s3-winbind: Fix bug #9052 resolving our own "Domain Local" groups.

We don't resolve our own "Domain Local" groups since bug #7843 has been
fixed. So we need to add the add resource groups to the sid list too.

Before bug #7843 the "Domain Local" groups were added with a
lookupuseraliases call, but this isn't done anymore for our domain
so we need to resolve resource groups here.

When to use Resource Groups:
http://technet.microsoft.com/en-us/library/cc753670%28v=WS.10%29.aspx

Signed-off-by: Jeremy Allison <jra@samba.org>

diff --git a/source3/include/proto.h b/source3/include/proto.h
index e22fc9cd3d8437ba3967dfdfb5e4cf5dbe417eef..720f431cc73dac98272f79e26ba7a9f385a022e6 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -809,8 +809,7 @@ NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
                              const struct netr_SamInfo3 *info3,
                              struct dom_sid **user_sids,
                              uint32_t *num_user_sids,
-                             bool include_user_group_rid,
-                             bool skip_ressource_groups);
+                             bool include_user_group_rid);
 
 /* The following definitions come from lib/util_sock.c  */
 

diff --git a/source3/lib/util_sid.c b/source3/lib/util_sid.c
index f080d3dfb0c3afa80375cfcf98a97fcb52255f96..f051b7a1ff547fd7aeaa0028d18c71c0d3d59cc1 100644 (file)
--- a/source3/lib/util_sid.c
+++ b/source3/lib/util_sid.c
@@ -130,8 +130,7 @@ NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
                              const struct netr_SamInfo3 *info3,
                              struct dom_sid **user_sids,
                              uint32_t *num_user_sids,
-                             bool include_user_group_rid,
-                             bool skip_ressource_groups)
+                             bool include_user_group_rid)
 {
        NTSTATUS status;
        struct dom_sid sid;
@@ -191,12 +190,6 @@ NTSTATUS sid_array_from_info3(TALLOC_CTX *mem_ctx,
          */
 
        for (i = 0; i < info3->sidcount; i++) {
-
-               if (skip_ressource_groups &&
-                   (info3->sids[i].attributes & SE_GROUP_RESOURCE)) {
-                       continue;
-               }
-
                status = add_sid_to_array(mem_ctx, info3->sids[i].sid,
                                      &sid_array, &num_sids);
                if (!NT_STATUS_IS_OK(status)) {

diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c
index 4c078dfadee5f9201e72175f5b07694b01c318b0..55069f6477acc3bb0c3d58519743b7ec0656053b 100644 (file)
--- a/source3/winbindd/winbindd_pam.c
+++ b/source3/winbindd/winbindd_pam.c
@@ -306,7 +306,7 @@ static NTSTATUS check_info3_in_group(struct netr_SamInfo3 *info3,
        status = sid_array_from_info3(talloc_tos(), info3,
                                      &token->sids,
                                      &token->num_sids,
-                                     true, false);
+                                     true);
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(frame);
                return status;

diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index 63cb2d2f02a908345f8eeb7c7ead5bffc95a0952..37b65783c8b3a6099051d034210641519d75c521 100644 (file)
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -1033,12 +1033,18 @@ NTSTATUS lookup_usergroups_cached(struct winbindd_domain *domain,
                return NT_STATUS_UNSUCCESSFUL;
        }
 
-       /* Skip Domain local groups outside our domain.
-          We'll get these from the getsidaliases() RPC call. */
+       /*
+        * Before bug #7843 the "Domain Local" groups were added with a
+        * lookupuseraliases call, but this isn't done anymore for our domain
+        * so we need to resolve resource groups here.
+        *
+        * When to use Resource Groups:
+        * http://technet.microsoft.com/en-us/library/cc753670%28v=WS.10%29.aspx
+        */
        status = sid_array_from_info3(mem_ctx, info3,
                                      user_sids,
                                      &num_groups,
-                                     false, true);
+                                     false);
 
        if (!NT_STATUS_IS_OK(status)) {
                TALLOC_FREE(info3);