summaryrefslogtreecommitdiffstats
path: root/source/nsswitch/winbindd_rpc.c
Commit message (Collapse)AuthorAgeFilesLines
* Fix "might be used uninitialised" warnings.Jeremy Allison2003-03-031-2/+2
| | | | Jeremy.
* fixed a crash bug in the new winbindd 'sids rule!' codeAndrew Tridgell2003-02-281-1/+1
|
* Kill RID-only and domain+RID madness from winbind.Andrew Bartlett2003-02-261-31/+62
| | | | | | | | | | | | | | | | | | | Now we deal with SIDs in almost all of winbind (a couple of limited exceptions remain, but I'm looking into them - they use non-winbind structs ATM). This has particular benifits in returning out-of-domain SIDs for group membership (Need to look into this a bit more) as well as general code quality. This also removes much of the complexity from the idmap interface, which now only deals with mapping IDs, not with SID->domain translations. Breifly tested, but needs more. Fixes some valgrind-found bugs from my previous commit. Winbind cache chagned to using SID strings in some places, as I could not follow exactly how to save and restore multiple packed sids properly. Andrew Bartlett
* Merge from appliance:Tim Potter2003-02-261-34/+23
| | | | | | | | | | | >Another hopeful fix for CR#1168. Change the RPC used in querying >domain users from QueryDispInfo to EnumDomainUsers. Hopefully this >will fix the random dropouts that keep occuring when listing large >domains. > >My thought is that since QueryDispInfo is only used in the NT user >manager it may have a bug with large domains. A more commonly used >RPC may not have such problems.
* Patch based on work by Michael Steffens <michael_steffens@hp.com> to wrapJeremy Allison2003-02-151-65/+107
| | | | | | all cm_get_XX calls and their subsequent requests in a retry loop in case we've temporarily lost connection to the DC. Makes winbindd more reliable. Jeremy.
* Use new interface for cli_samr_query_dispinfo().Tim Potter2003-01-291-5/+10
|
* Fix from "Ken Cross" <kcross@nssolutions.com> for enumeratingJeremy Allison2003-01-061-1/+3
| | | | | groups. Jeremy.
* Forward port the change to talloc_init() to make all talloc contextsJeremy Allison2002-12-201-6/+6
| | | | | named. Ensure we can query them. Jeremy.
* merge from APP_HEADGerald Carter2002-10-081-0/+60
| | | | | | | | | * s/driverlocation/comment * detect native mode domain and enumerate local groups Also * Added sendfile stats from SAMBA_2_2
* Bugfix merge:Tim Potter2002-09-111-0/+1
| | | | | | >Initialise user_rid value in WINBIND_USERINFO structure returned by >the rpc version of query_user(). This fixes a caching bug found by >Gavrie Philipson from disksite.
* Quietened some debugs.Tim Potter2002-09-041-2/+2
|
* This fixes a number of ADS problems, particularly with netbioslessAndrew Tridgell2002-08-051-3/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | setups. - split up the ads structure into logical pieces. This makes it much easier to keep things like the authentication realm and the server realm separate (they can be different). - allow ads callers to specify that no sasl bind should be performed (used by "net ads info" for example) - fix an error with handing ADS_ERROR_SYSTEM() when errno is 0 - completely rewrote the code for finding the LDAP server. Now try DNS methods first, and try all DNS servers returned from the SRV DNS query, sorted by closeness to our interfaces (using the same sort code as we use in replies from WINS servers). This allows us to cope with ADS DCs that are down, and ensures we don't pick one that is on the other side of the country unless absolutely necessary. - recognise dnsRecords as binary when displaying them - cope with the realm not being configured in smb.conf (work it out from the LDAP server) - look at the trustDirection when looking up trusted domains and don't include trusts that trust our domains but we don't trust theirs. - use LDAP to query the alternate (netbios) name for a realm, and make sure that both and long and short forms of the name are accepted by winbindd. Use the short form by default for listing users/groups. - rescan the list of trusted domains every 5 minutes in case new trust relationships are added while winbindd is running - include transient trust relationships (ie. C trusts B, B trusts A, so C trusts A) in winbindd. - don't do a gratuituous node status lookup when finding an ADS DC (we don't need it and it could fail) - remove unused sid_to_distinguished_name function - make sure we find the allternate name of our primary domain when operating with a netbiosless ADS DC (using LDAP to do the lookup) - fixed the rpc trusted domain enumeration to support up to approx 2000 trusted domains (the old limit was 3) - use the IP for the remote_machine (%m) macro when the client doesn't supply us with a name via a netbios session request (eg. port 445) - if the client uses SPNEGO then use the machine name from the SPNEGO auth packet for remote_machine (%m) macro - add new 'net ads workgroup' command to find the netbios workgroup name for a realm
* this is a trick to work around the fact that posix does not supplyAndrew Tridgell2002-07-141-0/+20
| | | | | | | | | | a getgr*() function that lists groups without numerating all the group members. Instead of definiing a new nss method (which might cause problems) I added an environment variable WINBIND_GETGRLST that tells winbind not to fill in the group members in a gergrent() request. This can speed up group listing by a factor of 20 or more (on my test system with 50000 groups it reduces the time from an hour to 2 minutes)
* Fix from Andrew Esh for not checking return code.Jeremy Allison2002-06-201-0/+3
| | | | Jeremy.
* more debug classess activatedSimo Sorce2002-06-181-0/+3
|
* A few more trusted domains updates from mimir.Andrew Bartlett2002-05-171-2/+3
| | | | | | | I think we may still need to look at our server enumeration code, but other than that, its much better in the tree than out. Andrew Bartlett
* The cli_lsa_lookup_{names,sids} functions were returning uselessTim Potter2002-04-141-6/+4
| | | | | | information when one or more of the names/sids being queried were not resolvable. We now return a list the same length as the parameters passed instead of an array of just the resolvable names/sids.
* possibly fix the 15000 user problemAndrew Tridgell2002-04-111-2/+2
| | | | | I think its caused by a rpc operation failing and us giving invalid data back to the cache layer. Using talloc_zero() should solve this.
* Fixed the handle leak in the connection management code (this code is crapJeremy Allison2002-04-041-2/+11
| | | | | and should be rewritten, just not now... :-). Jeremy.
* Spelling fixes.Tim Potter2002-03-241-1/+1
|
* reduced memory usage in winbindd with a rpc backend by using aAndrew Tridgell2002-01-311-6/+11
| | | | separate talloc context for each partial fetch
* Removed version number from file header.Tim Potter2002-01-301-1/+1
| | | | Changed "SMB/Netbios" to "SMB/CIFS" in file header.
* Back out some of the less well thought out ideas from last weeks work onAndrew Bartlett2002-01-261-5/+16
| | | | | | | | | | winbind default domains, particulary now I understand whats going on a lot better. This ensures that the RPC client code does as little 'magic' as possible - this is up to the application/user. (Where - for to name->sid code - it was all along). This leaves the change that allows the sid->name code to return domains and usernames in seperate paramaters. Andrew Bartlett
* This patch makes the 'winbind use default domain' code interact better withAndrew Bartlett2002-01-201-4/+12
| | | | | | | | | | | | | | | | | | | | | | | | | | smbd, and also makes it much cleaner inside winbindd. It is mostly my code, with a few changes and testing performed by Alexander Bokovoy <a.bokovoy@sam-solutions.net>. ab has tested it in security=domain and security=ads, but more testing is always appricatiated. The idea is that we no longer cart around a 'domain\user' string, we keep them seperate until the last moment - when we push that string into a pwent on onto the socket. This removes the need to be constantly parsing that string - the domain prefix is almost always already provided, (only a couple of functions actually changed arguments in all this). Some consequential changes to the RPC client code, to stop it concatonating the two strings (it now passes them both back as params). I havn't changed the cache code, however the usernames will no longer have a double domain prefix in the key string. The actual structures are unchanged - but the meaning of 'username' in the 'rid' will have changed. (The cache is invalidated at startup, so on-disk formats are not an issue here). Andrew Bartlett
* Many thanks to Alexander Bokovoy <a.bokovoy@sam-solutions.net>.Andrew Bartlett2002-01-121-0/+9
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This work was sponsored by Optifacio Software Services, Inc. Andrew Bartlett (various e-mails announcements merged into some form of commit message below:) This patch which adds basics of universal groups support into Samba 3. Currently, only Winbind with RPC calls supports this, ADS support requires additional (possibly huge) work on KRB5 PAC. However, basic infrastructure is here. This patch adds: 1. Storing of universal groups for particular user logged into Samba software (smbd/ two winbind-pam methods) into netlogon_unigrp.tdb as array of uint32 supplemental group rids keyed as DOMAIN_SID/USER_RID in tdb. 2. Fetching of unversal groups for given user rid and domain sid from netlogon_unigrp.tdb. Since this is used in both smbd and winbindd, main code is in source/lib/netlogon_uingrp.c. Dependencies are added to AUTH_OBJ as UNIGRP_OBJ and WINBINDD_OBJ as UNIGRP_OBJ. This patch has had a few versions, the final version in particular: Many thanks to Andrew Bartlett for critics and comments, and partly rewritten code. New: - updated fetching code to changed byte order macros - moved functions to proper namespace - optimized memory usage by reusing caller's memory context - enhanced code to more follow Samba coding rules Todo: - proper universal group expiration after timeout
* A big tidyup while thinking about getting trusted domains being re-readTim Potter2002-01-101-4/+4
| | | | | | | | | | | | | | | | | | when they are added or removed on the PDC. - renamed GETPWNAM_FROM_{UID,USER} constants and functions to GETPW{NAM,UID} - renamed GETGRNAM_FROM_{GID,GROUP} constants and functions to GETGR{NAM,GID} - use SIGUSR2 in winbindd for debugging/logging instead of SIGUSR1 in preparation for moving to smbcontrol type messages (not sure whether to ditch this altogether or not) - tidy debugging messages in top level winbind user and group routines - convert talloc_init() to talloc_init_named() - make enumerations of the domain list use the same local variable names
* removed the start_ndx parameter from group enumerationAndrew Tridgell2001-12-111-5/+31
| | | | | | I tried testing this by lowering the buffer size in cli_samr_enum_dom_groups() but that didn't work - I think this needs more looking into
* got rid of start_ndx from query_user_list()Andrew Tridgell2001-12-111-23/+39
|
* robustness fixes and moved ccache location into winbindd_ads codeAndrew Tridgell2001-12-101-0/+8
|
* winbindd backends can now be marked "consistent" or "inconsistent"Andrew Tridgell2001-12-101-0/+1
| | | | | | | consistent backends (like ADS) always give correct primary group info, so we can play cache tricks to speed things up a lot inconsistent backends (like MSRPC) need to fetch stuff more often
* moved the domain sid lookup and enumeration of trusted domains intoAndrew Tridgell2001-12-101-2/+46
| | | | | | | | the backends at startup, loop until we get the domain sid for our primary domain, trying every 10 seconds. This makes winbindd handle a room-wide power failure better
* completely new winbindd cache infrastructureAndrew Tridgell2001-12-091-5/+9
| | | | | | | | | | | | | | | | | | | this one looks like just another winbind backend, and has the following properties: - does -ve and +ve cacheing of all queries - can be disabled with -n switch to winbindd - stores all records packed, so even huge domains are not a problem for a complete cache - handles the server being down - uses sequence numbers for all entries This fixes a lot of problems with winbindd. Serving from cache is now *very* fast.
* moved the sequence number fetch into the backend, and fetch theAndrew Tridgell2001-12-051-1/+56
| | | | sequence number via ldap when using ads
* finally worked out how to do ldap lookups by binary blobs, so I canAndrew Tridgell2001-12-051-10/+114
| | | | | | | now do searches on SID. This allows me to do a true ldap sid_to_name() function one one function to go!
* added lookup_groups() to the ads backendAndrew Tridgell2001-12-041-2/+2
| | | | winbindd/ADS can now do initgroups()
* moved lookup_usergroups() into the backend structureAndrew Tridgell2001-12-041-1/+61
|
* added a query_user backendAndrew Tridgell2001-12-041-1/+58
| | | | fixed a winbindd crash when the group membership can't be looked up
* changed query_dispinfo to query_user_listAndrew Tridgell2001-12-031-5/+5
|
* put sid_to_name behind the winbindd backend interfaceAndrew Tridgell2001-12-031-1/+33
| | | | | | | I spent quite a while trying to work out how to make this call via ldap and failed. I then found that MS servers seem use rpc for sid_to_name, and it works even when in native mode, I ended up just implementing it via rpc
* added name_to_sid to the backendAndrew Tridgell2001-12-031-1/+34
|
* added a basic ADS backend to winbind. More work needed, but atAndrew Tridgell2001-12-031-10/+10
| | | | least basic operations work
* split winbindd_enum_dom_groups into the new backend structureAndrew Tridgell2001-12-031-0/+130
also created winbindd_rpc.c which contains the functions that have been converted to the new structure. There will soon be a winbindd_ads.c for the ldap backend
generated by cgit (git 2.34.1) at 2025-09-25 10:12:27 +0000