summaryrefslogtreecommitdiffstats
path: root/source4/kdc
Commit message (Collapse)AuthorAgeFilesLines
* gensec: clarify memory ownership for gensec_session_info() and ↵Andrew Bartlett2011-08-031-0/+1
| | | | | | | | | | | | | | | gensec_session_key() This is slightly less efficient, because we no longer keep a cache on the gensec structures, but much clearer in terms of memory ownership. Both gensec_session_info() and gensec_session_key() now take a mem_ctx and put the result only on that context. Some duplication of memory in the callers (who were rightly uncertain about who was the rightful owner of the returned memory) has been removed to compensate for the internal copy. Andrew Bartlett
* s4:kdc: fix compiler warningStefan Metzmacher2011-08-021-1/+1
| | | | | | | metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Aug 2 06:06:15 CEST 2011 on sn-devel-104
* s4:kdc: canonicalize the principal if HDB_F_FOR_TGS_REQ is givenStefan Metzmacher2011-07-261-2/+7
| | | | | | | | | Windows seems to always canonicalize the principal in TGS replies. metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Jul 26 03:25:06 CEST 2011 on sn-devel-104
* s4:kdc: restore the behavior before the last heimdal importStefan Metzmacher2011-07-201-8/+16
| | | | | | | metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Wed Jul 20 12:12:38 CEST 2011 on sn-devel-104
* s4:kdc: set *_strongest_*_key to true to restore the old behaviorStefan Metzmacher2011-07-151-0/+13
| | | | | | | | | TODO: check why this is needed. metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Fri Jul 15 12:26:25 CEST 2011 on sn-devel-104
* s4:kdc/mit_samba: disable mit_samba_check_s4u2proxy()Stefan Metzmacher2011-06-281-0/+9
| | | | | | | | | | | As mit_samba_update_pac_data() doesn't support adding S4U_DELEGATION_INFO to the pac (and I have no clue how to add that) we should disable S4U2Proxy until this is implemented. metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Tue Jun 28 20:35:19 CEST 2011 on sn-devel-104
* s4:kdc: generate the S4U_DELEGATION_INFO in the regenerated pacStefan Metzmacher2011-06-284-7/+155
| | | | metze
* s4:kdc: use KRB5_WINDC_PLUGIN_MINOR define instead of KRB5_WINDC_PLUGING_MINORStefan Metzmacher2011-06-281-1/+1
| | | | metze
* s4:kdc: implement samba_kdc_check_s4u2proxy()Stefan Metzmacher2011-06-241-0/+105
| | | | metze
* Use tevent_req_oomVolker Lendecke2011-06-201-1/+1
| | | | This fixes a few Coverity errors
* libcli/util Rename common map_nt_error_from_unix to avoid duplicate symbolAndrew Bartlett2011-06-201-2/+2
| | | | | | | | | | | | The two error tables need to be combined, but for now seperate the names. (As the common parts of the tree now use the _common function, errmap_unix.c must be included in the s3 autoconf build). Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Mon Jun 20 08:12:03 CEST 2011 on sn-devel-104
* s4-ipv6: update callers to load_interface_list()Andrew Tridgell2011-06-061-1/+1
|
* s4-ipv6: use iface_list_wildcard() to listen on IPv6Andrew Tridgell2011-06-061-12/+17
| | | | | when we need to listen on a wildcard address, we now listen on a list of sockets, usually 0.0.0.0 and ::
* s4:kdc: split s4u2self and s4u2proxy checksStefan Metzmacher2011-05-184-23/+55
| | | | metze
* s4:kdc: UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION => ↵Stefan Metzmacher2011-05-181-0/+14
| | | | | | flags.trusted_for_delegation metze
* s4-interfaces Rename interfaces code so not to conflict with source3/Andrew Bartlett2011-05-081-4/+4
| | | | | | | | | The iface_count, iface_n_bcast, and load_interfaces functions conflicted with functions of the same name in source3, so the source4 functions were renamed. Hopefully we can actually wrap one around the other in future. Andrew Bartlett
* kdc: always ldb escape the realmAndrew Bartlett2011-04-051-1/+11
|
* lib/util/charset rename iconv_convenience to iconv_handleAndrew Bartlett2011-03-251-2/+2
| | | | | | This better reflects what this structure is Andrew Bartlett
* charcnv: removed the allow_badcharcnv and allow_bad_conv options to ↵Andrew Tridgell2011-03-241-2/+2
| | | | | | | | | convert_string*() we shouldn't accept bad multi-byte strings, it just hides problems Autobuild-User: Andrew Tridgell <tridge@samba.org> Autobuild-Date: Thu Mar 24 01:47:26 CET 2011 on sn-devel-104
* source4/kdc: Fix prototypes for all functions.Jelmer Vernooij2011-03-196-1/+13
|
* s4:kdc: split the kdc_tcp_proxy() logic from the main kdc logicStefan Metzmacher2011-03-043-252/+303
| | | | | | | | | | | By having kdc_tcp_proxy_send/recv(), which just asks any writeable dc for a reponse blob, we simplify the interaction between client-local and local-writeable sockets. This allows us to make kdc_socket, kdc_process_fn_t, kdc_tcp_call and kdc_tcp_socket private to kdc.c again. metze
* s4:kdc: split the kdc_udp_proxy() logic from the main kdc logicStefan Metzmacher2011-03-043-207/+231
| | | | | | | | | | | By having kdc_udp_proxy_send/recv(), which just asks any writeable dc for a reponse blob, we simplify the interaction between client-local and local-writeable sockets. This allows us to make kdc_udp_call and kdc_udp_socket private to kdc.c again. metze
* s4:kdc: add a kdc_proxy_unavailable_error() helper functionStefan Metzmacher2011-03-041-0/+24
| | | | metze
* s4:kdc: fix calculation of the rodc kvnoStefan Metzmacher2011-03-041-4/+12
| | | | | | | | | | | | | | | | | | Bit shifting is non-trivial in C:-) This int32_t a = 0x12340000; uint32_t b = (a >> 16); results in 0x00001234, but this int32_t a = 0xEDCB0000; uint32_t b = (a >> 16); results in 0xFFFFEDCB, while we expected 0x0000EDCB. metze
* s4-auth: rename 'auth' subsystem to 'auth4'Andrew Tridgell2011-02-181-5/+5
| | | | | | | | this prevents conflicts with the s3 auth modules. The auth modules in samba3 may appear in production smb.conf files, so it is preferable to rename the s4 modules for minimal disruption. Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* ldb: use #include <ldb.h> for ldbAndrew Tridgell2011-02-101-1/+1
| | | | | | | | thi ensures we are using the header corresponding to the version of ldb we're linking against. Otherwise we could use the system ldb for link and the in-tree one for include Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4-auth Rework auth subsystem to remove struct auth_serversupplied_infoAndrew Bartlett2011-02-092-15/+16
| | | | | | | | | | | | | This changes auth_serversupplied_info into the IDL-defined struct auth_user_info_dc. This then in turn contains a struct auth_user_info, which is the only part of the structure that is mainted into the struct session_info. The idea here is to avoid keeping the incomplete results of the authentication (such as session keys, lists of SID memberships etc) in a namespace where it may be confused for the finalised results. Andrew Barltett
* mit-samba: Allow nesting on the event contextSimo Sorce2011-02-071-0/+3
| | | | | | | | This context is used in ldb, and ldb modules apparently abort if nesting is not allowed. Autobuild-User: Simo Sorce <idra@samba.org> Autobuild-Date: Mon Feb 7 20:58:02 CET 2011 on sn-devel-104
* s4-kdc: don't ask for an extended DN for krbtgt_dnAndrew Tridgell2011-01-141-1/+1
| | | | | | otherwise msg->dn would be non-minimal and would fail in searches Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* Typo fix in KDC parameters.Brad Hards2010-12-241-3/+3
| | | | | | | Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Fri Dec 24 12:09:00 CET 2010 on sn-devel-104
* s4:kdc/*.c - minimise includesMatthias Dieter Wallnöfer2010-12-128-44/+2
| | | | | Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Sun Dec 12 15:20:46 CET 2010 on sn-devel-104
* s4:kdc/proxy.c - optimise includes in order to fix a build warning on Tru64Matthias Dieter Wallnöfer2010-12-121-6/+1
|
* s4:kdc/kpasswdd.c - don't return an uninitialised NT_STATUSMatthias Dieter Wallnöfer2010-12-121-2/+1
| | | | Discovered by Tru64 build
* s4-lsa Implement kerberos ticket life policyAndrew Bartlett2010-12-095-3/+108
| | | | | | | | We now no longer print tickets with a potentially infinite life, and we report the same life over LSA as we use in the KDC. We should get this from group policy, but for now it's parametric smb.conf options. Andrew Bartlett
* s4:kdc/kpasswdd.c - fix memory leaksMatthias Dieter Wallnöfer2010-12-041-2/+15
|
* s4/kdc - fix a warning regarding a changed parameter type (kvno)Matthias Dieter Wallnöfer2010-12-033-3/+3
| | | | | Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Fri Dec 3 23:56:15 CET 2010 on sn-devel-104
* s4:heimdal: import lorikeet-heimdal-201012010201 (commit ↵Andrew Bartlett2010-12-012-21/+6
| | | | 81fe27bcc0148d410ca4617f8759b9df1a5e935c)
* s4-loadparm: use loadparm_init_global() instead of loadparm_init()Andrew Tridgell2010-11-291-1/+1
| | | | | | | this prevents us having two lp_ctx contexts in these tools which leads to bizarre behaviour Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
* s4-kdc Rework supported encryption type logic to match MicrosoftAndrew Bartlett2010-11-161-37/+16
| | | | | | | | | | | | | | | | | Thanks to Hongwei Sun for the clear description of the algorithim involved. Importantly, it isn't possible to remove encryption types from the list, only to add them over the defaults (DES and arcfour-hmac-md5, and additional AES for DCs and RODCs). This changes the behaviour for entries with msDS-supportedEncryptionTypes: 0, which Angelos Oikonomopoulos reported finding set by ADUC when attempting to store cleartext passwords. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Tue Nov 16 21:24:43 UTC 2010 on sn-devel-104
* s4-kdc Fix the realm handling again, this time pay attention to the flagsAndrew Bartlett2010-11-161-20/+20
| | | | | | | | | The KDC sets different flags for the AS-REQ (this is client-depenent) and the TGS-REQ to determine if the realm should be forced to the canonical value. If we do this always, or do this never, we get into trouble, so it's much better to honour the flags we are given. Andrew Bartlett
* s4-kdc use 'flags' to only create the 'admin data' elements when requestedAndrew Bartlett2010-11-161-15/+19
| | | | | | This avoids setting these values when the caller simply does not care Andrew Bartlett
* s4-kdc Add 'flags' parameter to db fetch callsAndrew Bartlett2010-11-161-8/+35
| | | | | | This will allow these calls to honour the flags passed in from the KDC Andrew Bartlett
* s4-kdc Don't regenerate the PAC for cross-realm ticketsAndrew Bartlett2010-11-151-0/+3
| | | | | | | | | | | We should never get a cross-realm ticket that was not issued by a full DC, but if someone claims to have such a thing, reject it rather than segfaulting on the NULL client pointer. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Mon Nov 15 23:59:34 UTC 2010 on sn-devel-104
* s4-kdc Don't always regenerate the PACAndrew Bartlett2010-11-151-2/+4
| | | | | | | | | The PAC was being regenerated on all normal DCs, because they don't have a msDS-SecondaryKrbTgtNumber attribute. Instead we need to check if it's set and not equal to our RODC number, allowing RODCs to trust the full DCs and itself, but not other RODCs. Andrew Bartlett
* s4-kdc Fix realm handling in our KDCAndrew Bartlett2010-11-151-38/+6
| | | | | | | we should reset the realm part of the principal, but not the lowercase realm embedded in the 'krbtgt/realm@REALM'. Andrew Bartlett
* kdc: Build as shared module by default.Jelmer Vernooij2010-11-151-0/+1
|
* s4-kdc update startup routines after heimdal updateAndrew Bartlett2010-11-151-1/+13
| | | | | | | We should check the errors from krb5_kdc_windc_init and we now need to additionally run krb5_kdc_pkinit_config() Andrew Bartlett
* s4-kdc Remove use of heimdal private headers in kpasswd server.Andrew Bartlett2010-11-151-16/+3
| | | | | | | This remains an abuse, because it relies on setting into the krb5_principal structure, but at least it causes less trouble for the server. Andrew Bartlett
* s4-kdc: if "bind interfaces only" is false, then also listen on wildcardAndrew Tridgell2010-11-151-20/+44
| | | | | | | Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Autobuild-User: Andrew Tridgell <tridge@samba.org> Autobuild-Date: Mon Nov 15 00:13:59 UTC 2010 on sn-devel-104
* Build wrepl server as service by default.Jelmer Vernooij2010-11-141-1/+1
|
generated by cgit (git 2.34.1) at 2025-08-28 19:11:57 +0000