summaryrefslogtreecommitdiffstats
path: root/source4
Commit message (Collapse)AuthorAgeFilesLines
* s4-drepl: don't call UpdateRefs on a RODCAndrew Tridgell2010-09-291-5/+11
| | | | | | we use the ADD_REF bit in getncchanges instead Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
* s4-drepl: fixed the checking of replica_flags in the drepl serverAndrew Tridgell2010-09-291-7/+0
| | | | | | we were incorrectly avoiding a getncchanges when WRIT_REP was not set Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
* s4-kcc: fixed the replica_flags in repsFrom in the kccAndrew Tridgell2010-09-291-31/+72
| | | | | | | if our calculated replica_flags doesn't match the ones in our repsFrom then update it Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
* s4-dns: send A record updates via TKEYAndrew Tridgell2010-09-301-1/+6
|
* s4-smbtorture: add new EnumPrinters test to test printername/servernameGünther Deschner2010-09-301-13/+207
| | | | | | behaviour in EnumPrinter and GetPrinter calls. Guenther
* s4-samldb: also set a password on the krbtgt_NNNN accountAndrew Tridgell2010-09-291-0/+11
| | | | | | | when we setup the krbtgt_NNNN account using the DCPROMO_OID control, we also need to set an initial password for this account Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4-devel: added new options to getncchanges scriptAndrew Tridgell2010-09-291-9/+65
| | | | | | added --pas, --dest-dsa and --replica-flags options Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
* s4-drs: implement PAS checks and access checks for getncchangesAndrew Tridgell2010-09-291-26/+130
| | | | | | | | | | | This implements partial attribute set checking on getncchanges. If the client sends a partial_attribute_set then we only return the specified attributes. This also implements access checking on the NC root for the access right GUIDs for requests with and without reveal secrets Pair-Programmed-With: Anatoliy Atanasov <anatoliy.atanasov@postpath.com>
* s4-drs: added drs_security_access_check_nc_root()Andrew Tridgell2010-09-292-12/+63
| | | | this checks securiity on the NC root of the specified naming context
* s4-sam: added DOMAIN_RID_ENTERPRISE_READONLY_DCS for RODCs in the PACAndrew Tridgell2010-09-291-0/+16
| | | | Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4-spnupdate: when we are a RODC we need to use the WriteSPN DRS callAndrew Tridgell2010-09-291-10/+57
| | | | | we can't do SPN updates via sam writes and replication, as the sam is read-only
* s4-drsutils: expose DsBind() call in drs_utils.pyAndrew Tridgell2010-09-291-37/+38
| | | | this will be used by samba_spnupdate
* s4-kerberos: use TZ=GMT when we are invoking krb5 code in helpersAndrew Tridgell2010-09-292-0/+12
| | | | | | | | | | | Our helper scripts can fail on Fedora with the PDT timezone (Western USA). This is the same issue we found with Heimdal earlier today, the 24 second difference between GMT and UTC, but this time in MIT Kerberos as linked into bind9. By forcing TZ=GMT in these scripts we avoid the problem Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4-rodc: RODC should not accept requests for role transferNadezhda Ivanova2010-09-291-0/+12
| | | | | A RODC cannot assume a role, and unwillingToPerform must be returned if such request is sent via LDAP
* s4-provision: simplify our generated krb5.confAndrew Tridgell2010-09-281-14/+1
| | | | | | | | we don't want to force the KDC to be ourselves, we should be using DNS to find a live KDC. Also remove some other options and allow the krb5 lib to use defaults. Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4-kdc: RODC DCs should be able to produce forwardable ticketsAndrew Tridgell2010-09-281-1/+1
| | | | Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* heimdal: fixed timegm UTC/GMT bugAndrew Tridgell2010-09-281-15/+6
| | | | | | | | | | | This was a wonderful bug! On some Fedora systems, but not on Ubuntu, there is a difference between UTC and GMT. Heimdal replaced timegm() with _der_timegm() which did not account for that difference (which is 24 seconds at the moment). This led to a mutual authentication failure. Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4-sam: fixed termination of krbtgt_attrs (comma and NULL)Andrew Tridgell2010-09-281-4/+4
| | | | Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* ldb-dn: don't crash on NULL in ldb_binary_encode_string()Andrew Tridgell2010-09-281-0/+3
| | | | Thanks to Nadya for finding this one!
* s4-kdc Ensure that an RODC may act as a server (needed to fillAndrew Bartlett2010-09-281-5/+24
| | | | | | the krbtgt role). Andrew Bartlett
* heimdal Use a seperate krb5_auth_context for the delegated credentialsAndrew Bartlett2010-09-283-1/+35
| | | | | | | If we re-use this context, we overwrite the timestamp while talking to the KDC and fail the mutual authentiation with the target server. Andrew Bartlett
* s4-drs: added support for DRSUAPI_EXOP_REPL_OBJAndrew Tridgell2010-09-281-1/+32
| | | | this extended getncchanges operation replicates a single object
* ldb-tdb: ignore failure to register control on rootdseAndrew Tridgell2010-09-281-4/+1
| | | | this is expected for non-sam LDBs
* s4-drs: use drs_ObjectIdentifier_*() calls in getncchangesAndrew Tridgell2010-09-281-14/+16
| | | | this allows for replication by GUID or SID
* s4-drs: moved the drs_ObjectIdentifier handling to dsdb_dn.cAndrew Tridgell2010-09-282-44/+42
| | | | | | | this will be used outside of the drs server. This also fixes the handling of the ndr_size elements of the drs_ObjectIdentifier
* waf: we don't need the preprocessor recursion limit any moreAndrew Tridgell2010-09-281-3/+0
| | | | thanks to ita for this
* s4-drs: Added check for drs-manage-topology to updateRefs.Nadezhda Ivanova2010-09-281-7/+9
|
* s4-drs: Added drs_security_access_check functionNadezhda Ivanova2010-09-282-0/+64
| | | | | It takes a security token, an ldb_context, and the desired CAR and checks if the principal has this CAR granted
* s4-dsdb: adapted check_access_on_dn for use in drs.Nadezhda Ivanova2010-09-281-9/+10
|
* heimdal Fix DNS name qualification to not mangle IP addressesAndrew Bartlett2010-09-291-5/+23
| | | | | | | | | If the host running this code used IPv6 forms for IPv4 addreses then the check for '.' would not be sufficient to determine that this isn't a name we should mangle. Instead, check if it can be parsed as a numeric address first, and only then mangle. Andrew Bartlett
* s4-kdc Handle the case where we may be given a ticket from an RODC in db layerAndrew Bartlett2010-09-296-37/+83
| | | | | | | | This includes rewriting the PAC if the original krbtgt isn't to be trusted, and reading different entries from the DB for the krbtgt depending on the krbtgt number. Andrew Bartlett
* heimdal Add an error code for use in the RODCAndrew Bartlett2010-09-291-0/+1
| | | | | | | | | | In this case, the whole request packet should be forwarded to a real KDC, with full secrets, as we don't have the password. This could also be used to implement 'play dead when the LDAP server is down'. Andrew Bartlett
* heimdal Add support for extracting a particular KVNO from the databaseAndrew Bartlett2010-09-297-19/+54
| | | | | | | | | This should allow master key rollover. (but the real reason is to allow multiple krbtgt accounts, as used by Active Directory to implement RODC support) Andrew Bartlett
* s4-kdc Add common setup, handle RODC setup caseAndrew Bartlett2010-09-295-73/+156
| | | | | | | | | | This means we just set up the system_session etc in one place and don't diverge between the MIT and Heimdal plugins. We also now determine if we are an RODC and store some details that we will need later. Andrew Bartlett
* s4-dsdb Add ldb_reset_err_string() when we set error codes.Andrew Bartlett2010-09-292-0/+4
| | | | If we don't we could show an old, incrorrect error
* s4-dsdb Make samdb_reference_dn() use dsdb_search() and DSDB_SEARCH_ONE_ONLYAndrew Bartlett2010-09-291-7/+8
| | | | | | | | This simplifies the function. While doing so, also change the error string setting to set a really clear error string for the failure to find and failure to parse cases. Andrew Bartlett
* s4-kdc Add function to determine if a hdb entry is a RODCAndrew Bartlett2010-09-292-0/+18
| | | | | | This is important, as we must ignore the PAC from an RODC. Andrew Bartlett
* s4-kdc Use msDS-SecondaryKrbTgtNumber to fill in the full KVNOAndrew Bartlett2010-09-292-1/+19
| | | | Andrew Bartlett
* s4-dsdb Fix segfault in error case in rootdse moduleAndrew Bartlett2010-09-291-1/+4
|
* ldb: Fix path to alternative buildtools.Jelmer Vernooij2010-09-281-1/+1
|
* samba4: Don't update Makefile/configure from autogen.sh.Jelmer Vernooij2010-09-282-2/+12
|
* ldb/tevent: Fix detection of waf paths.Jelmer Vernooij2010-09-282-2/+11
|
* ldb: Update autogen-waf.sh to no longer overwrite existing files.Jelmer Vernooij2010-09-282-2/+12
|
* ldb: Remove samba-specific targets from Makefile.Jelmer Vernooij2010-09-281-8/+0
|
* ldb: Bump version because of addition of ldb_req_location.Jelmer Vernooij2010-09-281-1/+1
|
* s4-selftest: added a --fail-immediately option to s4 testAndrew Tridgell2010-09-281-0/+7
| | | | | | | this can be used to force an immediate test failure on the first failed test case. You can also use: make test FAIL_IMMEDIATELY=1
* s4-provision: fixed the authority response for our SOA recordAndrew Tridgell2010-09-281-1/+1
| | | | | | | some clients rely on this being the hostname, not the domain Autobuild-User: Andrew Tridgell <tridge@samba.org> Autobuild-Date: Tue Sep 28 06:39:19 UTC 2010 on sn-devel-104
* s4-dns: implemented RODC DNS update in dns update taskAndrew Tridgell2010-09-271-0/+199
| | | | Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4-netlogon: added RODC DNS update call fwded to dnsupdate taskAndrew Tridgell2010-09-272-4/+100
| | | | | when we get a netlogon RODC DNS update, we send it to the dnsupdate task
* s4-dns: added --update-list option to samba_dnsupdateAndrew Tridgell2010-09-271-8/+14
| | | | this allows us to use it for RODC netlogon updates
generated by cgit (git 2.34.1) at 2025-09-26 00:03:29 +0000