summaryrefslogtreecommitdiffstats
path: root/source3/auth
Commit message (Collapse)AuthorAgeFilesLines
...
* s3: Use talloc_stackframe() in create_token_from_usernameVolker Lendecke2010-04-111-7/+1
|
* s3: Fix a memleak in user_in_group_sidVolker Lendecke2010-04-111-0/+1
|
* s3: Remove the make_auth_methods routineVolker Lendecke2010-04-1110-72/+101
| | | | This was just TALLOC_ZERO_P
* s3: Fix a typoVolker Lendecke2010-04-111-1/+1
|
* s3: Make "auth_context" its own talloc parentVolker Lendecke2010-04-114-15/+9
| | | | Remove "mem_ctx" from "struct auth_context"
* s3: Fix some nonempty linesVolker Lendecke2010-04-116-36/+35
|
* s3: Fix a typoVolker Lendecke2010-04-091-1/+1
|
* s3:ntlmssp: use client.netbios_name instead of workstationStefan Metzmacher2010-03-241-2/+2
| | | | | | metze Signed-off-by: Günther Deschner <gd@samba.org>
* s3:ntlmssp: rename void *auth_context; into void *callback_private;Stefan Metzmacher2010-03-241-5/+5
| | | | | | metze Signed-off-by: Günther Deschner <gd@samba.org>
* s3:ntlmssp: pass names to ntlmssp_server_start() and store them in ntlmssp_stateStefan Metzmacher2010-03-241-6/+28
| | | | | | | | Inspired by the NTLMSSP merge work by Andrew Bartlett. metze Signed-off-by: Günther Deschner <gd@samba.org>
* s3:ntlmssp: replace server_role by a server.is_standalone in ntlmssp_stateStefan Metzmacher2010-03-241-1/+5
| | | | | | | | Inspired by the NTLMSSP merge work by Andrew Bartlett. metze Signed-off-by: Günther Deschner <gd@samba.org>
* Fix valgrind error when running under share level security. plaintext_passwordJeremy Allison2010-03-221-2/+2
| | | | | | is a data blob with a data pointer pointing to an allocation of length zero. Jeremy.
* s3: Fix some nonempty blank linesVolker Lendecke2010-02-201-59/+57
|
* s3: Remove some calls to memset -- reduces text size by some bytes for meVolker Lendecke2010-01-241-8/+3
|
* s3:auth: fix account unlock regression introduced with fix for bug #4347Michael Adam2010-01-141-7/+5
| | | | | | | | By an oversight, the patchset for #4347 made the unlocking of a locked account after the lockout duration ineffective. Thanks to Björn for finding this! Michael
* s3:auth: add comment to nulling out stolen sampassMichael Adam2010-01-121-0/+4
| | | | | | | | | | Adding this comment makes me think, I could also have changed make_server_info_sam() talloc_move instead of talloc_steal, but that would have changed the signature... Well the comment is a first step. :-) Michael
* s3: Replace most calls to sid_append_rid() by sid_compose()Volker Lendecke2010-01-101-6/+4
|
* s3: Remove the typedef for "auth_serversupplied_info"Volker Lendecke2010-01-1011-34/+36
|
* s3: Remove the typedef for "auth_usersupplied_info"Volker Lendecke2010-01-1012-30/+30
|
* s3:auth: don't update the bad pw count if pw is among last 2 history entriesMichael Adam2010-01-071-1/+73
| | | | | | | | | This conforms to the behaviour of Windows 2003: http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/security/bpactlck.mspx This is supposed to fixes Bug #4347 . Michael
* s3:auth:check_sam_security: introduce a bool var to control pad_pw_count ↵Michael Adam2010-01-071-1/+7
| | | | | | | | incrementation This is a preparatory patch for the last part in fixing bug #4347 . Michael
* s3:auth:check_sam_security: improve calling and logging of ↵Michael Adam2010-01-071-4/+16
| | | | | | | | | pdb_update_sam_account Log what went wrongl, and also call pdb_update_sam_account inside become_root/unbecome_root: do the logging outside. Michael
* s3:auth:check_sam_security: fix a leading tab/ws mixupMichael Adam2010-01-071-1/+1
| | | | Michael
* s3:auth:check_sam_security: create (and use) a common exit pointMichael Adam2010-01-071-11/+7
| | | | | | for use after sam_password_ok() has been called. Michael
* s3:auth:check_sam_security: null out sampass after it has been stolen.Michael Adam2010-01-071-0/+1
| | | | | | | | So that a later talloc_free would not harm. I could have used talloc_move instead of talloc steal in make_server_info_sam(), but this would have required a change of the signature. Michael
* s3:auth:sam_password_ok: take username, acct_ctrl and nt/lm hashes, not sampassMichael Adam2010-01-071-14/+20
| | | | | | | | This is in preparation to extending check_sam_security to also check against the password history before updating the bad password count. This way, sam_password_ok can more easily be reused for that purpose. Michael
* s3:auth: use data_blob_null instead of data_blob(NULL, 0) in sam_password_ok()Michael Adam2010-01-071-2/+2
| | | | | | | This way it is more explicit that there is no allocated data here that may leak. Michael
* s3:auth:sam_password_ok: fix allocation of a data blob.Michael Adam2010-01-071-1/+1
| | | | | | | | | | | | data_blob(mem_ctx, 16) does not use mem_ctx as a talloc ctx but copies 16 bytes from mem_ctx into the newly allocated data blob. This can not have been intentional. A blank uint8_t array of length 16 is allocated by passing NULL instead of mem_ctx. And using data_blob_talloc(mem_ctx, NULL, 16) adds the allocated blank 16 byte array to mem_ctx - so this is what must have been intended. Michael
* s3:auth:sam_password_ok: enhance readability (imho) by adding some pointersMichael Adam2010-01-071-17/+24
| | | | | | and removing bool variables and several checks. Michael
* s3:check_sam_security: untangle assignment from statementMichael Adam2010-01-071-1/+2
| | | | Michael
* s3:ntlmssp: change get_challange() to return NTSTATUSStefan Metzmacher2009-12-291-2/+3
| | | | metze
* s3:ntlmssp: only include ntlmssp.h where actually neededAndrew Bartlett2009-12-221-0/+1
| | | | Andrew Bartlett
* s3:auth: Fix typo in debug message.Karolin Seeger2009-12-071-2/+2
| | | | Karolin
* s3:fix a comment typoMichael Adam2009-11-141-1/+1
| | | | Michael
* s3:is_trusted_domain: shortcut if domain name == global_sam_nameMichael Adam2009-11-141-0/+4
| | | | | | | A domain can't have a trust with itself. This saves some roundtrips to the ldap server for ldapsam. Michael
* s3:is_trusted_domain: shortcut if domain name is NULL or emptyMichael Adam2009-11-141-0/+4
| | | | | | This saves some roundtrips to LDAP in an ldapsm setup. Michael
* s3/pam: move variable declaration into belonging ifdef sectionBjörn Jacke2009-11-131-1/+1
| | | | This fixes a unused variable 'addr' warning on some platforms
* Ensure all callers to the rpc_client/cli_pipe functions correctlyJeremy Allison2009-11-121-6/+6
| | | | | initialize return variables. Jeremy.
* s3-passdb: cleanup some callers of pdb_get_trusteddom_pw().Günther Deschner2009-11-031-3/+1
| | | | Guenther
* s3: use enum netr_SchannelType all over the place.Günther Deschner2009-10-131-1/+1
| | | | Guenther
* schannel: fully share schannel sign/seal between s3 and 4.Günther Deschner2009-09-161-13/+13
| | | | Guenther
* s3-dcerpc: use dcerpc_AuthLevel and remove duplicate set of flags.Günther Deschner2009-09-152-2/+2
| | | | Guenther
* s3-rpc_client: add dcerpc_transport_t to cli_rpc_pipe_open_schannel().Günther Deschner2009-09-111-1/+1
| | | | Guenther
* Implement Metze's suggestion of trying getpwuid(0) then getpwnam(root).Jeremy Allison2009-08-221-9/+5
| | | | Jeremy.
* Try and fix the buildfarm by using getpwnam(root) insteadJeremy Allison2009-08-211-0/+7
| | | | | | of getpwuid(0) if DEVELOPER is defined. I'm hoping the build farm defines DEVELOPER... Jeremy.
* s3: fix bug #6650, authentication at member servers when winbindd is not runningMichael Adam2009-08-211-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Authentication of domain users on the member server fails when winbindd is not running. This is because the is_trusted_domain() check behaves differently when winbindd is running and when it isn't: Since wb_is_trusted_domain() calls wbcDomainInfo(), and this will also give a result for our own domain, this succeeds for the member server's own domain when winbindd is running. When winbindd is not running, is_trusted_domain() checks (and possibly updates) the trustdom cache, and this does the lsa_EnumTrustDom() rpc call to the DC which does not return its own domain. In case of winbindd not running, before 3.4, the domain part was _silently_ mapped to the workgroup in auth_util.c:make_user_info_map(), which effectively did nothing in the member case. But then the parameter "map untrusted to domain" was introduced and the mapping was made to the workstation name instead of the workgroup name by default unless "map untrusted to domain = yes". (Commits d8c54fddda2dba3cbc5fc13e93431b152813892e, 5cd4b7b7c03df6e896186d985b6858a06aa40b3f, and fbca26923915a70031f561b198cfe2cc0d9c3aa6) This was ok as long as winbindd was running, but with winbindd not running, these changes actually uncovered the above logic bug in the check. So the correct check is to treat the workgroup as trusted / or known in the member case. This is most easily achieved by not comparing the domain name against get_global_sam_name() which is the host name unless for a DC but against my_sam_name() which is the workgroup for a DC and for a member, too. (These names are not very intuitive...) I admit that this is a very long commit message for a one-liner, but this has needed some tracking down, and I think the change deserves some justification. Michael
* Fix bug #6647 - get_root_nt_token: getpwnam("root") failed!Jeremy Allison2009-08-191-2/+2
| | | | | | Not all systems may have a "root" user, but all must have a passwd entry for a uid of zero. Jeremy.
* Added prefer_ipv4 bool parameter to resolve_name().Jeremy Allison2009-07-281-1/+1
| | | | | | | | | | W2K3 DC's can have IPv6 addresses but won't serve krb5/ldap or cldap on those addresses. Make sure when we're asking for DC's we prefer IPv4. If you have an IPv6-only network this prioritizing code will be a no-op. And if you have a mixed network then you need to prioritize IPv4 due to W2K3 DC's. Jeremy.
* Remove an unused talloc context.Jeremy Allison2009-07-161-8/+2
| | | | Jeremy.
* Tidyup prompted by #6554 - Wrong deallocation in sam_account_ok.Jeremy Allison2009-07-161-2/+3
| | | | Jeremy.
generated by cgit (git 2.34.1) at 2025-09-27 11:15:43 +0000