If we get a SID from group mapping, no need to check it's prefix.

Just set it directly.

Andrew Bartlett

diff --git a/source/passdb/pdb_ldap.c b/source/passdb/pdb_ldap.c
index 643d165e5885ca6e8facc1dd474d412b61a7a2c4..fd5ad7ee1256c55b24d5585b15f2ae7e0907a2b3 100644 (file)
--- a/source/passdb/pdb_ldap.c
+++ b/source/passdb/pdb_ldap.c
@@ -589,10 +589,14 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state,
 
        get_single_attribute(ldap_struct, entry, "rid", temp);
        user_rid = (uint32)atol(temp);
+
+       pdb_set_user_sid_from_rid(sampass, user_rid);
+
        if (!get_single_attribute(ldap_struct, entry, "primaryGroupID", temp)) {
                group_rid = 0;
        } else {
                group_rid = (uint32)atol(temp);
+               pdb_set_group_sid_from_rid(sampass, group_rid);
        }
 
        if ((ldap_state->permit_non_unix_accounts) 
@@ -624,11 +628,10 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state,
                        GROUP_MAP map;
                        /* call the mapping code here */
                        if(get_group_map_from_gid(gid, &map, MAPPING_WITHOUT_PRIV)) {
-                               if (!sid_peek_check_rid(get_global_sam_sid(), &map.sid, &group_rid))
-                                       return False;
+                               pdb_set_group_sid(sampass, &map.sid);
                        } 
                        else {
-                               group_rid=pdb_gid_to_group_rid(gid);
+                               pdb_set_group_sid_from_rid(sampass, pdb_gid_to_group_rid(gid));
                        }
                }
        }
@@ -781,9 +784,6 @@ static BOOL init_sam_from_ldap (struct ldapsam_privates *ldap_state,
        pdb_set_hours_len(sampass, hours_len);
        pdb_set_logon_divs(sampass, logon_divs);
 
-       pdb_set_user_sid_from_rid(sampass, user_rid);
-       pdb_set_group_sid_from_rid(sampass, group_rid);
-
        pdb_set_username(sampass, username);
 
        pdb_set_domain(sampass, domain);