sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-26 21:57:41 +03:00
Code

winbindd: Sync secrets.ldb into secrets.tdb on startup

Browse Source 
This ensures that the domain SID and machine account password are written into
secrets.tdb if the secrets.tdb file was either never written or was deleted.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10991

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
This commit is contained in:
Andrew Bartlett 2015-06-12 11:57:07 +12:00 committed by Jeremy Allison
parent b209cd1677
commit 5de7621cbf
1 changed files with 70 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

72
source3/winbindd/winbindd_util.c
View File

@ -29,6 +29,7 @@
#include "passdb.h"
#include "source4/lib/messaging/messaging.h"
#include "librpc/gen_ndr/ndr_lsa.h"
#include "auth/credentials/credentials.h"
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_WINBIND
@ -701,6 +702,49 @@ static void wb_imsg_new_trusted_domain(struct imessaging_context *msg,
TALLOC_FREE(frame);
}
/*
* We did not get the secret when we queried secrets.tdb, so read it
* from secrets.tdb and re-sync the databases
*/
static bool migrate_secrets_tdb_to_ldb(struct winbindd_domain *domain)
{
bool ok;
struct cli_credentials *creds;
NTSTATUS can_migrate = pdb_get_trust_credentials(domain->name,
NULL, domain, &creds);
if (!NT_STATUS_IS_OK(can_migrate)) {
DEBUG(0, ("Failed to fetch our own, local AD domain join "
"password for winbindd's internal use, both from "
"secrets.tdb and secrets.ldb: %s\n",
nt_errstr(can_migrate)));
return false;
}
/*
* NOTE: It is very unlikely we end up here if there is an
* oldpass, because a new password is created at
* classicupgrade, so this is not a concern.
*/
ok = secrets_store_machine_pw_sync(cli_credentials_get_password(creds),
NULL /* oldpass */,
cli_credentials_get_domain(creds),
cli_credentials_get_realm(creds),
cli_credentials_get_salt_principal(creds),
0, /* Supported enc types, unused */
&domain->sid,
cli_credentials_get_password_last_changed_time(creds),
cli_credentials_get_secure_channel_type(creds),
false /* do_delete: Do not delete */);
TALLOC_FREE(creds);
if (ok == false) {
DEBUG(0, ("Failed to write our our own, "
"local AD domain join password for "
"winbindd's internal use into secrets.tdb\n"));
return false;
}
return true;
}
/* Look up global info for the winbind daemon */
bool init_domain_list(void)
{
@ -750,8 +794,32 @@ bool init_domain_list(void)
&account_name,
&sec_chan_type);
if (!ok) {
DEBUG(0, ("Failed to fetch our own, local AD domain join password for winbindd's internal use\n"));
return false;
/*
* If get_trust_pw_hash() fails, then try and
* fetch the password from the more recent of
* secrets.{ldb,tdb} using the
* pdb_get_trust_credentials()
*/
ok = migrate_secrets_tdb_to_ldb(domain);
if (ok == false) {
DEBUG(0, ("Failed to migrate our own, "
"local AD domain join password for "
"winbindd's internal use into "
"secrets.tdb\n"));
return false;
}
ok = get_trust_pw_hash(domain->name,
current_nt_hash.hash,
&account_name,
&sec_chan_type);
if (ok == false) {
DEBUG(0, ("Failed to find our our own, just "
"written local AD domain join "
"password for winbindd's internal "
"use in secrets.tdb\n"));
return false;
}
}
if (sec_chan_type == SEC_CHAN_RODC) {
domain->rodc = true;