Attachment 300141 Details for Bug 429024 – fix idmap with legacy conf, and pam_winbindd on DC vs trusted domains

[patch] fix idmap with legacy conf, and pam_winbindd on DC vs trusted domains

rhel5.2-429024-plus.patch (text/plain), 3.67 KB, created by Simo Sorce on 2008-04-02 21:53:14 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Simo Sorce

Created: 2008-04-02 21:53:14 UTC

Size: 3.67 KB

patch

obsolete

>From 06ce99f5f0ab94f75f22aec7b212b21f84c88980 Mon Sep 17 00:00:00 2001
>From: Simo Sorce <idra@samba.org>
>Date: Tue, 1 Apr 2008 18:25:47 -0400
>Subject: [PATCH] Fix trusted users on a DC that uses the old idmap syntax.
> There was no default backend therefore on IDs were mapped by default.
>
>---
> source/winbindd/idmap.c |   70 +++++++++++++++++++++++++++++++++++++++++++++++
> 1 files changed, 70 insertions(+), 0 deletions(-)
>
>diff --git a/source/nsswitch/idmap.c b/source/nsswitch/idmap.c
>index c1b4e10..10807e6 100644
>--- a/source/nsswitch/idmap.c
>+++ b/source/nsswitch/idmap.c
>@@ -522,6 +522,76 @@ NTSTATUS idmap_init(void)
> 		talloc_free(config_option);
> 	}
> 
>+	/* on DCs we need to add idmap_tdb as the default backend if compat is
>+	 * defined (when the old implicit configuration is used)
>+	 * This is not done in the previous loop a on member server we exclude
>+	 * the local domain. But on a DC the local domain is the only domain
>+	 * available therefore we are left with no default domain */
>+	if (((lp_server_role() == ROLE_DOMAIN_PDC) ||
>+	     (lp_server_role() == ROLE_DOMAIN_BDC)) &&
>+            ((num_domains == 0) && (compat == 1))) {
>+
>+		dom = TALLOC_ZERO_P(idmap_ctx, struct idmap_domain);
>+		IDMAP_CHECK_ALLOC(dom);
>+
>+		dom->name = talloc_strdup(dom, "__default__");
>+		IDMAP_CHECK_ALLOC(dom->name);
>+
>+		dom->default_domain = True;
>+		dom->readonly = False;
>+
>+		/* get the backend methods for this domain */
>+		dom->methods = get_methods(backends, compat_backend);
>+
>+		if ( ! dom->methods) {
>+			ret = smb_probe_module("idmap", compat_backend);
>+			if (NT_STATUS_IS_OK(ret)) {
>+				dom->methods = get_methods(backends,
>+							   compat_backend);
>+			}
>+		}
>+		if ( ! dom->methods) {
>+			DEBUG(0, ("ERROR: Could not get methods for "
>+				  "backend %s\n", compat_backend));
>+			ret = NT_STATUS_UNSUCCESSFUL;
>+			goto done;
>+		}
>+
>+		/* now that we have methods,
>+		 * set the destructor for this domain */
>+		talloc_set_destructor(dom, close_domain_destructor);
>+
>+		dom->params = talloc_strdup(dom, compat_params);
>+		IDMAP_CHECK_ALLOC(dom->params);
>+
>+		/* Finally instance a backend copy for this domain */
>+		ret = dom->methods->init(dom);
>+		if ( ! NT_STATUS_IS_OK(ret)) {
>+			DEBUG(0, ("ERROR: Initialization failed for backend "
>+				  "%s (domain %s), deferred!\n",
>+				  compat_backend, dom->name));
>+		}
>+		idmap_domains = talloc_realloc(idmap_ctx, idmap_domains,
>+						struct idmap_domain *, 2);
>+		if ( ! idmap_domains) {
>+			DEBUG(0, ("Out of memory!\n"));
>+			ret = NT_STATUS_NO_MEMORY;
>+			goto done;
>+		}
>+		idmap_domains[num_domains] = dom;
>+
>+		def_dom_num = num_domains;
>+
>+		/* Bump counter to next available slot */
>+
>+		num_domains++;
>+
>+		DEBUG(10, ("Domain %s - Backend %s - %sdefault - %sreadonly\n",
>+				dom->name, compat_backend,
>+				dom->default_domain?"":"not ",
>+				dom->readonly?"":"not "));
>+	}
>+
> 	/* automatically add idmap_nss backend if needed */
> 	if ((lp_server_role() == ROLE_DOMAIN_MEMBER) &&
> 	    ( ! pri_dom_is_in_list) &&
>-- 
>1.5.3.2
>
>--- samba-3.0.28.orig/source/nsswitch/winbindd_pam.c	2008-04-02 16:14:23.000000000 -0400
>+++ samba-3.0.28/source/nsswitch/winbindd_pam.c	2008-04-02 16:18:11.000000000 -0400
>@@ -1518,11 +1518,15 @@
> 		}
> 
> 		if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
>-			result = fillup_password_policy(domain, state);
>+			struct winbindd_domain *our_domain = find_our_domain();
> 
>-			if (!NT_STATUS_IS_OK(result)) {
>-				DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
>-				goto done;
>+			if (our_domain == domain) {
>+				result = fillup_password_policy(domain, state);
>+
>+				if (!NT_STATUS_IS_OK(result)) {
>+					DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
>+					goto done;
>+				}
> 			}
> 		}
>

Actions: View | Diff

Attachments on bug 429024: 291892 | 291893 | 291897 | 291898 | 292014 | 292015 | 292202 | 292203 | 293489 | 293625 | 293626 | 295318 | 299950 | 300141