s4-sam: don't look in GC NCs for user accounts
authorAndrew Tridgell <tridge@samba.org>
Thu, 29 Sep 2011 07:43:25 +0000 (17:43 +1000)
committerAndrew Tridgell <tridge@samba.org>
Tue, 4 Oct 2011 04:08:57 +0000 (15:08 +1100)
We need to exclude GC partial replica naming contexts from SAM lookups

Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>

source4/auth/sam.c

index 24a40fc..767e44c 100644 (file)
@@ -493,7 +493,9 @@ NTSTATUS sam_get_results_principal(struct ldb_context *sam_ctx,
        
        /* pull the user attributes */
        ret = dsdb_search_one(sam_ctx, tmp_ctx, msg, user_dn,
-                             LDB_SCOPE_BASE, attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
+                             LDB_SCOPE_BASE, attrs,
+                             DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                             "(objectClass=*)");
        if (ret != LDB_SUCCESS) {
                talloc_free(tmp_ctx);
                return NT_STATUS_INTERNAL_DB_CORRUPTION;
@@ -540,7 +542,9 @@ NTSTATUS authsam_get_user_info_dc_principal(TALLOC_CTX *mem_ctx,
                int ret;
                /* pull the user attributes */
                ret = dsdb_search_one(sam_ctx, tmp_ctx, &msg, user_dn,
-                                     LDB_SCOPE_BASE, user_attrs, DSDB_SEARCH_SHOW_EXTENDED_DN, "(objectClass=*)");
+                                     LDB_SCOPE_BASE, user_attrs,
+                                     DSDB_SEARCH_SHOW_EXTENDED_DN | DSDB_SEARCH_NO_GLOBAL_CATALOG,
+                                     "(objectClass=*)");
                if (ret == LDB_ERR_NO_SUCH_OBJECT) {
                        talloc_free(tmp_ctx);
                        return NT_STATUS_NO_SUCH_USER;