fixed the secondary group mappings for ADS users

(This used to be commit be399f5823bb8dfe6cc28d58aaeceb51f1b7382b)

1 files changed, 56 insertions, 8 deletions

diff --git a/source3/nsswitch/winbindd_ads.c b/source3/nsswitch/winbindd_ads.c
index afd6a528d3..2206c5a36e 100644
--- a/source3/nsswitch/winbindd_ads.c
+++ b/source3/nsswitch/winbindd_ads.c
@@ -427,7 +427,6 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain,
 	char *exp;
 	char *sidstr;
 	uint32 atype;
-	char *s;
 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 
 	DEBUG(3,("ads: sid_to_name\n"));
@@ -449,8 +448,7 @@ static NTSTATUS sid_to_name(struct winbindd_domain *domain,
 		goto done;
 	}
 
-	s = ads_pull_string(ads, mem_ctx, msg, "sAMAccountName");
-	*name = talloc_strdup(mem_ctx, s);
+	*name = ads_pull_string(ads, mem_ctx, msg, "sAMAccountName");
 	*type = ads_atype_map(atype);
 
 	status = NT_STATUS_OK;
@@ -464,6 +462,48 @@ done:
 }
 
 
+/* convert a sid to a distnguished name */
+static NTSTATUS sid_to_distinguished_name(struct winbindd_domain *domain,
+					  TALLOC_CTX *mem_ctx,
+					  DOM_SID *sid,
+					  char **dn)
+{
+	ADS_STRUCT *ads = NULL;
+	const char *attrs[] = {"distinguishedName", NULL};
+	ADS_STATUS rc;
+	void *msg = NULL;
+	char *exp;
+	char *sidstr;
+	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
+
+	DEBUG(3,("ads: sid_to_distinguished_name\n"));
+
+	ads = ads_cached_connection(domain);
+	if (!ads) goto done;
+
+	sidstr = sid_binstring(sid);
+	asprintf(&exp, "(objectSid=%s)", sidstr);
+	rc = ads_search_retry(ads, &msg, exp, attrs);
+	free(exp);
+	free(sidstr);
+	if (!ADS_ERR_OK(rc)) {
+		DEBUG(1,("sid_to_distinguished_name ads_search: %s\n", ads_errstr(rc)));
+		goto done;
+	}
+
+	*dn = ads_pull_string(ads, mem_ctx, msg, "distinguishedName");
+
+	status = NT_STATUS_OK;
+
+	DEBUG(3,("ads sid_to_distinguished_name mapped %s\n", *dn));
+
+done:
+	if (msg) ads_msgfree(ads, msg);
+
+	return status;
+}
+
+
 /* Lookup user information from a rid */
 static NTSTATUS query_user(struct winbindd_domain *domain, 
 			   TALLOC_CTX *mem_ctx, 
@@ -614,13 +654,12 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 				uint32 **name_types)
 {
 	DOM_SID group_sid;
-	char *sidstr;
 	const char *attrs[] = {"sAMAccountName", "objectSid", "sAMAccountType", NULL};
 	ADS_STATUS rc;
 	int count;
 	void *res=NULL, *msg=NULL;
 	ADS_STRUCT *ads = NULL;
-	char *exp;
+	char *exp, *dn = NULL;
 	NTSTATUS status = NT_STATUS_UNSUCCESSFUL;
 
 	*num_names = 0;
@@ -629,13 +668,17 @@ static NTSTATUS lookup_groupmem(struct winbindd_domain *domain,
 	if (!ads) goto done;
 
 	sid_from_rid(domain, group_rid, &group_sid);
-	sidstr = sid_binstring(&group_sid);
+	status = sid_to_distinguished_name(domain, mem_ctx, &group_sid, &dn);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(3,("Failed to find distinguishedName for %s\n", sid_string_static(&group_sid)));
+		return status;
+	}
+
 	/* search for all users who have that group sid as primary group or as member */
 	asprintf(&exp, "(&(objectCategory=user)(|(primaryGroupID=%d)(memberOf=%s)))",
-		 group_rid, sidstr);
+		 group_rid, dn);
 	rc = ads_search_retry(ads, &res, exp, attrs);
 	free(exp);
-	free(sidstr);
 	if (!ADS_ERR_OK(rc)) {
 		DEBUG(1,("query_user_list ads_search: %s\n", ads_errstr(rc)));
 		goto done;
@@ -692,6 +735,11 @@ static NTSTATUS sequence_number(struct winbindd_domain *domain, uint32 *seq)
 	if (!ads) return NT_STATUS_UNSUCCESSFUL;
 
 	rc = ads_USN(ads, seq);
+	if (!ADS_ERR_OK(rc)) {
+		/* its a dead connection */
+		ads_destroy(&ads);
+		domain->private = NULL;
+	}
 	return ads_ntstatus(rc);
 }