s3-net: no secrets access required when processing a ODJ provisioning

It should be possible to call "net offlinejoin provision" as non-root,
no access to secrets.tdb required in that case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15414

Guenther

Signed-off-by: Guenther Deschner <gd@samba.org>
Reviewed-by: Andreas Schneider <asn@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Wed Jul  5 09:23:22 UTC 2023 on atb-devel-224

diff --git a/source3/libnet/libnet_join.c b/source3/libnet/libnet_join.c
index 3bff7ec1412b16a8b8ffe89c96e5cbb14e21b677..b60eb112d0a19bb61c691d22d230e8e9832a615f 100644 (file)
--- a/source3/libnet/libnet_join.c
+++ b/source3/libnet/libnet_join.c
@@ -2369,6 +2369,14 @@ static WERROR libnet_join_pre_processing(TALLOC_CTX *mem_ctx,
                r->in.admin_account = admin_account;
        }
 
+       if (r->in.provision_computer_account_only) {
+               /*
+                * When in the "provision_computer_account_only" path we do not
+                * need to have access to secrets.tdb at all - gd
+                */
+               return WERR_OK;
+       }
+
        if (!secrets_init()) {
                libnet_join_set_error_string(mem_ctx, r,
                        "Unable to open secrets database");