loadparm.c :

	added "domain admin users" parameter
	added "domain guest users" parameter

	these two complement the "domain groups" parameter.  the "domain groups"
	parameter should be for your own groups, and well-known aliases.

util.c :

	added ability to do "domain groups = power_users admin_users backup_ops"
	which are well-known RID aliases, not well-known RID groups.

pipenetlog.c :

	combine the "domain admin users"; "domain guest users" and "domain groups"
	parameters to give an array of RID groups to include in the SAM Logon
	response.

ipc.c smb.h :

	moved REALLOC() into smb.h
	added RID #defines.

proto.h:

	usual.
(This used to be commit f2554f231d1f59f30224adcc02b2b3ca4c24e0dd)

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 5bd17459582c84ad0b9b6898610ea9e820d9235c..4613137d0d56a833adbd38f1a41fc07d683d261a 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -178,6 +178,8 @@ char *lp_announce_version(void);
 char *lp_netbios_aliases(void);
 char *lp_domainsid(void);
 char *lp_domain_groups(void);
+char *lp_domain_admin_users(void);
+char *lp_domain_guest_users(void);
 BOOL lp_dns_proxy(void);
 BOOL lp_wins_support(void);
 BOOL lp_wins_proxy(void);

diff --git a/source3/include/smb.h b/source3/include/smb.h
index 7921e77108e705abc0b7286b946276ce9ea64b52..0965b6b90b4cd498fd146848f45a2fe2828286ab 100644 (file)
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -66,6 +66,8 @@ typedef int BOOL;
 typedef  int smb_shm_offset_t;
 #define NULL_OFFSET (smb_shm_offset_t)(0)
 
+/* limiting size of ipc replies */
+#define REALLOC(ptr,size) Realloc(ptr,MAX((size),4*1024))
 
 /*
    Samba needs type definitions for int16, int32, uint16 and uint32.
@@ -298,6 +300,32 @@ typedef fstring string;
 #define NETSERVERGETINFO 0x15
 #define NETSHAREENUM     0x0f
 
+/* well-known RIDs - Relative IDs */
+
+/* RIDs - Well-known users ... */
+#define DOMAIN_USER_RID_ADMIN          (0x000001F4L)
+#define DOMAIN_USER_RID_GUEST          (0x000001F5L)
+
+/* RIDs - well-known groups ... */
+#define DOMAIN_GROUP_RID_ADMINS        (0x00000200L)
+#define DOMAIN_GROUP_RID_USERS         (0x00000201L)
+#define DOMAIN_GROUP_RID_GUESTS        (0x00000202L)
+
+/* RIDs - well-known aliases ... */
+#define DOMAIN_ALIAS_RID_ADMINS        (0x00000220L)
+#define DOMAIN_ALIAS_RID_USERS         (0x00000221L)
+#define DOMAIN_ALIAS_RID_GUESTS        (0x00000222L)
+#define DOMAIN_ALIAS_RID_POWER_USERS   (0x00000223L)
+
+#define DOMAIN_ALIAS_RID_ACCOUNT_OPS   (0x00000224L)
+#define DOMAIN_ALIAS_RID_SYSTEM_OPS    (0x00000225L)
+#define DOMAIN_ALIAS_RID_PRINT_OPS     (0x00000226L)
+#define DOMAIN_ALIAS_RID_BACKUP_OPS    (0x00000227L)
+
+#define DOMAIN_ALIAS_RID_REPLICATOR    (0x00000228L)
+
+
+
 /* 32 bit time (sec) since 01jan1970 - cifs6.txt, section 3.5, page 30 */
 typedef struct time_info
 {

diff --git a/source3/lib/util.c b/source3/lib/util.c
index ec0f9f0efc99a525d670ecf99474a50acff770f6..96c0774e92a59b259ef16e582084dc0d15030062 100644 (file)
--- a/source3/lib/util.c
+++ b/source3/lib/util.c
@@ -4509,6 +4509,28 @@ char *tab_depth(int depth)
        return spaces;
 }
 
+
+/* array lookup of well-known RID aliases.  the purpose of these escapes me.. */
+static struct
+{
+       uint32 rid;
+       char   *rid_name;
+
+} rid_lookups[] = 
+{
+       { DOMAIN_ALIAS_RID_ADMINS       , "admins" },
+       { DOMAIN_ALIAS_RID_USERS        , "users" },
+       { DOMAIN_ALIAS_RID_GUESTS       , "guests" },
+       { DOMAIN_ALIAS_RID_POWER_USERS  , "power_users" },
+
+       { DOMAIN_ALIAS_RID_ACCOUNT_OPS  , "account_ops" },
+       { DOMAIN_ALIAS_RID_SYSTEM_OPS   , "system_ops" },
+       { DOMAIN_ALIAS_RID_PRINT_OPS    , "print_ops" },
+       { DOMAIN_ALIAS_RID_BACKUP_OPS   , "backup_ops" },
+       { DOMAIN_ALIAS_RID_REPLICATOR   , "replicator" },
+       { 0                             , NULL }
+};
+
 int make_domain_gids(char *gids_str, DOM_GID *gids)
 {
        char *ptr;
@@ -4523,12 +4545,26 @@ int make_domain_gids(char *gids_str, DOM_GID *gids)
        {
                /* the entries are of the form GID/ATTR, ATTR being optional.*/
                char *attr;
+               uint32 rid = 0;
+               int i;
 
                attr = strchr(s2,'/');
                if (attr) *attr++ = 0;
                if (!attr || !*attr) attr = "7"; /* default value for attribute is 7 */
 
-               gids[count].gid = atoi(s2);
+               /* look up the RID string and see if we can turn it into a rid number */
+               for (i = 0; rid_lookups[i].rid_name != NULL; i++)
+               {
+                       if (strequal(rid_lookups[i].rid_name, s2))
+                       {
+                               rid = rid_lookups[i].rid;
+                               break;
+                       }
+               }
+
+               if (rid == 0) rid = atoi(s2);
+
+               gids[count].gid  = rid;
                gids[count].attr = atoi(attr);
 
                DEBUG(5,("group id: %d attr: %d\n", gids[count].gid, gids[count].attr));
@@ -4536,3 +4572,4 @@ int make_domain_gids(char *gids_str, DOM_GID *gids)
 
        return count;
 }
+

diff --git a/source3/param/loadparm.c b/source3/param/loadparm.c
index d0dfe4ace74e8aacf0d68217235b948730641940..a72471c5a90012dcd02cf6f317277350676887db 100644 (file)
--- a/source3/param/loadparm.c
+++ b/source3/param/loadparm.c
@@ -128,6 +128,8 @@ typedef struct
   char *szValidChars;
   char *szWorkGroup;
   char *szDomainController;
+  char *szDomainAdminUsers;
+  char *szDomainGuestUsers;
   char *szUsernameMap;
   char *szCharacterSet;
   char *szLogonScript;
@@ -447,6 +449,8 @@ struct parm_struct
   {"domain sid",       P_USTRING, P_GLOBAL, &Globals.szDomainSID,       NULL},
   {"domain groups",    P_USTRING, P_GLOBAL, &Globals.szDomainGroups,    NULL},
   {"domain controller",P_STRING,  P_GLOBAL, &Globals.szDomainController,NULL},
+  {"domain admin users",P_STRING,  P_GLOBAL, &Globals.szDomainAdminUsers, NULL},
+  {"domain guest users",P_STRING,  P_GLOBAL, &Globals.szDomainGuestUsers, NULL},
   {"username map",     P_STRING,  P_GLOBAL, &Globals.szUsernameMap,     NULL},
   {"character set",    P_STRING,  P_GLOBAL, &Globals.szCharacterSet,    handle_character_set},
   {"logon script",     P_STRING,  P_GLOBAL, &Globals.szLogonScript,     NULL},
@@ -865,6 +869,8 @@ FN_GLOBAL_STRING(lp_netbios_aliases,&Globals.szNetbiosAliases)
 
 FN_GLOBAL_STRING(lp_domainsid,&Globals.szDomainSID)
 FN_GLOBAL_STRING(lp_domain_groups,&Globals.szDomainGroups)
+FN_GLOBAL_STRING(lp_domain_admin_users,&Globals.szDomainAdminUsers)
+FN_GLOBAL_STRING(lp_domain_guest_users,&Globals.szDomainGuestUsers)
 
 FN_GLOBAL_BOOL(lp_dns_proxy,&Globals.bDNSproxy)
 FN_GLOBAL_BOOL(lp_wins_support,&Globals.bWINSsupport)

diff --git a/source3/pipenetlog.c b/source3/pipenetlog.c
index 0563a615913209764b75110af31cfcb1be64bd46..ad4ad6336988836a933dbae914387b01b0aec485 100644 (file)
--- a/source3/pipenetlog.c
+++ b/source3/pipenetlog.c
@@ -508,6 +508,7 @@ static void api_lsa_sam_logon( user_struct *vuser,
                pstring home_drive;
                pstring my_name;
                pstring my_workgroup;
+               pstring domain_groups;
                pstring dom_sid;
                extern pstring myname;
 
@@ -518,6 +519,9 @@ static void api_lsa_sam_logon( user_struct *vuser,
 
                pstrcpy(samlogon_user, unistr2(q_l.sam_id.auth.id1.uni_user_name.buffer));
 
+               DEBUG(3,("SAM Logon. Domain:[%s].  User [%s]\n",
+                         lp_workgroup(), samlogon_user));
+
                /* hack to get standard_sub_basic() to use the sam logon username */
                sam_logon_in_ssb = True;
 
@@ -529,7 +533,28 @@ static void api_lsa_sam_logon( user_struct *vuser,
                pstrcpy(home_drive  , lp_logon_drive ());
                pstrcpy(home_dir    , lp_logon_home  ());
 
-               num_gids = make_domain_gids(lp_domain_groups(), gids);
+               /* any additional groups this user is in.  e.g power users */
+               pstrcpy(domain_groups, lp_domain_groups());
+
+               /* one RID group always added: 512 (Admin); 513 (Users); 514 (Guests) */
+
+               if (user_in_list(samlogon_user, lp_domain_guest_users()))
+               {
+                       DEBUG(3,("domain guest access granted\n"));
+                       strcat(domain_groups, " 514/7 ");
+               }
+               else if (user_in_list(samlogon_user, lp_domain_admin_users()))
+               {
+                       DEBUG(3,("domain admin access granted\n"));
+                       strcat(domain_groups, " 512/7 ");
+               }
+               else
+               {
+                       DEBUG(3,("domain user access granted\n"));
+                       strcat(domain_groups, " 513/7 ");
+               }
+
+               num_gids = make_domain_gids(domain_groups, gids);
 
                sam_logon_in_ssb = False;
 

diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c
index 4f6c85de9f74ff38ad8b57cb82b22069dafb5938..efae39889dcd793bfedd20df933809a80a4ab90f 100644 (file)
--- a/source3/smbd/ipc.c
+++ b/source3/smbd/ipc.c
@@ -52,8 +52,6 @@ extern fstring myworkgroup;
 #define ERROR_INVALID_LEVEL 124
 #define ERROR_MORE_DATA 234
 
-#define REALLOC(ptr,size) Realloc(ptr,MAX((size),4*1024))
-
 #define ACCESS_READ 0x01
 #define ACCESS_WRITE 0x02
 #define ACCESS_CREATE 0x04