Age | Commit message (Collapse) | Author | Files | Lines |
|
me to expose a type arguement to make_sec_desc(). We weren't copying
the SE_DESC_DACL_AUTO_INHERITED flag which could cause errors on
auto inherited checks.
Jeremy.
(This used to be commit 546b2271c08735ac1049a453abac996d794aa364)
|
|
>Patch from Gregory Hinton Nietsky <gregory@networksentry.co.za>,
>ensure the desired access is read from the incoming RPC request.
>Jeremy.
(This used to be commit a556637d0bc56aeb980c422c4d1da44311956c3b)
|
|
(This used to be commit c17a7dc9a190156a069da3e861c18fd3f81224ad)
|
|
(This used to be commit 3101c236b8241dc0183995ffceed551876427de4)
|
|
prior to this merge, checkout HEAD_PRE_3_0_0_BETA_3_MERGE
(This used to be commit adb98e7b7cd0f025b52c570e4034eebf4047b1ad)
|
|
in add groupmem code.
Jeremy.
(This used to be commit 7e7077e9e363f46cea93767f0463581dbec87063)
|
|
Jeremy.
(This used to be commit e12934c67b6aea9e3e449009e159ce6814dcbd11)
|
|
plus internal fixes
1st stage
(This used to be commit 6d036761e565bc93964bb3c939d5b7d78d5778a3)
|
|
SAM_ACCOUNT does not have anymore uid and gid fields
all the code that used them has been fixed to use the proper idmap calls
fix to idmap_tdb for first time idmap.tdb initialization.
auth_serversupplied_info structure has now an uid and gid field
few other fixes to make the system behave correctly with idmap
tested only with tdbsam, but smbpasswd and nisplus should be ok
have not tested ldap !
(This used to be commit 6a6f6032467e55aa9b76390e035623976477ba42)
|
|
of sync-up for the rpc_server/srv_samr_nt.c
Andrew Bartlett
(This used to be commit 3c867aedd9abc29389f5d049dbc94ada6738d1b0)
|
|
(This used to be commit ba1e654a15fa800e56732fe005afd7479c18324b)
|
|
the credentials from secrets.tdb
(This used to be commit cf6af44a2464cf1d9bea909dbc0e20829bdc2665)
|
|
includes a --with-idmap=no switch to disable idmap usage if you find
problems.
cosmetic fixes and param aliases to separate winbind from idamp roles.
A temporarily remote idmap winbind compatibility backend.
As I have time I will further change code to not call directly winbind
(partly done but not tested) and a specilized module will be built in place
for the current glue hack.
The patch has been tested locally in my limited time, the patch is simple and
clear and should not reserve problems, if any just disable it.
As usual, comments and fisex are welcome :-)
Simo.
(This used to be commit 02781320476ed1b7ee5d943fa36f9a66ab67f208)
|
|
a bit better.
This just sets the minimum possible attributes - if we are 'upgrading' an
LDAP based user account, the attributes will be there anyway. This matches
NT pretty well to.
This also fixes some use of unitialised values in the desired_access checking.
(found by valgrind).
Andrew Bartlett
(This used to be commit 929213ff2a5829ba8435ba1be0de317bca1e0da0)
|
|
When we look see if a user is in a list, and we try to 'expand' an @group, we
should lookup the user's own list of groups, rather than looking for all the
members of a group.
I'm sure this will fix some nasty performance issues, particularly on large
domains etc. In particular, this avoids contacting winbind at all, if the
group is not a winbind group.
(This caused a deadlock on my winbind-on-PDC setup).
The groups list always includes the user's primary group, as per the
getgrouplist manpage, and my recent changes to our implementation.
Andrew Bartlett
(This used to be commit 9be21976f7662ebe6eb92fff7cecbdb352eca334)
|
|
(This used to be commit e3d00fa47d38cd214f5e350e1d6b30d90ed8a52c)
|
|
calls to init_unistr2() in the code and every one of them got the 3rd
argument incorrect, so I thought it best just to remove the argument.
The incorrect usage was caused by callers using strlen() to determine
the length of the string. The 3rd argument to init_unistr2() was
supposed to be the character length, not the byte length of the
string, so for non-english this could come out wrong.
I also removed the bogus 'always allocate at least 256 bytes'
hack. There may be some code that relies on this, but if there is then
the code is broken and needs fixing.
(This used to be commit b9eff31b1433c81fbff733e194914a40f25e3bda)
|
|
(This used to be commit 9ac196dad4893b0ceef13281a140be5d85391e6c)
|
|
minimum password age and min password length for all password changes.
Andrew Bartlett
(This used to be commit 028f808c032becfa4618924cb301a4af2708fa96)
|
|
named. Ensure we can query them.
Jeremy.
(This used to be commit 842e08e52a665ae678eea239759bb2de1a0d7b33)
|
|
(This used to be commit 43cd6e5a702bb1004b36a5845e0765851395ebf2)
|
|
dashes of const. This is a rather large check-in, some things may break.
It does compile though :-).
Jeremy.
(This used to be commit 82b8f749a36b42e22186297482aad2abb04fab8a)
|
|
(This used to be commit 62ee7b7dc08e7be261211de8f85b8e9be4df7b54)
|
|
place.
Jeremy.
(This used to be commit e46e38beabe8ae5b1ba1941dcffecbc89165ce2a)
|
|
Jeremy.
(This used to be commit 4d9b205362997f897be4739efd52ee2cfde4c6cb)
|
|
This is not 100% the same as what SuSE shipped in their Samba, there is
a crash bug fix, a race condition fix, and a few logic changes I'd like to
discuss with Andreas. Added Andreas to (C) notices for posix_acls.c
Jeremy.
(This used to be commit a81d700ae9c82d4b7ea631ab7862162a2ed3d512)
|
|
Volker
(This used to be commit 1f702dcd2ced6f64a619e3ddbb570f41f7f0986b)
|
|
Currently this calls back to mapping.c, but we have the framework
to get the information into LDAP and the passdb.tdb (should we? I
think so..).
This has received moderate testing with net rpc vampire and
usrmgr. I found the add_groupmem segfault in add_aliasmem as
well, but that will be another checkin.
Volker
(This used to be commit f30095852fea19421ac8e25dfe9c5cd4b2206f84)
|
|
Volker
(This used to be commit 32d6bcf3acefc77873a7241cc0c7e26241a65301)
|
|
The actual design change is relitivly small however:
It all goes back to jerry's 'BOOL store', added to many of the elements in a
SAM_ACCOUNT. This ensured that smb.conf defaults did not get 'fixed' into
ldap. This was a great win for admins, and this patch follows in the same way.
This patch extends the concept - we don't store values back into LDAP unless
they have been changed. So if we read a value, but don't update it, or we
read a value, find it's not there and use a default, we will not update
ldap with that value. This reduced clutter in our LDAP DB, and makes it
easier to change defaults later on.
Metze's particular problem was that when we 'write back' an unchanged value,
we would clear any muliple values in that feild. Now he can still have his
mulitivalued 'uid' feild, without Samba changing it for *every* other
operation.
This also applies to many other attributes, and helps to eliminate a nasty
race condition. (Time between get and set)
This patch is big, and needs more testing, but metze has tested usrmgr, and
I've fixed some pdbedit bugs, and tested domain joins, so it isn't compleatly
flawed ;-).
The same system will be introduced into the SAM code shortly, but this fixes
bugs that people were coming across in production uses of Samba 3.0/HEAD, hence
it's inclusion here.
Andrew Bartlett
(This used to be commit 7f237bde212eb188df84a5d8adb598a93fba8155)
|
|
only in parts of srv_samr_nt is not good.
This is soo broken. :-)
Volker
(This used to be commit 74e4a3479f380b320daa0d46c0ba4daa9f98c18f)
|
|
also try to uniform names to a clean scheme.
first part.
(This used to be commit a123e05877caf90c28980be2d84b1d0b46e4fd21)
|
|
(This used to be commit 2613d3a48a8d60c3db38406a1abd943dbe0b7d09)
|
|
group mapping not as local, but as WKN_GRP.
Volker
(This used to be commit cb05dcab2de117ea4db54af313a05905cd5a0d0a)
|
|
control bits right on the SAMR pipe.
Andrew Bartlett
(This used to be commit e87948c777b59592b130da081ef5d25600455d29)
|
|
better job of working with usrmgr. Previously we were blanking out entires,
and all sort of mischif.
The new patch (which I've now had a chance to test/modify) also takes care not
to expand % values (ie we go \\%L\%U -> \\server\user, we don't want to store
\\server\user back) and to correctly notice 'not set' compared to 'null string'
etc.
Andrew Bartlett
(This used to be commit ab878b6cc4132594fc33f78aeebf0d8b7266c150)
|
|
When creating a group you have to take care of the fact that the
underlying unix might not like the group name. This change gets around
that problem by giving the add group script the chance to invent a
group name. It then must only return the newly created numerical gid.
Volker
(This used to be commit b959419ed38e66a12b63cad3e5fbfa849f952acc)
|
|
(This used to be commit 9d6331524089d76c5832b9ba001fb0e8a05f39d7)
|
|
acb_mask/all_machines flag combination. The avoids a bug where we were listing
users in the 'trusting domains' dialog in usrmgr.
We might also need to invalidate the cache for some other SAMR actions.
Andrew Bartlett
(This used to be commit 65047aee7fefefaecded9772184a54c046ab1784)
|
|
the DC's SAM. We were only returning workstations, not PDCs or BDCs.
Win2k's 'Computer Manager' tool uses this to list all computers in the domain
(as opposed to using NetBIOS).
Andrew Bartlett
(This used to be commit 004090edffef6cc04c286b9924b8c47ea3260ef2)
|
|
Volker
(This used to be commit 70cf2f1e2f0187c546a0193824ab85a416c5236c)
|
|
links successfully!
(This used to be commit 0ea4bcb6b772a0d95d20f7c1a2a0c08a0ba9e466)
|
|
(This used to be commit 7573fd1746dfe5034deb51a6d205e15af6ff81de)
|
|
might be ugly, etc - please don't blame me for anything but instead try to fix
the code :-). Compiling of the new sam system can be enabled with the
configure option --with-sam
Removing passdb/passgrp.c as it's unused
fix typo in utils/testparm.c
(This used to be commit 4b7de5ee236c043e6169f137992baf09a95c6f2c)
|
|
(This used to be commit 8ebc295f4a487993474390e0686d2aa9313be8d1)
|
|
(This used to be commit bc9e9e3e2e0d861f34de26a9ef8b627a86c9954d)
|
|
(This used to be commit 482d873c26bf02e27ffcd92042b476eda765a5ff)
|
|
existing connect (which I've been told is really connect2), with one
extra dword. We've only seen 0x00000002 there...
(This used to be commit 266344634944dff30f56453f9d86c490e7ac7a55)
|
|
patches:
Andrew Bartlett
From his e-mail:
Below I attach the following patches as a result of my work
on trusted domains support:
1) srv_samr_nt.c.diff
This fixes a bug which caused to return null string as
the first entry of enumerated accounts list (no matter what
entry, it was always null string and rid) and possibly
spoiled further names, depeding on their length.
I found that while testing my 'net rpc trustdom list'
against nt servers and samba server.
2) libsmb.diff
Now, fallback to anonymous connection works correctly.
3) smbpasswd.c.diff
Just a little fix which actually allows one to create
a trusting domain account using smbpasswd
4) typos.diff
As the name suggests, it's just a few typos fix :)
(This used to be commit 888d595fab4f6b28318b743f47378cb7ca35d479)
|
|
Andrew Bartlett
(This used to be commit 88b68f79721b5fea7ddcad5a83b9555528c75c20)
|