summaryrefslogtreecommitdiffstats
path: root/source4/auth/ntlm
Commit message (Collapse)AuthorAgeFilesLines
* s4:auth Change auth_generate_session_info to take flagsAndrew Bartlett2010-05-201-1/+7
| | | | | | | | | | | | | | This allows us to control what groups should be added in what use cases, and in particular to more carefully control the introduction of the 'authenticated' group. In particular, in the 'service_named_pipe' protocol, we do not have control over the addition of the authenticated users group, so we key of 'is this user the anonymous SID'. This also takes more care to allocate the right length ptoken->sids Andrew Bartlett
* s4:auth Push check for messaging context into winbind backendAndrew Bartlett2010-05-202-5/+5
| | | | | | | If we don't use the winbind backend, we don't (for now) need a messaging context- and we don't have one in LDB at the moment. Andrew Bartlett
* s4:auth Add dependency from the operational module onto authAndrew Bartlett2010-05-203-7/+33
| | | | | | | We had to split up the auth module into a module loaded by main deamon and a subsystem we manually init in the operational module. Andrew Bartlett
* s4:auth Allow the operational module to get a user's tokenGroups from authAndrew Bartlett2010-05-202-36/+120
| | | | | | | | This creates a new interface to the auth subsystem, to allow an auth_context to be created from the ldb, and then tokenGroups to be calculated in the same way that the auth subsystem would. Andrew Bartlett
* s3: Remove use of iconv_convenience.Jelmer Vernooij2010-05-181-1/+0
|
* Finish removal of iconv_convenience in public API's.Jelmer Vernooij2010-05-181-7/+4
|
* s4:auth Change auth_generate_session_info to take an auth contextAndrew Bartlett2010-04-143-14/+18
| | | | | | | | | | | | | | | | | | The auth context was in the past only for NTLM authentication, but we need a SAM, an event context and and loadparm context for calculating the local groups too, so re-use that infrustructure we already have in place. However, to avoid problems where we may not have an auth_context (in torture tests, for example), allow a simpler 'session_info' to be generated, by passing this via an indirection in gensec and an generate_session_info() function pointer in the struct auth_context. In the smb_server (for old-style session setups) we need to change the async context to a new 'struct sesssetup_context'. This allows us to use the auth_context in processing the authentication reply . Andrew Bartlett
* lib/replace/wscript: inline LIBREPLACE_EXT into 'replace' as the autoconf ↵Stefan Metzmacher2010-04-121-1/+1
| | | | | | system does metze
* s4:auth/ntlm/auth_developer.c - "fixed_challenge_get_challenge" - fix the ↵Matthias Dieter Wallnöfer2010-04-061-5/+2
| | | | | | assignment of the challenge This is a string buffer and not a DATA_BLOB.
* s4-waf: more dependencies on tallocAndrew Tridgell2010-04-061-1/+2
| | | | | these are needed so we can support a system talloc without using the bundled talloc.h
* s4-waf: mark the wscript files as python so vim/emacs knows how to highlight ↵Andrew Tridgell2010-04-061-0/+2
| | | | them
* s4-waf: remove the need for some of the lib aliasesAndrew Tridgell2010-04-061-1/+1
|
* build: waf quicktest nearly worksAndrew Tridgell2010-04-061-5/+1
| | | | | Rewrote wafsamba using a new dependency handling system, and started adding the waf test code
* build: commit all the waf build files in the treeAndrew Tridgell2010-04-061-0/+64
|
* s4-dsdb: added dsdb_search_one() and cleanup dsdb_find_dn_by_guid()Andrew Tridgell2010-02-161-4/+6
| | | | | | | | dsdb_find_dn_by_guid() now takes a struct GUID instead of a guid_string. All the callers in fact wanted a struct GUID, so we now avoid the extra conversion. Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4:auth: make auth_challenge_may_be_modified() publicStefan Metzmacher2009-12-291-1/+1
| | | | metze
* s4:auth: remove autogenerated auth/ntlm/auth_proto.hStefan Metzmacher2009-12-291-50/+0
| | | | metze
* s4:auth: change auth_check_password_send/recv to tevent_reqStefan Metzmacher2009-12-242-108/+136
| | | | metze
* s4:auth Change 'get_challenge' API to be more like Samba3Andrew Bartlett2009-12-225-29/+23
| | | | | | | It is just easier to fill in the known to be 8 byte challenge than stuff about with allocated pointers. Andrew Bartlett
* s4:auth generate the prototype file in the right placeAndrew Bartlett2009-12-221-1/+1
|
* s4-gensec: Replace gensec_get_peer_addr with new tsocket based fn.Andreas Schneider2009-12-162-3/+5
|
* s4-dsdb: create a static system_session contextAndrew Tridgell2009-10-231-2/+2
| | | | | | This patch adds a system_session cache, preventing us from having to recreate it on every ldb open, and allowing us to detect when the same session is being used in ldb_wrap
* s4: ran minimal_includes.pl on source4/auth/ntlmAndrew Tridgell2009-10-206-14/+0
|
* s4:auth_sam: Restructure tail in "authsam_get_server_info_principal" and fix ↵Matthias Dieter Wallnöfer2009-10-161-3/+8
| | | | a memory leak
* added a uid_wrapper libraryAndrew Tridgell2009-08-051-1/+1
| | | | | | | | | | | | | | | | | | | | This library intercepts seteuid and related calls, and simulates them in a manner similar to the nss_wrapper and socket_wrapper libraries. This allows us to enable the vfs_unixuid NTVFS module in the build farm, which means we are more likely to catch errors in the token manipulation. The simulation is not complete, but it is enough for Samba4 for now. The major areas of incompleteness are: - no emulation of setreuid, setresuid or saved uids. These would be needed for use in Samba3 - no emulation of ruid changing. That would also be needed for Samba3 - no attempt to emulate file ownership changing, so code that (for example) tests whether st.st_uid matches geteuid() needs special handling
* s4:kerberos Add support for user principal names in certificatesAndrew Bartlett2009-07-281-1/+1
| | | | | | | | | | | | | | This extends the PKINIT code in Heimdal to ask the HDB layer if the User Principal Name name in the certificate is an alias (perhaps just by case change) of the name given in the AS-REQ. (This was a TODO in the Heimdal KDC) The testsuite is extended to test this behaviour, and the other PKINIT certficate (using the standard method to specify a principal name in a certificate) is updated to use a Administrator (not administrator). (This fixes the kinit test). Andrew Bartlett
* s4 auth_winbind: Internally, info3 has utf8 buffers, not utf16 buffers.Kai Blin2009-06-251-63/+16
| | | | Thanks to gd for the catch.
* s4 auth_winbind: Don't allocate the rids for the info3 structure within the loopKai Blin2009-06-251-4/+4
|
* s4: Add libwbclient backend to auth_winbindKai Blin2009-06-252-1/+216
|
* s4:kdc Allow a password change when the password is expiredAndrew Bartlett2009-06-181-1/+1
| | | | | | | | | | | | | | This requires a rework on Heimdal's windc plugin layer, as we want full control over what tickets Heimdal will issue. (In particular, in case our requirements become more complex in future). The original problem was that Heimdal's check would permit the ticket, but Samba would then deny it, not knowing it was for kadmin/changepw Also (in hdb-samba4) be a bit more careful on what entries we will make the 'change_pw' service mark that this depends on. Andrew Bartlett
* changed the auth path to use extended DN ops to avoid non-indexed searchesAndrew Tridgell2009-06-041-28/+19
| | | | | | | | | | | | | | | | | | Logs showed that every SAM authentication was causing a non-indexed ldb search for member=XXX. This was previously indexed in Samba4, but since we switched to using the indexes from the full AD schema it now isn't. The fix is to use the extended DN operations to allow us to ask the server for the memberOf attribute instead, with with the SIDs attached to the result. This also means one less search on every authentication. The patch is made more complex by the fact that some common routines use the result of these user searches, so we had to update all searches that uses user_attrs and those common routines to make sure they all returned a ldb_message with a memberOf filled in and the SIDs attached.
* Don't use crossRef records to find our own domainAndrew Bartlett2009-05-261-118/+26
| | | | | | | | A single AD server can only host a single domain, so don't stuff about with looking up our crossRef record in the cn=Partitions container. We instead trust that lp_realm() and lp_workgroup() works correctly. Andrew Bartlett
* fixed interpretation of ACB_PWNOTREQAndrew Tridgell2009-05-251-14/+0
| | | | | | This bit actually means that we should ignore the minimum password length field for this user. It doesn't mean that the password should be seen as empty
* Port Samba4 to the new combined libcli/auth functionsAndrew Bartlett2009-04-142-6/+1
| | | | | | | For example, some of the new shared functionality was previously in the wkssvc torture test. Andrew Bartlett
* Move ntlm_check.h into the common libcli/authAndrew Bartlett2009-04-141-76/+0
|
* Move libcli/auth to the top levelAndrew Bartlett2009-04-141-603/+0
|
* s4: Use same function signature for convert_* as s3.Jelmer Vernooij2009-03-011-1/+1
|
* Add allow_badcharcnv argument to all conversion function, forJelmer Vernooij2009-03-011-1/+1
| | | | consistency with Samba 3.
* Push sam_get_server_info_principal into the auth subsystemAndrew Bartlett2009-02-133-10/+87
| | | | | | | | | This means it must be accessed via the supplied auth_context in the GENSEC server, and should remove the hard depenceny of GENSEC on the auth subsystem and ldb (allowing LDB not to rely on LDB is considered a good thing, apparently) Andrew Bartlett
* Remove auth/ntlm as a dependency of GENSEC by means of function pointers.Andrew Bartlett2009-02-131-0/+7
| | | | | | | | | | | When starting GENSEC on the server, the auth subsystem context must be passed in, which now includes function pointers to the key elements. This should (when the other dependencies are fixed up) allow GENSEC to exist as a client or server library without bundling in too much of our server code. Andrew Bartlett
* s4:auth/ntlm: fix c++ warningStefan Metzmacher2009-02-051-1/+1
| | | | metze
* s4:auth: move make_server_info_netlogon_validation() function arroundStefan Metzmacher2009-01-211-1/+1
| | | | metze
* s4:lib/tevent: rename structsStefan Metzmacher2008-12-292-5/+5
| | | | | | | | | | | | | | | | | | | | list="" list="$list event_context:tevent_context" list="$list fd_event:tevent_fd" list="$list timed_event:tevent_timer" for s in $list; do o=`echo $s | cut -d ':' -f1` n=`echo $s | cut -d ':' -f2` r=`git grep "struct $o" |cut -d ':' -f1 |sort -u` files=`echo "$r" | grep -v source3 | grep -v nsswitch | grep -v packaging4` for f in $files; do cat $f | sed -e "s/struct $o/struct $n/g" > $f.tmp mv $f.tmp $f done done metze
* s4: Always link in auth, as some of the core infrastructure depends on it.Jelmer Vernooij2008-12-221-0/+1
|
* s4:kdc: allow a trusted domain to get kerberos ticketsStefan Metzmacher2008-12-041-1/+2
| | | | metze
* Remove another use of global_loadparm.Jelmer Vernooij2008-11-021-0/+1
| | | | | | Eventually, we should move some of these parameters into a separate struct (perhaps into smb_transport_options?), to avoid the long lists of parameters.
* Add gensec_settings structure. This wraps loadparm_context for now, butJelmer Vernooij2008-11-021-0/+1
| | | | should in the future only contain some settings required for gensec.
* Remove another use of global_loadparm.Jelmer Vernooij2008-11-021-0/+1
|
* Remove use of lp_*() from ntlm_check.c.Jelmer Vernooij2008-11-013-16/+18
|
* Remove iconv_convenience argument from convert_string{,talloc}() butJelmer Vernooij2008-10-241-1/+1
| | | | make them wrappers around convert_string{,talloc}_convenience().
generated by cgit (git 2.34.1) at 2025-09-26 23:14:46 +0000