summaryrefslogtreecommitdiffstats
path: root/source/nsswitch
Commit message (Collapse)AuthorAgeFilesLines
...
* Merge undone cleanups.Tim Potter2002-09-123-26/+27
|
* Merge of winbind auth cleanups from appliance.Tim Potter2002-09-123-30/+34
|
* Merge of cut&paste fix from appliance.Tim Potter2002-09-121-1/+1
|
* Spelling fix.Tim Potter2002-09-121-2/+2
|
* Put pid number in invalid request size debug.Tim Potter2002-09-111-2/+2
|
* Bugfix merge:Tim Potter2002-09-111-0/+1
| | | | | | >Initialise user_rid value in WINBIND_USERINFO structure returned by >the rpc version of query_user(). This fixes a caching bug found by >Gavrie Philipson from disksite.
* This is the 'main' inclue for for winbind clients - all clients should includeAndrew Bartlett2002-09-071-0/+16
| | | | | | | only this file, and not any others. It includes the function prototypes. (Forgot to commit with earlier patch) Andrew Bartlett
* Don't leak file desciptors in this (impossible?) error case.Andrew Bartlett2002-09-071-0/+1
|
* Winbind client-side cleanups.Andrew Bartlett2002-09-076-37/+94
| | | | | | | | | | | | | | | | | | The global winbind file descriptor can cause havoc in some situations - particulary when it becomes 0, 1 or 2. This patch (based on some very nice work by Hannes Schmidt <mail@schmidt-net.via.t-online.de>) starts to recitfy the problem by ensuring that the close-on-exec flag is set, and that we move above 3 in the file descriptor table. I've also decided that the PAM module can close it's pipe handle on every request - this isn't performance-critical code. The next step is to do the same for nss_winbind. (But things like getent() might get in our way there). This also cleans up some function prototypes, puts them in just one place. Andrew Bartlett
* Patch from "Stefan (metze) Metzmacher" <metze@metzemix.de>Andrew Bartlett2002-09-061-4/+4
| | | | | | | | | | | | | to extend the ADS_STATUS system to include NTSTATUS, and to provide a better general infrustructure for his sam_ads work. I've also added some extra failure mode DEBUG()s to parts of the code. NOTE: The ADS_ERR_OK() macro is rather sensitive to braketing issues - without the final set of brakets, the test is essentially inverted - causing some intersting 'error = success' messages... Andrew Bartlett
* Quietened some debugs.Tim Potter2002-09-041-2/+2
|
* added cli_net_auth_3 client code.Jean-François Micouleau2002-08-301-3/+3
| | | | | | | | | | changed cli_nt_setup_creds() to call cli_net_auth_2 or cli_net_auth_3 based on a switch. pass also the negociation flags all the way. all the places calling cli_nt_setup_creds() are still using cli_net_aut2(), it's just for future use and for rpcclient. in the future we will be able to call auth_2 or auth_3 as we want. J.F.
* fix connecting to a BDC when the PDC is down but in WINS and no bcastAndrew Tridgell2002-08-291-5/+3
| | | | | | can be used to find a BDC 2nd try ....
* fix connecting to a BDC when the PDC is down but in WINS and no bcastAndrew Tridgell2002-08-291-0/+7
| | | | can be used to find a BDC
* Use popt for --helpJelmer Vernooij2002-08-291-54/+24
|
* Fix typo in debug.Tim Potter2002-08-271-1/+1
|
* Moved calculation of secure channel type into a new function.Tim Potter2002-08-231-4/+3
|
* Patch from Paul Green <Paul.Green@stratus.com> to be more POSIX-compatibleJelmer Vernooij2002-08-211-0/+4
|
* be a bit more paranoid about not getting duplicate domain names (canAndrew Tridgell2002-08-181-2/+8
| | | | | happen when the LDAP call to get the flatname for the primary domain fails)
* Becouse of changes to the meaning of this feild over time, this doesn'tAndrew Bartlett2002-08-171-17/+0
| | | | | | | | | actually work. Also, the idea of 'loopback winbind' isn't that bad an idea anyway (potential PDC/BDC applications). Given all that, remove it... Andrew Bartlett
* Merge of netbios namecache code from APPLIANCE_HEAD.Tim Potter2002-08-161-0/+2
| | | | | | | Tridge suggested a generic caching mechanism for Samba to avoid the proliferation of little cache files hanging around limpet like in the locks directory. Someone should probably implement this at some stage.
* Add some more const :-)Andrew Bartlett2002-08-071-3/+3
| | | | | | | This also makes it a easier to see which paramaters are 'in', and which are 'out'. Andrew Bartlett
* fixed wbinfo -t for netbiosless domainsAndrew Tridgell2002-08-051-1/+7
|
* This fixes a number of ADS problems, particularly with netbioslessAndrew Tridgell2002-08-056-125/+172
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | setups. - split up the ads structure into logical pieces. This makes it much easier to keep things like the authentication realm and the server realm separate (they can be different). - allow ads callers to specify that no sasl bind should be performed (used by "net ads info" for example) - fix an error with handing ADS_ERROR_SYSTEM() when errno is 0 - completely rewrote the code for finding the LDAP server. Now try DNS methods first, and try all DNS servers returned from the SRV DNS query, sorted by closeness to our interfaces (using the same sort code as we use in replies from WINS servers). This allows us to cope with ADS DCs that are down, and ensures we don't pick one that is on the other side of the country unless absolutely necessary. - recognise dnsRecords as binary when displaying them - cope with the realm not being configured in smb.conf (work it out from the LDAP server) - look at the trustDirection when looking up trusted domains and don't include trusts that trust our domains but we don't trust theirs. - use LDAP to query the alternate (netbios) name for a realm, and make sure that both and long and short forms of the name are accepted by winbindd. Use the short form by default for listing users/groups. - rescan the list of trusted domains every 5 minutes in case new trust relationships are added while winbindd is running - include transient trust relationships (ie. C trusts B, B trusts A, so C trusts A) in winbindd. - don't do a gratuituous node status lookup when finding an ADS DC (we don't need it and it could fail) - remove unused sid_to_distinguished_name function - make sure we find the allternate name of our primary domain when operating with a netbiosless ADS DC (using LDAP to do the lookup) - fixed the rpc trusted domain enumeration to support up to approx 2000 trusted domains (the old limit was 3) - use the IP for the remote_machine (%m) macro when the client doesn't supply us with a name via a netbios session request (eg. port 445) - if the client uses SPNEGO then use the machine name from the SPNEGO auth packet for remote_machine (%m) macro - add new 'net ads workgroup' command to find the netbios workgroup name for a realm
* Winbind updates!Andrew Bartlett2002-07-317-29/+151
| | | | | | | | | | | | | | | | This updates the 'winbind' authentication module and winbind's 'PAM' (actually netlogon) code to allow smbd to cache connections to the DC. This is particulary relevent when we need mutex locks already - there is no parallelism to be gained anyway. The winbind code authenticates the user, and if successful, passes back the 'info3' struct describing the user. smbd then interprets that in exactly the same way as an 'ntdomain' logon. Also, add parinoia to winbind about null termination. Andrew Bartlett
* support netbiosless search for the DC using ADS in the winbindd AUTHAndrew Tridgell2002-07-311-58/+110
| | | | code.
* Fixed for memory leak in connection caching code when a dc isTim Potter2002-07-301-1/+13
| | | | permanently down. Found by Dan Coppock.
* Add another message rather than 'internal module error'Andrew Bartlett2002-07-241-0/+4
| | | | Andrew Bartlett
* Another smattering of static and constAndrew Bartlett2002-07-212-8/+8
|
* Renamed all the new_cli_netlogon_* functions to cli_netlogon_*Tim Potter2002-07-211-2/+2
| | | | as they're no longer new!
* Compilers do find bugs :-)Andrew Bartlett2002-07-211-2/+1
| | | | | | | This was a mixup between the enum type NSS_STATUS and a BOOL (extra test for equality). Andrew Bartlett
* Try to fix up warnings - particularly on the IRIX 64 bit compiler (which had aAndrew Bartlett2002-07-203-5/+5
| | | | | | | | distinction between uchar and char). Lots of const etc. Andrew Bartlett
* fixed a number of real bugs found by warnings on the 64 bit irix compilerAndrew Tridgell2002-07-151-4/+4
|
* after thinking about the env variable hack for avoiding group membershipAndrew Tridgell2002-07-141-14/+20
| | | | | | enumeration I realised it could be a security hole for setuid progs. This adds a proper nss function instead.
* this is a trick to work around the fact that posix does not supplyAndrew Tridgell2002-07-146-9/+53
| | | | | | | | | | a getgr*() function that lists groups without numerating all the group members. Instead of definiing a new nss method (which might cause problems) I added an environment variable WINBIND_GETGRLST that tells winbind not to fill in the group members in a gergrent() request. This can speed up group listing by a factor of 20 or more (on my test system with 50000 groups it reduces the time from an hour to 2 minutes)
* I just noticed that I never added my copyright when I messed with thisAndrew Bartlett2002-07-131-0/+1
| | | | | | previously. Fix that. Andrew Bartlett
* Usage fixes from APPLIANCE_HEAD.Tim Potter2002-07-111-1/+2
|
* Merge of init_domain_list() fix from APPLIANCE_HEAD.Tim Potter2002-07-111-3/+0
|
* this implements a completely new strategy for fetching groupAndrew Tridgell2002-07-111-33/+83
| | | | | | | | | | | | membership from an ADS server. We now use a 'member' query on the group and do a separate call to convert the resulting distinguished name to a name, rid etc. This is *much* faster for very large numbers of groups (on a quantum test system with 10000 groups it drops the time from an hour to about 35 seconds). strangely enough, this actually *increases* the amount of ldap traffic, its just that the MS LDAP server answers these queries much faster.
* Kill off codepage related stuff, now we don't use codepages any more.Andrew Bartlett2002-07-031-4/+0
| | | | Andrew Bartlett
* used findstatic.pl to make some variables static and remove some deadAndrew Tridgell2002-07-011-1/+1
| | | | code
* fixed a bug handling startup when the ads server is not contactableAndrew Tridgell2002-07-011-1/+1
|
* The next phase in the WINS rewrite!Andrew Tridgell2002-06-271-2/+0
| | | | | | | | | | | | | | | | We now cope wiith multiple WINS groups and multiple failover servers for release and refresh as well as registration. We also do the regitrations in the same fashion as W2K does, where we don't try to register the next IP in the list for a name until the WINS server has acked the previos IP. This prevents us flooding the WINS server and also seems to make for much more reliable multi-homed registration. I also changed the dead WINS server code to mark pairs of IPs dead, not individual IPs. The idea is that a WINS server might be dead from the point of view of one of our interfaces, but not another, so we need to keep talking to it on one while moving onto a failover WINS server on the other interface. This copes much better with partial LAN outages and weird routing tables.
* This commit finally gives us multiple wins server groups. We nowAndrew Tridgell2002-06-262-33/+17
| | | | | | | | | | | | | | | | | | | | | | | | accept an extended syntax for 'wins server' like this: wins server = group1:192.168.2.10 group2:192.168.3.99 group1:192.168.0.1 The tags before the IPs don't mean anything, they are just a way of grouping IPs together. If you use the old syntax (ie. no ':') then an implicit group name of '*' is used. In general I'd recommend people use interface names for the group names, but it doesn't matter much. When we register in nmbd we try to register all our IPs with each group of WINS servers. We keep trying until all of them are registered with every group, falling back to the failover WINS servers for each group as we go. When we do a WINS lookup we try each of the WINS servers for each group. If a WINS server for a group gives a negative answer then we give up on that group and move to the next group. If it times out then we move to the next failover wins server in the group. In either case, if a WINS server doesn't respond then we mark it dead for 10 minutes, to prevent lengthy waits for dead servers.
* Update cli_full_connection() to take a 'flags' paramater, and try to get aAndrew Bartlett2002-06-251-1/+1
| | | | | | few more places to use it. Andrew Bartlett
* Add a couple more DEBUG()s to winbindd.Andrew Bartlett2002-06-251-4/+9
| | | | Andrew Bartlett
* Fix from Andrew Esh for not checking return code.Jeremy Allison2002-06-201-0/+3
| | | | Jeremy.
* more debug classess activatedSimo Sorce2002-06-1814-0/+40
|
* Latest patch from metze <metze@metzemix.de> to move most of samba acrossAndrew Bartlett2002-06-133-7/+9
| | | | | | | | | | | to using SIDs instead of RIDs. The new funciton sid_peek_check_rid() takes an 'expected domain sid' argument. The idea here is to prevent mistakes where the SID is implict, but isn't the same one that we have in the struct. Andrew Bartlett
* Ignore winbindd_proto.hTim Potter2002-06-121-0/+1
|
generated by cgit (git 2.34.1) at 2025-09-26 05:05:05 +0000