summaryrefslogtreecommitdiffstats
path: root/source4/auth
Commit message (Collapse)AuthorAgeFilesLines
...
* auth4: Remove unused wbc_contextVolker Lendecke2014-03-051-1/+0
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Change-Id: I07d9f7d8028429564d91da39f8d1e73cc13a646c Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth4: Do not generate just a temporary wbc_contextVolker Lendecke2014-03-051-10/+1
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Change-Id: I16e116d7f1fdaf165e1239c10723c51f3828126d Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth4: auth_session_info_fill_unix only needs a tevent_contextVolker Lendecke2014-03-052-3/+4
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Change-Id: Id453d68f57bd1dd15aa5778b317d258a6132d3d6 Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* auth4: security_token_to_unix_token only needs a tevent_contextVolker Lendecke2014-03-051-3/+3
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Change-Id: I27e5b38fcd3ac899c55c0632ea5d92fad686d9b1 Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* source4: Use wbc_sids_to_xidsVolker Lendecke2014-03-051-5/+1
| | | | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Change-Id: I86ea6587c436247ce66207c517f9c8d567ecac1d Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* Revert "source4: Use wbc_sids_to_xids"Volker Lendecke2014-02-181-1/+5
| | | | | | | This reverts commit de7122ddc356697777cce95d22b3fab7697b30db. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* Revert "auth4: security_token_to_unix_token only needs a tevent_context"Volker Lendecke2014-02-181-3/+3
| | | | | | | This reverts commit 1de725c2926b526200032c4f46132c17533986c7. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* Revert "auth4: auth_session_info_fill_unix only needs a tevent_context"Volker Lendecke2014-02-182-4/+3
| | | | | | | This reverts commit 75d7c4609c1c743f84ca9f2d0666aece9e5200d4. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* Revert "auth4: Do not generate just a temporary wbc_context"Volker Lendecke2014-02-181-1/+10
| | | | | | | This reverts commit 5124a9e1183de990ca3146cd355152094495a779. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* Revert "auth4: Remove unused wbc_context"Volker Lendecke2014-02-181-0/+1
| | | | | | | This reverts commit 6b04558c5e0547a807ac0fcb5eeb1085cfe602ac. Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
* s4:auth/gensec: only include "librpc/gen_ndr/dcerpc.h"Stefan Metzmacher2014-02-132-2/+2
| | | | | | | We only need some DCERPC_ defines. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Guenther Deschner <gd@samba.org>
* auth4: Remove unused wbc_contextVolker Lendecke2014-02-101-1/+0
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Kai Blin <kai@samba.org>
* auth4: Do not generate just a temporary wbc_contextVolker Lendecke2014-02-101-10/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Kai Blin <kai@samba.org>
* auth4: auth_session_info_fill_unix only needs a tevent_contextVolker Lendecke2014-02-102-3/+4
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Kai Blin <kai@samba.org>
* auth4: security_token_to_unix_token only needs a tevent_contextVolker Lendecke2014-02-101-3/+3
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Kai Blin <kai@samba.org>
* source4: Use wbc_sids_to_xidsVolker Lendecke2014-02-101-5/+1
| | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Kai Blin <kai@samba.org>
* samba:python - Py_RETURN_NONE remove compatibility code for releases < 2.4Matthias Dieter Wallnöfer2014-01-091-4/+0
| | | | | | | | | http://www.python.org/doc//current/c-api/none.html Reviewed-By: Jelmer Vernooij <jelmer@samba.org> Autobuild-User(master): Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date(master): Thu Jan 9 16:27:47 CET 2014 on sn-devel-104
* s4:gensec_gssapi: make sure gensec_gssapi_[un]seal_packet() rejects header ↵Stefan Metzmacher2014-01-071-0/+12
| | | | | | | | | | | | | signing If header signing is requested we should error out instead of silently ignoring it, our peer would hopefully reject it, but we should also do that. TODO: we should implement header signing using gss_wrap_iov(). Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:auth/gensec_gssapi: handle GENSEC_FEATURE_SIGN_PKT_HEADER in have_feature()Stefan Metzmacher2014-01-071-0/+12
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth-kerberos: add the credentials.h so that enum credentials_obtained is ↵Matthieu Patou2013-10-271-0/+1
| | | | | | | | | | | | | defined We had a warning about the enum being defined in the parameter list: warning: ‘enum credentials_obtained’ declared inside parameter list Signed-off-by: Matthieu Patou <mat@matws.net> Reviewed-by: Andrew Bartlet <abartlet@samba.org> Autobuild-User(master): Matthieu Patou <mat@samba.org> Autobuild-Date(master): Sun Oct 27 02:25:47 CET 2013 on sn-devel-104
* auth4: Remove an unused variableVolker Lendecke2013-10-151-1/+0
| | | | | | Signed-off-by: Volker Lendecke <vl@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* gensec: move schannel module to toplevel.Günther Deschner2013-09-192-340/+0
| | | | | | | | Guenther Signed-off-by: Günther Deschner <gd@samba.org> Pair-Programmed-With: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* auth/gensec: introduce gensec_internal.hStefan Metzmacher2013-08-105-0/+5
| | | | | | | | | | We should treat most gensec related structures private. It's a long way, but this is a start. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec/schannel: only require librpc/gen_ndr/dcerpc.hStefan Metzmacher2013-08-101-1/+1
| | | | | | | | We just need DCERPC_AUTH_TYPE_SCHANNEL Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec/schannel: there's no point in having schannel_session_key()Stefan Metzmacher2013-08-101-8/+0
| | | | | | | | | | gensec_session_key() will return NT_STATUS_NO_USER_SESSION_KEY before calling schannel_session_key(), as we don't provide GENSEC_FEATURE_SESSION_KEY. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec/schannel: GENSEC_FEATURE_ASYNC_REPLIES is not supportedStefan Metzmacher2013-08-101-3/+0
| | | | | | | | | There's a sequence number attached to the connection, which needs to be incremented with each message... Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec/schannel: use the correct computer_name from ↵Stefan Metzmacher2013-08-101-3/+3
| | | | | | | | | | | netlogon_creds_CredentialState We need to use the same computer_name we used in the netr_Authenticate3 request. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec/schannel: simplify the code by using netsec_create_state()Stefan Metzmacher2013-08-101-68/+30
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* s4:gensec/schannel: remove unused dcerpc_schannel_creds()Stefan Metzmacher2013-08-102-49/+0
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* gensec: Make the no-hostname status message much less scaryAndrew Bartlett2013-05-162-2/+2
| | | | Reviewed-by: Stefan Metzmacher <metze@samba.org>
* source4/auth/kerberos/kerberos-notes.txt: Fix typo.Karolin Seeger2013-05-151-1/+1
| | | | | Signed-off-by: Karolin Seeger <kseeger@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* gensec: recv_handler can't be NULL at that point.Andreas Schneider2013-03-051-1/+1
| | | | | | We probably want to segfault here if it is NULL. Reviewed-by: David Disseldorp <ddiss@samba.org>
* Move python modules from source4/scripting/python/ to python/.Jelmer Vernooij2013-03-021-1/+1
| | | | | | | Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Mar 2 03:57:34 CET 2013 on sn-devel-104
* s4:pygensec: make use of samba_tevent_context_init()Stefan Metzmacher2013-02-281-1/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
* pyauth: Check return value of lpcfg_from_py_object().Andreas Schneider2013-02-221-0/+4
| | | | Reviewed-by: Alexander Bokovoy <ab@samba.org>
* s4:auth/kerberos: make use of samba_tevent_context_init()Stefan Metzmacher2013-02-191-1/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
* Fix some cut-and-paste and spelling in debug messagesGuenter Kukkukk2013-02-121-8/+8
| | | | | | | | | Signed-off-by: Guenter Kukkukk <kukks@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Tue Feb 12 07:28:27 CET 2013 on sn-devel-104
* dsdb: Ensure "authenticated users" is processed for group membershipsAndrew Bartlett2013-01-211-5/+39
| | | | | | | | | | | | | | | | | | This change moves the addition of "Authenticated Users" from the very end of the token processing to the start. The reason is that we need to see if "Authenticated Users" is a member of other builtin groups, just as we would for any other SID. This picks up the "Pre-Windows 2000 Compatible Access" group, which is in turn often used in ACLs on LDAP objects. Without this change, the eventual token does not contain S-1-5-32-554 and users other than "Administrator" are unable to read uidNumber (in particular). Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: Support match-by-key in cli_credentials_get_server_gss_creds()Andrew Bartlett2012-08-302-0/+2
| | | | | | | | | | | | | This allows a password alone to be used to accept kerberos tickets. Of course, we need to have got the salt right, but we do not need also the correct kvno. This allows gensec_gssapi to accept tickets based on a secrets.tdb entry. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Aug 30 01:26:12 CEST 2012 on sn-devel-104
* lib/krb5_wrap: Move enctype conversion functions into a simple helper fileAndrew Bartlett2012-08-281-45/+0
|
* build: rename security → samba-securityBjörn Jacke2012-08-102-2/+2
| | | | | | | | | there is a libsecurity on OSF1 which clasheѕ with our security lib. see bug #9023. Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Björn Jacke <bj@sernet.de> Autobuild-Date(master): Fri Aug 10 14:22:21 CEST 2012 on sn-devel-104
* s4-auth: Make sure we use the correct credential state.Andreas Schneider2012-07-171-1/+6
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If we create a copy of the credential state we miss updates to the credentials. To establish a netlogon schannel connection we create client credentials and authenticate with them using dcerpc_netr_ServerAuthenticate2() For this we call netlogon_creds_client_authenticator() which increases the sequence number and steps the credentials. Lets assume the sequence number is 1002. After a successful authentication we get the server credentials and we send bind a auth request with the received creds. This sets up gensec and the gensec schannel module created a copy of the client creds and stores it in the schannel auth state. So the creds stored in gensec have the sequence number 1002. After that we continue and need the client credentials to call dcerpc_netr_LogonGetCapabilities() to verify the connection. So we need to increase the sequence number of the credentials to 1004 and step the credentials to the next state. The server always does the same and everything is just fine here. The connection is established and we want to do another netlogon call. So we get the creds from gensec and want to do a netlogon call e.g. dcerpc_netr_SamLogonWithFlags. We get the needed creds from gensec. The sequence number is 1002 and we talk to the server. The server is already ahead cause we are already at sequence number 1004 and the server expects it to be 1006. So the server gives us ACCESS_DENIED cause we use a copy in gensec. Signed-off-by: Günther Deschner <gd@samba.org>
* auth: Common function for retrieving PAC_LOGIN_INFO from PACChristof Schmitt2012-07-062-45/+0
| | | | | | | | Several functions use the same logic as kerberos_pac_logon_info. Move kerberos_pac_logon_info to common code and reuse it to remove the code duplication. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
* auth: Remove .get_challenge (only used for security=server)Andrew Bartlett2012-07-037-97/+0
| | | | | | | | | | | | | With NTLMSSP, for NTLM2 we need to be able to set the effective challenge, so if we ever did use a module that needed this functionlity, we would downgrade to just NTLM. Now that security=server has been removed, we have no such module. This will make it easier to make the auth subsystem async, as we will not need to consider making .get_challenge async. Andrew Bartlett
* auth: Use only security_token_is_system to determine that a user is SYSTEMAndrew Bartlett2012-06-191-2/+0
| | | | | | | | | | This removes the duplication on how to detect that a user is system in Samba now that the smbd system account is also only SID_NT_SYSTEM we can use the same check everywhere. Andrew Bartlett Signed-off-by: Andreas Schneider <asn@samba.org>
* lib/param: Create a seperate server role for "active directory domain ↵Andrew Bartlett2012-06-152-1/+2
| | | | | | | | | | | | | | | controller" This will allow us to detect from the smb.conf if this is a Samba4 AD DC which will allow smarter handling of (for example) accidentially starting smbd rather than samba. To cope with upgrades from existing Samba4 installs, 'domain controller' is a synonym of 'active directory domain controller' and new parameters 'classic primary domain controller' and 'classic backup domain controller' are added. Andrew Bartlett
* s4:kerberos: fix typos in kerberos-notes.txtMichael Adam2012-06-121-2/+2
|
* s4:gensec: fix a comment typoMichael Adam2012-06-121-1/+1
|
* build: Add missing deps and make MESSAGING a private libraryAndrew Bartlett2012-06-071-1/+1
| | | | | | | | | To remove finddcs_nbt these missing deps need to be added. These subsystems linked to to implicit dependencies provided by finddcs. Due to the new arrangmenet of subsystems, MESSAGING needs to be a private library to avoid being a source of duplicate symbols. Andrew Bartlett
* lib/krb5_wrap: Move krb5_princ_size helper to source4 as it is only used thereAndrew Bartlett2012-05-301-0/+8
| | | | | | | | | | This is also where the related krb5_princ_component is declared. Also fix the configure check to use the correct name This helps the autoconf build on Heimdal. Andrew Bartlett
generated by cgit (git 2.34.1) at 2025-08-30 13:32:39 +0000