From: Gerald W. Carter <jerry@samba.org>
Date: Thu, 27 Mar 2008 16:56:29 +0000 (-0500)
Subject: Don't fill password policy structure for any domain other than our own.
X-Git-Tag: samba-3.3.0pre1~3074
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=4de4949e3bfcfb2169c329f19cb76936d9043d50;p=thirdparty%2Fsamba.git

Don't fill password policy structure for any domain other than our own.

The samr connects will fail.  This is not independent of the CONTACT_TRUSTDOM
flag neede by krb5 logins.
---

diff --git a/source/winbindd/winbindd_pam.c b/source/winbindd/winbindd_pam.c
index 63127cbfcd3..3b13a9269a9 100644
--- a/source/winbindd/winbindd_pam.c
+++ b/source/winbindd/winbindd_pam.c
@@ -1638,12 +1638,24 @@ process_result:
 
 
 		if (state->request.flags & WBFLAG_PAM_GET_PWD_POLICY) {
-			result = fillup_password_policy(domain, state);
-
+			struct winbindd_domain *our_domain = find_our_domain();
+			
+			/* This is not entiurely correct I believe, but it is 
+			   consistent.  Only apply the password policy settings
+			   too warn users for our own domain.  Cannot obtain these 
+			   from trusted DCs all the  time so don't do it at all. 
+			   -- jerry */
+
+			result = NT_STATUS_NOT_SUPPORTED;			
+			if (our_domain == domain ) {
+a				result = fillup_password_policy(our_domain, state);
+			}
+			
 			if (!NT_STATUS_IS_OK(result) 
 			    && !NT_STATUS_EQUAL(result, NT_STATUS_NOT_SUPPORTED) ) 
 			{
-				DEBUG(10,("Failed to get password policies: %s\n", nt_errstr(result)));
+				DEBUG(10,("Failed to get password policies for domain %s: %s\n", 
+					  domain->name, nt_errstr(result)));
 				goto done;
 			}
 		}