s3: Added new parameter "map untrusted to domain"

When enabled this reverts smbd to the legacy domain remapping behavior when
a user provides an untrusted domain

This partially reverts d8c54fdd

4 files changed, 41 insertions, 4 deletions

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index f942b2e50a..892e5c4ab7 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -226,14 +226,18 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
 	if (!is_trusted_domain(domain) &&
 	    !strequal(domain, get_global_sam_name()) )
 	{
-		domain = get_global_sam_name();
-		DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] on "
+		if (lp_map_untrusted_to_domain())
+			domain = my_sam_name();
+		else
+			domain = get_global_sam_name();
+		DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
 			  "workstation [%s]\n",
 			  client_domain, domain, smb_name, wksta_name));
 	}
 
-	/* we know that it is a trusted domain (and we are allowing them) or it
-	 * is our domain */
+	/* We know that the given domain is trusted (and we are allowing them),
+	 * it is our global SAM name, or for legacy behavior it is our
+	 * primary domain name */
 
 	result = make_user_info(user_info, smb_name, internal_username,
 			      client_domain, domain, wksta_name,
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 2365015544..7ad063ef47 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -4067,6 +4067,7 @@ bool lp_nt_status_support(void);
 bool lp_stat_cache(void);
 int lp_max_stat_cache_size(void);
 bool lp_allow_trusted_domains(void);
+bool lp_map_untrusted_to_domain(void);
 int lp_restrict_anonymous(void);
 bool lp_lanman_auth(void);
 bool lp_ntlm_auth(void);
@@ -4435,6 +4436,7 @@ bool sid_check_is_in_our_domain(const DOM_SID *sid);
 
 /* The following definitions come from passdb/passdb.c  */
 
+const char *my_sam_name(void);
 struct samu *samu_new( TALLOC_CTX *ctx );
 NTSTATUS samu_set_unix(struct samu *user, const struct passwd *pwd);
 NTSTATUS samu_alloc_rid_unix(struct samu *user, const struct passwd *pwd);
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 0dfbb09331..a127ec5394 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -345,6 +345,7 @@ struct global {
 	struct param_opt_struct *param_opt;
 	int cups_connection_timeout;
 	char *szSMBPerfcountModule;
+	bool bMapUntrustedToDomain;
 };
 
 static struct global Globals;
@@ -1776,6 +1777,15 @@ static struct parm_struct parm_table[] = {
 		.enum_list	= enum_kerberos_method,
 		.flags		= FLAG_ADVANCED,
 	},
+	{
+		.label		= "map untrusted to domain",
+		.type		= P_BOOL,
+		.p_class	= P_GLOBAL,
+		.ptr		= &Globals.bMapUntrustedToDomain,
+		.special	= NULL,
+		.enum_list	= NULL,
+		.flags		= FLAG_ADVANCED | FLAG_GLOBAL,
+	},
 
 
 	{N_("Logging Options"), P_SEP, P_SEPARATOR},
@@ -5053,6 +5063,8 @@ static void init_globals(bool first_time_only)
 	Globals.bRegistryShares = False;
 
 	Globals.iminreceivefile = 0;
+
+	Globals.bMapUntrustedToDomain = false;
 }
 
 /*******************************************************************
@@ -5351,6 +5363,7 @@ FN_GLOBAL_BOOL(lp_nt_status_support, &Globals.bNTStatusSupport)
 FN_GLOBAL_BOOL(lp_stat_cache, &Globals.bStatCache)
 FN_GLOBAL_INTEGER(lp_max_stat_cache_size, &Globals.iMaxStatCacheSize)
 FN_GLOBAL_BOOL(lp_allow_trusted_domains, &Globals.bAllowTrustedDomains)
+FN_GLOBAL_BOOL(lp_map_untrusted_to_domain, &Globals.bMapUntrustedToDomain)
 FN_GLOBAL_INTEGER(lp_restrict_anonymous, &Globals.restrict_anonymous)
 FN_GLOBAL_BOOL(lp_lanman_auth, &Globals.bLanmanAuth)
 FN_GLOBAL_BOOL(lp_ntlm_auth, &Globals.bNTLMAuth)
diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index c526a175f2..95e5deb36f 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -27,6 +27,24 @@
 #undef DBGC_CLASS
 #define DBGC_CLASS DBGC_PASSDB
 
+/******************************************************************
+ Get the default domain/netbios name to be used when
+ testing authentication.
+
+ LEGACY: this function provides the legacy domain mapping used with
+	 the lp_map_untrusted_to_domain() parameter
+******************************************************************/
+
+const char *my_sam_name(void)
+{
+       /* Standalone servers can only use the local netbios name */
+       if ( lp_server_role() == ROLE_STANDALONE )
+               return global_myname();
+
+       /* Default to the DOMAIN name when not specified */
+       return lp_workgroup();
+}
+
 /**********************************************************************
 ***********************************************************************/