s4-security: added a new security level SECURITY_DOMAIN_CONTROLLER

This will be used as a simple way to lock down DRS replication to
administrators and domain controllers

diff --git a/source4/libcli/security/security.h b/source4/libcli/security/security.h
index 6dbbe014e7f598e9b29999ad2c7e9a005d591bdc..3cfa484816265d4769207226d34aa7519adaa317 100644 (file)
--- a/source4/libcli/security/security.h
+++ b/source4/libcli/security/security.h
@@ -22,6 +22,7 @@
 enum security_user_level {
        SECURITY_ANONYMOUS,
        SECURITY_USER,
+       SECURITY_DOMAIN_CONTROLLER,
        SECURITY_ADMINISTRATOR,
        SECURITY_SYSTEM
 };

diff --git a/source4/libcli/security/security_token.c b/source4/libcli/security/security_token.c
index 0764dfeb8fa8b07a159b05812ef7e67c08830651..d3eff93ddb78610321e15d6a610c546f8c6363ee 100644 (file)
--- a/source4/libcli/security/security_token.c
+++ b/source4/libcli/security/security_token.c
@@ -142,6 +142,11 @@ bool security_token_has_nt_authenticated_users(const struct security_token *toke
        return security_token_has_sid_string(token, SID_NT_AUTHENTICATED_USERS);
 }
 
+bool security_token_has_enterprise_dcs(const struct security_token *token)
+{
+       return security_token_has_sid_string(token, SID_NT_ENTERPRISE_DCS);
+}
+
 enum security_user_level security_session_user_level(struct auth_session_info *session_info) 
 {
        if (!session_info) {
@@ -160,6 +165,10 @@ enum security_user_level security_session_user_level(struct auth_session_info *s
                return SECURITY_ADMINISTRATOR;
        }
 
+       if (security_token_has_enterprise_dcs(session_info->security_token)) {
+               return SECURITY_DOMAIN_CONTROLLER;
+       }
+
        if (security_token_has_nt_authenticated_users(session_info->security_token)) {
                return SECURITY_USER;
        }