Version: 3.0.1 [ 10730 ]

Version: 3.0.0 [ 10740 ]

description: First enable use of Windows trusted authentication:

CREATE GLOBAL MAPPING TRUSTED_AUTH
USING PLUGIN WIN_SSPI
FROM ANY USER
TO USER;

Then we want to define some exact Windows trusted authentication user group mapping to firebird role:

CREATE MAPPING WIN_GLADMIN
USING PLUGIN WIN_SSPI
FROM Group NOOMGLADMIN
TO ROLE GLADMIN;

But this does not work.
It seems that currently works role assignment mapping only for windows admins (Predefined_Group DOMAIN_ANY_RID_ADMINS).

Mabe this issue is retated to one 'ToDo' comment in plugin WIN_SSPI code (AuthSspi.cpp):

int WinSspiServer::authenticate(Firebird::CheckStatusWrapper* status,
IServerBlock* sBlock,
IWriter* writerInterface)
{
try
{
const bool wasActive = sspi.isActive();

	sspiData\.clear\(\);
	unsigned int length;
	const unsigned char\* bytes = sBlock\-\>getData\(&length\);
	sspiData\.add\(bytes, length\);

	if \(\!sspi\.accept\(sspiData\)\)
		return AUTH\_CONTINUE;

	if \(wasActive && \!sspi\.isActive\(\)\)
	\{
		bool wheel = false;
		string login;
		sspi\.getLogin\(login, wheel\);
		ISC\_systemToUtf8\(login\);

		writerInterface\-\>add\(status, login\.c\_str\(\)\);
		if \(wheel\)
		\{
			writerInterface\-\>add\(status, FB\_DOMAIN\_ANY\_RID\_ADMINS\);
			writerInterface\-\>setType\(status, FB\_PREDEFINED\_GROUP\);
		\}

		// ToDo: walk groups to which login belongs and list them using writerInterface

		return AUTH\_SUCCESS;
	\}

	sBlock\-\>putData\(status, sspiData\.getCount\(\), sspiData\.begin\(\)\);
\}

...

assignee: Alexander Peshkov [ alexpeshkoff ]

status: Open [ 1 ] => Resolved [ 5 ]

resolution: Fixed [ 1 ]

Fix Version: 4.0 Beta 1 [ 10750 ]

Fix Version: 3.0.5 [ 10885 ]

Version: 3.0.4 [ 10863 ]

Version: 3.0.3 [ 10810 ]