winbindd: do not modify credentials in NTLM passthrough

[kai/samba-autobuild/.git] / source3 / winbindd / winbindd_pam_auth_crap.c

diff --git a/source3/winbindd/winbindd_pam_auth_crap.c b/source3/winbindd/winbindd_pam_auth_crap.c
index 2fb5111510c78bd8c82913fe084662ee7afa9dc6..e6a47c867857b739477dbce5a2237f7bdaf2724f 100644 (file)
--- a/source3/winbindd/winbindd_pam_auth_crap.c
+++ b/source3/winbindd/winbindd_pam_auth_crap.c
@@ -22,6 +22,8 @@
 
 struct winbindd_pam_auth_crap_state {
        struct winbindd_response *response;
+       struct netr_SamInfo3 *info3;
+       uint32_t flags;
 };
 
 static void winbindd_pam_auth_crap_done(struct tevent_req *subreq);
@@ -35,6 +37,7 @@ struct tevent_req *winbindd_pam_auth_crap_send(
        struct tevent_req *req, *subreq;
        struct winbindd_pam_auth_crap_state *state;
        struct winbindd_domain *domain;
+       const char *auth_domain = NULL;
 
        req = tevent_req_create(mem_ctx, &state,
                                struct winbindd_pam_auth_crap_state);
@@ -42,6 +45,21 @@ struct tevent_req *winbindd_pam_auth_crap_send(
                return NULL;
        }
 
+       if (request->flags & WBFLAG_PAM_AUTH_PAC) {
+               NTSTATUS status;
+
+               state->flags = request->flags;
+               status = winbindd_pam_auth_pac_send(cli, &state->info3);
+               if (NT_STATUS_IS_OK(status)) {
+                       /* Defer filling out response to recv */
+                       tevent_req_done(req);
+               } else {
+                       tevent_req_nterror(req, status);
+               }
+
+               return tevent_req_post(req, ev);
+       }
+
        /* Ensure null termination */
        request->data.auth_crap.user[
                sizeof(request->data.auth_crap.user)-1] = '\0';
@@ -60,14 +78,12 @@ struct tevent_req *winbindd_pam_auth_crap_send(
                return tevent_req_post(req, ev);
        }
 
-       if ((request->data.auth_crap.domain[0] == '\0')
-           && lp_winbind_use_default_domain()) {
-               fstrcpy(request->data.auth_crap.domain,
-                       lp_workgroup());
+       auth_domain = request->data.auth_crap.domain;
+       if (auth_domain[0] == '\0') {
+               auth_domain = lp_workgroup();
        }
 
-       domain = find_auth_domain(
-               request->flags, request->data.auth_crap.domain);
+       domain = find_auth_domain(request->flags, auth_domain);
        if (domain == NULL) {
                tevent_req_nterror(req, NT_STATUS_NO_SUCH_USER);
                return tevent_req_post(req, ev);
@@ -114,6 +130,12 @@ NTSTATUS winbindd_pam_auth_crap_recv(struct tevent_req *req,
                set_auth_errors(response, status);
                return status;
        }
+
+       if (state->flags & WBFLAG_PAM_AUTH_PAC) {
+               return append_auth_data(response, response, state->flags,
+                                       state->info3, NULL, NULL);
+       }
+
        *response = *state->response;
        response->result = WINBINDD_PENDING;
        state->response = talloc_move(response, &state->response);