summaryrefslogtreecommitdiff
path: root/source3/rpc_server/srv_samr.c
diff options
context:
space:
mode:
authorGünther Deschner <gd@samba.org>2006-05-18 19:34:25 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 11:17:08 -0500
commitc60e96c392df858dd22d39d27513486c5c18c3d2 (patch)
treedf8494292848cdb78a13afc1e3284a3222952824 /source3/rpc_server/srv_samr.c
parent39c45ce4f1a0cce9dc23e6d8df3f93bb124a19a0 (diff)
downloadsamba-c60e96c392df858dd22d39d27513486c5c18c3d2.tar.gz
samba-c60e96c392df858dd22d39d27513486c5c18c3d2.tar.bz2
samba-c60e96c392df858dd22d39d27513486c5c18c3d2.zip
r15698: An attempt to make the winbind lookup_usergroups() call in security=ads
more scalable: The most efficient way is to use the "tokenGroups" attribute which gives the nested group membership. As this attribute can not always be retrieved when binding with the machine account (the only garanteed way to get the tokenGroups I could find is when the machine account is a member of the "Pre Win2k Access" builtin group). Our current fallback when "tokenGroups" failed is looking for all groups where the userdn was in the "member" attribute. This behaves not very well in very large AD domains. The patch first tries the "memberOf" attribute on the user's dn in that case and directly retrieves the group's sids by using the LDAP Extended DN control from the user's object. The way to pass down the control to the ldap search call is rather painfull and probably will be rearranged later on. Successfully tested on win2k sp0, win2k sp4, wink3 sp1 and win2k3 r2. Guenther (This used to be commit 7d766b5505e4099ef7dd4e88bb000ebe38d71bd0)
Diffstat (limited to 'source3/rpc_server/srv_samr.c')
0 files changed, 0 insertions, 0 deletions