summaryrefslogtreecommitdiffstats
path: root/source/include/smbldap.h
Commit message (Collapse)AuthorAgeFilesLines
* r20215: Next step trying to fix the Solaris build.Volker Lendecke2007-10-101-1/+1
| | | | | | | | | I think "anonimous" is correctly spelled "anonymous". The Solaris compile is referring to this as "anonymous" in line 814 of smbldap.c. Simo, please check. Thanks, Volker
* r20116: Start merging in the work done to create the new idmap subsystem.Simo Sorce2007-10-101-0/+4
| | | | Simo.
* r16122: As we use 'inetOrgPerson' as structural objectclass for new accounts forGünther Deschner2007-10-101-0/+1
| | | | | | | | | | eDir, we already add 'sn' as required attribute on LDAP add operations. When we modify an entry, we need to request 'sn' as well in our attribute lists, so that we don't try to add it a second time. Guenther
* r13460: by popular demand....Gerald Carter2007-10-101-7/+2
| | | | | | | | | * remove pdb_context data structure * set default group for DOMAIN_RID_GUEST user as RID 513 (just like Windows) * Allow RID 513 to resolve to always resolve to a name * Remove auto mapping of guest account primary group given the previous 2 changes
* r13316: Let the carnage begin....Gerald Carter2007-10-101-3/+12
| | | | Sync with trunk as off r13315
* r10656: BIG merge from trunk. Features not copied overGerald Carter2007-10-101-4/+9
| | | | | | | * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck)
* r9303: Clobber compiler warnings. Patch from Jason Mader ↵James Peach2007-10-101-2/+24
| | | | | | <jason@ncac.gwu.edu> plus some extra function declarations. Bugzilla bug #2523.
* r6351: This is quite a large and intrusive patch, but there are not many ↵Volker Lendecke2007-10-101-0/+1
| | | | | | | | | | | | | | | | pieces that can be taken out of it, so I decided to commit this in one lump. It changes the passdb enumerating functions to use ldap paged results where possible. In particular the samr calls querydispinfo, enumdomusers and friends have undergone significant internal changes. I have tested this extensively with rpcclient and a bit with usrmgr.exe. More tests and the merge to trunk will follow later. The code is based on a first implementation by Günther Deschner, but has evolved quite a bit since then. Volker
* r5655: Added support for Novell NDS universal password. Code donated byJeremy Allison2007-10-101-0/+25
| | | | | | | | Vince Brimhall <vbrimhall@novell.com> - slight tidyup by me to use Samba conventions. Vince - thanks a *lot* for this code - please test to make sure I haven't messed anything up. Jeremy.
* r5428: Apply some const. LDAP attribs should now be declared const char ↵Volker Lendecke2007-10-101-2/+2
| | | | | | | | *attr[]. This gives some new warnings in smbldap.c, but a the callers are cleaned up. Volker
* r5349: After talking with Jerry, reverted the addition of account policies toGünther Deschner2007-10-101-4/+0
| | | | | | passdb in 3_0 (they are still in trunk). Guenther
* r4925: Migrate Account Policies to passdb (esp. replicating ldapsam).Günther Deschner2007-10-101-0/+4
| | | | | | | | Does automated migration from account_policy.tdb v1 and v2 and offers a pdbedit-Migration interface. Jerry, please feel free to revert that if you have other plans. Guenther
* r4840: * Add more generic root-dse inspection function to check for givenGünther Deschner2007-10-101-0/+1
| | | | | | | | | controls or extensions. * Check and remember if ldapsam's LDAP Server support paged results (in preparation of adding async paged-results to set|get|end-sampwent in ldapsam). Guenther
* r4736: small set of merges from rtunk to minimize the diffsGerald Carter2007-10-101-1/+1
|
* r3563: During a typical logon a modern workstation makes a lot of anonymous ↵Volker Lendecke2007-10-101-0/+1
| | | | | | | | | | | session setups on its way to open a pipe. This gets rid of many round-trips to the LDAP server during logon by setting up the server_info_guest once and not asking the LDAP server and nss every time. Make sure that the ldap connection is reopened in the child. (I did not look at the sql backends.) Volker
* r2444: Based on jmcd's patch, implement special lists for the ldap user ↵Volker Lendecke2007-10-101-0/+2
| | | | | | | | | | | | | attributes to delete. Richard, IMHO this is the better solution to the problem you currently have. Please review. Thanks, Volker
* r1810: Patch from Richard Renard <rrenard@idealx.com> to storeJeremy Allison2007-10-101-0/+1
| | | | | logon hours attributes in an LDAP database. Jeremy.
* r1588: This is one of the more pathetic patches I ever checked in. Many hours ofVolker Lendecke2007-10-101-1/+1
| | | | | | | | | | | | | coding have passed, but I could not find a way to get the OpenLDAP libraries to reliably time out on any of the queries we make, *and* get correct error returns. No, async calls and ldap_result does NOT work, or I was simply too stupid to correctly interpret the OpenLDAP manpage and source. We can not allow to hang indefinitely in an ldap query, especially not for winbindd. "ldap timeout" now specifies the overall timeout for the complete operation, that's why I increased that to 15 seconds. Volker
* r1388: Adding password history code for ldap backend, based on a patch fromJeremy Allison2007-10-101-2/+3
| | | | | | | | | "Jianliang Lu" <j.lu@tiesse.com>. Multi-string attribute changed to linearised pstring due to ordering issues. A few other changes to fix race conditions. I will add the tdb backend code next. This code compiles but has not yet been tested with password history policy set to greater than zero. Targeted for 3.0.6. Jeremy.
* r1317: Patch from Joe Meadows "Joe Meadows" <jameadows@webopolis.com> toJeremy Allison2007-10-101-1/+2
| | | | | | add a timeout to the ldap open calls. New parameter, ldap timeout added. Jeremy.
* r116: volker's patch for local group and group nestingGerald Carter2007-10-101-0/+3
|
* r53: Remove modifyTimestamp from list of our attributes. We just check it forJim McDonough2007-10-101-1/+0
| | | | | | cache entry time comparisons in password lockout. Fixes problems where pdb_ldap tries to delete the operational attribute modifyTimestamp when deleting a user account.
* Password lockout for LDAP backend. Caches autolock flag, bad count, andJim McDonough2004-03-181-0/+1
| | | | | | | | | | | | | | | bad time locally, updating the directory only for hitting the policy limit or resetting. This needed to be done at the passdb level rather than auth, because some of the functions need to be supported from tools such as pdbedit. It was done at the LDAP backend level instead of generically after discussion, because of the complexity of inserting it at a higher level. The login cache read/write/delete is outside of the ldap backend, so it could easily be called by other backends. tdbsam won't call it for obvious reasons, and authors of other backends need to decide if they want to implement it.
* Get MungedDial actually working with full TS strings in it for pdb_ldap.Jim McDonough2004-03-111-1/+4
| | | | | | | I know this isn't pretty, but neither was our assumption that all strings from the directory fit inside a pstring. There was no way this worked before will all versions of usrmgr (for example, the only version of mine that has the TS Confic button).
* Add bad password count/time attributesJim McDonough2004-02-231-0/+1
|
* This is metze's LDAP rebind sleep patch:Volker Lendecke2003-12-251-0/+2
| | | | | | | | | | | When smb.conf tells us to write to a read-only LDAP replica and we are redirected by the LDAP server, the replication might take some seconds, especially over slow links. This patch delays the next read after a rebind for 'ldap rebind sleep' milliseconds. Metze, thanks for your patience. Volker
* support munged dial for ldapsam; patch from Aurélien Degrémont; bug 800Gerald Carter2003-12-041-0/+1
|
* The "unknown_5" 32 bit field in the user structs is actually 2 16-bitJeremy Allison2003-09-181-0/+2
| | | | | | | | | | | fields, bad_password_count and logon_count. Ensure this is stored/fetched in the various SAMs. As it replaces the unknown_5 field this fits exactly into the tdb SAM without any binary problems. It also is added to the LDAP SAM as two extra attributes. It breaks compatibility with the experimental SAMs xml and mysql. The maintainers of these SAMs must fix them so upgrades like this can be done transparently. I will insist on the "experimental" status until this is solved. Jeremy.
* Disconnect an idle LDAP connection after 150 seconds.Volker Lendecke2003-07-171-0/+3
| | | | | | | | | | | | Not strictly a bugfix, but it should considerably reduce the load we put on LDAP servers given that at least nss_ldap on Linux keeps a connection open. And it should also stress our reconnect-code a bit more ;-) Thanks to metze for this! Volker
* This patch cleans up some of our ldap code, for better behaviour:Andrew Bartlett2003-07-041-1/+5
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | We now always read the Domain SID out of LDAP. If the local secrets.tdb is ever different to LDAP, it is overwritten out of LDAP. We also store the 'algorithmic rid base' into LDAP, and assert if it changes. (This ensures cross-host synchronisation, and allows for possible integration with idmap). If we fail to read/add the domain entry, we just fallback to the old behaviour. We always use an existing DN when adding IDMAP entries to LDAP, unless no suitable entry is available. This means that a user's posixAccount will have a SID added to it, or a user's sambaSamAccount will have a UID added. Where we cannot us an existing DN, we use 'sambaSid=S-x-y-z,....' as the DN. The code now allows modifications to the ID mapping in many cases. Likewise, we now check more carefully when adding new user entires to LDAP, to not duplicate SIDs (for users, at this stage), and to add the sambaSamAccount onto the idmap entry for that user, if it is already established (ensuring we do not duplicate sambaSid entries in the directory). The allocated UID code has been expanded to take into account the space between '1000 - algorithmic rid base'. This much better fits into what an NT4 does - allocating in the bottom part of the RID range. On the code cleanup side of things, we now share as much code as possible between idmap_ldap and pdb_ldap. We also no longer use the race-prone 'enumerate all users' method for finding the next RID to allocate. Instead, we just start at the bottom of the range, and increment again if the user already exists. The first time this is run, it may well take a long time, but next time will just be able to use the next Rid. Thanks to metze and AB for double-checking parts of this. Andrew Bartlett
* Patch to move functions directly from pdb_ldap.c into lib/smbldap.cAndrew Bartlett2003-06-251-15/+25
| | | | | | The functions are unchanged. Next step is to make idmap_ldap use them. Andrew Bartlett
* This patch works towards to goal of common code shared between idmap_ldapAndrew Bartlett2003-06-211-2/+13
| | | | | | | | | | | | | | and pdb_ldap. So far, it's just a function rename, so that the next patch can be a very simple matter of copying functions, without worrying about what changed in the process. Also removes the 'static' pointers for the rebind procedures, replacing them with a linked list of value/key lookups. (Only needed on older LDAP client libs) Andrew Bartlett
* fix build on systems w/o LDAP libsGerald Carter2003-06-061-0/+14
|
* * break out more common code used between pdb_ldap and idmap_ldapGerald Carter2003-06-061-0/+2
| | | | | | | | | | * remove 'winbind uid' and 'winbind gid' parameters (replaced by current idmap parameter) * create the sambaUnixIdPool entries automatically in the 'ldap idmap suffix' * add new 'ldap idmap suffix' and 'ldap group suffix' parametrer * "idmap backend = ldap" now accepts 'ldap:ldap://server/' format (parameters are passed to idmap init() function
* working draft of the idmap_ldap code.Gerald Carter2003-06-051-0/+101
Includes sambaUnixIdPool objectclass Still needs cleaning up wrt to name space. More changes to come, but at least we now have a a working distributed winbindd solution.
generated by cgit (git 2.34.1) at 2024-10-07 14:24:56 +0000