rpcclient: Ask for minimal permissions for SID and name lookups

The RPC calls to lookup SIDS and names only require the
POLICY_LOOKUP_NAMES permission. Only ask for that instead of the
MAXIMUM_ALLOWED flag. This allows these calls to work against a NetApp
that does not accept MAXIMUM_ALLOWED (see bugzilla 11105).

Signed-off-by: Christof Schmitt <cs@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source3/rpcclient/cmd_lsarpc.c b/source3/rpcclient/cmd_lsarpc.c
index abb454331c2fc3d68c23b4ac1542307c13993dd1..aae1a5b629d9bcdbba61ab8a4b9aee7c28233002 100644 (file)
--- a/source3/rpcclient/cmd_lsarpc.c
+++ b/source3/rpcclient/cmd_lsarpc.c
@@ -237,8 +237,8 @@ static NTSTATUS cmd_lsa_lookup_names(struct rpc_pipe_client *cli,
        }
 
        status = rpccli_lsa_open_policy(cli, mem_ctx, True,
-                                    SEC_FLAG_MAXIMUM_ALLOWED,
-                                    &pol);
+                                       LSA_POLICY_LOOKUP_NAMES,
+                                       &pol);
 
        if (!NT_STATUS_IS_OK(status))
                goto done;
@@ -288,8 +288,8 @@ static NTSTATUS cmd_lsa_lookup_names_level(struct rpc_pipe_client *cli,
        }
 
        status = rpccli_lsa_open_policy(cli, mem_ctx, True,
-                                    SEC_FLAG_MAXIMUM_ALLOWED,
-                                    &pol);
+                                       LSA_POLICY_LOOKUP_NAMES,
+                                       &pol);
        if (!NT_STATUS_IS_OK(status)) {
                goto done;
        }
@@ -406,8 +406,8 @@ static NTSTATUS cmd_lsa_lookup_sids(struct rpc_pipe_client *cli, TALLOC_CTX *mem
        }
 
        status = rpccli_lsa_open_policy(cli, mem_ctx, True,
-                                    SEC_FLAG_MAXIMUM_ALLOWED,
-                                    &pol);
+                                       LSA_POLICY_LOOKUP_NAMES,
+                                       &pol);
 
        if (!NT_STATUS_IS_OK(status))
                goto done;
@@ -481,8 +481,8 @@ static NTSTATUS cmd_lsa_lookup_sids_level(struct rpc_pipe_client *cli,
        }
 
        status = rpccli_lsa_open_policy(cli, mem_ctx, True,
-                                    SEC_FLAG_MAXIMUM_ALLOWED,
-                                    &pol);
+                                       LSA_POLICY_LOOKUP_NAMES,
+                                       &pol);
        if (!NT_STATUS_IS_OK(status)) {
                goto done;
        }