summaryrefslogtreecommitdiff
path: root/source3/nsswitch
diff options
context:
space:
mode:
authorGerald Carter <jerry@samba.org>2004-04-07 12:42:03 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 10:51:09 -0500
commitf79e40072a963fd3b9698fa26c4e4dc135ab8c3e (patch)
tree48e446a9635fbb37d6eb6c21df362cbdf50f0644 /source3/nsswitch
parent82285f2e0efe2b2c741268f8bbe80510e5b00f28 (diff)
downloadsamba-f79e40072a963fd3b9698fa26c4e4dc135ab8c3e.tar.gz
samba-f79e40072a963fd3b9698fa26c4e4dc135ab8c3e.tar.bz2
samba-f79e40072a963fd3b9698fa26c4e4dc135ab8c3e.zip
r115: finally checking in tridge's winbindd_schannel patch for connections
(This used to be commit 1fae60ab20c5cbe396dc8af1c8c9a98d5683fdf4)
Diffstat (limited to 'source3/nsswitch')
-rw-r--r--source3/nsswitch/winbindd_cm.c34
1 files changed, 34 insertions, 0 deletions
diff --git a/source3/nsswitch/winbindd_cm.c b/source3/nsswitch/winbindd_cm.c
index 29b856ec45..b2d6e861a3 100644
--- a/source3/nsswitch/winbindd_cm.c
+++ b/source3/nsswitch/winbindd_cm.c
@@ -111,6 +111,28 @@ static void cm_get_ipc_userpass(char **username, char **domain, char **password)
}
}
+/*
+ setup for schannel on any pipes opened on this connection
+*/
+static NTSTATUS setup_schannel(struct cli_state *cli)
+{
+ NTSTATUS ret;
+ uchar trust_password[16];
+ uint32 sec_channel_type;
+
+ if (!secrets_fetch_trust_account_password(lp_workgroup(),
+ trust_password,
+ NULL, &sec_channel_type)) {
+ return NT_STATUS_UNSUCCESSFUL;
+ }
+
+ ret = cli_nt_setup_netsec(cli, sec_channel_type,
+ AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN,
+ trust_password);
+
+ return ret;
+}
+
/* Open a connction to the remote server, cache failures for 30 seconds */
static NTSTATUS cm_open_connection(const struct winbindd_domain *domain, const int pipe_index,
@@ -256,6 +278,18 @@ static NTSTATUS cm_open_connection(const struct winbindd_domain *domain, const i
break;
}
+ /* try and use schannel if possible, but continue anyway if it
+ failed. This allows existing setups to continue working,
+ while solving the win2003 '100 user' limit for systems that
+ are joined properly */
+ if (NT_STATUS_IS_OK(result)) {
+ NTSTATUS status = setup_schannel(new_conn->cli);
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(3,("schannel refused - continuing without schannel (%s)\n",
+ nt_errstr(status)));
+ }
+ }
+
SAFE_FREE(ipc_username);
SAFE_FREE(ipc_domain);
SAFE_FREE(ipc_password);