Age | Commit message (Collapse) | Author | Files | Lines |
|
handle a
particular SID. Make sure that the passdb backend will accept the same set
range of local SIDs that the idmap system sends it.
Simo, Jerry - this is a 3_0_25 candidate. Can you please review?
(This used to be commit 86a70adb6a2d277f235857451bbee7d530d15310)
|
|
decides smbd
to be idle it might happen that smbd needs to do a winbind operation (for
example sid2name) as non-root. This then fails to get the privileged
pipe. When later on on the same connection another authentication request
comes in, we try to do the CRAP auth via the non-privileged pipe.
This adds a winbindd_priv_request_response() request that kills the existing
winbind pipe connection if it's not privileged.
Volker
(This used to be commit e5741e27c4c22702c9f8b07877641fecc7eef39c)
|
|
(This used to be commit e1fbfbe1c49d3ff1ca71a33e66fae1f2d48fb7a7)
|
|
(This used to be commit fcec3d1c46affbf802fb411913c8cc59c02102fa)
|
|
* Fix getgroups() call called using a normalized name
* Fix some more name mappings that could cause for example
a user to be unable to unlock the screen as the username
would not match in the PAM authenticate call.
(This used to be commit 505fc669a1b2c36e1639924b9639c97988056d8d)
|
|
winbind
who did not run the idle events to drop ldap connections.
Volker
(This used to be commit af3308ce5a21220ff4c510de356dbaa6cf9ff997)
|
|
newline
(This used to be commit f57e4f8adaa3b8cfc300ee6625fdbca968bb81d3)
|
|
(This used to be commit 51b96ba79c9e7ca7a4cdf777fe160152ab35236e)
|
|
to get the
Krb5 config stuff to work in the server affinity settings.
(This used to be commit 518052be38385ad089c0cb092d07ccd210a27ef3)
|
|
ads_cached_connection() does not call get_dc_name()
before ads_connect() and therefore does not setup
the environment to look at krb5.conf.DOMAIN file
before sending the TGT request. The failure I'm seeing
occurs ni a multi-DC domain where we get back preuath
failed after we just joined the domain.
(This used to be commit 256f36dce3e3a39798b2ad38fa3123669d670597)
|
|
(This used to be commit 82dc19f844af65a8815c629e4ec1f354d208a53f)
|
|
SATOH Fumiyasu <fumiya@samba.gr.jp>
(This used to be commit d68b2910c8ba97a42b8bccc0af1341fc301a76d0)
|
|
(This used to be commit 0de74724289f2b78719f6675664d7376446650d0)
|
|
(This used to be commit 05886edb3559355e8cd3e3eb8999f24b64ddb3eb)
|
|
so they can honor the offline logon state.
(This used to be commit 15b13dfe81e861b94077c94b80117a85a5ffb999)
|
|
is took late
(This used to be commit 5575845952171aaeae81cf65fe32be33cc1b45ba)
|
|
on x86_64 Linux boxes. Since it is not needed, just use malloc()
on Linux.
(This used to be commit 3644bd999621e04b3fae262f172e93ea8fdcd47e)
|
|
by the nss_info backend
(This used to be commit a9028612a3f614579b28f9560cc67aef90b31cf8)
|
|
LAM module does to work around a system that does not support
>8 character usernames. Without the change, pam_winbind tries
to authenticate _#uid in the domain.
(This used to be commit 7f0ba72e05acbd958fbf768a04d16c29189dc8f7)
|
|
su - DOM\user was unable to set the process crendentials
without listing the "id" and other attributes in the attrlist[].
More fixes to come, but I didn't want this to get lost.
(This used to be commit 4c53d300fa3516a4c5113bc94dfd07413c46b038)
|
|
Patch from Zack Kirsch <zack.kirsch@isilon.com>.
Jeremy.
(This used to be commit df07a662e32367a52c1e8473475423db2ff5bc51)
|
|
Fix escaping of DN components and filters around the code
Add some notes to commandline help messages about how to pass DNs
revert jra's "concistency" commit to nsswitch/winbindd_ads.c, as it was
incorrect.
The 2 functions use DNs in different ways.
- lookup_usergroups_member() uses the DN in a search filter,
and must use the filter escaping function to escape it
Escaping filters that include escaped DNs ("\," becomes "\5c,") is the
correct way to do it (tested against W2k3).
- lookup_usergroups_memberof() instead uses the DN ultimately as a base dn.
Both functions do NOT need any DN escaping function as DNs can't be reliably
escaped when in a string form, intead each single RDN value must be escaped
separately.
DNs coming from other ldap calls (like ads_get_dn()), do not need escaping as
they come already escaped on the wire and passed as is by the ldap libraries
DN filtering has been tested.
For example now it is possible to do something like:
'net ads add user joe#5' as now the '#' character is correctly escaped when
building the DN, previously such a call failed with Invalid DN Syntax.
Simo.
(This used to be commit 5b4838f62ab1a92bfe02626ef40d7f94c2598322)
|
|
broken :-). This will do until Simo fixes the escape
calls properly.
Jeremy.
(This used to be commit b7d91ec1b20f8d58903a3283f7789a30041461be)
|
|
(This used to be commit b5fd72282da85f50a040fd949752bc71023ff055)
|
|
there is just no cache around for a user.
Guenther
(This used to be commit a6c249b59228c6891cde624f72fff23879dbd19f)
|
|
shoulder.... Correct fix for warning :-)
Jeremy.
(This used to be commit 773001870d22ef4ff7ec00f73661b59a63cade42)
|
|
Jeremy.
(This used to be commit 34675624e2be886188337a883a6c4a57ef7e3fe3)
|
|
others don't get stuck with the winbindd hang.
Still waiting on additional confirmation from Guenther
that this fixes thes issues he was observing as well.
But it's been running in my local tree for a day without
problems.
(This used to be commit 0d2b80c6c4a744b05a0efdec352cddccc430e0c4)
|
|
Jerry please check.
Simo.
(This used to be commit a5354aa9a0bd860500356f45d09fce3d01649c60)
|
|
(This used to be commit 52e6a2ceab794875781575ed17ec86808f6e26da)
|
|
changed a password via pam_chauthtok. Only do this if
a) a user logs on using an expired password (or a password that needs to
be changed immediately) or
b) the user itself changes his password.
Also make sure to delete the in-memory krb5 credential cache (when a
user did not request a FILE based cred cache).
Finally honor the krb5 settings in the first pam authentication in the
chauthtok block (PAM_PRELIM_CHECK). This circumvents confusion when
NTLM samlogon authentication is still possible with the old password after
the password has been already changed (on w2k3 sp1 dcs).
Guenther
(This used to be commit c3005c48cd86bc1dd17fab80da05c2d34071b872)
|
|
on terminate. Pointed out by Herb.
Jeremy.
(This used to be commit 08998b74a51acd55eb6cbe095e682e2a79334736)
|
|
Guenther
(This used to be commit 5c4a58ff3ab261e32789f39f2cf478367b727318)
|
|
Guenther
(This used to be commit ad063d9a944e923777e538c2cb050d47f9f8bea0)
|
|
(This used to be commit aa8f306fa545af653d8288919fa5a3b80f447bec)
|
|
(This used to be commit 9fe5f7885771e68b11c7794653d0e4771eeac403)
|
|
allow detection of libbiconv if all others fail - need for FreeBSD
(This used to be commit 7acc9421b0643cb04bff1f1d98ecb899f9b09601)
|
|
_nss_winbind_initgroups_dyn() on an empty group list.
Guenther
(This used to be commit 155b9e7c74d1a623e018fc2f8ca2e32e4aa3f213)
|
|
Avoid assigning 0 as primary group id for users in NSS calls.
Jerry, please check.
Guenther
(This used to be commit 03f5f7d0140c99411c137e7e2eac7e2d0c08202e)
|
|
Jeremy, I'm afraid you removed the "domain->initialized" from the
set_dc_types_and_flags() call when the connect to PI_LSARPC_DS failed
(with rev. 19148).
This causes now that init_dc_connection_network is called again and
again which in turn rescans the DC each time (which of course fails each
time with NT_STATUS_BUFFER_TOO_SMALL). Just continue with the
non-PI_LSARPC_DS scan so that the domain is initialized properly.
Guenther
(This used to be commit c6f63a08f55a4121cbe5aac537d2ef983dc25a97)
|
|
Guenther
(This used to be commit 639b7989b3ad1438a443a33dc41115bcc90f72d2)
|
|
Guenther
(This used to be commit e3c32583795631212dc0d5cd01981b27cde2a489)
|
|
print NSS_STATUS code with DEBUG_NSS when leaving a function.
Guenther
(This used to be commit 53ecd63d94fd0a502ef5cdeb512c8e38795698e1)
|
|
Guenther
(This used to be commit dcbf7a1250aa5c6293ffba6a930ee23537ec9484)
|
|
Cached logon with pam_winbind should work now also for NT4 and samba3
domains.
Guenther
(This used to be commit b2f91154820219959b8008b15802c70e1d76d158)
|
|
Guenther
(This used to be commit 5a7b2fccb3cdc6a849aedcd256eea86faec1d54c)
|
|
Guenther
(This used to be commit 968dfcc8218cacdd97c2c66929e95f5062ff464a)
|
|
Guenther
(This used to be commit 16c90f30b93f32c4f8fed00a6cc154c596e4244d)
|
|
(This used to be commit 5c3edad86098c5271cb141b8f7885ca7f5b48072)
|
|
For the winbind cached ADS LDAP connection handling
(ads_cached_connection()) we were (incorrectly) assuming that the
service ticket lifetime equaled the tgt lifetime. For setups where the
service ticket just lives 10 minutes, we were leaving hundreds of LDAP
connections in CLOSE_WAIT state, until we fail to service entirely with
"Too many open files".
Also sequence_number() in winbindd_ads.c needs to delete the cached LDAP
connection after the ads_do_search_retry() has failed to submit the
search request (although the bind succeeded (returning an expired
service ticket that we cannot delete from the memory cred cache - this
will get fixed later)).
Guenther
(This used to be commit 7e1a84b7226fb8dcd5d34c64a3478a6d886a9a91)
|