summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
Diffstat (limited to 'source3')
-rw-r--r--source3/auth/auth_util.c12
-rw-r--r--source3/include/proto.h2
-rw-r--r--source3/param/loadparm.c13
-rw-r--r--source3/passdb/passdb.c18
4 files changed, 41 insertions, 4 deletions
diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index f942b2e50a..892e5c4ab7 100644
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -226,14 +226,18 @@ NTSTATUS make_user_info_map(auth_usersupplied_info **user_info,
if (!is_trusted_domain(domain) &&
!strequal(domain, get_global_sam_name()) )
{
- domain = get_global_sam_name();
- DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] on "
+ if (lp_map_untrusted_to_domain())
+ domain = my_sam_name();
+ else
+ domain = get_global_sam_name();
+ DEBUG(5, ("Mapped domain from [%s] to [%s] for user [%s] from "
"workstation [%s]\n",
client_domain, domain, smb_name, wksta_name));
}
- /* we know that it is a trusted domain (and we are allowing them) or it
- * is our domain */
+ /* We know that the given domain is trusted (and we are allowing them),
+ * it is our global SAM name, or for legacy behavior it is our
+ * primary domain name */
result = make_user_info(user_info, smb_name, internal_username,
client_domain, domain, wksta_name,
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 2365015544..7ad063ef47 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -4067,6 +4067,7 @@ bool lp_nt_status_support(void);
bool lp_stat_cache(void);
int lp_max_stat_cache_size(void);
bool lp_allow_trusted_domains(void);
+bool lp_map_untrusted_to_domain(void);
int lp_restrict_anonymous(void);
bool lp_lanman_auth(void);
bool lp_ntlm_auth(void);
@@ -4435,6 +4436,7 @@ bool sid_check_is_in_our_domain(const DOM_SID *sid);
/* The following definitions come from passdb/passdb.c */
+const char *my_sam_name(void);
struct samu *samu_new( TALLOC_CTX *ctx );
NTSTATUS samu_set_unix(struct samu *user, const struct passwd *pwd);
NTSTATUS samu_alloc_rid_unix(struct samu *user, const struct passwd *pwd);
diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index 0dfbb09331..a127ec5394 100644
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -345,6 +345,7 @@ struct global {
struct param_opt_struct *param_opt;
int cups_connection_timeout;
char *szSMBPerfcountModule;
+ bool bMapUntrustedToDomain;
};
static struct global Globals;
@@ -1776,6 +1777,15 @@ static struct parm_struct parm_table[] = {
.enum_list = enum_kerberos_method,
.flags = FLAG_ADVANCED,
},
+ {
+ .label = "map untrusted to domain",
+ .type = P_BOOL,
+ .p_class = P_GLOBAL,
+ .ptr = &Globals.bMapUntrustedToDomain,
+ .special = NULL,
+ .enum_list = NULL,
+ .flags = FLAG_ADVANCED | FLAG_GLOBAL,
+ },
{N_("Logging Options"), P_SEP, P_SEPARATOR},
@@ -5053,6 +5063,8 @@ static void init_globals(bool first_time_only)
Globals.bRegistryShares = False;
Globals.iminreceivefile = 0;
+
+ Globals.bMapUntrustedToDomain = false;
}
/*******************************************************************
@@ -5351,6 +5363,7 @@ FN_GLOBAL_BOOL(lp_nt_status_support, &Globals.bNTStatusSupport)
FN_GLOBAL_BOOL(lp_stat_cache, &Globals.bStatCache)
FN_GLOBAL_INTEGER(lp_max_stat_cache_size, &Globals.iMaxStatCacheSize)
FN_GLOBAL_BOOL(lp_allow_trusted_domains, &Globals.bAllowTrustedDomains)
+FN_GLOBAL_BOOL(lp_map_untrusted_to_domain, &Globals.bMapUntrustedToDomain)
FN_GLOBAL_INTEGER(lp_restrict_anonymous, &Globals.restrict_anonymous)
FN_GLOBAL_BOOL(lp_lanman_auth, &Globals.bLanmanAuth)
FN_GLOBAL_BOOL(lp_ntlm_auth, &Globals.bNTLMAuth)
diff --git a/source3/passdb/passdb.c b/source3/passdb/passdb.c
index c526a175f2..95e5deb36f 100644
--- a/source3/passdb/passdb.c
+++ b/source3/passdb/passdb.c
@@ -27,6 +27,24 @@
#undef DBGC_CLASS
#define DBGC_CLASS DBGC_PASSDB
+/******************************************************************
+ Get the default domain/netbios name to be used when
+ testing authentication.
+
+ LEGACY: this function provides the legacy domain mapping used with
+ the lp_map_untrusted_to_domain() parameter
+******************************************************************/
+
+const char *my_sam_name(void)
+{
+ /* Standalone servers can only use the local netbios name */
+ if ( lp_server_role() == ROLE_STANDALONE )
+ return global_myname();
+
+ /* Default to the DOMAIN name when not specified */
+ return lp_workgroup();
+}
+
/**********************************************************************
***********************************************************************/