summaryrefslogtreecommitdiffstats
path: root/auth/credentials
Commit message (Collapse)AuthorAgeFilesLines
* kerberos: Remove un-used event context argument from smb_krb5_init_context()Andrew Bartlett2014-04-281-1/+1
| | | | | | | | | | | | | | | | | The event context here was only specified in the server or admin-tool context, which does not do network communication, so this only caused a talloc_reference() and never any useful result. The actual network communication code sets an event context directly before making the network call. Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Apr 28 02:24:57 CEST 2014 on sn-devel-104
* auth/tests: add missing #include "torture/local/proto.h"Stefan Metzmacher2014-04-021-0/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* dbwrap: add dbwrap_flags argument to dbwrap_local_open()Michael Adam2014-02-071-1/+2
| | | | | | | | To be consistent with db_open() and prepare for future possible extensions. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
* auth:credentials: avoid talloc_reference in cli_credentials_set_netlogon_creds()Stefan Metzmacher2013-10-161-1/+5
| | | | | | | | | | | | | Typically cli_credentials_set_netlogon_creds() should be used directly before the DCERPC bind. And cli_credentials_get_netlogon_creds() should be only used by the gensec layer, which only needs a copy. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Oct 16 23:56:01 CEST 2013 on sn-devel-104
* auth: fix space/tab mixup in cli_credentials_get_password()Michael Adam2013-09-201-2/+2
| | | | | Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org>
* Prepare for SASL/EXTERNAL supportHoward Chu2013-09-181-0/+8
| | | | | | Signed-off-by: Howard Chu <hyc@symas.com> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
* auth/credentials: Add cli_credentials_{set,get}_forced_sasl_mech()Andrew Bartlett2013-09-164-0/+46
| | | | | | | | | | This will allow us to force the use of only DIGEST-MD5, for example, which is useful to avoid hitting GSSAPI, SPNEGO or NTLM when talking to OpenLDAP and Cyrus-SASL. Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Nadezhda Ivanova <nivanova@symas.com>
* auth/credentials: make sure cli_credentials_get_nt_hash() always returns a ↵Stefan Metzmacher2013-08-122-7/+16
| | | | | | | | talloc object Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: use CRED_CALLBACK_RESULT after a callbackStefan Metzmacher2013-08-051-11/+23
| | | | | | | | | | | | We only do this if it's still CRED_CALLBACK after the callback, this allowes the callback to overwrite it. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Mon Aug 5 09:36:05 CEST 2013 on sn-devel-104
* auth/credentials: simplify password_tries stateStefan Metzmacher2013-08-052-6/+15
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: get the old password from secrets.tdbStefan Metzmacher2013-08-051-0/+11
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: keep cli_credentials privateStefan Metzmacher2013-08-056-93/+126
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: add cli_credentials_shallow_copy()Stefan Metzmacher2013-08-052-0/+18
| | | | | | | | This is useful for testing. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: add cli_credentials_[set_]callback_data*Stefan Metzmacher2013-08-052-0/+19
| | | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: remove pointless talloc_reference() from ↵Stefan Metzmacher2013-08-051-1/+1
| | | | | | | | cli_credentials_get_principal_and_obtained() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: remove pointless talloc_reference() from ↵Stefan Metzmacher2013-08-051-1/+1
| | | | | | | | cli_credentials_get_unparsed_name() Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Andrew Bartlett <abartlet@samba.org>
* build: Build with system md5.h on OpenIndianaAndrew Bartlett2013-06-191-1/+1
| | | | | | | | | | | | | | | | | | | | This changes (again...) our system md5 detection to cope with how OpenIndiana does md5. I'm becoming increasingly convinced this isn't worth our while (we should have just done samba_md5...), but for now this change seems to work on FreeBSD, OpenIndiana and Linux with libbsd. This needs us to rename struct MD5Context -> MD5_CTX, but we provide a config.h define to rename the type bad if MD5_CTX does not exist (it does however exist in the md5.h from libbsd). Andrew Bartlett Signed-off-by: Andrew Bartlett <abartlet@samba.org> Reviewed-by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Wed Jun 19 21:32:36 CEST 2013 on sn-devel-104
* build: Remove unused credentials_samba3.cAndrew Bartlett2013-05-281-49/+0
| | | | | | | | | | This file was only used by the autoconf build system. Andrew Bartlett Reviewed-by: Jelmer Vernooij <jelmer@samba.org> Reviewed-by: David Disseldorp <ddiss@samba.org>
* secrets: use lpcfg_private_db_path() convenience helper.Rusty Russell2013-04-121-3/+1
| | | | | Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Reviewed-by: Jeremy Allison <jra@samba.org>
* auth/pycredentials: make use of samba_tevent_context_init()Stefan Metzmacher2013-02-281-1/+1
| | | | | Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
* ntdb: switch between secrets.tdb and secrets.ntdb depending on 'use ntdb'Rusty Russell2013-02-201-1/+3
| | | | | | | | | | | Since we open with dbwrap, it auto-converts old tdbs (which it will rename to secrets.tdb.bak once it's done). Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Rusty Russell <rusty@rustcorp.com.au> Autobuild-Date(master): Wed Feb 20 07:09:19 CET 2013 on sn-devel-104
* auth: added cli_credentials_failed_kerberos_login()Andrew Tridgell2012-11-012-0/+64
| | | | | | | | this is used to support retrying kerberos connections after removing a ccache entry, to cope with a server being re-built while our client still has a valid service ticket Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* auth/credentials: Do not print passwords in a talloc memory dumpAndrew Bartlett2012-08-311-0/+8
| | | | | | | The fact that a password was created here is enough information, so overwrite with the function name and line. Andrew Bartlett
* auth/credentials: Support match-by-key in cli_credentials_get_server_gss_creds()Andrew Bartlett2012-08-301-3/+8
| | | | | | | | | | | | | This allows a password alone to be used to accept kerberos tickets. Of course, we need to have got the salt right, but we do not need also the correct kvno. This allows gensec_gssapi to accept tickets based on a secrets.tdb entry. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Aug 30 01:26:12 CEST 2012 on sn-devel-104
* auth/credentials: Remove unused, and un-declared cli_credentials_set_krbtgt()Andrew Bartlett2012-08-291-29/+0
|
* auth/credentials: Better integrate fetch of secrets.tdb and secrets.ldb recordsAndrew Bartlett2012-08-291-32/+61
| | | | | | | | By checking first if there is a secrets.tdb record and passing in the password and last change time we avoid setting one series of values and then replacing them. We also avoid the need to work around the setting of anonymous. Andrew Bartlett
* auth/credentials: Improve memory handling in cli_credentials_set_machine_accountAndrew Bartlett2012-08-291-26/+26
| | | | | | | | | By using a tempoary talloc context this is much tidier and more reliable code. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Aug 29 03:11:10 CEST 2012 on sn-devel-104
* auth/credentials: Avoid double-free in the failure caseAndrew Bartlett2012-08-291-1/+1
| | | | | | This pointer is only valid if dbwrap_fetch returned success. Andrew Bartlett
* auth/credentials: Rework credentials handling to try and find the most ↵Andrew Bartlett2012-08-281-33/+71
| | | | | | | | recent machine pw As winbindd will update secrets.tdb but not secrets.ldb, we need to detect this and use secrets.tdb Andrew Bartlett
* auth/credentials: Expand secrets.tdb fetch of secrets to preserve ↵Andrew Bartlett2012-08-281-0/+4
| | | | | | | | workstation and realm These would otherwise be set during the fetch from the secrets.ldb, but are wiped when that fails. Andrew Bartlett
* build: rename security → samba-securityBjörn Jacke2012-08-101-1/+1
| | | | | | | | | there is a libsecurity on OSF1 which clasheѕ with our security lib. see bug #9023. Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Björn Jacke <bj@sernet.de> Autobuild-Date(master): Fri Aug 10 14:22:21 CEST 2012 on sn-devel-104
* auth/credentials: Remove extra newlineAndrew Bartlett2012-07-191-1/+1
|
* auth/credentials: Look in the secrets.tdb for the machine accountAndrew Bartlett2012-07-152-3/+50
| | | | | | | | | This is for use with the -P/--machine-pass option. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun Jul 15 05:41:28 CEST 2012 on sn-devel-104
* auth/credentials: 'workgroup' set via command line will not drop existing ccacheAlexander Bokovoy2012-05-242-13/+7
| | | | | | | | | | The root cause for existing ccache being invalidated was use of global loadparm with 'workgroup' value set as if from command line. However, we don't really need to take 'workgroup' parameter value's nature into account when invalidating existing ccache. When -U is used on the command line, one can specify a password to force ccache invalidation. The commit also reverts previous fix now that root cause is clear.
* auth-credentials: Support using pre-fetched ccache when obtaining kerberos ↵Alexander Bokovoy2012-05-231-2/+12
| | | | | | | | | credentials When credentials API is used by a client-side program that already as fetched required tickets into a ccache, we need to skip re-initializing ccache. This is used in FreeIPA when Samba 4 Python bindings are run after mod_auth_kerb has obtained user tickets already.
* auth and s4-rpc_server: Do not use features we currently can't implement ↵Simo Sorce2012-05-231-1/+4
| | | | with MIT Kerbros build
* s4-auth: Use smb_krb5_cc_get_lifetime() wrapper.Andreas Schneider2012-05-041-2/+2
| | | | Signed-off-by: Simo Sorce <idra@samba.org>
* lib/replace: split out GSSAPI from lib/replace/system/kerberos.h into ↵Alexander Bokovoy2012-04-251-0/+1
| | | | | | | | | | | | | | lib/replace/system/gssapi.h With waf build include directories are defined by dependencies specified to subsystems. Without proper dependency <gssapi/gssapi.h> cannot be found for embedded Heimdal builds when there are no system-wide gssapi/gssapi.h available. Split out GSSAPI header includes in a separate replacement header and use that explicitly where needed. Autobuild-User: Alexander Bokovoy <ab@samba.org> Autobuild-Date: Wed Apr 25 00:18:33 CEST 2012 on sn-devel-104
* Make krb5 wrapper library common so they can be used all overSimo Sorce2012-04-231-0/+1
|
* srv_keytab: Pass krb5_context directly, it's all we use anyways.Simo Sorce2012-04-121-1/+2
| | | | Signed-off-by: Andreas Schneider <asn@samba.org>
* s4-auth-krb: Remove dependency on credentials too.Simo Sorce2012-04-121-3/+6
| | | | Signed-off-by: Andreas Schneider <asn@samba.org>
* s4-auth-krb: Remove unneded dependency on kerberos_util.Simo Sorce2012-04-121-3/+13
| | | | Signed-off-by: Andreas Schneider <asn@samba.org>
* s4-auth-krb: Move keytab functions in a separate file.Simo Sorce2012-04-122-2/+3
| | | | | | Confine ldb dependency. Signed-off-by: Andreas Schneider <asn@samba.org>
* s4-auth-krb: Move function into more appropriate header.Simo Sorce2012-04-121-8/+0
| | | | Signed-off-by: Andreas Schneider <asn@samba.org>
* s4-auth-krb: Make cli_credentials_invalidate_client_gss_creds static.Simo Sorce2012-04-122-2/+4
| | | | | | It's not used anywhere else. Signed-off-by: Andreas Schneider <asn@samba.org>
* s4-auth-krb: Make impersonate_principal_from_credentials static.Simo Sorce2012-04-121-6/+0
| | | | | | It's not used anywhere else. Signed-off-by: Andreas Schneider <asn@samba.org>
* credentials: Show returned error_string in debug messageAndrew Bartlett2012-02-101-2/+2
|
* auth/credentials Remove debug that prints in normal operationAndrew Bartlett2012-01-091-1/+0
| | | | | | | | | | The fact that this function is unimplemented is unimportant to the callers as credential caches are not handled via the auth/credentials code in s3. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Mon Jan 9 03:24:36 CET 2012 on sn-devel-104
* credentials: Always honour the return value of E_deshash()Andrew Bartlett2011-12-281-4/+2
| | | | | | | When this returns false, the hash value is not correct as the password could not be converted into an uppercase, 14 char or less ASCII string. Andrew Bartlett
* s4-dns Use match-by-key in GSSAPI server if principal is not specifiedAndrew Bartlett2011-12-071-3/+9
| | | | | | | | | This allows dlz_bind9 to match on exactly the same key as bind9 itself Andrew Bartlett Autobuild-User: Amitay Isaacs <amitay@samba.org> Autobuild-Date: Wed Dec 7 02:20:10 CET 2011 on sn-devel-104
generated by cgit (git 2.34.1) at 2024-06-11 08:20:52 +0000