smbd: in ntlm auth, do not map empty domain in case of \user@realm

When mapping user and domain during NTLM authentication, an empty domain
is mapped to the local SAM db. However, an empty domain may legitimately
be used if the user field has both user and domain in upn@realm format.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=12375

Signed-off-by: Uri Simchoni <uri@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>

diff --git a/selftest/knownfail b/selftest/knownfail
index e3090f488a2037a04299aa5baef34fc3c95527e1..976761b94b440220e9bcac30332fe0251236075e 100644 (file)
--- a/selftest/knownfail
+++ b/selftest/knownfail
@@ -294,5 +294,3 @@
 #ntvfs server blocks copychunk with execute access on read handle
 ^samba4.smb2.ioctl.copy_chunk_bad_access
 ^samba4.drs.getnc_exop.python.*getnc_exop.DrsReplicaPrefixMapTestCase.test_regular_prefix_map_ex_attid.*
-#ad_member does not support for user@realm NTLM authentication
-^samba3.unix.whoami ntlm user@realm.*\(ad_member

diff --git a/source3/auth/auth_util.c b/source3/auth/auth_util.c
index 5473fa23a6c734883a8eb7e2db2ee7a2ff5a8106..2da28961bbe6836b0dbd639145e92759ff91ae25 100644 (file)
--- a/source3/auth/auth_util.c
+++ b/source3/auth/auth_util.c
@@ -107,6 +107,11 @@ NTSTATUS make_user_info_map(TALLOC_CTX *mem_ctx,
        NTSTATUS result;
        bool was_mapped;
        char *internal_username = NULL;
+       bool upn_form = false;
+
+       if (client_domain[0] == '\0' && strchr(smb_name, '@')) {
+               upn_form = true;
+       }
 
        was_mapped = map_username(talloc_tos(), smb_name, &internal_username);
        if (!internal_username) {
@@ -126,10 +131,9 @@ NTSTATUS make_user_info_map(TALLOC_CTX *mem_ctx,
         * non-domain member box will also map to WORKSTATION\user.
         * This also deals with the client passing in a "" domain */
 
-       if (!is_trusted_domain(domain) &&
+       if (!upn_form && !is_trusted_domain(domain) &&
            !strequal(domain, my_sam_name()) &&
-           !strequal(domain, get_global_sam_name()))
-       {
+           !strequal(domain, get_global_sam_name())) {
                if (lp_map_untrusted_to_domain())
                        domain = my_sam_name();
                else