3 files changed, 10 insertions, 2 deletions
diff --git a/source4/auth/auth.h b/source4/auth/auth.h
index 0b6b1d3583..c472d86d1e 100644
--- a/source4/auth/auth.h
+++ b/source4/auth/auth.h
@@ -72,6 +72,7 @@ struct auth_operations {
 						       const char *principal,
 						       struct ldb_dn *user_dn,
 						       struct auth_user_info_dc **interim_info);
+	uint32_t flags;
 };
 
 struct auth_method_context {
diff --git a/source4/auth/ntlm/auth.c b/source4/auth/ntlm/auth.c
index 642d8684e5..6d5747eb78 100644
--- a/source4/auth/ntlm/auth.c
+++ b/source4/auth/ntlm/auth.c
@@ -342,6 +342,11 @@ static void auth_check_password_async_trigger(struct tevent_context *ev,
 
 	for (method=state->auth_ctx->methods; method; method = method->next) {
 
+		if (state->user_info->flags & USER_INFO_LOCAL_SAM_ONLY
+		    && !(method->ops->flags & AUTH_METHOD_LOCAL_SAM)) {
+			continue;
+		}
+
 		/* we fill in state->method here so debug messages in
 		   the callers know which method failed */
 		state->method = method;
diff --git a/source4/auth/ntlm/auth_sam.c b/source4/auth/ntlm/auth_sam.c
index 6b184f8d32..6e2dd440f7 100644
--- a/source4/auth/ntlm/auth_sam.c
+++ b/source4/auth/ntlm/auth_sam.c
@@ -677,14 +677,16 @@ static const struct auth_operations sam_ignoredomain_ops = {
 	.name		           = "sam_ignoredomain",
 	.want_check	           = authsam_ignoredomain_want_check,
 	.check_password	           = authsam_check_password_internals,
-	.get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper
+	.get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper,
+	.flags                     = AUTH_METHOD_LOCAL_SAM
 };
 
 static const struct auth_operations sam_ops = {
 	.name		           = "sam",
 	.want_check	           = authsam_want_check,
 	.check_password	           = authsam_check_password_internals,
-	.get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper
+	.get_user_info_dc_principal = authsam_get_user_info_dc_principal_wrapper,
+	.flags                     = AUTH_METHOD_LOCAL_SAM
 };
 
 _PUBLIC_ NTSTATUS auth4_sam_init(void);