sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-24 13:57:43 +03:00
Code

s3:auth_sam: map an empty domain or '.' to the local SAM name

Browse Source 
When a domain member gets an empty domain name or '.', it should
not forward the authentication to domain controllers of
the primary domain.

But we need to keep passing UPN account names with
an empty domain to the DCs as a domain member.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14247

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
Stefan Metzmacher 2020-01-23 16:21:43 +01:00 committed by Andreas Schneider
parent a9eeea6ef7
commit 590df382be
3 changed files with 41 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
python/samba/tests/auth_log_winbind.py
View File

@ -321,7 +321,7 @@ class AuthLogTestsWinbind(AuthLogTestBase, BlackboxTestCase):
self.assertEquals("unix:", msg["Authentication"]["localAddress"])
self.assertEquals('', msg["Authentication"]["clientDomain"])
# This is what the existing winbind implementation returns.
self.assertEquals("NT_STATUS_INVALID_HANDLE",
self.assertEquals("NT_STATUS_NO_SUCH_USER",
msg["Authentication"]["status"])
self.assertEquals(self.credentials.get_username(),
msg["Authentication"]["clientAccount"])
@ -424,7 +424,7 @@ class AuthLogTestsWinbind(AuthLogTestBase, BlackboxTestCase):
self.assertEquals("unix:", msg["Authentication"]["localAddress"])
self.assertEquals('', msg["Authentication"]["clientDomain"])
# This is what the existing winbind implementation returns.
self.assertEquals("NT_STATUS_INVALID_HANDLE",
self.assertEquals("NT_STATUS_NO_SUCH_USER",
msg["Authentication"]["status"])
self.assertEquals(self.credentials.get_username(),
msg["Authentication"]["clientAccount"])

2
selftest/knownfail.d/empty-domain-name
View File

@ -1,5 +1,5 @@
^samba3.blackbox.smbclient_auth.empty_domain.domain_creds.smbclient.*as.user.*nt4_member
^samba3.blackbox.smbclient_auth.empty_domain.member_creds.smbclient.*as.user.*ad_member
^samba3.blackbox.smbclient_auth.empty_domain.domain_creds.smbclient.*as.user.*ad_member
^samba3.blackbox.smbclient_auth.dot_domain.domain_creds.smbclient.*as.user.*nt4_member
^samba3.blackbox.smbclient_auth.dot_domain.domain_creds.smbclient.*as.user.*ad_member
^samba3.blackbox.smbclient_auth.upn.domain_creds.smbclient.*as.*user.*nt4_member

38
source3/auth/auth_sam.c
View File

@ -93,10 +93,36 @@ static NTSTATUS auth_samstrict_auth(const struct auth_context *auth_context,
return NT_STATUS_NOT_IMPLEMENTED;
}
if (lp_server_role() == ROLE_DOMAIN_MEMBER) {
const char *p = NULL;
p = strchr_m(user_info->mapped.account_name, '@');
if (p != NULL) {
/*
* This needs to go to the DC,
* even if @ is the last character
*/
return NT_STATUS_NOT_IMPLEMENTED;
}
}
if (effective_domain == NULL) {
effective_domain = "";
}
DBG_DEBUG("Check auth for: [%s]\\[%s]\n",
effective_domain,
user_info->mapped.account_name);
if (strequal(effective_domain, "") || strequal(effective_domain, ".")) {
/*
* An empty domain name or '.' should be handled
* as the local SAM name.
*/
effective_domain = lp_netbios_name();
}
is_local_name = is_myname(effective_domain);
is_my_domain = strequal(effective_domain, lp_workgroup());
@ -174,6 +200,10 @@ static NTSTATUS auth_sam_netlogon3_auth(const struct auth_context *auth_context,
return NT_STATUS_NOT_IMPLEMENTED;
}
if (effective_domain == NULL) {
effective_domain = "";
}
DBG_DEBUG("Check auth for: [%s]\\[%s]\n",
effective_domain,
user_info->mapped.account_name);
@ -189,6 +219,14 @@ static NTSTATUS auth_sam_netlogon3_auth(const struct auth_context *auth_context,
return NT_STATUS_INVALID_SERVER_STATE;
}
if (strequal(effective_domain, "") || strequal(effective_domain, ".")) {
/*
* An empty domain name or '.' should be handled
* as the local SAM name.
*/
effective_domain = lp_workgroup();
}
is_my_domain = strequal(user_info->mapped.domain_name, lp_workgroup());
if (!is_my_domain) {
DBG_INFO("%s is not our domain name (DC for %s)\n",