summaryrefslogtreecommitdiffstats
path: root/source/libads/sasl.c
Commit message (Collapse)AuthorAgeFilesLines
* Fix Coverity ID 488Volker Lendecke2008-03-231-0/+2
| | | | "status" was used uninitialized on success -- metze, please check
* libads: fix typoStefan Metzmacher2007-12-061-1/+1
| | | | metze
* RIP BOOL. Convert BOOL -> bool. I found a few interestingJeremy Allison2007-10-181-2/+2
| | | | | | | bugs in various places whilst doing this (places that assumed BOOL == int). I also need to fix the Samba4 pidl generation (next checkin). Jeremy.
* r25422: Get rid of some cast warnings.Michael Adam2007-10-101-3/+3
|
* r25407: Revert Longhorn join patch as it is not correct for the 3.2 tree.Gerald Carter2007-10-101-3/+1
| | | | | | The translate_name() used by cli_session_setup_spnego() cann rely Winbindd since it is needed by the join process (and hence before Winbind can be run).
* r25400: Windows 2008 (Longhorn) Interop fixes for AD specific auth2 flags,Gerald Carter2007-10-101-1/+3
| | | | and client fixes. Patch from Todd Stetcher <todd.stetcher@isilon.com>.
* r25328: When using ldap sasl wrapping with gssapi it's important to receive ↵Günther Deschner2007-10-101-0/+5
| | | | | | | | warnings for clock-skew errors. Guenther
* r25133: Fix sasl wrapping (for ldap sign&seal).Günther Deschner2007-10-101-46/+5
| | | | | | | | | | | | | | | The gss_import_name() broke as we switched from the internal MIT OID "gss_nt_krb5_principal" to "GSS_KRB5_NT_PRINCIPAL_NAME" and didn't switch from passing the krb5_principal (or better: a pointer to that, see MIT's "*HORRIBLE* bug") to pass the string principal directly. Jerry, Jeremy, neither I could figure out the need of passing in a krb5_principal at all nor could I reproduce the crash you were seeing. I sucessfully tested the code (now importing a string) with MIT 1.2.7, 1.3.6, 1.4.3, 1.5.1, 1.6.1 and Heimdal 0.7.2, 1.0, 1.0.1. Guenther
* r25109: Remove obsolete argument from ads_guess_service_principal().Günther Deschner2007-10-101-3/+2
| | | | Guenther
* r25108: Make ifdef labyrinth in sasl code a bit more readable.Günther Deschner2007-10-101-2/+2
| | | | Guenther
* r24804: As a temporary workaround, also try to guess the server's principal ↵Günther Deschner2007-10-101-41/+12
| | | | | | | | | in the "not_defined_in_RFC4178@please_ignore" case to make at least LDAP SASL binds succeed with windows server 2008. Guenther
* r24251: Neverending fun:Günther Deschner2007-10-101-1/+1
| | | | | | | | Heimdal doesn't accept all OIDs and gss_import_name() fails with GSS_S_BAD_NAMETYPE using this one. Use the GSS_KRB5_NT_PRINCIPAL_NAME OID instead (which works with at least MIT 1.6.1 and Heimdal 1.0.1). Guenther
* r24131: - make it more clear what the different min and max fields meanStefan Metzmacher2007-10-101-33/+44
| | | | | | | | | - with the "GSSAPI" sasl mech the plain, sign or seal negotiation is independed from the req_flags and ret_flags - verify the server supports the wrapping type we want - better handling on negotiated buffer sizes metze
* r24128: fix double free in error pathStefan Metzmacher2007-10-101-6/+7
| | | | metze
* r24104: fix the build, sorry...Stefan Metzmacher2007-10-101-3/+4
| | | | metze
* r24103: add some useful debug messages, as not all LDAPStefan Metzmacher2007-10-101-3/+19
| | | | | | libraries support wrapping hooks... metze
* r24098: - make use of the ads_service_principal abstractionStefan Metzmacher2007-10-101-61/+32
| | | | | | | | also for the "GSSAPI" sasl mech. - also use the ads_kinit_password() fallback logic from the "GSS-SPNEGO" sasl mech. metze
* r24095: add one more fallback alternative toStefan Metzmacher2007-10-101-0/+20
| | | | | | construct the principal metze
* r24093: move gssapi/krb5 principal handling into a functionStefan Metzmacher2007-10-101-88/+146
| | | | metze
* r24062: fix logic for broken krb5 libs which always forceStefan Metzmacher2007-10-101-1/+2
| | | | | | sign and seal... metze
* r24042: add support for krb5 sign and seal in LDAP via "GSS-SPNEGO"Stefan Metzmacher2007-10-101-1/+309
| | | | metze
* r24037: only setup sasl wrapping after a successful bindStefan Metzmacher2007-10-101-2/+4
| | | | metze
* r23953: Some C++ warningsVolker Lendecke2007-10-101-3/+6
|
* r23948: add gsskrb5 sign and seal support for LDAP connectionsStefan Metzmacher2007-10-101-5/+135
| | | | | | NOTE: only for the "GSSAPI" SASL mech yet metze
* r23946: add support for NTLMSSP sign and sealStefan Metzmacher2007-10-101-1/+122
| | | | | | NOTE: windows servers are broken with sign only... metze
* r23945: add infrastructure to select plain, sign or seal LDAP connectionStefan Metzmacher2007-10-101-0/+8
| | | | metze
* r23888: move elements belonging to the current ldap connection to aStefan Metzmacher2007-10-101-6/+6
| | | | | | substructure. metze
* r23784: use the GPLv3 boilerplate as recommended by the FSF and the license textAndrew Tridgell2007-10-101-2/+1
|
* r23779: Change from v2 or later to v3 or later.Jeremy Allison2007-10-101-1/+1
| | | | Jeremy.
* r22844: Introduce const DATA_BLOB data_blob_null = { NULL, 0, NULL }; andVolker Lendecke2007-10-101-9/+9
| | | | replace all data_blob(NULL, 0) calls.
* r22153: fix LDAP SASL "GSSAPI" bind against w2k3, this isn't criticalStefan Metzmacher2007-10-101-5/+10
| | | | | | | because we try "GSS-SPNEGO" first and all windows version support that. metze
* r22092: - make spnego_parse_auth_response() more generic andStefan Metzmacher2007-10-101-1/+1
| | | | | | | | | not specific for NTLMSSP - it's possible that the server sends a mechOID and authdata if negResult != SPNEGO_NEG_RESULT_INCOMPLETE, but we still force the mechOID to be present if negResult == SPNEGO_NEG_RESULT_INCOMPLETE metze
* r22079: Tsk, tsk, Metze didn't compile before check-in :-).Jeremy Allison2007-10-101-1/+1
| | | | | Merge the memory leak fix (with fix :-) to 3.0.25. Jeremy.
* r22078: fix memory leak in not often used code, we only use it if the serverStefan Metzmacher2007-10-101-3/+3
| | | | | | | | doesn't support GSS-SPNEGO in SASL can someone please review this, maybe it's also for 3.0.25 metze
* r21850: After Jerry explained to me the HORRIBLE way in whichJeremy Allison2007-10-101-5/+15
| | | | | | | | the MIT gss libraries *SUCK*, move the frees to the end of the function so MIT doesn't segfault..... Add a comment so that another engineer knows why I did this. Jeremy.
* r21847: Fix memory leaks in error paths (and in main code path in one case...)Jeremy Allison2007-10-101-5/+13
| | | | | in sasl bind. Wonder why coverity didn't find these ? Jeremy.
* r21273: * Protect the sasl bind against a NULL principal stringGerald Carter2007-10-101-1/+29
| | | | in the SPNEGO negTokenInit
* r21240: Fix longstanding Bug #4009.Günther Deschner2007-10-101-2/+6
| | | | | | | | | | | | | | | | | For the winbind cached ADS LDAP connection handling (ads_cached_connection()) we were (incorrectly) assuming that the service ticket lifetime equaled the tgt lifetime. For setups where the service ticket just lives 10 minutes, we were leaving hundreds of LDAP connections in CLOSE_WAIT state, until we fail to service entirely with "Too many open files". Also sequence_number() in winbindd_ads.c needs to delete the cached LDAP connection after the ads_do_search_retry() has failed to submit the search request (although the bind succeeded (returning an expired service ticket that we cannot delete from the memory cred cache - this will get fixed later)). Guenther
* r21046: Backing out svn r20403 (Andrew's krb5 ticket cleanupGerald Carter2007-10-101-0/+11
| | | | | | | | as this is causing the WRONG_PASSWORD error in the SetUserInfo() call during net ads join). We are now back to always list RC4-HMAC first if supported by the krb5 libraries.
* r20403: Cleaning out my Samba 3.0 tree:Andrew Bartlett2007-10-101-11/+0
| | | | | | | | | As discussed with jerry at the CIFS conf: overriding the administrator's wishes from the krb5.conf has only every given me segfaults. We suggest leaving this up to the defaults from the libraries anyway. Andrew Bartlett
* r20132: get rid of defined but not used warning - static function only usedHerb Lewis2007-10-101-0/+2
| | | | inside the #ifdef HAVE_KRB5
* r18047: More C++ stuffVolker Lendecke2007-10-101-3/+3
|
* r18019: Fix a C++ warnings: Don't use void * in libads/ for LDAPMessage anymore.Volker Lendecke2007-10-101-1/+1
| | | | | | | Compiled it on systems with and without LDAP, I hope it does not break the build farm too badly. If it does, I'll fix it tomorrow. Volker
* r17899: Fix Stanford checker bug - possible null deref.Jeremy Allison2007-10-101-2/+5
| | | | Jeremy.
* r16945: Sync trunk -> 3.0 for 3.0.24 code. Still needJeremy Allison2007-10-101-2/+0
| | | | | | | to do the upper layer directories but this is what everyone is waiting for.... Jeremy.
* r15210: Add wrapper functions smb_krb5_parse_name, smb_krb5_unparse_name,Jeremy Allison2007-10-101-1/+1
| | | | | | | smb_krb5_parse_name_norealm_conv that pull/push from unix charset to utf8 (which krb5 uses on the wire). This should fix issues when the unix charset is not compatible with or set to utf8. Jeremy.
* r13316: Let the carnage begin....Gerald Carter2007-10-101-5/+18
| | | | Sync with trunk as off r13315
* r13137: make cleare where long ifdefs endsSimo Sorce2007-10-101-2/+2
|
* r11504: Added Andrew Bartletts removal of another NTLMSSP implementationJeremy Allison2007-10-101-85/+89
| | | | | patch. Jeremy.
* r10656: BIG merge from trunk. Features not copied overGerald Carter2007-10-101-1/+1
| | | | | | | * \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck)
generated by cgit (git 2.34.1) at 2025-09-04 20:35:45 +0000