summaryrefslogtreecommitdiffstats
path: root/source3/auth/auth.c
Commit message (Collapse)AuthorAgeFilesLines
* challange -> challengeTim Potter2001-11-261-4/+4
| | | | (This used to be commit d6318add27f6bca5be00cbedf2226b642341297a)
* This is another rather major change to the samba authenticaionAndrew Bartlett2001-11-241-79/+86
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | subystem. The particular aim is to modularized the interface - so that we can have arbitrary password back-ends. This code adds one such back-end, a 'winbind' module to authenticate against the winbind_auth_crap functionality. While fully-functional this code is mainly useful as a demonstration, because we don't get back the info3 as we would for direct ntdomain authentication. This commit introduced the new 'auth methods' parameter, in the spirit of the 'auth order' discussed on the lists. It is renamed because not all the methods may be consulted, even if previous methods fail - they may not have a suitable challenge for example. Also, we have a 'local' authentication method, for old-style 'unix if plaintext, sam if encrypted' authentication and a 'guest' module to handle guest logins in a single place. While this current design is not ideal, I feel that it does provide a better infrastructure than the current design, and can be built upon. The following parameters have changed: - use rhosts = This has been replaced by the 'rhosts' authentication method, and can be specified like 'auth methods = guest rhosts' - hosts equiv = This needs both this parameter and an 'auth methods' entry to be effective. (auth methods = guest hostsequiv ....) - plaintext to smbpasswd = This is replaced by specifying 'sam' rather than 'local' in the auth methods. The security = parameter is unchanged, and now provides defaults for the 'auth methods' parameter. The available auth methods are: guest rhosts hostsequiv sam (passdb direct hash access) unix (PAM, crypt() etc) local (the combination of the above, based on encryption) smbserver (old security=server) ntdomain (old security=domain) winbind (use winbind to cache DC connections) Assistance in testing, or the production of new and interesting authentication modules is always appreciated. Andrew Bartlett (This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
* Minor updates. A small dose of const.Andrew Bartlett2001-11-111-1/+1
| | | | (This used to be commit 80667cb0dd1a2cdef17711c8580af9f524971cea)
* Change to guest logon code.Andrew Bartlett2001-11-081-24/+43
| | | | | | | | | | | | | | | | | | | | | | | | | | This changes the way we process guest logons - we now treat them as normal logons, but set the 'guest' flag. In particular this is needed becouse Win2k will do an NTLMSSP login with username "", therefore missing our previous guest connection code - this is getting a pain to do as a special case all over the shop. Tridge: We don't seem to be setting a guest bit for NTLMSSP, in either the anonymous or authenticated case, can you take a look at this? Also some cleanups in the check_password() code that should make some of the debugs clearer. Various other minor cleanups: - change the session code to just take a vuser, rather than having to do a vuid lookup on vuser.vuid - Change some of the global_client_caps linking - Better debug in authorise_login(): show the vuid. Andrew Bartlett (This used to be commit 62f4e4bd0aef9ade653b3f8d575d2864c166ab4d)
* This is a farily large patch (3300 lines) and reworks most of the AuthRewriteAndrew Bartlett2001-10-311-145/+118
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | code. In particular this assists tpot in some of his work, becouse it provides the connection between the authenticaion and the vuid generation. Major Changes: - Fully malloc'ed structures. - Massive rework of the code so that all structures are made and destroyed using malloc and free, rather than hanging around on the stack. - SAM_ACCOUNT unix uids and gids are now pointers to the same, to allow them to be declared 'invalid' without the chance that people might get ROOT by default. - kill off some of the "DOMAIN\user" lookups. These can be readded at a more appropriate place (probably domain_client_validate.c) in the future. They don't belong in session setups. - Massive introduction of DATA_BLOB structures, particularly for passwords. - Use NTLMSSP flags to tell the backend what its getting, rather than magic lenghths. - Fix winbind back up again, but tpot is redoing this soon anyway. - Abstract much of the work in srv_netlog_nt back into auth helper functions. This is a LARGE change, and any assistance is testing it is appriciated. Domain logons are still broken (as far as I can tell) but other functionality seems intact. Needs testing with a wide variety of MS clients. Andrew Bartlett (This used to be commit f70fb819b2f57bd57232b51808345e2319d52f6c)
* Added some extra fields to the auth_serversupplied_info structure.Tim Potter2001-10-311-1/+13
| | | | | | | | | | To obtain the full group membership of a user (i.e nested groups on a win2k native mode server) it is necessary to merge this list of groups with the groups returned by winbindd when creating an nt access token. This breaks winbindd linking while AB and I sync up our changes to the authentication subsystem. (This used to be commit 4eeb7bcd783d7cfb3ac232f1faa035773007401d)
* Removed 'extern int DEBUGLEVEL' as it is now in the smb.h header.Tim Potter2001-10-021-3/+0
| | | | (This used to be commit 2d0922b0eabfdc0aaf1d0797482fef47ed7fde8e)
* Fix up a number of intertwined issues:Andrew Bartlett2001-09-291-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The big one is a global change to allow us to NULLify the free'ed pointer to a former passdb object. This was done to allow idra's SAFE_FREE() macro to do its magic, and to satisfy the input test in pdb_init_sam() for a NULL pointer to start with. This NULL pointer test was what was breaking the adding of accounts up until now, and this code has been reworked to avoid duplicating work - I hope this will avoid a similar mess-up in future. Finally, I fixed a few nasty bugs where the pdb_ fuctions's return codes were being ignored. Some of these functions malloc() and are permitted to fail. Also, this caught a nasty bug where pdb_set_lanman_password(sam, NULL) acheived precisely didilly-squat, just returning False. Now that we check the returns this bug was spotted. This could allow different LM and NT passwords. - the pdbedit code needs to start checking these too, but I havn't had a chance to fix it. I have also fixed up where some of the password changing code was using the pdb_set functions to store *internal* data. I assume this is from a previous lot of mass conversion work... Most likally (and going on past experience) I have missed somthing, probably in the LanMan password change code which I havn't yet been able to test, but this lot is in much better shape than it was before. If all this is too much to swallow (particularly for 2.2.2) then just adding a sam_pass = NULL to the particular line of passdb.c should do the trick for the ovbious bug. Andrew Bartlett (This used to be commit 762c8758a7869809d89b4da9c2a5249678942930)
* Fix up workstaion and kickoff time checks, moved to auth_smbpasswd.c whereAndrew Bartlett2001-09-161-10/+13
| | | | | | | | | | they can have general effect. Fixed up workstaion support in the rest of samba, so that we can do these checks. Pass through the workstation for cli_net_logon(), if supplied. (This used to be commit 7f04a139b2ee34b4c282590509cdf21395815a7a)
* Some patches to authentication:Tim Potter2001-09-121-13/+20
| | | | | | | | | | - the usersupplied_info now contains a smb_username (as it comes across on the wire) and a unix_username (after being passed through mapping functions) - when doing security={server,domain} use the smb_username, otherwise use the unix_username (This used to be commit d34fd8ec0716127c7a68eeb8e77d1ae8cc07b547)
* the next stage in the NTSTATUS/WERROR change. smbd and nmbd now compile, but ↵Andrew Tridgell2001-09-041-8/+8
| | | | | | the client code still needs some work (This used to be commit dcd6e735f709a9231860ceb9682db40ff26c9a66)
* converted another bunch of stuff to NTSTATUSAndrew Tridgell2001-08-271-8/+8
| | | | (This used to be commit 1d36250e338ae0ff9fbbf86019809205dd97d05e)
* started converting NTSTATUS to be a structure on systems with gcc in order ↵Andrew Tridgell2001-08-271-8/+9
| | | | | | to make it type incompatible with BOOL so we catch errors sooner. This has already found a number of bugs (This used to be commit 1b778bc7d22efff3f90dc450eb12baa1241cf68f)
* get rid of compiler warningsHerb Lewis2001-08-241-3/+3
| | | | (This used to be commit 0768991d04ea03e774ca8662c9cae5e1951b88e0)
* Add comment to clarify why we call this twice.Andrew Bartlett2001-08-201-0/+2
| | | | (This used to be commit afece03d023b2905c27e147516b61487a7503028)
* two fixes for NT clients -> share level Samba serverAndrew Tridgell2001-08-201-1/+2
| | | | (This used to be commit a25911d58c752350b62b205cfb0d6fc5b1c90cef)
* This patch does a number of things, mostly smaller than they look :-)Andrew Bartlett2001-08-121-60/+23
| | | | | | | | | | | | | | | | In particuar, it moves the domain_client_validate stuff out of auth_domain.c to somwhere where they (I hope) they can be shared with winbind better. (This may need some work) The main purpose of this patch was however to improve some of the internal documentation and to correctly place become_root()/unbecome_root() calls within the code. Finally this patch moves some more of auth.c into other files, auth_unix.c in this case. Andrew Bartlett (This used to be commit ea1c547ac880def29f150de2172c95213509350e)
* a few cleanups while mergeing the passdb code into 2.2Gerald Carter2001-08-091-1/+1
| | | | (This used to be commit ef01739708479c43f529c646dd136ee5670b08f9)
* Record the NT_STATUS constant rather than its number in the logfilesAndrew Bartlett2001-08-061-1/+2
| | | | | Fix typo in lmhosts manpage (This used to be commit 9fff946cf113b4858b730f5ba644d5648ba95027)
* This is the fix for the PAM bug I probably introduced in the previous commit,Andrew Bartlett2001-08-031-0/+3
| | | | | | | | | which I will confirm once I can find a box it would break on in the first place. (this is the pam accounts as nobody thing we had with 2.2.0) Andrew Bartlett (This used to be commit 9746ad12bd2d310e5c255c7ea491b87170b807af)
* This is my 'Authentication Rewrite' version 1.01, mostly as submitted toAndrew Bartlett2001-08-031-0/+275
samba-technical a few weeks ago. The idea here is to standardize the checking of user names and passwords, thereby ensuring that all authtentications pass the same standards. The interface currently implemented in as nt_status = check_password(user_info, server_info) where user_info contains (mostly) the authentication data, and server_info contains things like the user-id they got, and their resolved user name. The current ugliness with the way the structures are created will be killed the next revision, when they will be created and malloced by creator functions. This patch also includes the first implementation of NTLMv2 in HEAD, but which needs some more testing. We also add a hack to allow plaintext passwords to be compared with smbpasswd, not the system password database. Finally, this patch probably reintroduces the PAM accounts bug we had in 2.2.0, I'll fix that once this hits the tree. (I've just finished testing it on a wide variety of platforms, so I want to get this patch in). (This used to be commit b30b6202f31d339b48d51c0d38174cafd1cfcd42)
generated by cgit (git 2.34.1) at 2024-11-06 14:27:30 +0000