sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-10 01:18:15 +03:00
Code

auth/credentials: let cli_credentials_parse_string() always reset principal and realm

Browse Source 
If we reset username we need to reset principal if it was set at the same level.

If domain is reset we also need to use it as realm if realm
was set at the same level. Otherwise we'd build a principal
that belongs to a different user, which would not work
and only increment the wrong lockout counter and result
in wrong authorization tokens to be used.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
This commit is contained in:
Stefan Metzmacher 2016-12-14 16:47:57 +01:00 committed by Andrew Bartlett
parent 6b18ac6915
commit eaf3d44641
1 changed files with 32 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
auth/credentials/credentials.c
View File

@ -797,9 +797,40 @@ _PUBLIC_ void cli_credentials_parse_string(struct cli_credentials *credentials,
|| (p = strchr_m(uname, '/'))
|| (p = strchr_m(uname, credentials->winbind_separator)))
{
const char *domain = NULL;
domain = uname;
*p = 0;
cli_credentials_set_domain(credentials, uname, obtained);
uname = p+1;
if (obtained == credentials->realm_obtained &&
!strequal_m(credentials->domain, domain))
{
/*
* We need to undo a former set with the same level
* in order to get the expected result from
* cli_credentials_get_principal().
*
* But we only need to do that if the domain
* actually changes.
*/
cli_credentials_set_realm(credentials, domain, obtained);
}
cli_credentials_set_domain(credentials, domain, obtained);
}
if (obtained == credentials->principal_obtained &&
!strequal_m(credentials->username, uname))
{
/*
* We need to undo a former set with the same level
* in order to get the expected result from
* cli_credentials_get_principal().
*
* But we only need to do that if the username
* actually changes.
*/
credentials->principal_obtained = CRED_UNINITIALISED;
credentials->principal = NULL;
}
cli_credentials_set_username(credentials, uname, obtained);
}