From: Gerald Carter <jerry@samba.org>
Date: Thu, 21 Apr 2005 17:13:50 +0000 (+0000)
Subject: r6421: use add machine script when creating a user (ACB_NORMAL)
X-Git-Tag: samba-misc-tags/initial-v3-0-unstable~4918
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=0ac57ae94202190ddbe538f7180a0443463b48cf;p=thirdparty%2Fsamba.git

r6421: use add machine script when creating a user (ACB_NORMAL)
who has a name ending in '$' (usrmgr.exe does this for
domain trusts (that's was jfm's original comment I think).

avoid an assert() call in libldap.
---

diff --git a/source/passdb/pdb_ldap.c b/source/passdb/pdb_ldap.c
index 04929314f09..7d66b0aaf04 100644
--- a/source/passdb/pdb_ldap.c
+++ b/source/passdb/pdb_ldap.c
@@ -3423,7 +3423,8 @@ static BOOL ldapsam_search_firstpage(struct pdb_search *search)
 		state->connection->paged_results = False;
 	}
 
-	state->current_entry = ldap_first_entry(ld, state->entries);
+	if ( ld )
+		state->current_entry = ldap_first_entry(ld, state->entries);
 
 	if (state->current_entry == NULL) {
 		ldap_msgfree(state->entries);
diff --git a/source/rpc_server/srv_samr_nt.c b/source/rpc_server/srv_samr_nt.c
index fe54476cc95..89cb49c05cc 100644
--- a/source/rpc_server/srv_samr_nt.c
+++ b/source/rpc_server/srv_samr_nt.c
@@ -1985,13 +1985,15 @@ NTSTATUS _samr_create_user(pipes_struct *p, SAMR_Q_CREATE_USER *q_u, SAMR_R_CREA
 		se_priv_copy( &se_rights, &se_machine_account );
 		can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
 	} 
-	else if ( acb_info & ACB_NORMAL )
+	/* usrmgr.exe (and net rpc trustdom grant) creates a normal user 
+	   account for domain trusts and changes the ACB flags later */
+	else if ( acb_info & ACB_NORMAL && (account[strlen(account)-1] != '$') )
 	{
 		pstrcpy(add_script, lp_adduser_script());
 		se_priv_copy( &se_rights, &se_add_users );
 		can_add_account = user_has_privileges( p->pipe_user.nt_user_token, &se_rights );
 	} 
-	else if ( acb_info & (ACB_SVRTRUST|ACB_DOMTRUST) ) 
+	else 	/* implicit assumption of a BDC or domain trust account here (we already check the flags earlier) */
 	{
 		pstrcpy(add_script, lp_addmachine_script());
 		if ( lp_enable_privileges() ) {