From 532a14dc684e7a6d8c584d5671a4ebbad00aa4fc Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Thu, 22 Feb 2018 10:40:19 +0100 Subject: [PATCH] winbind: let cm_connect_netlogon_transport() only work against direct trust as AD DC BUG: https://bugzilla.samba.org/show_bug.cgi?id=13278 Signed-off-by: Stefan Metzmacher Reviewed-by: Ralph Boehme --- source3/winbindd/winbindd_cm.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/source3/winbindd/winbindd_cm.c b/source3/winbindd/winbindd_cm.c index b6a54d0a12b..a88e05cac23 100644 --- a/source3/winbindd/winbindd_cm.c +++ b/source3/winbindd/winbindd_cm.c @@ -3212,6 +3212,17 @@ static NTSTATUS cm_connect_netlogon_transport(struct winbindd_domain *domain, *cli = NULL; + if (IS_AD_DC) { + if (domain->secure_channel_type == SEC_CHAN_NULL) { + /* + * Make sure we don't even try to + * connect to a foreign domain + * without a direct outbound trust. + */ + return NT_STATUS_NO_TRUST_LSA_SECRET; + } + } + result = init_dc_connection_rpc(domain, domain->rodc); if (!NT_STATUS_IS_OK(result)) { return result; -- 2.11.4.GIT