fix: Incorrectly pass-in parameters when calling AD_OfflineQueryMembe…

…rof #186922 Fix incorrectly pass-in parameters when calling AD_OfflineQueryMemberof Related work items: #186922
BeyondTrust · Jun 14, 2019 · b0a2d17 · b0a2d17
1 parent 4d946b8
commit b0a2d17
Show file tree

Hide file tree

Showing 2 changed files with 24 additions and 5 deletions.
diff --git a/lsass/server/auth-providers/ad-open-provider/online.c b/lsass/server/auth-providers/ad-open-provider/online.c
@@ -2926,16 +2926,35 @@ AD_FindObjectsByListNoCache(
     OUT PLSA_SECURITY_OBJECT** pppObjects
     )
 {
-    return LsaAdBatchFindObjects(
+    DWORD dwError = LW_ERROR_SUCCESS;
+    DWORD dwOfflineDomains = 0;
+    PSTR* ppszOfflineDomains = NULL;
+
+    dwError =  LsaAdBatchFindObjects(
                 pContext,
                 QueryType,
                 dwCount,
                 ppszList,
                 NULL,
                 pdwCount,
                 pppObjects,
-                NULL,
-                NULL);
+                &dwOfflineDomains,
+                &ppszOfflineDomains);
+    if (dwError == LW_ERROR_SUCCESS &&
+        dwCount == 1 && dwOfflineDomains == 1)
+    {
+       // Success is returned even if the domain(s) is offline or the 
+       // object(s) is not found. However, If we're looking for a 
+       // single object, and the number of offline domains is also one, 
+       // then return domain offline.
+       dwError =  LW_ERROR_DOMAIN_IS_OFFLINE;
+    }
+
+    LwFreeStringArray(ppszOfflineDomains, dwOfflineDomains);
+    ppszOfflineDomains = NULL;
+    dwOfflineDomains = 0;
+
+    return dwError;
 }
 
 DWORD

diff --git a/lsass/server/auth-providers/ad-open-provider/provider-main.c b/lsass/server/auth-providers/ad-open-provider/provider-main.c
@@ -5359,8 +5359,8 @@ AD_QueryMemberOf(
             FindFlags,
             dwSidCount,
             ppszSids,
-            pdwGroupSidCount,
-            pppszGroupSids);
+            &dwGroupSidCount,
+            &ppszGroupSids);
     }
 
     *pdwGroupSidCount = dwGroupSidCount;