summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorMatthieu Patou <mat@matws.net>2011-05-21 11:56:45 +0400
committerMatthias Dieter Wallnöfer <mdw@samba.org>2011-05-21 16:25:12 +0200
commite3aa200a14e92f82c8233cad1b8062ffcc5a9a7e (patch)
tree6c8cb9578e27982ba1af41de1333fbe34c88405f
parent67bf5cfc0853078e4e817dbc1a9f9de78ed2610d (diff)
downloadsamba-e3aa200a14e92f82c8233cad1b8062ffcc5a9a7e.tar.gz
samba-e3aa200a14e92f82c8233cad1b8062ffcc5a9a7e.tar.bz2
samba-e3aa200a14e92f82c8233cad1b8062ffcc5a9a7e.zip
s4:samldb LDB module - don't change the "primaryGroupId" on LDB modifications unless we are a computer/dc/rodc
Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org>
-rw-r--r--source4/dsdb/samdb/ldb_modules/samldb.c17
1 files changed, 16 insertions, 1 deletions
diff --git a/source4/dsdb/samdb/ldb_modules/samldb.c b/source4/dsdb/samdb/ldb_modules/samldb.c
index 21341850d9..216e14dc4b 100644
--- a/source4/dsdb/samdb/ldb_modules/samldb.c
+++ b/source4/dsdb/samdb/ldb_modules/samldb.c
@@ -1219,6 +1219,12 @@ static int samldb_prim_group_trigger(struct samldb_ctx *ac)
return ret;
}
+
+/**
+ * This function is called on a LDB modify. It performs some additions/changes
+ * on the current LDB message. Changes depend on the value of
+ * userAccountControl.
+ */
static int samldb_user_account_control_change(struct samldb_ctx *ac)
{
struct ldb_context *ldb = ldb_module_get_ctx(ac->module);
@@ -1278,7 +1284,16 @@ static int samldb_user_account_control_change(struct samldb_ctx *ac)
el->flags = LDB_FLAG_MOD_REPLACE;
}
- if (!ldb_msg_find_element(ac->msg, "primaryGroupID")) {
+ /*
+ * If the account has UF_SERVER_TRUST_ACCOUNT or
+ * UF_WORKSTATION_TRUST_ACCOUNT then change the group
+ * as it's either a workstation, a RODC, or a DC.
+ *
+ * If not it might be just a user that we are enabling
+ * and in this case we don't want to change its default group.
+ */
+ if (user_account_control & (UF_SERVER_TRUST_ACCOUNT| UF_WORKSTATION_TRUST_ACCOUNT) &&
+ !ldb_msg_find_element(ac->msg, "primaryGroupID")) {
uint32_t rid = ds_uf2prim_group_rid(user_account_control);
ret = samdb_msg_add_uint(ldb, ac->msg, ac->msg,
"primaryGroupID", rid);