summaryrefslogtreecommitdiffstats
path: root/source3/auth
Commit message (Collapse)AuthorAgeFilesLines
* s3:fix a comment typoMichael Adam2009-11-141-1/+1
| | | | Michael
* s3:is_trusted_domain: shortcut if domain name == global_sam_nameMichael Adam2009-11-141-0/+4
| | | | | | | A domain can't have a trust with itself. This saves some roundtrips to the ldap server for ldapsam. Michael
* s3:is_trusted_domain: shortcut if domain name is NULL or emptyMichael Adam2009-11-141-0/+4
| | | | | | This saves some roundtrips to LDAP in an ldapsm setup. Michael
* s3/pam: move variable declaration into belonging ifdef sectionBjörn Jacke2009-11-131-1/+1
| | | | This fixes a unused variable 'addr' warning on some platforms
* Ensure all callers to the rpc_client/cli_pipe functions correctlyJeremy Allison2009-11-121-6/+6
| | | | | initialize return variables. Jeremy.
* s3-passdb: cleanup some callers of pdb_get_trusteddom_pw().Günther Deschner2009-11-031-3/+1
| | | | Guenther
* s3: use enum netr_SchannelType all over the place.Günther Deschner2009-10-131-1/+1
| | | | Guenther
* schannel: fully share schannel sign/seal between s3 and 4.Günther Deschner2009-09-161-13/+13
| | | | Guenther
* s3-dcerpc: use dcerpc_AuthLevel and remove duplicate set of flags.Günther Deschner2009-09-152-2/+2
| | | | Guenther
* s3-rpc_client: add dcerpc_transport_t to cli_rpc_pipe_open_schannel().Günther Deschner2009-09-111-1/+1
| | | | Guenther
* Implement Metze's suggestion of trying getpwuid(0) then getpwnam(root).Jeremy Allison2009-08-221-9/+5
| | | | Jeremy.
* Try and fix the buildfarm by using getpwnam(root) insteadJeremy Allison2009-08-211-0/+7
| | | | | | of getpwuid(0) if DEVELOPER is defined. I'm hoping the build farm defines DEVELOPER... Jeremy.
* s3: fix bug #6650, authentication at member servers when winbindd is not runningMichael Adam2009-08-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Authentication of domain users on the member server fails when winbindd is not running. This is because the is_trusted_domain() check behaves differently when winbindd is running and when it isn't: Since wb_is_trusted_domain() calls wbcDomainInfo(), and this will also give a result for our own domain, this succeeds for the member server's own domain when winbindd is running. When winbindd is not running, is_trusted_domain() checks (and possibly updates) the trustdom cache, and this does the lsa_EnumTrustDom() rpc call to the DC which does not return its own domain. In case of winbindd not running, before 3.4, the domain part was _silently_ mapped to the workgroup in auth_util.c:make_user_info_map(), which effectively did nothing in the member case. But then the parameter "map untrusted to domain" was introduced and the mapping was made to the workstation name instead of the workgroup name by default unless "map untrusted to domain = yes". (Commits d8c54fddda2dba3cbc5fc13e93431b152813892e, 5cd4b7b7c03df6e896186d985b6858a06aa40b3f, and fbca26923915a70031f561b198cfe2cc0d9c3aa6) This was ok as long as winbindd was running, but with winbindd not running, these changes actually uncovered the above logic bug in the check. So the correct check is to treat the workgroup as trusted / or known in the member case. This is most easily achieved by not comparing the domain name against get_global_sam_name() which is the host name unless for a DC but against my_sam_name() which is the workgroup for a DC and for a member, too. (These names are not very intuitive...) I admit that this is a very long commit message for a one-liner, but this has needed some tracking down, and I think the change deserves some justification. Michael
* Fix bug #6647 - get_root_nt_token: getpwnam("root") failed!Jeremy Allison2009-08-191-2/+2
| | | | | | Not all systems may have a "root" user, but all must have a passwd entry for a uid of zero. Jeremy.
* Added prefer_ipv4 bool parameter to resolve_name().Jeremy Allison2009-07-281-1/+1
| | | | | | | | | | W2K3 DC's can have IPv6 addresses but won't serve krb5/ldap or cldap on those addresses. Make sure when we're asking for DC's we prefer IPv4. If you have an IPv6-only network this prioritizing code will be a no-op. And if you have a mixed network then you need to prioritize IPv4 due to W2K3 DC's. Jeremy.
* Remove an unused talloc context.Jeremy Allison2009-07-161-8/+2
| | | | Jeremy.
* Tidyup prompted by #6554 - Wrong deallocation in sam_account_ok.Jeremy Allison2009-07-161-2/+3
| | | | Jeremy.
* s3:smbd: move more session specific globals to struct smbd_server_connectionStefan Metzmacher2009-06-032-5/+9
| | | | metze
* s3:smbd: move negprot related globals to struct smbd_server_connectionStefan Metzmacher2009-06-031-11/+15
| | | | metze
* s3/auth map NULL domains to our global sam nameSteven Danneman2009-05-281-9/+3
| | | | | | | | | | | | | | This is an addendum to d8c54fdd, which made make_user_info_map() match Windows behavior by mapping untrusted domains given to smbd on the wire with the users credentials to smbd's global sam name. This fix was being circumvented in the case where the client passed a NULL domain. Vista clients do this. In that case smbd was always remapping the name to the machine workgroup. The NULL domain case should also be mapped to the global sam name. Removing the code in this patch, causes us to fall down to the logic added in d8c54fdd and properly map the domain.
* s3 auth: Make debug message louder and more usefulDan Sledz2009-05-121-2/+3
|
* Fix a bunch of compiler warnings about wrong format types.Jeremy Allison2009-05-111-5/+5
| | | | | Should make Solaris 10 builds look cleaner. Jeremy.
* s3-auth: use full 16byte session key in make_user_info_netlogon_interactive().Günther Deschner2009-05-071-2/+1
| | | | | | | | | | | | | | | | | | | Patch from Jeremy. With this patch, I was able to join Windows 7 RC to a Samba3 DC, and login into a Samba 3 Domain. There are still two registry settings required: HKLM\System\CCS\Services\LanmanWorkstation\Parameters DWORD DomainCompatibilityMode = 1 DWORD DNSNameResolutionRequired = 0 Do *not* modify the other netlogon registry parameters that were passed around, they weaken security. Guenther (cherry picked from commit b5097d54cb74ca0ea328f9e029562f65f4a01134)
* Fix bug #6291 - force user stop working.Jeremy Allison2009-04-281-1/+37
| | | | | | | A previous fix broke the invariant that *uid is always initialized on return from create_token_from_username(). Restore it. Jeremy.
* s3:auth Fix segfault: Always initialise returned session keysAndrew Bartlett2009-04-191-1/+3
|
* Make Samba3 use the new common libcli/auth codeAndrew Bartlett2009-04-142-12/+44
| | | | | This is particuarly in the netlogon client (but not server at this stage)
* Rework Samba3 to use new libcli/auth code (partial)Andrew Bartlett2009-04-144-2/+6
| | | | | | | | | | | This commit is mostly to cope with the removal of SamOemHash (replaced by arcfour_crypt()) and other collisions (such as changed function arguments compared to Samba3). We still provide creds_hash3 until Samba3 uses the credentials code in netlogon server Andrew Bartlett
* s3-auth: rename static smb_create_user(). Sorry...Günther Deschner2009-04-011-2/+2
| | | | Guenther
* s3: fix guest auth when winbindd is runningSteven Danneman2009-02-261-7/+7
| | | | | | | | | | | | | | | This fix is very subtle. If a server is configured with "security = share" and "guest ok = yes" and winbindd is running authorization will fail during tree connect. This is due to our inability to map the guest sid S-1-5-21-X-501 to a uid through sid_to_uid(). Winbindd is unaware of the hard coded mapping between this sid and whatever uid the name in lp_guestaccount() is assigned. So sid_to_uid() fails and we exit create_token_from_username() without ever calling pdb_getsampwsid() which IS aware of the hard coded mapping. This patch just reorganizes the code, moving sid_to_uid() down to the block of code in which it is needed, avoiding this early failure.
* s3: Fix 'assignment differ in signedness' warningTim Prouty2009-02-251-1/+1
|
* s3: Rename auth_onefs_wb and pdb_onefs_samDan Sledz2009-02-241-7/+23
| | | | | | | auth_onefs_wb.c -> auth_wbc.c pdb_onefs_sam.c -> pdb_wbc_sam.c No changes to functionality
* Revert "s3 auth: Add parameter that forces every user through an NSS lookup"Tim Prouty2009-02-211-22/+4
| | | | | | | | After the discussion on samba-technical, it was decided that the best answer for now was to revert this change. The right way to do this is to rewrite the token api to use opaque tokens with pluggable modules. This reverts commit 8e19a288052bca5efdb0277a40c1e0fdd099cc2b.
* Fix the build on SolarisVolker Lendecke2009-02-211-1/+1
|
* Fix some nonempty blank linesVolker Lendecke2009-02-211-31/+31
|
* Remove the static "chal" from ntlmssp.c:get_challenge()Volker Lendecke2009-02-213-10/+15
|
* Introduce a new authentication backend auth_onefs_wbDan Sledz2009-02-201-0/+134
| | | | | | | This new backend is custom tailored to onefs' unique requirements: 1) No fallback logic 2) Does not validate the domain of the user 3) Handles unencrypted passwords
* s3 auth: Add parameter that forces every user through an NSS lookupZach Loafman2009-02-161-4/+22
| | | | | | When set to yes, "force username map" forces every user, even AD users, through an NSS lookup. This allows the token to be overridden with information from NSS in certain broken environments.
* s3:auth: only create_local_token() should add S-1-22-X-Y sidsStefan Metzmacher2009-02-131-27/+0
| | | | metze
* s3:auth: add S-1-22-X-Y sids to the local tokenStefan Metzmacher2009-02-131-0/+38
| | | | metze
* s3: Added new parameter "map untrusted to domain"Steven Danneman2009-02-121-4/+8
| | | | | | | When enabled this reverts smbd to the legacy domain remapping behavior when a user provides an untrusted domain This partially reverts d8c54fdd
* s3: Change behavior when seeing an unknown domain.Dan Sledz2009-02-111-22/+35
| | | | | | | After a lot of testing against various Windows servers (W2K, W2K3, W2K8), within an AD domain it seems that unknown domains will only be translated to the local account domain, not the netbios name of the member server's domain. This makes samba act more like Windows.
* Fix double free caused by incorrect talloc_steal usage.Dan Sledz2009-02-111-2/+2
|
* S3: Fixes for coverity issues.todd stecher2009-02-101-2/+2
|
* Fix some nonempty blank linesVolker Lendecke2009-02-101-9/+9
|
* Fix a valgrind error: rpc_bind talloc_move()s the auth structVolker Lendecke2009-02-041-2/+0
|
* Ensure null termination of the password in mymachinepw, remove a debugVolker Lendecke2009-02-041-3/+1
|
* Memory leaks and other fixes found by Coveritytodd stecher2009-01-211-1/+3
|
* Fix a typoVolker Lendecke2009-01-211-1/+1
|
* Fix some nonempty blank linesVolker Lendecke2009-01-201-9/+9
|
* Make cli_negprot return NTSTATUS instead of boolVolker Lendecke2008-12-191-3/+6
|
generated by cgit (git 2.34.1) at 2025-05-15 06:36:12 +0000