From: Rowland Penny <rpenny@samba.org>
Date: Wed, 7 Jun 2017 14:57:53 +0000 (+0100)
Subject: samba-tool: You cannot add members to a group if the member exists as a sAMAccountNam... 
X-Git-Tag: ldb-1.1.31~121
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=b64f0b5da640524c5f11b0e7eb2777a39fa04b95;p=thirdparty%2Fsamba.git

samba-tool: You cannot add members to a group if the member exists as a sAMAccountName and a CN.

Signed-off-by: Rowland Penny <rpenny@samba.org>
Reviewed-by: Alexander Bokovoy <ab@samba.org>

Autobuild-User(master): Alexander Bokovoy <ab@samba.org>
Autobuild-Date(master): Fri Jun  9 23:24:47 CEST 2017 on sn-devel-144
---

diff --git a/python/samba/netcmd/group.py b/python/samba/netcmd/group.py
index 11f87732def..b9d6add4cf9 100644
--- a/python/samba/netcmd/group.py
+++ b/python/samba/netcmd/group.py
@@ -199,6 +199,8 @@ This command adds one or more members to an existing Active Directory group. The
 
 When a member is added to a group the member may inherit permissions and rights from the group.  Likewise, when permission or rights of a group are changed, the changes may reflect in the members through inheritance.
 
+The member names specified on the command must be the sAMaccountName.
+
 Example1:
 samba-tool group addmembers supergroup Group1,Group2,User1 -H ldap://samba.samdom.example.com -Uadministrator%passw0rd
 
diff --git a/python/samba/samdb.py b/python/samba/samdb.py
index 19dd8e9a6ad..719bb8b2d90 100644
--- a/python/samba/samdb.py
+++ b/python/samba/samdb.py
@@ -266,9 +266,12 @@ changetype: modify
 """ % (str(targetgroup[0].dn))
 
             for member in members:
-                targetmember = self.search(base=self.domain_dn(), scope=ldb.SCOPE_SUBTREE,
-                                    expression="(|(sAMAccountName=%s)(CN=%s))" % (
-                    ldb.binary_encode(member), ldb.binary_encode(member)), attrs=[])
+                filter = ('(&(sAMAccountName=%s)(|(objectclass=user)'
+                          '(objectclass=group)))' % ldb.binary_encode(member))
+                targetmember = self.search(base=self.domain_dn(),
+                                           scope=ldb.SCOPE_SUBTREE,
+                                           expression="%s" % filter,
+                                           attrs=[])
 
                 if len(targetmember) != 1:
                     raise Exception('Unable to find "%s". Operation cancelled.' % member)