summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
authorChristof Schmitt <cs@samba.org>2014-09-11 16:39:21 -0700
committerKarolin Seeger <kseeger@samba.org>2014-10-09 21:23:05 +0200
commitf2f050ccb9a07fc1219f4f4b73ef2875ca37ab9e (patch)
tree7d038236eb6e61a82966151766b2fb9e0d1b1a5d /source3
parenta0eb3ddd761235e0308fa8f8982ef027ea179805 (diff)
downloadsamba-f2f050ccb9a07fc1219f4f4b73ef2875ca37ab9e.tar.gz
s3-winbindd: Do not use domain SID from LookupSids for Sids2UnixIDs call
Create a new lsa_RefDomainList and populate it with the domain SID from the original query. That avoids the problem that for migrated objects, LookupSids returns the SID of the new domain, and combining that with the RID from the input results in an invalid SID. A better fix would be querying the RID of the user in the new domain, but the approach here at least avoids id mappings entries for invalid SIDs. Signed-off-by: Christof Schmitt <cs@samba.org> Reviewed-by: Volker Lendecke <vl@samba.org> Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Mon Sep 29 13:15:18 CEST 2014 on sn-devel-104 (cherry picked from commit 9c9216410faf707edc4ba05f2b715d45f7f51ca4) Bug: https://bugzilla.samba.org/show_bug.cgi?id=10838 Invalid id mappings for users/groups migrated from another domain
Diffstat (limited to 'source3')
-rw-r--r--source3/winbindd/wb_sids2xids.c33
1 files changed, 30 insertions, 3 deletions
diff --git a/source3/winbindd/wb_sids2xids.c b/source3/winbindd/wb_sids2xids.c
index cbd4444566..5b0dbbbebe 100644
--- a/source3/winbindd/wb_sids2xids.c
+++ b/source3/winbindd/wb_sids2xids.c
@@ -23,6 +23,7 @@
#include "../libcli/security/security.h"
#include "idmap_cache.h"
#include "librpc/gen_ndr/ndr_wbint_c.h"
+#include "lsa.h"
struct wb_sids2xids_state {
struct tevent_context *ev;
@@ -38,6 +39,19 @@ struct wb_sids2xids_state {
struct lsa_RefDomainList *domains;
struct lsa_TransNameArray *names;
+ /*
+ * Domain array to use for the idmap call. The output from
+ * lookupsids cannot be used directly since for migrated
+ * objects the returned domain SID can be different that the
+ * original one. The new domain SID cannot be combined with
+ * the RID from the previous domain.
+ *
+ * The proper way would be asking for the correct RID in the
+ * new domain, but this approach avoids id mappings for
+ * invalid SIDs.
+ */
+ struct lsa_RefDomainList *idmap_doms;
+
struct wbint_TransIDArray ids;
};
@@ -162,13 +176,26 @@ static void wb_sids2xids_lookupsids_done(struct tevent_req *subreq)
return;
}
+ state->idmap_doms = talloc_zero(state, struct lsa_RefDomainList);
+ if (tevent_req_nomem(state->idmap_doms, req)) {
+ return;
+ }
+
for (i=0; i<state->num_non_cached; i++) {
+ struct dom_sid dom_sid;
+ struct lsa_DomainInfo *info;
struct lsa_TranslatedName *n = &state->names->names[i];
struct wbint_TransID *t = &state->ids.ids[i];
+ sid_copy(&dom_sid, &state->non_cached[i]);
+ sid_split_rid(&dom_sid, &t->rid);
+
+ info = &state->domains->domains[n->sid_index];
t->type = lsa_SidType_to_id_type(n->sid_type);
- t->domain_index = n->sid_index;
- sid_peek_rid(&state->non_cached[i], &t->rid);
+ t->domain_index = init_lsa_ref_domain_list(state,
+ state->idmap_doms,
+ info->name.string,
+ &dom_sid);
t->xid.id = UINT32_MAX;
t->xid.type = t->type;
}
@@ -176,7 +203,7 @@ static void wb_sids2xids_lookupsids_done(struct tevent_req *subreq)
child = idmap_child();
subreq = dcerpc_wbint_Sids2UnixIDs_send(
- state, state->ev, child->binding_handle, state->domains,
+ state, state->ev, child->binding_handle, state->idmap_doms,
&state->ids);
if (tevent_req_nomem(subreq, req)) {
return;