summaryrefslogtreecommitdiff
path: root/auth
AgeCommit message (Collapse)AuthorFilesLines
2013-03-27auth/ntlmssp: Avoid use-after-free of user_info after logon failure at log ↵Andrew Bartlett1-1/+1
level 5 Reviewed-by: Jeremy Allison <jra@samba.org>
2013-02-28auth/pycredentials: make use of samba_tevent_context_init()Stefan Metzmacher1-1/+1
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2013-02-20ntdb: switch between secrets.tdb and secrets.ntdb depending on 'use ntdb'Rusty Russell1-1/+3
Since we open with dbwrap, it auto-converts old tdbs (which it will rename to secrets.tdb.bak once it's done). Signed-off-by: Rusty Russell <rusty@rustcorp.com.au> Reviewed-by: Andrew Bartlett <abartlet@samba.org> Autobuild-User(master): Rusty Russell <rusty@rustcorp.com.au> Autobuild-Date(master): Wed Feb 20 07:09:19 CET 2013 on sn-devel-104
2013-01-24gensec: Allow login without a PAC by default (bug #9581)Andrew Bartlett1-1/+1
The sense of this test was inverted. We only want to take the ACCESS_DENIED error if gensec:require_pac=true. Andrew Bartlett Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-11-01auth: added cli_credentials_failed_kerberos_login()Andrew Tridgell2-0/+64
this is used to support retrying kerberos connections after removing a ccache entry, to cope with a server being re-built while our client still has a valid service ticket Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2012-09-22auth/kerberos: add HAVE_KRB5 guard to fix non-krb5 build after winbindd pac ↵Andrew Bartlett1-0/+3
changes Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Sep 22 02:44:07 CEST 2012 on sn-devel-104
2012-09-20auth/kerberos: Adjust log level for failed PAC signature verificationChristof Schmitt1-1/+1
With winbindd trying to verify the signature of an application provided PAC, this message can be easily triggered. Adjust the debug level to avoid filling up the logs. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-09-20auth: Fix some nonempty blank linesVolker Lendecke1-61/+59
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-08-31auth/credentials: Do not print passwords in a talloc memory dumpAndrew Bartlett1-0/+8
The fact that a password was created here is enough information, so overwrite with the function name and line. Andrew Bartlett
2012-08-30auth/credentials: Support match-by-key in cli_credentials_get_server_gss_creds()Andrew Bartlett1-3/+8
This allows a password alone to be used to accept kerberos tickets. Of course, we need to have got the salt right, but we do not need also the correct kvno. This allows gensec_gssapi to accept tickets based on a secrets.tdb entry. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Thu Aug 30 01:26:12 CEST 2012 on sn-devel-104
2012-08-29auth/credentials: Remove unused, and un-declared cli_credentials_set_krbtgt()Andrew Bartlett1-29/+0
2012-08-29auth/credentials: Better integrate fetch of secrets.tdb and secrets.ldb recordsAndrew Bartlett1-32/+61
By checking first if there is a secrets.tdb record and passing in the password and last change time we avoid setting one series of values and then replacing them. We also avoid the need to work around the setting of anonymous. Andrew Bartlett
2012-08-29auth/credentials: Improve memory handling in cli_credentials_set_machine_accountAndrew Bartlett1-26/+26
By using a tempoary talloc context this is much tidier and more reliable code. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Wed Aug 29 03:11:10 CEST 2012 on sn-devel-104
2012-08-29auth/credentials: Avoid double-free in the failure caseAndrew Bartlett1-1/+1
This pointer is only valid if dbwrap_fetch returned success. Andrew Bartlett
2012-08-28auth/credentials: Rework credentials handling to try and find the most ↵Andrew Bartlett1-33/+71
recent machine pw As winbindd will update secrets.tdb but not secrets.ldb, we need to detect this and use secrets.tdb Andrew Bartlett
2012-08-28auth/credentials: Expand secrets.tdb fetch of secrets to preserve ↵Andrew Bartlett1-0/+4
workstation and realm These would otherwise be set during the fetch from the secrets.ldb, but are wiped when that fails. Andrew Bartlett
2012-08-10build: rename security → samba-securityBjörn Jacke2-2/+2
there is a libsecurity on OSF1 which clasheѕ with our security lib. see bug #9023. Signed-off-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Björn Jacke <bj@sernet.de> Autobuild-Date(master): Fri Aug 10 14:22:21 CEST 2012 on sn-devel-104
2012-08-04auth/ntlmssp: avoid talloc_tos() in ntlmssp_client_initial()Stefan Metzmacher1-1/+1
This avoids a smb_panic at log level = 10. If we don't have a talloc stackframe yet. metze
2012-07-30auth/kerberos: Do not do pointer arithmatic on a void *Andrew Bartlett1-1/+1
Found with -Werror=pointer-arith Andrew Bartlett
2012-07-19auth/credentials: Remove extra newlineAndrew Bartlett1-1/+1
2012-07-15auth/credentials: Look in the secrets.tdb for the machine accountAndrew Bartlett2-3/+50
This is for use with the -P/--machine-pass option. Andrew Bartlett Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sun Jul 15 05:41:28 CEST 2012 on sn-devel-104
2012-07-06auth: Common function for retrieving PAC_LOGIN_INFO from PACChristof Schmitt2-0/+47
Several functions use the same logic as kerberos_pac_logon_info. Move kerberos_pac_logon_info to common code and reuse it to remove the code duplication. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2012-07-03auth: Remove .get_challenge (only used for security=server)Andrew Bartlett2-11/+0
With NTLMSSP, for NTLM2 we need to be able to set the effective challenge, so if we ever did use a module that needed this functionlity, we would downgrade to just NTLM. Now that security=server has been removed, we have no such module. This will make it easier to make the auth subsystem async, as we will not need to consider making .get_challenge async. Andrew Bartlett
2012-07-03auth/gensec: Remove unused gensec_security parameterAndrew Bartlett1-6/+3
2012-06-06auth-kerberos: avoid crash with MIT krb5 1.10.0 in gss_get_name_attribute()Alexander Bokovoy1-2/+18
gss_get_name_attribute() can return unintialized pac_display_buffer and later gss_release_buffer() will crash on attempting to release it. The fix on MIT krb5 side is in 1.10.1, reported in both Debian and MIT upstream: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=658514 http://krbdev.mit.edu/rt/Ticket/Display.html?user=guest&pass=guest&id=7087 We need to initialize variables before using gss_get_name_attribute() Autobuild-User: Alexander Bokovoy <ab@samba.org> Autobuild-Date: Wed Jun 6 18:22:51 CEST 2012 on sn-devel-104
2012-05-24auth/credentials: 'workgroup' set via command line will not drop existing ccacheAlexander Bokovoy2-13/+7
The root cause for existing ccache being invalidated was use of global loadparm with 'workgroup' value set as if from command line. However, we don't really need to take 'workgroup' parameter value's nature into account when invalidating existing ccache. When -U is used on the command line, one can specify a password to force ccache invalidation. The commit also reverts previous fix now that root cause is clear.
2012-05-23gse: Use the smb_gss_oid_equal wrapper.Andreas Schneider1-1/+1
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-05-23auth-credentials: Support using pre-fetched ccache when obtaining kerberos ↵Alexander Bokovoy1-2/+12
credentials When credentials API is used by a client-side program that already as fetched required tickets into a ccache, we need to skip re-initializing ccache. This is used in FreeIPA when Samba 4 Python bindings are run after mod_auth_kerb has obtained user tickets already.
2012-05-23auth and s4-rpc_server: Do not use features we currently can't implement ↵Simo Sorce1-1/+4
with MIT Kerbros build
2012-05-17auth/gensec: implement gensec_spnego_expire_time()Stefan Metzmacher1-0/+12
metze
2012-05-17auth/gensec: add gensec_expire_time()Stefan Metzmacher2-0/+12
metze
2012-05-04s4-auth: Use smb_krb5_cc_get_lifetime() wrapper.Andreas Schneider1-2/+2
Signed-off-by: Simo Sorce <idra@samba.org>
2012-04-25lib/replace: split out GSSAPI from lib/replace/system/kerberos.h into ↵Alexander Bokovoy3-1/+3
lib/replace/system/gssapi.h With waf build include directories are defined by dependencies specified to subsystems. Without proper dependency <gssapi/gssapi.h> cannot be found for embedded Heimdal builds when there are no system-wide gssapi/gssapi.h available. Split out GSSAPI header includes in a separate replacement header and use that explicitly where needed. Autobuild-User: Alexander Bokovoy <ab@samba.org> Autobuild-Date: Wed Apr 25 00:18:33 CEST 2012 on sn-devel-104
2012-04-23Make krb5 wrapper library common so they can be used all overSimo Sorce4-4/+56
2012-04-12srv_keytab: Pass krb5_context directly, it's all we use anyways.Simo Sorce1-1/+2
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12auth-krb: Move pac related util functions in a single place.Simo Sorce4-11/+78
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12auth-krb: Make functions static.Simo Sorce3-100/+2
The remaining gssapi_parse functions were used exclusively in gensec_krb5. Move them there and make them static. Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12auth-krb: Use simpler method to extract keytype.Simo Sorce1-19/+12
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12auth-krb: Nove oid packet check to gensec_util.Simo Sorce4-21/+47
This is clearly a utiliy function generic to gensec. Also the 3 callers had identical implementations. Provide a generic implementation for all of them and avoid duplicating the code everywhere. Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12s4-auth-krb: Remove dependency on credentials too.Simo Sorce1-3/+6
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12s4-auth-krb: Remove unneded dependency on kerberos_util.Simo Sorce1-3/+13
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12s4-auth-krb: Move keytab functions in a separate file.Simo Sorce2-2/+3
Confine ldb dependency. Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12s4-auth-krb: Move function into more appropriate header.Simo Sorce1-8/+0
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12s4-auth-krb: Make cli_credentials_invalidate_client_gss_creds static.Simo Sorce2-2/+4
It's not used anywhere else. Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12s4-auth-krb: Make impersonate_principal_from_credentials static.Simo Sorce1-6/+0
It's not used anywhere else. Signed-off-by: Andreas Schneider <asn@samba.org>
2012-04-12gensec_gssapi: keep private header file close to the actual codeSimo Sorce1-70/+0
Signed-off-by: Andreas Schneider <asn@samba.org>
2012-03-15auth/gensec_gssapi: gss_krb5_lucid_context_v1_t is not shared with the gse ↵Stefan Metzmacher1-1/+1
code anymore metze Autobuild-User: Stefan Metzmacher <metze@samba.org> Autobuild-Date: Thu Mar 15 09:16:16 CET 2012 on sn-devel-104
2012-03-09auth/ntlmssp: Remove reference to struct ntlmssp_stateAndrew Bartlett1-6/+1
2012-03-09auth/ntlmssp: Remove gensec_security element from gensec_ntlmssp_stateAndrew Bartlett4-8/+5
This just means there is one less pointer to ensure we initialise. Andrew Bartlett
2012-03-08auth/kerberos: Fall back to gsskrb5_get_subkey if we did not get the key typeAndrew Bartlett1-4/+23
The key type OID is optional, but we require that information to determine if we should use NEW_SPNEGO. Andrew Bartlett Autobuild-User: Andrew Bartlett <abartlet@samba.org> Autobuild-Date: Thu Mar 8 11:53:57 CET 2012 on sn-devel-104
generated by cgit (git 2.34.1) at 2024-11-01 14:47:35 +0000