sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-08-02 00:22:11 +03:00
Code Activity

added trusted realm support to ADS authentication

Browse Source 
the method used for checking if a domain is a trusted domain is very
crude, we should really call a backend fn of some sort. For now I'm
using winbindd to do the dirty work.
This commit is contained in:
Andrew Tridgell
-
parent ee1c3e1f04
commit adf44a9bd0
7 changed files with 54 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
source/smbd/sesssetup.c
View File

@ -107,14 +107,18 @@ static int reply_spnego_kerberos(connection_struct *conn,
*p = 0;
if (strcasecmp(p+1, ads->realm) != 0) {
DEBUG(3,("Ticket for incorrect realm %s\n", p+1));
ads_destroy(&ads);
return ERROR_NT(NT_STATUS_LOGON_FAILURE);
DEBUG(3,("Ticket for foreign realm %s@%s\n", client, p+1));
if (!lp_allow_trusted_domains()) {
return ERROR_NT(NT_STATUS_LOGON_FAILURE);
}
/* this gives a fully qualified user name (ie. with full realm).
that leads to very long usernames, but what else can we do? */
asprintf(&user, "%s%s%s", p+1, lp_winbind_separator(), client);
} else {
user = strdup(client);
}
ads_destroy(&ads);
user = client;
/* the password is good - let them in */
pw = smb_getpwnam(user,False);
if (!pw) {
@ -129,6 +133,7 @@ static int reply_spnego_kerberos(connection_struct *conn,
sess_vuid = register_vuid(server_info, user);
free(user);
free_server_info(&server_info);
if (sess_vuid == -1) {