Changeset 221 for branches/samba-3.3.x/source/auth

Timestamp:

May 24, 2009, 7:17:10 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update Samba 3.3 to 3.3.1

File:

• branches/samba-3.3.x/source/auth/auth_util.c (modified) (6 diffs)

branches/samba-3.3.x/source/auth/auth_util.c

@@ -556 +556 @@
         gid_t *gids;
         auth_serversupplied_info *result;
-        int i;
-        size_t num_gids;
-        DOM_SID unix_group_sid;
         const char *username = pdb_get_username(sampass);
         NTSTATUS status;
@@ -574 +571 @@
 
         result->sam_account = sampass;
-        /* Ensure thaat the sampass will be freed with the result */
-        talloc_steal(result, sampass);
         result->unix_name = pwd->pw_name;
         /* Ensure that we keep pwd->pw_name, because we will free pwd below */
@@ -632 +627 @@
         }
 
-        /* Add the "Unix Group" SID for each gid to catch mapped groups
-           and their Unix equivalent.  This is to solve the backwards 
-           compatibility problem of 'valid users = +ntadmin' where 
-           ntadmin has been paired with "Domain Admins" in the group 
-           mapping table.  Otherwise smb.conf would need to be changed
-           to 'valid user = "Domain Admins"'.  --jerry */
-        
-        num_gids = result->num_sids;
-        for ( i=0; i<num_gids; i++ ) {
-                if ( !gid_to_unix_groups_sid( gids[i], &unix_group_sid ) ) {
-                        DEBUG(1,("make_server_info_sam: Failed to create SID "
-                                "for gid %d!\n", gids[i]));
-                        continue;
-                }
-                status = add_sid_to_array_unique(result, &unix_group_sid,
-                                                 &result->sids,
-                                                 &result->num_sids);
-                if (!NT_STATUS_IS_OK(status)) {
-                        result->sam_account = NULL; /* Don't free on error exit. */
-                        TALLOC_FREE(result);
-                        return status;
-                }
-        }
-
         /* For now we throw away the gids and convert via sid_to_gid
          * later. This needs fixing, but I'd like to get the code straight and
@@ -666 +637 @@
 
         *server_info = result;
+        /* Ensure thaat the sampass will be freed with the result */
+        talloc_steal(result, sampass);
 
         return NT_STATUS_OK;
@@ -720 +693 @@
         NTSTATUS status;
         size_t i;
+        struct dom_sid tmp_sid;
 
         /*
@@ -772 +746 @@
         }
 
+        /*
+         * Add the "Unix Group" SID for each gid to catch mapped groups
+         * and their Unix equivalent.  This is to solve the backwards
+         * compatibility problem of 'valid users = +ntadmin' where
+         * ntadmin has been paired with "Domain Admins" in the group
+         * mapping table.  Otherwise smb.conf would need to be changed
+         * to 'valid user = "Domain Admins"'.  --jerry
+         *
+         * For consistency we also add the "Unix User" SID,
+         * so that the complete unix token is represented within
+         * the nt token.
+         */
+
+        if (!uid_to_unix_users_sid(server_info->utok.uid, &tmp_sid)) {
+                DEBUG(1,("create_local_token: Failed to create SID "
+                        "for uid %d!\n", server_info->utok.uid));
+        }
+        add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+                                &server_info->ptok->user_sids,
+                                &server_info->ptok->num_sids);
+
+        for ( i=0; i<server_info->utok.ngroups; i++ ) {
+                if (!gid_to_unix_groups_sid( server_info->utok.groups[i], &tmp_sid ) ) {
+                        DEBUG(1,("create_local_token: Failed to create SID "
+                                "for gid %d!\n", server_info->utok.groups[i]));
+                        continue;
+                }
+                add_sid_to_array_unique(server_info->ptok, &tmp_sid,
+                                        &server_info->ptok->user_sids,
+                                        &server_info->ptok->num_sids);
+        }
+
         debug_nt_user_token(DBGC_AUTH, 10, server_info->ptok);
+        debug_unix_user_token(DBGC_AUTH, 10,
+                              server_info->utok.uid,
+                              server_info->utok.gid,
+                              server_info->utok.ngroups,
+                              server_info->utok.groups);
 
         status = log_nt_token(server_info->ptok);