diff options
| author | Gerald Carter <jerry@samba.org> | 2005-11-10 20:28:23 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 11:05:23 -0500 |
| commit | ce0a1fa159baab4c4bdaac601d0f56e29a406945 (patch) | |
| tree | 964f0900ccb437f2b574dbfacab2d7627ad0425a /source3/nsswitch/winbindd_pam.c | |
| parent | 438d0ad451678c42614ab800bceaf490e09c120a (diff) | |
| download | samba-ce0a1fa159baab4c4bdaac601d0f56e29a406945.tar.gz samba-ce0a1fa159baab4c4bdaac601d0f56e29a406945.tar.bz2 samba-ce0a1fa159baab4c4bdaac601d0f56e29a406945.zip | |
r11652: Reinstate the netsamlogon_cache in order to work
around failed query_user calls. This fixes
logons to a member of a Samba domain as a user from a
trusted AD domain.
As per comments on samba-technical, I still need to add
(a) cache the PAC info as werll as NTLM net_user_info_3
(b) expire the cache when the SMB session goes away
Both Jeremy and Guenther have signed off on the idea.
(This used to be commit 0c2bb5ba7b92d9210e7fa9f7b70aa67dfe9faaf4)
Diffstat (limited to 'source3/nsswitch/winbindd_pam.c')
| -rw-r--r-- | source3/nsswitch/winbindd_pam.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c index 3571142c58..d398e41468 100644 --- a/source3/nsswitch/winbindd_pam.c +++ b/source3/nsswitch/winbindd_pam.c @@ -382,6 +382,9 @@ enum winbindd_result winbindd_dual_pam_auth(struct winbindd_domain *domain, } while ( (attempts < 2) && retry ); if (NT_STATUS_IS_OK(result)) { + netsamlogon_cache_store(state->mem_ctx, name_user, &info3); + wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3); + /* Check if the user is in the right group */ if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3, @@ -664,6 +667,11 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain, } while ( (attempts < 2) && retry ); if (NT_STATUS_IS_OK(result)) { + netsamlogon_cache_store(state->mem_ctx, name_user, &info3); + wcache_invalidate_samlogon(find_domain_from_name(name_domain), &info3); + + /* Check if the user is in the right group */ + if (!NT_STATUS_IS_OK(result = check_info3_in_group(state->mem_ctx, &info3, state->request.data.auth_crap.require_membership_of_sid))) { DEBUG(3, ("User %s is not in the required group (%s), so plaintext authentication is rejected\n", |