sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-22 22:04:08 +03:00
Code

Revert "s3-winbindd: make sure we obey the -n switch also for samlogon cache access."

Browse Source 
This reverts commit ae6a779bf9f816680e724ede37324b7f5355996b.

Bug 9125 analysis from Volker:

The problem is that there are no network calls possible at all that
would do what the samlogon cache does for us. There is just no way to
retrieve the group membership in a complex trusted environment. If you
have just a single domain with Samba as domain controller it might be
possible, but even within a single domain it is not possible to
correctly retrieve all group memberships using LDAP calls due to ACLs on
directory objects. The call to get that is called NetSamLogon on the
NETLOGON pipe. But this call requires user credentials and might trigger
updating counts on the server. So to correctly implement wbinfo -r after
a user has logged in, you have two alternatives: Save the info3 struct
or the PAC in the netsamlogon cache. If you insist on doing network
calls, you need to cache the user credentials somewhere to re-do the
NetSamLogon call every time the wbinfo -r is requested.

Reviewed-by: Andreas Schneider <asn@samba.org>
This commit is contained in:
David Disseldorp 2012-11-06 12:29:24 +01:00 committed by Andreas Schneider
parent ec0104b1e0
commit 9195792a38
4 changed files with 3 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
source3/winbindd/winbindd_ads.c
View File

@ -503,7 +503,7 @@ static NTSTATUS query_user(struct winbindd_domain *domain,
/* try netsamlogon cache first */
if (winbindd_use_cache() && (user = netsamlogon_cache_get( mem_ctx, sid )) != NULL )
if ( (user = netsamlogon_cache_get( mem_ctx, sid )) != NULL )
{
DEBUG(5,("query_user: Cache lookup succeeded for %s\n",
sid_string_dbg(sid)));

4
source3/winbindd/winbindd_cache.c
View File

@ -1302,10 +1302,6 @@ NTSTATUS wcache_get_creds(struct winbindd_domain *domain,
uint32 rid;
fstring tmp;
if (!winbindd_use_cache()) {
return NT_STATUS_OBJECT_NAME_NOT_FOUND;
}
if (!cache->tdb) {
return NT_STATUS_INTERNAL_DB_ERROR;
}

4
source3/winbindd/winbindd_creds.c
View File

@ -38,10 +38,6 @@ NTSTATUS winbindd_get_creds(struct winbindd_domain *domain,
struct netr_SamInfo3 *info;
NTSTATUS status;
if (!winbindd_use_cache()) {
return NT_STATUS_OBJECT_NAME_NOT_FOUND;
}
status = wcache_get_creds(domain, mem_ctx, sid, cached_nt_pass, cred_salt);
if (!NT_STATUS_IS_OK(status)) {
return status;

4
source3/winbindd/winbindd_msrpc.c
View File

@ -407,7 +407,7 @@ static NTSTATUS msrpc_query_user(struct winbindd_domain *domain,
{
struct rpc_pipe_client *samr_pipe;
struct policy_handle dom_pol;
struct netr_SamInfo3 *user = NULL;
struct netr_SamInfo3 *user;
TALLOC_CTX *tmp_ctx;
NTSTATUS status;
@ -425,9 +425,7 @@ static NTSTATUS msrpc_query_user(struct winbindd_domain *domain,
}
/* try netsamlogon cache first */
if (winbindd_use_cache()) {
user = netsamlogon_cache_get(tmp_ctx, user_sid);
}
if (user != NULL) {
DEBUG(5,("msrpc_query_user: Cache lookup succeeded for %s\n",
sid_string_dbg(user_sid)));