Age | Commit message (Collapse) | Author | Files | Lines |
|
(This used to be commit 6f3cd9e2af7f1b4bdd7cb0e487987de159bb0dd8)
|
|
our primary domain - new domains are added to the front of the list. :-(
Use a much more reliable 'flag test' instead. (note: changes winbind structures, make clean).
Andrew Bartlett
(This used to be commit cc050e01370633a985c9878bdce297f9175fdbf7)
|
|
- Fill in the 'backup' idea of a domain, if the DC didn't supply one. This
doesn't seem to occour in reality, hence why we missed the typo.
lib/charcnv.c:
lib/smbldap.c:
libads/ldap.c:
libsmb/libsmbclient.c:
printing/nt_printing.c:
- all the callers to pull_utf8_allocate() pass a char ** as the first
parammeter, so don't make them all cast it to a void **
nsswitch/winbind_util.c:
- Allow for a more 'correct' view of when usernames should be qualified
in winbindd. If we are a PDC, or have 'winbind trusted domains only',
then for the authentication returns stip the domain portion.
- Fix valgrind warning about use of free()ed name when looking up our
local domain. lp_workgroup() is maniplated inside a procedure that
uses it's former value. Instead, use the fact that our local domain is
always the first in the list.
Andrew Bartlett
(This used to be commit 494781f628683d6e68e8ba21ae54f738727e8c21)
|
|
Push the unix username into utf8 for it's trip across the socket.
Andrew Bartlett
(This used to be commit 3225f262b18bdcf326d3bfd031dac169bd9347c9)
|
|
Instead of returning a name in DOMAIN\user format, we now return it in the
same way that nsswtich does - following the rules of 'winbind use default
domain', in the correct case and with the correct seperator.
This should help sites who are using Squid or the new SASL code I'm working
on, to match back to their unix usernames.
Andrew Bartlett
(This used to be commit 7a3a5a63612b2698a39f784859496c395505a79b)
|
|
(This used to be commit 46b2fb4db5c7e273a9b43c59340a0a47ade5bd5e)
|
|
(This used to be commit 9c70e4b44e0dda8f2af4172b928437bd9d3e8b7c)
|
|
(This used to be commit 550b309a65d138364502c720894e2099de6b5076)
|
|
Let the build farm chew on it for a bit.
(This used to be commit 41e4b036dff0af7be69bf95ea3d64dfccd3a4b8e)
|
|
the full name in gecos field; bug 587
(This used to be commit 329065d7cddb52c52667c93e0a0218c0e89938be)
|
|
(This used to be commit df14b0af31863680218b06ae9de2f010a38fba6e)
|
|
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of data structures...
(This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
|
|
winbind functions to be accessed via NSS. This provides a much cleaner
way for applications that need (for example) to provide name->sid
mappings to do this via NSS rather than having to know the winbindd
pipe protocol (as this might change).
This patch also adds a varient of the winbindd_getgroups() call called
winbindd_getusersids() that provides direct SID->SIDs listing of a
users supplementary groups. This is enough to allow non-Samba
applications to do ACL checking.
A test program for the new functionality will be committed shortly.
I also added the 'wbinfo --user-sids' option to expose the new
function in wbinfo.
(This used to be commit 702b35da0ac7c73aa5a6603f871d865565bbe278)
|
|
compilation, but that allows Samba3 to take advantage of pre-compiled
headers in gcc if available.
(This used to be commit b3e024ce1da7c7e24fcacd8a2964dd2e4562ba39)
|
|
UNIX entity foo to DOMAIN\foo instead of SERVER\foo
on members of a Samba domain when all UNIX accounts
are shared via NIS, et. al.
* allow winbindd to match local accounts to domain SID
when 'winbind trusted domains only = yes'
* remove code in idmap_ldap that searches the user
suffix and group suffix. It's not needed and
provides inconsistent functionality from the tdb backend.
This has been tested. I'm still waiting on some more feedback
but This needs to be in 3.0.1pre2 for widespread use.
(This used to be commit ee272414e9965d7d550ba91d4e83997134dd51e6)
|
|
(This used to be commit 0519a7022b4979c0e8ddd4907f4b858a59299c06)
|
|
functions.
(This used to be commit 7710232ba21305a1e3c9523ace82a5a419526b50)
|
|
Jeremy.
(This used to be commit 119a89246bf84cb98b76cf3777c039fa8eb644f2)
|
|
platforms don't have setenv().
(This used to be commit a8b487c4cb5d181e59755f49063512b2729bccb5)
|
|
is given (patch from Tom Dickson)
(This used to be commit ca18ec0f901330c14a68c8a44d2a88a42bb7d92c)
|
|
in iconv.c and nsswitch/). Using them means you're not thinking about multibyte at
all and I really want to discourage that.
Jeremy.
(This used to be commit d7e35dfb9283d560d0ed2ab231f36ed92767dace)
|
|
(This used to be commit f0a0771c02404c91cd64961f85622022a4e56b2f)
|
|
(This used to be commit 1482933089bd1e6114ad29d77ce229482f2d161b)
|
|
DEBUG() should not be called in winbind client code as it's actually
dynamically linked by glibc into programs that use the nsswitch
database functions.
(This used to be commit 90380a684af244175d216344101e734c85220a7b)
|
|
socket and add a comment to winbindd.c to explain the fancy calculation of
buffer offset.
(This used to be commit 7c7ef9680b7378e12ffdd0bf95ee7ad673bea2f5)
|
|
(This used to be commit 5eca81c66096a01eda1731892d044c09d4c18556)
|
|
down; bug 437
(This used to be commit 1cfbd92404270e0c67a3b295fc9cf461b29d3503)
|
|
(This used to be commit a83266a927b81a9f7a62b211793faaf8d401767c)
|
|
(This used to be commit e1fac713e25692a5790c3261ba323732930f5249)
|
|
Jeremy.
(This used to be commit a43ca66290ac1df9b00e3e43e32d8117b3d1b873)
|
|
(This used to be commit 02ae82fb3f70dc37e815d8e88bfd31a8c3ff43db)
|
|
There was some confusion over dynamically allocated lists of pointers
(i.e you have to make space for the list of pointers and what they are
pointing too) in the memory buffer passed in from libc.
Valgrind is much happer now and as a bonus there is no segfault.
(This used to be commit 7907c44414acb841a9001e82285790eece73d032)
|
|
ads_search_XXX() calls.
(This used to be commit 74c02e5fbc411d6fd1b13a1e21599da030897efe)
|
|
flushing connections in winbindd_pam_auth[_crap]()
(This used to be commit 60c8796edd84249db5419329a0fea4bbc7f9bb98)
|
|
already have ads_search_retry() for this. However, neither
domain_sid() nor sequence_nunber() used this function. So modify
them to us ads_do_search_retry() so we can specify the base search
DN and scope.
(This used to be commit 89f6adf830187d020bf4b35d1a4b2b48c7a075d0)
|
|
smb.conf
Fixes to ensure we work with disable netbios = yes
(This used to be commit 3913e43724870c62a0d77ec3e73cbe9480cb6247)
|
|
(This used to be commit e3f5afb83142f44369dcd341d6e66ed2fe51248f)
|
|
Ken Cross. Sometimes ads conenction get stale but we don't know
they are dead until we try them. This patch may need some optimization
after people bang on it for a while.
(This used to be commit 7021cf63a4501c90620cf6a5f117eef345bbd291)
|
|
Also make sure thet ads_startup uses lp_realm instead of
just relying on the workgroup name. Fixes bug in net ads join
when the workgroup defaults to "WORKGROUP" and we ignore the
realm name.
(This used to be commit b1763ace4e85f41574894e3807cabb5196fec661)
|
|
if it already exists. FreeBSD 4.8 doesn't need the redefinition, 5.0 does.
(This used to be commit 4a3727b03b0488fa82687014cb476b1971a78be8)
|
|
nsswitch/pam_winbind.h so we can compile properly on this platform.
(This used to be commit 75411005fcab7ecf31940c5f7b87fd407166f98a)
|
|
(This used to be commit 934fb418a3a3628ee4cde699df872bc1035fc769)
|
|
Fix from Ken Cross.
(This used to be commit 45775b48a0d91390aa698b750d59cda0150cfbd0)
|
|
(This used to be commit 3324adcaceb9191b5d4d671ac9b51c85c6714598)
|
|
(This used to be commit ae452e51b02672a56adf18aa7a7e365eeaba9272)
|
|
(This used to be commit 2d85612752daa26c0773b86bd40eb3430b1cce3b)
|
|
- Make winbindd try to use kerberos for connections to DCs, so that it can
access RA=2 servers, particularly for netlogon.
- Make rpcclient follow the new flags for the NETLOGON pipe
- Make all the code that uses schannel use the centralised functions for doing so.
Andrew Bartlett
(This used to be commit 96b4187963cedcfe158ff02868929b8cf81c6ebf)
|
|
(This used to be commit 398bd14fc6e2f8ab2f34211270e179b8928a6669)
|
|
* bug #280 (my fault) - initialize sambaNextUserRid and
sambaNextGroupRid
* Unix users shared vis LDAP or NIS between a samba domain member
of a Samba domain are not seen as domain users on the member servers.
not as local users.
(This used to be commit a030fa373aefde8628def54ca8152f237a0467dc)
|
|
and workstation to utf8 before sending the winbindd request. Also, don't
continue when the call to pull_utf8() fails but rather return a winbind
error. (This is what was causing the crash)
(This used to be commit ca1c463360b75538a93b56a87cbb4a6ee7b6cec6)
|