Bug 1019 - Net groupmap modify : different search keys (SID, then gid) are used to update a record
Summary: Net groupmap modify : different search keys (SID, then gid) are used to updat...
Alias: None
Product: Samba 3.0
Classification: Unclassified
Component: User/Group Accounts (show other bugs)
Version: 3.0.0
Hardware: All Linux
: P3 critical
Target Milestone: none
Assignee: Samba Bugzilla Account
QA Contact:
URL: http://lists.samba.org/archive/samba-...
Depends on: 1017
Blocks: 828
  Show dependency treegraph
Reported: 2004-01-30 01:49 UTC by Ganael LAPLANCHE
Modified: 2005-09-27 12:50 UTC (History)
0 users

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Ganael LAPLANCHE 2004-01-30 01:49:20 UTC
Test :

/usr/local/samba/bin# ./net groupmap list
domadm (S-1-5-21-3746524048-3196343125-3229652583-512) -> domadm
test (S-1-5-21-3746524048-3196343125-3229652583-520) -> newdomadm
opuspdc1:/usr/local/samba/bin# ./net groupmap modify
sid=S-1-5-21-3746524048-3196343125-3229652583-512 unixgroup=newdomadm
Updated mapping entry for
/usr/local/samba/bin# ./net groupmap list
domadm (S-1-5-21-3746524048-3196343125-3229652583-512) -> domadm
domadm (S-1-5-21-3746524048-3196343125-3229652583-512) -> newdomadm

The result of this command is unexpected ! Here is what (I think) happens :

- First, the command doesn't check for the existence of a mapping involving
newdomadm -> we should get an error here (same error as in bug #1017)

- Second, net_groupmap.c/net_groupmap_modify looks for the mapping using
the SID (it finds S-1-5-21-3746524048-3196343125-3229652583-512/domadm) and
modifies it in memory (to get
S-1-5-21-3746524048-3196343125-3229652583-512/newdomadm). BUT, when the
mapping is to be stored in LDAP via
pdb_ldap.c/ldapsam_update_group_mapping_entry, it is passed ALREADY
MODIFIED to the function that looks for the mapping but using the new GID
(the one of newdomadm) ! 

Since the search keys aren't the same (SID, then
Gid), we may get in trouble here. This is what happens, it doesn't return
the same record, it returns the second, existing one
(S-1-5-21-3746524048-3196343125-3229652583-520/newdomadm) which is modified
to S-1-5-21-3746524048-3196343125-3229652583-512/newdomadm.
Comment 1 Gerald (Jerry) Carter (dead mail address) 2004-03-18 07:06:02 UTC
moving to 3.0
Comment 2 Gerald (Jerry) Carter (dead mail address) 2004-03-18 07:07:27 UTC
resetting component
Comment 3 Gerald (Jerry) Carter (dead mail address) 2005-09-27 12:50:07 UTC
try 'net groupmap set'.  The add/modify option will be 
deprecated in the next release (3.0.21).