diff options
Diffstat (limited to 'source3/nsswitch/winbindd_util.c')
| -rw-r--r-- | source3/nsswitch/winbindd_util.c | 80 |
1 files changed, 65 insertions, 15 deletions
diff --git a/source3/nsswitch/winbindd_util.c b/source3/nsswitch/winbindd_util.c index 6d1675752f..318da4a63a 100644 --- a/source3/nsswitch/winbindd_util.c +++ b/source3/nsswitch/winbindd_util.c @@ -52,8 +52,9 @@ struct winbindd_domain *domain_list(void) { /* Initialise list */ - if (!_domain_list) - init_domain_list(); + if (!_domain_list) + if (!init_domain_list()) + return NULL; return _domain_list; } @@ -166,9 +167,7 @@ void rescan_trusted_domains( void ) if ( (now > last_scan) && ((now-last_scan) < WINBINDD_RESCAN_FREQ) ) return; - /* get the handle for our domain */ - - if ( (mydomain = find_domain_from_name(lp_workgroup())) == NULL ) { + if ( (mydomain = find_our_domain()) == NULL ) { DEBUG(0,("rescan_trusted_domains: Can't find my own domain!\n")); return; } @@ -266,10 +265,12 @@ BOOL init_domain_list(void) /* Free existing list */ free_domain_list(); - /* Add ourselves as the first entry */ + /* Add ourselves as the first entry. It *must* be the first entry */ domain = add_trusted_domain( lp_workgroup(), lp_realm(), &cache_methods, NULL); + domain->primary = True; + /* get any alternate name for the primary domain */ cache_methods.alternate_name(domain); @@ -291,8 +292,17 @@ BOOL init_domain_list(void) return True; } -/* Given a domain name, return the struct winbindd domain info for it - if it is actually working. */ +/** + * Given a domain name, return the struct winbindd domain info for it + * + * @note Do *not* pass lp_workgroup() to this function. domain_list + * may modify it's value, and free that pointer. Instead, our local + * domain may be found by looking at the first entry in domain_list() + * directly. + * + * + * @return The domain structure for the named domain, if it is working. + */ struct winbindd_domain *find_domain_from_name(const char *domain_name) { @@ -302,8 +312,9 @@ struct winbindd_domain *find_domain_from_name(const char *domain_name) for (domain = domain_list(); domain != NULL; domain = domain->next) { if (strequal(domain_name, domain->name) || - (domain->alt_name[0] && strequal(domain_name, domain->alt_name))) + (domain->alt_name[0] && strequal(domain_name, domain->alt_name))) { return domain; + } } /* Not found */ @@ -329,6 +340,24 @@ struct winbindd_domain *find_domain_from_sid(DOM_SID *sid) return NULL; } +/* Given a domain sid, return the struct winbindd domain info for it */ + +struct winbindd_domain *find_our_domain() +{ + struct winbindd_domain *domain; + + /* Search through list */ + + for (domain = domain_list(); domain != NULL; domain = domain->next) { + if (domain->primary) + return domain; + } + + /* Not found */ + + return NULL; +} + /* Lookup a sid in a domain from a name */ BOOL winbindd_lookup_sid_by_name(struct winbindd_domain *domain, @@ -471,6 +500,20 @@ BOOL check_domain_env(char *domain_env, char *domain) return False; } +/* Is this a domain which we may assume no DOMAIN\ prefix? */ + +static BOOL assume_domain(const char *domain) { + if ((lp_winbind_use_default_domain() + || lp_winbind_trusted_domains_only()) && + strequal(lp_workgroup(), domain)) + return True; + + if (strequal(get_global_sam_name(), domain)) + return True; + + return False; +} + /* Parse a string of the form DOMAIN/user into a domain and a user */ BOOL parse_domain_user(const char *domuser, fstring domain, fstring user) @@ -480,10 +523,13 @@ BOOL parse_domain_user(const char *domuser, fstring domain, fstring user) if ( !p ) { fstrcpy(user, domuser); - if ( lp_winbind_use_default_domain() ) + if ( assume_domain(lp_workgroup())) { fstrcpy(domain, lp_workgroup()); - else - fstrcpy( domain, "" ); + } else if (assume_domain(get_global_sam_name())) { + fstrcpy( domain, get_global_sam_name() ); + } else { + fstrcpy( domain, ""); + } } else { fstrcpy(user, p+1); @@ -501,13 +547,17 @@ BOOL parse_domain_user(const char *domuser, fstring domain, fstring user) 'winbind separator' options. This means: - omit DOMAIN when 'winbind use default domain = true' and DOMAIN is - lp_workgroup + lp_workgroup() + + If we are a PDC or BDC, and this is for our domain, do likewise. + + Also, if omit DOMAIN if 'winbind trusted domains only = true', as the + username is then unqualified in unix */ void fill_domain_username(fstring name, const char *domain, const char *user) { - if(lp_winbind_use_default_domain() && - !strcmp(lp_workgroup(), domain)) { + if (assume_domain(domain)) { strlcpy(name, user, sizeof(fstring)); } else { slprintf(name, sizeof(fstring) - 1, "%s%s%s", |