samba - Unnamed repository; edit this file 'description' to name the repository.

Age	Commit message (Collapse)	Author	Files	Lines
2003-02-15	Antti Andreimann <Antti.Andreimann@mail.ee> has done some changes to enable	Andrew Bartlett	1	-1/+6
	users w/o full administrative access on computer accounts to join a computer into AD domain. The patch and detailed changelog is available at: http://www.itcollege.ee/~aandreim/samba This is a list of changes in general: 1. When creating machine account do not fail if SD cannot be changed. setting SD is not mandatory and join will work perfectly without it. 2. Implement KPASSWD CHANGEPW protocol for changing trust password so machine account does not need to have reset password right for itself. 3. Command line utilities no longer interfere with user's existing kerberos ticket cache. 4. Command line utilities can do kerberos authentication even if username is specified (-U). Initial TGT will be requested in this case. I've modified the patch to share the kinit code, rather than copying it, and updated it to current CVS. The other change included in the original patch (local realms) has been left out for now. Andrew Bartlett (This used to be commit ce52f1c2ed4d3ddafe8ae6258c90b90fa434fe43)
2002-11-12	Removed global_myworkgroup, global_myname, global_myscope. Added liberal	Jeremy Allison	1	-2/+1
	dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit 82b8f749a36b42e22186297482aad2abb04fab8a)
2002-11-10	make sure that if kerberos fails we can fall back on NTLMSSP for SASL	Andrew Tridgell	1	-2/+5
	(This used to be commit 69dba08c40c9739137b4f01d38be5228edc6dd6e)
2002-10-31	Re-enable use of existing kerberos tickets.	Jim McDonough	1	-2/+6
	(This used to be commit 6ec5dce69834e72e458a8acff7d1790cbdd46d67)
2002-09-28	Try to compile as much as possible with only ldap, but not kerberos.	Andrew Bartlett	1	-1/+3
	(This used to be commit 9615ab10c006d8027f6a8b7dd3770eb77304dbdc)
2002-09-25	Avoid a segfault in net join when you have not done an kinit, and it's falling	Andrew Bartlett	1	-0/+5
	back to NTLMSSP. We need to get the password out of the user, and this eventually does. Andrew Bartlett (This used to be commit bb518a3bae3bf91a589021fcc5b1e715247c5ded)
2002-09-17	Add clock skew handling to our kerberos code. This allows us to cope with	Andrew Tridgell	1	-3/+4
	the DC being out of sync with the local machine. (This used to be commit 0d28d769472ea3b98ae4c8757093dfd4499f6dd1)
2002-08-30	convert the LDAP/SASL code to use GSS-SPNEGO if possible	Andrew Tridgell	1	-28/+220
	we now do this: - look for suported SASL mechanisms on the LDAP server - choose GSS-SPNEGO if possible - within GSS-SPNEGO choose KRB5 if we can do a kinit - otherwise use NTLMSSP This change also means that we no longer rely on having a gssapi library to do ADS. todo: - add TLS/SSL support over LDAP - change to using LDAP/SSL for password change in ADS (This used to be commit b04e91f660d3b26d23044075d4a7e707eb41462d)
2002-08-05	This fixes a number of ADS problems, particularly with netbiosless	Andrew Tridgell	1	-4/+5
	setups. - split up the ads structure into logical pieces. This makes it much easier to keep things like the authentication realm and the server realm separate (they can be different). - allow ads callers to specify that no sasl bind should be performed (used by "net ads info" for example) - fix an error with handing ADS_ERROR_SYSTEM() when errno is 0 - completely rewrote the code for finding the LDAP server. Now try DNS methods first, and try all DNS servers returned from the SRV DNS query, sorted by closeness to our interfaces (using the same sort code as we use in replies from WINS servers). This allows us to cope with ADS DCs that are down, and ensures we don't pick one that is on the other side of the country unless absolutely necessary. - recognise dnsRecords as binary when displaying them - cope with the realm not being configured in smb.conf (work it out from the LDAP server) - look at the trustDirection when looking up trusted domains and don't include trusts that trust our domains but we don't trust theirs. - use LDAP to query the alternate (netbios) name for a realm, and make sure that both and long and short forms of the name are accepted by winbindd. Use the short form by default for listing users/groups. - rescan the list of trusted domains every 5 minutes in case new trust relationships are added while winbindd is running - include transient trust relationships (ie. C trusts B, B trusts A, so C trusts A) in winbindd. - don't do a gratuituous node status lookup when finding an ADS DC (we don't need it and it could fail) - remove unused sid_to_distinguished_name function - make sure we find the allternate name of our primary domain when operating with a netbiosless ADS DC (using LDAP to do the lookup) - fixed the rpc trusted domain enumeration to support up to approx 2000 trusted domains (the old limit was 3) - use the IP for the remote_machine (%m) macro when the client doesn't supply us with a name via a netbios session request (eg. port 445) - if the client uses SPNEGO then use the machine name from the SPNEGO auth packet for remote_machine (%m) macro - add new 'net ads workgroup' command to find the netbios workgroup name for a realm (This used to be commit e358d7b24c86a46d8c361b9e32a25d4f71a6dc00)
2002-07-08	Fix length in snprintf invocation to account for "dn:" in sasl gssapi bind.	Jim McDonough	1	-2/+1
	Also remove unused line which incremented pointer by the wrong length anyway. Provided by Anthony Liguori (aliguori@us.ibm.com). (This used to be commit 47b7a3e0f3d101a3bcffd33db6ef4c0672b57ae0)
2002-01-30	Removed version number from file header.	Tim Potter	1	-2/+1
	Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2001-12-19	much better ADS error handling system	Andrew Tridgell	1	-21/+33
	(This used to be commit 05a90a28843e0d69183a49a76617c5f32817df16)
2001-12-19	- added initial support for trusted domains in winbindd_ads	Andrew Tridgell	1	-17/+36
	- gss error code patch from a.bokovoy@sam-solutions.net - better sid dumping in ads_dump - fixed help in wbinfo (This used to be commit ee1c3e1f044b4ef62169ad74c5cac40eef81bfda)
2001-12-08	added internal sasl/gssapi code. This means we are no longer dependent on ↵	Andrew Tridgell	1	-0/+186
	cyrus-sasl which makes the code much less fragile. Also added code to auto-determine the server name or realm (This used to be commit 435fdf276a79c2a517adcd7726933aeef3fa924b)