Changeset 751 for trunk/server/source3/winbindd/winbindd_pam.c

Timestamp:

Nov 29, 2012, 1:59:04 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.9

File:

• trunk/server/source3/winbindd/winbindd_pam.c (modified) (10 diffs)

trunk/server/source3/winbindd/winbindd_pam.c

@@ -307 +307 @@
                                       &token->sids,
                                       &token->num_sids,
-                                      true, false);
+                                      true);
         if (!NT_STATUS_IS_OK(status)) {
                 TALLOC_FREE(frame);
@@ -641 +641 @@
                                             service,
                                             user,
+                                            pass,
                                             realm,
                                             uid,
@@ -958 +959 @@
                                                             service,
                                                             state->request->data.auth.user,
+                                                            state->request->data.auth.pass,
                                                             domain->alt_name,
                                                             uid,
@@ -1079 +1081 @@
                                   state->request->data.auth.user, name_domain, name_user, name_domain));
 
-                        contact_domain = find_our_domain();
+                        result =  NT_STATUS_NO_SUCH_USER;
+                        goto done;
                 }
         }
@@ -1166 +1169 @@
                         DEBUG(3,("could not open handle to NETLOGON pipe (error: %s)\n",
                                   nt_errstr(result)));
+                        if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT)) {
+                                if (attempts > 0) {
+                                        DEBUG(3, ("This is the second problem for this "
+                                                "particular call, forcing the close of "
+                                                "this connection\n"));
+                                        invalidate_cm_connection(&domain->conn);
+                                } else {
+                                        DEBUG(3, ("First call to cm_connect_netlogon "
+                                                "has timed out, retrying\n"));
+                                        continue;
+                                }
+                        }
                         return result;
                 }
@@ -1221 +1236 @@
                 }
 
-                if (domain->can_do_samlogon_ex) {
+                if (domain->can_do_samlogon_ex && domain->can_do_validation6) {
                         result = rpccli_netlogon_sam_network_logon_ex(
                                         netlogon_pipe,
                                         mem_ctx,
-                                        0,
+                                        logon_parameters,
+                                        server,         /* server name */
+                                        username,       /* user name */
+                                        domainname,     /* target domain */
+                                        workstation,    /* workstation */
+                                        chal,
+                                        6,
+                                        lm_response,
+                                        nt_response,
+                                        info3);
+                } else {
+                        result = rpccli_netlogon_sam_network_logon(
+                                        netlogon_pipe,
+                                        mem_ctx,
+                                        logon_parameters,
                                         server,         /* server name */
                                         username,       /* user name */
@@ -1235 +1264 @@
                                         nt_response,
                                         info3);
-                } else {
-                        result = rpccli_netlogon_sam_network_logon(
-                                        netlogon_pipe,
-                                        mem_ctx,
-                                        0,
-                                        server,         /* server name */
-                                        username,       /* user name */
-                                        domainname,     /* target domain */
-                                        workstation,    /* workstation */
-                                        chal,
-                                        domain->can_do_validation6 ? 6 : 3,
-                                        lm_response,
-                                        nt_response,
-                                        info3);
                 }
 
@@ -1309 +1324 @@
 
                 if ( NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED) ) {
-                        DEBUG(3,("winbindd_pam_auth: sam_logon returned "
+                        DEBUG(3,("winbind_samlogon_retry_loop: sam_logon returned "
                                  "ACCESS_DENIED.  Maybe the trust account "
                                 "password was changed and we didn't know it. "
@@ -1320 +1335 @@
         } while ( (attempts < 2) && retry );
 
+        if (NT_STATUS_EQUAL(result, NT_STATUS_IO_TIMEOUT)) {
+                DEBUG(3,("winbind_samlogon_retry_loop: sam_network_logon(ex) "
+                                "returned NT_STATUS_IO_TIMEOUT after the retry."
+                                "Killing connections to domain %s\n",
+                        domainname));
+                invalidate_cm_connection(&domain->conn);
+        }
         return result;
 }
@@ -2086 +2108 @@
         }
 
+        /*
+         * Remove any mlock'ed memory creds in the child
+         * we might be using for krb5 ticket renewal.
+         */
+
+        winbindd_delete_memory_creds(state->request->data.logoff.user);
+
 #else
         result = NT_STATUS_NOT_SUPPORTED;