summaryrefslogtreecommitdiff
path: root/source3/nsswitch
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r21622: Fix bad merge caught by James.Gerald Carter1-7/+0
(This used to be commit 05886edb3559355e8cd3e3eb8999f24b64ddb3eb)
2007-10-10r21616: Delay initialization of idmap and nss_info backends until necessaryGerald Carter6-33/+193
so they can honor the offline logon state. (This used to be commit 15b13dfe81e861b94077c94b80117a85a5ffb999)
2007-10-10r21615: don't wait until the last second to try to renew a Krb5 ticket as it ↵Gerald Carter1-2/+4
is took late (This used to be commit 5575845952171aaeae81cf65fe32be33cc1b45ba)
2007-10-10r21614: The memset() called on aligned memory was causing crashesGerald Carter1-0/+11
on x86_64 Linux boxes. Since it is not needed, just use malloc() on Linux. (This used to be commit 3644bd999621e04b3fae262f172e93ea8fdcd47e)
2007-10-10r21613: perform variable subsitution on home directories and shells provided ↵Gerald Carter1-12/+13
by the nss_info backend (This used to be commit a9028612a3f614579b28f9560cc67aef90b31cf8)
2007-10-10r21612: Make pam_winbind do the same username fixup on AIX as the WINBINDDGerald Carter1-2/+32
LAM module does to work around a system that does not support >8 character usernames. Without the change, pam_winbind tries to authenticate _#uid in the domain. (This used to be commit 7f0ba72e05acbd958fbf768a04d16c29189dc8f7)
2007-10-10r21611: I'm not entirely sure about this patch but it is working.Gerald Carter1-13/+66
su - DOM\user was unable to set the process crendentials without listing the "id" and other attributes in the attrlist[]. More fixes to come, but I didn't want this to get lost. (This used to be commit 4c53d300fa3516a4c5113bc94dfd07413c46b038)
2007-10-10r21609: Fix memory leaks in error code paths (and one in winbindd_group.c).Jeremy Allison2-2/+7
Patch from Zack Kirsch <zack.kirsch@isilon.com>. Jeremy. (This used to be commit df07a662e32367a52c1e8473475423db2ff5bc51)
2007-10-10r21606: Implement escaping function for ldap RDN valuesSimo Sorce1-9/+1
Fix escaping of DN components and filters around the code Add some notes to commandline help messages about how to pass DNs revert jra's "concistency" commit to nsswitch/winbindd_ads.c, as it was incorrect. The 2 functions use DNs in different ways. - lookup_usergroups_member() uses the DN in a search filter, and must use the filter escaping function to escape it Escaping filters that include escaped DNs ("\," becomes "\5c,") is the correct way to do it (tested against W2k3). - lookup_usergroups_memberof() instead uses the DN ultimately as a base dn. Both functions do NOT need any DN escaping function as DNs can't be reliably escaped when in a string form, intead each single RDN value must be escaped separately. DNs coming from other ldap calls (like ads_get_dn()), do not need escaping as they come already escaped on the wire and passed as is by the ldap libraries DN filtering has been tested. For example now it is possible to do something like: 'net ads add user joe#5' as now the '#' character is correctly escaped when building the DN, previously such a call failed with Invalid DN Syntax. Simo. (This used to be commit 5b4838f62ab1a92bfe02626ef40d7f94c2598322)
2007-10-10r21566: If we're going to be broken, at least be *consistently*Jeremy Allison1-1/+9
broken :-). This will do until Simo fixes the escape calls properly. Jeremy. (This used to be commit b7d91ec1b20f8d58903a3283f7789a30041461be)
2007-10-10r21548: prevent segv (reference to -1 element of array)Herb Lewis1-1/+2
(This used to be commit b5fd72282da85f50a040fd949752bc71023ff055)
2007-10-10r21537: Avoid to trigger the confusing "cached entry differs." warning whenGünther Deschner2-2/+20
there is just no cache around for a user. Guenther (This used to be commit a6c249b59228c6891cde624f72fff23879dbd19f)
2007-10-10r21530: Don't code with jet-lag and Volker looking over yourJeremy Allison1-1/+1
shoulder.... Correct fix for warning :-) Jeremy. (This used to be commit 773001870d22ef4ff7ec00f73661b59a63cade42)
2007-10-10r21529: Fix warning from bad cast.Jeremy Allison1-1/+1
Jeremy. (This used to be commit 34675624e2be886188337a883a6c4a57ef7e3fe3)
2007-10-10r21525: Go ahead and checkin the mlock() & memalign() fixes soGerald Carter2-22/+10
others don't get stuck with the winbindd hang. Still waiting on additional confirmation from Guenther that this fixes thes issues he was observing as well. But it's been running in my local tree for a day without problems. (This used to be commit 0d2b80c6c4a744b05a0efdec352cddccc430e0c4)
2007-10-10r21508: Fix memleak in new idmap_tdb, thanks Herb.Simo Sorce1-12/+4
Jerry please check. Simo. (This used to be commit a5354aa9a0bd860500356f45d09fce3d01649c60)
2007-10-10r21505: make sure mlock()'d memory is aligned on a page boundaryGerald Carter2-7/+26
(This used to be commit 52e6a2ceab794875781575ed17ec86808f6e26da)
2007-10-10r21500: Fix inappropriate creation of a krb5 ticket refreshing event when a userGünther Deschner3-6/+68
changed a password via pam_chauthtok. Only do this if a) a user logs on using an expired password (or a password that needs to be changed immediately) or b) the user itself changes his password. Also make sure to delete the in-memory krb5 credential cache (when a user did not request a FILE based cred cache). Finally honor the krb5 settings in the first pam authentication in the chauthtok block (PAM_PRELIM_CHECK). This circumvents confusion when NTLM samlogon authentication is still possible with the old password after the password has been already changed (on w2k3 sp1 dcs). Guenther (This used to be commit c3005c48cd86bc1dd17fab80da05c2d34071b872)
2007-10-10r21474: Ensure trustdom_cache_shutdown() gets calledJeremy Allison1-4/+4
on terminate. Pointed out by Herb. Jeremy. (This used to be commit 08998b74a51acd55eb6cbe095e682e2a79334736)
2007-10-10r21454: Fix debug typo.Günther Deschner1-1/+1
Guenther (This used to be commit 5c4a58ff3ab261e32789f39f2cf478367b727318)
2007-10-10r21450: No need to TALLOC_FREE twice here.Günther Deschner1-2/+0
Guenther (This used to be commit ad063d9a944e923777e538c2cb050d47f9f8bea0)
2007-10-10r21399: need to zero the request and response structuresHerb Lewis1-0/+3
(This used to be commit aa8f306fa545af653d8288919fa5a3b80f447bec)
2007-10-10r21397: revert accidential commitHerb Lewis1-1/+1
(This used to be commit 9fe5f7885771e68b11c7794653d0e4771eeac403)
2007-10-10r21396: fix wbinfo --lookup-rids commandHerb Lewis2-4/+19
allow detection of libbiconv if all others fail - need for FreeBSD (This used to be commit 7acc9421b0643cb04bff1f1d98ecb899f9b09601)
2007-10-10r21394: Prevent nscd crash due to potential NULL pointer dereference inGünther Deschner1-0/+4
_nss_winbind_initgroups_dyn() on an empty group list. Guenther (This used to be commit 155b9e7c74d1a623e018fc2f8ca2e32e4aa3f213)
2007-10-10r21387: Another important fix for non-AD domains:Günther Deschner2-7/+3
Avoid assigning 0 as primary group id for users in NSS calls. Jerry, please check. Guenther (This used to be commit 03f5f7d0140c99411c137e7e2eac7e2d0c08202e)
2007-10-10r21382: Important fix for winbind when using non-AD domains.Günther Deschner1-1/+7
Jeremy, I'm afraid you removed the "domain->initialized" from the set_dc_types_and_flags() call when the connect to PI_LSARPC_DS failed (with rev. 19148). This causes now that init_dc_connection_network is called again and again which in turn rescans the DC each time (which of course fails each time with NT_STATUS_BUFFER_TOO_SMALL). Just continue with the non-PI_LSARPC_DS scan so that the domain is initialized properly. Guenther (This used to be commit c6f63a08f55a4121cbe5aac537d2ef983dc25a97)
2007-10-10r21358: Some more debugging for _nss_winbind_initgroups_dyn() on Linux.Günther Deschner1-0/+12
Guenther (This used to be commit 639b7989b3ad1438a443a33dc41115bcc90f72d2)
2007-10-10r21357: Fix typo.Günther Deschner1-1/+1
Guenther (This used to be commit e3c32583795631212dc0d5cd01981b27cde2a489)
2007-10-10r21353: In the turn of tracking down nss_winbind related bugs on Linux:Günther Deschner1-19/+100
print NSS_STATUS code with DEBUG_NSS when leaving a function. Guenther (This used to be commit 53ecd63d94fd0a502ef5cdeb512c8e38795698e1)
2007-10-10r21336: Fix indent (as pointed out by Volker).Günther Deschner1-6/+6
Guenther (This used to be commit dcbf7a1250aa5c6293ffba6a930ee23537ec9484)
2007-10-10r21318: Fix Bug #4225.Günther Deschner2-11/+69
Cached logon with pam_winbind should work now also for NT4 and samba3 domains. Guenther (This used to be commit b2f91154820219959b8008b15802c70e1d76d158)
2007-10-10r21310: Fix invalid printfs in pam_winbind.Günther Deschner1-12/+20
Guenther (This used to be commit 5a7b2fccb3cdc6a849aedcd256eea86faec1d54c)
2007-10-10r21309: Add PRINTF_ATTRIBUTE checks for log statements.Günther Deschner1-0/+3
Guenther (This used to be commit 968dfcc8218cacdd97c2c66929e95f5062ff464a)
2007-10-10r21308: Fix some typos and ensure to null terminate the correct strings.Günther Deschner3-6/+6
Guenther (This used to be commit 16c90f30b93f32c4f8fed00a6cc154c596e4244d)
2007-10-10r21284: Fix some unitilized variable warnings pointed out by Volker.Gerald Carter1-4/+6
(This used to be commit 5c3edad86098c5271cb141b8f7885ca7f5b48072)
2007-10-10r21240: Fix longstanding Bug #4009.Günther Deschner3-15/+33
For the winbind cached ADS LDAP connection handling (ads_cached_connection()) we were (incorrectly) assuming that the service ticket lifetime equaled the tgt lifetime. For setups where the service ticket just lives 10 minutes, we were leaving hundreds of LDAP connections in CLOSE_WAIT state, until we fail to service entirely with "Too many open files". Also sequence_number() in winbindd_ads.c needs to delete the cached LDAP connection after the ads_do_search_retry() has failed to submit the search request (although the bind succeeded (returning an expired service ticket that we cannot delete from the memory cred cache - this will get fixed later)). Guenther (This used to be commit 7e1a84b7226fb8dcd5d34c64a3478a6d886a9a91)
2007-10-10r21231: get rid of unused defines that cause a redefined warningHerb Lewis1-2/+0
(This used to be commit 509ae5ffa17be340c41fecaaace75816c18316c6)
2007-10-10r21228: Fix for fd leak on error path. Thanks toJeremy Allison1-1/+3
dleonard@vintela.com for this fix ! Jeremy. (This used to be commit 70b5db7d8c6aa324ad98436fe3fafe715c04c5a8)
2007-10-10r21182: * Refactor the code to obtain the LDAP connection credentialsGerald Carter2-123/+125
from both idmap_ldap_{alloc,db}_init() * Fix the backwards compat support in idmap_ldap.c * Fix a spelling error in the idmap_fetch_secret() function name (This used to be commit 615a10435618abb89852910a0d36c1d9ff35647f)
2007-10-10r21180: fix backwards compatible idmap backends parameter parsingGerald Carter1-6/+17
(This used to be commit 01af19cc9d8e282ffd6ff6b52699ed2d0369ff69)
2007-10-10r21161: Another fix for pam_winbind: Move the entire pwd expiry handling intoGünther Deschner1-14/+14
the PAM_SUCCESS block. Guenther (This used to be commit f4a704745cb0bd2c5dc2a9b16619d8ee30fd7ba1)
2007-10-10r21160: Some more pam_winbind fixes:Günther Deschner1-32/+79
* Consolidate all pam_winbind password expiry warnings in the one _pam_send_password_expiry_message() call. * Also convert some more NTSTATUS codes to error messages. * Add paranoia check to only do all the post-processing after PAM_SUCCESS. Guenther (This used to be commit 02713f314b65a14e659e801f7eebea453756ac44)
2007-10-10r21159: Cleanup pam_sm_chauthtok() in pam_winbind:Günther Deschner2-31/+44
Set info3 strings, krb5ccname and returned username after we changed a password and sucessfully re-authenticated afterwards. In that case we ended up without this information. Guenther (This used to be commit 034d42ba7236e67303a8221b7a613799d1a61b83)
2007-10-10r21158: Add _pam_setup_krb5_env() and _pam_warn_logon_type() functions forGünther Deschner1-31/+70
pam_winbind. Guenther (This used to be commit 1feb961577475dceb97948cd2fdb987005890498)
2007-10-10r21155: Forgot one _PAM_LOG_STATE_DATA_STRING call (only in 3_0).Günther Deschner1-0/+1
Guenther (This used to be commit 86b34cd5d6675c8f0a0becdcded36de4a815c898)
2007-10-10r21154: Add PAM_WINBIND_LOGONSERVER, also merge the various pam_set_data calls.Günther Deschner2-36/+69
Guenther (This used to be commit 97a0b1b79499af10930500ce857c93ffbacfdb6e)
2007-10-10r21152: Correctly omit pam conversations when PAM_SILENT has been set by theGünther Deschner2-57/+61
calling application. Guenther (This used to be commit ebfae9a671d2c960178228ba7fdcd07cb2f49a05)
2007-10-10r21151: applying patches for CVE-2007-045[34]Gerald Carter1-2/+4
(This used to be commit 1d46b2ae3447b3521987b2ab1064a6ea314cfa07)
2007-10-10r21149: Only say we are a groupmember for the optimized (rid 513) membershipGünther Deschner1-1/+4
lookup when we actually are. Although the Linux nss winbind backend protects against num_mem != 0 && buf == NULL. Guenther (This used to be commit a9ac4630b46242f88bd7a4e92511b55cc82e9940)
generated by cgit (git 2.34.1) at 2024-11-15 08:32:34 +0000