summaryrefslogtreecommitdiff
path: root/source4/ntp_signd/ntp_signd.c
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2008-08-19 14:11:51 +1000
committerAndrew Bartlett <abartlet@samba.org>2008-08-19 14:11:51 +1000
commitb33f4541f6157163f9b22af8607ecefe3953638f (patch)
treecb36a27033500dff5790789e696a4d24bf8ec30f /source4/ntp_signd/ntp_signd.c
parent7ef21658fbb519859aa7d23a614e1fdbcae95693 (diff)
parentaef684da3149eaf2b8d87c4903af241c9a2311a6 (diff)
downloadsamba-b33f4541f6157163f9b22af8607ecefe3953638f.tar.gz
samba-b33f4541f6157163f9b22af8607ecefe3953638f.tar.bz2
samba-b33f4541f6157163f9b22af8607ecefe3953638f.zip
Merge branch 'v4-0-test' of ssh://git.samba.org/data/git/samba into 4-0-abartlet
(This used to be commit fc6b4f03ebba015a13a6ab93221b0bc3ef8ef2ed)
Diffstat (limited to 'source4/ntp_signd/ntp_signd.c')
-rw-r--r--source4/ntp_signd/ntp_signd.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/source4/ntp_signd/ntp_signd.c b/source4/ntp_signd/ntp_signd.c
index c1ac7dbcf4..546743e4e6 100644
--- a/source4/ntp_signd/ntp_signd.c
+++ b/source4/ntp_signd/ntp_signd.c
@@ -123,7 +123,7 @@ static NTSTATUS ntp_signd_recv(void *private, DATA_BLOB wrapped_input)
struct signed_reply signed_reply;
enum ndr_err_code ndr_err;
struct ldb_result *res;
- const char *attrs[] = { "unicodePwd", "userAccountControl", NULL };
+ const char *attrs[] = { "unicodePwd", "userAccountControl", "cn", NULL };
struct MD5Context ctx;
struct samr_Password *nt_hash;
uint32_t user_account_control;
@@ -168,7 +168,7 @@ static NTSTATUS ntp_signd_recv(void *private, DATA_BLOB wrapped_input)
ret = ldb_search_exp_fmt(ntp_signdconn->ntp_signd->samdb, tmp_ctx,
&res, samdb_base_dn(ntp_signdconn->ntp_signd->samdb),
- LDB_SCOPE_SUBTREE, attrs, "(&(objectSid=%s)(objectClass=computer))",
+ LDB_SCOPE_SUBTREE, attrs, "(&(objectSid=%s)(objectClass=user))",
dom_sid_string(tmp_ctx, sid));
if (ret != LDB_SUCCESS) {
DEBUG(2, ("Failed to search for SID %s in SAM for NTP signing: %s\n", dom_sid_string(tmp_ctx, sid),
@@ -188,7 +188,13 @@ static NTSTATUS ntp_signd_recv(void *private, DATA_BLOB wrapped_input)
user_account_control = ldb_msg_find_attr_as_uint(res->msgs[0], "userAccountControl", 0);
if (user_account_control & UF_ACCOUNTDISABLE) {
- DEBUG(1, ("Account for SID [%s] is disabled\n", dom_sid_string(tmp_ctx, sid)));
+ DEBUG(1, ("Account %s for SID [%s] is disabled\n", ldb_dn_get_linearized(res->msgs[0]->dn), dom_sid_string(tmp_ctx, sid)));
+ talloc_free(tmp_ctx);
+ return NT_STATUS_ACCESS_DENIED;
+ }
+
+ if (!(user_account_control & (UF_INTERDOMAIN_TRUST_ACCOUNT|UF_SERVER_TRUST_ACCOUNT|UF_WORKSTATION_TRUST_ACCOUNT))) {
+ DEBUG(1, ("Account %s for SID [%s] is not a trust account\n", ldb_dn_get_linearized(res->msgs[0]->dn), dom_sid_string(tmp_ctx, sid)));
talloc_free(tmp_ctx);
return NT_STATUS_ACCESS_DENIED;
}