Age | Commit message (Collapse) | Author | Files | Lines |
|
(This used to be commit e6df9a7ac74a4e4f8de15fc01799bf42dfdd530c)
|
|
(This used to be commit a0ac9a8ffd4af31a0ebc423b4acbb2f043d865b8)
|
|
(This used to be commit e2f8eeb4e26e8f7bec4d9dc820b86a7b548f82da)
|
|
version to 3.0.20pre1
(This used to be commit 9727d05241574042dd3aa8844ae5c701d22e2da1)
|
|
(This used to be commit 6af57d4bae3ee0a28ab12294e813bb37b62e00f5)
|
|
Volker
(This used to be commit f406dda687b457b8247151cf86d39f03608b5503)
|
|
smbldap_search
and friends. This should be a fix for bug 2701. Thanks to jht for giving me
access to his box!
Volker
(This used to be commit 85320c12578f183d4ed0450949e0aee8d020e036)
|
|
(This used to be commit b0289d22587b0b532921a9b18c1efb767029bdcc)
|
|
(This used to be commit 0a7eabd46d40ddbd9dfbb7602653b28fd84dcf6f)
|
|
Volker to commit. Woo Hoo !
Jeremy.
(This used to be commit 316df944a456f150944761dab34add5e8c4ab699)
|
|
--enable-developer=yes?
Volker
(This used to be commit 61d40ac60dd9c8c9bbcf92e4fc57fe1d706bc721)
|
|
who has a name ending in '$' (usrmgr.exe does this for
domain trusts (that's was jfm's original comment I think).
avoid an assert() call in libldap.
(This used to be commit 0ac57ae94202190ddbe538f7180a0443463b48cf)
|
|
pointers now.
Yes, Jeremy, this is about re-inventing C++... :-)
Volker
(This used to be commit a831e54738c7854e68c696e9cbb132c012ff223c)
|
|
pieces that
can be taken out of it, so I decided to commit this in one lump. It changes
the passdb enumerating functions to use ldap paged results where possible. In
particular the samr calls querydispinfo, enumdomusers and friends have
undergone significant internal changes. I have tested this extensively with
rpcclient and a bit with usrmgr.exe. More tests and the merge to trunk will
follow later.
The code is based on a first implementation by Günther Deschner, but has
evolved quite a bit since then.
Volker
(This used to be commit f0bb44ac58e190e19eb4e92928979b0446e611c9)
|
|
modeled after query_displayinfo and should hide the differences between users,
groups and aliases while allowing a cache analog load_sampw_entries:
struct pdb_search *pdb_search_users(uint16 acct_flags);
struct pdb_search *pdb_search_groups(void);
struct pdb_search *pdb_search_aliases(const DOM_SID *sid);
uint32 pdb_search_entries(struct pdb_search *search, uint32 start_idx,
uint32 max_entries,
struct samr_displayentry **result);
void pdb_search_destroy(struct pdb_search *search);
Why this API? Eventually we will need to apply the work gd has started on
enumerating users with paged ldap searches to groups and aliases. Before doing
that I want to clean up the search routines we have.
The sample application (more to follow) is 'net maxrid'.
Volker
(This used to be commit 8b4f67a1e9d459145cde10b1064781d58d62b805)
|
|
initializable
statically.
Volker
(This used to be commit 3493d9f383567d286e69c0e60c0708ed400a04d9)
|
|
(This used to be commit efea76ac71412f8622cd233912309e91b9ea52da)
|
|
1. using smbc_getxattr() et al, one may now request all access control
entities in the ACL without getting all other NT attributes.
2. added the ability to exclude specified attributes from the result set
provided by smbc_getxattr() et al, when requesting all attributes,
all NT attributes, or all DOS attributes.
3. eliminated all compiler warnings, including when --enable-developer
compiler flags are in use. removed -Wcast-qual flag from list, as that
is specifically to force warnings in the case of casting away qualifiers.
Note: In the process of eliminating compiler warnings, a few nasties were
discovered. In the file libads/sasl.c, PRIVATE kerberos interfaces
are being used; and in libsmb/clikrb5.c, both PRIAVE and DEPRECATED
kerberos interfaces are being used. Someone who knows kerberos
should look at these and determine if there is an alternate method
of accomplishing the task.
(This used to be commit 994694f7f26da5099f071e1381271a70407f33bb)
|
|
to throw up.
Jeremy.
(This used to be commit 051f0ed8075a3616484888ab22d68ca11aa1dd36)
|
|
is the
change in pdb_enum_alias_memberships to match samr.idl a bit closer.
Volker
(This used to be commit 3a6786516957d9f67af6d53a3167c88aa272972f)
|
|
samr_lookup_rids. Gives us
again up to ~6x improvement on group membership lookups.
(This used to be commit e2117bcb09cbd21df3b6621c2794a006418c1d9e)
|
|
(This used to be commit b0f43460822eb5175c854959181de05307d73415)
|
|
(This used to be commit e84d070275464de43107b6b5910e25ccc3339302)
|
|
suffix instead of the group suffix.
Thanks to John Janosik (jpjanosi@us.ibm.com).
(This used to be commit bf3ce651ff3f654938bc98c604ad56214760a05e)
|
|
pdb_nds
handles users with no Universal or Simple Password. Bug #2453.
Jeremy.
(This used to be commit 0976793e3022254c31bda0fe3c49f864514c8d4c)
|
|
(This used to be commit 66471de977a56cbe58921f61da28cc7dcbc6e93e)
|
|
(This used to be commit 68fe1f194a49e7900aba1f201c949f5deb21df87)
|
|
Patch by Justin Ossevoort
(This used to be commit a281148168624dcab24e12f1cc7b0f6c7caf0185)
|
|
(This used to be commit 5c682c665dbf517280deef0d6cec7dadc737a2bc)
|
|
that uidNumber and gidNumber use match the rfc2307 schema
(This used to be commit c1727dc9e01f960c1eedf023b4de49ad6f418b18)
|
|
Vince Brimhall <vbrimhall@novell.com> - slight tidyup by me to
use Samba conventions.
Vince - thanks a *lot* for this code - please test to make sure
I haven't messed anything up.
Jeremy.
(This used to be commit 6f5ea963abe8e19d17a1803d4bedd9d87a317e58)
|
|
(This used to be commit 36bcfc5dae99868fc94ca01f902fec3d19926f5e)
|
|
Could someone else please look at this patch, verifying that I did not break
the ldapsam:trusted = False fallback to the old behaviour? It works fine for
me, but you never know. You're certainly free to review the new code as well :-)
Thanks,
Volker
(This used to be commit e1c3ca182b299dc65da1fa39aadb69876b5e16b8)
|
|
*attr[]. This
gives some new warnings in smbldap.c, but a the callers are cleaned up.
Volker
(This used to be commit 543799fc0ddc3176469acc1fab7093c41556d403)
|
|
(This used to be commit a7df3b5f06085d55cbf1e491aa606312b87e0448)
|
|
passdb in 3_0 (they are still in trunk).
Guenther
(This used to be commit fdf9bdbbac1d8d4f3b3e1fc7e49c1e659b9301b1)
|
|
free()'s on exit
(This used to be commit a882a349df1488a4d64c892dbd1ec1ee3624ea42)
|
|
Jeremy.
(This used to be commit 54ac409d4fd3b6e8e2bd338dabed446a92507811)
|
|
don't leave administator-sid unmapped. Simply return "Administrator"
Guenther
(This used to be commit 168ddf31d1af49d52d17dd09c9653d3deafb9442)
|
|
* added SE_PRIV checks to access_check_samr_object() in order
to deal with the run-time security descriptor and their
interaction with user rights
* Reordered original patch in _samr_set_userinfo[2] to still
allow root/administrative password changes for users and machines.
(This used to be commit f9f9e6039bd9443d54445e41c3783a2be18925fb)
|
|
(This used to be commit 8946efe102f7a8a9b5a8059a80666b782159e7b8)
|
|
When migrating account policies to ldapsam, handle the fact that an
admin might have changed the default location of the sambaDomain-object
after installation.
Guenther
(This used to be commit 78c3c7127444b8f9959f4d6ce9e540271869d70f)
|
|
administrator-sid mapping completely.
Guenther
(This used to be commit 4cbe37ecd544b01c57c7fce5b3be28669f4ba6c3)
|
|
Give the admin-user (rid 500) a chance to be found in passdb, not
returning the (possibly obscure) first entry of "admin users" before
that.
Guenther
(This used to be commit d319c0e189bc67a4552dafaff80113603b551eb3)
|
|
Guenther
(This used to be commit eee0bd806b4fd4558f9c48c09f7e85274e2b807f)
|
|
Does automated migration from account_policy.tdb v1 and v2 and offers a
pdbedit-Migration interface. Jerry, please feel free to revert that if
you have other plans.
Guenther
(This used to be commit 75af83dfcd8ef365b4b1180453060ae5176389f5)
|
|
profile path, logon home and logon script values
(This used to be commit 504ea4ac68f47b71542a88b17cbb6b546e1cb881)
|
|
ldapsam:trusted=True. Don't bail out when ldap-search returns pure
posixgroups (w.o. samba group-mapping).
This way those unix-memberships do not appear in user and nt user token.
Volker, could you please look over that one?
Guenther
(This used to be commit 853a8b7f1c0b00b2e4433d1281f3c9bfcaf980a6)
|
|
This allows the ldap-backend to search much more effeciently. Machines
will be searched in the ldap_machine_suffix and users in the
ldap_users_suffix. (Note that we already use the ldap_group_suffix in
ldapsam_setsamgrent for quite some time).
Using the specific ldap-bases becomes notably important in large
domains: On my testmachine "net rpc trustdom list" has to search through
40k accounts just to list 3 interdomain-trust-accounts, similiar effects
show up the non-user query_dispinfo-calls, etc.
Also renamed all_machines to only_machines in load_sampwd_entries()
since that reflects better what is really meant.
Guenther
(This used to be commit 6394257cc721ca739bda0e320375f04506913533)
|
|
controls or extensions.
* Check and remember if ldapsam's LDAP Server support paged results
(in preparation of adding async paged-results to set|get|end-sampwent in
ldapsam).
Guenther
(This used to be commit ced58bd8849cdef78513674dff1b1ec331945aa9)
|