Bug 10838 - Invalid id mappings for users/groups migrated from another domain
Summary: Invalid id mappings for users/groups migrated from another domain
Status: RESOLVED FIXED
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: Winbind (show other bugs)
Version: unspecified
Hardware: All All
: P5 normal (vote)
Target Milestone: ---
Assignee: Karolin Seeger
QA Contact: Samba QA Contact
URL:
Keywords:
Depends on:
Blocks:
 
Reported: 2014-09-24 23:04 UTC by Christof Schmitt
Modified: 2014-10-13 19:09 UTC (History)
0 users

See Also:

Attachments
Backport of patches to 4.0 branch (11.26 KB, patch)
2014-09-29 23:09 UTC, Christof Schmitt 		cs: review+
vl: review+
Details
Backport of patches to 4.1 branch (10.41 KB, patch)
2014-09-29 23:10 UTC, Christof Schmitt 		cs: review+
vl: review+
Details
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Christof Schmitt 2014-09-24 23:04:31 UTC 
This is an issue in 4.0, 4.1 and master.

When objects have been migrated from another domain, e.g. group membership
can still be indicated through SIDs in the previous domain.

When using the SID of the migration source, the LookupSids requests from
source3/winbindd/wb_sids2xids.c returns the domain sid from the new
domain.

The code in wb_sids2xids_lookupsids_done then combines the domain SID
from the new domain with the RID from the previous domain. When that
wrongly created SID clashes with the SID from an actual user or group,
user access can get denied.

The patch proposed in
https://lists.samba.org/archive/samba-technical/2014-September/102456.html
fixes this problem by reverting to the behavior seen in the 3.6 code;
use the SID from the previous domain for the id mapping request.
Comment 1 Christof Schmitt 2014-09-29 23:09:41 UTC 
Created attachment 10320 [details]
Backport of patches to 4.0 branch
Comment 2 Christof Schmitt 2014-09-29 23:10:10 UTC 
Created attachment 10321 [details]
Backport of patches to 4.1 branch
Comment 3 Christof Schmitt 2014-10-01 15:04:30 UTC 
Reassigning for inclusion in 4.x branches.
Comment 4 Karolin Seeger 2014-10-09 18:41:58 UTC 
Pushed to autobuild-v4-[0|0]-test.

Christof, please make sure to include the bug number in the commit message in furture. Thanks!
Comment 5 Karolin Seeger 2014-10-13 19:09:16 UTC 
Pushed to both branches.
Closing out bug report.

Thanks!