summaryrefslogtreecommitdiff
path: root/source3/winbindd
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2010-07-29 12:44:00 -0700
committerJeremy Allison <jra@samba.org>2010-07-29 12:44:00 -0700
commit4f4303048260ca19a5feef6b9338add1a19fb53c (patch)
tree8e2854192835290f16ff5810dcf79b96a5b3a058 /source3/winbindd
parente8d386704e4c126b979ffe6c8b588fb311cc2e34 (diff)
downloadsamba-4f4303048260ca19a5feef6b9338add1a19fb53c.tar.gz
samba-4f4303048260ca19a5feef6b9338add1a19fb53c.tar.bz2
samba-4f4303048260ca19a5feef6b9338add1a19fb53c.zip
Fix bug #7589 - ntlm_auth fails to use cached credentials.
In handling the WINBINDD_PAM_AUTH message winbindd canonicalizes a *copy* of the mapped username, but fails to canonicalize the actual username sent to the backend domain process. When "winbind default domain" is set this can lead to credentials being cached with an index of user: user, not DOMAIN\user. All other code paths that use canonicalize_username() (WINBINDD_PAM_CHAUTHTOK, WINBINDD_PAM_LOGOFF) correctly canonicalize the data sent to the backend. All calls the can cause credentials to be looked up (PAM_CHAUTHTOK etc.) correctly call canonicalize_username() to create the credential lookup key. Jeremy.
Diffstat (limited to 'source3/winbindd')
-rw-r--r--source3/winbindd/winbindd_pam_auth.c12
1 files changed, 5 insertions, 7 deletions
diff --git a/source3/winbindd/winbindd_pam_auth.c b/source3/winbindd/winbindd_pam_auth.c
index 94d98ec55b..4f963a3281 100644
--- a/source3/winbindd/winbindd_pam_auth.c
+++ b/source3/winbindd/winbindd_pam_auth.c
@@ -35,7 +35,7 @@ struct tevent_req *winbindd_pam_auth_send(TALLOC_CTX *mem_ctx,
struct tevent_req *req, *subreq;
struct winbindd_pam_auth_state *state;
struct winbindd_domain *domain;
- fstring name_domain, name_user, mapped_user;
+ fstring name_domain, name_user;
char *mapped = NULL;
NTSTATUS status;
@@ -62,17 +62,15 @@ struct tevent_req *winbindd_pam_auth_send(TALLOC_CTX *mem_ctx,
status = normalize_name_unmap(state, request->data.auth.user, &mapped);
- /* If the name normalization didnt' actually do anything,
- just use the original name */
+ /* If the name normalization changed something, copy it over the given
+ name */
if (NT_STATUS_IS_OK(status)
|| NT_STATUS_EQUAL(status, NT_STATUS_FILE_RENAMED)) {
- fstrcpy(mapped_user, mapped);
- } else {
- fstrcpy(mapped_user, request->data.auth.user);
+ fstrcpy(request->data.auth.user, mapped);
}
- if (!canonicalize_username(mapped_user, name_domain, name_user)) {
+ if (!canonicalize_username(request->data.auth.user, name_domain, name_user)) {
tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
return tevent_req_post(req, ev);
}