From 751367cd1d71f50751086c776f02583efd929e02 Mon Sep 17 00:00:00 2001
From: Gerald Carter <jerry@samba.org>
Date: Fri, 20 Jun 2003 12:58:09 +0000
Subject: [PATCH] fix for CR 2230; don't throw away domain local groups

---
 source/lib/username.c       | 25 ++++++++++++++++++++-----
 source/nsswitch/wb_client.c |  4 ++--
 2 files changed, 22 insertions(+), 7 deletions(-)

diff --git a/source/lib/username.c b/source/lib/username.c
index 376440b070b..4f7560e4fa6 100644
--- a/source/lib/username.c
+++ b/source/lib/username.c
@@ -357,9 +357,16 @@ static BOOL user_in_winbind_group_list(char *user,char *gname, BOOL *winbind_ans
 		fstrcpy( last_user, user );
 		
 	}
-	else
+	else 
 		DEBUG(10,("user_in_winbind_group_list: using cached user groups for [%s]\n", user));
  
+ 	if ( DEBUGLEVEL >= 10 ) {
+		DEBUG(10,("user_in_winbind_group_list: using groups -- "));
+	 	for ( i=0; i<num_groups; i++ )
+			DEBUGADD(10,("%d ", groups[i]));
+		DEBUGADD(10,("\n"));	
+	}
+	
  	/*
  	 * Now we have the gid list for this user - convert the gname
  	 * to a gid_t via either winbind or the local UNIX lookup and do the comparison.
@@ -370,6 +377,8 @@ static BOOL user_in_winbind_group_list(char *user,char *gname, BOOL *winbind_ans
  			gname ));
  		goto err;
  	}
+
+	DEBUG(10, ("user_in_winbind_group_list: group %s [%d]\n", gname, gid ));
  
  	for (i = 0; i < num_groups; i++) {
  		if (gid == groups[i]) {
@@ -545,7 +554,9 @@ BOOL user_in_list(char *user,char *list)
 			BOOL ret;
  
 			/* Check to see if name is a Windows group */
-			if (winbind_lookup_name(NULL, tok, &g_sid, &name_type) && name_type == SID_NAME_DOM_GRP) {
+			if (winbind_lookup_name(NULL, tok, &g_sid, &name_type) 
+				&& ( name_type==SID_NAME_DOM_GRP || name_type==SID_NAME_ALIAS ) )
+			{
  
 				/* Check if user name is in the Windows group */
 				ret = user_in_winbind_group_list(user, tok, &winbind_answered);
@@ -658,9 +669,13 @@ BOOL user_in_plist(char *user, char **the_list)
 			BOOL winbind_answered = False;
 			BOOL ret;
  
-			/* Check to see if name is a Windows group */
-			if (winbind_lookup_name(NULL, *list, &g_sid, &name_type) && name_type == SID_NAME_DOM_GRP) {
- 
+			/* Check to see if name is a Windows group;  Win2k native mode DCs
+			   will return domain local groups; while NT4 or mixed mode 2k DCs
+			   will not */
+			
+			if ( winbind_lookup_name(NULL, *list, &g_sid, &name_type) 
+				&& ( name_type==SID_NAME_DOM_GRP || name_type==SID_NAME_ALIAS ) )
+			{
 				/* Check if user name is in the Windows group */
 				ret = user_in_winbind_group_list(user, *list, &winbind_answered);
  
diff --git a/source/nsswitch/wb_client.c b/source/nsswitch/wb_client.c
index 372a329b849..0d52abc1aa2 100644
--- a/source/nsswitch/wb_client.c
+++ b/source/nsswitch/wb_client.c
@@ -446,7 +446,7 @@ BOOL winbind_gidtoname(fstring name, gid_t gid)
 	if (!winbind_lookup_sid(&sid, dom_name, group_name, &name_type))
 		return False;
 
-	if (name_type != SID_NAME_DOM_GRP)
+	if (name_type != SID_NAME_DOM_GRP && name_type != SID_NAME_ALIAS )
 		return False;
 
 	slprintf(name, sizeof(fstring)-1, "%s%s%s", dom_name, 
@@ -481,7 +481,7 @@ BOOL winbind_nametogid(gid_t *pgid, const char *gname)
 	if (!winbind_lookup_name(NULL, gname, &g_sid, &name_type))
                 return False;
 
-	if (name_type != SID_NAME_DOM_GRP)
+	if (name_type != SID_NAME_DOM_GRP && name_type != SID_NAME_ALIAS )
 		return False;
 
 	return winbind_sid_to_gid(pgid, &g_sid);
-- 
2.11.4.GIT