sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-27 22:50:26 +03:00
Code

s4:kdc: make sure we expand group memberships of the local domain

Browse Source 
BUG: https://bugzilla.samba.org/show_bug.cgi?id=13300

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
Stefan Metzmacher 2018-02-01 18:40:58 +01:00 committed by Andreas Schneider
parent a5f803e9e9
commit 63de04c01c
2 changed files with 11 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
selftest/knownfail.d/expand_trust_token
View File

@ -1 +0,0 @@
^samba4.blackbox.trust_token.Test.token.with.kerberos

11
source4/kdc/pac-glue.c
View File

@ -763,6 +763,17 @@ NTSTATUS samba_kdc_update_pac_blob(TALLOC_CTX *mem_ctx,
return NT_STATUS_UNSUCCESSFUL;
}
/*
* We need to expand group memberships within our local domain,
* as the token might be generated by a trusted domain.
*/
nt_status = authsam_update_user_info_dc(mem_ctx,
krbtgt->kdc_db_ctx->samdb,
user_info_dc);
if (!NT_STATUS_IS_OK(nt_status)) {
return nt_status;
}
nt_status = samba_get_logon_info_pac_blob(mem_ctx,
user_info_dc, pac_blob);