summaryrefslogtreecommitdiff
path: root/source3/rpc_server/srv_lsa_nt.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r4746: add server support for lsa_enum_acct_rights(); last checkin for the nightGerald Carter1-4/+30
(This used to be commit ccdff4a998405544433aa32938963e4c37962fcc)
2007-10-10r4742: add server support for lsa_add/remove_account_rights() and fix some ↵Gerald Carter1-0/+107
parsing bugs related to that code (This used to be commit 7bf1312287cc1ec6b97917ba25fc60d6db09f26c)
2007-10-10r4739: require membership in Domain Admins to be able to set privilegesGerald Carter1-0/+25
(This used to be commit e8b4cedc2081eeff53d86c2d894632e57a17926f)
2007-10-10r4724: Add support for Windows privileges in Samba 3.0Gerald Carter1-159/+140
(based on Simo's code in trunk). Rewritten with the following changes: * privilege set is based on a 32-bit mask instead of strings (plans are to extend this to a 64 or 128-bit mask before the next 3.0.11preX release). * Remove the privilege code from the passdb API (replication to come later) * Only support the minimum amount of privileges that make sense. * Rewrite the domain join checks to use the SeMachineAccountPrivilege instead of the 'is a member of "Domain Admins"?' check that started all this. Still todo: * Utilize the SePrintOperatorPrivilege in addition to the 'printer admin' parameter * Utilize the SeAddUserPrivilege for adding users and groups * Fix some of the hard coded _lsa_*() calls * Start work on enough of SAM replication to get privileges from one Samba DC to another. * Come up with some management tool for manipultaing privileges instead of user manager since it is buggy when run on a 2k client (haven't tried xp). Works ok on NT4. (This used to be commit 77c10ff9aa6414a31eece6dfec00793f190a9d6c)
2007-10-10r4088: Get medieval on our ass about malloc.... :-). Take control of all our ↵Jeremy Allison1-15/+13
allocation functions so we can funnel through some well known functions. Should help greatly with malloc checking. HEAD patch to follow. Jeremy. (This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)
2007-10-10r3875: Allow to look up at least or own sid in _lsa_lookup_sids.Günther Deschner1-2/+2
This fixes Bugzilla #1076 and Exchange 5.5 SP4 can then be finally installed on NT4 in a samba-controlled domain. Guenther (This used to be commit bb191c1098dea06bf2cd89276c74e32279fbb3d4)
2007-10-10r1340: _samr_lookupsids with more than 32 (MAX_REF_DOMAINS) SIDs failed. ThisVolker Lendecke1-1/+1
happened because init_dom_ref did not find the domain in question in the list of already mentioned domains. Could others please double-check this? Thanks, Volker (This used to be commit d7b2e41f00491ecf57db70e4da8cf8a3d2469c2b)
2007-10-10r911: Patch from "Jerome Borsboom" <j.borsboom@erasmusmc.nl>, don'tJeremy Allison1-6/+6
overwrite error code. Jeremy. (This used to be commit 735e49ddc3c4485c7b43208345d0e3e2b8960ad4)
2007-10-10r810: Fix from "Jerome Borsboom" <j.borsboom@erasmusmc.nl> to ensure error ↵Jeremy Allison1-6/+6
status codes don't get overwritten. Jeremy. (This used to be commit c179451b07c2315a667c2ff683cd30c4d224758e)
2007-10-10r801: Fix from "Jianliang Lu" <j.lu@tiesse.com> to return correct groupJeremy Allison1-0/+2
types. Jeremy. (This used to be commit d97b9146a137d43278f3125bafe8a453da82f4ce)
2007-10-10r196: merging struct uuid from trunkGerald Carter1-5/+4
(This used to be commit 911a28361b9d8dd50597627f245ebfb57c6294fb)
2007-10-10r116: volker's patch for local group and group nestingGerald Carter1-0/+5
(This used to be commit b393469d9581f20e4d4c52633b952ee984cca36f)
2007-10-10r91: Fix lsalookupnames. Previously we'd fail if we didn't find the name, butJim McDonough1-0/+6
we never checked if it was a domain user and didn't find a local one. (This used to be commit 68022f5ebc55d1f3403dee5198d364cff300baf5)
2004-02-19Fixup correct (as per W2K3) returns for lookupsids as well as lookupnames.Jeremy Allison1-6/+7
Inspired by Volkers patch. Jeremy. (This used to be commit a47127e90e7d0928b772ba45bd843eeeacc9ef8a)
2004-02-17Fix based on Volker's code to correctly return code from lsa_lookup_sidsJeremy Allison1-17/+19
on unmapped sids. Jeremy. (This used to be commit 37a52c31682fcf115eefc31381c02a3ec29c1f8d)
2004-01-30Fix up name canonicalization (needed for krb5 keytab support later).Jeremy Allison1-1/+1
Remove source_env handler (no longer used in any codepath). Jeremy. (This used to be commit 3a3e33603084048e647af86a9badaaf49433c789)
2003-12-10Fix UNISTR2 length bug in LsaQueryInfo(3) that cause SID resolution to fail ↵Gerald Carter1-1/+1
on local files on on domain members; bug 875 (This used to be commit c6594e35573186966a4d57404f1c06b98670db06)
2003-11-24more access fixes for group enumeration in LDAP; bug 281Gerald Carter1-1/+8
(This used to be commit 68283407e0f366d8315f4be6caed67eb6fe84b85)
2003-10-06split some security related functions in their own files.Simo Sorce1-35/+35
(no need to include all of smbd files to use some basic sec functions) also minor compile fixes couldn't compile to test these due to some kerberos problems wirh 3.0, but on HEAD they're working well, so I suppose it's ok to commit (This used to be commit c78f2d0bd15ecd2ba643bb141cc35a3405787aa1)
2003-09-25Fix for #480. Change the interface for init_unistr2 to not take a lengthJeremy Allison1-38/+33
but a flags field. We were assuming that 2*strlen(mb_string) == length of ucs2-le string. This is not the case. Count it after conversion. Jeremy. (This used to be commit f82c273a42f930c7152cfab84394781744815e0e)
2003-09-19Ensure that dup_sec_desc copies the 'type' field correctly. This causedJeremy Allison1-1/+1
me to expose a type arguement to make_sec_desc(). We weren't copying the SE_DESC_DACL_AUTO_INHERITED flag which could cause errors on auto inherited checks. Jeremy. (This used to be commit 28b315a7501f42928d73efaa75f74146ba95cf2d)
2003-08-15get rid of some sompiler warnings on IRIXHerb Lewis1-1/+1
(This used to be commit a6a39c61e8228c8b3b7552ab3c61ec3a6a639143)
2003-08-01Update my copyrights according to my agreement with IBMJim McDonough1-1/+1
(This used to be commit a2bd8f0bfa12f2a1e33c96bc9dabcc0e2171700d)
2003-07-03Removed strupper/strlower macros that automatically map to ↵Jeremy Allison1-1/+1
strupper_m/strlower_m. I really want people to think about when they're using multibyte strings. Jeremy. (This used to be commit ff222716a08af65d26ad842ce4c2841cc6540959)
2003-06-18Ok, this patch removes the privilege stuff we had in, unused, for some time.Simo Sorce1-20/+38
The code was nice, but put in the wrong place (group mapping) and not supported by most of the code, thus useless. We will put back most of the code when our infrastructure will be changed so that privileges actually really make sense to be set. This is a first patch of a set to enhance all our mapping code cleaness and stability towards a sane next beta for 3.0 code base Simo. (This used to be commit e341e7c49f8c17a9ee30ca3fab3aa0397c1f0c7e)
2003-05-07Set our 'global sam name' in one place. For domain controllers, this isAndrew Bartlett1-19/+4
lp_workgroup(), for all other server this is global_myname(). This is the name of the domain for accounts on *this* system, and getting this wrong caused interesting bugs with 'take ownership' on member servers and standalone servers at Snap. (They lookup the username that they got, then convert that to a SID - but becouse the domain out of the smbpasswd entry was wrong, we would fail the lookup). Andrew Bartlett (This used to be commit 5fc78eba20411f3f5a8ccadfcba5c4ab73180dba)
2003-04-22Oops...Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit 898ff89632a394ff32fd38f1c4e94412388fa8bd)
2003-04-22Make our 'get DNS domain name' code try a bit harder - if gethostname() doesn'tAndrew Bartlett1-3/+11
include a domain portion, do a gethostbyname() lookup on that name. Use this name in our PolicyPrimaryDomainInformation reply (_lsa_query_info2) that Win2k uses when trying to trust us as a trusted domain. (We need to do a better mapping between our Netbios and Win2k domain names, but this will do for now - particularly annoying is the way this possibly needs to map with our kerberos realm). Andrew Bartlett (This used to be commit 3be03271030208a69da29c6e2a7b92cdbaa8c6aa)
2003-03-13Merge of Andrew Bartlett's SID limit fix from HEAD.Jeremy Allison1-0/+5
Jeremy. (This used to be commit 98ed7e0cbbc693b486bb91855cb3331e51daef6c)
2002-11-12Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison1-22/+19
dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit f755711df8f74f9b8e8c1a2b0d07d02a931eeb89)
2002-11-02Merge passdb from HEAD -> 3.0Andrew Bartlett1-9/+9
The work here includes: - metze' set/changed patch, which avoids making changes to ldap on unmodified attributes. - volker's group mapping in passdb patch - volker's samsync stuff - volkers SAMR changes. - mezte's connection caching patch - my recent changes (fix magic root check, ldap ssl) Andrew Bartlett (This used to be commit 2044d60bbe0043cdbb9aba931115672bde975d2f)
2002-09-25sync'ing up for 3.0alpha20 releaseGerald Carter1-0/+2
(This used to be commit 65e7b5273bb58802bf0c389b77f7fcae0a1f6139)
2002-08-17Sync 3.0 branch with HEADJelmer Vernooij1-1/+96
(This used to be commit e01596853e3eea533baa08c33f26ded75f33fdd4)
2002-07-15updated the 3.0 branch from the head branch - ready for alpha18Andrew Tridgell1-19/+39
(This used to be commit 03ac082dcb375b6f3ca3d810a6a6367542bc23ce)
2002-04-09Add a become_root()/unbecome_root() pair to allow acces to the passdb forAndrew Bartlett1-0/+4
SID lookup. This fixes a bug where SIDs (rather than names) are displayed in windows ACL lists (This used to be commit e60c509813a9113cd76135b6ded3018ff04d49f2)
2002-03-29Don't core dump listing thousands of users in usrmgr.Jeremy Allison1-9/+20
Jeremy. (This used to be commit c6566fa5fadf37a2b133e7be1f13c0de93efab34)
2002-03-29Ensure we return a parseable value if invalid handle given.Jeremy Allison1-17/+17
Jeremy. (This used to be commit f169f3f4df81537426f708d68da44e0fc40ad15e)
2002-01-31this fixes the problem of not being able to add a SD to a file on aAndrew Tridgell1-2/+1
non-domain Samba server from a NT4 client. Note that this exactly reverses a change by Jeremy on the 18th of December 2001, reverting the code back to what JF originally wrote. I have looked carefully with a sniffer and JFs original NULL sid is correct (ie. it matches what NT4 does) and also fixes the problem. Sending a blank sid (which is what jeremy's patch did) causes NT4 to give a classic "parameter is incorrect error" and prevents the addition of new ACLs. (This used to be commit 9930cf97330dd93985c5558cec6b24406e90c228)
2002-01-30Removed version number from file header.Tim Potter1-2/+1
Changed "SMB/Netbios" to "SMB/CIFS" in file header. (This used to be commit 6a58c9bd06d0d7502a24bf5ce5a2faf0a146edfa)
2002-01-26Move the lsa code across to the changed args for lookup_name, and surround itAndrew Bartlett1-2/+11
in become_root()/unbecome_root(). Also only allocate the memory the client reqests - and don't allow the client to trigger an SMB_ASSERT if they ask for 'more'. Up the maximum number of sids allowed, and note that this is an arbiary guess, and can be raised without consequence. Andrew Bartlett (This used to be commit 6e7667125d142670db7393ed7a48386f3821d896)
2001-12-31- portablitity fixes for cc -64 on irixAndrew Tridgell1-1/+0
- fixed gid* bug in rpc_server (This used to be commit 48aa90c48c5f0e3054c4acdc49668e222e7c0d36)
2001-12-18Fixup JF's weird SID return :-).Jeremy Allison1-1/+2
Jeremy (This used to be commit 7b8fb8d85c406b8755f60cf14dc2377bc59eda53)
2001-12-18I'm pretty sure we need to return our netbios name for LSA_QUERY_INFOJeremy Allison1-1/+1
level 5 when we're a standalone server. This makes the security dialogs return correct info. JF - please check ! Jeremy. (This used to be commit dd13daf52bc96637ef3d40920cbd3bcadb7e08f5)
2001-12-18in lsa_query_info at level 5 in member mode, we must reply our machineJean-François Micouleau1-1/+1
name and not our domain name. I thought it has been already fixed ! J.F. (This used to be commit 1fbb01868b489c896ad1c65ded223999b0ee6013)
2001-12-17there is no unknown field in LSA_SEC_QOSJean-François Micouleau1-67/+208
some cleanup of the lsa_open_policy and lsa_open_policy2 parser. the length fields are not correct but that's what NT send. We don't anymore underflow or overflow the decoding. added the domain admins group to the default SD. we are now checking the desired access flag in the lsa_open_policy_X() calls and in most functions also. J.F. (This used to be commit a217c4e4ff4d13122703d22258792fe5e8e9f02f)
2001-12-14add lsa_query_secobj server code. level 4 is the ACL, level 1 is theJean-François Micouleau1-0/+70
owner. that's basic stuff. got the POLICY_ define from TNG but they are also in an include file in the NT SDK. J.F. (This used to be commit 84289a9bf42847981926e198ad36c050904fa9ed)
2001-12-04added a boolean to the group mapping functions to specify if we need orJean-François Micouleau1-6/+8
not the privileges. Usually we don't need them, so the memory is free early. lib/util_sid.c: added some helper functions to check an SID. passdb/passdb.c: renamed local_lookup_rid() to local_lookup_sid() and pass an RID all the way. If the group doesn't exist on the domain SID, don't return a faked one as it can collide with a builtin one. Some rpc structures have been badly designed, they return only rids and force the client to do subsequent lsa_lookup_sid() on the domain sid and the builtin sid ! rpc_server/srv_util.c: wrote a new version of get_domain_user_groups(). Only the samr code uses it atm. It uses the group mapping code instead of a bloody hard coded crap. The netlogon code will use it too, but I have to do some test first. J.F. (This used to be commit 6c87e96149101995b7d049657d5c26eefef37d8c)
2001-11-29Changed again how the privilege list is handled in the group mapping code.Jean-François Micouleau1-17/+162
This time it's a PRIVILEGE_SET struct instead of a simple uint32 array. It makes much more sense. Also added a uint32 systemaccount to the GROUP_MAP struct as some privilege showing in USRMGR.EXE are not real privs but a bitmask flag. I guess it's an heritage from NT 3.0 ! I could setup an NT 3.1 box to verify, but I'm too lazy (yes I still have my CDs). Added 3 more LSA calls: SetSystemAccount, AddPrivileges and RemovePrivileges, we can manage all this privilege from UserManager. Time to change the NT_USER_TOKEN struct and add checks in all the rpc functions. Fun, fun, fun. J.F. (This used to be commit 3f0a9ef2b8c626cfa2878394bb7b642342342bf3)
2001-11-23return NO_MORE_ENTRIES in lsa_enum_trust_dom. UserManager is happier :-)Jean-François Micouleau1-1/+1
J.F. (This used to be commit 75ee50bbef531a1487c1f8b76b8e70627fbdbdf1)
2001-11-23Changed how the privileges are stored in the group mapping code. It's nowJean-François Micouleau1-5/+7
an array of uint32. That's not perfect but that's better. Added more privileges too. Changed the local_lookup_rid/name functions in passdb.c to check if the group is mapped. Makes the LSA rpc calls return correct groups Corrected the return code in the LSA server code enum_sids. Only enumerate well known aliases if they are mapped to real unix groups. Won't confuse user seeing groups not available. Added a short/long view to smbgroupedit. now decoding rpc calls to add/remove privileges to sid. J.F. (This used to be commit f29774e58973f421bfa163c45bfae201a140f28c)
generated by cgit (git 2.34.1) at 2024-12-12 12:09:30 +0000