Age | Commit message (Collapse) | Author | Files | Lines |
|
For the winbind cached ADS LDAP connection handling
(ads_cached_connection()) we were (incorrectly) assuming that the
service ticket lifetime equaled the tgt lifetime. For setups where the
service ticket just lives 10 minutes, we were leaving hundreds of LDAP
connections in CLOSE_WAIT state, until we fail to service entirely with
"Too many open files".
Also sequence_number() in winbindd_ads.c needs to delete the cached LDAP
connection after the ads_do_search_retry() has failed to submit the
search request (although the bind succeeded (returning an expired
service ticket that we cannot delete from the memory cred cache - this
will get fixed later)).
Guenther
(This used to be commit 7e1a84b7226fb8dcd5d34c64a3478a6d886a9a91)
|
|
Guenther
(This used to be commit 4df582fa1049afe96bbee7e8cab93cfa82208ba3)
|
|
Guenther
(This used to be commit ea38e1f8362d75e7ac058a7c4aa06f1ca92ec108)
|
|
as this is causing the WRONG_PASSWORD error in the SetUserInfo()
call during net ads join).
We are now back to always list RC4-HMAC first if supported by
the krb5 libraries.
(This used to be commit 4fb57bce87588ac4898588ea4988eadff3a7f435)
|
|
Guenther
(This used to be commit 4e622572eb7939c6aa8e99fd9595bf28836bd5a3)
|
|
Guenther
(This used to be commit fb5830f87a16dbec16893348080bcdfc61e27ab0)
|
|
This allows a provider to supply the homedirectory, etc...
attributes for a user without requiring support in core
winbindd code. The idmap_ad.c module has been modified
to provide the idmap 'ad' library as well as the rfc2307 and sfu
"winbind nss info" support.
The SID/id mapping is working in idmap_ad but the nss_info
still has a few quirks that I'm in the process of resolving.
(This used to be commit aaec0115e2c96935499052d9a637a20c6445986e)
|
|
close Guenther, then you forgot to use "key" :-) :-).
Jeremy.
(This used to be commit 56842b59d00d531b0c9c22639603dc721eab50b4)
|
|
the stored client sitename with the sitename from each sucessfull CLDAP
connection.
Guenther
(This used to be commit 6a13e878b5d299cb3b3d7cb33ee0d51089d9228d)
|
|
less DNS query. This speeds up offline detection slightly.
Guenther
(This used to be commit eda76ecf07a4d2f9bb5544e2c031cfad14d93e85)
|
|
ask for the list of DCs twice.
Guenther
(This used to be commit a9baf27e1348dd6dadd7a2fafdf9c269087b80ac)
|
|
site support in a network where many DC's are down.
I heard via Volker there is still a bug w.r.t the
wrong site being chosen with trusted domains but
we'll have to layer that fix on top of this.
Gd - complain if this doesn't work for you.
Jeremy.
(This used to be commit 97e248f89ac6548274f03f2ae7583a255da5ddb3)
|
|
non-existing krb5 credential cache should not generate an error.
Guenther
(This used to be commit 11c6f573af5c1d3387e60f3fc44b00e28cd87813)
|
|
(This used to be commit 86e6ae6a9fe2a6fdaeeb503653a312662c7f50e9)
|
|
so apps will know which one to look for,
(This used to be commit d4a5dc3ad5f56a5f741424ecc4fffa0ef39bdc67)
|
|
As discussed with jerry at the CIFS conf: overriding the
administrator's wishes from the krb5.conf has only every given me
segfaults. We suggest leaving this up to the defaults from the
libraries anyway.
Andrew Bartlett
(This used to be commit 0b72c04906b1c25e80b217a8f34fd3a8e756b9ca)
|
|
This gives much nicer error messages when failing to join due to clock
skew.
Guenther
(This used to be commit 5c5a7611029ff1b630c53d4660578e188acf97f5)
|
|
* Fix DNS updates for multi-homed hosts
* Child domains often don't have an NS record in
DNS so we have to fall back to looking up the the NS
records for the forest root.
* Fix compile warning caused by mismatched 'struct in_addr'
and 'in_addr_t' parameters called to DoDNSUpdate()
(This used to be commit 3486acd3c3ebefae8f98dcc72d1c3d6b06fffcc7)
|
|
inside the #ifdef HAVE_KRB5
(This used to be commit c6cdf76c5809b4a4b145acb7dd4a695aaf7fcd28)
|
|
Volker
(This used to be commit b7dc9b81696aa5434419c5378a47b41c6dee3dfa)
|
|
Directory:
When having DC-less sites, AD assigns DCs from other sites to that site
that does not have it's own DC. The most reliable way for us to identify
the nearest DC - in that and all other cases - is the closest_dc flag in
the CLDAP reply.
Guenther
(This used to be commit ff004f7284cb047e738ba3d3ad6602e8aa84e883)
|
|
<david.hu@hp.com>. Fixes #4212.
Guenther
(This used to be commit 4ec896cdbe441b17d91895a50ac9be61efe2f9c1)
|
|
along with some memleaks.
Guenther
(This used to be commit 4bad52c5b3a983418d4216a2c3f5e04926e37e94)
|
|
Guenther
(This used to be commit 61ebedc82ee7d7a98e2a52b0677d723a801ab30f)
|
|
statement.
Guenther
(This used to be commit 62928734b820f512f940c1ed79048e14b322d060)
|
|
does not exist.
Guenther
(This used to be commit 359315021df3a4dbfe5142e529e3efdbc49e405c)
|
|
Guenther
(This used to be commit 1308a842716bc3bd1a9853b9b206dc7308a8c1dd)
|
|
Guenther
(This used to be commit 7579a91f81a43f570987fecca03c19f559887685)
|
|
Guenther
(This used to be commit ecb632a1534d5178602b9143bb17712559fe2e4f)
|
|
Guenther
(This used to be commit e7cae9bbae2848ca1088a822883563062dd3f612)
|
|
Guenther
(This used to be commit 7df5808d8b1d9458dbd47b92750c0b128325335c)
|
|
the first is to not enable the ldap ldb backend just yet. This will
need configure tests to conditionally include. We should be able to
use the m4 files from lib/ldb/
The 2nd is to fix libads/gpo.o not to publicly prototype a function
that needs ldap.h
(This used to be commit 1cf17edc14ebd379b982b589a66e86316ef7087b)
|
|
Guenther
(This used to be commit 40a6169aceb51dc7f73ae72ebac2e55c6b1edc3f)
|
|
Guenther
(This used to be commit cdc81927dbbc542500211ad8e6815815d7764731)
|
|
Guenther
(This used to be commit a0aedee1c90af163210dd459603dd5dffb73e132)
|
|
Guenther
(This used to be commit 927cda5d31e9cb02105df3cfc06f5cb273233747)
|
|
Guenther
(This used to be commit b70ed9e48394ddeaf0102e017cf706ff083e065b)
|
|
descriptor
buffers.
Make security access masks simply a uint32 rather than a structure
with a uint32 in it.
(This used to be commit b41c52b9db5fc4a553b20a7a5a051a4afced9366)
|
|
Guenther
(This used to be commit 2fc63fb8f7927ea61c565801b4c6308d3a4afcd1)
|
|
Jeremy.
(This used to be commit e568271af2b5c20cff70b72b8ab4b1b704122b40)
|
|
for anonymous bound connections.
When doing anonymous bind you can never use paged LDAP control for
RootDSE searches on AD.
Guenther
(This used to be commit dc1d92faabd4b291f607eb481349ba37e52ef11e)
|
|
Jeremy.
(This used to be commit 03e1078b459531af5a2336b584b3c886c5dd1e29)
|
|
Guenther
(This used to be commit 398f368c8a2df36d522583c733f7c22cac2f2059)
|
|
Guenther
(This used to be commit 8bb6e82f02044a715dbeee020bcc4a01a83c4a64)
|
|
Jeremy.
(This used to be commit f8984fa8b706bb76559e447b30a201e1cc2871b6)
|
|
(This used to be commit 1398425067d77d90ecf2ed4c17a12d643f7f5a88)
|
|
Fix a C++ compat warning.
Volker
(This used to be commit 351e583f66714562eca1f40429bfee70f06d281c)
|
|
(This used to be commit 86db85423027d34cb053fc068159ddd2226e90ec)
|
|
a non-fatal error path if the 'disable machine
account' code succeeded.
Jeremy.
(This used to be commit f47bffa21ec1caf5ec3a6ec77af801df0b63d83a)
|
|
Guenther
(This used to be commit 8ab214956ef11ff0b1532713cff65c17d2439570)
|