From f62683956a3b182f6a61cc7a2b4ada2e74cde243 Mon Sep 17 00:00:00 2001 From: Noel Power Date: Wed, 16 Oct 2013 16:30:55 +0100 Subject: [PATCH] fail authentication for single group name which cannot be converted to sid furthermore if more than one name is supplied and no sid is converted then also fail. Bug: https://bugzilla.samba.org/show_bug.cgi?id=10300 Signed-off-by: Noel Power Reviewed-by: Andreas Schneider Reviewed-by: David Disseldorp [ddiss@samba.org: fixed incorrect bugzilla tag I added to master commit] --- nsswitch/pam_winbind.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/nsswitch/pam_winbind.c b/nsswitch/pam_winbind.c index 9322971..cd5e7ba 100644 --- a/nsswitch/pam_winbind.c +++ b/nsswitch/pam_winbind.c @@ -1172,6 +1172,12 @@ static bool winbind_name_list_to_sid_string_list(struct pwb_context *ctx, _make_remark_format(ctx, PAM_TEXT_INFO, _("Cannot convert group %s " "to sid, please contact your administrator to see " "if group %s is valid."), search_location, search_location); + + /* If no valid groups were converted we should fail outright */ + if (name_list != NULL && strlen(sid_list_buffer) == 0) { + result = false; + goto out; + } /* * The lookup of the last name failed.. * It results in require_member_of_sid ends with ',' -- 1.8.1.4