samba.git/source4/rpc_server/samr, branch master

Fix the O3 developer build

2015-03-03T12:14:53+00:00

Different gcc versions complain at different places

Signed-off-by: Volker Lendecke 
Reviewed-by: Alexander Bokovoy 

Autobuild-User(master): Volker Lendecke 
Autobuild-Date(master): Tue Mar  3 13:14:53 CET 2015 on sn-devel-104

dsdb: Always store and return the userParameters as a array of LE 16-bit values

2014-07-09T06:42:08+00:00

This is not allowed to be odd length, as otherwise we can not send it over the SAMR transport correctly.

Allocating one byte less memory than required causes malloc() heap corruption
and then a crash or lockup of the SAMR server.

Andrew Bartlett

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10130
Change-Id: I5c0c531c1d660141e07f884a4789ebe11c1716f6
Pair-Programmed-With: Stefan Metzmacher 
Signed-off-by: Andrew Bartlett 
Signed-off-by: Stefan Metzmacher

s4:samr: allow builtin groups for samr_OpenGroup.

2014-05-03T05:57:13+00:00

This fixes nsswitch getgrgid for builtins.

Signed-off-by: Michael Adam 
Reviewed-by: Andrew Bartlett

dsdb: Allow SAMR server to return the computed, not actual badPwdCount

2014-04-02T15:12:47+00:00

This matters after the lockout observation period has expired.

Note: that QueryUserInfo level 3 returns the raw badPwdCount value.

Andrew Bartlett

Change-Id: I7b304a50984072bc6cb1daf3315b4427443632a9
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

s4:rpc_server/samr: passdown unmodified acct_flags to the ldb layer.

2014-04-02T15:12:47+00:00

The samldb module will handle the verification and magic.

Change-Id: If38e0ed229b98eac4db9b39988de4a25f9a352f2
Signed-off-by: Stefan Metzmacher 
Reviewed-by: Andrew Bartlett

s4-samr: Escape the username in the LDAP filter

2014-04-02T15:12:47+00:00

Change-Id: I99945f0b86ea2862c88c00ad39c809ef1101ca9b
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

s4:auth: Add password lockout support to the AD DC

2014-04-02T15:12:46+00:00

Including a fix by Arvid Requate 

Change-Id: I25d10da50dd6119801cd37349cce970599531c6b
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

dsdb: Put password lockout support in samdb_result_passwords()

2014-04-02T15:12:46+00:00

This seems to be the best choke point to check for locked out
accounts, as aside from the KDC, all the password authentication and
change callers use it.

Andrew Bartlett

Change-Id: I0f21a79697cb8b08ef639445bd05a896a2c9ee1b
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

dsdb: Rework samdb_result_acct_flags to use either userAccountControl or msDS-User-Account-Control-Computed

2014-04-02T15:12:46+00:00

This allows us to avoid the domain lookup in the constructed attribute
when not required.

By using msDS-User-Account-Control-Computed the lockout and password
expiry checks are now handled in the operational ldb module.

Andrew Bartlett

Change-Id: I6eb94933e4602e2e50c2126062e9dfa83a46191b
Signed-off-by: Andrew Bartlett 
Reviewed-by: Stefan Metzmacher

CVE-2013-4496:Revert remainder of ce895609b04380bfc41e4f8fddc84bd2f9324340

2014-03-13T14:06:35+00:00

Part of this was removed when ChangePasswordUser was unimplemented,
but remove the remainder of this flawed commit.  Fully check the
password first, as extract_pw_from_buffer() already does a partial
check of the password because it needs a correct old password to
correctly decrypt the length.

Andrew Bartlett

Bug: https://bugzilla.samba.org/show_bug.cgi?id=10245

Change-Id: Ibccc4ada400b5f89a942d79c1a269b493e0adda6
Signed-off-by: Andrew Bartlett 
Reviewed-by: Andreas Schneider 
Reviewed-by: Stefan Metzmacher 
Reviewed-on: https://gerrit.samba.org/38

Autobuild-User(master): Stefan Metzmacher 
Autobuild-Date(master): Thu Mar 13 15:06:35 CET 2014 on sn-devel-104