| Commit message (Collapse) | Author | Age | Files | Lines |
|
|
|
|
|
|
|
|
|
|
|
| |
This module redirects various samdb requests into different modules,
depending on the prefix. It also makes moving to an LDAP backend
easier, as it is just a different partition backend.
This adds yet another stage to the provision process, as we must setup
the partitions before we setup the magic attributes.
Andrew Bartlett
(This used to be commit 31225b9cb6ef6fcb7bd831043999b1b44ef1b128)
|
|
|
|
|
| |
Commit the classic backwards compatible module which is the default one
(This used to be commit a89cc346b9296cb49929898d257a064a6c2bae86)
|
|
|
|
|
| |
Andrew Bartlett
(This used to be commit 82f5f6c03d005741613c5b00705613c4078c844e)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This required changes to the rootDSE module, to allow registration of
partitions. In doing so I renamed the 'register' operation to
'register_control' and 'register_partition', which changed a few more
modules.
Due to the behaviour of certain LDAP servers, we create the baseDN
entry in two parts: Firstly, we allow the admin to export a simple
LDIF file to add to their server. Then we perform a modify to add the
remaining attributes.
To delete all users in partitions, we must now search and delete all
objects in the partition, rather than a simple search from the root.
Against LDAP, this might not delete all objects, so we allow this to
fail.
In testing, we found that the 'Domain Controllers' container was
misnamed, and should be 'CN=', rather than 'OU='.
To avoid the Templates being found in default searches, they have been
moved to CN=Templates from CN=Templates,${BASEDN}.
Andrew Bartlett
(This used to be commit b49a4fbb57f10726bd288fdc9fc95c0cbbe9094a)
|
|
|
|
|
|
|
|
| |
Find more possible posix group names for the 'domain users' group, as
the existing options don't exist in OSX.
Andrew Bartlett
(This used to be commit 4e8d7b7fb310a668ae8653bc06036c94249b2b2a)
|
|
|
|
|
| |
metze
(This used to be commit e896c32614fd4fd80a124ccfe49332e319f717f9)
|
|
|
|
|
|
|
|
|
| |
scripts.
This tests the real module, and avoids duplication.
Andrew Bartlett
(This used to be commit 0859ba59ae00029177cd63366fc59efe8b19c973)
|
|
|
|
|
| |
and use it in provisioning to fullfill rfc 3045 requirements
(This used to be commit 3fb9571a76481560304a826fc945983d52123299)
|
|
|
|
|
| |
unix name mappings
(This used to be commit dc74d8ccf15b9324cd8b90ef9d41cf293b9de8e3)
|
|
|
|
| |
(This used to be commit 0cacd69dd57254cb1b51ad7969993bc24bae86c7)
|
|
|
|
|
|
| |
the main provision logic, so it can also be used as part of the
vampire process
(This used to be commit 95e90169f4e5887ee88116179d96f28f9e06796e)
|
|
|
|
|
|
|
|
| |
I would sugguest to run 'make test && make valgrind' before each commit
at this stage...
metze
(This used to be commit b7a0a778cc77f294aac589416b05dc676696d11e)
|
|
|
|
| |
(This used to be commit 1c49ce8df0fd2150c68d0bf4162f1ef69ff3392a)
|
|
|
|
| |
(This used to be commit cc4cab341e51d26c90534777eae65b7683ed93ce)
|
|
|
|
|
|
| |
domain migration
(This used to be commit c7951d17b1c4f53dd710d6a0fcf87ce678be3ff1)
|
|
|
|
|
|
|
| |
There still a few things to work out
Andrew Bartlett
(This used to be commit 701558b5fe917555416eb0d100ef756f8ef7cf65)
|
|
|
|
|
| |
Andrew Bartlett
(This used to be commit def31956181833db4c8e5079b745ca60fdf35136)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
code.
Previously, we had to know (or guess) the host and domain guid at the
provision stage. Now we query the database post-provision, to extract
the values and fill in the zone file.
This allows us to generate a correct zone file in the Windows migration case.
In an effort to make SWAT easier to use, I have removed and renamed
some of the provision options.
I have also fixed a nasty issue in my js code. I had implictly
declared a global variable of the name 'join', with disasterious
results for any subsequent user of the string utility function:
esp exception - ASSERT at lib/appweb/ejs/ejsParser.c:2064, 0
Backtrace:
[ 0] substitute_var:20 -> list[i] = join("", list2)
[ 1] setup_file:9 -> data = substitute_var(data, subobj)
Andrew Bartlett
(This used to be commit a38ceefd11f8b748f30383ef36a4752f178bfca1)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
Doing this required reworking ejsnet, particularly so it could take a
set of credentials, not just a username and password argument.
This required fixing the ejsnet.js test script, which now adds and
deletes a user, and is run from 'make test'. This should prevent it
being broken again.
Deleting a user from ejsnet required that the matching backend be
added to libnet, hooking fortunetly onto already existing code for the
actual deletion.
The js credentials interface now handles the 'set machine account' flag.
New functions have been added to provision.js to wrap the basic
operations (so we can write a command line version, as well as the web
based version).
Andrew Bartlett
(This used to be commit a5e7c17c348c45e61699cc1626a0d5eae2df4636)
|
|
|
|
|
| |
Andrew Bartlett
(This used to be commit 7b169aad3f94f1695b1f99cc91ff928cb2ca0389)
|
|
|
|
|
|
|
|
|
|
|
|
| |
main provision script a bit, as the argument list was getting out of
control. (It has been replaced in part with an object).
This also returns the session_info from the auth code into ejs.
We still need access control allowing only root to re-provision.
Andrew Bartlett
(This used to be commit 002cdcf3cab6563909d31edc5d825e857dc0a732)
|
|
|
|
|
| |
Andrew Bartlett
(This used to be commit 42cdad5e3f06c307baf80396fd8449b803ef84c3)
|
|
|
|
|
|
|
|
|
|
| |
This should allow us to provision to a 'normal' LDAP server.
Also add in 'session info' hooks (unused). Both of these need to be
hooked in on the webserver.
Andrew Bartlett
(This used to be commit b349d2fbfefd0e0d4620b9e8e0c4136f900be1ae)
|
|
|
|
| |
(This used to be commit 5884a7effff0b11e82c9d273dbd0407b0f2eb02d)
|
|
|
|
|
|
| |
Gunderson)
(This used to be commit 4c562c42b43d98f4c6bdbacc5cb1dd5e65bc3418)
|
|
|
|
|
|
|
|
| |
Gunderson).
this still doesn't work as a bug in ldb causes it to not understand
escaped characters in DNs when parsing DNs
(This used to be commit 10da56fb6cc57b6c0650a8dc81ded5faa643a96e)
|
|
|
|
| |
(This used to be commit 3d70ebca0b706ae22bc7a3f48c2247c450c42026)
|
|
|
|
| |
(This used to be commit f4ac7d6359b5a6de04a6ea518dec99f4c9b49b3d)
|
|
|
|
|
|
|
| |
with debugging!
Andrew Bartlett
(This used to be commit fe36cb6767ce99432e2778037aad334170dca173)
|
|
|
|
|
|
|
| |
server. Now to try another one...
Andrew Bartlett
(This used to be commit 175f616d74ac3567a35713343be0c63c96c5aede)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
backend.
The idea is that every time we open an LDB, we can provide a
session_info and/or credentials. This would allow any ldb to be remote
to LDAP. We should also support provisioning to a authenticated ldap
server.
(They are separate so we can say authenticate as foo for remote, but
here we just want a token of SYSTEM).
Andrew Bartlett
(This used to be commit ae2f3a64ee0b07575624120db45299c65204210b)
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
This merges Samba4 up to current lorikeet-heimdal, which includes a
replacement for some Samba-specific hacks.
In particular, the credentials system now supplies GSS client and
server credentials. These are imported into GSS with
gss_krb5_import_creds(). Unfortunetly this can't take an MEMORY
keytab, so we now create a FILE based keytab as provision and join
time.
Because the keytab is now created in advance, we don't spend .4s at
negprot doing sha1 s2k calls. Also, because the keytab is read in
real time, any change in the server key will be correctly picked up by
the the krb5 code.
To mark entries in the secrets which should be exported to a keytab,
there is a new kerberosSecret objectClass. The new routine
cli_credentials_update_all_keytabs() searches for these, and updates
the keytabs.
This is called in the provision.js via the ejs wrapper
credentials_update_all_keytabs().
We can now (in theory) use a system-provided /etc/krb5.keytab, if
krb5Keytab: FILE:/etc/krb5.keytab
is added to the secrets.ldb record. By default the attribute
privateKeytab: secrets.keytab
is set, pointing to allow the whole private directory to be moved
without breaking the internal links.
(This used to be commit 6b75573df49c6210e1b9d71e108a9490976bd41d)
|
|
|
|
| |
(This used to be commit 4b56c129c6f1654f9dbe37bc950a836f15c48b3d)
|
|
|
|
|
|
|
| |
smbsrv_connection
metze
(This used to be commit acd3e644e030a3544ddc6cdcd4e0ec9617732cba)
|
|
|
|
| |
(This used to be commit 696fa87a212e65d6337c39a84f682b64b52593a5)
|
|
|
|
|
|
| |
argument to split()
(This used to be commit 25131efea8c1a2b0bfa7f999766ebcbab8fa8006)
|
|
|
|
|
| |
needed for mmc management of Samba4.
(This used to be commit cbbce4fe403efc0b9e63052c2aa1fbb5972f2abe)
|
|
|
|
| |
(This used to be commit daa9dcd8f4b1dde801091ec64faa8158481d171c)
|
|
|
|
|
|
| |
- speed up provisioning a bit using a ldb transaction (also means you
can't end up with a ldb being half done)
(This used to be commit 91dfe304cf688bb81b69ff3192ac84b78b34b311)
|
|
|
|
|
|
|
|
|
| |
js arrays are a special type of object where the length property is
automatic, and cannot be modified manually. Our code was manually
setting length, which made it abort when someone passed in a real ejs
array. To fix this we need to create real arrays instead of objects,
and remove the code that manually sets the length
(This used to be commit ebdd1393fde44a0a35446d1a922d29a7c1769ba7)
|
|
|
|
|
|
| |
problem is really caused by hklm not having objectclass attributes on
its records, but this is a workaround)
(This used to be commit 62d5253a033f47335ceefade9ad7d98ddfc19584)
|
|
|
|
| |
(This used to be commit 27f46b4f18346ea03d8626a380e417b00f7a88d1)
|
|
|
|
|
|
|
| |
list should be from the dnsdomain (ie lowercae).
Andrew Bartlett
(This used to be commit 10d692a1c216134b301b5851ce1e71ed93cc6164)
|
|
|
|
|
| |
Andrew Bartlett
(This used to be commit 0c29f0e30d64be09baad792eb2850aa0b8fa9981)
|
|
|
|
|
|
|
| |
fired.
Andrew Bartlett
(This used to be commit df6a40c2d261804f1cd4feb24572135a4c62a802)
|
|
|
|
|
|
|
|
|
| |
so you can use them in search filters,
only for administration not used inside the winserver code
- fix the samba3 ugrade scripts to create a correct samba4 wins.ldb
metze
(This used to be commit 9f3b6746d86583c48097da48c28f50f075bbd3e3)
|
|
|
|
|
|
| |
role"
(This used to be commit c5e3a1c55d9e21f9ee618169dc05c69ee9c9c5b1)
|
|
|
|
|
|
|
|
|
| |
if we fail to erase a ldb during provision by traversing
and deleting records (an in-place erase) then just unlink it
and start it again. This makes provisioning much more robust
to changes in ldb that make it not backward compatible with
old DBs.
(This used to be commit 173655aec25c462b8b90b850df65ae6f95f44efb)
|
|
|
|
| |
(This used to be commit 87f25fe49caa78422582337c5208a331ef5b8c15)
|
|
|
|
|
| |
Convert Samba3 policy "refuse machine pw change" to registry value.
(This used to be commit a143234ac7622ef3ef87c80224927551a1452e4b)
|