summaryrefslogtreecommitdiffstats
path: root/source/include/ads.h
Commit message (Collapse)AuthorAgeFilesLines
* r24804: As a temporary workaround, also try to guess the server's principal ↵Günther Deschner2007-08-301-0/+2
| | | | | | | | | in the "not_defined_in_RFC4178@please_ignore" case to make at least LDAP SASL binds succeed with windows server 2008. Guenther
* r24132: merge from SAMBA_3_2:Stefan Metzmacher2007-08-021-4/+5
| | | | | | | | | | - make it more clear what the different min and max fields mean - with the "GSSAPI" sasl mech the plain, sign or seal negotiation is independed from the req_flags and ret_flags - verify the server supports the wrapping type we want - better handling on negotiated buffer sizes metze
* r24040: merge from SAMBA_3_2:Stefan Metzmacher2007-07-251-1/+1
| | | | | | remove unused global variable... metze
* r23947: merge from SAMBA_3_2:Stefan Metzmacher2007-07-181-1/+1
| | | | | | | | add support for NTLMSSP sign and seal NOTE: windows servers are broken with sign only... metze
* r23944: merge from SAMBA_3_2:Stefan Metzmacher2007-07-181-1/+12
| | | | | | | - always provide ads_setup_sasl_wrapping() function - read/write returning 0 means EOF and we need to return direct metze
* r23927: merge from SAMBA_3_2:Stefan Metzmacher2007-07-171-2/+2
| | | | | | implement output buffer handling for the SASL write wrapper metze
* r23923: merge from SAMBA_3_2:Stefan Metzmacher2007-07-171-15/+46
| | | | | | implement buffer handling for the SASL read wrapper metze
* r23899: merge from SAMBA_3_2:Stefan Metzmacher2007-07-161-3/+3
| | | | | | | | rename HAVE_ADS_SASL_WRAPPING -> HAVE_LDAP_SASL_WRAPPING + adding missing file libads/sasl_wrapping.c metze
* r23897: hopefully fix the buildStefan Metzmacher2007-07-161-1/+1
| | | | metze
* r23894: merge from SAMBA_3_2:Stefan Metzmacher2007-07-161-4/+6
| | | | | | | add dummy callbacks for LDAP SASL wrapping, they're not used yet... metze
* r23889: merge from SAMBA_3_2:Stefan Metzmacher2007-07-161-10/+13
| | | | | | | move elements belonging to the current ldap connection to a substructure. metze
* r23838: Allow to store schema and config path in ADS_STRUCT config.Günther Deschner2007-07-111-0/+2
| | | | Guenther
* r23826: Fix gpo security filtering by matching the security descriptor ace's ↵Günther Deschner2007-07-111-0/+3
| | | | | | | | for the extended apply group policy right. Guenther
* r23766: Add GTYPE_SECURITY_UNIVERSAL_GROUP define.Günther Deschner2007-07-091-0/+5
| | | | Guenther
* r23607: Add legacy support for Services for Unix (SFU) 2.0.Günther Deschner2007-06-261-4/+12
| | | | Guenther
* r23128: Fix typo.Günther Deschner2007-05-241-1/+1
| | | | Guenther
* r22841: Add comment to endif statement.Lars Müller2007-05-141-1/+1
|
* r22797: We are only interested in the DACL of the security descriptor, so ↵Günther Deschner2007-05-111-0/+1
| | | | | | | | search with the SD_FLAGS control. Guenther
* r22795: Merge krb5_get_init_creds_opt_get_error() usage from 3_0.Günther Deschner2007-05-111-0/+6
| | | | Guenther
* r21241: Merge from 3_0:Günther Deschner2007-02-081-1/+2
| | | | | | | | | | | | | | | | | | | Fix longstanding Bug #4009. For the winbind cached ADS LDAP connection handling (ads_cached_connection()) we were (incorrectly) assuming that the service ticket lifetime equaled the tgt lifetime. For setups where the service ticket just lives 10 minutes, we were leaving hundreds of LDAP connections in CLOSE_WAIT state, until we fail to service entirely with "Too many open files". Also sequence_number() in winbindd_ads.c needs to delete the cached LDAP connection after the ads_do_search_retry() has failed to submit the search request (although the bind succeeded (returning an expired service ticket that we cannot delete from the memory cred cache - this will get fixed later)). Guenther
* r21186: * Merge nss_info and idmap interface changes to current Gerald Carter2007-02-061-10/+11
| | | | | | stable branch * Also include pam_winbind changes for multiple groups in the require-membership-of parameter
* r20857: Silence gives assent :-). Checking in the fix forJeremy Allison2007-01-171-0/+1
| | | | | | | | | site support in a network where many DC's are down. I heard via Volker there is still a bug w.r.t the wrong site being chosen with trusted domains but we'll have to layer that fix on top of this. Gd - complain if this doesn't work for you. Jeremy.
* r19782: more compile fixes for mergeGerald Carter2006-11-191-0/+4
|
* r19488: British trains are at least good for something...Jeremy Allison2006-10-241-0/+6
| | | | | | | Merge back the winbindd changes from SAMBA_3_0 to a release branch. This compiles, but hasn't been valgrinded or tested. That will come... Jeremy.
* r16674: After removing each individual post-3.0.23rc3 change:Gerald Carter2006-06-291-0/+1
| | | | | | | | | | | | | | This pulls is what I considered safe fixes from SAMBA_3_0. This boiled down to either Klocwork fixes or obvious compiler warning fixes. I did not include any changes to fnuction signatures not the version change to the passdb API. Also pulled in the 3 nmbd fixes requested by Jeremy and the wildcard delete fix. This code will sit for a few days in the cooker and then become 3.0.23 if nothing blows up. I don't care how many more compile warning fixes people throw into SAMBA_3_0.
* r16348: * merging changes from SAMBA_3_0 r16346Gerald Carter2006-06-191-0/+4
| | | | * updating release notes to match
* r15837: starting sync up for 3.0.23rc1 (in sync with SAMBA_3_0 r15822)Gerald Carter2006-05-231-20/+58
|
* r14051: Add remaining (documented) userAccountControl bits, thanks to LukeGünther Deschner2006-03-081-2/+2
| | | | | | Howard for pointing this out. Guenther
* r13657: Let winbindd try to obtain the gecos field from the msSFU30GecosGünther Deschner2006-02-231-0/+2
| | | | | | attribute when "winbind nss info = sfu" is set. Fixes #3539. Guenther
* r13316: Let the carnage begin....Gerald Carter2006-02-031-0/+2
| | | | Sync with trunk as off r13315
* r11242: use LDAP bitwise machting rule when searching for groups in ADS.Günther Deschner2005-10-211-3/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | This avoids that each time a full-group-dump is requested from ADS; the bitwise match allows to only query those groups we are interested in. The ADS LDAP server changed to RFC compliant behaviour when decoding the ldap filter with extensible match in the latest SPs (fixes). From the patch: /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o * rollup-fixes: * * According to Section 5.1(4) of RFC 2251 if a value of a type is it's * default value, it MUST be absent. In case of extensible matching the * "dnattr" boolean defaults to FALSE and so it must be only be present * when set to TRUE. * * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a * filter using bitwise matching rule then a buggy AD fails to decode * the extensible match. As a workaround set it to TRUE and thereby add * the dnAttributes "dn" field to cope with those older AD versions. * It should not harm and won't put any additional load on the AD since * none of the dn components have a bitmask-attribute. * * Thanks to Ralf Haferkamp for input and testing */ Guenther
* r10656: BIG merge from trunk. Features not copied overGerald Carter2005-09-301-1/+1
| | | | | | | * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck)
* r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the ↵Günther Deschner2005-06-291-4/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | POSIX homedirectory and the loginshell from Active Directory's "Services for Unix". Enable it with: winbind sfu support = yes User-Accounts without SFU-Unix-Attributes will be assigned template-based Shells and Homedirs as before. Note that it doesn't matter which version of Services for Unix you use (2.0, 2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell, msSFU30LoginShell, etc.) automatically. If you also want to share the same uid/gid-space as SFU then also use PADL's ad-idmap-Plugin: idmap backend = ad When using the idmap-plugin only those accounts will appear in Name Service Switch that have those UNIX-attributes which avoids potential uid/gid-space clashes between SFU-ids and automatically assigned idmap-ids. Guenther
* r4665: Fix inspired by posting from Joe Meadows <jameadows@webopolis.com>.Jeremy Allison2005-01-111-3/+0
| | | | | Make all LDAP timeouts consistent. Jeremy.
* r2832: Readd WKGUID-binding to match the correct default-locations of newGünther Deschner2004-10-061-0/+3
| | | | | | | | | | | | | | | User-, Group- and Machine-Accounts in Active Directory (this got lost during the last trunk-merge). This way we match e.g. default containers moved by redircmp.exe and redirusr.exe in Windows 2003 and don't blindly default to cn=Users or cn=Computers. Further wkguids can be examied via "net ads search wellknownobjects=*". This should still keep a samba3-client joining a samba4 dc. Fixes Bugzilla #1343. Guenther
* r2: import HEAD into svn+ssh://svn.samba.org/home/svn/samba/trunkCVS Import User2004-04-041-0/+226
metze
generated by cgit (git 2.34.1) at 2025-09-27 15:41:16 +0000