summaryrefslogtreecommitdiff
path: root/source3/rpc_server/srv_samr_nt.c
AgeCommit message (Collapse)AuthorFilesLines
2004-03-04There's a specific error message NT_STATUS_ALIAS_EXISTS.Volker Lendecke1-1/+1
(This used to be commit 0ad00bce0752373a1ac471f6629a5e64ee5af280)
2004-03-03more usrmgr fixes: display lockout timers in minutes, not seconds, for samr 2eJim McDonough1-2/+2
(This used to be commit 95e7cfdb19bab4a5aac59e10afb3b1416e6079c5)
2004-03-01Ok here it is my latest work on privilegesSimo Sorce1-20/+52
This patch add privilege support for samba Currently it is implemented only for tdbsam backend but estending it to other sam backends is straightforward. I must make a big thank to JFM for his teachings on the matter and the functions at the base of this work. At thye moment only samr_create_user honours SeAddUsersPrivilege and SeMachineAccountPrivilege to permit any user to add machines and/or users to the server. The command "net priv" has been provided to manipulate the privileges database. There are still many things to do (like support in "net rpc vampire") but the working core is here. Feel free to comment/extend on this work. Of course I will deny that any bug may affect this code :-) Simo. This patch adds also my patch about add share command enhancements. (This used to be commit 7a78c3605e203bd8e0d7ae244605f076a5d0b0bc)
2004-02-29Apply my experimental aliases support to HEAD. This will be a bit difficult toVolker Lendecke1-3/+6
merge to 3_0, as the pdb interfaces has changed a bit between the two. This has not been tested too severly (which means it's completely broken ;-), but I want it in for review. Feel free to revert it :-) TODO: make 'net groupmap' a bit more friendly for alias members. Put that stuff into pdb_ldap. Getting the information over to winbind. One plan without linking pdb into winbind would be to fill group_mapping.tdb with the membership information and have that as a cache (or use gencache.tdb?). smbd on a PDC or stand-alone could trigger that itself, the problem is a BDC using LDAP. This needs to do it on a regular basis. The BDC smbd needs to be informed about SAM changes somehow... Volker (This used to be commit 30ef8fe1e85c0ca229b54f3f1595c4330f7191d1)
2004-02-29net_rpc.c: Don't complain if [add|del]mem was successful.Volker Lendecke1-1/+1
srv_samr_nt.c: Correctly report that a user is not member of an alias. Volker (This used to be commit 26d99204b7cbfa8e259f2a8438eadc9ff6be0709)
2004-02-25Do the query part of the previous fix...reset time and duration are set in ↵Jim McDonough1-2/+2
minutes, not seconds. Works from usrmgr. (This used to be commit d02dd0e5f5fae3256b1922c2963e18c8fa36a3e6)
2004-02-25reset time and duration are set in minutes, not seconds. Works from usrmgr.Jim McDonough1-2/+2
(This used to be commit 08a7c9697d49719e4cfb32a06720873c98585f67)
2004-02-17Also set alias info for builtins.Volker Lendecke1-1/+2
Volker (This used to be commit 32682cd81485e295720fc65c98669c2e6e5c6043)
2004-02-17In samr_lookup_names Windows does not return WKN_GRP(5) but ALIAS(4) whenVolker Lendecke1-1/+6
you search in BUILTIN. Match that. Volker (This used to be commit 471cf1bf87638953bec4954667bbf8a49c693903)
2004-02-16Cosmetic fix: use sid_is_in_our_domain.Volker Lendecke1-7/+3
Volker (This used to be commit fc0dc0607d03eaefc2a0e3ffe7f1cf3612e73e0c)
2004-01-26(merge from 3.0)Andrew Bartlett1-2/+2
This adds client-side support for the unicode/SAMR password change scheme. As well as avoiding DOS charset issues, this scheme returns useful error codes, that we can map back via the pam interface. This patch also cleans up the interfaces used for password buffers, to avoid duplication of code. Andrew Bartlett (This used to be commit 8063b8b6c2eb30cb116988e265fb289109d7c348)
2004-01-15Bug 381: check builtin (not local) group SID. Patch from Jianliang Lu ↵Gerald Carter1-1/+1
<j.lu@tiesse.com> (This used to be commit 59cabc5b940990352ebd0ceef8b6e85ac04669c4)
2004-01-13sync HEAD with recent changes in 3.0Gerald Carter1-3/+14
(This used to be commit c98399e3c9d74e19b7c9d806ca8028b48866931e)
2004-01-09fix some warnings from the Sun compiler; also merge some of abartlet's error ↵Gerald Carter1-1/+1
code changes form 3.0 (This used to be commit 2279e98cb81faaf8a4e971fec339955f14c23858)
2004-01-05(merge from 3.0)Andrew Bartlett1-2/+2
Match Win2k, and return NT_STATUS_INVALID_PARAMETER if this parameter is not an account type Andrew Bartlett (This used to be commit 43ee2e0b6a6f95ce2864befeb08b5de2ace41c7c)
2004-01-05(merge from 3.0)Andrew Bartlett1-99/+50
JHT came up with a nasty (broken) torture case in preparing examples for his book. This prompted me to look at the code that reads the unix group list. This code did a lot of name -> uid -> name -> sid translations, which caused problems. Instead, we now do just name -> sid I also cleaned up some interfaces, and client tools. Andrew Bartlett (This used to be commit cc535a6c70d8dcf677322e31b24dec58b23d80f0)
2003-12-16make sure we delete the group mapping before calling the delete group ↵Gerald Carter1-2/+4
script; patch from Jianliang Lu <j.lu@tiesse.com> (This used to be commit 66edeb855e7d7a0bfa20cbe93275c86880bd453d)
2003-12-10more group lookup access fixes on the neverending bug 281Gerald Carter1-1/+6
(This used to be commit 975ac6f5aa4d8d709733757e4e003f3c551fc9ba)
2003-12-07Merge from 3.0:Andrew Bartlett1-0/+6
source/libsmb/ntlmssp.c: Picked up by the build farm - despite all my efforts, security=server was broken by my NTLM2 commit. This should correctly cause the NTLM2 case not to be negotiated when 'security=server' is in effect. testsuide/build_farm/runlist: Without 'non unix accounts' we can't test security=domain on the build farm. source/rpc_server/srv_samr_nt.c: Match Win2k and return 'invalid parameter' for creating of a new account with account flags of 0. Andrew Bartlett (This used to be commit e97f1eb62ae01b5259d7ecfab9b55b07103379c7)
2003-12-04* fix RemoveSidForeignDomain() ; bug 252Gerald Carter1-46/+81
* don't fall back to unmapped UNIX group for get_local_group_from_sid() * remove an extra become/unbecome_root() pair from group enumeration (This used to be commit c0f34b42a6a4af09ae4b76721bc350784d87f686)
2003-11-24more access fixes for group enumeration in LDAP; bug 281Gerald Carter1-3/+5
(This used to be commit c4ce92e80688fe7fd4b2fde2c31e94baf3e4dca0)
2003-11-23Merge from 3.0:Andrew Bartlett1-9/+6
Add support for variable-length session keys in our client code. This means that we now support 'net rpc join' with KRB5 (des based) logins. Now, you need to hack 'net' to do that, but the principal is important... When we add kerberos to 'net rpc', it should be possible to still do user management and the like over RPC. - Add server-side support for variable-length session keys (as used by DES based krb5 logins). Andrew Bartlett (This used to be commit 1287cf5f921327c9ea758de46220c4e2dedc485c)
2003-11-22(merge from 3.0)Andrew Bartlett1-3/+15
Changes all over the shop, but all towards: - NTLM2 support in the server - KEY_EXCH support in the server - variable length session keys. In detail: - NTLM2 is an extension of NTLMv1, that is compatible with existing domain controllers (unlike NTLMv2, which requires a DC upgrade). * This is known as 'NTLMv2 session security' * (This is not yet implemented on the RPC pipes however, so there may well still be issues for PDC setups, particuarly around password changes. We do not fully understand the sign/seal implications of NTLM2 on RPC pipes.) This requires modifications to our authentication subsystem, as we must handle the 'challege' input into the challenge-response algorithm being changed. This also needs to be turned off for 'security=server', which does not support this. - KEY_EXCH is another 'security' mechanism, whereby the session key actually used by the server is sent by the client, rather than being the shared-secret directly or indirectly. - As both these methods change the session key, the auth subsystem needed to be changed, to 'override' session keys provided by the backend. - There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation. - The 'names blob' in NTLMSSP is always in unicode - never in ascii. Don't make an ascii version ever. - The other big change is to allow variable length session keys. We have always assumed that session keys are 16 bytes long - and padded to this length if shorter. However, Kerberos session keys are 8 bytes long, when the krb5 login uses DES. * This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. * - Add better DEBUG() messages to ntlm_auth, warning administrators of misconfigurations that prevent access to the privileged pipe. This should help reduce some of the 'it just doesn't work' issues. - Fix data_blob_talloc() to behave the same way data_blob() does when passed a NULL data pointer. (just allocate) REMEMBER to make clean after this commit - I have changed plenty of data structures... Andrew Bartlett (This used to be commit 57a895aaabacc0c9147344d097d333793b77c947)
2003-11-17* make sure we only enumerate group mapping entriesGerald Carter1-135/+44
(not /etc/group) even when doing local aliases * remove "hide local users" parameter; we have this behavior built into 3.0 (This used to be commit 3b75e862dfba42c95e2279c300c06bb981f52993)
2003-11-07* only install swat html files onceGerald Carter1-3/+17
* revert the change that prevent the guest account from being added to a passdb backend since it broke the build farm. * apply patch from Alex Deiter to fix the "smbldap_open: cannot access when not root error" messages when looking up group information (bug 281) (This used to be commit 20bd309239199d85accb2b7aac6d4dd73e414f85)
2003-11-07Handle munged dial string. Patch from Aur?lien Degr?mont <adegremont@idealx.com>Jeremy Allison1-1/+36
with memory leak fixes by me. Jeremy. (This used to be commit daceed37387c517b3f0ab9c173f419215e3d676b)
2003-09-29Merge from 3.0:Tim Potter1-14/+9
>Fix for #480. Change the interface for init_unistr2 to not take a length >but a flags field. We were assuming that 2*strlen(mb_string) == length of ucs2-le string. >This is not the case. Count it after conversion. >Jeremy. (This used to be commit e2ab9e54cd0ec0002175cf18ff364f4aebaf85a0)
2003-09-19Ensure that dup_sec_desc copies the 'type' field correctly. This causedJeremy Allison1-4/+4
me to expose a type arguement to make_sec_desc(). We weren't copying the SE_DESC_DACL_AUTO_INHERITED flag which could cause errors on auto inherited checks. Jeremy. (This used to be commit 546b2271c08735ac1049a453abac996d794aa364)
2003-09-15Merge from Samba 3.0:Tim Potter1-1/+1
>Patch from Gregory Hinton Nietsky <gregory@networksentry.co.za>, >ensure the desired access is read from the incoming RPC request. >Jeremy. (This used to be commit a556637d0bc56aeb980c422c4d1da44311956c3b)
2003-09-09sync 3.0 into HEAD for the last timeGerald Carter1-17/+95
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
2003-08-02port latest changes from SAMBA_3_0 treeSimo Sorce1-17/+17
(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)
2003-07-16trying to get HEAD building again. If you want the codeGerald Carter1-83/+129
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE (This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
2003-05-16Patch from "Esh, Andrew" <Andrew_Esh@adaptec.com> to fix core dump bugJeremy Allison1-1/+14
in add groupmem code. Jeremy. (This used to be commit 7e7077e9e363f46cea93767f0463581dbec87063)
2003-05-12Fix compiler warnings.Jeremy Allison1-1/+0
Jeremy. (This used to be commit e12934c67b6aea9e3e449009e159ce6814dcbd11)
2003-05-01*id_to_*id call reshape to return NTSTATUS errorsSimo Sorce1-1/+1
plus internal fixes 1st stage (This used to be commit 6d036761e565bc93964bb3c939d5b7d78d5778a3)
2003-04-29This is a nice rewrite:Simo Sorce1-20/+6
SAM_ACCOUNT does not have anymore uid and gid fields all the code that used them has been fixed to use the proper idmap calls fix to idmap_tdb for first time idmap.tdb initialization. auth_serversupplied_info structure has now an uid and gid field few other fixes to make the system behave correctly with idmap tested only with tdbsam, but smbpasswd and nisplus should be ok have not tested ldap ! (This used to be commit 6a6f6032467e55aa9b76390e035623976477ba42)
2003-04-29Merge 3.0's change to how we add users onto HEAD, including a few other bitsAndrew Bartlett1-57/+12
of sync-up for the rpc_server/srv_samr_nt.c Andrew Bartlett (This used to be commit 3c867aedd9abc29389f5d049dbc94ada6738d1b0)
2003-04-29only call the add_script if the getpwnam_alloc() failsGerald Carter1-22/+27
(This used to be commit ba1e654a15fa800e56732fe005afd7479c18324b)
2003-04-22wrap pdb_enum_group_mapping() in [un]become_root() so LDAP queries can get ↵Gerald Carter1-0/+5
the credentials from secrets.tdb (This used to be commit cf6af44a2464cf1d9bea909dbc0e20829bdc2665)
2003-04-02THE Idmap patch :-)Simo Sorce1-1/+1
includes a --with-idmap=no switch to disable idmap usage if you find problems. cosmetic fixes and param aliases to separate winbind from idamp roles. A temporarily remote idmap winbind compatibility backend. As I have time I will further change code to not call directly winbind (partly done but not tested) and a specilized module will be built in place for the current glue hack. The patch has been tested locally in my limited time, the patch is simple and clear and should not reserve problems, if any just disable it. As usual, comments and fisex are welcome :-) Simo. (This used to be commit 02781320476ed1b7ee5d943fa36f9a66ab67f208)
2003-03-21Give volker a hand, and let domain joins with existing user accounts workAndrew Bartlett1-12/+38
a bit better. This just sets the minimum possible attributes - if we are 'upgrading' an LDAP based user account, the attributes will be there anyway. This matches NT pretty well to. This also fixes some use of unitialised values in the desired_access checking. (found by valgrind). Andrew Bartlett (This used to be commit 929213ff2a5829ba8435ba1be0de317bca1e0da0)
2003-02-17This patch fixes one of my longest-standing pet hates with Samba :-).Andrew Bartlett1-10/+10
When we look see if a user is in a list, and we try to 'expand' an @group, we should lookup the user's own list of groups, rather than looking for all the members of a group. I'm sure this will fix some nasty performance issues, particularly on large domains etc. In particular, this avoids contacting winbind at all, if the group is not a winbind group. (This caused a deadlock on my winbind-on-PDC setup). The groups list always includes the user's primary group, as per the getgrouplist manpage, and my recent changes to our implementation. Andrew Bartlett (This used to be commit 9be21976f7662ebe6eb92fff7cecbdb352eca334)
2003-01-17reverted this patch till I sort out the craziness with UNIHDRAndrew Tridgell1-4/+4
(This used to be commit e3d00fa47d38cd214f5e350e1d6b30d90ed8a52c)
2003-01-17This removes the 3rd argument from init_unistr2(). There were 240Andrew Tridgell1-4/+4
calls to init_unistr2() in the code and every one of them got the 3rd argument incorrect, so I thought it best just to remove the argument. The incorrect usage was caused by callers using strlen() to determine the length of the string. The 3rd argument to init_unistr2() was supposed to be the character length, not the byte length of the string, so for non-english this could come out wrong. I also removed the bogus 'always allocate at least 256 bytes' hack. There may be some code that relies on this, but if there is then the code is broken and needs fixing. (This used to be commit b9eff31b1433c81fbff733e194914a40f25e3bda)
2003-01-15small merges from SAMBA_3_0; mostly typos, renames, etc...Gerald Carter1-1/+1
(This used to be commit 9ac196dad4893b0ceef13281a140be5d85391e6c)
2003-01-01Move our password change code along a little - use NTSTATUS, and implmenetAndrew Bartlett1-3/+2
minimum password age and min password length for all password changes. Andrew Bartlett (This used to be commit 028f808c032becfa4618924cb301a4af2708fa96)
2002-12-20Forward port the change to talloc_init() to make all talloc contextsJeremy Allison1-1/+1
named. Ensure we can query them. Jeremy. (This used to be commit 842e08e52a665ae678eea239759bb2de1a0d7b33)
2002-11-20Spelling fix.Tim Potter1-1/+1
(This used to be commit 43cd6e5a702bb1004b36a5845e0765851395ebf2)
2002-11-12Removed global_myworkgroup, global_myname, global_myscope. Added liberalJeremy Allison1-9/+7
dashes of const. This is a rather large check-in, some things may break. It does compile though :-). Jeremy. (This used to be commit 82b8f749a36b42e22186297482aad2abb04fab8a)
2002-11-08Make it easier to track things down here - add some debugs on failure.Andrew Bartlett1-0/+2
(This used to be commit 62ee7b7dc08e7be261211de8f85b8e9be4df7b54)
generated by cgit (git 2.34.1) at 2025-01-13 20:32:15 +0000