summaryrefslogtreecommitdiff
path: root/source3/groupdb/mapping.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r4724: Add support for Windows privileges in Samba 3.0Gerald Carter1-12/+1
(based on Simo's code in trunk). Rewritten with the following changes: * privilege set is based on a 32-bit mask instead of strings (plans are to extend this to a 64 or 128-bit mask before the next 3.0.11preX release). * Remove the privilege code from the passdb API (replication to come later) * Only support the minimum amount of privileges that make sense. * Rewrite the domain join checks to use the SeMachineAccountPrivilege instead of the 'is a member of "Domain Admins"?' check that started all this. Still todo: * Utilize the SePrintOperatorPrivilege in addition to the 'printer admin' parameter * Utilize the SeAddUserPrivilege for adding users and groups * Fix some of the hard coded _lsa_*() calls * Start work on enough of SAM replication to get privileges from one Samba DC to another. * Come up with some management tool for manipultaing privileges instead of user manager since it is buggy when run on a 2k client (haven't tried xp). Works ok on NT4. (This used to be commit 77c10ff9aa6414a31eece6dfec00793f190a9d6c)
2007-10-10r4088: Get medieval on our ass about malloc.... :-). Take control of all our ↵Jeremy Allison1-4/+4
allocation functions so we can funnel through some well known functions. Should help greatly with malloc checking. HEAD patch to follow. Jeremy. (This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)
2007-10-10r3566: Completely replace the queryuseraliases call. The previous ↵Volker Lendecke1-10/+25
implementation does not exactly match what you would expect. XP workstations during login actually do this, so we should better become a bit more correct. The LDAP query issued is not really fully optimal, but it is a lot faster and more correct than what was there before. The change in passdb.h makes it possible that queryuseraliases is done with a single ldap query. Volker (This used to be commit 2508d4ed1e16c268fc9f3676b0c6a122e070f93d)
2007-10-10r3561: Since we have tdb_reopen_all() after all forks, the local_pid logic ↵Volker Lendecke1-4/+1
is not correct anymore. If we actually open the tdb before the fork, we end up opening the tdb twice. Jerry, jra, this also happens in the locking and printing subsystems. You might want to check it there (not that it actually happens right now, but this gave me some confusion lately...). Volker (This used to be commit 40cad9dcc14ddec0ce74bb9010d13bd82e4d10af)
2007-10-10r2865: Add static and remove unused functions that only cload the blame-gameAndrew Bartlett1-122/+0
in finding out who is causing the massive performance problems with large LDAP directories. Andrew Bartlett (This used to be commit f16ed2616a67c412bc9b78354a5faf673e64cf42)
2007-10-10r2753: Workaround for the (rather broken) _samr_query_useraliases rpc-call.Günther Deschner1-14/+1
_samr_query_useraliases shows up with all kind of very weird memberships (global-groups, machine-accounts, etc.). Sometimes even if there is no alias-membership at all. One of the biggest mistakes is to convert any unix-group the user is a member of, into an alias by default in get_group_from_gid. get_alias_user_groups should be rewritten to use pdb_enum_alias_memberships. Guenther (This used to be commit 73ab2d2a74d3992167d9304dd41f60ad0805dd67)
2007-10-10r116: volker's patch for local group and group nestingGerald Carter1-1/+459
(This used to be commit b393469d9581f20e4d4c52633b952ee984cca36f)
2004-03-09Fix to debug message lacking termination with '\n'.Rafal Szczesniak1-12/+12
rafal (This used to be commit 2a7dd469430459d124cb48d516b82766a2a249bc)
2004-02-17When creating a group via a script, don't let winbind do it as well.Volker Lendecke1-3/+1
Volker (This used to be commit 6a229f1488c2f0935c24e223614e4c88b36d15c0)
2004-01-25Fix memleak just introduced. Thanks to abartlet :-)Volker Lendecke1-0/+1
Volker (This used to be commit be485eea81c6bab8067642c26e41a14652ce7ee6)
2004-01-25On my SuSE 8.2 (glibc 2.3.2) the getpwnam inside pdb_getsampwnam resetVolker Lendecke1-30/+43
the surrounding getpwent loop to the first entry. So smbd went into an endless loop. Volker (This used to be commit 1797b16fadd61ef1f30a1be950e3afe7a2e1d791)
2004-01-02JHT came up with a nasty (broken) torture case in preparing examples forAndrew Bartlett1-28/+63
his book. This prompted me to look at the code that reads the unix group list. This code did a lot of name -> uid -> name -> sid translations, which caused problems. Instead, we now do just name->sid I also cleaned up some interfaces, and client tools. Andrew Bartlett (This used to be commit f9e59f8bc06fae7e5c8cb0980947f78942dc25c0)
2003-12-10more group lookup access fixes on the neverending bug 281Gerald Carter1-5/+23
(This used to be commit 9359a6ea80d1228e87ea825a100a2d289c37162d)
2003-12-04* fix RemoveSidForeignDomain() ; bug 252Gerald Carter1-14/+16
* don't fall back to unmapped UNIX group for get_local_group_from_sid() * remove an extra become/unbecome_root() pair from group enumeration (This used to be commit da12bbdb0dd9179b1ed457fa009679e2da4a8440)
2003-11-24more access fixes for group enumeration in LDAP; bug 281Gerald Carter1-1/+7
(This used to be commit 68283407e0f366d8315f4be6caed67eb6fe84b85)
2003-08-15Fix syntax error!Tim Potter1-1/+1
(This used to be commit cd0b6f74baa01dbe43c29cdadf1505083cdc878f)
2003-08-15fix compile warnings on IRIXGerald Carter1-5/+29
(This used to be commit b9779ba590a62acac12fa268c0e9dbe054176ae4)
2003-07-22Fixup a bunch of printf-style functions and debugs to use unsigned long whenTim Potter1-1/+1
displaying pid_t, uid_t and gid_t values. This removes a whole lot of warnings on some of the 64-bit build farm machines as well as help us out when 64-bit uid/gid/pid values come along. (This used to be commit f93528ba007c8800a850678f35f499fb7360fb9a)
2003-07-16fixes for 'net rpc vampire'. I can now take a blank Samba hostGerald Carter1-18/+14
and migrate an NT4 domain and still logon from domain members (tested logon scripts, system policies, profiles, & home directories) (passdb backend = tdbsam) removed call to idmap_init_wellknown_sids() from winbindd.c since the local domain should be handled by the guest passdb backend (and you don't really always want the Administrator account to be root) ...and we didn't pay attention to this anyways now. (This used to be commit 837d7c54d3ca780160aa0d6a2f0a109bb691948e)
2003-07-15We should report if a group mapping fails. This should fix bug#225.Volker Lendecke1-3/+1
Jerry, this is assigned to you. Do you want to answer it? However, we have to decide what to do if a mapping is to be done for a unix group not in LDAP.... Volker (This used to be commit bf449d467cfe4987df17010490a16ab0472c0803)
2003-07-11moving more code around.Gerald Carter1-4/+2
* move rid allocation into IDMAP. See comments in _api_samr_create_user() * add winbind delete user/group functions I'm checking this in to sync up with everyone. But I'm going to split the add a separate winbindd_allocate_rid() function for systems that have an 'add user script' but need idmap to give them a RID. Life would be so much simplier without 'enable rid algorithm'. The current RID allocation is horrible due to this one fact. Tested idmap_tdb but not idmap_ldap yet. Will do that tomorrow. Nothing has changed in the way a samba domain is represented, stored, or search in the directory so things should be ok with previous installations. going to bed now. (This used to be commit 0463045cc7ff177fab44b25faffad5bf7140244d)
2003-07-09Large set of changes to add UNIX account/group managementGerald Carter1-56/+121
to winbindd. See README.idmap-and-winbind-changes for details. (This used to be commit 1111bc7b0c7165e1cdf8d90eb49f4c368d2eded6)
2003-07-04Fix memleak in groupdb. Spotted by MetzeAlexander Bokovoy1-1/+1
(This used to be commit 5280c6953195c2664628ecaab59ea82b4863e8f7)
2003-06-18Ok, this patch removes the privilege stuff we had in, unused, for some time.Simo Sorce1-510/+47
The code was nice, but put in the wrong place (group mapping) and not supported by most of the code, thus useless. We will put back most of the code when our infrastructure will be changed so that privileges actually really make sense to be set. This is a first patch of a set to enhance all our mapping code cleaness and stability towards a sane next beta for 3.0 code base Simo. (This used to be commit e341e7c49f8c17a9ee30ca3fab3aa0397c1f0c7e)
2003-06-18And some more memory leaks in mapping.c and pdb_tdb.c. tdb_nextkeyVolker Lendecke1-0/+2
mallocs its key, so we should free it after use. Volker (This used to be commit 9750799ba2e1aaa59fa255f23880c9c618195c3d)
2003-06-17And more other memory leaks. One new (idmap) and one ancient (groupdb).Volker Lendecke1-0/+4
Volker (This used to be commit 2392f460aeb11f32759e84faf1e7ace73c5db281)
2003-05-12And finally IDMAP in 3_0Simo Sorce1-11/+12
We really need idmap_ldap to have a good solution with ldapsam, porting it from the prvious code is beeing made, the code is really simple to do so I am confident it is not a problem to commit this code in. Not committing it would have been worst. I really would have been able to finish also the group code, maybe we can put it into a followin release after 3.0.0 even if it may be an upgrade problem. The code has been tested and seem to work right, more testing is needed for corner cases. Currently winbind pdc (working only for users and not for groups) is disabled as I was not able to make a complete group code replacement that works somewhat in a week (I have a complete patch, but there are bugs) Simo. (This used to be commit 0e58085978f984436815114a2ec347cf7899a89d)
2003-04-29don't implement any group mapping functions in the guest sam moduleGerald Carter1-0/+48
(This used to be commit a354bf4b7eadec3e6aa5f5547b58c7856fda3471)
2003-03-23The group mapping functions are not calledVolker Lendecke1-6/+6
directly anymore, but instead through the passdb interface. So we can make them static. Volker (This used to be commit 99da1119a7a7fc0879e63f7e11cb4500419359e8)
2003-03-22Thanks to volker, merge passdb changes from HEAD:Andrew Bartlett1-0/+55
- pdb_guest (including change defaults) - 'default' passdb actions (instead of 'not implemented' stubs in each module) - net_rpc_samsync no longer assumes pdb_unix Andrew Bartlett (This used to be commit 4bec53c8c81019f0f06a93c4df0800bbf7281dd6)
2003-02-18Check return code of string_to_sid. (Merge from HEAD)Martin Pool1-1/+5
(This used to be commit 5d09aea6f78aa247dbd77617c93c2a1dd2e2702f)
2003-01-03Merge from HEAD - make Samba compile with -Wwrite-strings without additionalAndrew Bartlett1-3/+3
warnings. (Adds a lot of const). Andrew Bartlett (This used to be commit 3a7458f9472432ef12c43008414925fd1ce8ea0c)
2002-11-23Lots of fixes for error paths where tdb_fetch() data need freeing.Jeremy Allison1-11/+18
Found via a post from Arcady Chernyak <Arcady.Chernyak@efi.com>. Jeremy. (This used to be commit 5d5762d1787db4392d2dff16024097c638b2d494)
2002-11-12Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison1-1/+1
dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit f755711df8f74f9b8e8c1a2b0d07d02a931eeb89)
2002-11-02Merge passdb from HEAD -> 3.0Andrew Bartlett1-5/+5
The work here includes: - metze' set/changed patch, which avoids making changes to ldap on unmodified attributes. - volker's group mapping in passdb patch - volker's samsync stuff - volkers SAMR changes. - mezte's connection caching patch - my recent changes (fix magic root check, ldap ssl) Andrew Bartlett (This used to be commit 2044d60bbe0043cdbb9aba931115672bde975d2f)
2002-10-04Add a timeout to tdb_lock_bystring(). Ensure we never have more thanJeremy Allison1-1/+1
MAX_PRINT_JOBS in a queue. Jeremy. (This used to be commit 9fe3c0b90d4bff2217e3cb5a34b4683ca314c06e)
2002-09-25sync'ing up for 3.0alpha20 releaseGerald Carter1-5/+49
(This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-07-15updated the 3.0 branch from the head branch - ready for alpha18Andrew Tridgell1-7/+5
(This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-29Since we have dynamic initialisation in the group mapping code, makeTim Potter1-72/+94
init_group_mapping() a static function and don't call it from any client programs. Not sure whether I've made a bigger mess here or not... (This used to be commit 3c887d9021269aaa9fc0bc771af8589077e6208e)
2002-01-27Patch from Kevin Stefanik <kstef@mtppi.org> to do some more error checking forAndrew Bartlett1-6/+24
group mapping init failures. (This used to be commit cd6a2dad4e3092a19f784b6548fce49ecd8bb549)
2002-01-17A nice *big* change to the fundemental way we do things.Andrew Bartlett1-1/+2
Samba (ab)uses the returns from getpwnam() a lot - in particular it keeps them around for a long time - often past the next call... This adds a getpwnam_alloc and a getpwuid_alloc to the collection. These function as expected, returning a malloced structure that can be free()ed with passwd_free(&passwd). This patch also cuts down on the number of calls to getpwnam - mostly by taking advantage of the fact that the passdb interface is already case-insensiteve. With this patch most of the recursive cases have been removed (that I know of) and the problems are reduced further by not using the sys_ interface in the new code. This means that pointers to the cache won't be affected. (This is a tempoary HACK, I intend to kill the password cache entirly). The only change I'm a little worried about is the change to rpc_server/srv_samr_nt.c for private groups. In this case we are getting groups from the new group mapping DB. Do we still need to check for private groups? I've toned down the check to a case sensitve match with the new code, but we might be able to kill it entirly. I've also added a make_modifyable_passwd() function, that copies a passwd struct into the form that the old sys_getpw* code provided. As far as I can tell this is only actually used in the pass_check.c crazies, where I moved the final 'special case' for shadow passwords (out of _Get_Pwnam()). The matching case for getpwent() is dealt with already, in lib/util_getent.c Also included in here is a small change to register the [homes] share at vuid creation rather than just in one varient of the session setup. (This picks up the SPNEGO cases). The home directory is now stored on the vuid, and I am hoping this might provide a saner way to do %H substitions. TODO: Kill off remaining Get_Pwnam_Modify calls (they are not needed), change the remaining sys_getpwnam() callers to use getpwnam_alloc() and move Get_Pwnam to return an allocated struct. Andrew Bartlett (This used to be commit 1d86c7f94230bc53daebd4d2cd829da6292e05da)
2002-01-13don't try to allocate zero bytesAndrew Tridgell1-10/+7
(This used to be commit d09616da6823b69a03a8a008987c4eb02ca0061b)
2002-01-09When re-writing tdb version numbers as little endian int32, we mustJeremy Allison1-6/+8
change the version number also. Jeremy. (This used to be commit 3dec9cf99a82bd15626eb99e7d937ff00183cc05)
2002-01-09Fixed all uses of tdb_fetch/store/_int to use explicit int32 little endianJeremy Allison1-5/+18
in tdb's. All except winbindd_idmap.... Hmmmmmm. Jeremy. (This used to be commit ec71f1732b6b27bd2d65b250a6f3720a235dc38d)
2002-01-03Fixed nasty cast of tdb_delete in traversals.Jeremy Allison1-1/+1
Jeremy. (This used to be commit a0cdec3acc82d1ce0292fadd4b8dac23638450f3)
2002-01-02Actually enforce the passdb API.Andrew Bartlett1-1/+1
Thou shalt not reference SAM_ACCOUNT members directly - always use pdb_get/pdb_set. This is achived by making the whole of SAM_ACCOUNT have a .private member, where the real members live. This caught a pile of examples, and these have beeen fixed. The pdb_get..() functions are 'const' (have been for some time) and this required a few small changes to constify other functions. I've also added some debugs to the pdb get and set, they can be removed if requested. I've rewritten the copy_id2x_to_sam_pass() functions to use the new passdb interface, but I need the flags info to do it properly. The pdb_free_sam() funciton now blanks out the LM and NT hashes, and as such I have removed many extra 'samr_clear_sam_passwd(smbpass)' calls as a result. Finally, any and all testing is always appriciated - but the basics seem to work. Andrew Bartlett (This used to be commit d3dd28f6c443187b8d820d5a39c7c5b3be2fa95c)
2001-12-04added a boolean to the group mapping functions to specify if we need orJean-François Micouleau1-27/+69
not the privileges. Usually we don't need them, so the memory is free early. lib/util_sid.c: added some helper functions to check an SID. passdb/passdb.c: renamed local_lookup_rid() to local_lookup_sid() and pass an RID all the way. If the group doesn't exist on the domain SID, don't return a faked one as it can collide with a builtin one. Some rpc structures have been badly designed, they return only rids and force the client to do subsequent lsa_lookup_sid() on the domain sid and the builtin sid ! rpc_server/srv_util.c: wrote a new version of get_domain_user_groups(). Only the samr code uses it atm. It uses the group mapping code instead of a bloody hard coded crap. The netlogon code will use it too, but I have to do some test first. J.F. (This used to be commit 6c87e96149101995b7d049657d5c26eefef37d8c)
2001-12-03added a tdb to store the account policy informations.Jean-François Micouleau1-0/+3
You can change them with either usermanager->policies->account or from a command prompt on NT/W2K: net accounts /domain we can add a rpc accounts to the net command. As the net_rpc.c is still empty, I did not start. How should I add command to it ? Should I take the rpcclient/cmd_xxx functions and call them from there ? alse changed the SAM_UNK_INFO_3 parser, it's an NTTIME. This one is more for jeremy ;-) J.F. (This used to be commit bc28a8eebd9245ce3004ae4b1a359db51f77bf21)
2001-12-03init group db before useAndrew Tridgell1-0/+12
this fixes the smbpasswd segvs (This used to be commit d2bcdfd995b9562872d865e723b23ed84247a73f)
generated by cgit (git 2.34.1) at 2024-12-15 04:07:24 +0000