s4:samr: allow builtin groups for samr_OpenGroup.

This fixes nsswitch getgrgid for builtins.

Signed-off-by: Michael Adam <obnox@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c
index 3e58a44fb82d2f797e2239b11ea7cd075c0bf1a6..eacbe7da7b46797a03ae013268a99c03e5e8aed9 100644 (file)
--- a/source4/rpc_server/samr/dcesrv_samr.c
+++ b/source4/rpc_server/samr/dcesrv_samr.c
@@ -1746,13 +1746,22 @@ static NTSTATUS dcesrv_samr_OpenGroup(struct dcesrv_call_state *dce_call, TALLOC
        }
 
        /* search for the group record */
-       ret = gendb_search(d_state->sam_ctx,
-                          mem_ctx, d_state->domain_dn, &msgs, attrs,
-                          "(&(objectSid=%s)(objectClass=group)"
-                          "(|(groupType=%d)(groupType=%d)))",
-                          ldap_encode_ndr_dom_sid(mem_ctx, sid),
-                          GTYPE_SECURITY_UNIVERSAL_GROUP,
-                          GTYPE_SECURITY_GLOBAL_GROUP);
+       if (d_state->builtin) {
+               ret = gendb_search(d_state->sam_ctx,
+                                  mem_ctx, d_state->domain_dn, &msgs, attrs,
+                                  "(&(objectSid=%s)(objectClass=group)"
+                                  "(groupType=%d))",
+                                  ldap_encode_ndr_dom_sid(mem_ctx, sid),
+                                  GTYPE_SECURITY_BUILTIN_LOCAL_GROUP);
+       } else {
+               ret = gendb_search(d_state->sam_ctx,
+                                  mem_ctx, d_state->domain_dn, &msgs, attrs,
+                                  "(&(objectSid=%s)(objectClass=group)"
+                                  "(|(groupType=%d)(groupType=%d)))",
+                                  ldap_encode_ndr_dom_sid(mem_ctx, sid),
+                                  GTYPE_SECURITY_UNIVERSAL_GROUP,
+                                  GTYPE_SECURITY_GLOBAL_GROUP);
+       }
        if (ret == 0) {
                return NT_STATUS_NO_SUCH_GROUP;
        }