From: Stefan Metzmacher <metze@sernet.de>
Date: Thu, 24 Sep 2009 19:35:38 +0000 (+0200)
Subject: s3:winbindd_cm: don't invalidate the whole connection when just samr gave ACCCESS_DENIED
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c6d485583aba69b38b2972224e27edb60c3bf09a;p=thirdparty%2Fsamba.git

s3:winbindd_cm: don't invalidate the whole connection when just samr gave ACCCESS_DENIED

metze
---

diff --git a/source/winbindd/winbindd_cm.c b/source/winbindd/winbindd_cm.c
index bf8490edda3..bd502a5ece0 100644
--- a/source/winbindd/winbindd_cm.c
+++ b/source/winbindd/winbindd_cm.c
@@ -2148,7 +2148,18 @@ NTSTATUS cm_connect_sam(struct winbindd_domain *domain, TALLOC_CTX *mem_ctx,
 
  done:
 
-	if (!NT_STATUS_IS_OK(result)) {
+	if (NT_STATUS_EQUAL(result, NT_STATUS_ACCESS_DENIED)) {
+		/*
+		 * if we got access denied, we might just have no access rights
+		 * to talk to the remote samr server server (e.g. when we are a
+		 * PDC and we are connecting a w2k8 pdc via an interdomain
+		 * trust). In that case do not invalidate the whole connection
+		 * stack
+		 */
+		TALLOC_FREE(conn->samr_pipe);
+		ZERO_STRUCT(conn->sam_domain_handle);
+		return result;
+	} else if (!NT_STATUS_IS_OK(result)) {
 		invalidate_cm_connection(conn);
 		return result;
 	}