s4-kdc: don't look at global catalog NCs in the kdc

[ira/wip.git] / source4 / kdc / kpasswdd.c

diff --git a/source4/kdc/kpasswdd.c b/source4/kdc/kpasswdd.c
index 478dcaf573249bc0f16d01cd96aeed7dce654382..0763e924986480a8f3e7ceb472a8e4aa723b7149 100644 (file)
--- a/source4/kdc/kpasswdd.c
+++ b/source4/kdc/kpasswdd.c
@@ -30,6 +30,7 @@
 #include "libcli/security/security.h"
 #include "param/param.h"
 #include "kdc/kdc-glue.h"
+#include "dsdb/common/util.h"
 
 /* Return true if there is a valid error packet formed in the error_blob */
 static bool kpasswdd_make_error_reply(struct kdc_server *kdc,
@@ -160,24 +161,27 @@ static bool kpasswdd_change_password(struct kdc_server *kdc,
        struct samr_Password *oldLmHash, *oldNtHash;
        struct ldb_context *samdb;
        const char * const attrs[] = { "dBCSPwd", "unicodePwd", NULL };
-       struct ldb_message **res;
+       struct ldb_message *msg;
        int ret;
 
        /* Fetch the old hashes to get the old password in order to perform
         * the password change operation. Naturally it would be much better to
         * have a password hash from an authentication around but this doesn't
         * seem to be the case here. */
-       ret = gendb_search(kdc->samdb, mem_ctx, NULL, &res, attrs,
-                          "(&(objectClass=user)(sAMAccountName=%s))",
-                          session_info->info->account_name);
-       if (ret != 1) {
+       ret = dsdb_search_one(kdc->samdb, mem_ctx, &msg, ldb_get_default_basedn(kdc->samdb),
+                             LDB_SCOPE_SUBTREE,
+                             attrs,
+                             DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                             "(&(objectClass=user)(sAMAccountName=%s))",
+                             session_info->info->account_name);
+       if (ret != LDB_SUCCESS) {
                return kpasswdd_make_error_reply(kdc, mem_ctx,
                                                KRB5_KPASSWD_ACCESSDENIED,
                                                "No such user when changing password",
                                                reply);
        }
 
-       status = samdb_result_passwords(mem_ctx, kdc->task->lp_ctx, res[0],
+       status = samdb_result_passwords(mem_ctx, kdc->task->lp_ctx, msg,
                                        &oldLmHash, &oldNtHash);
        if (!NT_STATUS_IS_OK(status)) {
                return kpasswdd_make_error_reply(kdc, mem_ctx,