summaryrefslogtreecommitdiffstats
path: root/source4/kdc/hdb-samba4.c
Commit message (Collapse)AuthorAgeFilesLines
* s4-kdc: Add hdb plugin for samba4, to allow kadmin to workAndrew Bartlett2011-11-301-32/+0
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | This will help users who are used to the kadmin interface, and could be extended to import existing MIT or Heimdal keys into a Samba4 AD domain. To use, add to your krb5.conf [kdc] database = { dbname = samba4: } or [kdc] database = { dbname = samba4:/usr/local/samba/etc/smb.conf } And copy hdb_samba4.so from PREFIX/modules/hdb to your Heimdal lib directory Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Wed Nov 30 03:22:11 CET 2011 on sn-devel-104
* s4:kdc: split s4u2self and s4u2proxy checksStefan Metzmacher2011-05-181-6/+21
| | | | metze
* s4:kdc/*.c - minimise includesMatthias Dieter Wallnöfer2010-12-121-4/+0
| | | | | Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Sun Dec 12 15:20:46 CET 2010 on sn-devel-104
* s4/kdc - fix a warning regarding a changed parameter type (kvno)Matthias Dieter Wallnöfer2010-12-031-1/+1
| | | | | Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Fri Dec 3 23:56:15 CET 2010 on sn-devel-104
* s4:heimdal: import lorikeet-heimdal-201012010201 (commit ↵Andrew Bartlett2010-12-011-16/+0
| | | | 81fe27bcc0148d410ca4617f8759b9df1a5e935c)
* s4-kdc: rename kdc/kdc.h to kdc/kdc-glue.hAndrew Tridgell2010-11-121-1/+1
| | | | kdc.h conflicts with a heimdal header name
* s4-kdc Fix up after import of new lorikeet-heimdalAndrew Bartlett2010-10-031-2/+18
| | | | | Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Sun Oct 3 01:56:04 UTC 2010 on sn-devel-104
* s4-kdc Handle the case where we may be given a ticket from an RODC in db layerAndrew Bartlett2010-09-291-4/+5
| | | | | | | | This includes rewriting the PAC if the original krbtgt isn't to be trusted, and reading different entries from the DB for the krbtgt depending on the krbtgt number. Andrew Bartlett
* s4-kdc Add common setup, handle RODC setup caseAndrew Bartlett2010-09-291-43/+3
| | | | | | | | | | This means we just set up the system_session etc in one place and don't diverge between the MIT and Heimdal plugins. We also now determine if we are an RODC and store some details that we will need later. Andrew Bartlett
* Per Andrews request, revertJelmer Vernooij2010-06-231-2/+0
| | | | | | | "heimdal/waf: Initial work on making it possible to use the system" as the hdb_check_s4u2self function handling is incorrect. This reverts commit b099631f428d0ecc641d59bd3c94674e6348dde9.
* heimdal/waf: Initial work on making it possible to use the systemJelmer Vernooij2010-06-191-0/+2
| | | | | | | heimdal again. Still missing are the detection of the right Heimdal version and linking (unresolved symbols at the moment).
* s4:kdc Remove special talloc_free of the ldb contextAndrew Bartlett2010-05-281-10/+0
| | | | | | | I can see no reason not to just let this go with the talloc tree that created it, and avoid a talloc_free with references. Andrew Bartlett
* Remove more usages of iconv_convenience in files which were apparently not ↵Jelmer Vernooij2010-05-181-1/+0
| | | | recompiled by waf.
* s4:kdc Add functions to hdb-samba4 for the new s4u2self callback.Andrew Bartlett2010-04-101-5/+6
| | | | | | | For now, this shares the 'if it's the same host' system with the constrained delegation code. Andrew Bartlett
* s4:kdc move db functions in their own fileSimo Sorce2010-01-281-1463/+45
| | | | | | | | | | Keep all heimdal related plugin code within hdb_samba4.c Move interfaces needed by multiple plugins in db-glue.c Move sequence context in main db context so that we do not depend on db->hdb_dbc in the common code. Remove unnecessary paremeters from function prototypes
* s4:kdc Use a clearer name for the samba kdc entrySimo Sorce2010-01-281-17/+15
| | | | | | Renames hdb_samba4_private to samba_kdc_entry Streamlines members of the entry and the kdc db contextto avoid unnecessary duplication.
* s4:kdc Use better db context structureSimo Sorce2010-01-281-60/+76
| | | | | | | | This allows to use a common structure not tied to hdb_samba4 Also allows to avoid many casts within hdb_samba4 functions This is the first step to abstract samba kdc databse functions so they can be used by the MIT forthcoming plugin.
* s4:kdc Simplify header filesSimo Sorce2010-01-221-6/+8
|
* Fix commentSimo Sorce2010-01-081-1/+1
|
* s4:cleanups remove trailing spaces and tabsSimo Sorce2009-12-231-119/+120
|
* s4-hdb: go back to a separate samdb for the KDCAndrew Tridgell2009-11-091-1/+16
| | | | | | | | | The change to use a common system_session broke replication as the KDC forces CRED_DONT_USE_KERBEROS on session->credentials, which is shared with other parts of the system. This should be fixed once we confirm whether the ldap backend actually relies on CRED_DONT_USE_KERBEROS
* s4:kdc/hdb-samba4 - Remove unused variableMatthias Dieter Wallnöfer2009-10-301-1/+0
|
* s4-samdb: reduce the number of samdb opens at startupAndrew Tridgell2009-10-251-3/+3
| | | | | Using common parameters means that the ldb_wrap code can return a reference rather than a new database
* s4-kdc: ignore unknown keytypes Andrew Tridgell2009-09-181-0/+6
| | | | don't fail hdb operations if one of the key types is unknown
* fixed a double free bug on error in net exportAndrew Tridgell2009-08-251-1/+0
|
* s4:kerberos Use MIT compatible names for these enc typesAndrew Bartlett2009-08-211-2/+2
| | | | | | | | | This is a small start on (ie, the only trivial part of) the work shown in: http://k5wiki.kerberos.org/wiki/Projects/Samba4_Port#Samba.27s_use_of_Heimdal_symbols.2C_with_MIT_differences (a table of all Kerberos symbols used in Samba4, and notes on where they differ from those provided with MIT Kerberos) Andrew Bartlett
* s4:kerberos Add support for user principal names in certificatesAndrew Bartlett2009-07-281-12/+91
| | | | | | | | | | | | | | This extends the PKINIT code in Heimdal to ask the HDB layer if the User Principal Name name in the certificate is an alias (perhaps just by case change) of the name given in the AS-REQ. (This was a TODO in the Heimdal KDC) The testsuite is extended to test this behaviour, and the other PKINIT certficate (using the standard method to specify a principal name in a certificate) is updated to use a Administrator (not administrator). (This fixes the kinit test). Andrew Bartlett
* s4:kdc Push context to hdb_samba4 by way of the 'name' of the DBAndrew Bartlett2009-07-271-3/+12
| | | | | | | | | | | This overloads the 'name' part of the keytab name to supply a context pointer, and so avoids 3 global variables! To do this, we had to stop putting the entry for kpasswd into the secrets.ldb. (I don't consider this a big loss, and any entry left there by an upgrade will be harmless). Andrew Bartlett
* s4:kdc Tidy up hdb_samba4 some moreAndrew Bartlett2009-07-271-28/+38
| | | | | | | | | This removes the last use of the prefix hdb_ldb and makes it clear that we pass in 3 global variables to get state information into hdb_samba4 when used as a keytab. (And that they belong to hdb_samba4, not to the KDC) Andrew Bartlett
* s4:kdc Add in a simple check for constrained delegation to selfAndrew Bartlett2009-07-201-1/+70
| | | | | | | | | | To do this properly, we must use the PAC, but for now this is enough to check that we are delegating to another name on the same host (which must be safe). (Windows 7 does this a lot, also noted in bug 6273) Andrew Bartlett
* s4:kdc Rework KDC to pull in less attributes for krbtgt lookupsAndrew Bartlett2009-07-171-16/+33
| | | | | | | | | Each attribute we request from LDB comes with a small cost, so don't lookup any more than we must for the (very) frequent krbtgt lookup case. Similarly, we don't need to build a PAC for a server (as a target), so don't ask for the PAC attributes here either. Andrew Bartlett
* s4:kdc rename functions from LDB_ to hdb_samba4Andrew Bartlett2009-07-171-71/+71
| | | | | | | The LDB_ prefix is misleading, and stomps on the LDB namespace. This is a Samba4 hdb module, and not something generic. Andrew Bartlett
* s4:kdc Initialise new hdb function pointers.Andrew Bartlett2009-07-161-0/+3
| | | | Soon we will add implementations for these.
* libds: share UF_ flags between samba3 and 4.Günther Deschner2009-07-131-1/+1
| | | | Guenther
* s4:heimdal Allow KRB5_NT_ENTERPRISE names in all DB lookupsAndrew Bartlett2009-06-301-0/+1
| | | | | | | | | | | | | | The previous code only allowed an KRB5_NT_ENTERPRISE name (an e-mail list user principal name) in an AS-REQ. Evidence from the wild (Win2k8 reportadely) indicates that this is instead valid for all types of requests. While this is now handled in heimdal/kdc/misc.c, a flag is now defined in Heimdal's hdb so that we can take over this handling in future (once we start using a system Heimdal, and if we find out there is more to be done here). Andrew Bartlett
* s4:kdc Only get the lp_ctx once for a LDB_fetch()Andrew Bartlett2009-06-301-11/+18
|
* Rework hdb-samba4 to remove useless abstractions.Andrew Bartlett2009-06-301-84/+44
| | | | | | | | | | | The function LDB_lookup_principal() has been eliminated, and it's contents spread back to it's callers. Removing the abstraction makes the code clearer. Also ensure we never pass unescaped user input to a LDB search function. Andrew Bartlett
* s4:kdc Allow a password change when the password is expiredAndrew Bartlett2009-06-181-1/+12
| | | | | | | | | | | | | | This requires a rework on Heimdal's windc plugin layer, as we want full control over what tickets Heimdal will issue. (In particular, in case our requirements become more complex in future). The original problem was that Heimdal's check would permit the ticket, but Samba would then deny it, not knowing it was for kadmin/changepw Also (in hdb-samba4) be a bit more careful on what entries we will make the 'change_pw' service mark that this depends on. Andrew Bartlett
* s4:heimdal: import lorikeet-heimdal-200906080040 (commit ↵Andrew Bartlett2009-06-121-59/+52
| | | | | | | | | | | 904d0124b46eed7a8ad6e5b73e892ff34b6865ba) Also including the supporting changes required to pass make test A number of heimdal functions and constants have changed since we last imported a tree (for the better, but inconvenient for us). Andrew Bartlett
* changed the auth path to use extended DN ops to avoid non-indexed searchesAndrew Tridgell2009-06-041-27/+25
| | | | | | | | | | | | | | | | | | Logs showed that every SAM authentication was causing a non-indexed ldb search for member=XXX. This was previously indexed in Samba4, but since we switched to using the indexes from the full AD schema it now isn't. The fix is to use the extended DN operations to allow us to ask the server for the memberOf attribute instead, with with the SIDs attached to the result. This also means one less search on every authentication. The patch is made more complex by the fact that some common routines use the result of these user searches, so we had to update all searches that uses user_attrs and those common routines to make sure they all returned a ldb_message with a memberOf filled in and the SIDs attached.
* Handle the krbtgt special case by looking for RID -514Andrew Bartlett2009-05-271-26/+52
| | | | | | | | It turns out (seen in MS-SAMR 3.1.1.7.1 for example) that the primary way the krbtgt account is recognised as special is that RID. This should fix issues such as 'password expired' on the kpasswd service. Andrew Bartlett
* Don't use crossRef records to find our own domainAndrew Bartlett2009-05-261-138/+69
| | | | | | | | A single AD server can only host a single domain, so don't stuff about with looking up our crossRef record in the cn=Partitions container. We instead trust that lp_realm() and lp_workgroup() works correctly. Andrew Bartlett
* s4:kdc: avoid c++ reserved word 'private'Stefan Metzmacher2009-02-011-26/+26
| | | | metze
* s4:lib/tevent: rename structsStefan Metzmacher2008-12-291-1/+1
| | | | | | | | | | | | | | | | | | | | list="" list="$list event_context:tevent_context" list="$list fd_event:tevent_fd" list="$list timed_event:tevent_timer" for s in $list; do o=`echo $s | cut -d ':' -f1` n=`echo $s | cut -d ':' -f2` r=`git grep "struct $o" |cut -d ':' -f1 |sort -u` files=`echo "$r" | grep -v source3 | grep -v nsswitch | grep -v packaging4` for f in $files; do cat $f | sed -e "s/struct $o/struct $n/g" > $f.tmp mv $f.tmp $f done done metze
* s4:kdc: pass down event_context explicitStefan Metzmacher2008-12-291-1/+1
| | | | metze
* Add TALLOC_CTX pointer to strhex_to_data_blob for consistency with SambaJelmer Vernooij2008-10-181-2/+1
| | | | 3.
* Fix include paths to new location of libutil.Jelmer Vernooij2008-10-111-1/+1
|
* Set default trust kvno to -1Andrew Bartlett2008-10-061-1/+1
|
* Fix cross-realm authentication in Samba4's KDC.Andrew Bartlett2008-10-061-3/+5
|
* Use the trust password version as kvno for trusts in Kerberos.Andrew Bartlett2008-10-061-0/+7
|
generated by cgit (git 2.34.1) at 2024-07-01 05:18:31 +0000