rpc/samr: Fix PSO support in SAMR password_change RPC

To get the SAMR password_lockout test passing, we now just need to query
the msDS-ResultantPSO attribute for the user in the SAMR code. The
common code will then determine that a PSO applies to the user, and use
the PSO's lockout settings.

Signed-off-by: Tim Beale <timbeale@catalyst.net.nz>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>

diff --git a/selftest/knownfail.d/password_lockout b/selftest/knownfail.d/password_lockout
index eebab10c86b46a1ffd3a568d5549ae72f101373f..58f047f8aef5f70666090b57a28dd405b5b57de4 100644 (file)
--- a/selftest/knownfail.d/password_lockout
+++ b/selftest/knownfail.d/password_lockout
@@ -1,4 +1,3 @@
 samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTests.test_pso_userPassword_lockout_with_clear_change_krb5_ldap_userAccountControl\(ad_dc_ntvfs\)
 samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTests.test_pso_userPassword_lockout_with_clear_change_ntlm_ldap_lockoutTime\(ad_dc_ntvfs\)
 samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTests.test_pso_userPassword_lockout_with_clear_change_ntlm_samr\(ad_dc_ntvfs\)
-samba4.ldap.password_lockout.python\(ad_dc_ntvfs\).__main__.PasswordTests.test_pso_samr_change_password\(ad_dc_ntvfs\)

diff --git a/source4/rpc_server/samr/samr_password.c b/source4/rpc_server/samr/samr_password.c
index d7b5e16e34d6212131fa2ceab85b4ef7097f8a5b..db202cce986b343c021d74ad11e60c2ce80a1c05 100644 (file)
--- a/source4/rpc_server/samr/samr_password.c
+++ b/source4/rpc_server/samr/samr_password.c
@@ -107,6 +107,7 @@ NTSTATUS dcesrv_samr_OemChangePasswordUser2(struct dcesrv_call_state *dce_call,
        struct ldb_message **res;
        const char * const attrs[] = { "objectSid", "dBCSPwd",
                                       "userAccountControl",
+                                      "msDS-ResultantPSO",
                                       "msDS-User-Account-Control-Computed",
                                       "badPwdCount", "badPasswordTime",
                                       "samAccountName",
@@ -301,6 +302,7 @@ NTSTATUS dcesrv_samr_ChangePasswordUser3(struct dcesrv_call_state *dce_call,
        struct ldb_message **res;
        const char * const attrs[] = { "unicodePwd", "dBCSPwd",
                                       "userAccountControl",
+                                      "msDS-ResultantPSO",
                                       "msDS-User-Account-Control-Computed",
                                       "badPwdCount", "badPasswordTime",
                                       "objectSid", NULL };