sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-28 01:58:17 +03:00
Code

winbind: force the usage of schannel in cm_connect_lsa() as AD DC

Browse Source 
This makes sure we only talk to direct trusts.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13278

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
(cherry picked from commit 3e17a3b7cd4083299037ba9377931bea792b2d18)
This commit is contained in:
Stefan Metzmacher 2018-02-22 10:40:19 +01:00
parent cdcb8a9540
commit ceaf7acd72
1 changed files with 21 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
source3/winbindd/winbindd_cm.c
View File

@ -2967,6 +2967,13 @@ retry:
TALLOC_FREE(conn->lsa_pipe);
if (IS_AD_DC) {
/*
* Make sure we only use schannel as AD DC.
*/
goto schannel;
}
result = get_trust_credentials(domain, talloc_tos(), false, &creds);
if (!NT_STATUS_IS_OK(result)) {
DEBUG(10, ("cm_connect_lsa: No user available for "
@ -3080,6 +3087,13 @@ retry:
goto done;
}
if (IS_AD_DC) {
/*
* Make sure we only use schannel as AD DC.
*/
goto done;
}
DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
"anonymous\n"));
@ -3087,6 +3101,13 @@ retry:
anonymous:
if (IS_AD_DC) {
/*
* Make sure we only use schannel as AD DC.
*/
goto done;
}
if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
result = NT_STATUS_DOWNGRADE_DETECTED;
DEBUG(1, ("Unwilling to make LSA connection to domain %s "