diff options
| author | Ralph Boehme <slow@samba.org> | 2021-01-11 17:10:19 +0100 |
|---|---|---|
| committer | Karolin Seeger <kseeger@samba.org> | 2021-02-01 07:50:10 +0000 |
| commit | 7878dec1da0c314a20b7d1ff98bd1576a861f0c4 (patch) | |
| tree | 39f69b3fdd24f0b0654e8fe6060f029d58454162 /source3 | |
| parent | c983012811ee5e77cdb5a8deabd27278e867ec42 (diff) | |
| download | samba-7878dec1da0c314a20b7d1ff98bd1576a861f0c4.tar.gz | |
winbind: check for allowed domains in winbindd_dual_pam_auth_crap()
BUG: https://bugzilla.samba.org/show_bug.cgi?id=14602
Signed-off-by: Ralph Boehme <slow@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
(cherry picked from commit c17bc9c6115e4e92132f3cb912547eac78227938)
Diffstat (limited to 'source3')
| -rw-r--r-- | source3/winbindd/winbindd_pam.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/source3/winbindd/winbindd_pam.c b/source3/winbindd/winbindd_pam.c index 428fc2398d4..732b27842cb 100644 --- a/source3/winbindd/winbindd_pam.c +++ b/source3/winbindd/winbindd_pam.c @@ -2765,6 +2765,16 @@ enum winbindd_result winbindd_dual_pam_auth_crap(struct winbindd_domain *domain, goto done; } + if (!is_allowed_domain(info3->base.logon_domain.string)) { + DBG_NOTICE("Authentication failed for user [%s] " + "from firewalled domain [%s]\n", + info3->base.account_name.string, + info3->base.logon_domain.string); + state->response->data.auth.authoritative = true; + result = NT_STATUS_AUTHENTICATION_FIREWALL_FAILED; + goto done; + } + result = append_auth_data(state->mem_ctx, state->response, state->request->flags, validation_level, |