summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2006-01-31 22:58:50 +0000
committerGerald (Jerry) Carter <jerry@samba.org>2007-10-10 13:51:40 -0500
commit541809b006e40c5acba7570bcd858196db634e56 (patch)
tree6016ab4b98c8ea7103bbb10d8f2f638c05b70e32
parent5113bb843842b2d605f4af8c0b43fef9875b6bc1 (diff)
downloadsamba-541809b006e40c5acba7570bcd858196db634e56.tar.gz
samba-541809b006e40c5acba7570bcd858196db634e56.tar.bz2
samba-541809b006e40c5acba7570bcd858196db634e56.zip
r13265: Clarify how delegation works with the remote RPC backend.
Andrew Bartlett (This used to be commit 75489ac8bced0f9e7ab28739fd6b26ab12cfa585)
-rw-r--r--source4/rpc_server/remote/README33
1 files changed, 32 insertions, 1 deletions
diff --git a/source4/rpc_server/remote/README b/source4/rpc_server/remote/README
index 670777806e..0d235a9901 100644
--- a/source4/rpc_server/remote/README
+++ b/source4/rpc_server/remote/README
@@ -1,7 +1,38 @@
-This smb.conf example should get you started:
+This is an RPC backend that implements all operations in terms of
+remote RPC operations. This may be useful in certain debugging
+situations, where the traffic is encrypted, or you wish to validate
+that IDL is correct before implementing full test clients, or with
+windows clients.
+There are two modes of operation: Password specified and delegated
+credentials.
+
+Password specified:
+-------------------
+
+This uses a static username/password in the config file, example:
+
+[global]
dcerpc endpoint servers = remote
dcerpc_remote:binding = ncacn_np:win2003
dcerpc_remote:username = administrator
dcerpc_remote:password = PASSWORD
dcerpc_remote:interfaces = samr, lsarpc, netlogon
+
+Delegated credentials:
+----------------------
+
+If your incoming user is authenticated with Kerberos, and the machine
+account for this Samba4 proxy server is 'trusted for delegation', then
+the Samba4 proxy can forward the client's credentials to the target.
+
+You must be joined to the domain (net join <domain> member).
+
+To set 'trusted for delegation' with MMC, see the checkbox in the
+Computer account property page under Users and Computers.
+
+[global]
+ dcerpc endpoint servers = remote
+ dcerpc_remote:binding = ncacn_np:win2003
+ dcerpc_remote:interfaces = samr, lsarpc, netlogon
+