r23225: Attached find a patch that makes use of NetSamLogonEx in

winbind. With this and W2k3 DCs around it is possible to use
more than one winbind on the same machine account, because
NetSamLogonEx does not use the credentials chain.

I added the flag domain->can_do_samlogon_ex because this
only works against W2k3 and with schannel. The theory is to
try if we're AD and have schannel, and fall back to
NetSamLogon if this fails. can_do_samlogon_ex is thus a
protection against multiple failures.

Only checking into 3_0, this needs more review before going
into a production release.

Feel free to comment :-)
(This used to be commit f5d525399b0b03a3d0b223fe72ef0a8a631fc599)

1 files changed, 8 insertions, 0 deletions

diff --git a/source3/nsswitch/winbindd.h b/source3/nsswitch/winbindd.h
index 4679a1330c..e98c859405 100644
--- a/source3/nsswitch/winbindd.h
+++ b/source3/nsswitch/winbindd.h
@@ -169,6 +169,14 @@ struct winbindd_domain {
 	time_t startup_time;		       /* When we set "startup" true. */
 	BOOL startup;                          /* are we in the first 30 seconds after startup_time ? */
 
+	BOOL can_do_samlogon_ex; /* Due to the lack of finer control what type
+				  * of DC we have, let us try to do a
+				  * credential-chain less samlogon_ex call
+				  * with AD and schannel. If this fails with
+				  * DCERPC_FAULT_OP_RNG_ERROR, then set this
+				  * to False. This variable is around so that
+				  * we don't have to try _ex every time. */
+
 	/* Lookup methods for this domain (LDAP or RPC) */
 	struct winbindd_methods *methods;