summaryrefslogtreecommitdiffstats
path: root/source3/winbindd
Commit message (Collapse)AuthorAgeFilesLines
* s3:winbindd/nss_info: remove unused variable from nss_init()Michael Adam2008-12-011-1/+0
| | | | Michael
* s3:winbindd/nss_info: make nss_domain_list_add_domain() staticMichael Adam2008-12-011-2/+2
| | | | Michael
* s3:winbindd/nss_info: fix default backend handling for ad backends.Michael Adam2008-12-011-23/+61
| | | | | | | | | | | | | This fixes "winbind nss info = rfc2307" (or sfu or sfu20). Originally, only explicitly configured domains (like "rfc2307:domain") worked with the ad module, since the domain name was not passed backe to the module. This is fixed by recording the first backend listed without domain in the "winbind nss info" parameter as the default backend, and creating new nss_domain entries (using this default backend) on the fly as requests for domains which are not explicitly configured are encountered. Michael
* s3:winbindd/nss_info: whitespace cleanup.Michael Adam2008-12-011-35/+33
| | | | | | Remove trailing spaces and fix tab / space mixup. Michael
* s3:winbindd_cache: add debugging to get_nss_info_cached()Michael Adam2008-12-011-0/+7
| | | | Michael
* s3:winbindd/nss_info: add entry debug message to nss_get_info()Michael Adam2008-12-011-0/+3
| | | | Michael
* s3:winbindd/nss_info: add debugging to nss_init()Michael Adam2008-12-011-0/+7
| | | | Michael
* s3:winbindd/idmap_ad: add entry debug message to nss_ad_get_info()Michael Adam2008-12-011-0/+3
| | | | Michael
* s3:winbindd/idmap_ad: add support for trusted domains to idmap_ad (bug #3661)Michael Adam2008-12-011-126/+221
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This initial fix does at least work for explicitly configured domains. The patch has a few disadvantages: 1. It does work only for explicitly configured domains, not with the default backend (idmap backend = ad), since it relies on the domain name being passed in via the idmap_domain. One workaround for this would be to create clones of the default idmap_domain for domains not explicitly configured. 2. It calls find_domain_from_name_noinit() from idmap_ad_cached_connection. The problem here is that only the NetBIOS domain name (workgroup name) is passed in via the idmap_domain struct, and the module has to establish a connection to the domain based on that information. find_domain_from_name_noinit() has the disadvantage that it uses the state of the domain list at fork time (unless used from the main winbindd). But this should be ok as long as the primary domain was reachable at start time. For nss_info, the situation is similar - This will only work for domains explicitly configured in smb.conf as follows: "winbind nss info = rfc2307:dom1 sfu:dom2 rfc2307:dom3 template:dom4" Setting the default nss info to one of the ad backends (rfc2307, sfu, sfu20) will fail since the domain name is not passed in with the nss_domain_entry. Michael
* s3:winbindd/idmap_ad: refactor core of nss_{sfu|sfu20|rfc2307}_init to ↵Michael Adam2008-12-011-34/+48
| | | | | | common function. Michael
* s3:winbindd/idmap_ad: rename ctx to mem_ctx in nss_ad_get_info()Michael Adam2008-12-011-8/+8
| | | | | | in preparation to using the idmap_ad_context there Michael
* s3:winbindd/idmap: add diagnostic entry debug msg to ↵Michael Adam2008-12-011-0/+3
| | | | | | idmap_backends_sid_to_unixid Michael
* s3:winbindd/idmap: add diagnostic entry debug msg to ↵Michael Adam2008-12-011-0/+4
| | | | | | idmap_backends_unixid_to_sid Michael
* s3:winbindd/idmap: add diagnostic entry debug msg to idmap_find_domain().Michael Adam2008-12-011-0/+3
| | | | Michael
* s3:winbindd/idmap_util: unify entering debug messages and add ouput of domainMichael Adam2008-12-011-4/+8
| | | | Michael
* s3:winbindd/nss_info: change nss_map_{to|from}_alias to take nss_domain_entryMichael Adam2008-12-015-18/+18
| | | | | | instead of just the domain name Michael
* Revert "UNFINISHED - s3:idmap_ad: multi-domain"Michael Adam2008-11-251-83/+69
| | | | | | | | This reverts commit 6a4957d35d50e6508917aca62b282ae4904187c8. Sorry - this got accidentially pushed. Michael
* UNFINISHED - s3:idmap_ad: multi-domainMichael Adam2008-11-251-69/+83
| | | | Michael
* s3-winbindd: make all winbind rpc-methods static.Michael Adam2008-11-212-65/+32
| | | | | | | Now that the methods are no longer needed in winbindd_ads, we can make them static again. Michael
* s3-winbindd_ads: use the reconnect methods instead of the rpc methods directlyMichael Adam2008-11-211-6/+75
| | | | | | | | | | Some of the ads methods just point to the rpc methods. This makes winbindd_ads use the reconnect methods instead of calling the rpc methods directly in order to prevent negative cache entries for e.g. name_to_sid, when the dc has closed the connection without sending a reset. Michael
* s3-winbindd_ads: prevent negative GM/ cache entries due to broken connectionsMichael Adam2008-11-211-0/+23
| | | | | | | | | | | | | | The ads lookup_groupmem() function calls lda_lookupsids to resolve sids to names. This is tried only once. So in case the connection was broken, e.g. closed by the server (without a reset packet), there will be an empty GM/ cache entry for the requested group which will prevent proper working of access checks among other checks for the expiry period. This patch works around this problem by retrying once if the lsa_lookupsids call fails, re-establishing the dc-connection, as we already do in many other places (e.g. the winbindd retry methods for the rpc layer). Michael
* s3-winbindd: for now only change machine pwd when not using a system krb5 ↵Günther Deschner2008-11-211-0/+1
| | | | | | keytab. Guenther
* Clean-up various trailing space and >80 column lines.Steven Danneman2008-11-183-21/+33
|
* Added ability to remove id mappings in wbinfo and libwbclient.Steven Danneman2008-11-186-2/+141
| | | | | | | | | | | | | | | | | The idmap_tdb backend already provides an interface to remove existing id mappings. This commit plumbs that ability up through, winbindd, libwbclient, and wbinfo. Added new winbindd command: WINBINDD_REMOVE_MAPPING Added new libwbclient interfaces: wbcRemoveUidMapping() and wbcRemoveGidMapping() Added new wbinfo options: --remove-uid-mapping --remove-gid-mapping Increased libwbclient version to 0.2 Increased winbind interface version to 20
* Fix extended DN parse error when AD object does not have a SID.Steven Danneman2008-11-181-18/+37
| | | | | | | | | | | Some AD objects, like Exchange Public Folders, can be members of Security Groups but do not have a SID attribute. This patch adds more granular return errors to ads_get_sid_from_extended_dn(). Callers can now determine if a parse error occured because of bad input, or the DN was valid but contained no SID. I updated all callers to ignore SIDless objects when appropriate. Also did some cleanup to the out paths of lookup_usergroups_memberof()
* Whitespace and >80 column cleanups.Steven Danneman2008-11-182-39/+41
|
* Fix bug #5906 when running winbindd on a Samba PDC. Winbindd crash on ↵Davide Sfriso2008-11-171-2/+2
| | | | | | 'getent group' Jeremy.
* s3-winbindd: workaround for samr_ChangePasswordUser3 to User2 fallback for ↵Günther Deschner2008-11-131-0/+6
| | | | | | w2k dcs. Guenther
* Fix memory leak in error path, spotted by Martin Zielinski <mz@seh.de>.Jeremy Allison2008-11-121-0/+1
| | | | Jeremy.
* s3-samr-idl: cleanup.Günther Deschner2008-11-101-0/+2
| | | | Guenther
* ntlm_auth: Put huge NTLMv2 blobs into extra_data on CRAP auth.Kai Blin2008-11-101-7/+18
| | | | This fixes bug #5865
* s3: fix a few "shadows a global declaration" warningsTim Prouty2008-11-033-14/+14
|
* [s3]winbindd: speed up fill_grent_mem (i.e. winbindd_getgrent) a lot.Michael Adam2008-11-021-13/+20
| | | | | | | | | | With large groups, getgrent ran into timeouts because after each single user that was added to the expanded group list, the list was sorted and made unique. Now the list is sorted just once after all members have been added. Michael
* Rename dos_errstr() to win_errstr() for consistency with Samba 4.Jelmer Vernooij2008-11-012-2/+2
|
* Coverity fix CID: 592 - null deref (can't happen but doesn't hurt to be sure).Jeremy Allison2008-10-291-1/+1
| | | | Jeremy.
* [s3]winbind: fix smbd hanging on Solaris when winbindd closes socket.Michael Adam2008-10-271-1/+6
| | | | | | | | | | | | | | | | | On some versions of Solaris, we observed a strange effect of close(2) on a socket: After the server (here winbindd) called close, the client fd was not marked as readable for select. And a write call to the fd did not produce an error EPIPE but just returned as if successful. So while winbindd had called remove_client(), the corresponding smbd still thought that it was connected, but failed to retrieve answers for its queries. This patch works around the problem by forcing the client fd to the readable state: Just write one byte into the socket before closing. Michael
* s3: fix simple "incompatible pointer type" build warningTim Prouty2008-10-231-1/+1
|
* Use sockaddr_storage only where we rely on the size, use sockaddrJelmer Vernooij2008-10-231-1/+1
| | | | | otherwise (to clarify we can also pass in structs smaller than sockaddr_storage, such as sockaddr_in).
* Fix a valgrind error in idmap_ad_sids_to_unixids()Volker Lendecke2008-10-201-0/+2
| | | | | | | | We need to initialize all mappings in case we don't find anything. Simo, please check! Volker
* Use separate make variables for libutil and libcrypto.Jelmer Vernooij2008-10-182-3/+3
|
* s3: fix various samr callers.Günther Deschner2008-10-151-1/+1
| | | | Guenther
* Remove smb_np_structVolker Lendecke2008-10-131-2/+0
|
* Cope with changed signature of http_timestring().Jelmer Vernooij2008-10-111-1/+1
|
* s3-winbindd: use new, richer structures in WINBINDD_DSGETDCNAME implementation.Günther Deschner2008-10-091-21/+40
| | | | Guenther
* Fix bug #5814 - Winbindd dumping core in a strange manner while doing ↵Jeremy Allison2008-10-081-0/+23
| | | | | | | | | | | | | | | | "rescan_trusted_domain". From analysis by hargagan <shargagan@novell.com> : "The winbindd_child_died() is also getting called from process_loop() in case of SIGCHLD signal. In this case it doesn't make the timeout_handler to NULL for the first request. It then initiate a new request using schedule_async_request() which installs a new timeout handler for the same request. In such a case, for a badly unresponsive system both the timeout handler can be called. For the first call the "private_data" will be cleared and for another call the timeout handler will be detecting the double free. So, for such a case as well, the winbindd_child_died() should make the timeout_handler to NULL." Jeremy.
* idmap_adex: Add more debugging to the basic search function.Gerald (Jerry) Carter2008-10-061-0/+18
| | | | Log the dn of all located entries in order to verify search results.
* idmap_adex: Add log messages to dc_add_domain for easier debugging.Gerald (Jerry) Carter2008-10-061-0/+8
| | | | Part of continue work on BUG 5806.
* Log in the parent winbind log where a request is goingVolker Lendecke2008-10-061-0/+4
|
* Fix use of DLIST_REMOVE as spotted by Constantine Vetoshev <gepardcv@gmail.com>.Jeremy Allison2008-10-011-2/+1
| | | | | | | | | | | | | | | | | This API is unusual in that if used to remove a non-list head it nulls out the next and prev pointers. This is what you want for debugging (don't want an entry removed from the list to be still virtually linked into it) but means there is no consistent idiom for use as the next and prev pointers get trashed on removal from the list, meaning you must save them yourself. You can use it one way when deleting everything via the head pointer, as this preserves the next pointer, but you *must* use it another way when not deleting everything via the head pointer. Fix all known uses of this (the main one is in conn_free_internal() and would not free all the private data entries for vfs modules. The other changes in web/statuspage.c and winbindd_util.c are not strictly neccessary, as the head pointer is being used, but I've done them for consistency. Long term we must revisit this as this API is too hard to use correctly. Jeremy.
* re-added "winbind:ignore domains" patchAndrew Tridgell2008-09-291-0/+17
| | | | | | | | | | | | This option really is essential, as we discover again and again at customer sites. Due to bugs in winbind some domains are toxic. When you are installing at a site and a particular domain in a complex setup causes winbind to segfault or hang then you need a way to disable that domain and continue. In an ideal world winbind could handle arbitrarily complex ADS domains, but we are nowhere near that yet. If we ever get to that stage then we won't need this option.
generated by cgit (git 2.34.1) at 2024-10-11 21:54:32 +0000