| Commit message (Collapse) | Author | Age | Files | Lines |
... | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
ads_cached_connection() does not call get_dc_name()
before ads_connect() and therefore does not setup
the environment to look at krb5.conf.DOMAIN file
before sending the TGT request. The failure I'm seeing
occurs ni a multi-DC domain where we get back preuath
failed after we just joined the domain.
|
| | |
|
| |
| |
| |
| | |
SATOH Fumiyasu <fumiya@samba.gr.jp>
|
| | |
|
| | |
|
| |
| |
| |
| | |
so they can honor the offline logon state.
|
| |
| |
| |
| | |
is took late
|
| |
| |
| |
| |
| | |
on x86_64 Linux boxes. Since it is not needed, just use malloc()
on Linux.
|
| |
| |
| |
| | |
by the nss_info backend
|
| |
| |
| |
| |
| |
| | |
LAM module does to work around a system that does not support
>8 character usernames. Without the change, pam_winbind tries
to authenticate _#uid in the domain.
|
| |
| |
| |
| |
| |
| | |
su - DOM\user was unable to set the process crendentials
without listing the "id" and other attributes in the attrlist[].
More fixes to come, but I didn't want this to get lost.
|
| |
| |
| |
| | |
ends up commenting out the remainder of the line and we have missing libraries in the link
|
| |
| |
| |
| |
| | |
Patch from Zack Kirsch <zack.kirsch@isilon.com>.
Jeremy.
|
| |
| |
| |
| |
| | |
Coverity finds them :-)
Jeremy.
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
Fix escaping of DN components and filters around the code
Add some notes to commandline help messages about how to pass DNs
revert jra's "concistency" commit to nsswitch/winbindd_ads.c, as it was
incorrect.
The 2 functions use DNs in different ways.
- lookup_usergroups_member() uses the DN in a search filter,
and must use the filter escaping function to escape it
Escaping filters that include escaped DNs ("\," becomes "\5c,") is the
correct way to do it (tested against W2k3).
- lookup_usergroups_memberof() instead uses the DN ultimately as a base dn.
Both functions do NOT need any DN escaping function as DNs can't be reliably
escaped when in a string form, intead each single RDN value must be escaped
separately.
DNs coming from other ldap calls (like ads_get_dn()), do not need escaping as
they come already escaped on the wire and passed as is by the ldap libraries
DN filtering has been tested.
For example now it is possible to do something like:
'net ads add user joe#5' as now the '#' character is correctly escaped when
building the DN, previously such a call failed with Invalid DN Syntax.
Simo.
|
| |
| |
| |
| | |
Jeremy.
|
| |
| |
| |
| | |
Jeremy.
|
| |
| |
| |
| |
| |
| | |
allowed a CIFS client bug to remain unnoticed :-(.
I suck.
Jeremy.
|
| | |
|
| |
| |
| |
| |
| | |
removed).
Jeremy.
|
| |
| |
| |
| |
| |
| | |
to allow client to fragment large SPNEGO blobs (large krb5
tickets). Tested against W2K3R2. Should fix bug #4400.
Jeremy.
|
| |
| |
| |
| |
| | |
where return value was incorrectly initialized.
Jeremy.
|
| |
| |
| |
| |
| |
| | |
broken :-). This will do until Simo fixes the escape
calls properly.
Jeremy.
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| |
| | |
builtin
domain. Without this patch we leaked a DISPINFO for the (NULL) domain per
samr_connect*() call.
Volker
|
| | |
|
| |
| |
| |
| |
| |
| | |
directly after another.
Guenther
|
| |
| |
| |
| | |
Guenther
|
| |
| |
| |
| | |
Guenther
|
| |
| |
| |
| | |
Guenther
|
| |
| |
| |
| | |
Guenther
|
| |
| |
| |
| |
| |
| | |
proto should be required before creating any binary from now on.
Remove proto_exists from the all, pam_smbpass, and pam_bindind rule.
|
| | |
|
| |
| |
| |
| | |
comment :-)
|
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
them. It just does not make sense to do a querydispinfo on an alias handle...
This fixes a memleak: Every samr_connect*() call leaked a DISP_INFO for the
(NULL) sid.
More cleanup pending: Essentially, we only need the DISP_INFO cache for the
get_global_sam_sid() domain. BUILTIN is fixed and small enough, and there are
no other domains around where enumerations could happen.
This also removes the explicit builtin_domain flags. I don't think this is
worth it. If this makes a significant difference, then we have a *VERY* tuned
RPC layer...
Jeremy, please check this. If it's ok, we might want to merge it across.
Volker
|
| | |
|
| |
| |
| |
| |
| |
| |
| |
| | |
path.
Thanks,
Volker
|
| | |
|
| |
| |
| |
| | |
Guenther
|
| |
| |
| |
| |
| |
| |
| |
| | |
called with the -v option).
Patch from William Jojo <jojowil@hvcc.edu>.
Guenther
|
| |
| |
| |
| |
| |
| | |
there is just no cache around for a user.
Guenther
|
| |
| |
| |
| | |
Guenther
|
| |
| |
| |
| |
| | |
shoulder.... Correct fix for warning :-)
Jeremy.
|
| |
| |
| |
| | |
Jeremy.
|
| |
| |
| |
| | |
is the case where we don't have memalign() or posix_memalign().
|
| |
| |
| |
| |
| |
| |
| |
| | |
others don't get stuck with the winbindd hang.
Still waiting on additional confirmation from Guenther
that this fixes thes issues he was observing as well.
But it's been running in my local tree for a day without
problems.
|
| |
| |
| |
| | |
Guenther
|
| |
| |
| |
| |
| | |
Slightly change the DEBUG 0 message as suggested by Volker on
samba-technical.
|
| |
| |
| |
| |
| |
| | |
Jerry please check.
Simo.
|