Age | Commit message (Collapse) | Author | Files | Lines |
|
cannot put saf_name in the failed conn cache as it's uninitialized.
Store saf_servername (the ip) in that case.
Volker, please check.
Guenther
(This used to be commit 098a87f492f69caeb523478a7ebcd0e3f636497d)
|
|
Volker
(This used to be commit 8a5cebc19e4709399976efe9e3ba3bf29249620a)
|
|
Fix more potential segfaults when something on our way to a DC connection
fails.
We can not continue if dcip_to_name() fails. With
192.168.234.100 nt4pdc
192.168.234.100 windows#1c
192.168.234.100 windows#1b
in the lmhosts file when nt4pdc is rebooted, we do find the DC's IP address,
we can connect to TCP 139 while it is booting but anything else fails. So we
fall back to put the IP address into domain->dcname. When the DC is fully up
later on we try to do the auth2 against \\192.168.234.100 which gives
INVALID_COMPUTER_NAME. And we never get out of this loop again.
Fix this.
Jerry, maybe you can take a look.
Thanks,
Volker
(This used to be commit b1244e79068af9e287252b2dfbb8d612e717674a)
|
|
a domain
controller the next time we connect this child ran into a segfault because it
tried to reference a half-baked connection.
Volker
(This used to be commit c8a8204c744cf7aa1a1a6992a3433d99b6bb73a1)
|
|
The motivating factor is to not require more privileges for
the user account than Windows does when joining a domain.
The points of interest are
* net_ads_join() uses same rpc mechanisms as net_rpc_join()
* Enable CLDAP queries for filling in the majority of the
ADS_STRUCT->config information
* Remove ldap_initialized() from sam/idmap_ad.c and
libads/ldap.c
* Remove some unnecessary fields from ADS_STRUCT
* Manually set the dNSHostName and servicePrincipalName attribute
using the machine account after the join
Thanks to Guenther and Simo for the review.
Still to do:
* Fix the userAccountControl for DES only systems
* Set the userPrincipalName in order to support things like
'kinit -k' (although we might be able to just use the sAMAccountName
instead)
* Re-add support for pre-creating the machine account in
a specific OU
(This used to be commit 4c4ea7b20f44cd200cef8c7b389d51b72eccc39b)
|
|
(This used to be commit 62d60a04cd85dc521e7d63726b856f38287466ad)
|
|
case future forward lookups would fail
(This used to be commit d56ed46faec46dad74b469d25ff99c9002792c78)
|
|
* ignore the primary group SID attribute from struct samu*
* generate the primary group SID strictlky from the Unix
primary group when dealing with passdb users
* Fix memory leak in original patch caused by failing to free a
talloc *
* add wrapper around samu_set_unix() to prevent exposing the create
BOOL to callers. Wrappers are samu_set_unix() and samu-allic_rid_unix()
(This used to be commit bcf269e2ec6630b78d909010fabd3b69dd6dda84)
|
|
(This used to be commit a918e4ac2426d4cb3cd526c4fad7480b832e6a12)
|
|
Guenther
(This used to be commit 286f6fc2339cf4ef232c16466b8dffdcddbe343f)
|
|
Sync with trunk as off r13315
(This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
|
|
(This used to be commit 6c3480f9aecc061660ad5c06347b8f1d3e11a330)
|
|
rebooting
(This used to be commit 994794383361cfe5d58098ae494489fb0164e1df)
|
|
Guenther
(This used to be commit 499224f02a8722eea0d4644ca81ca55da0e9a86b)
|
|
and client_name when doing netlogon credential setup.
Jeremy.
(This used to be commit 37e6ef9389041f58eada167239fd022f01c5fecb)
|
|
Volker
(This used to be commit 440e7b3342e6b7b12208b789853962de72a9cac2)
|
|
(this is the way it's been done in other functions). Instead
of moving this into the IDL, I think the best solution would
be to write a wrapper function around any call that needs
this (this is what we already do for many of the calls).
Jeremy.
(This used to be commit aeca4efa11728be53b81967bb5442b5b09d1a975)
|
|
lsa_openpolicy and fall back appropriately. In particular an ntlmssp bind
failure can not be detected before the first real rpc request, at least
according to abartlet :-)
Works for me against w2k3, w2k and nt4. Sooner or later I should test against
samba4 ... :-)
Volker
(This used to be commit 48a9e35208ae7b6271508085f59833e5def640e8)
|
|
here. ;-)
We can only tell if the bind succeeded on the first real RPC call. So we have
to decide according to success of samrconnect whether we have to fall
back. Similarly for lsaopenpolicy.
Volker
(This used to be commit 0603e1c8456ee87b87b051e0303a35fdbfbcf7ca)
|
|
Volker
(This used to be commit 770ad2a8a72ae7bfcdc1b86b72142e11f662d975)
|
|
(This used to be commit 10fb32ec52b32b72a46a783b73c6dd1f24625d9b)
|
|
* \PIPE\unixinfo
* winbindd's {group,alias}membership new functions
* winbindd's lookupsids() functionality
* swat (trunk changes to be reverted as per discussion with Deryck)
(This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
|
|
checking trusted account for winbindd running on a Samba PDC
(This used to be commit 24b43af642c9d41c14b9ad64704e13cc9150378d)
|
|
(This used to be commit c2f69827de13a6e63077bfc4a62738c0f88e0835)
|
|
the latest MS changes in 2003 sp1 and 2004 sp4 sr1
(This used to be commit 7588c32baa50994bdc6e351d79da3edff1fdc876)
|
|
2003 sp1 and Windows 2000 SP4 SR1
(This used to be commit bc1443837c81bebbac7894075a15fe96338f8b0a)
|
|
* make sure to use our domain as the account name in the net_req_auth2()
request when running on a Samba DC
* make sure to lookup the correct domain (not default to ours) when getting an async
getpwnam() call
(This used to be commit c9c3e3c122a6a04847c448d298b6f1adb4f35a60)
|
|
(This used to be commit a0ac9a8ffd4af31a0ebc423b4acbb2f043d865b8)
|
|
(This used to be commit 88c2ed1534d5239273458768b7b3f05102a2af16)
|
|
(This used to be commit 91a8e1ac6debffe457624a625e0f407bdbbbcb15)
|
|
Can't do LsaOpenPolicy() over schannel anymore.
This is an interesting find as it could imply that there are
other changes we haven't seen yet in sp1.
Volker, You might want to look at this for trunk.
(This used to be commit 82e3a9d9b526522376ea967c66c67b02f2c68dd8)
|
|
netbios = yes'
(This used to be commit 75a223f1188ae0041c9e3c748af107d642f73810)
|
|
the cli* in cm_prepare_connection(). using credentials from a domain other thanour primary domain will cause the schannel setup to fail
(This used to be commit a13e29b5f2f1e48225b5b5964bc0777948f16622)
|
|
(This used to be commit a8aab6de7516b70cae6c096883874fa152777b13)
|
|
(This used to be commit ccdff4a998405544433aa32938963e4c37962fcc)
|
|
DC name
via netbios, as the user might have set an IP address or a fqdn.
Volker
(This used to be commit 61466f38429ba67ace3e84c870a0f913f64d122c)
|
|
(This used to be commit 13a2aa50ea203cee9c2323bb0428f8c50a3c0f77)
|
|
allocation
functions so we can funnel through some well known functions. Should help greatly with
malloc checking.
HEAD patch to follow.
Jeremy.
(This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)
|
|
simultaeneously to all
DCs found. The first one to reply wins.
Volker
(This used to be commit 84ac54aef2bd56b5c889d3b05b8828aceb8ae00e)
|
|
(This used to be commit 128951cfe43e364970ec5760230a6450f54ae86d)
|
|
for setting up an schannel connection. This solves the problem
of a Samba DC running winbind, trusting a native mode AD domain,
and needing to enumerate AD users via wbinfo -u.
(This used to be commit e9f109d1b38e0b0adec9b7e9a907f90a79d297ea)
|
|
and AD) as well as on a Samba DC
(This used to be commit 157d53782d6a7d0b7e30676a674ff2a25a15369c)
|
|
(This used to be commit fbeff419913b01bf0e814ada6ec55d56fe90f179)
|
|
(This used to be commit 1fae60ab20c5cbe396dc8af1c8c9a98d5683fdf4)
|
|
to winbindd_cm about this
(This used to be commit 5134c6bcbc5180431e95a30559c453f3744fd427)
|
|
have been tested against an NT4 DC
(This used to be commit 8e8a351cabb502f1a93b219fec064fb4eb094856)
|
|
domains, this patch ensures that we always use the ADS backend when
security=ADS, and the remote server is capable.
The routines used for this behaviour have been upgraded to modern Samba
codeing standards.
This is a change in behaviour for mixed mode domains, and if the trusted
domain cannot be reached with our current krb5.conf file, we will show
that domain as disconnected.
This is in line with existing behaviour for native mode domains, and for
our primary domain.
As a consequence of testing this patch, I found that our kerberos error
handling was well below par - we would often throw away useful error
values. These changes move more routines to ADS_STATUS to return
kerberos errors.
Also found when valgrinding the setup, fix a few memory leaks.
While sniffing the resultant connections, I noticed we would query our
list of trusted domains twice - so I have reworked some of the code to
avoid that.
Andrew Bartlett
(This used to be commit 7c34de8096b86d2869e7177420fe129bd0c7541d)
|
|
Andrew Bartlett
(This used to be commit 93a5d8079a0291be14517e437f8f0c964c21e91d)
|
|
DNS names (realms) from NetBIOS domain names.
Until now, we would experience delays as we broadcast lookups for DNS names
onto the local network segments.
Now if DNS comes back negative, we fall straight back to looking up the
short name.
Andrew Bartlett
(This used to be commit 32397c8b01f1dec7b05140d210bb32f836a80ca6)
|
|
(This used to be commit cf4454969434d3026c57ac11c0528dc4cea9c77a)
|