sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00
Code

Fix bug #7589 - ntlm_auth fails to use cached credentials.

Browse Source 
In handling the WINBINDD_PAM_AUTH message winbindd canonicalizes a *copy*
of the mapped username, but fails to canonicalize the actual username
sent to the backend domain process. When "winbind default domain"
is set this can lead to credentials being cached with an index of
user: user, not DOMAIN\user. All other code paths that use
canonicalize_username() (WINBINDD_PAM_CHAUTHTOK, WINBINDD_PAM_LOGOFF)
correctly canonicalize the data sent to the backend. All calls
the can cause credentials to be looked up (PAM_CHAUTHTOK etc.)
correctly call canonicalize_username() to create the credential
lookup key.

Jeremy.
This commit is contained in:
Jeremy Allison 2010-07-29 12:44:00 -07:00
parent e8d386704e
commit 4f43030482
1 changed files with 5 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
source3/winbindd/winbindd_pam_auth.c
View File

@ -35,7 +35,7 @@ struct tevent_req *winbindd_pam_auth_send(TALLOC_CTX *mem_ctx,
struct tevent_req *req, *subreq;
struct winbindd_pam_auth_state *state;
struct winbindd_domain *domain;
fstring name_domain, name_user, mapped_user;
fstring name_domain, name_user;
char *mapped = NULL;
NTSTATUS status;
@ -62,17 +62,15 @@ struct tevent_req *winbindd_pam_auth_send(TALLOC_CTX *mem_ctx,
status = normalize_name_unmap(state, request->data.auth.user, &mapped);
/* If the name normalization didnt' actually do anything,
just use the original name */
/* If the name normalization changed something, copy it over the given
name */
if (NT_STATUS_IS_OK(status)
|| NT_STATUS_EQUAL(status, NT_STATUS_FILE_RENAMED)) {
fstrcpy(mapped_user, mapped);
} else {
fstrcpy(mapped_user, request->data.auth.user);
fstrcpy(request->data.auth.user, mapped);
}
if (!canonicalize_username(mapped_user, name_domain, name_user)) {
if (!canonicalize_username(request->data.auth.user, name_domain, name_user)) {
tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
return tevent_req_post(req, ev);
}