sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2024-12-23 17:34:34 +03:00
Code

Only retrieve password policies in pam_auth when WBFLAG_PAM_GET_PWD_POLICY is set.

Browse Source 
This essentially re-establishes r14496 (2155bb0535)
which was undone in r17723 (43bd8c00ab) for
reasons that are unclear to me. Maybe I am being too naive.

Now we do again only retrieve the password policy when called from
the pam_winbind module. This fixes logons delegated to AD trusted
domain controllers: We need to connect to the sam to retrieve the
password policy. But auhtenticated session setup is not possible
when contacting the trusted domain dc and afterwards, SamrConnect
also fails with whatever credentials and method used.

Michael
This commit is contained in:
Michael Adam 2007-12-19 17:53:14 +01:00 committed by Günther Deschner
parent b5f600fab5
commit 6d765e0de5
3 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
source/nsswitch/pam_winbind.c
View File

@ -1201,6 +1201,7 @@ static int winbind_auth_request(pam_handle_t * pamh,
request.data.auth.uid = -1;
request.flags = WBFLAG_PAM_INFO3_TEXT |
WBFLAG_PAM_GET_PWD_POLICY |
WBFLAG_PAM_CONTACT_TRUSTDOM;
if (ctrl & (WINBIND_KRB5_AUTH|WINBIND_CACHED_LOGIN)) {

2
source/nsswitch/winbind_struct_protocol.h
View File

@ -194,7 +194,7 @@ typedef struct winbindd_gr {
#define WBFLAG_PAM_KRB5 0x00001000
#define WBFLAG_PAM_FALLBACK_AFTER_KRB5 0x00002000
#define WBFLAG_PAM_CACHED_LOGIN 0x00004000
#define WBFLAG_PAM_GET_PWD_POLICY 0x00008000 /* not used */
#define WBFLAG_PAM_GET_PWD_POLICY 0x00008000
/* generic request flags */
#define WBFLAG_QUERY_ONLY 0x00000020 /* not used */

15
source/winbindd/winbindd_pam.c
View File

@ -1593,13 +1593,16 @@ process_result:
}
}
result = fillup_password_policy(domain, state);
if (!NT_STATUS_IS_OK(result)
&& !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
{
DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
goto done;
if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
result = fillup_password_policy(domain, state);
if (!NT_STATUS_IS_OK(result)
&& !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) )
{
DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
goto done;
}
}
result = NT_STATUS_OK;