Commit the translation of the realm to the netbios domain name in the kerberos

session setup. After talking to jht and abartlet I made this unconditional, no
additional parameter.

Jerry: This is a change in behaviour, but I think it is necessary.

Volker

diff --git a/source/nsswitch/wbinfo.c b/source/nsswitch/wbinfo.c
index 04233bb85cb5db9eb22c01228f135b81d859d90a..bca1813167b979312bada9f562e8d01fb15cc2b2 100644 (file)
--- a/source/nsswitch/wbinfo.c
+++ b/source/nsswitch/wbinfo.c
@@ -247,6 +247,42 @@ static BOOL wbinfo_show_sequence(const char *domain)
        return True;
 }
 
+/* Show domain info */
+
+static BOOL wbinfo_domain_info(const char *domain_name)
+{
+       struct winbindd_request request;
+       struct winbindd_response response;
+
+       ZERO_STRUCT(request);
+       ZERO_STRUCT(response);
+
+       fstrcpy(request.domain_name, domain_name);
+
+       /* Send request */
+
+       if (winbindd_request(WINBINDD_DOMAIN_INFO, &request, &response) !=
+           NSS_STATUS_SUCCESS)
+               return False;
+
+       /* Display response */
+
+       d_printf("Name    : %s\n", response.data.domain_info.name);
+       d_printf("Alt_Name: %s\n", response.data.domain_info.alt_name);
+
+       d_printf("SID     : %s\n", response.data.domain_info.sid);
+
+       d_printf("Native  : %s\n",
+                response.data.domain_info.native_mode ? "Yes" : "No");
+
+       d_printf("Primary : %s\n",
+                response.data.domain_info.primary ? "Yes" : "No");
+
+       d_printf("Sequence: %d\n", response.data.domain_info.sequence_number);
+
+       return True;
+}
+
 /* Check trust account password */
 
 static BOOL wbinfo_check_secret(void)
@@ -922,6 +958,8 @@ int main(int argc, char **argv)
                { "check-secret", 't', POPT_ARG_NONE, 0, 't', "Check shared secret" },
                { "trusted-domains", 'm', POPT_ARG_NONE, 0, 'm', "List trusted domains" },
                { "sequence", 0, POPT_ARG_NONE, 0, OPT_SEQUENCE, "Show sequence numbers of all domains" },
+               { "domain-info", 'D', POPT_ARG_STRING, &string_arg, 'D',
+                 "Show all most info we have about the domain" },
                { "user-groups", 'r', POPT_ARG_STRING, &string_arg, 'r', "Get user groups", "USER" },
                { "authenticate", 'a', POPT_ARG_STRING, &string_arg, 'a', "authenticate user", "user%password" },
                { "set-auth-user", 0, POPT_ARG_STRING, &string_arg, OPT_SET_AUTH_USER, "Store user and password used by winbindd (root only)", "user%password" },
@@ -1048,6 +1086,12 @@ int main(int argc, char **argv)
                                goto done;
                        }
                        break;
+               case 'D':
+                       if (!wbinfo_domain_info(string_arg)) {
+                               d_printf("Could not get domain info\n");
+                               goto done;
+                       }
+                       break;
                case 'r':
                        if (!wbinfo_get_usergroups(string_arg)) {
                                d_printf("Could not get groups for user %s\n", 

diff --git a/source/nsswitch/winbindd.c b/source/nsswitch/winbindd.c
index 4b47ac13a2f3cbe3d149999ec636ba680078f57f..b1c0c67d52b1235f45ea1bbf04e7fb284517f117 100644 (file)
--- a/source/nsswitch/winbindd.c
+++ b/source/nsswitch/winbindd.c
@@ -262,6 +262,7 @@ static struct dispatch_table dispatch_table[] = {
        { WINBINDD_INFO, winbindd_info, "INFO" },
        { WINBINDD_INTERFACE_VERSION, winbindd_interface_version, "INTERFACE_VERSION" },
        { WINBINDD_DOMAIN_NAME, winbindd_domain_name, "DOMAIN_NAME" },
+       { WINBINDD_DOMAIN_INFO, winbindd_domain_info, "DOMAIN_INFO" },
        { WINBINDD_NETBIOS_NAME, winbindd_netbios_name, "NETBIOS_NAME" },
        { WINBINDD_PRIV_PIPE_DIR, winbindd_priv_pipe_dir, "WINBINDD_PRIV_PIPE_DIR" },
 

diff --git a/source/nsswitch/winbindd_misc.c b/source/nsswitch/winbindd_misc.c
index 88fbb5ee0065d088e4216944d9345ae4390ddc6f..1a5ecb56c7c364f74dd492a7b630f1fa4f5b27a8 100644 (file)
--- a/source/nsswitch/winbindd_misc.c
+++ b/source/nsswitch/winbindd_misc.c
@@ -202,6 +202,35 @@ enum winbindd_result winbindd_show_sequence(struct winbindd_cli_state *state)
        return WINBINDD_OK;
 }
 
+enum winbindd_result winbindd_domain_info(struct winbindd_cli_state *state)
+{
+       struct winbindd_domain *domain;
+
+       DEBUG(3, ("[%5lu]: domain_info [%s]\n", (unsigned long)state->pid,
+                 state->request.domain_name));
+
+       domain = find_domain_from_name(state->request.domain_name);
+
+       if (domain == NULL) {
+               DEBUG(3, ("Did not find domain [%s]\n",
+                         state->request.domain_name));
+               return WINBINDD_ERROR;
+       }
+
+       fstrcpy(state->response.data.domain_info.name, domain->name);
+       fstrcpy(state->response.data.domain_info.alt_name, domain->alt_name);
+       fstrcpy(state->response.data.domain_info.sid,
+               sid_string_static(&domain->sid));
+       
+       state->response.data.domain_info.native_mode = domain->native_mode;
+       state->response.data.domain_info.primary = domain->primary;
+
+       state->response.data.domain_info.sequence_number =
+               domain->sequence_number;
+
+       return WINBINDD_OK;
+}
+
 enum winbindd_result winbindd_ping(struct winbindd_cli_state
                                                   *state)
 {

diff --git a/source/nsswitch/winbindd_nss.h b/source/nsswitch/winbindd_nss.h
index 41fecd2816cf8d6d715e1fb73beed2be77ab96ff..00d49e7d3eaca61dbf6cdf0096f36968cb3096d9 100644 (file)
--- a/source/nsswitch/winbindd_nss.h
+++ b/source/nsswitch/winbindd_nss.h
@@ -92,6 +92,9 @@ enum winbindd_cmd {
        WINBINDD_INFO,              /* Various bit of info.  Currently just tidbits */
        WINBINDD_DOMAIN_NAME,       /* The domain this winbind server is a member of (lp_workgroup()) */
 
+       WINBINDD_DOMAIN_INFO,   /* Most of what we know from
+                                  struct winbindd_domain */
+
        WINBINDD_SHOW_SEQUENCE, /* display sequence numbers of domains */
 
        /* WINS commands */
@@ -260,6 +263,14 @@ struct winbindd_response {
                        char first_8_lm_hash[8];
                } auth;
                uint32 rid;     /* create user or group */
+               struct {
+                       fstring name;
+                       fstring alt_name;
+                       fstring sid;
+                       BOOL native_mode;
+                       BOOL primary;
+                       uint32 sequence_number;
+               } domain_info;
        } data;
 
        /* Variable length return data */

diff --git a/source/smbd/sesssetup.c b/source/smbd/sesssetup.c
index e9cfa47d0c635692c4db2bbef161cc5474ae51df..2c38cd3eb3a93670add53310327a98506d58808f 100644 (file)
--- a/source/smbd/sesssetup.c
+++ b/source/smbd/sesssetup.c
@@ -141,7 +141,8 @@ static int reply_spnego_kerberos(connection_struct *conn,
                                 DATA_BLOB *secblob)
 {
        DATA_BLOB ticket;
-       char *client, *p;
+       char *client, *p, *domain;
+       fstring netbios_domain_name;
        const struct passwd *pw;
        char *user;
        int sess_vuid;
@@ -198,8 +199,45 @@ static int reply_spnego_kerberos(connection_struct *conn,
 
        /* this gives a fully qualified user name (ie. with full realm).
           that leads to very long usernames, but what else can we do? */
-          
-       asprintf(&user, "%s%c%s", p+1, *lp_winbind_separator(), client);
+
+       domain = p+1;
+
+       {
+               /* If we have winbind running, we can (and must) shorten the
+                  username by using the short netbios name. Otherwise we will
+                  have inconsistent user names. With Kerberos, we get the
+                  fully qualified realm, with ntlmssp we get the short
+                  name. And even w2k3 does use ntlmssp if you for example
+                  connect to an ip address. */
+
+               struct winbindd_request wb_request;
+               struct winbindd_response wb_response;
+               NSS_STATUS wb_result;
+
+               ZERO_STRUCT(wb_request);
+               ZERO_STRUCT(wb_response);
+
+               DEBUG(10, ("Mapping [%s] to short name\n", domain));
+
+               fstrcpy(wb_request.domain_name, domain);
+
+               wb_result = winbindd_request(WINBINDD_DOMAIN_INFO,
+                                            &wb_request, &wb_response);
+
+               if (wb_result == NSS_STATUS_SUCCESS) {
+
+                       fstrcpy(netbios_domain_name,
+                               wb_response.data.domain_info.name);
+                       domain = netbios_domain_name;
+
+                       DEBUG(10, ("Mapped to [%s]\n", domain));
+               } else {
+                       DEBUG(3, ("Could not find short name -- winbind "
+                                 "not running?\n"));
+               }
+       }
+
+       asprintf(&user, "%s%c%s", domain, *lp_winbind_separator(), client);
        
        pw = smb_getpwnam( user );