summaryrefslogtreecommitdiff
path: root/source3/nsswitch
AgeCommit message (Collapse)AuthorFilesLines
2002-08-18be a bit more paranoid about not getting duplicate domain names (canAndrew Tridgell1-2/+8
happen when the LDAP call to get the flatname for the primary domain fails) (This used to be commit 8d40f34e2f5188f15f414e807d023bfea7bd8c8e)
2002-08-17Becouse of changes to the meaning of this feild over time, this doesn'tAndrew Bartlett1-17/+0
actually work. Also, the idea of 'loopback winbind' isn't that bad an idea anyway (potential PDC/BDC applications). Given all that, remove it... Andrew Bartlett (This used to be commit fc0d6e53fce1d05b16ec58c0bdc38aa8da4422c0)
2002-08-16Merge of netbios namecache code from APPLIANCE_HEAD.Tim Potter1-0/+2
Tridge suggested a generic caching mechanism for Samba to avoid the proliferation of little cache files hanging around limpet like in the locks directory. Someone should probably implement this at some stage. (This used to be commit dad31483b3bd1790356ef1e40ac62624a403bce8)
2002-08-07Add some more const :-)Andrew Bartlett1-3/+3
This also makes it a easier to see which paramaters are 'in', and which are 'out'. Andrew Bartlett (This used to be commit 122cf648d7f364c68ecb7a576a42e94a954e9e56)
2002-08-05fixed wbinfo -t for netbiosless domainsAndrew Tridgell1-1/+7
(This used to be commit 68e70b000b273ba72206c87ad1efd6efc2c7c487)
2002-08-05This fixes a number of ADS problems, particularly with netbioslessAndrew Tridgell6-125/+172
setups. - split up the ads structure into logical pieces. This makes it much easier to keep things like the authentication realm and the server realm separate (they can be different). - allow ads callers to specify that no sasl bind should be performed (used by "net ads info" for example) - fix an error with handing ADS_ERROR_SYSTEM() when errno is 0 - completely rewrote the code for finding the LDAP server. Now try DNS methods first, and try all DNS servers returned from the SRV DNS query, sorted by closeness to our interfaces (using the same sort code as we use in replies from WINS servers). This allows us to cope with ADS DCs that are down, and ensures we don't pick one that is on the other side of the country unless absolutely necessary. - recognise dnsRecords as binary when displaying them - cope with the realm not being configured in smb.conf (work it out from the LDAP server) - look at the trustDirection when looking up trusted domains and don't include trusts that trust our domains but we don't trust theirs. - use LDAP to query the alternate (netbios) name for a realm, and make sure that both and long and short forms of the name are accepted by winbindd. Use the short form by default for listing users/groups. - rescan the list of trusted domains every 5 minutes in case new trust relationships are added while winbindd is running - include transient trust relationships (ie. C trusts B, B trusts A, so C trusts A) in winbindd. - don't do a gratuituous node status lookup when finding an ADS DC (we don't need it and it could fail) - remove unused sid_to_distinguished_name function - make sure we find the allternate name of our primary domain when operating with a netbiosless ADS DC (using LDAP to do the lookup) - fixed the rpc trusted domain enumeration to support up to approx 2000 trusted domains (the old limit was 3) - use the IP for the remote_machine (%m) macro when the client doesn't supply us with a name via a netbios session request (eg. port 445) - if the client uses SPNEGO then use the machine name from the SPNEGO auth packet for remote_machine (%m) macro - add new 'net ads workgroup' command to find the netbios workgroup name for a realm (This used to be commit e358d7b24c86a46d8c361b9e32a25d4f71a6dc00)
2002-07-31Winbind updates!Andrew Bartlett7-29/+151
This updates the 'winbind' authentication module and winbind's 'PAM' (actually netlogon) code to allow smbd to cache connections to the DC. This is particulary relevent when we need mutex locks already - there is no parallelism to be gained anyway. The winbind code authenticates the user, and if successful, passes back the 'info3' struct describing the user. smbd then interprets that in exactly the same way as an 'ntdomain' logon. Also, add parinoia to winbind about null termination. Andrew Bartlett (This used to be commit 167f122b670d4ef67d78e6f79a2bae3f6e8d67df)
2002-07-31support netbiosless search for the DC using ADS in the winbindd AUTHAndrew Tridgell1-58/+110
code. (This used to be commit 3929532e3bfb98b925d73d331c8cbb319fdc8b9a)
2002-07-30Fixed for memory leak in connection caching code when a dc isTim Potter1-1/+13
permanently down. Found by Dan Coppock. (This used to be commit 13c0cc830e3d787a0c3a1aedd47641597026541e)
2002-07-24Add another message rather than 'internal module error'Andrew Bartlett1-0/+4
Andrew Bartlett (This used to be commit e09c4bd69aaec0dc43b5bf69f651cbfad3c5f4ad)
2002-07-21Another smattering of static and constAndrew Bartlett2-8/+8
(This used to be commit 897cc4a610932e596f8a9807213166e380ef0203)
2002-07-21Renamed all the new_cli_netlogon_* functions to cli_netlogon_*Tim Potter1-2/+2
as they're no longer new! (This used to be commit 277f6bbb9a63541a473a80a7994e9bde5c6f22dc)
2002-07-21Compilers do find bugs :-)Andrew Bartlett1-2/+1
This was a mixup between the enum type NSS_STATUS and a BOOL (extra test for equality). Andrew Bartlett (This used to be commit 63b7820b6585608c0ebb582ec8b28ed3c949a1f4)
2002-07-20Try to fix up warnings - particularly on the IRIX 64 bit compiler (which had aAndrew Bartlett3-5/+5
distinction between uchar and char). Lots of const etc. Andrew Bartlett (This used to be commit 8196ee908e10db2119e480fe1b0a71b31a16febc)
2002-07-15fixed a number of real bugs found by warnings on the 64 bit irix compilerAndrew Tridgell1-4/+4
(This used to be commit 04de6bbc8055e5547af41b10e284b722f40e726d)
2002-07-14after thinking about the env variable hack for avoiding group membershipAndrew Tridgell1-14/+20
enumeration I realised it could be a security hole for setuid progs. This adds a proper nss function instead. (This used to be commit c7c49d87af5e9a0bef058e6d79188d8b11fefc02)
2002-07-14this is a trick to work around the fact that posix does not supplyAndrew Tridgell6-9/+53
a getgr*() function that lists groups without numerating all the group members. Instead of definiing a new nss method (which might cause problems) I added an environment variable WINBIND_GETGRLST that tells winbind not to fill in the group members in a gergrent() request. This can speed up group listing by a factor of 20 or more (on my test system with 50000 groups it reduces the time from an hour to 2 minutes) (This used to be commit e3f73256d31ab9914daae49f41e984a534996870)
2002-07-13I just noticed that I never added my copyright when I messed with thisAndrew Bartlett1-0/+1
previously. Fix that. Andrew Bartlett (This used to be commit c552910477f0baca4d2173c2bdf4748de3c3b8ad)
2002-07-11Usage fixes from APPLIANCE_HEAD.Tim Potter1-1/+2
(This used to be commit 952d722a3bba15b7a10b4cbabb5548f4dde682d7)
2002-07-11Merge of init_domain_list() fix from APPLIANCE_HEAD.Tim Potter1-3/+0
(This used to be commit 66c9cab369e38284c71572bfb3643538e253a451)
2002-07-11this implements a completely new strategy for fetching groupAndrew Tridgell1-33/+83
membership from an ADS server. We now use a 'member' query on the group and do a separate call to convert the resulting distinguished name to a name, rid etc. This is *much* faster for very large numbers of groups (on a quantum test system with 10000 groups it drops the time from an hour to about 35 seconds). strangely enough, this actually *increases* the amount of ldap traffic, its just that the MS LDAP server answers these queries much faster. (This used to be commit 5538048e4f6dd224b2990f3c6a3e99fd07065f77)
2002-07-03Kill off codepage related stuff, now we don't use codepages any more.Andrew Bartlett1-4/+0
Andrew Bartlett (This used to be commit d1ca2b9f23ce701eb6b6becafb1acd813fc8fc3a)
2002-07-01used findstatic.pl to make some variables static and remove some deadAndrew Tridgell1-1/+1
code (This used to be commit 91ad9041e9507d36eb3f40c23c5d4df61f139ef0)
2002-07-01fixed a bug handling startup when the ads server is not contactableAndrew Tridgell1-1/+1
(This used to be commit dbfd4e5101599bcb85600e4c5c93ce5390b9aa91)
2002-06-27The next phase in the WINS rewrite!Andrew Tridgell1-2/+0
We now cope wiith multiple WINS groups and multiple failover servers for release and refresh as well as registration. We also do the regitrations in the same fashion as W2K does, where we don't try to register the next IP in the list for a name until the WINS server has acked the previos IP. This prevents us flooding the WINS server and also seems to make for much more reliable multi-homed registration. I also changed the dead WINS server code to mark pairs of IPs dead, not individual IPs. The idea is that a WINS server might be dead from the point of view of one of our interfaces, but not another, so we need to keep talking to it on one while moving onto a failover WINS server on the other interface. This copes much better with partial LAN outages and weird routing tables. (This used to be commit 313f2c9ff7a513802e4f893324865e70912d419e)
2002-06-26This commit finally gives us multiple wins server groups. We nowAndrew Tridgell2-33/+17
accept an extended syntax for 'wins server' like this: wins server = group1:192.168.2.10 group2:192.168.3.99 group1:192.168.0.1 The tags before the IPs don't mean anything, they are just a way of grouping IPs together. If you use the old syntax (ie. no ':') then an implicit group name of '*' is used. In general I'd recommend people use interface names for the group names, but it doesn't matter much. When we register in nmbd we try to register all our IPs with each group of WINS servers. We keep trying until all of them are registered with every group, falling back to the failover WINS servers for each group as we go. When we do a WINS lookup we try each of the WINS servers for each group. If a WINS server for a group gives a negative answer then we give up on that group and move to the next group. If it times out then we move to the next failover wins server in the group. In either case, if a WINS server doesn't respond then we mark it dead for 10 minutes, to prevent lengthy waits for dead servers. (This used to be commit e125f06058b6b51382cf046b1dbb30728b8aeda5)
2002-06-25Update cli_full_connection() to take a 'flags' paramater, and try to get aAndrew Bartlett1-1/+1
few more places to use it. Andrew Bartlett (This used to be commit 23689b0746d5ab030d8693abf71dd2e80ec1d7c7)
2002-06-25Add a couple more DEBUG()s to winbindd.Andrew Bartlett1-4/+9
Andrew Bartlett (This used to be commit 3b2464ffdad5e64a05e227b50116cb59f6d34204)
2002-06-20Fix from Andrew Esh for not checking return code.Jeremy Allison1-0/+3
Jeremy. (This used to be commit 629cea2ff4f640cd60d9ecfa72acf2707b3f1ff4)
2002-06-18more debug classess activatedSimo Sorce14-0/+40
(This used to be commit 897e64d2e0c1d04ab93441ccaffe369bf43be46e)
2002-06-13Latest patch from metze <metze@metzemix.de> to move most of samba acrossAndrew Bartlett3-7/+9
to using SIDs instead of RIDs. The new funciton sid_peek_check_rid() takes an 'expected domain sid' argument. The idea here is to prevent mistakes where the SID is implict, but isn't the same one that we have in the struct. Andrew Bartlett (This used to be commit 04f9a8ff4c7982f6597c0f6748f85d66d4784901)
2002-06-12Ignore winbindd_proto.hTim Potter1-0/+1
(This used to be commit 8e51081333ae0b81a2aa2c609aa7a3ff8bf7f4ec)
2002-06-10Remove "sids.h" as it really wasn't being used anywhere, and was exportingAndrew Bartlett3-2/+1
the (now static) global_sam_sid. The only place it was being used was to return global_sid_NULL to some uid->sid functions - and I'm not convinced this is correct in any case. Andrew Bartlett (This used to be commit e2a76a7fc94dd59c09bba3cda91446fad9f8c0e0)
2002-06-10With this file being automaticly regenerated, and cleaned up with 'make clean'Andrew Bartlett1-142/+0
I think it should be removed from CVS. This matches the other proto files. Andrew Bartlett (This used to be commit 5a8d573f1784b037fd848d85a96dabfebfad63fd)
2002-06-07Merge pidfile fix.Jeremy Allison1-3/+3
Jeremy. (This used to be commit 2c1e78702423ba17993975eb7f158058cc7f229f)
2002-06-05Store cache entry keys that have RID values in decimal to beTim Potter1-6/+6
consistent with other keys. (This used to be commit 1e5bdf974fb1e64b5f5b82e0e24eb97aeb229584)
2002-06-05Fix for Linux kernel bug where signal mask set within a signal handlerJeremy Allison1-1/+15
is being ignored on sighandler exit. This means we have to have a small array of fd's, not a single one. Jeremy. (This used to be commit b06862e2de8d3bafbc10a9807501ef5bf148a61c)
2002-06-04Store the key for a name to sid cache entry in upper case rather thanTim Potter1-4/+12
whatever case the request was made in. This gets rid of duplicate cache entries. Also when doing a sid to name, prime the cache with the name to sid mapping result. We can't do the reverse as we don't know the correct case of the name to store in the cache. (This used to be commit f268b0d5fb811b364578b11a66ca69973717eea8)
2002-06-04Fixed some formatting.Tim Potter1-3/+4
(This used to be commit 25554b46ded273e8f4070f14661b691ccc9ddd17)
2002-06-03fixed some debug messagesAndrew Tridgell1-2/+2
(This used to be commit 8b5ac00ac60135f83145c65425d7b33a751a15b4)
2002-06-02The last element of the definitions of enums can't have a trailingTim Potter1-1/+1
comma. Only initialisers can have this in ANSI C. (This used to be commit b6119f583552425c2be30662e9325270a5dbf096)
2002-05-29merge from 2.2Gerald Carter1-1/+1
(This used to be commit 612584f7d5383db28960e1ae9aaeaa9b8b47486c)
2002-05-28Updates to better report some NTSTATUS errors into PAM, and update to PAMAndrew Bartlett1-0/+9
to correctly allow password changes on expired passwords. (No security implications, as its just a 'will I let you talk to the server' check). pam_winbind checks the password prior to changing it, so that users don't have to make up and type their new password when they havn't even got the old one right. This also helps with stacking etc. Andrew Bartlett (This used to be commit 2b78d493002a3ba13533429c6a14f5c0a92f43d1)
2002-05-24Fixed incorrect comment.Tim Potter1-2/+2
(This used to be commit 2f74fb6e9893d306598ebedd54658f2dd56e988e)
2002-05-24Remove the password length paramater from cli_full_connection - it reallyAndrew Bartlett1-1/+1
didn't make any sense, and its was always just strlen(password) anyway. This fixes it to be strlen(password)+1 Andrew Bartlett (This used to be commit c205b18bd6b9b69200ff3db55f2c641631d4ab40)
2002-05-21debug classizedSimo Sorce3-0/+9
(This used to be commit ae5d24873ad0fb3df970cc9912e18e6a5067ae2d)
2002-05-19A small change to print out the error message only if we could not check theRichard Sharpe1-4/+5
secrets ... (This used to be commit 56eea2623a8a8f2a5a0311cda6d0282d0037a3cc)
2002-05-18As per rsharpe's request, require only a Masters in Astrophysics toAndrew Bartlett2-16/+18
correctly configure winbind. (Next job: Fill in the 'error_msg' field with somthing useful) (This used to be commit 49ee2a25c131641887cbc438a6336652f042cfb0)
2002-05-17A few more trusted domains updates from mimir.Andrew Bartlett1-2/+3
I think we may still need to look at our server enumeration code, but other than that, its much better in the tree than out. Andrew Bartlett (This used to be commit d57a1b4629d12a0374cc6d74dfc6f5d4793fcef8)
2002-05-17Changes to allow head to translate NMB flags ...Richard Sharpe2-8/+8
(This used to be commit c986a19cde0dfa96b512eb24d873203981e68c48)
generated by cgit (git 2.34.1) at 2024-12-14 19:25:36 +0000