svn commit: samba r11242 - branches/SAMBA_3_0/source/include branches/SAMBA_3_0/source/nsswitch trunk/source/include trunk/source/nsswitch

[gd at samba.org]

Author: gd
Date: 2005-10-21 12:50:39 +0000 (Fri, 21 Oct 2005)
New Revision: 11242

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=11242

Log:
use LDAP bitwise machting rule when searching for groups in ADS.

This avoids that each time a full-group-dump is requested from ADS; the
bitwise match allows to only query those groups we are interested in.

The ADS LDAP server changed to RFC compliant behaviour when decoding the ldap
filter with extensible match in the latest SPs (fixes). From the patch:

/* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o
  * rollup-fixes:
  *
  * According to Section 5.1(4) of RFC 2251 if a value of a type is it's
  * default value, it MUST be absent. In case of extensible matching the
  * "dnattr" boolean defaults to FALSE and so it must be only be present
  * when set to TRUE.
  *
  * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a
  * filter using bitwise matching rule then a buggy AD fails to decode
  * the extensible match. As a workaround set it to TRUE and thereby add
  * the dnAttributes "dn" field to cope with those older AD versions.
  * It should not harm and won't put any additional load on the AD since
  * none of the dn components have a bitmask-attribute.
  *
  * Thanks to Ralf Haferkamp for input and testing */

Guenther


Modified:
   branches/SAMBA_3_0/source/include/ads.h
   branches/SAMBA_3_0/source/nsswitch/winbindd_ads.c
   trunk/source/include/ads.h
   trunk/source/nsswitch/winbindd_ads.c


Changeset:
Sorry, the patch is too large (295 lines) to include; please use WebSVN to see it!
WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=11242