DomainKey-Signature: a=rsa-sha1; c=nofws; d=sourceware.org; h=list-id
	:list-unsubscribe:list-subscribe:list-archive:list-post
	:list-help:sender:mime-version:references:in-reply-to:from:date
	:message-id:subject:to:content-type; q=dns; s=default; b=RmKzz1p
	VuphNrbAOjK0xm/WGAEg2gAFA5X7anq0KYdYboC9cJlKGJF6e5QJfbqd0eArrbKq
	DYahnywSm5VTGXUbIig9nzZbsjmpqXTAM8G2yO4EWHhSp36zJr9NMpuNNsidSp0U
	1ZFyl/yQtwGbGQ0affkkkKGaLwGiQdceu0yg=
Mailing-List: contact cygwin-help@cygwin.com; run by ezmlm
Sender: cygwin-owner@cygwin.com
Mail-Followup-To: cygwin@cygwin.com
MIME-Version: 1.0
References: <CANV9t=SNfgP-CA32yfPwLv2=d0F8xtpdCT4o_wwGFGE+F3SEuA@mail.gmail.com> <50cba8d1-4794-8db9-d1f3-ab9476421db7@gmx.com> <CANV9t=QQ1higAt1qeDF4fckkz_6eqQJtdhau8+uhrAvGtWUK_A@mail.gmail.com> <20190215163817.GI2702@calimero.vinschen.de>
In-Reply-To: <20190215163817.GI2702@calimero.vinschen.de>
From: Bill Stewart <bstewart@iname.com>
Date: Fri, 15 Feb 2019 12:14:07 -0700
Message-ID: <CANV9t=Rm+su=qDqdFN-LqiMLEAHJD7WxW_OSqqSpqgeb6ir++w@mail.gmail.com>
Subject: Re: Windows to Cygwin username mapping: Domain before local account when duplicate name?
To: cygwin@cygwin.com
Content-Type: text/plain; charset="UTF-8"

On Fri, Feb 15, 2019 at 9:38 AM Corinna Vinschen wrote:

> There's a documented ruleset which is strictly followed
> https://cygwin.com/cygwin-ug-net/ntsec.html#ntsec-mapping-how:

From that reference, we have the following order:

* Well-known SIDs in the NT_AUTHORITY domain of the S-1-5-RID type

* Other well-known SIDs in the NT_AUTHORITY domain (S-1-5-X-RID)

* Other well-known SIDs

* Logon SIDs

* Accounts from the local machine's user DB (SAM)

* Accounts from the machine's primary domain

* Accounts from a trusted domain of the machine's primary domain

This listing suggests to me that local accounts would be returned
before domain accounts. This is sensible because you wouldn't want to
search the domain before searching the local machine first
(performance).

So the scenario I am talking about is there is testuser in local SAM,
and testuser in computer's domain.

'getend passwd testuser' returns the domain account. Based on the
above, I was expecting the local account to be returned first.

What am I missing?

Bill

--
Problem reports:       http://cygwin.com/problems.html
FAQ:                   http://cygwin.com/faq/
Documentation:         http://cygwin.com/docs.html
Unsubscribe info:      http://cygwin.com/ml/#unsubscribe-simple