From f092d689c577293d011912be5ded5ebf8aa49fc9 Mon Sep 17 00:00:00 2001
From: =?utf8?q?G=C3=BCnther=20Deschner?= <gd@samba.org>
Date: Wed, 24 Jun 2009 00:33:44 +0200
Subject: [PATCH] s3-pdb_ldap: Fix bug #4296: Clean up group membership while
 deleting a user.

Note that this only is tried with editposix=yes.

Guenther
---
 source3/passdb/pdb_ldap.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)

diff --git a/source3/passdb/pdb_ldap.c b/source3/passdb/pdb_ldap.c
index fc736c2e3eb..2c8d0518d55 100644
--- a/source3/passdb/pdb_ldap.c
+++ b/source3/passdb/pdb_ldap.c
@@ -1986,6 +1986,18 @@ static NTSTATUS ldapsam_update_sam_account(struct pdb_methods *my_methods, struc
  - The "rename user script" has full responsibility for changing everything
 ***************************************************************************/
 
+static NTSTATUS ldapsam_del_groupmem(struct pdb_methods *my_methods,
+				     TALLOC_CTX *tmp_ctx,
+				     uint32 group_rid,
+				     uint32 member_rid);
+
+static NTSTATUS ldapsam_enum_group_memberships(struct pdb_methods *methods,
+					       TALLOC_CTX *mem_ctx,
+					       struct samu *user,
+					       DOM_SID **pp_sids,
+					       gid_t **pp_gids,
+					       size_t *p_num_groups);
+
 static NTSTATUS ldapsam_rename_sam_account(struct pdb_methods *my_methods,
 					   struct samu *old_acct,
 					   const char *newname)
@@ -5255,6 +5267,40 @@ static NTSTATUS ldapsam_delete_user(struct pdb_methods *my_methods, TALLOC_CTX *
 		return NT_STATUS_NO_MEMORY;
 	}
 
+	/* try to remove memberships first */
+	{
+		NTSTATUS status;
+		struct dom_sid *sids = NULL;
+		gid_t *gids = NULL;
+		size_t num_groups = 0;
+		int i;
+		uint32_t user_rid = pdb_get_user_rid(sam_acct);
+
+		status = ldapsam_enum_group_memberships(my_methods,
+							tmp_ctx,
+							sam_acct,
+							&sids,
+							&gids,
+							&num_groups);
+		if (!NT_STATUS_IS_OK(status)) {
+			goto delete_dn;
+		}
+
+		for (i=0; i < num_groups; i++) {
+
+			uint32_t group_rid;
+
+			sid_peek_rid(&sids[i], &group_rid);
+
+			ldapsam_del_groupmem(my_methods,
+					     tmp_ctx,
+					     group_rid,
+					     user_rid);
+		}
+	}
+
+ delete_dn:
+
 	rc = smbldap_delete(ldap_state->smbldap_state, dn);
 	if (rc != LDAP_SUCCESS) {
 		return NT_STATUS_UNSUCCESSFUL;
-- 
2.11.4.GIT