside each group SID.

Whereas before, in auth_convert_user_info_dc_sambaseinfo() and
auth_convert_user_info_dc_saminfo6(), we invariantly used the flag
combination SE_GROUP_MANDATORY | SE_GROUP_ENABLED_BY_DEFAULT |
SE_GROUP_ENABLED to set attributes in the PAC, we now take the correct
attributes from user_info_dc.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
19 files changed:
auth/auth_sam_reply.c
librpc/idl/auth.idl
selftest/knownfail_heimdal_kdc
source3/auth/auth_ntlmssp.c
source3/auth/auth_util.c
source3/passdb/pdb_samba_dsdb.c
source4/auth/ntlm/auth.c
source4/auth/ntlm/auth_developer.c
source4/auth/sam.c
source4/auth/session.c
source4/auth/system_session.c
source4/dsdb/common/util.c
source4/dsdb/common/util_groups.c
source4/dsdb/samdb/ldb_modules/operational.c
source4/dsdb/samdb/samdb.c
source4/dsdb/samdb/samdb.h
source4/kdc/pac-glue.c
source4/torture/auth/pac.c
source4/torture/rpc/remote_pac.c