From: Björn Baumbach <bb@sernet.de>
Date: Fri, 9 Aug 2019 14:45:51 +0000 (+0200)
Subject: python/samdb: adapt search filter for group object type
X-Git-Tag: samba-4.12.0rc1~13
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c4e899d6b4bcc5d42c73810e0c7fe8b67db2b094;p=thirdparty%2Fsamba.git

python/samdb: adapt search filter for group object type

Use a group search filter which is similar to the filter which is used
by the basic MS Windows group membership management.

The filter excludes the group type GROUP_TYPE_BUILTIN_LOCAL_GROUP.

Signed-off-by: Björn Baumbach <bb@sernet.de>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/python/samba/samdb.py b/python/samba/samdb.py
index 7852373c817..b1d5acb8399 100644
--- a/python/samba/samdb.py
+++ b/python/samba/samdb.py
@@ -258,7 +258,9 @@ pwdLastSet: 0
             filter += ('(&(sAMAccountName=%s)(samAccountType=%d))' %
                        (ldb.binary_encode(member), dsdb.ATYPE_NORMAL_ACCOUNT))
         if 'group' in member_types:
-            filter += ('(&(sAMAccountName=%s)(objectclass=group))' %
+            filter += ('(&(sAMAccountName=%s)'
+                       '(objectClass=group)'
+                       '(!(groupType:1.2.840.113556.1.4.803:=1)))' %
                        ldb.binary_encode(member))
         if 'computer' in member_types:
             samaccountname = member