From: Gerald W. Carter <jerry@samba.org>
Date: Fri, 23 May 2008 20:19:58 +0000 (-0500)
Subject: Manually port Steven Dannenman fix for using the correct machine domain when
X-Git-Tag: samba-3.3.0pre1~1152
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=69b37ae60757075a0712149c5f97f17ee22c2e41;p=thirdparty%2Fsamba.git

Manually port Steven Dannenman fix for using the correct machine domain when
looking up trust credentials in our tdb.

   commit fd0ae47046d37ec8297396a2733209c4d999ea91
   Author: Steven Danneman <sdanneman@isilon.com>
   Date:   Thu May 8 13:34:49 2008 -0700

      Use machine account and machine password from our domain when
      contacting trusted domains.
---

diff --git a/source/passdb/passdb.c b/source/passdb/passdb.c
index 46dab156eef..e3a3d3ca9e5 100644
--- a/source/passdb/passdb.c
+++ b/source/passdb/passdb.c
@@ -1560,10 +1560,10 @@ bool get_trust_pw_clear(const char *domain, char **ret_pwd,
 		return true;
 	}
 
-	/* Just get the account for the requested domain. In the future this
-	 * might also cover to be member of more than one domain. */
+	/* Here we are a domain member server.  We can only be a member
+	   of one domain so ignore the request domain and assume our own */
 
-	pwd = secrets_fetch_machine_password(domain, &last_set_time, channel);
+	pwd = secrets_fetch_machine_password(lp_workgroup(), &last_set_time, channel);
 
 	if (pwd != NULL) {
 		*ret_pwd = pwd;
diff --git a/source/winbindd/winbindd_cm.c b/source/winbindd/winbindd_cm.c
index 377b1b2d214..9bab80377a9 100644
--- a/source/winbindd/winbindd_cm.c
+++ b/source/winbindd/winbindd_cm.c
@@ -706,12 +706,12 @@ static NTSTATUS get_trust_creds(const struct winbindd_domain *domain,
 		return NT_STATUS_NO_MEMORY;
 	}
 
-	/* this is at least correct when domain is our domain,
-	 * which is the only case, when this is currently used: */
+	/* For now assume our machine account only exists in our domain */
+
 	if (machine_krb5_principal != NULL)
 	{
 		if (asprintf(machine_krb5_principal, "%s$@%s",
-			     account_name, domain->alt_name) == -1)
+			     account_name, lp_realm()) == -1)
 		{
 			return NT_STATUS_NO_MEMORY;
 		}