auth4: reflect the reality and use "winbind_rodc" instead of "winbind" for the auth...
commitae2454c5be4a8314e504e65d46d1caaeff36fb31
authorStefan Metzmacher <metze@samba.org>
Fri, 17 Mar 2017 13:54:16 +0000 (17 14:54 +0100)
committerStefan Metzmacher <metze@samba.org>
Fri, 24 Mar 2017 10:57:10 +0000 (24 11:57 +0100)
treed715432f6a9ccee518301bf33cba6477ec27239a
parent83dd7d033b8dc902f4ba3dbf733c7bfb079900f1
auth4: reflect the reality and use "winbind_rodc" instead of "winbind" for the auth methods as AD_DC

Currently we always map any incoming domain to our own domain
in map_user_info_cracknames(), so that the winbind module is never
used at all, e.g. we're DC of W4EDOM-L4.BASE with a forest trust to W2012R2-L4.BASE:

  [2017/03/22 10:09:54.268472,  3, pid=4724, effective(0, 0), real(0, 0)] ../source4/auth/ntlm/auth.c:271(auth_check_password_send)
    auth_check_password_send: Checking password for unmapped user [W2012R2-L4]\[administrator]@[UB1404-163]
  [2017/03/22 10:09:54.268496,  5, pid=4724, effective(0, 0), real(0, 0)] ../source4/auth/ntlm/auth_util.c:57(map_user_info_cracknames)
    map_user_info_cracknames: Mapping user [W2012R2-L4]\[administrator] from workstation [UB1404-163]
    auth_check_password_send: mapped user is: [W4EDOM-L4]\[administrator]@[UB1404-163]

That means the only condition in which "sam_ignoredomain" returns
NT_STATUS_NOT_IMPLEMENTED is the RODC case.

BUG: https://bugzilla.samba.org/show_bug.cgi?id=2976
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12709

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
source4/auth/ntlm/auth.c