summaryrefslogtreecommitdiff
path: root/source3/auth
AgeCommit message (Collapse)AuthorFilesLines
2004-02-21Add calls to password lockout functions. Should now work against tdbsam only.Jim McDonough1-0/+38
(This used to be commit 3e8a9c3584ff2a3c2e120c97569676ac45ec8e59)
2004-02-02Remove bogus check. No functional change, just cosmetics.Volker Lendecke1-5/+0
Volker (This used to be commit e3a5e2d9c23e8ba6bc817e433e596f535644c862)
2004-01-15BUG 936: fix bind credentials for schannel binds in smbd (and add a comment ↵Gerald Carter1-4/+9
to winbindd_cm about this (This used to be commit 5134c6bcbc5180431e95a30559c453f3744fd427)
2004-01-07Doxygen comment fix.Rafal Szczesniak1-2/+5
rafal (This used to be commit b5e492b8eaf7cefe185d44b6c708f96ff61bd27b)
2004-01-05Change our Domain controller lookup routines to more carefully seperateAndrew Bartlett1-2/+5
DNS names (realms) from NetBIOS domain names. Until now, we would experience delays as we broadcast lookups for DNS names onto the local network segments. Now if DNS comes back negative, we fall straight back to looking up the short name. Andrew Bartlett (This used to be commit 32397c8b01f1dec7b05140d210bb32f836a80ca6)
2003-12-31auth/auth_util.c:Andrew Bartlett1-1/+1
- Fill in the 'backup' idea of a domain, if the DC didn't supply one. This doesn't seem to occour in reality, hence why we missed the typo. lib/charcnv.c: lib/smbldap.c: libads/ldap.c: libsmb/libsmbclient.c: printing/nt_printing.c: - all the callers to pull_utf8_allocate() pass a char ** as the first parammeter, so don't make them all cast it to a void ** nsswitch/winbind_util.c: - Allow for a more 'correct' view of when usernames should be qualified in winbindd. If we are a PDC, or have 'winbind trusted domains only', then for the authentication returns stip the domain portion. - Fix valgrind warning about use of free()ed name when looking up our local domain. lp_workgroup() is maniplated inside a procedure that uses it's former value. Instead, use the fact that our local domain is always the first in the list. Andrew Bartlett (This used to be commit 494781f628683d6e68e8ba21ae54f738727e8c21)
2003-12-30Move our basic password checking code from inside the authenticationAndrew Bartlett1-345/+1
subsystem into a seperate file - ntlm_check.c. This allows us to call these routines from ntlm_auth. The purpose of this exercise is to allow ntlm_auth (when operating as an NTLMSSP server) to avoid talking to winbind. This should allow for easier debugging. ntlm_auth itself has been reorgainised, so as to share more code between the SPNEGO-wrapped and 'raw' NTLMSSP modes. A new 'client' NTLMSSP mode has been added, for use with a Cyrus-SASL module I am writing (based on vl's work) Andrew Bartlett (This used to be commit 48315e8fd227978e0161be293ad4411b45e3ea5b)
2003-12-30Refactor our authentication and authentication testing code.Andrew Bartlett1-148/+219
The next move will be to remove our password checking code from the SAM authentication backend, and into a file where other parts of samba can use it. The ntlm_auth changes provide for better use of common code. Andrew Bartlett (This used to be commit 2375abfa0077a884248c84614d5109f57dfdf5b1)
2003-12-19* add a few useful debug linesGerald Carter2-9/+30
* fix bug involving Win9x clients. Make sure we save the right case for the located username in fill_sam_account() (This used to be commit 850e4be29e185ebe890f094372aa8c2cc86de76a)
2003-12-09Final part of fix for #445. Don't add user for machine accounts.Jeremy Allison1-0/+4
Jeremy. (This used to be commit 3684cffbd269389d14b37edd5959e29912c13a60)
2003-12-06Fix for bug #445 (missing unix user on kerberos auth doesn't call add userJeremy Allison1-3/+13
script). Jeremy. (This used to be commit 5d9f06bdae4e7b878a87fb97367cf10afbc5f6b2)
2003-11-23Patch by emil@disksites.com <Emil Rasamat> to ensure we always alwaysAndrew Bartlett2-2/+15
free() each auth method. (We had relied on the use of talloc() only, despite providing the free() callback) Andrew Bartlett (This used to be commit 5872c0e26e3407c7c1dcf2074a36896a3ca1325a)
2003-11-22Changes all over the shop, but all towards:Andrew Bartlett4-30/+142
- NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... (This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
2003-11-10Patch from Andrew Bartlett <abartlet@samba.org> for security=server coreJeremy Allison1-6/+8
dump if server goes away. Jeremy. (This used to be commit e61324cc6a222ca714530827068104f7a74c0911)
2003-11-09Skip over the winbind separator when looking up a user.Volker Lendecke1-0/+1
Volker (This used to be commit 6b457d0c5c1a18b6e09c2c4cc489ce791aac3c6b)
2003-11-06run krb5 logins through the username map if the winbindd lookup fails; bug 698Gerald Carter1-4/+9
(This used to be commit efe257bce2020e94d00946a27e2e586c82a1480f)
2003-10-24Andrew Bartlett patch to cope with Exchange 5.5 cleartext pop password auth.Jeremy Allison1-0/+16
Jeremy. (This used to be commit 46e66ee950eee035ad008c189cd2378f734af605)
2003-10-22Put strcasecmp/strncasecmp on the banned list (except for needed callsJeremy Allison1-1/+1
in iconv.c and nsswitch/). Using them means you're not thinking about multibyte at all and I really want to discourage that. Jeremy. (This used to be commit d7e35dfb9283d560d0ed2ab231f36ed92767dace)
2003-10-20more 2.2.x compatibility fixes - allow user looksup in the kerb5Gerald Carter1-1/+25
sesssetup to fall back to 'user' instaed of failing is REA.LM\user doesn't exist. also fix include line in smb_acls.h as requested by metze (This used to be commit 62ed2598b3441b3c198872df8eb55e594332807b)
2003-10-07make sure to call get_user_groups() with the full winbindd name for a user ↵Gerald Carter2-11/+22
if he;she has one; bug 406 (This used to be commit 1737b36e9193e30285c598ad75d90f610bab47fe)
2003-09-08Tidy up some formatting. Get ready for allowing bad password lockout. (basedJeremy Allison1-49/+38
on a patch posted from Richard Renard <rrenard@idealx.com>. Jeremy. (This used to be commit abf54b58e95a949cb883d4485853dc560489c03f)
2003-09-05More tuning from cachegrind. Change most trim_string() calls to trim_char(0,Jeremy Allison3-7/+7
as that's what they do. Fix string_replace() to fast-path ascii. Jeremy. (This used to be commit f35e9a8b909d3c74be47083ccc4a4e91a14938db)
2003-08-28Fix bug found by tridge in 2.2.x. Ensure that %U substitution isJeremy Allison1-3/+0
restored on next valid packet if a logon fails. This has relevence if people are using su.exe within logon scripts ! Jeremy. (This used to be commit d405a93a9d3f9a1d93bb3289b00683fba3160bbe)
2003-08-15get rid of more compiler warningsHerb Lewis3-4/+4
(This used to be commit 398bd14fc6e2f8ab2f34211270e179b8928a6669)
2003-08-09fix for BUG #267 (problem with supplementary groups).Gerald Carter1-42/+76
Use winbindd to get the group list if possible since we already know it from netsamlogon_cache.tdb. More effecient than letting libc call getgrent() to get seconary groups. Tested by Ken Cross. (This used to be commit 3c537c906f29a08e75895c8c8e3ed5c5abaaa940)
2003-08-08need to be able to connect to a domain member as a local account; don't ↵Gerald Carter1-3/+3
always map to the domain name (This used to be commit 20b6e64da2669e5dfc7265cae331ec9c89aa02dc)
2003-07-30Add a command line option (-S on|off|required) to enable signing on clientJeremy Allison1-1/+1
connections. Overrides smb.conf parameter if set. Jeremy. (This used to be commit 879309671df6b530e0bff69559422a417da4a307)
2003-07-26Correctly detect an "add user script" - check that *lp_adduser_script() != '\0',Jeremy Allison1-1/+1
not lp_adduser_script() != NULL. Jeremy. (This used to be commit 2eac65ebe7147b36a34e0ca1c3f455f559ab0361)
2003-07-25More printf portability fixes. Got caught out by some gcc'isms lastTim Potter2-9/+9
time. )-: (This used to be commit 59dae1da66a5eb7e128263bd578f167d8746e9f0)
2003-07-24More printf fixes - size_t is long on some architectures.Tim Potter2-7/+7
(This used to be commit ba4d334b822248d8ab929c9568533431603d967e)
2003-07-24Server side NTLM signing works - until the first async packet. Working on thisJeremy Allison1-1/+0
next.... Jeremy. (This used to be commit eff74a1fcc597497a4c70589a44c1b70e93ab549)
2003-07-23convert snprintf() calls using pstrings & fstringsGerald Carter1-1/+1
to pstr_sprintf() and fstr_sprintf() to try to standardize. lots of snprintf() calls were using len-1; some were using len. At least this helps to be consistent. (This used to be commit 9f835b85dd38cbe655eb19021ff763f31886ac00)
2003-07-18Fix memleakVolker Lendecke1-1/+1
(This used to be commit 228fe54f0d65b895bef9e095ad996a48edf964df)
2003-07-11Fix a small typo in a comment and pretty it up a bit.Richard Sharpe1-1/+1
(This used to be commit 3b5ddd8e1f021f6a38434c0d9a47317ab6ff2614)
2003-07-11moving more code around.Gerald Carter1-1/+5
* move rid allocation into IDMAP. See comments in _api_samr_create_user() * add winbind delete user/group functions I'm checking this in to sync up with everyone. But I'm going to split the add a separate winbindd_allocate_rid() function for systems that have an 'add user script' but need idmap to give them a RID. Life would be so much simplier without 'enable rid algorithm'. The current RID allocation is horrible due to this one fact. Tested idmap_tdb but not idmap_ldap yet. Will do that tomorrow. Nothing has changed in the way a samba domain is represented, stored, or search in the directory so things should be ok with previous installations. going to bed now. (This used to be commit 0463045cc7ff177fab44b25faffad5bf7140244d)
2003-07-09Large set of changes to add UNIX account/group managementGerald Carter1-3/+10
to winbindd. See README.idmap-and-winbind-changes for details. (This used to be commit 1111bc7b0c7165e1cdf8d90eb49f4c368d2eded6)
2003-07-08standlone servers don't have any trusted domainsGerald Carter1-0/+5
(This used to be commit 4acdfc5c944aa8830d6cec7bd1225200448e45c5)
2003-07-08fix bone head mistake when setting the uid in the server_info struct.Gerald Carter1-11/+3
(This used to be commit 43f21078ec0f885d4d1a0b90476b55f8f92de9e7)
2003-07-08Initialise the uid and gid values to a safe default in make_server_info()Tim Potter1-0/+8
(This used to be commit 3a1f4f5ea5379b0deb6dc6b8ed81dedc3a08f70e)
2003-07-08fix temporary bug so people can test 3.0 again; make sure to initialize the ↵Gerald Carter1-1/+2
uid for the server_info struct (This used to be commit 6a84297da53e8658f4bcfa4951ceed011b69201f)
2003-07-08Spelling.Tim Potter1-1/+1
(This used to be commit a9a3339b2d99dcb64b675b27255d4aa5959a1caf)
2003-07-07temporarily disable a sanity check to prevent winbindd from deadlockingGerald Carter1-1/+3
on a Samba PDC. Will be re-enabled after winbind_passdb is done. (This used to be commit c4762aa3bc0d5d2dc5161b543b22808a369e0698)
2003-07-07and so it begins....Gerald Carter2-49/+18
* remove idmap_XX_to_XX calls from smbd. Move back to the the winbind_XXX and local_XXX calls used in 2.2 * all uid/gid allocation must involve winbindd now * move flags field around in winbindd_request struct * add WBFLAG_QUERY_ONLY option to winbindd_sid_to_[ug]id() to prevent automatic allocation for unknown SIDs * add 'winbind trusted domains only' parameter to force a domain member server to use matching users names from /etc/passwd for its domain (needed for domain member of a Samba domain) * rename 'idmap only' to 'enable rid algorithm' for better clarity (defaults to "yes") code has been tested on * domain member of native mode 2k domain * ads domain member of native mode 2k domain * domain member of NT4 domain * domain member of Samba domain * Samba PDC running winbindd with trusts Logons tested using 2k clients and smbclient as domain users and trusted users. Tested both 'winbind trusted domains only = [yes|no]' This will be a long week of changes. The next item on the list is winbindd_passdb.c & machine trust accounts not in /etc/passwd (done via winbindd_passdb) (This used to be commit 8266dffab4aedba12a33289ff32880037ce950a8)
2003-07-06This changes our Unix primary GID behaviour back to what most people expect:Andrew Bartlett1-6/+2
Samba will now use the user's UNIX primary group, as the primary group when dealing with the filesystem. The NT primary group is ignored in unix. For the NT_TOKEN, the primary group is the NT priamry group, and the unix primary group is added to the NT_TOKEN as a supplementary group. This should fix bug #109, but will need to be revisited when we get a full NT group database. Also in this commit: - Fix debug statements in service.c - Make idmap_ldap show if it's adding, or modifying an existing DN - Make idmap_ldap show both the error message and error string (This used to be commit 32e455a714b2090fcfd1f6d73daccf600c15d51b)
2003-07-05Add some debug statments to our vampire code - try to make it easier to trackAndrew Bartlett1-2/+8
down failures. Add a 'auto-add on modify' feature to guestsam Fix some segfault bugs on no-op idmap modifications, and on new idmappings that do not have a DN to tack onto. Make the 'private data' a bit more robust. Andrew Bartlett (This used to be commit 6c48309cda9538da5a32f3d88a7bb9c413ae9e8e)
2003-07-05PAM should operate on the Unix username, not the NT username (which might notAndrew Bartlett1-6/+6
have the domain\ qualification). Andrew Bartlett (This used to be commit 7cfa1e7c4abee10fe8c75e36aee68ee9f557656e)
2003-07-04Fixed strlower changes I missed. Pointed out by metze.Jeremy Allison1-2/+2
Jeremy (This used to be commit da5ee2b765fc321b14e92eb27bde8ec8930b61d4)
2003-07-03Removed strupper/strlower macros that automatically map to ↵Jeremy Allison3-6/+5
strupper_m/strlower_m. I really want people to think about when they're using multibyte strings. Jeremy. (This used to be commit ff222716a08af65d26ad842ce4c2841cc6540959)
2003-07-03This patch takes the work the jerry did for beta2, and generalises it:Andrew Bartlett7-44/+92
- The 'not implmented' checks are now done by all auth modules - the ntdomain/trustdomain/winbind modules are more presise as to what domain names they can and cannot handle - The become_root() calls are now around the winbind pipe opening only, not the entire auth call - The unix username is kept seperate from the NT username, removing the need for 'clean off the domain\' in parse_net.c - All sid->uid translations are now validated with getpwuid() to put a very basic stop to logins with 'half deleted' accounts. Andrew Bartlett (This used to be commit 85f88191b9927cc434645ef4c1eaf5ec0e8af2ec)
2003-07-01* fixed volker's wbinfo -a lockup again. This one was my fault.Gerald Carter1-1/+44
It was caused by the winbind_ping() call in is_trusted_domain() o if we are a DC then we check our own direct trust relationships we have to rely on winbindd to update the truatdom_cache o if we are a domain member, then we can update the trustdom_cache ourselves if winbindd is not there (This used to be commit 22dfcafb37f7109dc455f4fb6323a25ba4f097bc)
generated by cgit (git 2.34.1) at 2024-07-17 12:16:52 +0000