s4:dcesrv_samr_GetGroupsForUser - also universal group memberships are returned here

Tested using User Manager for Domains against Windows Server 2008.
MS-SAMR 3.1.5.9.1 is wrong in this case therefore I've informed the dochelp team.

diff --git a/source4/rpc_server/samr/dcesrv_samr.c b/source4/rpc_server/samr/dcesrv_samr.c
index e222a41d26412049306ae9d9545b299ca9c2212f..4a3f95e68dcd25650c6daa07939413a9b43c6d1a 100644 (file)
--- a/source4/rpc_server/samr/dcesrv_samr.c
+++ b/source4/rpc_server/samr/dcesrv_samr.c
@@ -3564,9 +3564,10 @@ static NTSTATUS dcesrv_samr_GetGroupsForUser(struct dcesrv_call_state *dce_call,
        count = samdb_search_domain(a_state->sam_ctx, mem_ctx,
                                    d_state->domain_dn, &res,
                                    attrs, d_state->domain_sid,
-                                   "(&(member=%s)(grouptype=%d)(objectclass=group))",
+                                   "(&(member=%s)(|(grouptype=%d)(grouptype=%d))(objectclass=group))",
                                    ldb_dn_get_linearized(a_state->account_dn),
-                                   GTYPE_SECURITY_GLOBAL_GROUP);
+                                   GTYPE_SECURITY_GLOBAL_GROUP,
+                                   GTYPE_SECURITY_UNIVERSAL_GROUP);
        if (count < 0)
                return NT_STATUS_INTERNAL_DB_CORRUPTION;