Commit 03f79295 authored by jan.koester's avatar jan.koester
Browse files

test

parent bf0acd37

plugin/krb5/krb5.cpp

+19 −6
Changes for plugin/krb5/krb5.cpp: 19 added lines, 6 removed lines.
Original line number Diff line number Diff line
@@ -33,6 +33,7 @@ 
#include <random>

#include <algorithm>

#include <memory>

#include <set>

#include <chrono>

#include <fstream>

#include <sstream>
@@ -3969,17 +3970,29 @@ std::vector<uint8_t> Krb5KDC::buildPacAuthData(RealmInfo &ri, const uuid::uuid & 
    if (!entry->objectSid.empty() && entry->objectSid.inDomain(ri.meta.sid))

        pu.userRid = entry->objectSid.rid();



    /* groups: primary + each memberOf resolved to its in-domain RID */

    /* groups: primary + every in-domain group the account is in, also

     * through nested groups (GPO security filtering and file ACLs name

     * outer groups) */

    std::map<uint32_t, bool> rids;

    rids[pu.primaryGroupRid] = true;

    if (auto *mo = entry->get("memberOf")) {

        for (auto &dnStr : *mo) {

    {

        std::set<std::string> seen;

        std::vector<dsdb::Values> todo;

        if (auto *mo = entry->get("memberOf")) todo.push_back(*mo);

        while (!todo.empty()) {

            dsdb::Values mo = todo.back();

            todo.pop_back();

            for (auto &dnStr : mo) {

                dsdb::Dn gdn;

            if (!dsdb::Dn::parse(dnStr, gdn))

                if (!dsdb::Dn::parse(dnStr, gdn) || !seen.insert(gdn.key()).second)

                    continue;

                auto g = ri.dir->byDn(gdn);

                if (!g || g->objectSid.empty() || !g->objectSid.inDomain(ri.meta.sid))

                    continue;

            if (auto g = ri.dir->byDn(gdn))

                if (!g->objectSid.empty() && g->objectSid.inDomain(ri.meta.sid))

                rids[g->objectSid.rid()] = true;

                if (auto *outer = g->get("memberOf"))

                    todo.push_back(*outer);

            }

        }

    }

    for (auto &[rid, _] : rids)