pgreco / rpms / ipa

Forked from forks/areguera/rpms/ipa 4 years ago
Clone

Blame SOURCES/0068-ipa-sam-create-the-gidNumber-attribute-in-the-truste.patch

ac7d03
From 376a1fbfe97624116d8fb10f26d97ef15fd3b917 Mon Sep 17 00:00:00 2001
ac7d03
From: Florence Blanc-Renaud <flo@redhat.com>
ac7d03
Date: Tue, 21 Mar 2017 17:33:20 +0100
ac7d03
Subject: [PATCH] ipa-sam: create the gidNumber attribute in the trusted domain
ac7d03
 entry
ac7d03
ac7d03
When a trusted domain entry is created, the uidNumber attribute is created
ac7d03
but not the gidNumber attribute. This causes samba to log
ac7d03
	Failed to find a Unix account for DOM-AD$
ac7d03
because the samu structure does not contain a group_sid and is not put
ac7d03
in the cache.
ac7d03
The fix creates the gidNumber attribute in the trusted domain entry,
ac7d03
and initialises the group_sid field in the samu structure returned
ac7d03
by ldapsam_getsampwnam. This ensures that the entry is put in the cache.
ac7d03
ac7d03
Note that this is only a partial fix for 6660 as it does not prevent
ac7d03
_netr_ServerAuthenticate3 from failing with the log
ac7d03
	_netr_ServerAuthenticate3: netlogon_creds_server_check failed. Rejecting auth request from client VM-AD machine account dom-ad.example.com.
ac7d03
ac7d03
https://pagure.io/freeipa/issue/6827
ac7d03
ac7d03
Reviewed-By: Alexander Bokovoy <abokovoy@redhat.com>
ac7d03
---
ac7d03
 daemons/ipa-sam/ipa_sam.c | 40 +++++++++++++++++++++++++++++++++++++---
ac7d03
 1 file changed, 37 insertions(+), 3 deletions(-)
ac7d03
ac7d03
diff --git a/daemons/ipa-sam/ipa_sam.c b/daemons/ipa-sam/ipa_sam.c
ac7d03
index 4c1fda5f82b43f69929613f9938410b32cff31e7..6a29e8e10b4299356b9ead76276eecc8083791a3 100644
ac7d03
--- a/daemons/ipa-sam/ipa_sam.c
ac7d03
+++ b/daemons/ipa-sam/ipa_sam.c
ac7d03
@@ -195,6 +195,7 @@ struct ipasam_privates {
ac7d03
 	char *trust_dn;
ac7d03
 	char *flat_name;
ac7d03
 	struct dom_sid fallback_primary_group;
ac7d03
+	char *fallback_primary_group_gid_str;
ac7d03
 	char *server_princ;
ac7d03
 	char *client_princ;
ac7d03
 	struct sss_idmap_ctx *idmap_ctx;
ac7d03
@@ -2419,6 +2420,9 @@ static NTSTATUS ipasam_set_trusted_domain(struct pdb_methods *methods,
ac7d03
 	if (entry == NULL || sid == NULL) {
ac7d03
 		smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
ac7d03
 				 LDAP_ATTRIBUTE_UIDNUMBER, IPA_MAGIC_ID_STR);
ac7d03
+		smbldap_make_mod(priv2ld(ldap_state), entry, &mods,
ac7d03
+		                 LDAP_ATTRIBUTE_GIDNUMBER,
ac7d03
+				 ldap_state->ipasam_privates->fallback_primary_group_gid_str);
ac7d03
 	}
ac7d03
 
ac7d03
 	if (td->netbios_name != NULL) {
ac7d03
@@ -2829,6 +2833,7 @@ static bool init_sam_from_td(struct samu *user, struct pdb_trusted_domain *td,
ac7d03
 {
ac7d03
 	NTSTATUS status;
ac7d03
 	struct dom_sid *u_sid;
ac7d03
+	struct dom_sid *g_sid;
ac7d03
 	char *name;
ac7d03
 	char *trustpw = NULL;
ac7d03
 	char *trustpw_utf8 = NULL;
ac7d03
@@ -2884,6 +2889,11 @@ static bool init_sam_from_td(struct samu *user, struct pdb_trusted_domain *td,
ac7d03
 	}
ac7d03
 	talloc_free(u_sid);
ac7d03
 
ac7d03
+	g_sid = &ldap_state->ipasam_privates->fallback_primary_group;
ac7d03
+	if (!pdb_set_group_sid(user, g_sid, PDB_SET)) {
ac7d03
+		return false;
ac7d03
+	}
ac7d03
+
ac7d03
 	status = get_trust_pwd(user, &td->trust_auth_incoming, &trustpw, NULL);
ac7d03
 	if (!NT_STATUS_IS_OK(status)) {
ac7d03
 		return false;
ac7d03
@@ -3594,14 +3604,17 @@ static void ipasam_free_private_data(void **vp)
ac7d03
 static struct dom_sid *get_fallback_group_sid(TALLOC_CTX *mem_ctx,
ac7d03
 					      struct smbldap_state *ldap_state,
ac7d03
 					      struct sss_idmap_ctx *idmap_ctx,
ac7d03
-					      LDAPMessage *dom_entry)
ac7d03
+					      LDAPMessage *dom_entry,
ac7d03
+					      char **fallback_group_gid_str)
ac7d03
 {
ac7d03
 	char *dn;
ac7d03
 	char *sid;
ac7d03
+	char *gidnumber;
ac7d03
 	int ret;
ac7d03
 	const char *filter = "objectClass=*";
ac7d03
 	const char *attr_list[] = {
ac7d03
 					LDAP_ATTRIBUTE_SID,
ac7d03
+					LDAP_ATTRIBUTE_GIDNUMBER,
ac7d03
 					NULL};
ac7d03
 	LDAPMessage *result;
ac7d03
 	LDAPMessage *entry;
ac7d03
@@ -3648,9 +3661,20 @@ static struct dom_sid *get_fallback_group_sid(TALLOC_CTX *mem_ctx,
ac7d03
 		talloc_free(sid);
ac7d03
 		return NULL;
ac7d03
 	}
ac7d03
+	talloc_free(sid);
ac7d03
+
ac7d03
+	gidnumber = get_single_attribute(mem_ctx, ldap_state->ldap_struct,
ac7d03
+					entry, LDAP_ATTRIBUTE_GIDNUMBER);
ac7d03
+	if (gidnumber == NULL) {
ac7d03
+		DEBUG(0, ("Missing mandatory attribute %s.\n",
ac7d03
+			  LDAP_ATTRIBUTE_GIDNUMBER));
ac7d03
+		ldap_msgfree(result);
ac7d03
+		return NULL;
ac7d03
+	}
ac7d03
+
ac7d03
+	*fallback_group_gid_str = gidnumber;
ac7d03
 
ac7d03
 	ldap_msgfree(result);
ac7d03
-	talloc_free(sid);
ac7d03
 
ac7d03
 	return fallback_group_sid;
ac7d03
 }
ac7d03
@@ -4443,6 +4467,7 @@ static NTSTATUS pdb_init_ipasam(struct pdb_methods **pdb_method,
ac7d03
 	char *domain_sid_string = NULL;
ac7d03
 	struct dom_sid *ldap_domain_sid = NULL;
ac7d03
 	struct dom_sid *fallback_group_sid = NULL;
ac7d03
+	char *fallback_group_gid_str = NULL;
ac7d03
 
ac7d03
 	LDAPMessage *result = NULL;
ac7d03
 	LDAPMessage *entry = NULL;
ac7d03
@@ -4586,7 +4611,8 @@ static NTSTATUS pdb_init_ipasam(struct pdb_methods **pdb_method,
ac7d03
 	fallback_group_sid = get_fallback_group_sid(ldap_state,
ac7d03
 					ldap_state->smbldap_state,
ac7d03
 					ldap_state->ipasam_privates->idmap_ctx,
ac7d03
-					result);
ac7d03
+					result,
ac7d03
+					&fallback_group_gid_str);
ac7d03
 	if (fallback_group_sid == NULL) {
ac7d03
 		DEBUG(0, ("Cannot find SID of fallback group.\n"));
ac7d03
 		ldap_msgfree(result);
ac7d03
@@ -4596,6 +4622,14 @@ static NTSTATUS pdb_init_ipasam(struct pdb_methods **pdb_method,
ac7d03
 		 fallback_group_sid);
ac7d03
 	talloc_free(fallback_group_sid);
ac7d03
 
ac7d03
+	if (fallback_group_gid_str == NULL) {
ac7d03
+		DEBUG(0, ("Cannot find gidNumber of fallback group.\n"));
ac7d03
+		ldap_msgfree(result);
ac7d03
+		return NT_STATUS_INVALID_PARAMETER;
ac7d03
+	}
ac7d03
+	ldap_state->ipasam_privates->fallback_primary_group_gid_str =
ac7d03
+		fallback_group_gid_str;
ac7d03
+
ac7d03
 	domain_sid_string = get_single_attribute(
ac7d03
 				ldap_state,
ac7d03
 				ldap_state->smbldap_state->ldap_struct,
ac7d03
-- 
ac7d03
2.9.3
ac7d03