Ensure, if we're a PDC or BDC, that the SID stored for the domain name

and the machine name are identical.
Jeremy.
(This used to be commit 87e6b08964d13d6613342c9be21871a2e776e2e6)

1 files changed, 70 insertions, 10 deletions

diff --git a/source3/passdb/machine_sid.c b/source3/passdb/machine_sid.c
index 16a9903ec8..a670505167 100644
--- a/source3/passdb/machine_sid.c
+++ b/source3/passdb/machine_sid.c
@@ -1,8 +1,8 @@
 /* 
    Unix SMB/CIFS implementation.
    Password and authentication handling
-   Copyright (C) Jeremy Allison 		1996-1998
-   Copyright (C) Luke Kenneth Casson Leighton 	1996-1998
+   Copyright (C) Jeremy Allison 		1996-2002
+   Copyright (C) Andrew Tridgell		2002
    Copyright (C) Gerald (Jerry) Carter		2000
       
    This program is free software; you can redistribute it and/or modify
@@ -64,46 +64,106 @@ static void generate_random_sid(DOM_SID *sid)
 		sid->sub_auths[sid->num_auths++] = IVAL(raw_sid_data, i*4);
 }
 
+static BOOL read_sam_sid(void)
+{
+	extern pstring global_myname;
+	extern fstring global_myworkgroup;
+}
+
 /****************************************************************************
  Generate the global machine sid.
 ****************************************************************************/
+
 BOOL pdb_generate_sam_sid(void)
 {
 	char *fname = NULL;
 	char *domain_name;
 	extern pstring global_myname;
 	extern fstring global_myworkgroup;
+	BOOL is_dc = False;
 
 	generate_wellknown_sids();
 
-	/* the local SAMR sid is based on the workgroup only when we are a DC */
 	switch (lp_server_role()) {
 	case ROLE_DOMAIN_PDC:
 	case ROLE_DOMAIN_BDC:
-		domain_name = global_myworkgroup;
+		is_dc = True;
 		break;
 	default:
-		domain_name = global_myname;
+		is_dc = False;
 		break;
 	}
 
-	if (secrets_fetch_domain_sid(domain_name, &global_sam_sid)) {
+	if (secrets_fetch_domain_sid(global_myname, &global_sam_sid)) {
+		DOM_SID domain_sid;
+
+		/* We got our sid. If not a pdc/bdc, we're done. */
+		if (!is_dc)
+			return True;
+
+		if (!secrets_fetch_domain_sid(global_myworkgroup, &domain_sid)) {
+
+			/* No domain sid and we're a pdc/bdc. Store it */
+
+			if (!secrets_store_domain_sid(global_myworkgroup, &global_sam_sid)) {
+				DEBUG(0,("pdb_generate_sam_sid: Can't store domain SID as a pdc/bdc.\n"));
+				return False;
+			}
+			return True;
+		}
+
+		if (!sid_equal(&domain_sid, &global_sam_sid)) {
+
+			/* Domain name sid doesn't match global sam sid. Re-store global sam sid as domain sid. */
+
+			DEBUG(0,("pdb_generate_sam_sid: Mismatched SIDs as a pdc/bdc.\n"));
+			if (!secrets_store_domain_sid(global_myworkgroup, &global_sam_sid)) {
+				DEBUG(0,("pdb_generate_sam_sid: Can't re-store domain SID as a pdc/bdc.\n"));
+				return False;
+			}
+			return True;
+		}
+
 		return True;
+		
 	}
 
 	/* check for an old MACHINE.SID file for backwards compatibility */
 	asprintf(&fname, "%s/MACHINE.SID", lp_private_dir());
+
 	if (read_sid_from_file(fname, &global_sam_sid)) {
 		/* remember it for future reference and unlink the old MACHINE.SID */
-		if (secrets_store_domain_sid(domain_name, &global_sam_sid)) {
-			unlink(fname);
+		if (!secrets_store_domain_sid(global_myname, &global_sam_sid)) {
+			DEBUG(0,("pdb_generate_sam_sid: Failed to store SID from file.\n"));
+			SAFE_FREE(fname);
+			return False;
+		}
+		unlink(fname);
+		if (is_dc) {
+			if (!secrets_store_domain_sid(global_myworkgroup, &global_sam_sid)) {
+				DEBUG(0,("pdb_generate_sam_sid: Failed to store domain SID from file.\n"));
+				SAFE_FREE(fname);
+				return False;
+			}
 		}
-		return True;
 	}
 
+	SAFE_FREE(fname);
+
 	/* we don't have the SID in secrets.tdb, we will need to
            generate one and save it */
 	generate_random_sid(&global_sam_sid);
 
-	return secrets_store_domain_sid(domain_name, &global_sam_sid);
+	if (!secrets_store_domain_sid(global_myname, &global_sam_sid)) {
+		DEBUG(0,("pdb_generate_sam_sid: Failed to store generated machine SID.\n"));
+		return False;
+	}
+	if (is_dc) {
+		if (!secrets_store_domain_sid(global_myworkgroup, &global_sam_sid)) {
+			DEBUG(0,("pdb_generate_sam_sid: Failed to store generated domain SID.\n"));
+			return False;
+		}
+	}
+
+	return True;
 }