From: Stefan Metzmacher <metze@samba.org>
Date: Thu, 22 Feb 2018 09:40:19 +0000 (+0100)
Subject: winbind: force the usage of schannel in cm_connect_lsa() as AD DC
X-Git-Tag: ldb-1.3.2~39
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3e17a3b7cd4083299037ba9377931bea792b2d18;p=thirdparty%2Fsamba.git

winbind: force the usage of schannel in cm_connect_lsa() as AD DC

This makes sure we only talk to direct trusts.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13278

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index 4229647dc4d..b6a54d0a12b 100644
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -2970,6 +2970,13 @@ retry:
 
 	TALLOC_FREE(conn->lsa_pipe);
 
+	if (IS_AD_DC) {
+		/*
+		 * Make sure we only use schannel as AD DC.
+		 */
+		goto schannel;
+	}
+
 	result = get_trust_credentials(domain, talloc_tos(), false, &creds);
 	if (!NT_STATUS_IS_OK(result)) {
 		DEBUG(10, ("cm_connect_lsa: No user available for "
@@ -3083,6 +3090,13 @@ retry:
 		goto done;
 	}
 
+	if (IS_AD_DC) {
+		/*
+		 * Make sure we only use schannel as AD DC.
+		 */
+		goto done;
+	}
+
 	DEBUG(10,("cm_connect_lsa: rpccli_lsa_open_policy failed, trying "
 		  "anonymous\n"));
 
@@ -3090,6 +3104,13 @@ retry:
 
  anonymous:
 
+	if (IS_AD_DC) {
+		/*
+		 * Make sure we only use schannel as AD DC.
+		 */
+		goto done;
+	}
+
 	if (lp_winbind_sealed_pipes() || lp_require_strong_key()) {
 		result = NT_STATUS_DOWNGRADE_DETECTED;
 		DEBUG(1, ("Unwilling to make LSA connection to domain %s "