summaryrefslogtreecommitdiffstats
path: root/source4/auth
Commit message (Collapse)AuthorAgeFilesLines
* s4:gensec/schannel: remove unused talloc_reference() in schannel_update()Stefan Metzmacher2009-10-241-1/+1
| | | | | | We never expose creds to the caller in schannel_update(). metze
* s4-python: we need to include Python.h firstAndrew Tridgell2009-10-232-2/+2
| | | | | If we don't include Python.h first then we get a pile of warnings due to broken redefines of XOPEN_SOURCE in the Python includes.
* s4:gensec Use an index on computerName in schannel.ldbAndrew Bartlett2009-10-231-1/+4
|
* s4-ldbwrap: added re-use of ldb contexts in ldb_wrap_connect()Andrew Tridgell2009-10-231-1/+1
| | | | | | | | | This allows us to reuse a ldb context if it is open twice, instead of going through the expensive process of a full ldb open. We can reuse it if all of the parameters are the same. The change relies on callers using talloc_unlink() or free of a parent to close a ldb context.
* s4-dsdb: create a static system_session contextAndrew Tridgell2009-10-236-12/+27
| | | | | | This patch adds a system_session cache, preventing us from having to recreate it on every ldb open, and allowing us to detect when the same session is being used in ldb_wrap
* s4: ran minimal_includes.pl on source4/auth/gensecAndrew Tridgell2009-10-206-12/+0
|
* s4: ran minimal_includes.pl on source4/auth/ntlmsspAndrew Tridgell2009-10-204-8/+0
|
* s4: ran minimal_includes.pl on source4/auth/ntlmAndrew Tridgell2009-10-206-14/+0
|
* s4:auth - fixed problem reading bind DN from secrets databaseEndi S. Dewata2009-10-162-0/+8
|
* s4:auth_sam: Restructure tail in "authsam_get_server_info_principal" and fix ↵Matthias Dieter Wallnöfer2009-10-161-3/+8
| | | | a memory leak
* s4:ntlmssp server - use also here the new "lp_dnsdomain()" callMatthias Dieter Wallnöfer2009-10-151-2/+1
|
* s4:auth/credentials/credentials - fix uninitalised pointersMatthias Dieter Wallnöfer2009-10-151-7/+35
| | | | This should fix bug #6755.
* s4: Changes the old occurences of "lp_realm" in "lp_dnsdomain" where neededMatthias Dieter Wallnöfer2009-10-142-18/+9
| | | | | | For KERBEROS applications the realm should be upcase (function "lp_realm") but for DNS ones it should be used lowcase (function "lp_dnsdomain"). This patch implements the use of both in the right way.
* s4-pygensec: a bit closer to workingAndrew Tridgell2009-10-023-9/+56
| | | | | I'll need help from Andrew on how to get gensec to initialise it's ops element
* gensec: Avoid exposing lp_ctx on the API level.Jelmer Vernooij2009-09-263-14/+12
|
* pygensec: Add initial work on a gensec Python module.Jelmer Vernooij2009-09-263-0/+184
|
* s4:auth/gensec/schannel - fix a const warningMatthias Dieter Wallnöfer2009-09-251-1/+2
|
* s4:schannel: fix some compiler warningsStefan Metzmacher2009-09-251-2/+4
| | | | | | If we only do signing we can pass down a const data buffer. metze
* s4-auth: add SID_NT_ENTERPRISE_DCS is a server trust accountAndrew Tridgell2009-09-191-1/+13
|
* s4-sam: add a note about the solaris clientAndrew Tridgell2009-09-171-0/+2
|
* spnego: Support ASN.1 BIT STRING and use it in SPNEGO.Kouhei Sutou2009-09-171-2/+4
| | | | Signed-off-by: Günther Deschner <gd@samba.org>
* spnego: share spnego_parse.Günther Deschner2009-09-174-475/+2
| | | | Guenther
* libcli/auth: rewrite schannel sign/seal code to be more genericStefan Metzmacher2009-09-161-33/+56
| | | | | | This prepares support for HMAC-SHA256/AES. metze
* schannel: move schannel_sign to main directory.Günther Deschner2009-09-164-312/+3
| | | | Guenther
* s4-schannel: try to fix the build.Günther Deschner2009-09-161-1/+1
| | | | Guenther
* s4-schannel: first step of decoupling schannel from gensec.Günther Deschner2009-09-162-20/+51
| | | | Guenther
* s4-schannel: strip trailing whitespace.Günther Deschner2009-09-161-36/+36
| | | | Guenther
* s4-schannel: use NL_AUTH_MESSAGE for schannel.Günther Deschner2009-09-131-23/+35
| | | | Guenther
* s4-schannel: strip trailing whitespace.Günther Deschner2009-09-131-26/+26
| | | | Guenther
* Added "admin_session" method.Nadezhda Ivanova2009-09-093-0/+218
| | | | | | The purpose of admin_session is to be able to execute parts of provisioning as the user Administrator in order to have the correct group and owner in the security descriptors. To be used for provisioning and tests only.
* s4:sam - Implement also here the right primary group behaviourMatthias Dieter Wallnöfer2009-09-071-46/+71
| | | | | | | We have not only to expand the additional groups but *also* the primary group to gain all rights of a user account. Also, remove an unneeded context (tmp_ctx) and "talloc_steal".
* s4: include ntlmssp header in auth/ntlmssp/ntlmssp.h.Günther Deschner2009-08-281-0/+1
| | | | Guenther
* s4-ntlmssp: use interface constants in TargetInfo blob.Günther Deschner2009-08-281-5/+5
| | | | Guenther
* s4-ntlmssp: use NTLMSSP headers from IDL and remove duplicate constants.Günther Deschner2009-08-285-50/+21
| | | | Guenther
* s4-schannel: add ldb suffix to schannel functions.Günther Deschner2009-08-271-2/+2
| | | | Guenther
* s4:kerberos Use MIT compatible names for these enc typesAndrew Bartlett2009-08-211-1/+1
| | | | | | | | | This is a small start on (ie, the only trivial part of) the work shown in: http://k5wiki.kerberos.org/wiki/Projects/Samba4_Port#Samba.27s_use_of_Heimdal_symbols.2C_with_MIT_differences (a table of all Kerberos symbols used in Samba4, and notes on where they differ from those provided with MIT Kerberos) Andrew Bartlett
* added a uid_wrapper libraryAndrew Tridgell2009-08-051-1/+1
| | | | | | | | | | | | | | | | | | | | This library intercepts seteuid and related calls, and simulates them in a manner similar to the nss_wrapper and socket_wrapper libraries. This allows us to enable the vfs_unixuid NTVFS module in the build farm, which means we are more likely to catch errors in the token manipulation. The simulation is not complete, but it is enough for Samba4 for now. The major areas of incompleteness are: - no emulation of setreuid, setresuid or saved uids. These would be needed for use in Samba3 - no emulation of ruid changing. That would also be needed for Samba3 - no attempt to emulate file ownership changing, so code that (for example) tests whether st.st_uid matches geteuid() needs special handling
* s4: Change my nested groups patch to don't include user's SID itself in the ↵Matthias Dieter Wallnöfer2009-08-041-17/+24
| | | | "groupSID"s structure
* Return infinite time for last last logoff when last logoff = 0Matthieu Patou2009-08-032-2/+2
|
* s4:auth: make sure we have elements returned at all in ↵Stefan Metzmacher2009-07-311-0/+6
| | | | | | authsam_expand_nested_groups() metze
* s4: Patch to implement nested group and privilegesMatthias Dieter Wallnöfer2009-07-311-34/+100
| | | | | | | | | This patch adds a function "authsam_expand_nested_groups" (calculation of rights through expanding groups of a certain SID) which basically collects all memberships through "memberOf" attributes. It works with either user or group SIDs. For avoiding loops it tests on each call if the SID hasn't been added yet (through the helper function "sids_contains_sid"). The function itself is called by "authsam_make_server_info".
* s4:gensec/spnego: only generate the mechListMic when the server expects itStefan Metzmacher2009-07-281-1/+2
| | | | | | This fixes the ntvfs.cifs tests. metze
* s4:kerberos Add support for user principal names in certificatesAndrew Bartlett2009-07-282-3/+5
| | | | | | | | | | | | | | This extends the PKINIT code in Heimdal to ask the HDB layer if the User Principal Name name in the certificate is an alias (perhaps just by case change) of the name given in the AS-REQ. (This was a TODO in the Heimdal KDC) The testsuite is extended to test this behaviour, and the other PKINIT certficate (using the standard method to specify a principal name in a certificate) is updated to use a Administrator (not administrator). (This fixes the kinit test). Andrew Bartlett
* s4:kerberos Add 'net export keytab' command for wireshark decryptionAndrew Bartlett2009-07-282-1/+148
| | | | | | | | | | | | It is much easier to do decryption with wireshark when the keytab is available for every host in the domain. Running 'net export keytab <keytab name>' will export the current (as pointed to by the supplied smb.conf) local Samba4 doamin. (This uses Heimdal's 'hdb' keytab and then the existing hdb-samba4, and so has a good chance of keeping working in the long term). Andrew Bartlett
* Revert "s4:kerberos Add 'net export keytab' command for wireshark decryption"Stefan Metzmacher2009-07-272-148/+1
| | | | | | | | | | This reverts commit a40ce5d0d9d06f592a8885162bbaf644006b9f0f. This breaks the build... Andrew, please repush it, when it's fixed:-) metze
* s4:kerberos Add 'net export keytab' command for wireshark decryptionAndrew Bartlett2009-07-272-1/+148
| | | | | | | | | | | | It is much easier to do decryption with wireshark when the keytab is available for every host in the domain. Running 'net export keytab <keytab name>' will export the current (as pointed to by the supplied smb.conf) local Samba4 doamin. (This uses Heimdal's 'hdb' keytab and then the existing hdb-samba4, and so has a good chance of keeping working in the long term). Andrew Bartlett
* s4:gensec_gssapi: pass the correct oid to the gssapi layer.Stefan Metzmacher2009-07-241-4/+11
| | | | metze
* s4:gensec/spengo: make sure we send the blob with the micListMech signature ↵Stefan Metzmacher2009-07-241-1/+1
| | | | | | | | to the peer We should even do this if the submech has no more data to send. metze
* s4:kdc Rework KDC to pull in less attributes for krbtgt lookupsAndrew Bartlett2009-07-172-15/+29
| | | | | | | | | Each attribute we request from LDB comes with a small cost, so don't lookup any more than we must for the (very) frequent krbtgt lookup case. Similarly, we don't need to build a PAC for a server (as a target), so don't ask for the PAC attributes here either. Andrew Bartlett
* s4:gensec Rework gensec_krb5 mutual authentication defaultsAndrew Bartlett2009-07-161-24/+28
| | | | | | | | When emulating Samba3 (which we do to ensure we don't break compatability), don't do mutual authentication by default, as it breaks the session key with AES and isn't what Samba3 does anyway. Andrew Bartlett
generated by cgit (git 2.34.1) at 2025-09-25 18:36:10 +0000