Bug 6562 - ADUC: Console hangs when group memberships are changed from users without admin rights
Summary: ADUC: Console hangs when group memberships are changed from users without adm...
Alias: None
Product: Samba 4.0
Classification: Unclassified
Component: Tools (show other bugs)
Version: unspecified
Hardware: All All
: P3 normal (vote)
Target Milestone: ---
Assignee: Andrew Bartlett
QA Contact: Matthias Dieter Wallnöfer
Depends on: 6466
Blocks: 6600
  Show dependency treegraph
Reported: 2009-07-17 10:21 UTC by Matthias Dieter Wallnöfer
Modified: 2009-09-07 02:52 UTC (History)
1 user (show)

See Also:


Note You need to log in before you can comment on or make changes to this bug.
Description Matthias Dieter Wallnöfer 2009-07-17 10:21:47 UTC
When you log in as a normal (AD) user, open the ADUC console, try to add a group entry to some user and confirm this, the console hangs.

The last messages who are listed in the debug log:
ldb_request BASE dn=<user-dn>,filter=(objectClass=*)
ldb_request BASE dn=<group-dn>,filter=(objectClass=*)
ldb: start ldb transaction (nesting: 0)
ldb: objectclass_modify

Then the connection is going to be closed (closed connection to service IPC$) with NT_STATUS_END_OF_FILE.
Comment 1 Matthieu Patou 2009-07-19 01:41:18 UTC
A normal user shouldn't be denied any modification in ADCU ? (apart from his personnal informations)
It seems to me that at least a normal user is unable to create users (hopefully).

Comment 2 Matthias Dieter Wallnöfer 2009-08-01 13:40:18 UTC
I personally think that this depends on #6466. So we've to fix the other bug first.
Comment 3 Andrew Kroeger 2009-09-06 21:38:14 UTC
I can no longer (as of commit 9cf2d053cd255ee8c96bb25338b229e63d2d5182) reproduce this issue.  I was looking into it about 24 hours ago, and had no problems reproducing the hang then.  I now get an error message like "You do not have permission to modify the group smb4.internal.id10ts.net/Users/Domain Admins." if I attempt to add a user to the Domain Admins group (or any other group) when logged in as a non-admin user.

The testing I did earlier when I could reproduce the issue included my work on the display specifiers additions, so the only changes to my working tree since then are commits e6cb98e53a25af5fba2dc579ff6a51653183eb70 through a9595976370251a445919a235901c9058bc683ff.  I do not see anything in those changes that would indicate they were made to correct this issue.

I'll leave it to others to see if they can reproduce the original issue, and close this bug if they cannot.
Comment 4 Andrew Bartlett 2009-09-06 21:46:04 UTC
This fix 77e2403f1314a28722f0fb21f6682320b2e9935d fixed the hang, but the underlying bug is still present (and is the subject of my ldb-index branch)
Comment 5 Matthias Dieter Wallnöfer 2009-09-07 02:24:41 UTC
This is fixed with my patchset.
Comment 6 Andrew Bartlett 2009-09-07 02:52:42 UTC
Actually, I think this was fixed by the work tridge and I did to handle failures inside callbacks (8995491f59e7b6cee79b4249424e886f54f6b94d)