From: Stefan Metzmacher <metze@samba.org>
Date: Thu, 1 Feb 2018 10:06:10 +0000 (+0100)
Subject: winbindd: disable support for CROSS_ORGANIZATION domains
X-Git-Tag: talloc-2.1.12~418
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=afd97e72090aaf31b084646b5fcecaeb8cde653d;p=thirdparty%2Fsamba.git

winbindd: disable support for CROSS_ORGANIZATION domains

We don't support selective authentication yet,
so we shouldn't silently allow domain wide authentication
for such a trust.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=13299

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Ralph Boehme <slow@samba.org>
---

diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index 73e6b76ec73..b19c42f626b 100644
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -961,6 +961,17 @@ static bool add_trusted_domains_dc(void)
 			trust_flags |= NETR_TRUST_FLAG_IN_FOREST;
 		}
 
+		if (domains[i]->trust_attributes & LSA_TRUST_ATTRIBUTE_CROSS_ORGANIZATION) {
+			/*
+			 * We don't support selective authentication yet.
+			 */
+			DBG_WARNING("Ignoring CROSS_ORGANIZATION trust to "
+				    "domain[%s/%s]\n",
+				    domains[i]->netbios_name,
+				    domains[i]->domain_name);
+			continue;
+		}
+
 		status = add_trusted_domain(domains[i]->netbios_name,
 					    domains[i]->domain_name,
 					    &domains[i]->security_identifier,