summaryrefslogtreecommitdiff
path: root/source3/passdb/passdb.c
AgeCommit message (Collapse)AuthorFilesLines
2003-11-24more access fixes for group enumeration in LDAP; bug 281Gerald Carter1-3/+14
(This used to be commit c4ce92e80688fe7fd4b2fde2c31e94baf3e4dca0)
2003-11-17* make sure we only enumerate group mapping entriesGerald Carter1-14/+0
(not /etc/group) even when doing local aliases * remove "hide local users" parameter; we have this behavior built into 3.0 (This used to be commit 3b75e862dfba42c95e2279c300c06bb981f52993)
2003-11-03TDBSAM update code from Aur?lien Degr?mont <adegremont@idealx.com>.Jeremy Allison1-10/+442
Adds support for an additional field (uint32) which represents the lockout duration. I think this should be stored as an abolute UNIX time_t that specifies when the lockout should end - set it when the lockout is imposed. This new code also updates the on disk tdb version on load. Being merged into HEAD so Simo can add any other changes he wants before being back-ported to SAMBA_3_0. Jeremy. (This used to be commit 0eea3f22aba25c1d0a8800bb1725238422cb30eb)
2003-10-10Match Samba 2.2, and make ACB_NORMAL the default ACB value.Andrew Bartlett1-0/+7
(Samba 2.2 did this in the LDAP code, but it fits better as a generic thing) Andrew Bartlett (This used to be commit 36ccf922a34127f2eb6b7da590e426544539ab25)
2003-10-09Merge from 3.0:Tim Potter1-1/+1
>Typo in error message. >Jeremy. (This used to be commit 85eda9bc0c3d0e62c436a3958ec4a76d0e909d4c)
2003-09-18The "unknown_5" 32 bit field in the user structs is actually 2 16-bitJeremy Allison1-7/+13
fields, bad_password_count and logon_count. Ensure this is stored/fetched in the various SAMs. As it replaces the unknown_5 field this fits exactly into the tdb SAM without any binary problems. It also is added to the LDAP SAM as two extra attributes. It breaks compatibility with the experimental SAMs xml and mysql. The maintainers of these SAMs must fix them so upgrades like this can be done transparently. I will insist on the "experimental" status until this is solved. Jeremy. (This used to be commit 71ecd10181cd35313b79f618c2928c2f45424812)
2003-09-18Oops. Proper fix for #470.Jeremy Allison1-18/+20
Jeremy. (This used to be commit e121a2ec0c243477ea318d573166f342abbd1cce)
2003-09-18Fix for #470 - unable to display SIDs in ACLs.Jeremy Allison1-2/+11
Jeremy. (This used to be commit 1b343f710550a39815001c668c48d9b194f19243)
2003-09-15Merge from Samba 3.0:Tim Potter1-29/+8
>remove getpwnam() calls from init_sam_from_xxx(). >This means that %u & %g will no longer expand, but %U >and %G still do. The payback is that winbindd local >accounts for users work with 'wbinfo -u' when winbind >is running on a PDC. (This used to be commit f047e24561688c697179b14549b1800e00b2a435)
2003-09-09sync 3.0 into HEAD for the last timeGerald Carter1-13/+92
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
2003-08-02port latest changes from SAMBA_3_0 treeSimo Sorce1-5/+5
(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)
2003-07-16trying to get HEAD building again. If you want the codeGerald Carter1-41/+705
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
2003-05-18port fixes from 3.0Simo Sorce1-8/+2
(This used to be commit 0d098df8b5db02c73b859aea136d01c9ca42b17a)
2003-05-16Merge get_global_sam_name() from 3.0 to fix compile breakage.Tim Potter1-0/+8
(This used to be commit bc71d7a4ab70339cfd815a57448cbd8762d5ce38)
2003-05-14spellingTim Potter1-2/+2
(This used to be commit 249a6974702d050644d6d61f33f0034ce2a689ee)
2003-05-02shouldn't wellknown group be well.. ..WKN_GRP ?Simo Sorce1-2/+1
make a new sam_Account contain our domain by default, windows will complain on logon otherwise. fix stupid typo in idmap_util.c (This used to be commit 21701876dc6c59ebfc51be708a98226a00a764e0)
2003-05-01proper wellknown sids initialization at startupSimo Sorce1-3/+3
(This used to be commit 568feee8977ee1be210344c8ab1896512894cba2)
2003-05-01*id_to_*id call reshape to return NTSTATUS errorsSimo Sorce1-5/+3
plus internal fixes 1st stage (This used to be commit 6d036761e565bc93964bb3c939d5b7d78d5778a3)
2003-04-30correctly initiazlize idmap tdb when creationg newSimo Sorce1-53/+0
few fixes to *id_to_*id functions, we don't set the mapping for algoritmic RIDs, they are resolved in the classic way eliminate getpw* calls from tdbsam (This used to be commit 6a7689cf74cd4d5f29e0b12f4bf8ac3051d49157)
2003-04-29This is a nice rewrite:Simo Sorce1-7/+3
SAM_ACCOUNT does not have anymore uid and gid fields all the code that used them has been fixed to use the proper idmap calls fix to idmap_tdb for first time idmap.tdb initialization. auth_serversupplied_info structure has now an uid and gid field few other fixes to make the system behave correctly with idmap tested only with tdbsam, but smbpasswd and nisplus should be ok have not tested ldap ! (This used to be commit 6a6f6032467e55aa9b76390e035623976477ba42)
2003-04-29Some passdb backends really don't like having no primary group - so alwaysAndrew Bartlett1-34/+25
set one - new accounts -> domain users, unless otherwise specified. This moves that logic from pdb_set_sam_sids() into pdb_init_sam_new(), which is called by all the 'new account' creators. (pdb_set_sam_sids() now only deals with the mapping from an existing account) Andrew Bartlett (This used to be commit 2c7b3d9fd5bb327bdbd34ec27b36eb59cbc481af)
2003-04-29Merge 3.0's change to how we add users onto HEAD, including a few other bitsAndrew Bartlett1-25/+36
of sync-up for the rpc_server/srv_samr_nt.c Andrew Bartlett (This used to be commit 3c867aedd9abc29389f5d049dbc94ada6738d1b0)
2003-04-29ok next_rid out as well local_*id_to*id functionsSimo Sorce1-296/+52
reverted user making function, did not pass the abartlet test :-) idmap is now fully integrated, we only miss user creation and removal of uid and gid from SAM_ACCOUNT (This used to be commit 67af8c26586c4829166795813a373bf9be27b753)
2003-04-28new helper functions to create usersSimo Sorce1-1/+154
(This used to be commit 74826e7ebb62ab09df68bb00fbd6097852ec5b6d)
2003-04-16Adjust comment to respect change to no longer use unixsam by default...Andrew Bartlett1-3/+2
(This used to be commit 87f491d6a63e0818ada4ed21dd1f4905b20f846c)
2003-02-22Fix comment - the other bits of code don't call this any more.Andrew Bartlett1-4/+1
(This used to be commit 523d1429b1072c999d376d2b4e13a1c08349990a)
2003-02-22Remove 'unixsam' from the default passdb backends.Andrew Bartlett1-3/+3
The intention is to remove the muliple passdb backends, but we need the 'guest' account to always be there. If the admin adds the guest account to (say) LDAP, there will only be one backend required for operation. This helps remove some nasty behaviours with adding accounts to the system for both the RPC 'create user' and the SAMSYNC code. Users 'added' with an 'add user/machine' script won't magicly appear, and machine accounts 'pre-added' to unix, but not the smbpasswd file will not cause mayhem. This commit also implements somthing tridge discussed with me, the concept of 'default' passdb operation pointers - so that each backend does not need it's own stub funcitons wrapping the default tdb privilages/group mapping code. This also removes an implicit 'sid->name' and 'name->sid' mapping from our own local SID space, to winbind usernames. When adding mapping for NIS/LDAP non-sam users in future, we need to be careful. Andrew Bartlett (This used to be commit 6f32fa234961a525760a05418a08ec48d22d7617)
2003-01-02We already have one function to move unistr2 -> multibyte-static, so weAndrew Bartlett1-19/+0
don't need a second just for pdb. Also, remove magic 'is lp_guest_account' test - the magic RID should be up to the passdb backend to set. Andrew Bartlett (This used to be commit f71c8338d35a2e8c73c3d8006ea6858cb522c715)
2003-01-02BIG patch...Andrew Bartlett1-2/+2
This patch makes Samba compile cleanly with -Wwrite-strings. - That is, all string literals are marked as 'const'. These strings are always read only, this just marks them as such for passing to other functions. What is most supprising is that I didn't need to change more than a few lines of code (all in 'net', which got a small cleanup of net.h and extern variables). The rest is just adding a lot of 'const'. As far as I can tell, I have not added any new warnings - apart from making all of tdbutil.c's function const (so they warn for adding that const string to struct). Andrew Bartlett (This used to be commit 92a777d0eaa4fb3a1c7835816f93c6bdd456816d)
2002-12-20Forward port the change to talloc_init() to make all talloc contextsJeremy Allison1-1/+1
named. Ensure we can query them. Jeremy. (This used to be commit 842e08e52a665ae678eea239759bb2de1a0d7b33)
2002-11-12Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison1-8/+6
dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit 82b8f749a36b42e22186297482aad2abb04fab8a)
2002-11-07when doing a 'net rpc vampire' a pdb_init_sam_pw() is used to create aAndrew Tridgell1-0/+3
sam account object, then pdb_update_sam_account() can be used to update an account. This code path could lead to the methods element of the account being used when uninitialised (leading to a segv) Easiest fix is to always make that that when creating a sam_account object we initialise the methods to null, so that the passdb code knows that it needs to be filled in. (This used to be commit fb79fa5a31c2fa8ebdcddbc49b1d9c1aa3059691)
2002-11-03Extra little fix to vl's patch. Make sure the passdb and testparm messagesAndrew Bartlett1-3/+5
say exactly the same thing - in particular that we can algorithmic rid base == 1000, and use the BASE_RID macro to avoid the use of magic numbers. Andrew Bartlett (This used to be commit b70f2a8047ac549841bc103932b38951e9814186)
2002-11-03Force algorithmic rid base to sane values and talk about it.Volker Lendecke1-4/+25
Volker (This used to be commit ce5b2d991b42bbf6865ff75194f8ee4b46694841)
2002-10-21This moves the group mapping API into the passdb backend.Volker Lendecke1-7/+7
Currently this calls back to mapping.c, but we have the framework to get the information into LDAP and the passdb.tdb (should we? I think so..). This has received moderate testing with net rpc vampire and usrmgr. I found the add_groupmem segfault in add_aliasmem as well, but that will be another checkin. Volker (This used to be commit f30095852fea19421ac8e25dfe9c5cd4b2206f84)
2002-10-17Revert changesVolker Lendecke1-1/+1
(This used to be commit 975fd17f8af0f03f43995deb3fdd9bd5995a1c92)
2002-10-16Create group mappings on the fly.Volker Lendecke1-1/+1
Volker (This used to be commit e2fc1de34aaf875a7003f9d15d5f8ecf159130fb)
2002-10-12Nice *big* patch from metze.Andrew Bartlett1-28/+27
The actual design change is relitivly small however: It all goes back to jerry's 'BOOL store', added to many of the elements in a SAM_ACCOUNT. This ensured that smb.conf defaults did not get 'fixed' into ldap. This was a great win for admins, and this patch follows in the same way. This patch extends the concept - we don't store values back into LDAP unless they have been changed. So if we read a value, but don't update it, or we read a value, find it's not there and use a default, we will not update ldap with that value. This reduced clutter in our LDAP DB, and makes it easier to change defaults later on. Metze's particular problem was that when we 'write back' an unchanged value, we would clear any muliple values in that feild. Now he can still have his mulitivalued 'uid' feild, without Samba changing it for *every* other operation. This also applies to many other attributes, and helps to eliminate a nasty race condition. (Time between get and set) This patch is big, and needs more testing, but metze has tested usrmgr, and I've fixed some pdbedit bugs, and tested domain joins, so it isn't compleatly flawed ;-). The same system will be introduced into the SAM code shortly, but this fixes bugs that people were coming across in production uses of Samba 3.0/HEAD, hence it's inclusion here. Andrew Bartlett (This used to be commit 7f237bde212eb188df84a5d8adb598a93fba8155)
2002-09-26Patch from "Stefan (metze) Metzmacher" <metze@metzemix.de> to do a *much*Andrew Bartlett1-1/+1
better job of working with usrmgr. Previously we were blanking out entires, and all sort of mischif. The new patch (which I've now had a chance to test/modify) also takes care not to expand % values (ie we go \\%L\%U -> \\server\user, we don't want to store \\server\user back) and to correctly notice 'not set' compared to 'null string' etc. Andrew Bartlett (This used to be commit ab878b6cc4132594fc33f78aeebf0d8b7266c150)
2002-09-25Whenever we deal with adding machine/trusted domain accounts, always reset theAndrew Bartlett1-20/+23
flag to what we expect. This handles the 'upgrade' from unixsam beter (where all $ terminated accounts are machines). Andrew Bartlett (This used to be commit a198940ea6f7b7f3cba38c5a9f695e0731204583)
2002-09-25This patch from "Stefan (metze) Metzmacher" <metze@metzemix.de> cleans upAndrew Bartlett1-1/+10
pdb_ldap and adds a 'ldap passwd sync' option. The idea with this option is to do allow an ldap backend to do all the fancy password hashing etc - and to tell smbd no to try and double-up. Using 'ldap passwd sync = only' will do this, but is not recommended unless such a backend is in place... Running 'ldap passwd sync = yes' just gets you the same as doing 'pam passwd sync = yes' and having both PAM and pam_ldap correctly configured for 'magic root' behaviour, but only using ldap connection, and one set of credentials. This also gets us closer to allowing ldap to say 'password too short' etc, which might assist in maintaining a consistant password policy. Andrew Bartlett (This used to be commit f13e243f1a13d34ae057b40b01f561e8b95d4570)
2002-09-04Set default ACB attributes on 'unixsam' accounts. This means that machineAndrew Bartlett1-0/+9
accounts added first to /etc/passwd will be honered correctly. Also, users 'upgraded' to smbpasswd will have the right flags. Andrew Bartlett (This used to be commit 474cc910c73e5567313bac438c7324a80e2e90d8)
2002-08-21Use the 'init' flag to determine if the UID is set, rather than testing theAndrew Bartlett1-2/+5
uid for -1. Andrew Bartlett (This used to be commit 2fc12864ae78ea08d8cb4e3b1c7e341ca4a854e6)
2002-08-17Rework the 'guest account get's RID 501' code again...Andrew Bartlett1-39/+37
This moves it right into the passdb subsystem, where we can do this in just one (or 2) places. Due to the fact that this code can be in a tight loop, I've had to make 'guest account' a 'const' paramater, where % macros cannot be used. In any case, if the 'guest account' varies, we are in for some nasty cases in the other code, so it's useful anyway. Andrew Bartlett (This used to be commit 8718e5e7b2651edad15f52a4262dc745df7ad70f)
2002-08-16Make the 'guest account' always have a RID of DOMAIN_USER_RID_GUEST.Andrew Bartlett1-6/+20
Andrew Bartlett (This used to be commit 4725d7d04936335cbd85bd6ac5096c50fed93671)
2002-08-07Add const to a pile of const to *DOM_SID paramaters.Andrew Bartlett1-2/+2
Andrew Bartlett (This used to be commit fd0ebf976eb6e5fc25bc75ff471c69c3f3761e32)
2002-07-31Don't accidenity mess with the wrong domain's sids.Andrew Bartlett1-2/+2
(This used to be commit 0e2207c9c1ce573098f764e85a65c17cc1f1d284)
2002-07-30Update a pile of Samba's SID lookup code to ensure:Andrew Bartlett1-40/+53
- That we never call winbind recursivly - That we never use an 'algorithmic' RID when we have a fixed uid or gid mapping in either the passdb or the group mapping db. Also, remove restrictions that say 'this domain only'. If we have a mapping configured, allow it to be returned. If we later decide certian mappings are invalid, then we sould put that in the code that actually does the map. Allow 'sid->name' transtations on the fixed 'well known' groups for NT, even if they are not represented by Unix groups yet. Andrew Bartlett (This used to be commit d5bafb224337e393420c2ce9c0a787405314713c)
2002-07-26Clarify this comment.Andrew Bartlett1-0/+3
(This used to be commit d2b4e669aeada9c3498c3a9e49360270def5ad99)
2002-07-14addedd new (t)alloc_sub_* functionsSimo Sorce1-4/+4
they will get a const string and return a (t)alloced epanded one. also modified passdb/* stuff to use this one. (This used to be commit d378ac1e2efb0efc9a0f983d69cf678ca6255fd5)
generated by cgit (git 2.34.1) at 2024-12-23 12:23:08 +0000