summaryrefslogtreecommitdiffstats
path: root/source/include/ads.h
Commit message (Collapse)AuthorAgeFilesLines
* kerberos: fix HAVE_KRB5 related build issue.Günther Deschner2008-08-291-3/+4
| | | | Guenther
* kerberos: add KRB5_KT_KEY abstraction macro.Günther Deschner2008-08-291-1/+9
| | | | Guenther
* kerberos: move the KRB5_KEY* macros to header file.Günther Deschner2008-08-291-0/+12
| | | | Guenther
* libads: Add API call to connect to a global catalog server.Gerald W. Carter2008-06-271-1/+3
| | | | | | Extends ads_connect() to a new call ads_connect_gc() which connects on port 3268 rather than port 389. Also makes ads_try_connect() static and only used internally to ldap.c
* libads: add ADS_AUTH_USER_CREDS to avoid magic overwriting of usernames.Günther Deschner2008-06-241-8/+9
| | | | Guenther
* Remove DomainControllerAddressType which we now have in IDL.Günther Deschner2008-02-281-5/+0
| | | | Guenther
* Move DS_DOMAIN_FUNCTION defines to ads.h.Günther Deschner2008-01-291-0/+7
| | | | Guenther
* This is a large patch (sorry). Migrate from struct in_addrJeremy Allison2007-10-241-1/+1
| | | | | | | | | | | | | to struct sockaddr_storage in most places that matter (ie. not the nmbd and NetBIOS lookups). This passes make test on an IPv4 box, but I'll have to do more work/testing on IPv6 enabled boxes. This should now give us a framework for testing and finishing the IPv6 migration. It's at the state where someone with a working IPv6 setup should (theorecically) be able to type : smbclient //ipv6-address/share and have it work. Jeremy.
* r24804: As a temporary workaround, also try to guess the server's principal ↵Günther Deschner2007-10-101-0/+2
| | | | | | | | | in the "not_defined_in_RFC4178@please_ignore" case to make at least LDAP SASL binds succeed with windows server 2008. Guenther
* r24131: - make it more clear what the different min and max fields meanStefan Metzmacher2007-10-101-4/+5
| | | | | | | | | - with the "GSSAPI" sasl mech the plain, sign or seal negotiation is independed from the req_flags and ret_flags - verify the server supports the wrapping type we want - better handling on negotiated buffer sizes metze
* r24039: remove unused global variable...Stefan Metzmacher2007-10-101-1/+1
| | | | metze
* r23946: add support for NTLMSSP sign and sealStefan Metzmacher2007-10-101-1/+1
| | | | | | NOTE: windows servers are broken with sign only... metze
* r23945: add infrastructure to select plain, sign or seal LDAP connectionStefan Metzmacher2007-10-101-1/+12
| | | | metze
* r23926: implement output buffer handling for the SASL write wrapperStefan Metzmacher2007-10-101-2/+2
| | | | metze
* r23922: implement input buffer handling for the SASL read wrapperStefan Metzmacher2007-10-101-15/+46
| | | | metze
* r23898: rename HAVE_ADS_SASL_WRAPPING -> HAVE_LDAP_SASL_WRAPPINGStefan Metzmacher2007-10-101-3/+3
| | | | metze
* r23896: hopefully fix the build on most systemsStefan Metzmacher2007-10-101-1/+1
| | | | metze
* r23893: add dummy callbacks for LDAP SASL wrapping,Stefan Metzmacher2007-10-101-4/+6
| | | | | | they're not used yet... metze
* r23888: move elements belonging to the current ldap connection to aStefan Metzmacher2007-10-101-10/+13
| | | | | | substructure. metze
* r23838: Allow to store schema and config path in ADS_STRUCT config.Günther Deschner2007-10-101-0/+2
| | | | Guenther
* r23826: Fix gpo security filtering by matching the security descriptor ace's ↵Günther Deschner2007-10-101-0/+3
| | | | | | | | for the extended apply group policy right. Guenther
* r23766: Add GTYPE_SECURITY_UNIVERSAL_GROUP define.Günther Deschner2007-10-101-0/+5
| | | | Guenther
* r23607: Add legacy support for Services for Unix (SFU) 2.0.Günther Deschner2007-10-101-4/+12
| | | | Guenther
* r23128: Fix typo.Günther Deschner2007-10-101-1/+1
| | | | Guenther
* r22841: Add comment to endif statement.Lars Müller2007-10-101-1/+1
|
* r22797: We are only interested in the DACL of the security descriptor, so ↵Günther Deschner2007-10-101-0/+1
| | | | | | | | search with the SD_FLAGS control. Guenther
* r22664: When we have krb5_get_init_creds_opt_get_error() then try to get the ↵Günther Deschner2007-10-101-0/+6
| | | | | | | | NTSTATUS codes directly out of the krb5_error edata. Guenther
* r21240: Fix longstanding Bug #4009.Günther Deschner2007-10-101-1/+2
| | | | | | | | | | | | | | | | | For the winbind cached ADS LDAP connection handling (ads_cached_connection()) we were (incorrectly) assuming that the service ticket lifetime equaled the tgt lifetime. For setups where the service ticket just lives 10 minutes, we were leaving hundreds of LDAP connections in CLOSE_WAIT state, until we fail to service entirely with "Too many open files". Also sequence_number() in winbindd_ads.c needs to delete the cached LDAP connection after the ads_do_search_retry() has failed to submit the search request (although the bind succeeded (returning an expired service ticket that we cannot delete from the memory cred cache - this will get fixed later)). Guenther
* r20986: Commit the prototype of the nss_info plugin interface.Gerald Carter2007-10-101-10/+11
| | | | | | | | | | | This allows a provider to supply the homedirectory, etc... attributes for a user without requiring support in core winbindd code. The idmap_ad.c module has been modified to provide the idmap 'ad' library as well as the rfc2307 and sfu "winbind nss info" support. The SID/id mapping is working in idmap_ad but the nss_info still has a few quirks that I'm in the process of resolving.
* r20857: Silence gives assent :-). Checking in the fix forJeremy Allison2007-10-101-0/+1
| | | | | | | | | site support in a network where many DC's are down. I heard via Volker there is still a bug w.r.t the wrong site being chosen with trusted domains but we'll have to layer that fix on top of this. Gd - complain if this doesn't work for you. Jeremy.
* r18019: Fix a C++ warnings: Don't use void * in libads/ for LDAPMessage anymore.Volker Lendecke2007-10-101-0/+4
| | | | | | | Compiled it on systems with and without LDAP, I hope it does not break the build farm too badly. If it does, I'll fix it tomorrow. Volker
* r17970: Add missing include-guards around ads.h and ads_cldap.h.Jeremy Allison2007-10-101-0/+3
| | | | | | Remove all reference to "Default-First-Site-Name" and treat it like any other site. Jeremy.
* r17945: Store the server and client sitenames in the ADSJeremy Allison2007-10-101-0/+2
| | | | | | struct so we can see when they match - only create the ugly krb5 hack when they do. Jeremy.
* r17943: The horror, the horror. Add KDC site support byJeremy Allison2007-10-101-0/+1
| | | | | | | writing out a custom krb5.conf file containing the KDC I need. This may suck.... Needs some testing :-). Jeremy.
* r16548: Fix bug #3867 reported by jason@ncac.gwu.edu.Jeremy Allison2007-10-101-0/+1
| | | | Jeremy.
* r16336: Fix Klocwork ID's 1087, 1095, 1096, 1098, 1099, 1101, 1102, 1105, ↵Volker Lendecke2007-10-101-0/+4
| | | | | | | | 1107, 1109, 1111 Volker
* r15698: An attempt to make the winbind lookup_usergroups() call in security=adsGünther Deschner2007-10-101-0/+15
| | | | | | | | | | | | | | | | | | | | | | | | | more scalable: The most efficient way is to use the "tokenGroups" attribute which gives the nested group membership. As this attribute can not always be retrieved when binding with the machine account (the only garanteed way to get the tokenGroups I could find is when the machine account is a member of the "Pre Win2k Access" builtin group). Our current fallback when "tokenGroups" failed is looking for all groups where the userdn was in the "member" attribute. This behaves not very well in very large AD domains. The patch first tries the "memberOf" attribute on the user's dn in that case and directly retrieves the group's sids by using the LDAP Extended DN control from the user's object. The way to pass down the control to the ldap search call is rather painfull and probably will be rearranged later on. Successfully tested on win2k sp0, win2k sp4, wink3 sp1 and win2k3 r2. Guenther
* r15697: I take no comments as no objections :)Günther Deschner2007-10-101-5/+27
| | | | | | | | | | Expand the "winbind nss info" to also take "rfc2307" to support the plain posix attributes LDAP schema from win2k3-r2. This work is based on patches from Howard Wilkinson and Bob Gautier (and closes bug #3345). Guenther
* r15543: New implementation of 'net ads join' to be more like Windows XP.Gerald Carter2007-10-101-15/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | The motivating factor is to not require more privileges for the user account than Windows does when joining a domain. The points of interest are * net_ads_join() uses same rpc mechanisms as net_rpc_join() * Enable CLDAP queries for filling in the majority of the ADS_STRUCT->config information * Remove ldap_initialized() from sam/idmap_ad.c and libads/ldap.c * Remove some unnecessary fields from ADS_STRUCT * Manually set the dNSHostName and servicePrincipalName attribute using the machine account after the join Thanks to Guenther and Simo for the review. Still to do: * Fix the userAccountControl for DES only systems * Set the userPrincipalName in order to support things like 'kinit -k' (although we might be able to just use the sAMAccountName instead) * Re-add support for pre-creating the machine account in a specific OU
* r15243: Sorry for the breakage:Günther Deschner2007-10-101-1/+5
| | | | | | | * Fix the build without kerberos headers * Fix memleak in the krb5_address handling Guenther
* r15240: Correctly disallow unauthorized access when logging on with theGünther Deschner2007-10-101-0/+12
| | | | | | | | | | | | kerberized pam_winbind and workstation restrictions are in effect. The krb5 AS-REQ needs to add the host netbios-name in the address-list. We don't get the clear NT_STATUS_INVALID_WORKSTATION code back yet from the edata of the KRB_ERROR but the login at least fails when the local machine is not in the workstation list on the DC. Guenther
* r14051: Add remaining (documented) userAccountControl bits, thanks to LukeGünther Deschner2007-10-101-2/+2
| | | | | | Howard for pointing this out. Guenther
* r13657: Let winbindd try to obtain the gecos field from the msSFU30GecosGünther Deschner2007-10-101-0/+2
| | | | | | attribute when "winbind nss info = sfu" is set. Fixes #3539. Guenther
* r13316: Let the carnage begin....Gerald Carter2007-10-101-0/+2
| | | | Sync with trunk as off r13315
* r11242: use LDAP bitwise machting rule when searching for groups in ADS.Günther Deschner2007-10-101-3/+25
| | | | | | | | | | | | | | | | | | | | | | | | | | | This avoids that each time a full-group-dump is requested from ADS; the bitwise match allows to only query those groups we are interested in. The ADS LDAP server changed to RFC compliant behaviour when decoding the ldap filter with extensible match in the latest SPs (fixes). From the patch: /* Workaround ADS LDAP bug present in MS W2K3 SP0 and W2K SP4 w/o * rollup-fixes: * * According to Section 5.1(4) of RFC 2251 if a value of a type is it's * default value, it MUST be absent. In case of extensible matching the * "dnattr" boolean defaults to FALSE and so it must be only be present * when set to TRUE. * * When it is set to FALSE and the OpenLDAP lib (correctly) encodes a * filter using bitwise matching rule then a buggy AD fails to decode * the extensible match. As a workaround set it to TRUE and thereby add * the dnAttributes "dn" field to cope with those older AD versions. * It should not harm and won't put any additional load on the AD since * none of the dn components have a bitmask-attribute. * * Thanks to Ralf Haferkamp for input and testing */ Guenther
* r10656: BIG merge from trunk. Features not copied overGerald Carter2007-10-101-1/+1
| | | | | | | * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck)
* r7994: This adds support in Winbindd's "security = ads"-mode to retrieve the ↵Günther Deschner2007-10-101-4/+20
| | | | | | | | | | | | | | | | | | | | | | | | | | | | POSIX homedirectory and the loginshell from Active Directory's "Services for Unix". Enable it with: winbind sfu support = yes User-Accounts without SFU-Unix-Attributes will be assigned template-based Shells and Homedirs as before. Note that it doesn't matter which version of Services for Unix you use (2.0, 2.2, 3.0 or 3.5). Samba should detect the correct attributes (msSFULoginShell, msSFU30LoginShell, etc.) automatically. If you also want to share the same uid/gid-space as SFU then also use PADL's ad-idmap-Plugin: idmap backend = ad When using the idmap-plugin only those accounts will appear in Name Service Switch that have those UNIX-attributes which avoids potential uid/gid-space clashes between SFU-ids and automatically assigned idmap-ids. Guenther
* r4665: Fix inspired by posting from Joe Meadows <jameadows@webopolis.com>.Jeremy Allison2007-10-101-3/+0
| | | | | Make all LDAP timeouts consistent. Jeremy.
* r2832: Readd WKGUID-binding to match the correct default-locations of newGünther Deschner2007-10-101-0/+3
| | | | | | | | | | | | | | | User-, Group- and Machine-Accounts in Active Directory (this got lost during the last trunk-merge). This way we match e.g. default containers moved by redircmp.exe and redirusr.exe in Windows 2003 and don't blindly default to cn=Users or cn=Computers. Further wkguids can be examied via "net ads search wellknownobjects=*". This should still keep a samba3-client joining a samba4 dc. Fixes Bugzilla #1343. Guenther
* Fix bugzilla # 1208Jim McDonough2004-03-241-0/+1
| | | | | | | | | | Winbind tickets expired. We now check the expiration time, and acquire new tickets. We couln't rely on renewing them, because if we didn't get a request before they expired, we wouldn't have renewed them. Also, there is a one-week limit in MS on renewal life, so new tickets would have been needed after a week anyway. Default is 10 hours, so we should only be acquiring them that often, unless the configuration on the DC is changed (and the minimum is 1 hour).
generated by cgit (git 2.34.1) at 2025-09-02 13:20:17 +0000