summaryrefslogtreecommitdiff
path: root/source3/passdb
diff options
context:
space:
mode:
Diffstat (limited to 'source3/passdb')
-rw-r--r--source3/passdb/pdb_get_set.c33
1 files changed, 28 insertions, 5 deletions
diff --git a/source3/passdb/pdb_get_set.c b/source3/passdb/pdb_get_set.c
index becd87fe8d..a5f7a0263a 100644
--- a/source3/passdb/pdb_get_set.c
+++ b/source3/passdb/pdb_get_set.c
@@ -192,7 +192,7 @@ const DOM_SID *pdb_get_group_sid(struct samu *sampass)
/* generate the group SID from the user's primary Unix group */
- if ( !(gsid = TALLOC_P( sampass, DOM_SID )) ) {
+ if ( !(gsid = TALLOC_ZERO_P( sampass, DOM_SID )) ) {
return NULL;
}
@@ -212,15 +212,38 @@ const DOM_SID *pdb_get_group_sid(struct samu *sampass)
return NULL;
}
- if ( pdb_gid_to_sid(pwd->pw_gid, gsid) ) {
+ gid_to_sid(gsid, pwd->pw_gid);
+ if (!is_null_sid(gsid)) {
enum lsa_SidType type = SID_NAME_UNKNOWN;
- TALLOC_CTX *mem_ctx = talloc_init("pdb_get_group_sid");
+ TALLOC_CTX *mem_ctx;
bool lookup_ret;
+ const DOM_SID *usid = pdb_get_user_sid(sampass);
+ DOM_SID dgsid;
+ uint32_t rid;
+
+ sid_copy(&dgsid, gsid);
+ sid_split_rid(&dgsid, &rid);
+ if (sid_equal(&dgsid, get_global_sam_sid())) {
+ /*
+ * As shortcut for the expensive lookup_sid call
+ * compare the domain sid part
+ */
+ switch (rid) {
+ case DOMAIN_RID_ADMINS:
+ case DOMAIN_RID_USERS:
+ sampass->group_sid = gsid;
+ return sampass->group_sid;
+ }
+ }
+ mem_ctx = talloc_init("pdb_get_group_sid");
if (!mem_ctx) {
return NULL;
}
+ DEBUG(10,("do lookup_sid(%s) for group of user %s\n",
+ sid_string_dbg(gsid), sid_string_dbg(usid)));
+
/* Now check that it's actually a domain group and not something else */
lookup_ret = lookup_sid(mem_ctx, gsid, NULL, NULL, &type);
@@ -232,8 +255,8 @@ const DOM_SID *pdb_get_group_sid(struct samu *sampass)
return sampass->group_sid;
}
- DEBUG(3, ("Primary group for user %s is a %s and not a domain group\n",
- pwd->pw_name, sid_type_lookup(type)));
+ DEBUG(3, ("Primary group %s for user %s is a %s and not a domain group\n",
+ sid_string_dbg(gsid), pwd->pw_name, sid_type_lookup(type)));
}
/* Just set it to the 'Domain Users' RID of 513 which will