s4:kdc: Add device to default groups for authentication policy evaluation

This means that expressions like ‘Device_Member_of(WD)’ will now work,
as they should.

It *also* means that expressions like ‘Device_Member_of(NU)’ will work,
even though they shouldn’t. This is because we consider SID_NT_NETWORK
to be a default group.

Our new behaviour may be wrong, but at least it’s now consistent with
the behaviour of user‐relative expressions like ‘Member_of(WD)’ and
‘Member_of(NU)’.

Signed-off-by: Joseph Sutton <josephsutton@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/selftest/knownfail_heimdal_kdc b/selftest/knownfail_heimdal_kdc
index 8a35b13062b6ca6957f86f0d0a078b9daf2002e5..dcda95954ba840c0d2ca7ae736fc6327ad9de149 100644 (file)
--- a/selftest/knownfail_heimdal_kdc
+++ b/selftest/knownfail_heimdal_kdc
@@ -133,4 +133,4 @@
 ^samba.tests.krb5.conditional_ace_tests.samba.tests.krb5.conditional_ace_tests.ConditionalAceTests.test_tgs_without_aa_asserted_identity_client_from_rodc\(ad_dc\)
 ^samba\.tests\.krb5\.conditional_ace_tests\.samba\.tests\.krb5\.conditional_ace_tests\.DeviceRestrictionTests\.test_device_in_network_group\(ad_dc\)$
 ^samba\.tests\.krb5\.conditional_ace_tests\.samba\.tests\.krb5\.conditional_ace_tests\.TgsReqServicePolicyTests\.test_device_in_authenticated_users\(ad_dc\)$
-^samba\.tests\.krb5\.conditional_ace_tests\.samba\.tests\.krb5\.conditional_ace_tests\.TgsReqServicePolicyTests\.test_device_in_world_group\(ad_dc\)$
+^samba\.tests\.krb5\.conditional_ace_tests\.samba\.tests\.krb5\.conditional_ace_tests\.TgsReqServicePolicyTests\.test_device_in_network_group\(ad_dc\)$

diff --git a/source4/kdc/authn_policy_util.c b/source4/kdc/authn_policy_util.c
index a9f793889ef8b9df4bccfa7c6618b19e775d35ab..46d1aa352a4a1fe34981efe00f58c680a5da1110 100644 (file)
--- a/source4/kdc/authn_policy_util.c
+++ b/source4/kdc/authn_policy_util.c
@@ -574,6 +574,7 @@ static NTSTATUS _authn_policy_access_check(TALLOC_CTX *mem_ctx,
        struct security_token *security_token = NULL;
        uint32_t session_info_flags =
                AUTH_SESSION_INFO_DEFAULT_GROUPS |
+               AUTH_SESSION_INFO_DEVICE_DEFAULT_GROUPS |
                AUTH_SESSION_INFO_SIMPLE_PRIVILEGES;
        const uint32_t access_desired = SEC_ADS_CONTROL_ACCESS;
        uint32_t access_granted;