[PATCH 1/2] s3-auth: fix force user for AD user
asn at samba.org
Tue Jan 14 08:21:12 MST 2014
On Monday 06 January 2014 11:37:19 you wrote:
> On Tue, 2013-12-17 at 21:59 +0100, Andreas Schneider wrote:
> > On Wednesday 18 December 2013 09:52:20 Andrew Bartlett wrote:
> > > On Tue, 2013-12-17 at 16:20 +0100, Andreas Schneider wrote:
> > > > On Saturday 14 December 2013 07:37:52 Andrew Bartlett wrote:
> > > > > > Günther and I are working on it. Here is our WIP branch:
> > > > > >
> > > > > > https://git.samba.org/?p=asn/samba.git;a=shortlog;h=refs/heads/for
> > > > > > ce_u
> > > > > > ser
> > > > >
> > > > > This looks like a much better approach!
> > > >
> > > > Hi Andrew,
> > > >
> > > > here is the proposed patchset:
> > > >
> > > > https://git.samba.org/?p=asn/samba.git;a=shortlog;h=refs/heads/force_u
> > > > ser
> > > >
> > > > I will run 'make test' but this should work. Could you please take
> > > > another
> > > > look?
> > >
> > > The main issue I see is that this new (great!) codepath is called for
> > > users from /etc/passwd, not just users from winbind forced in via force
> > > user. See the callers in auth_unix.c and user_krb5.c.
> > Yes, that's correct. We follwed all codepath and checked what is happening
> > and why. In user_krb5.c it is called if the information can't be found in
> > the PAC. So it can be a local user or the information could be retrieved
> > from winbind.
> > And auth_unix.c is for a unix user. I've tested that and it works if I use
> > a local user for 'force user'.
> > That's also why me renamed the function cause we just have a passwd struct
> > we convert ...
> Have you tested with a local user and plaintext passwords?
I don't know what you mean with the, smbpasswd plaintext password have been
removed since quite some time.
> We really
> should have a test environment for that, and for krb5 but without
> winbind (mapping to local user). I'm not at all convinced the patch is
> correct for those cases, but I can be persuaded.
Setps done to reproduce this:
Setup AD Server
Create a user bob1 on AD
Setup a Linux Client with the following smb.conf:
workgroup = LEVEL1
realm = LEVEL1.DISCWORLD.SITE
security = ads
map to guest = Bad User
logon path = \\%L\profiles\.msprofile
logon home = \\%L\%U\.9xprofile
logon drive = P:
usershare allow guests = Yes
#log file = /var/log/samba/log.%m
max log size = 0
log level = 10
debug pid = yes
kerberos method = system keytab
path = /srv/samba/test
writeable = yes
valid users = bob1
Create a local user bob1
Join the machine to AD
as a user do:
kinit bob1 at LEVEL1.DISCWORLD.SITE
asn at samba:~> smbclient -k -U bob1 //SAMBA/test
Domain=[LEVEL1] OS=[Unix] Server=[Samba 4.2.0pre1-GIT-0b079a4]
Andreas Schneider GPG-ID: CC014E3D
Samba Team asn at samba.org
More information about the samba-technical