samba.git/libds, branch master

dsdb-samldb: Only allow known and settable userAccountControl bits to be set

2015-01-22T06:50:06+00:00

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10993

Signed-off-by: Andrew Bartlett 
Signed-off-by: Garming Sam 
Pair-programmed-with: Garming Sam 
Reviewed-by: Stefan Metzmacher

libds: UF_PARTIAL_SECRETS_ACCOUNT is a flag, not an account type

2015-01-22T06:50:06+00:00

This list should only be of the account exclusive account type bits.

Note, this corrects the behaviour in samldb modifies of
userAccountControl.

This reverts 6cb91a8f33516a33210a25e4019f3f3fbbfe61f2

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10993

Pair-programmed-with: Garming Sam 
Signed-off-by: Andrew Bartlett 
Signed-off-by: Garming Sam 
Reviewed-by: Stefan Metzmacher

libds: add UF_PARTIAL_SECRETS_ACCOUNT to UF_ACCOUNT_TYPE_MASK

2014-04-02T15:12:47+00:00

Change-Id: Ie26520c37c393ab4d2e3c5782e3dca46d4d1f83c
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

lib/param: Create a seperate server role for "active directory domain controller"

2012-06-15T07:18:33+00:00

This will allow us to detect from the smb.conf if this is a Samba4 AD
DC which will allow smarter handling of (for example) accidentially
starting smbd rather than samba.

To cope with upgrades from existing Samba4 installs, 'domain
controller' is a synonym of 'active directory domain controller' and
new parameters 'classic primary domain controller' and 'classic backup
domain controller' are added.

Andrew Bartlett

s3-auth: remove "security=server" (depricated since 3.6)

2012-05-15T06:18:28+00:00

"security=server" has a lot of problems in the world with
modern security (ntlmv2 and krb5). It was also not very
reliable, as it needed a stable connection to the password
server for the lifetime of the whole client connection!

Please use "security=domain" or "security=ads" is you
authentication against remote servers (domain controllers).

metze
                       --------------
                      /              \
                     /      REST      \
                    /        IN        \
                   /       PEACE        \
                  /                      \
                  |      SEC_SERVER      |
                  |    security=server   |
                  |                      |
                  |                      |
                  |       12 May         |
                  |                      |
                  |        2012          |
                 *|     *  *  *          | *
        _________)/\\_//(\/(/\)/\//\/\///|_)_______

s3-auth: Remove security=share (depricated since 3.6).

2012-03-04T22:33:05+00:00

This patch removes security=share, which Samba implemented by matching
the per-share password provided by the client in the Tree Connect with
a selection of usernames supplied by the client, the smb.conf or
guessed from the environment.

The rationale for the removal is that for the bulk of security=share
users, we just we need a very simple way to run a 'trust the network'
Samba server, where users mark shares as guest ok.  This is still
supported, and the smb.conf options are documented at
https://wiki.samba.org/index.php/Public_Samba_Server

At the same time, this closes the door on one of the most arcane areas
of Samba authentication.

Naturally, full user-name/password authentication remain available in
security=user and above.

This includes documentation updates for username and only user, which
now only do a small amount of what they used to do.

Andrew Bartlett

                       --------------
                      /              \
                     /      REST      \
                    /        IN        \
                   /       PEACE        \
                  /                      \
                  |      SEC_SHARE       |
                  |    security=share    |
                  |                      |
                  |                      |
                  |       5 March        |
                  |                      |
                  |        2012          |
                 *|     *  *  *          | *
        _________)/\\_//(\/(/\)/\//\/\///|_)_______

Intersite KCC flags

2012-01-14T05:13:08+00:00

NTDSSITELINK option flags added

Signed-off-by: Andrew Tridgell

libds: Make server role values explicit for easier debugging

2011-11-16T23:34:09+00:00

param: calculate server role from security, and security from server role

2011-11-16T23:34:08+00:00

This allows smb.conf files from either the samba3 or samba4 tradition
to come to the same value of server role, using the information in the
smb.conf file.

This is important so that tools like 'net getlocalsid' work against a
Samba4 AD installation (yes, users have tried this).

Andrew Bartlett

Pair-Programmed-With: Amitay Isaacs

roles: Add ROLE_AUTO to indicate that the server role is calculated

2011-11-16T23:34:08+00:00