summaryrefslogtreecommitdiffstats
path: root/source/nsswitch
Commit message (Collapse)AuthorAgeFilesLines
...
* This is another rather major change to the samba authenticaionAndrew Bartlett2001-11-241-5/+7
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | subystem. The particular aim is to modularized the interface - so that we can have arbitrary password back-ends. This code adds one such back-end, a 'winbind' module to authenticate against the winbind_auth_crap functionality. While fully-functional this code is mainly useful as a demonstration, because we don't get back the info3 as we would for direct ntdomain authentication. This commit introduced the new 'auth methods' parameter, in the spirit of the 'auth order' discussed on the lists. It is renamed because not all the methods may be consulted, even if previous methods fail - they may not have a suitable challenge for example. Also, we have a 'local' authentication method, for old-style 'unix if plaintext, sam if encrypted' authentication and a 'guest' module to handle guest logins in a single place. While this current design is not ideal, I feel that it does provide a better infrastructure than the current design, and can be built upon. The following parameters have changed: - use rhosts = This has been replaced by the 'rhosts' authentication method, and can be specified like 'auth methods = guest rhosts' - hosts equiv = This needs both this parameter and an 'auth methods' entry to be effective. (auth methods = guest hostsequiv ....) - plaintext to smbpasswd = This is replaced by specifying 'sam' rather than 'local' in the auth methods. The security = parameter is unchanged, and now provides defaults for the 'auth methods' parameter. The available auth methods are: guest rhosts hostsequiv sam (passdb direct hash access) unix (PAM, crypt() etc) local (the combination of the above, based on encryption) smbserver (old security=server) ntdomain (old security=domain) winbind (use winbind to cache DC connections) Assistance in testing, or the production of new and interesting authentication modules is always appreciated. Andrew Bartlett
* Fixed delete on close bug. Added core dump code to winbindd.Jeremy Allison2001-11-232-3/+59
| | | | Jeremy.
* Set type to NOTUSED if lookup fail.Jeremy Allison2001-11-231-0/+1
| | | | Jeremy.
* Got rid of that stupid parse_domain_user() warning when compilingTim Potter2001-11-231-22/+0
| | | | winbindd.
* Finish 1.45 by removing redundant sid->string conversion inMartin Pool2001-11-231-14/+44
| | | | | | | | winbindd_lookup_sid_by_name. Also if the lookup fails then clobber the output parameters rather than leaving them looking potentially valid. Add doxygen.
* I think you were passing the name of the SID, rather than the DOM_SIDMartin Pool2001-11-231-1/+1
| | | | pointer itself. (Whatever that is.... ;-)
* Removed TimeInit() call from every client program (except for one placeTim Potter2001-11-233-5/+0
| | | | | in smbd/process.c where the timezone is reinitialised. Was replaced with check for a static is_initialised boolean.
* Fixed check machine account function.Tim Potter2001-11-234-74/+63
|
* Got positive and negative name caching working correctly with ↵Jeremy Allison2001-11-221-43/+47
| | | | | | | | | lookupname/lookupsid. There was a bug in cli_lsa_lookup_name/lookup_sid where NT_STATUS_NONE_MAPPED was being mapped to NT_STATUS_OK, and also the *wrong* number of entries mapped was being returned. The correct field is mapped_count, *NOT* num_entries. Jeremy.
* Fixed +ve caching. Still problems with -ve caching.Jeremy Allison2001-11-221-105/+115
| | | | Jeremy.
* Fixed caching of lookupname/lookupsid. Error in check of success !Jeremy Allison2001-11-221-2/+8
| | | | Jeremy.
* Added debugs to track down sequence lookup problems.Jeremy Allison2001-11-221-4/+10
| | | | Jeremy.
* W2K doesn't seem to respond to *#0 names in node status. Ensure nameJeremy Allison2001-11-212-27/+28
| | | | | lookup uses password server parameter when looking for PDCs. Jeremy.
* Added transparent +ve caching for lookupname/lookupsid. -ve caching canJeremy Allison2001-11-213-112/+238
| | | | | | | | be easily added (a one liner) once we know the correct error codes returned by a W2K DC. All other winbindd calls should go through a similar transparent caching layer (and will soon). Jeremy.
* Preparing to implement +ve and -ve caching for lookupname/lookupsid calls.Jeremy Allison2001-11-212-130/+191
| | | | Jeremy.
* Merge from 2.2.Tim Potter2001-11-191-1/+1
|
* Store some path names in global variables initialized to configureMartin Pool2001-11-193-9/+7
| | | | default, rather than in preprocessor macros.
* Tidyup formatting a bit (spaces->tabs) whilst reading new code to understandJeremy Allison2001-11-152-220/+202
| | | | | connection caching. Getting ready for back-merge to 2.2.3. Jeremy.
* Caching user, group and domain sam handles was a stupid idea.Tim Potter2001-11-154-103/+177
| | | | Now we just keep a record of the open pipes.
* Jeremy, I'm not sure what you were trying to do with the process activityTim Potter2001-11-151-3/+1
| | | | loop in winbindd but it didn't work.
* Added free_domain_info() function.Tim Potter2001-11-151-0/+27
| | | | Get list of trusted domains if we haven't fetched them yet.
* Added free_domain_info() function.Tim Potter2001-11-151-1/+1
|
* Cache positive and negative name domain controller lookups.Tim Potter2001-11-151-11/+148
| | | | | | Cache negative connection attempt lookups. Fixed loginc bug in connection_ok()
* Get list of trusted domains if we haven't fetched them yet.Tim Potter2001-11-152-0/+9
|
* Fixed display of uninitialised buffer in debug.Tim Potter2001-11-151-2/+8
| | | | Get list of trusted domains if we haven't fetched them yet.
* Bit of a cleanup of signal handling code.Tim Potter2001-11-151-8/+14
| | | | | | Ignore the SIGUSR1 signal before we install a handler for it as glibc (?) seems to just print out "User defined signal 1" and exit if no handler is installed.
* Fix detection of RedHat 7.2.Jeremy Allison2001-11-151-442/+0
| | | | | | Remove unused old file. Test 42 byte reply to SMBntcreate (W2K does this). Jeremy.
* Make signal handling safer (handle EINTR on read/write/accept), don'tJeremy Allison2001-11-141-38/+52
| | | | | call slprintf within a signal handler. Jeremy.
* Got ready to implement Martin's idea, but request doesn't have a lengthJeremy Allison2001-11-142-10/+24
| | | | | field.... well, now at least the code is there when it does :-). Jeremy.
* Random connection robustness related fixes. Display some debugs aboutTim Potter2001-11-145-31/+122
| | | | | | | the currently open connections when winbindd receives a USR1 signal. Hmm - I've just realised this will conflict with the messaging code but we don't use that yet.
* #ifdef'd out suggestion for tim on making the winbindd protocol moreMartin Pool2001-11-141-1/+13
| | | | robust.
* Added needed debugs...Jeremy Allison2001-11-141-25/+39
| | | | Jeremy.
* Fix winbind client code so that winbind calls are not made if theJeremy Allison2001-11-132-15/+43
| | | | | | | requested name does not have a winbind separator character. This makes the intent explicit. Tim, contact me if this is not what you indended. Jeremy.
* Use cli_nt_login_network() instead of domain_client_validate() to performTim Potter2001-11-053-41/+86
| | | | | | | pam authentication. This allows us to link in less other crap. Authenticating with a challenge/response doesn't seem to work though - we always get back NT_STATUS_WRONG_PASSWORD.
* Added NT_USER_TOKEN into server_info to fix extra groups problem.Jeremy Allison2001-11-031-1/+3
| | | | | Got "medieval on our ass" about const warnings (as many as I could :-). Jeremy.
* Removed unneeded extern.Tim Potter2001-10-311-2/+0
|
* This is a farily large patch (3300 lines) and reworks most of the AuthRewriteAndrew Bartlett2001-10-311-72/+15
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | code. In particular this assists tpot in some of his work, becouse it provides the connection between the authenticaion and the vuid generation. Major Changes: - Fully malloc'ed structures. - Massive rework of the code so that all structures are made and destroyed using malloc and free, rather than hanging around on the stack. - SAM_ACCOUNT unix uids and gids are now pointers to the same, to allow them to be declared 'invalid' without the chance that people might get ROOT by default. - kill off some of the "DOMAIN\user" lookups. These can be readded at a more appropriate place (probably domain_client_validate.c) in the future. They don't belong in session setups. - Massive introduction of DATA_BLOB structures, particularly for passwords. - Use NTLMSSP flags to tell the backend what its getting, rather than magic lenghths. - Fix winbind back up again, but tpot is redoing this soon anyway. - Abstract much of the work in srv_netlog_nt back into auth helper functions. This is a LARGE change, and any assistance is testing it is appriciated. Domain logons are still broken (as far as I can tell) but other functionality seems intact. Needs testing with a wide variety of MS clients. Andrew Bartlett
* Added some extra fields to the auth_serversupplied_info structure.Tim Potter2001-10-313-4/+14
| | | | | | | | | To obtain the full group membership of a user (i.e nested groups on a win2k native mode server) it is necessary to merge this list of groups with the groups returned by winbindd when creating an nt access token. This breaks winbindd linking while AB and I sync up our changes to the authentication subsystem.
* Don't force winbind to use non-local DC's.Volker Lendecke2001-10-291-1/+1
| | | | Volker
* This commit is number 4 of 4.Andrew Bartlett2001-10-291-4/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular this commit focuses on: Actually adding the 'const' to the passdb interface, and the flow-on changes. Also kill off the 'disp_info' stuff, as its no longer used. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes introduces a large dose of 'const' to the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username --- This finishes this line of commits off, your tree should now compile again :-) Andrew Bartlett
* Hey where did those 4 character tabs come from?Tim Potter2001-10-291-4/+4
|
* Don't reference tallocated memory that has already been disposed of. TheTim Potter2001-10-293-11/+26
| | | | cli_samr_query_userinfo function used to do this.
* Added some connection checking code. Doesn't work yet though.Tim Potter2001-10-271-10/+43
|
* Fix for fussy Solaris compiler.Tim Potter2001-10-211-3/+1
|
* Fixed some memory leaks introduced by connection handling rewrite, as wellTim Potter2001-10-194-20/+29
| | | | | | as one memory leak that has been there for ages! Changed the way talloc is used in get{pw,gr}nam routines.
* Converted some more functions to create and dispose of a talloc context on aTim Potter2001-10-195-87/+106
| | | | | | | | per-call basis rather than per-connection. Had a bit more of a reformatting fest. Still need to run it through insure and handle downed connections.
* Some reformatting.Tim Potter2001-10-141-6/+10
|
* Pass domain structure around in cache code rather than the domain name.Tim Potter2001-10-143-32/+29
|
* Resurrected sam sequence number code.Tim Potter2001-10-141-117/+175
| | | | | | Pass domain structure around in cache code rather than the domain name. Some misc reformatting to make things look prettier.
* Converted a few winbind functions to use a talloc context that is destroyedTim Potter2001-10-121-32/+72
| | | | immediately after the call.
generated by cgit (git 2.34.1) at 2025-09-28 07:13:24 +0000