From 79e3fe4052b0bdb0ca6b9c62686cacb581df0044 Mon Sep 17 00:00:00 2001 From: Mathieu Deaudelin-Lemay Date: Fri, 20 Nov 2015 11:56:11 -0500 Subject: [PATCH] Changes to allow SSSD to be used for access control with a machine account belonging to a domain controller. Resolves: https://fedorahosted.org/sssd/ticket/2870 --- src/providers/ad/ad_gpo.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/providers/ad/ad_gpo.c b/src/providers/ad/ad_gpo.c index f1e928b71c3b9d1666b4074f32464550febbadb9..bdf2776db9823906e75574187461607fa57f2121 100644 --- a/src/providers/ad/ad_gpo.c +++ b/src/providers/ad/ad_gpo.c @@ -67,6 +67,7 @@ #define AD_AT_FLAGS "flags" #define UAC_WORKSTATION_TRUST_ACCOUNT 0x00001000 +#define UAC_SERVER_TRUST_ACCOUNT 0x00002000 #define AD_AGP_GUID "edacfd8f-ffb3-11d1-b41d-00a0c968f939" #define AD_AUTHENTICATED_USERS_SID "S-1-5-11" @@ -1841,7 +1842,11 @@ ad_gpo_target_dn_retrieval_done(struct tevent_req *subreq) } /* we only support computer policy targets, not users */ - if (!(uac & UAC_WORKSTATION_TRUST_ACCOUNT)) { + if (!(uac & UAC_WORKSTATION_TRUST_ACCOUNT || + uac & UAC_SERVER_TRUST_ACCOUNT)) { + DEBUG(SSSDBG_OP_FAILURE, + "Invalid userAccountControl (%x) value for machine account.", + uac); ret = EINVAL; goto done; } -- 2.4.3