libads: Decide to have no fallback option

Before this change, it would always possibly choose another server at
random despite later using the original principal when it got back to
the connection initialization in the the winbind connection manager.
This caused bizarre authentication failures.

Signed-off-by: Garming Sam <garming@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source3/include/ads.h b/source3/include/ads.h
index 2b25c1c6c291554b6fa3965d478301f241ef0b46..ebc5728f3a4fccbe769271f55f7dff44a1dc2f86 100644 (file)
--- a/source3/include/ads.h
+++ b/source3/include/ads.h
@@ -64,6 +64,7 @@ typedef struct ads_struct {
                char *workgroup;
                char *ldap_server;
                bool gc;     /* Is this a global catalog server? */
+               bool no_fallback; /* Bail if the ldap_server is not available */
        } server;
 
        /* info needed to authenticate */

diff --git a/source3/libads/ldap.c b/source3/libads/ldap.c
index b2c57480f1e231366987b5a7204968289deaa6a8..c18837cc524d3097f83b20a33e167078288e7ca5 100644 (file)
--- a/source3/libads/ldap.c
+++ b/source3/libads/ldap.c
@@ -613,6 +613,11 @@ ADS_STATUS ads_connect(ADS_STRUCT *ads)
                if (ads->server.gc == true) {
                        return ADS_ERROR(LDAP_OPERATIONS_ERROR);
                }
+
+               if (ads->server.no_fallback) {
+                       status = ADS_ERROR_NT(NT_STATUS_NOT_FOUND);
+                       goto out;
+               }
        }
 
        ntstatus = ads_find_dc(ads);

diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c
index ce149b294e20479e476c56590415972c68950071..7566a301b7c93dfba67cbebf5f5ab5e063ae00a8 100644 (file)
--- a/source3/winbindd/winbindd_cm.c
+++ b/source3/winbindd/winbindd_cm.c
@@ -1370,6 +1370,7 @@ static bool dcip_check_name(TALLOC_CTX *mem_ctx,
                ads = ads_init(domain->alt_name, domain->name, addr);
                ads->auth.flags |= ADS_AUTH_NO_BIND;
                ads->config.flags |= request_flags;
+               ads->server.no_fallback = true;
 
                ads_status = ads_connect(ads);
                if (ADS_ERR_OK(ads_status)) {