IntenseWebs/freeipa
3
0
Fork 0
mirror of https://salsa.debian.org/freeipa-team/freeipa.git synced 2025-02-25 18:55:28 -06:00
Code Issues Packages Projects Releases Wiki Activity

kdb: support SMB services on IPA domain members

Browse Source 
SMB service on IPA domain member will have both ipaIDOjbect and ipaUser
object classes. Such service will have to be treated as a user in order
to issue MS-PAC record for it.

Fixes: https://pagure.io/freeipa/issue/3999
Signed-off-by: Alexander Bokovoy <abokovoy@redhat.com>
Reviewed-By: Rob Crittenden <rcritten@redhat.com>
Reviewed-By: Christian Heimes <cheimes@redhat.com>
This commit is contained in:
Alexander Bokovoy
2019-03-01 19:00:21 +02:00
parent 91abd1f67a
commit 653f72079e
1 changed files with 15 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
daemons/ipa-kdb/ipa_kdb_mspac.c
View File

@@ -401,6 +401,8 @@ static krb5_error_code ipadb_fill_info3(struct ipadb_context *ipactx,
bool is_host = false;
bool is_user = false;
bool is_service = false;
bool is_ipauser = false;
bool is_idobject = false;
krb5_principal princ;
krb5_data *data;
@@ -417,11 +419,24 @@ static krb5_error_code ipadb_fill_info3(struct ipadb_context *ipactx,
if (strcasecmp(objectclasses[c], "ipaNTUserAttrs") == 0) {
is_user = true;
}
if (strcasecmp(objectclasses[c], "ipaIDObject") == 0) {
is_idobject = true;
}
if (strcasecmp(objectclasses[c], "ipaUser") == 0) {
is_ipauser = true;
}
free(objectclasses[c]);
}
}
free(objectclasses);
/* SMB service on IPA domain member will have both ipaIDOjbect and ipaUser
* object classes. Such service will have to be treated as a user in order
* to issue MS-PAC record for it. */
if (is_idobject && is_ipauser) {
is_user = true;
}
if (!is_host && !is_user && !is_service) {
/* We only handle users and hosts, and services */
return ENOENT;