Age | Commit message (Collapse) | Author | Files | Lines |
|
Guenther
(This used to be commit b9d7a2962a472afb0c6b8e3ac5c2c819d4af2b39)
|
|
Guenther
(This used to be commit 19020d19dca7f34be92c8c2ec49ae7dbde60f8c1)
|
|
net ads keytab list /path/to/krb5.keytab
Guenther
(This used to be commit a2befee3f240543ea02ea99cebad886b54ae64eb)
|
|
Guenther
(This used to be commit d22c0d291e1b4a1412164d257310bbbb99de6500)
|
|
of default
keytabnames (like "ANY:FILE:/etc/krb5.keytab,krb4:/etc/srvtab"). This also
fixes keytab support with Heimdal (which supports the WRFILE pragma as well
now).
Guenther
(This used to be commit 7ca002f4cc9ec4139c0c48952ebf05f89b5795ef)
|
|
Guenther
(This used to be commit 11b390309b9677805e5b68f3a1b780658ae85137)
|
|
Jeremy.
(This used to be commit 03763bc5287fef5f100c911041668e23d4305f8d)
|
|
context flags.
(This used to be commit 903145e957cd05b219fdf7d5fc1e35430938a24e)
|
|
when verifying a ticket from winbindd_pam.c.
I've found during multiple, fast, automated SSH logins (such
as from a cron script) that the replay cache in MIT's krb5
lib will occasionally fail the krb5_rd_req() as a replay attack.
There seems to be a small window during which the MIT krb5
libs could reproduce identical time stamps for ctime and cusec
in the authenticator since Unix systems only give back
milli-seconds rather than the micro-seconds needed by the
authenticator. Checked against MIT 1.5.1. Have not
researched how Heimdal does it.
My thinking is that if someone can spoof the KDC and TDS
services we are pretty hopeless anyways.
(This used to be commit cbd33da9f78373e29729325bbab1ae9040712b11)
|
|
(This used to be commit 22a3ea40ac69fa3722abf28db845ab284a65ad97)
|
|
data to krb5_prompter.
Jeremy.
(This used to be commit 232fc5d69d44404df13f6516864352f9a5721552)
|
|
we were calling PRS_ALLOC_MEM with zero count.
Jeremy.
(This used to be commit 9a10736e6fa276ca4b0726fbb7baf0daafbdc46d)
|
|
This fixes the build on solaris (host sun9).
And hopefully doesn't break any other builds... :-)
If it does, we need some configure magic.
Thanks to Björn Jacke <bj@sernet.de>.
(This used to be commit a43775ab36aa3d36108e1b5860bbee6c47e9b1b4)
|
|
replace all data_blob(NULL, 0) calls.
(This used to be commit 3d3d61687ef00181f4f04e001d42181d93ac931e)
|
|
tokenGroup attribute.
Guenther
(This used to be commit e4e8f840605dfdf92ca60cc8fc6a4c85336565fb)
|
|
Guenther
(This used to be commit 6e911c442bf9b076f43f99576f9b588df2c39233)
|
|
ALLOWED OBJECT
ACEs).
Guenther
(This used to be commit e138cbc876e50ae25cb15c5109a42bc8b800c1ba)
|
|
search with
the SD_FLAGS control.
Guenther
(This used to be commit 648df57e53ddabe74052e816b8eba95180736208)
|
|
When asked to create a machine account in an OU as part
of "net ads join" and the account already exists in another
OU, simply move the machine object to the requested OU.
(This used to be commit 3004cc6e593e6659a618de66f659f579e71c07f7)
|
|
Helps when transitioning from offline to online mode.
Note that this is a quick hack and a better solution
would be to start the DNS server's state between processes
(similar to the namecache entries).
(This used to be commit 4f05c6fe26f4abd7ca71eac339fee2ef5e254369)
|
|
(This used to be commit 2ab617fbbffbd6bf98ee02150f62b87a2610531f)
|
|
winbindd's kerberized pam_auth use that.
Guenther
(This used to be commit 0f436eab5b2e5891c341c27cb22db52a72bf1af7)
|
|
NTSTATUS
codes directly out of the krb5_error edata.
Guenther
(This used to be commit dcd902f24a59288bbb7400d59c0afc0c8303ed69)
|
|
Guenther
(This used to be commit 997ded4e3f0dc2199b9a66a9485c919c16fbabc6)
|
|
That should be it....
Jeremy.
(This used to be commit 603233a98bbf65467c8b4f04719d771c70b3b4c9)
|
|
Jeremy.
(This used to be commit 8968808c3b5b0208cbad9ac92eaf948f2c546dd9)
|
|
Guenther
(This used to be commit 9ec76c542775ae58ff03f42ebfa1acc1a63a1bb1)
|
|
Guenther
(This used to be commit b8828ea2516876fe5dd76083864418db2f042be0)
|
|
ranged LDAP
queries more generic. Michael, feel free to overwrite these and the following.
Guenther
(This used to be commit 0475b8eea99ebb467e52225ad54f4302a77376b9)
|
|
because we try "GSS-SPNEGO" first and all windows version support
that.
metze
(This used to be commit 34a5badbded0b2537ee854287931e2a7dc3aeb37)
|
|
Jeremy.
(This used to be commit 7c45bd3a47fc2b24c5f1351a241ace2201c857d2)
|
|
not specific for NTLMSSP
- it's possible that the server sends a mechOID and authdata
if negResult != SPNEGO_NEG_RESULT_INCOMPLETE, but we still
force the mechOID to be present if negResult == SPNEGO_NEG_RESULT_INCOMPLETE
metze
(This used to be commit e9f2aa22f90208a5e530ef3b68664151960a0a22)
|
|
Merge the memory leak fix (with fix :-) to 3.0.25.
Jeremy.
(This used to be commit ab3150fe4ed2a629eb371db5f43ae09b9c583a64)
|
|
doesn't support GSS-SPNEGO in SASL
can someone please review this, maybe it's also for 3.0.25
metze
(This used to be commit 8c6930b7013b185af0530b04a7d5a49bc2ce7831)
|
|
Jeremy.
(This used to be commit 829580414d89ff4aa0f45906e455849c55f508b1)
|
|
Jeremy
(This used to be commit 8ba138efd097b08dcfe98f99b67c77579babf250)
|
|
to restructure libsmb/smb_signing.c so it isn't in
the base libs path but lives in libsmb instead (like
smb_seal.c does).
Jeremy.
(This used to be commit 1b828f051d0782201f697de15ff973bd6b097d5b)
|
|
Jeremy.
(This used to be commit d432d81c8321a4444b970169a5c7c3c5709de8e5)
|
|
doesn't
make sense as long as it doesn't work as an lp_unload().
Guenther
(This used to be commit 128ea9bebbb215e41d2f0576e1a73c6a362b7467)
|
|
the MIT gss libraries *SUCK*, move the frees to the end
of the function so MIT doesn't segfault.....
Add a comment so that another engineer knows why I did
this.
Jeremy.
(This used to be commit 1a2be06d4a1131952a97f94b05ae69b1dce4c300)
|
|
in sasl bind. Wonder why coverity didn't find these ?
Jeremy.
(This used to be commit 89bdd30e4b2bb9dbc2ab57c54be8c6d01cae5a26)
|
|
to return a NT_STATUS_TIME_DIFFERENCE_AT_DC error to
a client when there's clock skew. Will help people
debug this. Prepare us for being able to return the
correct sessionsetupX "NT_STATUS_MORE_PROCESSING_REQUIRED"
error with associated krb5 clock skew error to allow
clients to re-sync time with us when we're eventually
able to be a KDC.
Jeremy.
(This used to be commit c426340fc79a6b446033433b8de599130adffe28)
|
|
Volker
(This used to be commit fd0ee6722ddfcb64b5cc9c699375524ae3d8709b)
|
|
Not used
yet, the next step will be a secrets_fetch_machine_account() function that
also pulls the account name to be used in the appropriate places.
Volker
(This used to be commit f94e5af72e282f70ca5454cdf3aed510b747eb93)
|
|
This is a starting point and may get changed. Basically we need follow the
exact same path to detect (K)DCs like other Samba tools/winbind do. In
particular with regard to the server affinity cache and the site-awarness for
DNS SRV lookups.
To compile just call "make bin/smb_krb5_locator.so", copy to
/usr/lib/plugin/krb5/ (Heimdal HEAD) or /usr/lib/krb5/plugins/libkrb5/ (MIT)
and you should immediately be able to kinit to your AD domain without having
your REALM with kdc or kpasswd directives defined in /etc/krb5.conf at all.
Tested with todays Heimdal HEAD and MIT krb5 1.5.
Guenther
(This used to be commit 34ae610bd5b9fd1210f16beac07a1c5984144ca7)
|
|
(This used to be commit 4f6c2826aa1ac240b02122a40fe9a1ccabaaaf27)
|
|
calling convention in the latest MIT changes. Apparantly Heimdal
is also changing to this calling convention.
(This used to be commit c29c69d2df377fabb88a78e6f5237de106d5c2c5)
|
|
Jeremy.
(This used to be commit 02d08ca0be8c374e30c3c0e665853fa9e57f043a)
|
|
Coverity finds them :-)
Jeremy.
(This used to be commit cbe725f1b09f3d0edbdf823e0862edf21e16d336)
|
|
Fix escaping of DN components and filters around the code
Add some notes to commandline help messages about how to pass DNs
revert jra's "concistency" commit to nsswitch/winbindd_ads.c, as it was
incorrect.
The 2 functions use DNs in different ways.
- lookup_usergroups_member() uses the DN in a search filter,
and must use the filter escaping function to escape it
Escaping filters that include escaped DNs ("\," becomes "\5c,") is the
correct way to do it (tested against W2k3).
- lookup_usergroups_memberof() instead uses the DN ultimately as a base dn.
Both functions do NOT need any DN escaping function as DNs can't be reliably
escaped when in a string form, intead each single RDN value must be escaped
separately.
DNs coming from other ldap calls (like ads_get_dn()), do not need escaping as
they come already escaped on the wire and passed as is by the ldap libraries
DN filtering has been tested.
For example now it is possible to do something like:
'net ads add user joe#5' as now the '#' character is correctly escaped when
building the DN, previously such a call failed with Invalid DN Syntax.
Simo.
(This used to be commit 5b4838f62ab1a92bfe02626ef40d7f94c2598322)
|