diff options
| -rw-r--r-- | source4/auth/auth_sam.c | 3 | ||||
| -rw-r--r-- | source4/dsdb/samdb/cracknames.c | 11 |
2 files changed, 12 insertions, 2 deletions
diff --git a/source4/auth/auth_sam.c b/source4/auth/auth_sam.c index 95a7702822..49813a437d 100644 --- a/source4/auth/auth_sam.c +++ b/source4/auth/auth_sam.c @@ -64,7 +64,8 @@ static const char *user_attrs[] = { NULL, }; -static const char *domain_ref_attrs[] = {"nETBIOSName", "nCName", "dnsRoot", NULL}; +static const char *domain_ref_attrs[] = {"nETBIOSName", "nCName", + "dnsRoot", "objectClass", NULL}; /**************************************************************************** Do a specific test for an smb password being correct, given a smb_password and diff --git a/source4/dsdb/samdb/cracknames.c b/source4/dsdb/samdb/cracknames.c index 2010005a6b..977f992c08 100644 --- a/source4/dsdb/samdb/cracknames.c +++ b/source4/dsdb/samdb/cracknames.c @@ -453,11 +453,20 @@ WERROR DsCrackNameOneName(struct ldb_context *sam_ctx, TALLOC_CTX *mem_ctx, krb5_free_principal(smb_krb5_context->krb5_context, principal); return WERR_NOMEM; } + service = principal->name.name_string.val[0]; if ((principal->name.name_string.len == 2) && (strcasecmp(service, "host") == 0)) { + /* the 'cn' attribute is just the leading part of the name */ + char *computer_name; + computer_name = talloc_strndup(mem_ctx, principal->name.name_string.val[1], + strcspn(principal->name.name_string.val[1], ".")); + if (computer_name == NULL) { + return WERR_NOMEM; + } + result_filter = talloc_asprintf(mem_ctx, "(|(&(servicePrincipalName=%s)(objectClass=user))(&(cn=%s)(objectClass=computer)))", ldb_binary_encode_string(mem_ctx, unparsed_name_short), - ldb_binary_encode_string(mem_ctx, principal->name.name_string.val[1])); + ldb_binary_encode_string(mem_ctx, computer_name)); } else { result_filter = talloc_asprintf(mem_ctx, "(&(servicePrincipalName=%s)(objectClass=user))", ldb_binary_encode_string(mem_ctx, unparsed_name_short)); |