From: Joseph Sutton Date: Thu, 15 Dec 2022 01:07:06 +0000 (+1300) Subject: auth: Discard non-base SIDs when creating SamInfo2 X-Git-Tag: talloc-2.4.1~1644 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e5a6b001fd2844bfa5fa56047fb4cc09563966c4;p=thirdparty%2Fsamba.git auth: Discard non-base SIDs when creating SamInfo2 Our SamLogon tests are now all passing. Signed-off-by: Joseph Sutton Reviewed-by: Andrew Bartlett --- diff --git a/auth/auth_sam_reply.c b/auth/auth_sam_reply.c index fd94bdbc505..23579eb4035 100644 --- a/auth/auth_sam_reply.c +++ b/auth/auth_sam_reply.c @@ -453,6 +453,12 @@ NTSTATUS auth_convert_user_info_dc_saminfo2(TALLOC_CTX *mem_ctx, return status; } sam2->base = sam6->base; + /* + * We have nowhere to put sam6->sids, so we follow Windows here and drop + * it. Any resource groups it happened to be contain are lost. + */ + sam2->base.user_flags &= ~NETLOGON_EXTRA_SIDS; + TALLOC_FREE(sam6->sids); *_sam2 = sam2; return NT_STATUS_OK; diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc index b173ad851b5..99f687e3212 100644 --- a/selftest/knownfail_heimdal_kdc +++ b/selftest/knownfail_heimdal_kdc @@ -142,7 +142,3 @@ ^samba.tests.krb5.claims_tests.samba.tests.krb5.claims_tests.ClaimsTests.test_tgs_claims_remove_claims.ad_dc ^samba.tests.krb5.claims_tests.samba.tests.krb5.claims_tests.ClaimsTests.test_tgs_claims_remove_claims_to_krbtgt.ad_dc ^samba.tests.krb5.claims_tests.samba.tests.krb5.claims_tests.ClaimsTests.test_tgs_claims_to_krbtgt.ad_dc -# -# Group tests -# -^samba.tests.krb5.group_tests.samba.tests.krb5.group_tests.GroupTests.test_samlogon_SamInfo.ad_dc diff --git a/selftest/knownfail_mit_kdc b/selftest/knownfail_mit_kdc index dd28acf959a..4832e831508 100644 --- a/selftest/knownfail_mit_kdc +++ b/selftest/knownfail_mit_kdc @@ -612,7 +612,6 @@ samba.tests.krb5.as_canonicalization_tests.samba.tests.krb5.as_canonicalization_ ^samba.tests.krb5.group_tests.samba.tests.krb5.group_tests.GroupTests.test_group_universal_as_req_to_service.ad_dc ^samba.tests.krb5.group_tests.samba.tests.krb5.group_tests.GroupTests.test_group_user_group_removal_tgs_req_to_krbtgt.ad_dc ^samba.tests.krb5.group_tests.samba.tests.krb5.group_tests.GroupTests.test_group_user_group_removal_tgs_req_to_service.ad_dc -^samba.tests.krb5.group_tests.samba.tests.krb5.group_tests.GroupTests.test_samlogon_SamInfo.ad_dc # # Encryption type tests #