summaryrefslogtreecommitdiff
path: root/source3/auth
AgeCommit message (Collapse)AuthorFilesLines
2002-01-05I've decided to move the auth code around a bit more...Andrew Bartlett11-532/+535
The auth_authsupplied_info typedef is now just a plain struct - auth_context, but it has been modified to contain the function pointers to the rest of the auth subsystem's components. (Who needs non-static functions anyway?) In working all this mess out, I fixed a number of memory leaks and moved the entire auth subsystem over to talloc(). Note that the TALLOC_CTX attached to the auth_context can be rather long-lived, it is provided for things that are intended to live as long. (The global_negprot_auth_context lasts the whole life of the smbd). I've also adjusted a few things in auth_domain.c, mainly passing the domain as a paramater to a few functions instead of looking up lp_workgroup(). I'm hopign to make this entire thing a bit more trusted domains (as PDC) freindly in the near future. Other than that, I moved a bit of the code around, hence the rather messy diff. Andrew Bartlett (This used to be commit 12f5515f556cf39fea98134fe3e2ac4540501048)
2002-01-02debug statement fixups.Jeremy Allison1-16/+16
Merge SAFE_FREE fix in tdb from 2.2, and IRIX fix. Jeremy. (This used to be commit eb6607466565bcd5b3800492d0bc1ae8a44da4f6)
2002-01-02Another touch of 'const'Andrew Bartlett1-1/+1
(This used to be commit 3d812aacff98eec62c748cb89109a2e58806d92d)
2002-01-01Allow usernames in the form of 'NT_STATUS_....' to map to that as the errorAndrew Bartlett1-0/+6
when using the 'name_to_ntstatus' auth module. This could be useful in testing. Andrew Bartlett (This used to be commit 5cdc67d0bda8ef41305cae9c5be70d11593ffdd8)
2002-01-01Now that winbind doesn't rely on this, we may as well remove it...Andrew Bartlett1-108/+0
Andrew Bartlett (This used to be commit 6673fdda3cb6b90189d8f82274fdffa89f68101b)
2002-01-01A farily large commit:Andrew Bartlett9-184/+158
- Move rpc_client/cli_trust.c to smbd/change_trust_pw.c - It hasn't been used by anything else since smbpasswd lost its -j - Add a TALLOC_CTX to the auth subsytem. These are only valid for the length of the calls to the individual modules, if you want a longer context hide it in your private data. Similarly, all returns (like the server_info) should still be malloced. - Move the 'ntdomain' module (security=domain in oldspeak) over to use the new libsmb domain logon code. Also rework much of the code to use some better helper functions for the connection - getting us much better error returns (the new code is NTSTATUS). The only remaining thing to do is to figure out if tpot's 0xdead 0xbeef for the LUID feilds is sufficient, or if we should do random LUIDs as per the old code. Similarly, I'll move winbind over to this when I get a chance. This leaves the SPOOLSS code and some cli_pipe code as the only stuff still in rpc_client, at least as far as smbd is concerned. While I've given this a basic rundown, any testing is as always appriciated. Andrew Bartlett (This used to be commit d870edce76ecca259230fbdbdacd0c86793b4837)
2001-12-31- portablitity fixes for cc -64 on irixAndrew Tridgell1-3/+3
- fixed gid* bug in rpc_server (This used to be commit 48aa90c48c5f0e3054c4acdc49668e222e7c0d36)
2001-12-30Add a pile of doxygen style comments to various parts of Samba. Many of theseAndrew Bartlett4-56/+119
probably will never actually be genearted, but I like the style in any case. Also fix a segfault in 'net rpc' when the login failed and a small memory leak on failure in the auth_info.c code. Andrew Bartlett (This used to be commit 2efae7cc522651c22fb120835bc800645559b63e)
2001-12-29Removed extra lp_adduser() call.Jeremy Allison1-17/+0
Fixed up error returns in get_correct_cversion(). Jeremy. (This used to be commit 7ce2d1fe37d2be26c407f3dc9427851d00ca216a)
2001-12-19added trusted realm support to ADS authenticationAndrew Tridgell2-14/+35
the method used for checking if a domain is a trusted domain is very crude, we should really call a backend fn of some sort. For now I'm using winbindd to do the dirty work. (This used to be commit adf44a9bd0d997ba4dcfadc564a29149531525af)
2001-12-17make sure we pass the lm and nt data in the right order. They were swapped, ↵Jim McDonough1-2/+2
and somehow this worked when both were provided, but not when only one was. (This used to be commit 477309b1e653761b291daa4693976d341880beab)
2001-12-14If domain SID can't be fetched, we shouldn't return NT_STATUS_NO_MEMORY. It ↵Jim McDonough1-1/+1
causes a confusing client error. Changed to NT_STATUS_CANT_ACCESS_DOMAIN_INFO. (This used to be commit 07ea83e6f0f03ba4706c98abb58346a4f4ec983c)
2001-12-10added info level 3 to samrgetgroupinfo. I don't know what the value is.Jean-François Micouleau1-1/+1
It's just to keep usermanager happy ;-) clean up a bit samr_query_aliasinfo to return the group description added: samr_del_aliasmem, samr_del_groupmem and samr_del_domuser with the correct scripts, you can now entirely manage the users from usermanager ! Closer to full PDC every day ;-) J.F. (This used to be commit 0a727afc669704cda9b44d44dbac9e989e906ae3)
2001-12-08Fix segfault, and add a comment.Andrew Bartlett1-2/+5
(This used to be commit ff91131ef9b384765de3e4f22202d1e493f02efc)
2001-12-06again an intrusive patch:Jean-François Micouleau2-2/+4
- removed the ugly as hell sam_logon_in_ssb variable, I changed a bit the definition of standard_sub_basic() to cope with that. - removed the smb.conf: 'domain admin group' and 'domain guest group' parameters ! We're not playing anymore with the user's group RIDs ! - in get_domain_user_groups(), if the user's gid is a group, put it first in the group RID list. I just have to write an HOWTO now ;-) J.F. (This used to be commit fef52c4b96c987115fb1818c00c2352c67790e50)
2001-11-29I think the lookup_pdc_name() should be called lookup_dc_name() and theTim Potter1-1/+1
name_status_find() call here should look up a #1c name instead of #1d. This fixes some bugs currently with BDC authentication in winbindd and in smbd as you can't query the #1d name with the ip address of a BDC. Who is Uncle Tom Cobbley anyway? (This used to be commit 4215048f7b20a8f9e5877bdbb2f54841b2f7fa64)
2001-11-28fix a bunch of places where we can double-free a cli structureAndrew Tridgell1-4/+0
(This used to be commit e2ba2383c9f679c076749a8f4fccefc3559e37ec)
2001-11-27fixed the panics on basicsmb-sharelist on sun1Andrew Tridgell1-1/+3
(This used to be commit 1bd3235744bebefa6ba09795438400b4674c165c)
2001-11-27fixed leak in free_user_info()Andrew Tridgell1-0/+1
(This used to be commit 8eb4277b12b600cdbf8a5205ebc76d1d9d52f1aa)
2001-11-27another memory leak bites the dustAndrew Tridgell1-4/+0
(This used to be commit 982d6d447add2d4079c28c0b8ecb0e499f391a2a)
2001-11-27fix sense of lp_allow_trusted_domains()Andrew Tridgell3-11/+2
fix a memory leak (This used to be commit 1421f2fbcb296a894cb4e7548e0275e35e055b98)
2001-11-26Fix debugAndrew Bartlett1-1/+1
(This used to be commit 44224ae156394dac1055c68764c84f758cea6540)
2001-11-26A number of things to clean up the auth subsytem a bit...Andrew Bartlett6-52/+83
We now default encrypt passwords = yes We now check plaintext passwords (however aquired) with the 'sam' backend rather than unix, if encrypt passwords = yes. (this kills off the 'local' backed. The sam backend may be renamed in its place) The new 'samstrict' wrapper backend checks that the user's domain is one of our netbios aliases - this ensures that we don't get fallback crazies with security = domain. Similarly, the code in the 'ntdomain' and 'smbserver' backends now checks that the user was not local before contacting the DC. The default ordering has changed, we now check the local stuff first - but becouse of the changes above, we will really only ever contact one auth source. Andrew Bartlett (This used to be commit e89b47f65e7eaf5eb288a3d6ba2d3d115c628e7e)
2001-11-26add SEC_ADS auth methodAndrew Tridgell1-0/+12
(This used to be commit b175c42080b15f27589cb6b6d61af5cbbedf5d02)
2001-11-26challange -> challengeTim Potter7-54/+54
(This used to be commit d6318add27f6bca5be00cbedf2226b642341297a)
2001-11-26Got medieval on another pointless extern. Removed extern struct ipzeroTim Potter1-5/+3
and replaced with two functions: void zero_ip(struct in_adder *ip); BOOL is_zero_ip(struct in_addr ip); (This used to be commit 778f5f77a66cda76348a7c6f64cd63afe2bfe077)
2001-11-26This compleats the of the authenticaion subystem into the new 'auth'Andrew Bartlett1-1/+410
subdirectory. (The insertion of these files was done with some CVS backend magic, hence the lack of a commit message). This also moves libsmb/domain_client_validate.c back into auth_domain.c, becouse we no longer share it with winbind. Andrew Bartlett (This used to be commit 782835470cb68da2188a57007d6f55c17b094d08)
2001-11-25Add the PDC end of the smbtorture test for creating an NT_STATUS -> DOS errorAndrew Bartlett2-0/+36
map. This little authentication module is #ifdef DEVELOPER, becouse it really is of no use execept as a development tool invoke by setting: auth methods = guest sam name_to_ntstatus in the smb.conf file (the SAM and guest elements are required for the member server to authenticate itself). Andrew Bartlett (This used to be commit 9807e66f34c1088399657060977e384c5a7f0664)
2001-11-24And add the winbind module I missed in the last run.Andrew Bartlett1-0/+111
(large change to modularise the auth subsystem) Andrew Bartlett (This used to be commit 324c4676280641fee0647221dba1e826e03ba9ab)
2001-11-24This is another rather major change to the samba authenticaionAndrew Bartlett9-292/+799
subystem. The particular aim is to modularized the interface - so that we can have arbitrary password back-ends. This code adds one such back-end, a 'winbind' module to authenticate against the winbind_auth_crap functionality. While fully-functional this code is mainly useful as a demonstration, because we don't get back the info3 as we would for direct ntdomain authentication. This commit introduced the new 'auth methods' parameter, in the spirit of the 'auth order' discussed on the lists. It is renamed because not all the methods may be consulted, even if previous methods fail - they may not have a suitable challenge for example. Also, we have a 'local' authentication method, for old-style 'unix if plaintext, sam if encrypted' authentication and a 'guest' module to handle guest logins in a single place. While this current design is not ideal, I feel that it does provide a better infrastructure than the current design, and can be built upon. The following parameters have changed: - use rhosts = This has been replaced by the 'rhosts' authentication method, and can be specified like 'auth methods = guest rhosts' - hosts equiv = This needs both this parameter and an 'auth methods' entry to be effective. (auth methods = guest hostsequiv ....) - plaintext to smbpasswd = This is replaced by specifying 'sam' rather than 'local' in the auth methods. The security = parameter is unchanged, and now provides defaults for the 'auth methods' parameter. The available auth methods are: guest rhosts hostsequiv sam (passdb direct hash access) unix (PAM, crypt() etc) local (the combination of the above, based on encryption) smbserver (old security=server) ntdomain (old security=domain) winbind (use winbind to cache DC connections) Assistance in testing, or the production of new and interesting authentication modules is always appreciated. Andrew Bartlett (This used to be commit 8d31eae52a9757739711dbb82035a4dfe6b40c99)
2001-11-21More spelling fixes, comment reformatting.Tim Potter1-8/+11
(This used to be commit edb556b47446f75dc4987eee15276661eb6cec8d)
2001-11-21Spelling fix, reformatted comment.Tim Potter1-4/+6
(This used to be commit 096868bd35b374f97e570676fc23c006b6c7a1d3)
2001-11-20Fixed sizeof vs array length bug in make_user_info_winbind_crap()Tim Potter1-2/+2
Spelling fix. (This used to be commit 3d87c1a2444c3b9267e0dda7a2da77657fba143e)
2001-11-11Fix up some DEBUG()sAndrew Bartlett1-17/+37
Add and fix comments Add 'const' to some more input paramaters. (This used to be commit 0c7eefcb5c5db63294d0584029e0d32cd1523e80)
2001-11-11Add back the not null checks in a better place.Andrew Bartlett1-1/+7
Check the pdb_init_sam() for failure. (This used to be commit 1808cd5210258bddc349f13a7bcf20a3f46aa672)
2001-11-11make sam_account_ok static.Andrew Bartlett1-32/+29
remove rudundent not null checks fix indenting (This used to be commit 3eada888fddb1f0cb7c0ed7037eb1c60e7988ad9)
2001-11-11This extra check isn't needed, we can only get here if secuirty=domainAndrew Bartlett1-3/+0
(This used to be commit 600d83e43f61eb138115731ce089ba42d63e0924)
2001-11-11Minor updates. A small dose of const.Andrew Bartlett2-2/+2
(This used to be commit 80667cb0dd1a2cdef17711c8580af9f524971cea)
2001-11-11Remove built-in support for clear-text kerberos authentication.Andrew Bartlett1-123/+3
This should remove some confusion from the ./configure, but does not affect the 'real' kerberos support currently residing in smbd/sesssetup.c. This code is vunerable to a spoofed KDC, and is best replaced by --with-pam and the pam_krb5 module. This module includes measures to prevent such spoofing. Andrew Bartlett (This used to be commit 3235880b41ee5dd5ef171195489fb9254f5d89b0)
2001-11-09This change updates lp_guestaccount() to be a *global* paramater, rather thanAndrew Bartlett1-1/+1
per-share. I beleive that almost all the things that this could have done on a per-share basis can be done with other tools, like 'force user'. Almost all the user's of this paramater used it as a global anyway... While this is one step at a time, I hope it will allow me to considerably simplfy the make_connection() code, particularly for the user-level security case. This already removes an absolute truckload of extra attempted password lookups on the guest account. Andrew Bartlett (This used to be commit 8e708332eded210c1d1fe0cebca3c9c19f054b71)
2001-11-08Change to guest logon code.Andrew Bartlett2-26/+94
This changes the way we process guest logons - we now treat them as normal logons, but set the 'guest' flag. In particular this is needed becouse Win2k will do an NTLMSSP login with username "", therefore missing our previous guest connection code - this is getting a pain to do as a special case all over the shop. Tridge: We don't seem to be setting a guest bit for NTLMSSP, in either the anonymous or authenticated case, can you take a look at this? Also some cleanups in the check_password() code that should make some of the debugs clearer. Various other minor cleanups: - change the session code to just take a vuser, rather than having to do a vuid lookup on vuser.vuid - Change some of the global_client_caps linking - Better debug in authorise_login(): show the vuid. Andrew Bartlett (This used to be commit 62f4e4bd0aef9ade653b3f8d575d2864c166ab4d)
2001-11-05Renamed make_user_info_for_winbindd() to be more consistent with theTim Potter1-4/+4
names of the other functions in this file. (This used to be commit 4880f37e4ee08b6363314a3fb67051a6708988d0)
2001-11-03Added NT_USER_TOKEN into server_info to fix extra groups problem.Jeremy Allison1-12/+58
Got "medieval on our ass" about const warnings (as many as I could :-). Jeremy. (This used to be commit ee5e7ca547eff016818ba5c43b8ea0c9fa69b808)
2001-11-03Minor cleanups/fixes in the NTLMv2 codeAndrew Bartlett1-6/+2
(This used to be commit 253790f6d71653b572c0174113b8559820de6bdd)
2001-11-01Various post AuthRewrite cleanups, fixups and tidyups.Andrew Bartlett2-22/+31
Zero out some of the plaintext passwords for paranoia Fix up some of the other passdb backends with the change to *uid_t rather than uid_t. Make some of the code in srv_netlog_nt.c clearer, is passing an array around, so pass its lenght in is definition, not as a seperate paramater. Use sizeof() rather than magic numbers, it makes things easier to read. Cope with a PAM authenticated user who is not in /etc/passwd - currently by saying NO_SUCH_USER, but this can change in future. Andrew Bartlett (This used to be commit 514c91b16baca639bb04638042bf9894d881172a)
2001-10-31Fix up domain logons. Tested with NT4.Andrew Bartlett1-1/+1
(This used to be commit c8b2718adfe114b74a155116c5e74f014d6df887)
2001-10-31This is a farily large patch (3300 lines) and reworks most of the AuthRewriteAndrew Bartlett7-273/+868
code. In particular this assists tpot in some of his work, becouse it provides the connection between the authenticaion and the vuid generation. Major Changes: - Fully malloc'ed structures. - Massive rework of the code so that all structures are made and destroyed using malloc and free, rather than hanging around on the stack. - SAM_ACCOUNT unix uids and gids are now pointers to the same, to allow them to be declared 'invalid' without the chance that people might get ROOT by default. - kill off some of the "DOMAIN\user" lookups. These can be readded at a more appropriate place (probably domain_client_validate.c) in the future. They don't belong in session setups. - Massive introduction of DATA_BLOB structures, particularly for passwords. - Use NTLMSSP flags to tell the backend what its getting, rather than magic lenghths. - Fix winbind back up again, but tpot is redoing this soon anyway. - Abstract much of the work in srv_netlog_nt back into auth helper functions. This is a LARGE change, and any assistance is testing it is appriciated. Domain logons are still broken (as far as I can tell) but other functionality seems intact. Needs testing with a wide variety of MS clients. Andrew Bartlett (This used to be commit f70fb819b2f57bd57232b51808345e2319d52f6c)
2001-10-31Small 'const' updates ahead of some AuthRewrite merging.Andrew Bartlett1-5/+5
(This used to be commit 3b5e72bda3263c6bdf81dfface4fae4f06b71032)
2001-10-31Added some extra fields to the auth_serversupplied_info structure.Tim Potter1-1/+13
To obtain the full group membership of a user (i.e nested groups on a win2k native mode server) it is necessary to merge this list of groups with the groups returned by winbindd when creating an nt access token. This breaks winbindd linking while AB and I sync up our changes to the authentication subsystem. (This used to be commit 4eeb7bcd783d7cfb3ac232f1faa035773007401d)
2001-10-30Spnego on the 'server' end of security=server just does not work, so set theAndrew Bartlett1-0/+3
flags so we just do a 'normal' session setup. Also add some parinoia code to detect when sombody attempts to do a 'normal' session setup when spnego had been negoitiated. Andrew Bartlett (This used to be commit 190898586fa218c952fbd5bea56155d04e6f248b)
generated by cgit (git 2.34.1) at 2024-12-22 14:49:51 +0000