From: Andrew Bartlett <abartlet@samba.org>
Date: Mon, 21 Apr 2008 15:48:31 +0000 (+0200)
Subject: Add in a nice big comment explaining why SamLogonEx matters.
X-Git-Tag: samba-3.3.0pre1~2638
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=87232351b5e66728f8d602259961909e8c1dfcb6;p=thirdparty%2Fsamba.git

Add in a nice big comment explaining why SamLogonEx matters.

Andrew Bartlett
---

diff --git a/source/winbindd/winbindd_pam.c b/source/winbindd/winbindd_pam.c
index bc27f3db207..2de10a9f109 100644
--- a/source/winbindd/winbindd_pam.c
+++ b/source/winbindd/winbindd_pam.c
@@ -1307,6 +1307,27 @@ NTSTATUS winbindd_dual_pam_auth_samlogon(struct winbindd_domain *domain,
 			goto done;
 		}
 
+		/* It is really important to try SamLogonEx here,
+		 * because in a clustered environment, we want to use
+		 * one machine account from multiple physical
+		 * computers.  
+		 *
+		 * With a normal SamLogon call, we must keep the
+		 * credentials chain updated and intact between all
+		 * users of the machine account (which would imply
+		 * cross-node communication for every NTLM logon).
+		 *
+		 * (The credentials chain is not per NETLOGON pipe
+		 * connection, but globally on the server/client pair
+		 * by machine name).
+		 *
+		 * When using SamLogonEx, the credentials are not
+		 * supplied, but the session key is implied by the
+		 * wrapping SamLogon context.
+		 * 
+		 *  -- abartlet 21 April 2008
+		 */
+
 		logon_fn = contact_domain->can_do_samlogon_ex
 			? rpccli_netlogon_sam_network_logon_ex
 			: rpccli_netlogon_sam_network_logon;