From: Jeremy Allison <jra@samba.org>
Date: Fri, 8 May 2009 17:11:38 +0000 (-0700)
Subject: Expand the comment explaining why user_in_group_sid is
X-Git-Tag: tdb-1.1.5~663
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=f47b220ce1bd8632205679bbba8f679f4470360b;p=thirdparty%2Fsamba.git

Expand the comment explaining why user_in_group_sid is
not reliable for winbindd users from foreign domains.
Jeremy.
---

diff --git a/source3/smbd/posix_acls.c b/source3/smbd/posix_acls.c
index abfb00c44c0..8d172e17bd9 100644
--- a/source3/smbd/posix_acls.c
+++ b/source3/smbd/posix_acls.c
@@ -1297,7 +1297,12 @@ static bool uid_entry_in_group( canon_ace *uid_ace, canon_ace *group_ace )
 		return False;
 	}
 
-	/* notice that this is not reliable for users exported by winbindd! */
+	/*
+	 * user_in_group_sid() uses create_token_from_username()
+	 * which creates an artificial NT token given just a username,
+	 * so this is not reliable for users from foreign domains
+	 * exported by winbindd!
+	 */
 	return user_in_group_sid(u_name, &group_ace->trustee);
 }