summaryrefslogtreecommitdiffstats
path: root/source/nsswitch/winbindd.h
Commit message (Collapse)AuthorAgeFilesLines
* THE Idmap patch :-)Simo Sorce2003-04-021-1/+1
| | | | | | | | | | | | | | | | | | | includes a --with-idmap=no switch to disable idmap usage if you find problems. cosmetic fixes and param aliases to separate winbind from idamp roles. A temporarily remote idmap winbind compatibility backend. As I have time I will further change code to not call directly winbind (partly done but not tested) and a specilized module will be built in place for the current glue hack. The patch has been tested locally in my limited time, the patch is simple and clear and should not reserve problems, if any just disable it. As usual, comments and fisex are welcome :-) Simo.
* NTLM Authentication:Andrew Bartlett2003-03-231-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Add a 'privileged' mode to Winbindd. This is achieved by means of a directory under lockdir, that the admin can change the group access for. - This mode is now required to access with 'CRAP' authentication feature. - This *will* break the current SQUID helper, so I've fixed up our ntlm_auth replacement: - Update our NTLMSSP code to cope with 'datagram' mode, where we don't get a challenge. - Use this to make our ntlm_auth utility suitable for use in current Squid 2.5 servers. - Tested - works for Win2k clients, but not Win9X at present. NTLMSSP updates are needed. - Now uses fgets(), not x_fgets() to cope with Squid environment (I think somthing to do with non-blocking stdin). - Add much more robust connection code to wb_common.c - it will not connect to a server of a different protocol version, and it will automatically try and reconnect to the 'privileged' pipe if possible. - This could help with 'privileged' idmap operations etc in future. - Add a generic HEX encode routine to util_str.c, - fix a small line of dodgy C in StrnCpy_fn() - Correctly pull our 'session key' out of the info3 from th the DC. This is used in both the auth code, and in for export over the winbind pipe to ntlm_auth. - Given the user's challenge/response and access to the privileged pipe, allow external access to the 'session key'. To be used for MSCHAPv2 integration. Andrew Bartlett
* *Excellent* patch from Michael Steffens <michael_steffens@hp.com> to limitJeremy Allison2003-02-281-10/+11
| | | | | | | | | the unix domain sockets used by winbindd (also solves FD_SETSIZE problem in winbindd to boot !). Adds a "last_access" field to winbindd connections, and will close the oldest idle connection once the number of open connections goes over WINBINDD_MAX_SIMULTANEOUS_CLIENTS (defined in local.h as 200 currently). Jeremy.
* Kill RID-only and domain+RID madness from winbind.Andrew Bartlett2003-02-261-16/+12
| | | | | | | | | | | | | | | | | | | Now we deal with SIDs in almost all of winbind (a couple of limited exceptions remain, but I'm looking into them - they use non-winbind structs ATM). This has particular benifits in returning out-of-domain SIDs for group membership (Need to look into this a bit more) as well as general code quality. This also removes much of the complexity from the idmap interface, which now only deals with mapping IDs, not with SID->domain translations. Breifly tested, but needs more. Fixes some valgrind-found bugs from my previous commit. Winbind cache chagned to using SID strings in some places, as I could not follow exactly how to save and restore multiple packed sids properly. Andrew Bartlett
* From aliguori@us.ibm.com:Jim McDonough2003-02-201-0/+25
| | | | | | This patch adds the architecture for an IDMAP backend system including a new smb.conf parameter "winbind backend". Right now, the only valid value is "tdb" but I'm currently working on an LDAP backend.
* Move to a in-memory ccache for winbind, and replace setenv() properly.Andrew Bartlett2003-02-191-14/+0
| | | | | | | | (According to the manpages, you cannot put a stack variable into putenv()). Yes, this leaks memory. Andrew Bartlett
* merge from APP_HEADGerald Carter2002-10-081-1/+7
| | | | | | | | | * s/driverlocation/comment * detect native mode domain and enumerate local groups Also * Added sendfile stats from SAMBA_2_2
* merge native_mode flag in winbindd_domain struct from app-headGerald Carter2002-10-041-0/+1
|
* This fixes a number of ADS problems, particularly with netbioslessAndrew Tridgell2002-08-051-1/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | setups. - split up the ads structure into logical pieces. This makes it much easier to keep things like the authentication realm and the server realm separate (they can be different). - allow ads callers to specify that no sasl bind should be performed (used by "net ads info" for example) - fix an error with handing ADS_ERROR_SYSTEM() when errno is 0 - completely rewrote the code for finding the LDAP server. Now try DNS methods first, and try all DNS servers returned from the SRV DNS query, sorted by closeness to our interfaces (using the same sort code as we use in replies from WINS servers). This allows us to cope with ADS DCs that are down, and ensures we don't pick one that is on the other side of the country unless absolutely necessary. - recognise dnsRecords as binary when displaying them - cope with the realm not being configured in smb.conf (work it out from the LDAP server) - look at the trustDirection when looking up trusted domains and don't include trusts that trust our domains but we don't trust theirs. - use LDAP to query the alternate (netbios) name for a realm, and make sure that both and long and short forms of the name are accepted by winbindd. Use the short form by default for listing users/groups. - rescan the list of trusted domains every 5 minutes in case new trust relationships are added while winbindd is running - include transient trust relationships (ie. C trusts B, B trusts A, so C trusts A) in winbindd. - don't do a gratuituous node status lookup when finding an ADS DC (we don't need it and it could fail) - remove unused sid_to_distinguished_name function - make sure we find the allternate name of our primary domain when operating with a netbiosless ADS DC (using LDAP to do the lookup) - fixed the rpc trusted domain enumeration to support up to approx 2000 trusted domains (the old limit was 3) - use the IP for the remote_machine (%m) macro when the client doesn't supply us with a name via a netbios session request (eg. port 445) - if the client uses SPNEGO then use the machine name from the SPNEGO auth packet for remote_machine (%m) macro - add new 'net ads workgroup' command to find the netbios workgroup name for a realm
* debug classizedSimo Sorce2002-05-211-0/+3
|
* Moved definition of winbind username/password secrets into secrets.hTim Potter2002-04-101-6/+0
|
* Winbind cleanup.Andrew Bartlett2002-02-151-0/+1
| | | | | | | | | | | | | | | | | | This patch fixes the segfaults I introduced in the previous conneciton caching patch. It cleans up the connection cache a *lot* - in particular it adds significant robustness to the operation. If a the DC goes down, we no longer fail the next operation - the code checks if the connection died during one of its own operations on the socket, and restarts the conneciton as required. There is still a memory leak in here somewhere - but this code also cleans up a number of these. Also added is the abilty to sepecify the domain of the 'get around restrict anonymous' user that winbind uses. Andrew Bartlett
* Removed version number from file header.Tim Potter2002-01-301-2/+1
| | | | Changed "SMB/Netbios" to "SMB/CIFS" in file header.
* Always query the PDC for the list of trusted domains rather than interatingTim Potter2002-01-111-17/+26
| | | | | | | | | | | | | | | | | the list received at startup or we get an out of date list. I thought there might be some sequence number that is incremented when a trusted domain is added or removed - perhaps there is but I just haven't found it yet. - Renamed get_domain_info() to init_domain_list() - Made an accessor function to return the list of trusted domains rather than using a global so we don't have to remember to put a magic init function - The getent state can not keep a pointer to a winbind_domain structure as it may be freed if init_domain_list() is called again so we keep the domain name instead
* added trusted realm support to ADS authenticationAndrew Tridgell2001-12-191-0/+1
| | | | | | the method used for checking if a domain is a trusted domain is very crude, we should really call a backend fn of some sort. For now I'm using winbindd to do the dirty work.
* Modify winbindd to use authenticated user info from secrets.tdb when makingTim Potter2001-12-111-0/+5
| | | | IPC$ connections to domain controllers.
* removed the start_ndx parameter from group enumerationAndrew Tridgell2001-12-111-3/+2
| | | | | | I tried testing this by lowering the buffer size in cli_samr_enum_dom_groups() but that didn't work - I think this needs more looking into
* got rid of start_ndx from query_user_list()Andrew Tridgell2001-12-111-3/+2
|
* winbindd backends can now be marked "consistent" or "inconsistent"Andrew Tridgell2001-12-101-2/+4
| | | | | | | consistent backends (like ADS) always give correct primary group info, so we can play cache tricks to speed things up a lot inconsistent backends (like MSRPC) need to fetch stuff more often
* moved the domain sid lookup and enumeration of trusted domains intoAndrew Tridgell2001-12-101-0/+11
| | | | | | | | the backends at startup, loop until we get the domain sid for our primary domain, trying every 10 seconds. This makes winbindd handle a room-wide power failure better
* completely new winbindd cache infrastructureAndrew Tridgell2001-12-091-1/+3
| | | | | | | | | | | | | | | | | | | this one looks like just another winbind backend, and has the following properties: - does -ve and +ve cacheing of all queries - can be disabled with -n switch to winbindd - stores all records packed, so even huge domains are not a problem for a complete cache - handles the server being down - uses sequence numbers for all entries This fixes a lot of problems with winbindd. Serving from cache is now *very* fast.
* moved the sequence number fetch into the backend, and fetch theAndrew Tridgell2001-12-051-0/+3
| | | | sequence number via ldap when using ads
* added very basic ads connection cacheingAndrew Tridgell2001-12-051-0/+1
|
* finally worked out how to do ldap lookups by binary blobs, so I canAndrew Tridgell2001-12-051-5/+17
| | | | | | | now do searches on SID. This allows me to do a true ldap sid_to_name() function one one function to go!
* added lookup_groups() to the ads backendAndrew Tridgell2001-12-041-2/+3
| | | | winbindd/ADS can now do initgroups()
* moved lookup_usergroups() into the backend structureAndrew Tridgell2001-12-041-0/+5
|
* added a query_user backendAndrew Tridgell2001-12-041-0/+7
| | | | fixed a winbindd crash when the group membership can't be looked up
* changed query_dispinfo to query_user_listAndrew Tridgell2001-12-031-3/+3
|
* put sid_to_name behind the winbindd backend interfaceAndrew Tridgell2001-12-031-0/+6
| | | | | | | I spent quite a while trying to work out how to make this call via ldap and failed. I then found that MS servers seem use rpc for sid_to_name, and it works even when in native mode, I ended up just implementing it via rpc
* added name_to_sid to the backendAndrew Tridgell2001-12-031-0/+5
|
* split winbindd_enum_dom_groups into the new backend structureAndrew Tridgell2001-12-031-1/+4
| | | | | | also created winbindd_rpc.c which contains the functions that have been converted to the new structure. There will soon be a winbindd_ads.c for the ldap backend
* The beginnings of alternative backends for winbinddAndrew Tridgell2001-12-011-1/+23
| | | | | | This just splits off the dispinfo call behind a methods structure. I'll split off a few more functions soon, then we will be ready for LDAP replacement methods
* Added transparent +ve caching for lookupname/lookupsid. -ve caching canJeremy Allison2001-11-211-1/+1
| | | | | | | | be easily added (a one liner) once we know the correct error codes returned by a W2K DC. All other winbindd calls should go through a similar transparent caching layer (and will soon). Jeremy.
* Fixed some memory leaks introduced by connection handling rewrite, as wellTim Potter2001-10-191-1/+0
| | | | | | as one memory leak that has been there for ages! Changed the way talloc is used in get{pw,gr}nam routines.
* Converted some more functions to create and dispose of a talloc context on aTim Potter2001-10-191-0/+1
| | | | | | | | per-call basis rather than per-connection. Had a bit more of a reformatting fest. Still need to run it through insure and handle downed connections.
* Removed some unused code from the recent cleanup.Tim Potter2001-10-121-10/+2
|
* This is the start of a bit of a rewrite of winbindd's connection handling.Tim Potter2001-10-051-13/+9
| | | | | | | | | | | I've wrapped up all the decisions about managing, making and closing connections into a connection manager in nsswitch/winbindd_cm.c. It's rather incomplete at the moment - only querying basic user info works at the moment (i.e finger -m DOMAIN/user) and everything else is broken. Jeremy, please take a look and I'll start moving across the rest of winbindd to this new system.
* Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter2001-10-021-4/+0
|
* merge from APPLIANCE_TNGGerald Carter2001-08-301-0/+1
|
* Preliminary merge of winbind into HEAD. Note that this compiles and linksTim Potter2001-05-071-18/+46
| | | | but I haven't actually run it yet so it probably doesn't work. (-:
* in head as well ...Andrew Tridgell2000-05-101-1/+1
| | | | | renamed ntdom to winbind I think that using winbind in /etc/nsswitch.conf is better than ntdom
* brought the winbindd code into headAndrew Tridgell2000-05-091-0/+106
this does not yet compile, but I'm working on that.
generated by cgit (git 2.34.1) at 2025-09-26 12:29:53 +0000