r25068: Older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for every opcode on the

[samba.git] / source3 / nsswitch / winbindd_cm.c

diff --git a/source3/nsswitch/winbindd_cm.c b/source3/nsswitch/winbindd_cm.c
index 269dab0389b976eb52db0e59ac5b8996a3114c48..1a9d2bbeff36f6269b45918acdfc98ae0926e78f 100644 (file)
--- a/source3/nsswitch/winbindd_cm.c
+++ b/source3/nsswitch/winbindd_cm.c
@@ -395,6 +395,8 @@ static void set_domain_online(struct winbindd_domain *domain)
                return;
        }
 
+       winbindd_set_locator_kdc_envs(domain);
+
        /* If we are waiting to get a krb5 ticket, trigger immediately. */
        GetTimeOfDay(&now);
        set_event_dispatch_time(winbind_event_context(),
@@ -520,6 +522,7 @@ void winbind_add_failed_connection_entry(const struct winbindd_domain *domain,
                add_failed_connection_entry(domain->alt_name, server, result);
                saf_delete(domain->alt_name);
        }
+       winbindd_unset_locator_kdc_env(domain);
 }
 
 /* Choose between anonymous or authenticated connections.  We need to use
@@ -741,6 +744,8 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
                                  "[%s]\n", controller, global_myname(),
                                  machine_krb5_principal));
 
+                       winbindd_set_locator_kdc_envs(domain);
+
                        ads_status = cli_session_setup_spnego(*cli,
                                                              machine_krb5_principal, 
                                                              machine_password, 
@@ -837,6 +842,8 @@ static NTSTATUS cm_prepare_connection(const struct winbindd_domain *domain,
                saf_store( domain->alt_name, (*cli)->desthost );
        }
 
+       winbindd_set_locator_kdc_envs(domain);
+
        if (!cli_send_tconX(*cli, "IPC$", "IPC", "", 0)) {
 
                result = cli_nt_error(*cli);
@@ -1077,19 +1084,29 @@ static BOOL dcip_to_name(const struct winbindd_domain *domain, struct in_addr ip
 
                        DEBUG(10,("dcip_to_name: flags = 0x%x\n", (unsigned int)ads->config.flags));
 
-                       if (domain->primary && (ads->config.flags & ADS_KDC) && ads_closest_dc(ads)) {
-                               char *sitename = sitename_fetch(ads->config.realm);
+                       if (domain->primary && (ads->config.flags & ADS_KDC)) {
+                               if (ads_closest_dc(ads)) {
+                                       char *sitename = sitename_fetch(ads->config.realm);
+
+                                       /* We're going to use this KDC for this realm/domain.
+                                          If we are using sites, then force the krb5 libs
+                                          to use this KDC. */
+
+                                       create_local_private_krb5_conf_for_domain(domain->alt_name,
+                                                                       domain->name,
+                                                                       sitename,
+                                                                       ip);
+
+                                       SAFE_FREE(sitename);
+                               } else {
+                                       /* use an off site KDC */
+                                       create_local_private_krb5_conf_for_domain(domain->alt_name,
+                                                                       domain->name,
+                                                                       NULL,
+                                                                       ip);
+                               }
+                               winbindd_set_locator_kdc_envs(domain);
 
-                               /* We're going to use this KDC for this realm/domain.
-                                  If we are using sites, then force the krb5 libs
-                                  to use this KDC. */
-
-                               create_local_private_krb5_conf_for_domain(domain->alt_name,
-                                                               domain->name,
-                                                               sitename,
-                                                               ip);
-
-                               SAFE_FREE(sitename);
                                /* Ensure we contact this DC also. */
                                saf_store( domain->name, name);
                                saf_store( domain->alt_name, name);
@@ -1394,6 +1411,9 @@ static NTSTATUS cm_open_connection(struct winbindd_domain *domain,
        }
 
        if (NT_STATUS_IS_OK(result)) {
+
+               winbindd_set_locator_kdc_envs(domain);
+
                if (domain->online == False) {
                        /* We're changing state from offline to online. */
                        set_global_winbindd_state_online();
@@ -1695,6 +1715,16 @@ static void set_dc_type_and_flags_connect( struct winbindd_domain *domain )
                DEBUG(5, ("set_dc_type_and_flags_connect: rpccli_ds_getprimarydominfo "
                          "on domain %s failed: (%s)\n",
                          domain->name, nt_errstr(result)));
+
+               /* older samba3 DCs will return DCERPC_FAULT_OP_RNG_ERROR for
+                * every opcode on the LSARPC_DS pipe, continue with
+                * no_lsarpc_ds mode here as well to get domain->initialized
+                * set - gd */
+
+               if (NT_STATUS_V(result) == DCERPC_FAULT_OP_RNG_ERROR) {
+                       goto no_lsarpc_ds;
+               }
+
                return;
        }