r3705: Nobody has commented, so I'll take this as an ack...

abartlet, I'd like to ask you to take a severe look at this!

We have solved the problem to find the global groups a user is in twice: Once
in auth_util.c and another time for the corresponding samr call. The attached
patch unifies these and sends them through the passdb backend (new function
pdb_enum_group_memberships). Thus it gives pdb_ldap.c the chance to further
optimize the corresponding call if the samba and posix accounts are unified by
issuing a specialized ldap query.

The parameter to activate this ldapsam behaviour is

ldapsam:trusted = yes

Volker
(This used to be commit b94838aff1a009f8d8c2c3efd48756a5b8f3f989)

1 files changed, 12 insertions, 0 deletions

diff --git a/source3/include/passdb.h b/source3/include/passdb.h
index 8219e90f2b..db6bc2ac75 100644
--- a/source3/include/passdb.h
+++ b/source3/include/passdb.h
@@ -287,6 +287,12 @@ typedef struct pdb_context
 					   GROUP_MAP **rmap, int *num_entries,
 					   BOOL unix_only);
 
+	NTSTATUS (*pdb_enum_group_memberships)(struct pdb_context *context,
+					       const char *username,
+					       gid_t primary_gid,
+					       DOM_SID **sids, gid_t **gids,
+					       int *num_groups);
+
 	NTSTATUS (*pdb_find_alias)(struct pdb_context *context,
 				   const char *name, DOM_SID *sid);
 
@@ -379,6 +385,12 @@ typedef struct pdb_methods
 				       GROUP_MAP **rmap, int *num_entries,
 				       BOOL unix_only);
 
+	NTSTATUS (*enum_group_memberships)(struct pdb_methods *methods,
+					   const char *username,
+					   gid_t primary_gid,
+					   DOM_SID **sids, gid_t **gids,
+					   int *num_groups);
+
 	NTSTATUS (*find_alias)(struct pdb_methods *methods,
 			       const char *name, DOM_SID *sid);