2 files changed, 18 insertions, 6 deletions
diff --git a/source4/libcli/security/security.h b/source4/libcli/security/security.h
index e3fdb0c7948..585170ed61c 100644
--- a/source4/libcli/security/security.h
+++ b/source4/libcli/security/security.h
@@ -23,11 +23,12 @@
 #include "librpc/gen_ndr/security.h"
 
 enum security_user_level {
-	SECURITY_ANONYMOUS,
-	SECURITY_USER,
-	SECURITY_DOMAIN_CONTROLLER,
-	SECURITY_ADMINISTRATOR,
-	SECURITY_SYSTEM
+	SECURITY_ANONYMOUS            = 0,
+	SECURITY_USER                 = 10,
+	SECURITY_RO_DOMAIN_CONTROLLER = 20,
+	SECURITY_DOMAIN_CONTROLLER    = 30,
+	SECURITY_ADMINISTRATOR        = 40,
+	SECURITY_SYSTEM               = 50
 };
 
 struct auth_session_info;
diff --git a/source4/libcli/security/security_token.c b/source4/libcli/security/security_token.c
index d3eff93ddb7..f105ed391f9 100644
--- a/source4/libcli/security/security_token.c
+++ b/source4/libcli/security/security_token.c
@@ -147,7 +147,8 @@ bool security_token_has_enterprise_dcs(const struct security_token *token)
 	return security_token_has_sid_string(token, SID_NT_ENTERPRISE_DCS);
 }
 
-enum security_user_level security_session_user_level(struct auth_session_info *session_info) 
+enum security_user_level security_session_user_level(struct auth_session_info *session_info,
+						     const struct dom_sid *domain_sid)
 {
 	if (!session_info) {
 		return SECURITY_ANONYMOUS;
@@ -165,6 +166,16 @@ enum security_user_level security_session_user_level(struct auth_session_info *s
 		return SECURITY_ADMINISTRATOR;
 	}
 
+	if (domain_sid &&
+	    dom_sid_in_domain(domain_sid, session_info->security_token->user_sid)) {
+		uint32_t rid;
+		NTSTATUS status = dom_sid_split_rid(NULL, session_info->security_token->user_sid,
+						    NULL, &rid);
+		if (NT_STATUS_IS_OK(status) && rid == DOMAIN_RID_ENTERPRISE_READONLY_DCS) {
+			return SECURITY_RO_DOMAIN_CONTROLLER;
+		}
+	}
+
 	if (security_token_has_enterprise_dcs(session_info->security_token)) {
 		return SECURITY_DOMAIN_CONTROLLER;
 	}