Age | Commit message (Collapse) | Author | Files | Lines |
|
* make debug_state also configurable from the config file
* minor code cleanup
Guenther
(This used to be commit c562095953df55c91e3dad8f5c29c0b66664b62b)
|
|
Guenther
(This used to be commit adb40884e04069e7de7580b6531675ebaed5c117)
|
|
Jerry, the switch statement must ignore the PAM_SILENT flag.
Guenther
(This used to be commit 46d23c72bf4f3bd04021a9caf8d6b1380352b811)
|
|
(This used to be commit f82a5175304a12b18abb2bc3d9fd9f7023998357)
|
|
* Remove anpther check for PAM_SILENT that prevents logging to syslog
* Add missing check for TRY_FIRST_PASS when using authtok (missed
from previous merge)
(This used to be commit ed794f0872b749955f56112507fd3ae7a6c6e6f5)
|
|
Details: Improve PAM logging
- The improved logging is far tracking down PAM-related bugs
- PAM_SILENT was being mis-used to suppress syslog output instead of
suppressing user output. This lets PAM_SILENT still log to syslog.
- Allow logging of item & data state via debug_state config file option.
- Logging tracks the pam handle used.
(This used to be commit cc1a13a9f06e5c15c8df19d0fbb31dbdeb81a9cc)
|
|
Details: Reset the "new password prompt required" state whenever
we do a new auth. In more detail, in pam_sm_authenticate, if not
settting PAM_WINBIND_NEW_AUTHTOK_REQD, then clean any potentially
present PAM_WINBIND_NEW_AUTHTOK_REQD.
(This used to be commit 402e8594759b42c1986f4f8d69273f68ec5160af)
|
|
Patch details:
Support most options in pam_winbind.conf; support comma-separated names in
require-membership-of. Details below:
1) Provides support for almost all config options in pam_winbind.conf
(all except for use_first_pass, use_authtok, and unknown_ok).
- That allows us to work well when invoked via call_modules from
pam_unix2.conf as well as allowing use of spaces in names used
w/require_membership_of.
2) Support for comma-separated list of names or SID strings in
require_membership_of/require-membership-of.
- Increased require_membership_of field in winbind request from fstring
(256) to pstring (1024).
- In PAM side, parse out multiple names or SID strings and convert
all of them to SID strings.
- In Winbind side, support membership check against multiple SID strings.
(This used to be commit 4aca9864896b3e0890ffc9a6980d7ef1311138f7)
|
|
In case a user authenticated sucessfully and his password just expired
while beeing disconnected, we should allow a user to logon (given a
clear warning). We currently forced the user into a password change
dialogue in that scenario; this did not make much sense while offline.
Guenther
(This used to be commit 668b278653acfc4de7807834988f7af557e608a5)
|
|
We were incorrectly calculating the days until the password expires and
we also need to look at the info3 pass_must_change_time for expiry
calculation.
Guenther
(This used to be commit 22d79237127a064a934928d175182adecc6300de)
|
|
* fail on invalid credential flags in pam_sm_setcred
* parse config file for pam_sm_acct_mgmt and pam_sm_open_session
Guenther
(This used to be commit 2a428ac814d03880de63656ea97827126ccfec5c)
|
|
Guenther
(This used to be commit f6c9421abdf5731e894cd2ccc1b7431a3c368bbf)
|
|
Guenther
(This used to be commit 222320373f8a251fc2cf3ff8c3fec93a7a48f9df)
|
|
is set.
Guenther
(This used to be commit ecbab58826a51ace2a0d1181a41391f5d170ff06)
|
|
(e.g. to get the debug flag)
Guenther
(This used to be commit 2c549f71f15b066ac1f415544848b582558abd5d)
|
|
when offline and or doing password changes.
Jeremy.
(This used to be commit 4a74c553845c960a355ddb86abaadfe0d550271f)
|
|
pam_winbind. Thanks to Andrew Benham <andrew.benham@thus.net>
(This used to be commit 0d03f5137936546253a8b3334995f536f3621d57)
|
|
we're just doing strchr on a const string there's
no need to strdup it before, we're never modifying
it. Just remove the variable "parm".
Jeremy.
(This used to be commit 1af18f613b1399220e38e7ab40665c2ca177c5a7)
|
|
(This used to be commit 3fed72ac3efd1fa7df8fb7d1e2cb9772d66bb4bd)
|
|
field.
Guenther
(This used to be commit 66b92f27fa4edec180b8c8eee929ec8f31ef6a08)
|
|
Guenther
(This used to be commit a4d17ee9c960abdf21b9af1601bd1042e0cd7636)
|
|
Guenther
(This used to be commit 9621bb420a13e634badcc922c73c8bfb30aa6120)
|
|
it in.
(This used to be commit 4e464a2c35984752244f30ce9bb259eb16149e3f)
|
|
Guenther
(This used to be commit 143a48927b0e21d31a9f54cfc720b5d04a4b6751)
|
|
(This used to be commit 8c60e71229cd577f3b17345c5824363dd202eba9)
|
|
Jeremy.
(This used to be commit 7644fa70ba4f7c88d887930e23b5ee2e1632473b)
|
|
* as openlog() is non-reentrant and pam_winbind thereby overrides the
syslog settings of the calling application, directly call syslog (or
pam_vsyslog if available)
* support the PAM_SILENT flag to avoid any log messages beeing created
Guenther
(This used to be commit 0f7e37ffc4759a4e29f63ab83f39ddb31c8240f6)
|
|
pam offline logons.
Guenther
(This used to be commit 95788cb291b89b431972e29e148b412992cc32a5)
|
|
name that will be returned by winbindd. This
(should) fix the bug where the user logs in
with DOMAIN\user but winbindd returns only
"user" for the username due to 'winbind use
default domain' being set.
Jeremy.
(This used to be commit 1b2aa17354d50740902010f4a1e0217c8b1f7bdd)
|
|
AD DC
* Merge patches from SLES10 to make sure we talk to the correct
winbindd process when performing pam_auth (and pull the password policy info).
(This used to be commit 43bd8c00abb38eb23a1497a255d194fb1bbffffb)
|
|
(This used to be commit f6194cf4b263454bbdf180a7d014ffc3498df497)
|
|
other PAM modules to pick it up from there.
Guenther
(This used to be commit b3ac5a586ba37b1122b0dc941dfee648fc4fa6d5)
|
|
Guenther
(This used to be commit 62a8e0b08919e71c6a575ce6d89d8a4a09acbd87)
|
|
Patch from Dietrich Streifert <dietrich.streifert@visionet.de>
(This used to be commit 8d6218825827a54ca69e462c00a3dc9e25ef3ddf)
|
|
to do the upper layer directories but this is what
everyone is waiting for....
Jeremy.
(This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8)
|
|
Thanks to Bjoern Jacke for the report and test-case.
Guenther
(This used to be commit f2ebc0e3de396f44f49dabbfe42cb3ad1c1a7ec1)
|
|
pam_winbind.
Guenther
(This used to be commit 29758ea1c4e1b9b57d27765d539306058299fcd1)
|
|
pam_winbind.
Guenther
(This used to be commit bf077fb2268b79faffd1fdda04847c37ffead32d)
|
|
non-critical and fallback to only parse the argv options in that case.
Guenther
(This used to be commit 9dac3ab328e9c7ba374e0efc3fe16d940ecc9d3b)
|
|
(This used to be commit 7188ec6bd81715c4df17528bca2b2e658173043f)
|
|
Guenther
(This used to be commit 34b29c30b2f4b5a3c40a65ca8338c87a4c16f3ff)
|
|
Guenther
(This used to be commit 1856dc0f52b2a2ba2e59f1a7a77ccd32c27928c0)
|
|
Guenther
(This used to be commit cc800ced60e5e6bbd923a3a0b7d58650c6e14121)
|
|
too early.
Guenther
(This used to be commit 7f64a66d25f2a4aa48c2639da8e783c1759c5dd4)
|
|
/etc/security/pam_winbind.conf as config file for the PAM module by
default.
Guenther
(This used to be commit 41b79ee80c7b0f4836ded51d42c7dc91cba75ccd)
|
|
PAM_SUCCESS. Günther, could you take a look?
Thanks,
Volker
(This used to be commit fc6effcd9c2bb2d15b7e8fba85cc3193d2d7ce1f)
|
|
internals, mostly with the code that was in pam_winbind before.
Also switch from using loadparm to use iniParser to read the new
pam_winbind options from a configuration file. That still uses the old
(parametric) option names which will be replaced next (as iniParser does
not support parametric options).
Guenther
(This used to be commit 6f668ce67318f17bba79cd98b5d169cd19eafcd4)
|
|
ensure that global memory is freed when unloading pam_winbind.so (needs more testing on non-linux platforms)
(This used to be commit 1e0b79e591d70352a96e0a0487d8f394dc7b36ba)
|
|
Guenther
(This used to be commit 87293802f3e0666c9a50eb3ca63bb1a7dccc50dc)
|
|
environment.
Guenther
(This used to be commit 1f1402e45db8d80a7c19208fae934e1b0f3da134)
|