winbindd: remove 'winbind trusted domains only' handling

[samba.git] / source3 / winbindd / winbindd_util.c

diff --git a/source3/winbindd/winbindd_util.c b/source3/winbindd/winbindd_util.c
index bfe6ccad233f46c6cbcd539263da91ff15a360a4..b3439d078a3ea6445edd5f41ce9d34a4629cb16a 100644 (file)
--- a/source3/winbindd/winbindd_util.c
+++ b/source3/winbindd/winbindd_util.c
@@ -252,12 +252,10 @@ add_trusted_domain_from_tdc(const struct winbindd_tdc_domain *tdc)
        domain->domain_trust_attribs = tdc->trust_attribs;
 
        /* Is this our primary domain ? */
-       if (strequal(domain_name, get_global_sam_name()) &&
-                       (role != ROLE_DOMAIN_MEMBER)) {
-               domain->primary = true;
-       } else if (strequal(domain_name, lp_workgroup()) &&
-                       (role == ROLE_DOMAIN_MEMBER)) {
-               domain->primary = true;
+       if (role == ROLE_DOMAIN_MEMBER) {
+               domain->primary = strequal(domain_name, lp_workgroup());
+       } else {
+               domain->primary = strequal(domain_name, get_global_sam_name());
        }
 
        if (domain->primary) {
@@ -323,7 +321,7 @@ static void add_trusted_domains( struct winbindd_domain *domain )
        state->request.length = sizeof(state->request);
        state->request.cmd = WINBINDD_LIST_TRUSTDOM;
 
-       req = wb_domain_request_send(state, winbind_event_context(),
+       req = wb_domain_request_send(state, server_event_context(),
                                     domain, &state->request);
        if (req == NULL) {
                DEBUG(1, ("wb_domain_request_send failed\n"));
@@ -795,6 +793,7 @@ static bool migrate_secrets_tdb_to_ldb(struct winbindd_domain *domain)
 bool init_domain_list(void)
 {
        int role = lp_server_role();
+       struct pdb_domain_info *pdb_domain_info = NULL;
        NTSTATUS status;
 
        /* Free existing list */
@@ -806,15 +805,24 @@ bool init_domain_list(void)
 
        /* Local SAM */
 
+       /*
+        * In case the passdb backend is passdb_dsdb the domain SID comes from
+        * dsdb, not from secrets.tdb. As we use the domain SID in various
+        * places, we must ensure the domain SID is migrated from dsdb to
+        * secrets.tdb before get_global_sam_sid() is called the first time.
+        *
+        * The migration is done as part of the passdb_dsdb initialisation,
+        * calling pdb_get_domain_info() triggers it.
+        */
+       pdb_domain_info = pdb_get_domain_info(talloc_tos());
+
        if ( role == ROLE_ACTIVE_DIRECTORY_DC ) {
                struct winbindd_domain *domain;
                enum netr_SchannelType sec_chan_type;
                const char *account_name;
                struct samr_Password current_nt_hash;
-               struct pdb_domain_info *pdb_domain_info;
                bool ok;
 
-               pdb_domain_info = pdb_get_domain_info(talloc_tos());
                if (pdb_domain_info == NULL) {
                        DEBUG(0, ("Failed to fetch our own, local AD "
                                "domain info from sam.ldb\n"));
@@ -846,7 +854,7 @@ bool init_domain_list(void)
                         */
                        ok = migrate_secrets_tdb_to_ldb(domain);
 
-                       if (ok == false) {
+                       if (!ok) {
                                DEBUG(0, ("Failed to migrate our own, "
                                          "local AD domain join password for "
                                          "winbindd's internal use into "
@@ -857,7 +865,7 @@ bool init_domain_list(void)
                                               current_nt_hash.hash,
                                               &account_name,
                                               &sec_chan_type);
-                       if (ok == false) {
+                       if (!ok) {
                                DEBUG(0, ("Failed to find our our own, just "
                                          "written local AD domain join "
                                          "password for winbindd's internal "
@@ -1077,7 +1085,7 @@ static bool assume_domain(const char *domain)
                if ( !strequal(lp_workgroup(), domain) )
                        return False;
 
-               if ( lp_winbind_use_default_domain() || lp_winbind_trusted_domains_only() )
+               if ( lp_winbind_use_default_domain() )
                        return True;
        }
 
@@ -1158,9 +1166,6 @@ bool canonicalize_username(fstring username_inout, fstring domain, fstring user)
 
     If we are a PDC or BDC, and this is for our domain, do likewise.
 
-    Also, if omit DOMAIN if 'winbind trusted domains only = true', as the
-    username is then unqualified in unix
-
     On an AD DC we always fill DOMAIN\\USERNAME.
 
     We always canonicalize as UPPERCASE DOMAIN, lowercase username.
@@ -1331,10 +1336,11 @@ NTSTATUS lookup_usergroups_cached(TALLOC_CTX *mem_ctx,
 ********************************************************************/
 
 NTSTATUS normalize_name_map(TALLOC_CTX *mem_ctx,
-                            struct winbindd_domain *domain,
+                            const char *domain_name,
                             const char *name,
                             char **normalized)
 {
+       struct winbindd_domain *domain = NULL;
        NTSTATUS nt_status;
 
        if (!name || !normalized) {
@@ -1345,6 +1351,12 @@ NTSTATUS normalize_name_map(TALLOC_CTX *mem_ctx,
                return NT_STATUS_PROCEDURE_NOT_FOUND;
        }
 
+       domain = find_domain_from_name_noinit(domain_name);
+       if (domain == NULL) {
+               DBG_ERR("Failed to find domain '%s'\n", domain_name);
+               return NT_STATUS_NO_SUCH_DOMAIN;
+       }
+
        /* Alias support and whitespace replacement are mutually
           exclusive */
 
@@ -1611,9 +1623,6 @@ void set_auth_errors(struct winbindd_response *resp, NTSTATUS result)
 
 bool is_domain_offline(const struct winbindd_domain *domain)
 {
-       if (!lp_winbind_offline_logon()) {
-               return false;
-       }
        if (get_global_winbindd_state_offline()) {
                return true;
        }