summaryrefslogtreecommitdiff
path: root/source3/passdb/pdb_ldap.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r11922: Looks bigger than it is: There's no point in allocating arrays inVolker Lendecke1-17/+10
samr_lookup_rids twice. It was done in the srv_samr_nt.c code as well as in the pdb module. Remove the latter, this might happen more often. Volker (This used to be commit 57f0cf8cdd6928f4759036e5dd53d41736aa910d)
2007-10-10r11914: After talking to Jeremy, implement passdb:expand_explicit with a ↵Volker Lendecke1-3/+14
default of no. This changes our default behaviour. Sorry, Ingo, this *is* a bug that needs fixing. Jerry, you might want to put a marker into the WHATSNEW.txt when this is due. Volker (This used to be commit 6622db97bb575b028b3c0bc016b91f62a8c561a2)
2007-10-10r11847: Fix typo.Günther Deschner1-1/+1
Guenther (This used to be commit 6aefb3aebbbba486ea44ec9ef7bc46e0776eeba8)
2007-10-10r11236: Implement user rename for smbpasswd and ldap backends. Some cleanup onJim McDonough1-0/+47
tdb as well to make naming consistent. (This used to be commit ee91eb9a39cc5e3edd9e97eb040e7557930e4e62)
2007-10-10r11137: Compile with only 2 warnings (I'm still working on that code) on a gcc4Jeremy Allison1-51/+53
x86_64 box. Jeremy. (This used to be commit d720867a788c735e56d53d63265255830ec21208)
2007-10-10r10656: BIG merge from trunk. Features not copied overGerald Carter1-13/+341
* \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck) (This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
2007-10-10r9661: fallback to cn attribubte if displayName is not availableGerald Carter1-14/+14
(This used to be commit b1524999e0b4fc99d213fc6e56182a8fa8e88ef1)
2007-10-10r9660: real fix for group enumeration bug in 3.0.20; only affected the ↵Gerald Carter1-4/+5
ldapsam code (This used to be commit 62f9fb5e3a9bce539c9fedc5fdec1b8741a922c7)
2007-10-10r8797: avoid unset rids for builtin-aliases.Günther Deschner1-1/+2
Guenther (This used to be commit c2810bcf662771113dccdd603cd658d19a09de80)
2007-10-10r8787: Make enumeration of builtin-aliases work again.Günther Deschner1-5/+41
Guenther (This used to be commit 0c8859474da609c69435c2acdfa4fa012d87eed3)
2007-10-10r8542: - (re-)add better search-semantics: look for Interdomain trust accountsGünther Deschner1-2/+2
below the machine-suffix (this is where we create them)) to avoid digging through thousands of user-accounts just to find a handful of trust-accounts in the enumdomusers-samr-call. - don't access freed data in DEBUG-statement Guenther (This used to be commit 793c82c0172c4f834e43d04bf3f9d39858761e88)
2007-10-10r7882: Looks like a large patch - but what it actually does is make SambaJeremy Allison1-6/+6
safe for using our headers and linking with C++ modules. Stops us from using C++ reserved keywords in our code. Jeremy (This used to be commit 9506b8e145982b1160a2f0aee5c9b7a54980940a)
2007-10-10r7142: removing 'ldap filter' smb.conf optionGerald Carter1-4/+4
(This used to be commit e2f8eeb4e26e8f7bec4d9dc820b86a7b548f82da)
2007-10-10r6770: Fix bug 2705. Thanks, John, for beating my stuff :-)Volker Lendecke1-2/+0
Volker (This used to be commit f406dda687b457b8247151cf86d39f03608b5503)
2007-10-10r6748: With reconnects, state->connection->ldap_struct can change in ↵Volker Lendecke1-3/+8
smbldap_search and friends. This should be a fix for bug 2701. Thanks to jht for giving me access to his box! Volker (This used to be commit 85320c12578f183d4ed0450949e0aee8d020e036)
2007-10-10r6445: Make us survive the PARANOID_MALLOC_CHECKER. Should we enable that forVolker Lendecke1-2/+2
--enable-developer=yes? Volker (This used to be commit 61d40ac60dd9c8c9bbcf92e4fc57fe1d706bc721)
2007-10-10r6421: use add machine script when creating a user (ACB_NORMAL)Gerald Carter1-1/+2
who has a name ending in '$' (usrmgr.exe does this for domain trusts (that's was jfm's original comment I think). avoid an assert() call in libldap. (This used to be commit 0ac57ae94202190ddbe538f7180a0443463b48cf)
2007-10-10r6367: Slim down pdb_interface.c a bit. next_entry and search_end are functionVolker Lendecke1-9/+9
pointers now. Yes, Jeremy, this is about re-inventing C++... :-) Volker (This used to be commit a831e54738c7854e68c696e9cbb132c012ff223c)
2007-10-10r6351: This is quite a large and intrusive patch, but there are not many ↵Volker Lendecke1-0/+469
pieces that can be taken out of it, so I decided to commit this in one lump. It changes the passdb enumerating functions to use ldap paged results where possible. In particular the samr calls querydispinfo, enumdomusers and friends have undergone significant internal changes. I have tested this extensively with rpcclient and a bit with usrmgr.exe. More tests and the merge to trunk will follow later. The code is based on a first implementation by Günther Deschner, but has evolved quite a bit since then. Volker (This used to be commit f0bb44ac58e190e19eb4e92928979b0446e611c9)
2007-10-10r6263: Get rid of generate_wellknown_sids, they are const static and ↵Volker Lendecke1-2/+0
initializable statically. Volker (This used to be commit 3493d9f383567d286e69c0e60c0708ed400a04d9)
2007-10-10r6225: get rid of warnings from my compiler about nested externsHerb Lewis1-1/+2
(This used to be commit efea76ac71412f8622cd233912309e91b9ea52da)
2007-10-10r6080: Port some of the non-critical changes from HEAD to 3_0. The main one ↵Volker Lendecke1-16/+15
is the change in pdb_enum_alias_memberships to match samr.idl a bit closer. Volker (This used to be commit 3a6786516957d9f67af6d53a3167c88aa272972f)
2007-10-10r5965: Apply Volker's patch for "ldapsam trusted = yes" for ↵Jim McDonough1-15/+229
samr_lookup_rids. Gives us again up to ~6x improvement on group membership lookups. (This used to be commit e2117bcb09cbd21df3b6621c2794a006418c1d9e)
2007-10-10r5957: BUGS 2478, 2093: compiler warning patches from Jason MaderGerald Carter1-6/+7
(This used to be commit b0f43460822eb5175c854959181de05307d73415)
2007-10-10r5927: Fix ldapsam trusted enum_group_members. We were searching in the userJim McDonough1-1/+1
suffix instead of the group suffix. Thanks to John Janosik (jpjanosi@us.ibm.com). (This used to be commit bf3ce651ff3f654938bc98c604ad56214760a05e)
2007-10-10r5708: BUG 2424: patch from Vince Brimhall <vbrimhall@novell.com> to ensure ↵Gerald Carter1-5/+5
that uidNumber and gidNumber use match the rfc2307 schema (This used to be commit c1727dc9e01f960c1eedf023b4de49ad6f418b18)
2007-10-10r5655: Added support for Novell NDS universal password. Code donated byJeremy Allison1-55/+81
Vince Brimhall <vbrimhall@novell.com> - slight tidyup by me to use Samba conventions. Vince - thanks a *lot* for this code - please test to make sure I haven't messed anything up. Jeremy. (This used to be commit 6f5ea963abe8e19d17a1803d4bedd9d87a317e58)
2007-10-10r5481: Fix a memleakVolker Lendecke1-0/+2
(This used to be commit 36bcfc5dae99868fc94ca01f902fec3d19926f5e)
2007-10-10r5467: Optimize _samr_query_groupmem with LDAP backend for large domains.Volker Lendecke1-0/+208
Could someone else please look at this patch, verifying that I did not break the ldapsam:trusted = False fallback to the old behaviour? It works fine for me, but you never know. You're certainly free to review the new code as well :-) Thanks, Volker (This used to be commit e1c3ca182b299dc65da1fa39aadb69876b5e16b8)
2007-10-10r5428: Apply some const. LDAP attribs should now be declared const char ↵Volker Lendecke1-21/+22
*attr[]. This gives some new warnings in smbldap.c, but a the callers are cleaned up. Volker (This used to be commit 543799fc0ddc3176469acc1fab7093c41556d403)
2007-10-10r5349: After talking with Jerry, reverted the addition of account policies toGünther Deschner1-252/+3
passdb in 3_0 (they are still in trunk). Guenther (This used to be commit fdf9bdbbac1d8d4f3b3e1fc7e49c1e659b9301b1)
2007-10-10r5166: From James Peach - remove minor C99-isms.Jeremy Allison1-6/+12
Jeremy. (This used to be commit 54ac409d4fd3b6e8e2bd338dabed446a92507811)
2007-10-10r4994: Patch from abartlet:Günther Deschner1-13/+26
When migrating account policies to ldapsam, handle the fact that an admin might have changed the default location of the sambaDomain-object after installation. Guenther (This used to be commit 78c3c7127444b8f9959f4d6ce9e540271869d70f)
2007-10-10r4926: Use LDAP_SCOPE_ONELEVEL instead of OpenLDAP's LDAP_SCOPE_ONE-scope.Günther Deschner1-2/+2
Guenther (This used to be commit eee0bd806b4fd4558f9c48c09f7e85274e2b807f)
2007-10-10r4925: Migrate Account Policies to passdb (esp. replicating ldapsam).Günther Deschner1-3/+245
Does automated migration from account_policy.tdb v1 and v2 and offers a pdbedit-Migration interface. Jerry, please feel free to revert that if you have other plans. Guenther (This used to be commit 75af83dfcd8ef365b4b1180453060ae5176389f5)
2007-10-10r4860: fix silly limitation in ldapsam and tdbsam. Expand variables in the ↵Gerald Carter1-6/+11
profile path, logon home and logon script values (This used to be commit 504ea4ac68f47b71542a88b17cbb6b546e1cb881)
2007-10-10r4851: Preleminary fix for ldapsam_enum_group_memberships whenGünther Deschner1-3/+3
ldapsam:trusted=True. Don't bail out when ldap-search returns pure posixgroups (w.o. samba group-mapping). This way those unix-memberships do not appear in user and nt user token. Volker, could you please look over that one? Guenther (This used to be commit 853a8b7f1c0b00b2e4433d1281f3c9bfcaf980a6)
2007-10-10r4847: Hand over a acb_mask to pdb_setsampwent in load_sampwd_entries().Günther Deschner1-8/+23
This allows the ldap-backend to search much more effeciently. Machines will be searched in the ldap_machine_suffix and users in the ldap_users_suffix. (Note that we already use the ldap_group_suffix in ldapsam_setsamgrent for quite some time). Using the specific ldap-bases becomes notably important in large domains: On my testmachine "net rpc trustdom list" has to search through 40k accounts just to list 3 interdomain-trust-accounts, similiar effects show up the non-user query_dispinfo-calls, etc. Also renamed all_machines to only_machines in load_sampwd_entries() since that reflects better what is really meant. Guenther (This used to be commit 6394257cc721ca739bda0e320375f04506913533)
2007-10-10r4840: * Add more generic root-dse inspection function to check for givenGünther Deschner1-58/+1
controls or extensions. * Check and remember if ldapsam's LDAP Server support paged results (in preparation of adding async paged-results to set|get|end-sampwent in ldapsam). Guenther (This used to be commit ced58bd8849cdef78513674dff1b1ec331945aa9)
2007-10-10r4736: small set of merges from rtunk to minimize the diffsGerald Carter1-1/+1
(This used to be commit 4b351f2fcc365a7b7f8c22b5139c299aa54c9458)
2007-10-10r4088: Get medieval on our ass about malloc.... :-). Take control of all our ↵Jeremy Allison1-5/+5
allocation functions so we can funnel through some well known functions. Should help greatly with malloc checking. HEAD patch to follow. Jeremy. (This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)
2007-10-10r3883: Fix error return -- thanks to rsharpeVolker Lendecke1-1/+1
(This used to be commit 2d952c86c7e92fff48b4773ab46987d905b214cc)
2007-10-10r3871: Fix memleakVolker Lendecke1-1/+3
(This used to be commit dbfdde5f63f34fbe4ba1d794fcfc120178ff039a)
2007-10-10r3705: Nobody has commented, so I'll take this as an ack...Volker Lendecke1-0/+108
abartlet, I'd like to ask you to take a severe look at this! We have solved the problem to find the global groups a user is in twice: Once in auth_util.c and another time for the corresponding samr call. The attached patch unifies these and sends them through the passdb backend (new function pdb_enum_group_memberships). Thus it gives pdb_ldap.c the chance to further optimize the corresponding call if the samba and posix accounts are unified by issuing a specialized ldap query. The parameter to activate this ldapsam behaviour is ldapsam:trusted = yes Volker (This used to be commit b94838aff1a009f8d8c2c3efd48756a5b8f3f989)
2007-10-10r3628: A typo and a compile-warning.Günther Deschner1-1/+1
Guenther (This used to be commit 906d5f88aabf091ee273e0ed9c3d2947b22c5390)
2007-10-10r3566: Completely replace the queryuseraliases call. The previous ↵Volker Lendecke1-38/+40
implementation does not exactly match what you would expect. XP workstations during login actually do this, so we should better become a bit more correct. The LDAP query issued is not really fully optimal, but it is a lot faster and more correct than what was there before. The change in passdb.h makes it possible that queryuseraliases is done with a single ldap query. Volker (This used to be commit 2508d4ed1e16c268fc9f3676b0c6a122e070f93d)
2007-10-10r2923: Fix some obvious copy/paste leftover debug-messages.Günther Deschner1-8/+8
Guenther (This used to be commit 94f48d06c774eb137fef70063e6f29e5d5a6ba9d)
2007-10-10r2819: Make 'password history'-behaviour in ldapsam more consistent.Günther Deschner1-0/+3
Currently we cannot store more then 15 password history entries (windows NT4 allows to store 24) in ldapsam. When choosing more then "15" with pdbedit -P "password history", we fail to initialize the password history upon password change and overwrite the history, effectively using a password history of "1". We do already decrease any history-policy larger then 15 to 15 while storing the password history list attribute in ldap. Guenther (This used to be commit a4b47e71475a06c2e2287613b00648c5f53ae52c)
2007-10-10r2752: Fix the paranoia-check to ensure the ldap-attribute and theGünther Deschner1-1/+1
smb.conf-parameter for samba's "algorithmic rid base" in ldapsam are identical. It tried to get the value of LDAP_ATTR_ALGORITHMIC_RID_BASE via get_userattr_key2string() for a very long time now. This just can not work because LDAP_ATTR_ALGORITHMIC_RID_BASE is neither in attrib_map_v22 nor in attrib_map_v30. Instead, get it directly from dominfo_attr_list. Ldapsam will now correctly refuse to initialize when admins tried manually to have differing values for "algorithmic rid base" in ldap and smb.conf. idmap_ldap is another story... Guenther (This used to be commit c5b8bc6c2e9a3f789f41742438b31152721c0bf4)
2007-10-10r2619: Only issue the ldap extended password change operation if the ldap serverVolker Lendecke1-0/+75
supports it. This might be a fix for bugs 1823 and 1545, notifying both. Also ignore object class violation errors from the extended operation. We don't have the userPassword field in sambaSamAccount, and if we have such broken setup with user in /etc/passwd and only samba attribs in ldap, we fail this :-) Volker (This used to be commit a32ea3bc881f516fb733cb4767ae5cf22d658b12)
generated by cgit (git 2.34.1) at 2024-12-18 07:34:20 +0000