summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGünther Deschner <gd@samba.org>2009-06-24 00:33:44 +0200
committerGünther Deschner <gd@samba.org>2009-09-02 12:40:47 +0200
commitf092d689c577293d011912be5ded5ebf8aa49fc9 (patch)
tree00c20086263ca4620188f6cce21e242cb0c4e653
parent9bf74d0ed9c7496bb133e5108ba297abb1b00747 (diff)
downloadsamba-f092d689c577293d011912be5ded5ebf8aa49fc9.tar.gz
samba-f092d689c577293d011912be5ded5ebf8aa49fc9.tar.bz2
samba-f092d689c577293d011912be5ded5ebf8aa49fc9.zip
s3-pdb_ldap: Fix bug #4296: Clean up group membership while deleting a user.
Note that this only is tried with editposix=yes. Guenther
-rw-r--r--source3/passdb/pdb_ldap.c46
1 files changed, 46 insertions, 0 deletions
diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c
index fc736c2e3e..2c8d0518d5 100644
--- a/source3/passdb/pdb_ldap.c
+++ b/source3/passdb/pdb_ldap.c
@@ -1986,6 +1986,18 @@ static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, struc
- The "rename user script" has full responsibility for changing everything
***************************************************************************/
+static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
+ TALLOC_CTX *tmp_ctx,
+ uint32 group_rid,
+ uint32 member_rid);
+
+static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
+ TALLOC_CTX *mem_ctx,
+ struct samu *user,
+ DOM_SID **pp_sids,
+ gid_t **pp_gids,
+ size_t *p_num_groups);
+
static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
struct samu *old_acct,
const char *newname)
@@ -5255,6 +5267,40 @@ static NTSTATUS ldapsam_delete_user(struct pdb_methods *my_methods, TALLOC_CTX *
return NT_STATUS_NO_MEMORY;
}
+ /* try to remove memberships first */
+ {
+ NTSTATUS status;
+ struct dom_sid *sids = NULL;
+ gid_t *gids = NULL;
+ size_t num_groups = 0;
+ int i;
+ uint32_t user_rid = pdb_get_user_rid(sam_acct);
+
+ status = ldapsam_enum_group_memberships(my_methods,
+ tmp_ctx,
+ sam_acct,
+ &sids,
+ &gids,
+ &num_groups);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto delete_dn;
+ }
+
+ for (i=0; i < num_groups; i++) {
+
+ uint32_t group_rid;
+
+ sid_peek_rid(&sids[i], &group_rid);
+
+ ldapsam_del_groupmem(my_methods,
+ tmp_ctx,
+ group_rid,
+ user_rid);
+ }
+ }
+
+ delete_dn:
+
rc = smbldap_delete(ldap_state->smbldap_state, dn);
if (rc != LDAP_SUCCESS) {
return NT_STATUS_UNSUCCESSFUL;