summaryrefslogtreecommitdiffstats
path: root/source3/auth
Commit message (Collapse)AuthorAgeFilesLines
...
* Allow usernames in the form of 'NT_STATUS_....' to map to that as the errorAndrew Bartlett2002-01-011-0/+6
| | | | | | | | | when using the 'name_to_ntstatus' auth module. This could be useful in testing. Andrew Bartlett (This used to be commit 5cdc67d0bda8ef41305cae9c5be70d11593ffdd8)
* Now that winbind doesn't rely on this, we may as well remove it...Andrew Bartlett2002-01-011-108/+0
| | | | | Andrew Bartlett (This used to be commit 6673fdda3cb6b90189d8f82274fdffa89f68101b)
* A farily large commit:Andrew Bartlett2002-01-019-184/+158
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | - Move rpc_client/cli_trust.c to smbd/change_trust_pw.c - It hasn't been used by anything else since smbpasswd lost its -j - Add a TALLOC_CTX to the auth subsytem. These are only valid for the length of the calls to the individual modules, if you want a longer context hide it in your private data. Similarly, all returns (like the server_info) should still be malloced. - Move the 'ntdomain' module (security=domain in oldspeak) over to use the new libsmb domain logon code. Also rework much of the code to use some better helper functions for the connection - getting us much better error returns (the new code is NTSTATUS). The only remaining thing to do is to figure out if tpot's 0xdead 0xbeef for the LUID feilds is sufficient, or if we should do random LUIDs as per the old code. Similarly, I'll move winbind over to this when I get a chance. This leaves the SPOOLSS code and some cli_pipe code as the only stuff still in rpc_client, at least as far as smbd is concerned. While I've given this a basic rundown, any testing is as always appriciated. Andrew Bartlett (This used to be commit d870edce76ecca259230fbdbdacd0c86793b4837)
* - portablitity fixes for cc -64 on irixAndrew Tridgell2001-12-311-3/+3
| | | | | - fixed gid* bug in rpc_server (This used to be commit 48aa90c48c5f0e3054c4acdc49668e222e7c0d36)
* Add a pile of doxygen style comments to various parts of Samba. Many of theseAndrew Bartlett2001-12-304-56/+119
| | | | | | | | | | probably will never actually be genearted, but I like the style in any case. Also fix a segfault in 'net rpc' when the login failed and a small memory leak on failure in the auth_info.c code. Andrew Bartlett (This used to be commit 2efae7cc522651c22fb120835bc800645559b63e)
* Removed extra lp_adduser() call.Jeremy Allison2001-12-291-17/+0
| | | | | | Fixed up error returns in get_correct_cversion(). Jeremy. (This used to be commit 7ce2d1fe37d2be26c407f3dc9427851d00ca216a)
* added trusted realm support to ADS authenticationAndrew Tridgell2001-12-192-14/+35
| | | | | | | the method used for checking if a domain is a trusted domain is very crude, we should really call a backend fn of some sort. For now I'm using winbindd to do the dirty work. (This used to be commit adf44a9bd0d997ba4dcfadc564a29149531525af)
* make sure we pass the lm and nt data in the right order. They were swapped, ↵Jim McDonough2001-12-171-2/+2
| | | | | | and somehow this worked when both were provided, but not when only one was. (This used to be commit 477309b1e653761b291daa4693976d341880beab)
* If domain SID can't be fetched, we shouldn't return NT_STATUS_NO_MEMORY. It ↵Jim McDonough2001-12-141-1/+1
| | | | | | causes a confusing client error. Changed to NT_STATUS_CANT_ACCESS_DOMAIN_INFO. (This used to be commit 07ea83e6f0f03ba4706c98abb58346a4f4ec983c)
* added info level 3 to samrgetgroupinfo. I don't know what the value is.Jean-François Micouleau2001-12-101-1/+1
| | | | | | | | | | | | | | It's just to keep usermanager happy ;-) clean up a bit samr_query_aliasinfo to return the group description added: samr_del_aliasmem, samr_del_groupmem and samr_del_domuser with the correct scripts, you can now entirely manage the users from usermanager ! Closer to full PDC every day ;-) J.F. (This used to be commit 0a727afc669704cda9b44d44dbac9e989e906ae3)
* Fix segfault, and add a comment.Andrew Bartlett2001-12-081-2/+5
| | | | (This used to be commit ff91131ef9b384765de3e4f22202d1e493f02efc)
* again an intrusive patch:Jean-François Micouleau2001-12-062-2/+4
| | | | | | | | | | | | | | | | - removed the ugly as hell sam_logon_in_ssb variable, I changed a bit the definition of standard_sub_basic() to cope with that. - removed the smb.conf: 'domain admin group' and 'domain guest group' parameters ! We're not playing anymore with the user's group RIDs ! - in get_domain_user_groups(), if the user's gid is a group, put it first in the group RID list. I just have to write an HOWTO now ;-) J.F. (This used to be commit fef52c4b96c987115fb1818c00c2352c67790e50)
* I think the lookup_pdc_name() should be called lookup_dc_name() and theTim Potter2001-11-291-1/+1
| | | | | | | | | name_status_find() call here should look up a #1c name instead of #1d. This fixes some bugs currently with BDC authentication in winbindd and in smbd as you can't query the #1d name with the ip address of a BDC. Who is Uncle Tom Cobbley anyway? (This used to be commit 4215048f7b20a8f9e5877bdbb2f54841b2f7fa64)
* fix a bunch of places where we can double-free a cli structureAndrew Tridgell2001-11-281-4/+0
| | | | (This used to be commit e2ba2383c9f679c076749a8f4fccefc3559e37ec)
* fixed the panics on basicsmb-sharelist on sun1Andrew Tridgell2001-11-271-1/+3
| | | | (This used to be commit 1bd3235744bebefa6ba09795438400b4674c165c)
* fixed leak in free_user_info()Andrew Tridgell2001-11-271-0/+1
| | | | (This used to be commit 8eb4277b12b600cdbf8a5205ebc76d1d9d52f1aa)
* another memory leak bites the dustAndrew Tridgell2001-11-271-4/+0
| | | | (This used to be commit 982d6d447add2d4079c28c0b8ecb0e499f391a2a)
* fix sense of lp_allow_trusted_domains()Andrew Tridgell2001-11-273-11/+2
| | | | | fix a memory leak (This used to be commit 1421f2fbcb296a894cb4e7548e0275e35e055b98)
* Fix debugAndrew Bartlett2001-11-261-1/+1
| | | | (This used to be commit 44224ae156394dac1055c68764c84f758cea6540)
* A number of things to clean up the auth subsytem a bit...Andrew Bartlett2001-11-266-52/+83
| | | | | | | | | | | | | | | | | | | | | | | | We now default encrypt passwords = yes We now check plaintext passwords (however aquired) with the 'sam' backend rather than unix, if encrypt passwords = yes. (this kills off the 'local' backed. The sam backend may be renamed in its place) The new 'samstrict' wrapper backend checks that the user's domain is one of our netbios aliases - this ensures that we don't get fallback crazies with security = domain. Similarly, the code in the 'ntdomain' and 'smbserver' backends now checks that the user was not local before contacting the DC. The default ordering has changed, we now check the local stuff first - but becouse of the changes above, we will really only ever contact one auth source. Andrew Bartlett (This used to be commit e89b47f65e7eaf5eb288a3d6ba2d3d115c628e7e)
* add SEC_ADS auth methodAndrew Tridgell2001-11-261-0/+12
| | | | (This used to be commit b175c42080b15f27589cb6b6d61af5cbbedf5d02)
* challange -> challengeTim Potter2001-11-267-54/+54
| | | | (This used to be commit d6318add27f6bca5be00cbedf2226b642341297a)
* Got medieval on another pointless extern. Removed extern struct ipzeroTim Potter2001-11-261-5/+3
| | | | | | | | and replaced with two functions: void zero_ip(struct in_adder *ip); BOOL is_zero_ip(struct in_addr ip); (This used to be commit 778f5f77a66cda76348a7c6f64cd63afe2bfe077)
* This compleats the of the authenticaion subystem into the new 'auth'Andrew Bartlett2001-11-261-1/+410
| | | | | | | | | | | | | subdirectory. (The insertion of these files was done with some CVS backend magic, hence the lack of a commit message). This also moves libsmb/domain_client_validate.c back into auth_domain.c, becouse we no longer share it with winbind. Andrew Bartlett (This used to be commit 782835470cb68da2188a57007d6f55c17b094d08)
* Add the PDC end of the smbtorture test for creating an NT_STATUS -> DOS errorAndrew Bartlett2001-11-252-0/+36
| | | | | | | | | | | | | | | | | map. This little authentication module is #ifdef DEVELOPER, becouse it really is of no use execept as a development tool invoke by setting: auth methods = guest sam name_to_ntstatus in the smb.conf file (the SAM and guest elements are required for the member server to authenticate itself). Andrew Bartlett (This used to be commit 9807e66f34c1088399657060977e384c5a7f0664)
* And add the winbind module I missed in the last run.Andrew Bartlett2001-11-241-0/+111
| | | | | | | (large change to modularise the auth subsystem) Andrew Bartlett (This used to be commit 324c4676280641fee0647221dba1e826e03ba9ab)
* This is another rather major change to the samba authenticaionAndrew Bartlett2001-11-249-292/+799
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | subystem. The particular aim is to modularized the interface - so that we can have arbitrary password back-ends. This code adds one such back-end, a 'winbind' module to authenticate against the winbind_auth_crap functionality. While fully-functional this code is mainly useful as a demonstration, because we don't get back the info3 as we would for direct ntdomain authentication. This commit introduced the new 'auth methods' parameter, in the spirit of the 'auth order' discussed on the lists. It is renamed because not all the methods may be consulted, even if previous methods fail - they may not have a suitable challenge for example. Also, we have a 'local' authentication method, for old-style 'unix if plaintext, sam if encrypted' authentication and a 'guest' module to handle guest logins in a single place. While this current design is not ideal, I feel that it does provide a better infrastructure than the current design, and can be built upon. The following parameters have changed: - use rhosts = This has been replaced by the 'rhosts' authentication method, and can be specified like 'auth methods = guest rhosts' - hosts equiv = This needs both this parameter and an 'auth methods' entry to be effective. (auth methods = guest hostsequiv ....) - plaintext to smbpasswd = This is replaced by specifying 'sam' rather than 'local' in the auth methods. The security = parameter is unchanged, and now provides defaults for the 'auth methods' parameter. The available auth methods are: guest rhosts hostsequiv sam (passdb direct hash access) unix (PAM, crypt() etc) local (the combination of the above, based on encryption) smbserver (old security=server) ntdomain (old security=domain) winbind (use winbind to cache DC connections) Assistance in testing, or the production of new and interesting authentication modules is always appreciated. Andrew Bartlett (This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
* More spelling fixes, comment reformatting.Tim Potter2001-11-211-8/+11
| | | | (This used to be commit edb556b47446f75dc4987eee15276661eb6cec8d)
* Spelling fix, reformatted comment.Tim Potter2001-11-211-4/+6
| | | | (This used to be commit 096868bd35b374f97e570676fc23c006b6c7a1d3)
* Fixed sizeof vs array length bug in make_user_info_winbind_crap()Tim Potter2001-11-201-2/+2
| | | | | Spelling fix. (This used to be commit 3d87c1a2444c3b9267e0dda7a2da77657fba143e)
* Fix up some DEBUG()sAndrew Bartlett2001-11-111-17/+37
| | | | | | | Add and fix comments Add 'const' to some more input paramaters. (This used to be commit 0c7eefcb5c5db63294d0584029e0d32cd1523e80)
* Add back the not null checks in a better place.Andrew Bartlett2001-11-111-1/+7
| | | | | Check the pdb_init_sam() for failure. (This used to be commit 1808cd5210258bddc349f13a7bcf20a3f46aa672)
* make sam_account_ok static.Andrew Bartlett2001-11-111-32/+29
| | | | | | | remove rudundent not null checks fix indenting (This used to be commit 3eada888fddb1f0cb7c0ed7037eb1c60e7988ad9)
* This extra check isn't needed, we can only get here if secuirty=domainAndrew Bartlett2001-11-111-3/+0
| | | | (This used to be commit 600d83e43f61eb138115731ce089ba42d63e0924)
* Minor updates. A small dose of const.Andrew Bartlett2001-11-112-2/+2
| | | | (This used to be commit 80667cb0dd1a2cdef17711c8580af9f524971cea)
* Remove built-in support for clear-text kerberos authentication.Andrew Bartlett2001-11-111-123/+3
| | | | | | | | | | | This should remove some confusion from the ./configure, but does not affect the 'real' kerberos support currently residing in smbd/sesssetup.c. This code is vunerable to a spoofed KDC, and is best replaced by --with-pam and the pam_krb5 module. This module includes measures to prevent such spoofing. Andrew Bartlett (This used to be commit 3235880b41ee5dd5ef171195489fb9254f5d89b0)
* This change updates lp_guestaccount() to be a *global* paramater, rather thanAndrew Bartlett2001-11-091-1/+1
| | | | | | | | | | | | | | | | | per-share. I beleive that almost all the things that this could have done on a per-share basis can be done with other tools, like 'force user'. Almost all the user's of this paramater used it as a global anyway... While this is one step at a time, I hope it will allow me to considerably simplfy the make_connection() code, particularly for the user-level security case. This already removes an absolute truckload of extra attempted password lookups on the guest account. Andrew Bartlett (This used to be commit 8e708332eded210c1d1fe0cebca3c9c19f054b71)
* Change to guest logon code.Andrew Bartlett2001-11-082-26/+94
| | | | | | | | | | | | | | | | | | | | | | | | | | This changes the way we process guest logons - we now treat them as normal logons, but set the 'guest' flag. In particular this is needed becouse Win2k will do an NTLMSSP login with username "", therefore missing our previous guest connection code - this is getting a pain to do as a special case all over the shop. Tridge: We don't seem to be setting a guest bit for NTLMSSP, in either the anonymous or authenticated case, can you take a look at this? Also some cleanups in the check_password() code that should make some of the debugs clearer. Various other minor cleanups: - change the session code to just take a vuser, rather than having to do a vuid lookup on vuser.vuid - Change some of the global_client_caps linking - Better debug in authorise_login(): show the vuid. Andrew Bartlett (This used to be commit 62f4e4bd0aef9ade653b3f8d575d2864c166ab4d)
* Renamed make_user_info_for_winbindd() to be more consistent with theTim Potter2001-11-051-4/+4
| | | | | names of the other functions in this file. (This used to be commit 4880f37e4ee08b6363314a3fb67051a6708988d0)
* Added NT_USER_TOKEN into server_info to fix extra groups problem.Jeremy Allison2001-11-031-12/+58
| | | | | | Got "medieval on our ass" about const warnings (as many as I could :-). Jeremy. (This used to be commit ee5e7ca547eff016818ba5c43b8ea0c9fa69b808)
* Minor cleanups/fixes in the NTLMv2 codeAndrew Bartlett2001-11-031-6/+2
| | | | (This used to be commit 253790f6d71653b572c0174113b8559820de6bdd)
* Various post AuthRewrite cleanups, fixups and tidyups.Andrew Bartlett2001-11-012-22/+31
| | | | | | | | | | | | | | | | | | Zero out some of the plaintext passwords for paranoia Fix up some of the other passdb backends with the change to *uid_t rather than uid_t. Make some of the code in srv_netlog_nt.c clearer, is passing an array around, so pass its lenght in is definition, not as a seperate paramater. Use sizeof() rather than magic numbers, it makes things easier to read. Cope with a PAM authenticated user who is not in /etc/passwd - currently by saying NO_SUCH_USER, but this can change in future. Andrew Bartlett (This used to be commit 514c91b16baca639bb04638042bf9894d881172a)
* Fix up domain logons. Tested with NT4.Andrew Bartlett2001-10-311-1/+1
| | | | (This used to be commit c8b2718adfe114b74a155116c5e74f014d6df887)
* This is a farily large patch (3300 lines) and reworks most of the AuthRewriteAndrew Bartlett2001-10-317-273/+868
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | code. In particular this assists tpot in some of his work, becouse it provides the connection between the authenticaion and the vuid generation. Major Changes: - Fully malloc'ed structures. - Massive rework of the code so that all structures are made and destroyed using malloc and free, rather than hanging around on the stack. - SAM_ACCOUNT unix uids and gids are now pointers to the same, to allow them to be declared 'invalid' without the chance that people might get ROOT by default. - kill off some of the "DOMAIN\user" lookups. These can be readded at a more appropriate place (probably domain_client_validate.c) in the future. They don't belong in session setups. - Massive introduction of DATA_BLOB structures, particularly for passwords. - Use NTLMSSP flags to tell the backend what its getting, rather than magic lenghths. - Fix winbind back up again, but tpot is redoing this soon anyway. - Abstract much of the work in srv_netlog_nt back into auth helper functions. This is a LARGE change, and any assistance is testing it is appriciated. Domain logons are still broken (as far as I can tell) but other functionality seems intact. Needs testing with a wide variety of MS clients. Andrew Bartlett (This used to be commit f70fb819b2f57bd57232b51808345e2319d52f6c)
* Small 'const' updates ahead of some AuthRewrite merging.Andrew Bartlett2001-10-311-5/+5
| | | | (This used to be commit 3b5e72bda3263c6bdf81dfface4fae4f06b71032)
* Added some extra fields to the auth_serversupplied_info structure.Tim Potter2001-10-311-1/+13
| | | | | | | | | | To obtain the full group membership of a user (i.e nested groups on a win2k native mode server) it is necessary to merge this list of groups with the groups returned by winbindd when creating an nt access token. This breaks winbindd linking while AB and I sync up our changes to the authentication subsystem. (This used to be commit 4eeb7bcd783d7cfb3ac232f1faa035773007401d)
* Spnego on the 'server' end of security=server just does not work, so set theAndrew Bartlett2001-10-301-0/+3
| | | | | | | | | | flags so we just do a 'normal' session setup. Also add some parinoia code to detect when sombody attempts to do a 'normal' session setup when spnego had been negoitiated. Andrew Bartlett (This used to be commit 190898586fa218c952fbd5bea56155d04e6f248b)
* Fix up auth_smbpasswd.c to use the password interface, rather than theAndrew Bartlett2001-10-291-8/+8
| | | | | | | structures directly. Andrew Bartlett (This used to be commit c2dc24ab6370236437b72b929e2a56e174163d78)
* This commit is number 4 of 4.Andrew Bartlett2001-10-292-16/+19
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular this commit focuses on: Actually adding the 'const' to the passdb interface, and the flow-on changes. Also kill off the 'disp_info' stuff, as its no longer used. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes introduces a large dose of 'const' to the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username --- This finishes this line of commits off, your tree should now compile again :-) Andrew Bartlett (This used to be commit c95f5aeb9327347674589ae313b75bee3bf8e317)
* This commit is number 3 of 4.Andrew Bartlett2001-10-292-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | In particular this commit focuses on: Changing the Get_Pwnam code so that it can work in a const-enforced environment. While these changes have been mildly tested, and are pretty small, any assistance in this is appreciated. ---- These changes allow for 'const' in the Samba tree. There are a number of good reasons to do this: - I want to allow the SAM_ACCOUNT structure to move from wasteful pstrings and fstrings to allocated strings. We can't do that if people are modifying these outputs, as they may well make assumptions about getting pstrings and fstrings - I want --with-pam_smbpass to compile with a slightly sane volume of warnings, currently its pretty bad, even in 2.2 where is compiles at all. - Tridge assures me that he no longer opposes 'const religion' based on the ability to #define const the problem away. - Changed Get_Pwnam(x,y) into two variants (so that the const parameter can work correctly): - Get_Pwnam(const x) and Get_Pwnam_Modify(x). - Reworked smbd/chgpasswd.c to work with these mods, passing around a 'struct passwd' rather than the modified username (This used to be commit e7634f81c5116ff4addfb7e495f54b6bb78e8f77)
generated by cgit (git 2.34.1) at 2025-09-30 13:41:48 +0000