[PATCH 1/2] s3-auth: fix force user for AD user

[Andreas Schneider]

On Monday 06 January 2014 11:37:19 you wrote:
> On Tue, 2013-12-17 at 21:59 +0100, Andreas Schneider wrote:
> > On Wednesday 18 December 2013 09:52:20 Andrew Bartlett wrote:
> > > On Tue, 2013-12-17 at 16:20 +0100, Andreas Schneider wrote:
> > > > On Saturday 14 December 2013 07:37:52 Andrew Bartlett wrote:
> > > > > > Günther and I are working on it. Here is our WIP branch:
> > > > > > 
> > > > > > https://git.samba.org/?p=asn/samba.git;a=shortlog;h=refs/heads/for
> > > > > > ce_u
> > > > > > ser
> > > > > 
> > > > > This looks like a much better approach!
> > > > 
> > > > Hi Andrew,
> > > > 
> > > > here is the proposed patchset:
> > > > 
> > > > https://git.samba.org/?p=asn/samba.git;a=shortlog;h=refs/heads/force_u
> > > > ser
> > > > 
> > > > I will run 'make test' but this should work. Could you please take
> > > > another
> > > > look?
> > > 
> > > The main issue I see is that this new (great!) codepath is called for
> > > users from /etc/passwd, not just users from winbind forced in via force
> > > user.  See the callers in auth_unix.c and user_krb5.c.
> > 
> > Yes, that's correct. We follwed all codepath and checked what is happening
> > and why. In user_krb5.c it is called if the information can't be found in
> > the PAC. So it can be a local user or the information could be retrieved
> > from winbind.
> > 
> > And auth_unix.c is for a unix user. I've tested that and it works if I use
> > a local user for 'force user'.
> > 
> > That's also why me renamed the function cause we just have a passwd struct
> > we convert ...
> 
> Have you tested with a local user and plaintext passwords?

I don't know what you mean with the, smbpasswd plaintext password have been 
removed since quite some time.

> We really
> should have a test environment for that, and for krb5 but without
> winbind (mapping to local user).  I'm not at all convinced the patch is
> correct for those cases, but I can be persuaded.

Setps done to reproduce this:

Setup AD Server
Create a user bob1 on AD

----

Setup a Linux Client with the following smb.conf:

[global]
        workgroup = LEVEL1
        realm = LEVEL1.DISCWORLD.SITE
        security = ads
        map to guest = Bad User
        logon path = \\%L\profiles\.msprofile
        logon home = \\%L\%U\.9xprofile
        logon drive = P:
        usershare allow guests = Yes

        #log file = /var/log/samba/log.%m
        max log size = 0
        log level = 10
        debug pid = yes

        kerberos method = system keytab

[test]
        path = /srv/samba/test
        writeable = yes
        valid users = bob1

Create a local user bob1
Join the machine to AD
Start smbd

as a user do:
kinit bob1 at LEVEL1.DISCWORLD.SITE

asn at samba:~> smbclient -k -U bob1 //SAMBA/test
Domain=[LEVEL1] OS=[Unix] Server=[Samba 4.2.0pre1-GIT-0b079a4]
smb: \> 



	-- andreas

-- 
Andreas Schneider                   GPG-ID: CC014E3D
Samba Team                             asn at samba.org
www.samba.org