summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGerald Carter <jerry@samba.org>2006-08-31 18:32:23 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 11:39:44 -0500
commite53dfa1f4a1162b814ea7dc23c7c603d1c6c4908 (patch)
tree760913720db2f57c5f32f46cd065c6b9b529ddbf
parent305ceade3905dad45eac2f407dd8f56a9979cf1c (diff)
downloadsamba-e53dfa1f4a1162b814ea7dc23c7c603d1c6c4908.tar.gz
samba-e53dfa1f4a1162b814ea7dc23c7c603d1c6c4908.tar.bz2
samba-e53dfa1f4a1162b814ea7dc23c7c603d1c6c4908.zip
r17971: Disable storing SIDs in the S-1-22-1 and S-1-22-2 domain to the SID<->uid/gid cache. FIxes a bug in token creation
(This used to be commit fa05708789654a8a34cb4a4068514a0b3d950653)
-rw-r--r--source3/libads/kerberos_verify.c12
-rw-r--r--source3/passdb/lookup_sid.c10
2 files changed, 17 insertions, 5 deletions
diff --git a/source3/libads/kerberos_verify.c b/source3/libads/kerberos_verify.c
index 3aa0860809..cff007db47 100644
--- a/source3/libads/kerberos_verify.c
+++ b/source3/libads/kerberos_verify.c
@@ -376,13 +376,15 @@ NTSTATUS ads_verify_ticket(TALLOC_CTX *mem_ctx,
goto out;
}
- if (lp_use_kerberos_keytab()) {
+ /* always check secrets first in order to prevent hitting the
+ keytab until really necessary */
+
+ auth_ok = ads_secrets_verify_ticket(context, auth_context, host_princ,
+ ticket, &packet, &tkt, &keyblock);
+
+ if (!auth_ok && lp_use_kerberos_keytab()) {
auth_ok = ads_keytab_verify_ticket(context, auth_context, ticket, &packet, &tkt, &keyblock);
}
- if (!auth_ok) {
- auth_ok = ads_secrets_verify_ticket(context, auth_context, host_princ,
- ticket, &packet, &tkt, &keyblock);
- }
release_server_mutex();
got_replay_mutex = False;
diff --git a/source3/passdb/lookup_sid.c b/source3/passdb/lookup_sid.c
index 03fe58bc27..dbd466fe40 100644
--- a/source3/passdb/lookup_sid.c
+++ b/source3/passdb/lookup_sid.c
@@ -999,6 +999,11 @@ void store_uid_sid_cache(const DOM_SID *psid, uid_t uid)
{
struct uid_sid_cache *pc;
+ /* do not store SIDs in the "Unix Group" domain */
+
+ if ( sid_check_is_in_unix_users( psid ) )
+ return;
+
if (n_uid_sid_cache >= MAX_UID_SID_CACHE_SIZE && n_uid_sid_cache > TURNOVER_UID_SID_CACHE_SIZE) {
/* Delete the last TURNOVER_UID_SID_CACHE_SIZE entries. */
struct uid_sid_cache *pc_next;
@@ -1070,6 +1075,11 @@ static BOOL fetch_gid_from_cache(gid_t *pgid, const DOM_SID *psid)
void store_gid_sid_cache(const DOM_SID *psid, gid_t gid)
{
struct gid_sid_cache *pc;
+
+ /* do not store SIDs in the "Unix Group" domain */
+
+ if ( sid_check_is_in_unix_groups( psid ) )
+ return;
if (n_gid_sid_cache >= MAX_GID_SID_CACHE_SIZE && n_gid_sid_cache > TURNOVER_GID_SID_CACHE_SIZE) {
/* Delete the last TURNOVER_GID_SID_CACHE_SIZE entries. */