summaryrefslogtreecommitdiff
path: root/source3/passdb
AgeCommit message (Collapse)AuthorFilesLines
2003-07-15make sure to fallback to rid algoruthm for users not in smbpasswd (e.g. ↵Gerald Carter1-7/+17
force user = foo) (This used to be commit 399799c68cbc91cb3908b0d83ee4f51fa3bf3023)
2003-07-13use the specific funtion we have to check if a SID belong to our domainSimo Sorce1-12/+6
(This used to be commit a926959391676d69bd7cbaf4ce0be0d3cb715418)
2003-07-13Argl. Thinking twice and looking at the rest of callers of sid_compare_domainVolker Lendecke1-1/+6
proved the last patch wrong. Sorry. Volker (This used to be commit d8695eccc7acdee69ca0d0593b56a417f1f89167)
2003-07-13We have an API to compare the domain parts of two SIDs, so use it.Volker Lendecke1-6/+1
Volker (This used to be commit 39308ff138da88c1a4c0958cd4c7a9090261d3d5)
2003-07-11fix sid_to_[uid|gid] (spotted by Volker).Gerald Carter1-1/+1
Still testing this, but I'm checking it in so Volker can test it as well. Should be right. (This used to be commit 8edf193722f699cc33baed410917a78a5e28d0a4)
2003-07-11fix unitialised variableGerald Carter1-0/+6
(This used to be commit 5efa0d7cc28d903c1986b8e40072ae49e9532a88)
2003-07-11moving more code around.Gerald Carter4-781/+68
* move rid allocation into IDMAP. See comments in _api_samr_create_user() * add winbind delete user/group functions I'm checking this in to sync up with everyone. But I'm going to split the add a separate winbindd_allocate_rid() function for systems that have an 'add user script' but need idmap to give them a RID. Life would be so much simplier without 'enable rid algorithm'. The current RID allocation is horrible due to this one fact. Tested idmap_tdb but not idmap_ldap yet. Will do that tomorrow. Nothing has changed in the way a samba domain is represented, stored, or search in the directory so things should be ok with previous installations. going to bed now. (This used to be commit 0463045cc7ff177fab44b25faffad5bf7140244d)
2003-07-10i guess i'm the only one this ever annyoed...Gerald Carter1-2/+2
fix the confusion when we tdb_lock_bystring() but we retrieve an entry using tdb_fetch_by_string. It's now always tdb.*bystring() (This used to be commit 66359531b89368939f0e8f584a45844b5f2f99e7)
2003-07-09Fix up become_root/unbecome_root pairs needed around local passdbJeremy Allison1-3/+17
lookups. Jeremy. (This used to be commit 6bd47884030c9c124c4bba1f0d57cb8dd916530d)
2003-07-08Moved SAM_ACCOUNT marshall/unmarshall functions to make them externallyJeremy Allison2-401/+438
available. Removed extra auth_init (thanks metze). Jeremy. (This used to be commit 88135fbc4998c266052647f8b8e437ac01cf50ae)
2003-07-07Cleaning up linking issues. sam/idmap*.c only links inGerald Carter2-1/+115
winbindd now. Also removing an unused file. (This used to be commit 688369c23c604e9b6654fcf07190d2e27c1138cf)
2003-07-07Fixed a couple of const issues with the new code.Jeremy Allison1-2/+2
Jeremy. (This used to be commit e9fb6e45086a6170b6f6d5d3295398708ab1af58)
2003-07-07and so it begins....Gerald Carter2-6/+206
* remove idmap_XX_to_XX calls from smbd. Move back to the the winbind_XXX and local_XXX calls used in 2.2 * all uid/gid allocation must involve winbindd now * move flags field around in winbindd_request struct * add WBFLAG_QUERY_ONLY option to winbindd_sid_to_[ug]id() to prevent automatic allocation for unknown SIDs * add 'winbind trusted domains only' parameter to force a domain member server to use matching users names from /etc/passwd for its domain (needed for domain member of a Samba domain) * rename 'idmap only' to 'enable rid algorithm' for better clarity (defaults to "yes") code has been tested on * domain member of native mode 2k domain * ads domain member of native mode 2k domain * domain member of NT4 domain * domain member of Samba domain * Samba PDC running winbindd with trusts Logons tested using 2k clients and smbclient as domain users and trusted users. Tested both 'winbind trusted domains only = [yes|no]' This will be a long week of changes. The next item on the list is winbindd_passdb.c & machine trust accounts not in /etc/passwd (done via winbindd_passdb) (This used to be commit 8266dffab4aedba12a33289ff32880037ce950a8)
2003-07-06Fix ldapsam_getsampwsid to correctly only say 'no such user' when indeed thereAndrew Bartlett1-13/+13
is no such user... Thanks to jerry for spotting this. Also clean up the function a bit, to avoid this happening again... Andrew Bartlett (This used to be commit d9a6859e2bd963f28cf3c3a62e483e868822597f)
2003-07-05Fix commentAndrew Bartlett1-1/+1
(This used to be commit f7bf48114cec83a3f3107cce2b413221276a486d)
2003-07-05Add some debug statments to our vampire code - try to make it easier to trackAndrew Bartlett3-9/+28
down failures. Add a 'auto-add on modify' feature to guestsam Fix some segfault bugs on no-op idmap modifications, and on new idmappings that do not have a DN to tack onto. Make the 'private data' a bit more robust. Andrew Bartlett (This used to be commit 6c48309cda9538da5a32f3d88a7bb9c413ae9e8e)
2003-07-05Fixes to our LDAP/vampire codepaths:Andrew Bartlett3-11/+61
- Try better to add the appropriate mapping between UID and SIDs, based on Get_Pwnam() - Look for previous users (lookup by SID) and correctly modify the existing entry in that case - Map the root user to the Admin SID as a 'well known user' - Save the LDAPMessage result on the SAM_ACCOUNT for use in the next 'update' call on that user. This means that VL's very nice work on atomic LDAP updates now really gets used properly! - This also means that we know the right DN to update, without the extra round-trips to the server. Andrew Bartlett (This used to be commit c7118cb31dac24db3b762fe68ce655b17ea102e0)
2003-07-04This patch cleans up some of our ldap code, for better behaviour:Andrew Bartlett2-388/+394
We now always read the Domain SID out of LDAP. If the local secrets.tdb is ever different to LDAP, it is overwritten out of LDAP. We also store the 'algorithmic rid base' into LDAP, and assert if it changes. (This ensures cross-host synchronisation, and allows for possible integration with idmap). If we fail to read/add the domain entry, we just fallback to the old behaviour. We always use an existing DN when adding IDMAP entries to LDAP, unless no suitable entry is available. This means that a user's posixAccount will have a SID added to it, or a user's sambaSamAccount will have a UID added. Where we cannot us an existing DN, we use 'sambaSid=S-x-y-z,....' as the DN. The code now allows modifications to the ID mapping in many cases. Likewise, we now check more carefully when adding new user entires to LDAP, to not duplicate SIDs (for users, at this stage), and to add the sambaSamAccount onto the idmap entry for that user, if it is already established (ensuring we do not duplicate sambaSid entries in the directory). The allocated UID code has been expanded to take into account the space between '1000 - algorithmic rid base'. This much better fits into what an NT4 does - allocating in the bottom part of the RID range. On the code cleanup side of things, we now share as much code as possible between idmap_ldap and pdb_ldap. We also no longer use the race-prone 'enumerate all users' method for finding the next RID to allocate. Instead, we just start at the bottom of the range, and increment again if the user already exists. The first time this is run, it may well take a long time, but next time will just be able to use the next Rid. Thanks to metze and AB for double-checking parts of this. Andrew Bartlett (This used to be commit 9c595c8c2327b92a86901d84c3f2c284dabd597e)
2003-07-03Removed strupper/strlower macros that automatically map to ↵Jeremy Allison2-15/+15
strupper_m/strlower_m. I really want people to think about when they're using multibyte strings. Jeremy. (This used to be commit ff222716a08af65d26ad842ce4c2841cc6540959)
2003-07-02Uppercase first letter of debug level 0 statements.Tim Potter1-2/+2
(This used to be commit 05679968e207f795237bbee7b6564f365415d02f)
2003-07-01removing nisplussamGerald Carter1-1524/+0
(This used to be commit f75683995cf0d17df55a70dacd72ab2d6cd17989)
2003-07-01fix compile problem with nisplussamGerald Carter1-13/+18
(This used to be commit 2f7051e2bcaaa45a7315208fc9b5812e6ed657d9)
2003-07-01Different fix for memleak just committed. This belongs intoVolker Lendecke1-2/+0
tdb_search_list_free. Volker (This used to be commit 0f3822c8e71426983b960ad49511efa8707159f9)
2003-07-01Fix two memory leaks. tdb_search_keys allocates space for the keyVolker Lendecke1-0/+2
strings. Running 'net cache list' or secrets_get_trusted_domains through valgrind gives a *huge* amount of invalid reads of one byte beyond the indicated string length in libc's strncpy. Annoying... Volker (This used to be commit 0f8933ae778064ff58cdc832ce52c843631435bb)
2003-07-01* revert change to get_global_sam_name()Gerald Carter1-2/+23
* add get_default_sam_name() to be used by make_user_info_map() * add comments describing get_*_sam_name() (This used to be commit 90470366ea4bdb8021a3453c4bbeb29f009668c1)
2003-06-30* cleanup more DC name resolution issues in check_*domain_security()Gerald Carter1-4/+7
* is_trusted_domain() is broken without winbind. Still working on this. * get_global_sam_name() should return the workgroup name unless we are a standalone server (verified by volker) * Get_Pwnam() should always fall back to the username (minus domain name) even if it is not our workgroup so that TRUSTEDOMAIN\user can logon if 'user' exists in the local list of accounts (on domain members w/o winbind) Tested using Samba PDC with trusts (running winbindd) and a Samba 3.0 domain member not running winbindd. notes: make_user_info_map() is slightly broken now due to the fact that is_trusted_domain() only works with winbindd. disabled checks temporarily until I can sort this out. (This used to be commit e1d6094d066d4c16ab73075caba40a1ae6c56b1e)
2003-06-30Add the 'guest' passdb backend automatically ifVolker Lendecke1-0/+25
guest account != "" Volker (This used to be commit 21d330af107f744af9569b5577afc6e7ba6a269c)
2003-06-25large change:Gerald Carter2-3/+2
*) consolidates the dc location routines again (dns and netbios) get_dc_list() or get_sorted_dc_list() is the authoritative means of locating DC's again. (also inludes a flag to get_dc_list() to define if this should be a DNS only lookup or not) (however, if you set "name resolve order = hosts wins" you could still get DNS queries for domain name IFF ldap_domain2hostlist() fails. The answer? Fix your DNS setup) *) enabled DOMAIN<0x1c> lookups to be funneled through resolve_hosts resulting in a call to ldap_domain2hostlist() if lp_security() == SEC_ADS *) enables name cache for winbind ADS backend *) enable the negative connection cache for winbind ADS backend *) removes some old dead code *) consolidates some duplicate code *) moves the internal_name_resolve() to use an IP/port pair to deal with SRV RR dns replies. The namecache code also supports the IP:port syntax now as well. *) removes 'ads server' and moves the functionality back into 'password server' (which can support "hostname:port" syntax now but works fine with defaults depending on the value of lp_security()) (This used to be commit d7f7fcda425bef380441509734eca33da943c091)
2003-06-25Patch to move functions directly from pdb_ldap.c into lib/smbldap.cAndrew Bartlett1-718/+8
The functions are unchanged. Next step is to make idmap_ldap use them. Andrew Bartlett (This used to be commit 57617a0f8c84f9ced4df2901811ce5a5a5ae005e)
2003-06-24Fix pdb_ldap segfaults, and wrong default values for ldapsam_compat.Andrew Bartlett1-4/+3
Reviewed by vl, metze. Andrew Bartlett (This used to be commit 9804ad458ad35c9ea7de3e2e86bf8b2f85ae6533)
2003-06-22Found out a good number of NT_STATUS_IS_ERR used the wrong way.Simo Sorce3-4/+4
As abartlet rememberd me NT_STATUS_IS_ERR != !NT_STATUS_IS_OK This patch will cure the problem. Working on this one I found 16 functions where I think NT_STATUS_IS_ERR() is used correctly, but I'm not 100% sure, coders should check the use of NT_STATUS_IS_ERR() in samba is ok now. Simo. (This used to be commit c501e84d412563eb3f674f76038ec48c2b458687)
2003-06-21Fix memory leak. secrets_fetch allocates memory.Volker Lendecke1-0/+2
Volker (This used to be commit 2ec8d1ff88d3984a317a4a53ca3a299e8a68a9d7)
2003-06-21This patch works towards to goal of common code shared between idmap_ldapAndrew Bartlett1-261/+359
and pdb_ldap. So far, it's just a function rename, so that the next patch can be a very simple matter of copying functions, without worrying about what changed in the process. Also removes the 'static' pointers for the rebind procedures, replacing them with a linked list of value/key lookups. (Only needed on older LDAP client libs) Andrew Bartlett (This used to be commit f93167a7e1c56157481a934d2225fe19786a3bff)
2003-06-20Fix bug #136: "passdb backend = " caused smbd to segfault.Jim McDonough1-0/+5
Instead, spit out an error message. (This used to be commit 22f083b227a6f03ae42b985e45e9c384982c6ed2)
2003-06-18Ok, this patch removes the privilege stuff we had in, unused, for some time.Simo Sorce3-31/+26
The code was nice, but put in the wrong place (group mapping) and not supported by most of the code, thus useless. We will put back most of the code when our infrastructure will be changed so that privileges actually really make sense to be set. This is a first patch of a set to enhance all our mapping code cleaness and stability towards a sane next beta for 3.0 code base Simo. (This used to be commit e341e7c49f8c17a9ee30ca3fab3aa0397c1f0c7e)
2003-06-18And some more memory leaks in mapping.c and pdb_tdb.c. tdb_nextkeyVolker Lendecke1-2/+13
mallocs its key, so we should free it after use. Volker (This used to be commit 9750799ba2e1aaa59fa255f23880c9c618195c3d)
2003-06-18Better panic cleanly than segfault later when no sid can be found and created.Volker Lendecke1-2/+3
Everybody who calls get_global_sam_sid expects this to return non-NULL, and there are way too many places where this is called. Volker (This used to be commit 2dfa896e6fdd52aa0eebe7d811c7b4072fe98be3)
2003-06-17Fix a memory leak in pdb_tdb.c.Volker Lendecke1-0/+2
Simo, I remember you complaining about a memleak there, could it be this one, or did you resolve it at that time? Volker (This used to be commit c660595deda2ce836c0a191da0236f850004ba0d)
2003-06-17Make static (patch from metze)Jelmer Vernooij2-2/+2
(This used to be commit 908b16cc2a8b6c5c67aae0e1af9d51f57fe31212)
2003-06-17The return value of init_module functions is NTSTATUS, not intJelmer Vernooij2-6/+4
(This used to be commit f09df852ac0b25470fb9435c79a4a417e06e9b75)
2003-06-16Update link to DTDJelmer Vernooij1-1/+1
(This used to be commit 2737518b2571fecf60fcbcd99575dd6cf5bd0bdb)
2003-06-16Quieten another debug message.Tim Potter1-1/+1
(This used to be commit 2c47893c7542889d9e2ee097897a1df248b1a5e2)
2003-06-16Quieten debug message.Tim Potter1-1/+1
(This used to be commit 02d12cc4b9b9c5cfb7a05a6c2cf71cc59144bec9)
2003-06-13Rename some uuid functions so as not to conflict with systemTim Potter1-1/+1
versions. Fixes bug #154. (This used to be commit 986eae40f7669d15dc75aed340e628aa7efafddc)
2003-06-07Try to fix memory leaks found by valgrind in pdb_ldap code.Andrew Bartlett1-3/+3
Andrew Bartlett (This used to be commit decadfcc8205ed5611d74141e301569ef8b1d9f4)
2003-06-06support LDAP_EXOP_MODIFY_PASSWORD (not experiemental in OpenLDAP 2.1)Gerald Carter1-9/+21
(This used to be commit 50fdc938222112b5470d05d8cd15386bd0a112df)
2003-06-06* break out more common code used between pdb_ldap and idmap_ldapGerald Carter1-128/+36
* remove 'winbind uid' and 'winbind gid' parameters (replaced by current idmap parameter) * create the sambaUnixIdPool entries automatically in the 'ldap idmap suffix' * add new 'ldap idmap suffix' and 'ldap group suffix' parametrer * "idmap backend = ldap" now accepts 'ldap:ldap://server/' format (parameters are passed to idmap init() function (This used to be commit 1665926281ed2be3c5affca551c9d458d013fc7f)
2003-06-05working draft of the idmap_ldap code.Gerald Carter1-282/+3
Includes sambaUnixIdPool objectclass Still needs cleaning up wrt to name space. More changes to come, but at least we now have a a working distributed winbindd solution. (This used to be commit 824175854421f7c27d31ad673a8790dd018ae350)
2003-05-27cut-n-paste errorGerald Carter1-1/+1
(This used to be commit eb567e803e2da3ce11174812a5162642d8ef342b)
2003-05-27fix bug 118; replace hard coded 'next[User|Group]Rid' attribute namesGerald Carter1-6/+8
(This used to be commit f7ebb3c9e5d38d86d48459b7962a3da6d4900285)
generated by cgit (git 2.34.1) at 2024-12-15 16:04:32 +0000