(merge from 3.0)

Try to gain a bit more consistancy in the output of usernames from ntlm_auth:

Instead of returning a name in DOMAIN\user format, we now return it in the
same way that nsswtich does - following the rules of 'winbind use default
domain', in the correct case and with the correct seperator.

This should help sites who are using Squid or the new SASL code I'm working
on, to match back to their unix usernames.

--

Get the DOMAIN\username around the right way (I had username\domain...)

Push the unix username into utf8 for it's trip across the socket.

Andrew Bartlett
(This used to be commit 4c2e1189ff84d254f19b604999d011fdb17e538d)

2 files changed, 27 insertions, 0 deletions

diff --git a/source3/nsswitch/winbindd_nss.h b/source3/nsswitch/winbindd_nss.h
index 00d49e7d3e..2383db551e 100644
--- a/source3/nsswitch/winbindd_nss.h
+++ b/source3/nsswitch/winbindd_nss.h
@@ -152,6 +152,7 @@ typedef struct winbindd_gr {
 #define WBFLAG_PAM_CONTACT_TRUSTDOM 	0x0010
 #define WBFLAG_QUERY_ONLY		0x0020
 #define WBFLAG_ALLOCATE_RID		0x0040
+#define WBFLAG_PAM_UNIX_NAME            0x0080
 
 /* Winbind request structure */
 
diff --git a/source3/nsswitch/winbindd_pam.c b/source3/nsswitch/winbindd_pam.c
index 9962105787..d58c9dcc38 100644
--- a/source3/nsswitch/winbindd_pam.c
+++ b/source3/nsswitch/winbindd_pam.c
@@ -365,6 +365,32 @@ enum winbindd_result winbindd_pam_auth_crap(struct winbindd_cli_state *state)
 		
 		if (state->request.flags & WBFLAG_PAM_INFO3_NDR) {
 			result = append_info3_as_ndr(mem_ctx, state, &info3);
+		} else if (state->request.flags & WBFLAG_PAM_UNIX_NAME) {
+			/* ntlm_auth should return the unix username, per 
+			   'winbind use default domain' settings and the like */
+			
+			fstring username_out;
+			const char *nt_username, *nt_domain;
+			if (!(nt_username = unistr2_tdup(mem_ctx, &(info3.uni_user_name)))) {
+				/* If the server didn't give us one, just use the one we sent them */
+				nt_username = user;
+			}
+			
+			if (!(nt_domain = unistr2_tdup(mem_ctx, &(info3.uni_logon_dom)))) {
+				/* If the server didn't give us one, just use the one we sent them */
+				nt_domain = domain;
+			}
+
+			fill_domain_username(username_out, nt_domain, nt_username);
+
+			DEBUG(5, ("Setting unix username to [%s]\n", username_out));
+
+			/* this interface is in UTF8 */
+			if (push_utf8_allocate((char **)&state->response.extra_data, username_out) == -1) {
+				result = NT_STATUS_NO_MEMORY;
+				goto done;
+			}
+			state->response.length +=  strlen(state->response.extra_data)+1;
 		}
 		
 		if (state->request.flags & WBFLAG_PAM_NTKEY) {