mirror of
https://github.com/samba-team/samba.git
synced 2025-01-12 09:18:10 +03:00
fffefe72fc
We're using only NCACN_NP here as we rely on the smb signing restrictions of cm_prepare_connection(). This should fix SMB authentication with a user of a domain behind a transitive trust. With this change winbindd is able to call dcerpc_netr_DsrEnumerateDomainTrusts against the dc of a trusted domain again. This only works for two-way trusts. The main problem is the usage of is_trusted_domain() which doesn't know about the domain, if winbindd can't enumerate the domains in the other forest. is_trusted_domain() is used in make_user_info_map(), which is called in auth3_check_password() before auth_check_ntlm_password(). That means we're mapping the user of such a domain to our own local sam, before calling our auth modules. A much better fix, which removes the usage of is_trusted_domain() in planed for master, but this should do the job for current releases. We should avoid talking to DCs of other domains and always go via our primary domain. As we should code with one-way trusts also, we need to avoid relying on a complete list of domains in future. For now "wbinfo -m" lists domains behind a two-way transitive trust again, but that is likely to change in future again! BUG: https://bugzilla.samba.org/show_bug.cgi?id=11830 Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Reviewed-by: Ralph Boehme <slow@samba.org> Reviewed-by: Günther Deschner <gd@samba.org> |
||
|---|---|---|
| .. | ||
| auth | ||
| build | ||
| client | ||
| exports | ||
| groupdb | ||
| include | ||
| intl | ||
| lib | ||
| libads | ||
| libgpo | ||
| libnet | ||
| librpc | ||
| libsmb | ||
| locale | ||
| locking | ||
| modules | ||
| nmbd | ||
| param | ||
| passdb | ||
| printing | ||
| profile | ||
| registry | ||
| rpc_client | ||
| rpc_server | ||
| rpcclient | ||
| script | ||
| selftest | ||
| services | ||
| smbd | ||
| torture | ||
| utils | ||
| web | ||
| winbindd | ||
| .clang_complete | ||
| .dmallocrc | ||
| .indent.pro | ||
| change-log | ||
| Doxyfile | ||
| mainpage.dox | ||
| smbadduser.in | ||
| wscript | ||
| wscript_build | ||
| wscript_configure_system_ncurses | ||