Age | Commit message (Collapse) | Author | Files | Lines |
|
allocation
functions so we can funnel through some well known functions. Should help greatly with
malloc checking.
HEAD patch to follow.
Jeremy.
(This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)
|
|
abartlet, I'd like to ask you to take a severe look at this!
We have solved the problem to find the global groups a user is in twice: Once
in auth_util.c and another time for the corresponding samr call. The attached
patch unifies these and sends them through the passdb backend (new function
pdb_enum_group_memberships). Thus it gives pdb_ldap.c the chance to further
optimize the corresponding call if the samba and posix accounts are unified by
issuing a specialized ldap query.
The parameter to activate this ldapsam behaviour is
ldapsam:trusted = yes
Volker
(This used to be commit b94838aff1a009f8d8c2c3efd48756a5b8f3f989)
|
|
implementation does
not exactly match what you would expect.
XP workstations during login actually do this, so we should better become a
bit more correct. The LDAP query issued is not really fully optimal, but it is
a lot faster and more correct than what was there before. The change in
passdb.h makes it possible that queryuseraliases is done with a single ldap
query.
Volker
(This used to be commit 2508d4ed1e16c268fc9f3676b0c6a122e070f93d)
|
|
user is deleted first before deleting UNIX user (LDAP backend
needs this ordering).
Jeremy.
(This used to be commit 2815b31e013e517a58027ba74f118209caf4d85f)
|
|
relationships.
Jeremy.
(This used to be commit b910e530027c19c4e505314a91ffcb72f20d8f09)
|
|
(This used to be commit f836be323a233f3a28cbaa04c532e83ea98ead89)
|
|
Thanks to Jonas Olsson for the bug report & fix.
Volker
(This used to be commit de0eaf7be7d0c3aaf4e17b63653ca68b4332c982)
|
|
<j.lu@tiesse.com>.
Jeremy.
(This used to be commit d5fb5ba9df9fc0f9167e76402c59a971f52e1b1f)
|
|
Volker
(This used to be commit b4429d97439e511d40901f809e3923945cb52221)
|
|
(This used to be commit 911a28361b9d8dd50597627f245ebfb57c6294fb)
|
|
Volker
(This used to be commit 6e18bed17093e0b1792f68817096e64e0e841f26)
|
|
(This used to be commit b393469d9581f20e4d4c52633b952ee984cca36f)
|
|
(This used to be commit f0d99f318c67852ac5bf9b606faa115ad36a5f80)
|
|
(This used to be commit 832674c099a3ff9bb747dba6235e47d40a930abd)
|
|
srv_samr_nt.c: Correctly report that a user is not member of an alias.
Volker
(This used to be commit 540f625036871e7facd094fce49d7317f65f4ffd)
|
|
minutes, not seconds. Works from usrmgr.
(This used to be commit 98833a82facb0bc25d9ba6f4d4c1200627e98d6d)
|
|
(This used to be commit 700049d9efefc7f8952cc60bc46ba8aa790a28ba)
|
|
Volker
(This used to be commit 7a947ecdf56f2dd02811262372708f8a74bfedad)
|
|
you search in BUILTIN. Match that.
Volker
(This used to be commit 2863b21d8a5933c309c51edb09fbda4e669e4890)
|
|
Volker
(This used to be commit 04639e8862c360e89faac8b80c63197d514b7455)
|
|
(This used to be commit b60f6ec30d05e4e5bba9934a416ddc8bc089824f)
|
|
As well as avoiding DOS charset issues, this scheme returns useful error
codes, that we can map back via the pam interface.
This patch also cleans up the interfaces used for password buffers, to
avoid duplication of code.
Andrew Bartlett
(This used to be commit 2a2b1f0c872d154fbcce71a250e23dfad085ba1e)
|
|
<j.lu@tiesse.com>
(This used to be commit 2fd2c07df42df42103e81f5eb39bd1778de6ca0a)
|
|
(This used to be commit 6202e0fa727a4307f51bf42f5ced401a7c7b8214)
|
|
This adds a configure test, that tries to find out if we have a working
cracklib installation, and tries to pick up the debian hints on where
the dictionary might be found. Default is per my Fedora Core 1 system -
I'm not sure how much it changes.
Andrew Bartlett
(This used to be commit bc770edb788f0b6f719011cda683f045b76b7ba5)
|
|
(This used to be commit ebabf72a78f0165521268b73e0fcabe1ea7834fd)
|
|
if this parameter is not an account type
Andrew Bartlett
(This used to be commit faddf5d8f9821176f4367caaf61844980df9f79c)
|
|
his book.
This prompted me to look at the code that reads the unix group list. This
code did a lot of name -> uid -> name -> sid translations, which caused
problems. Instead, we now do just name->sid
I also cleaned up some interfaces, and client tools.
Andrew Bartlett
(This used to be commit f9e59f8bc06fae7e5c8cb0980947f78942dc25c0)
|
|
script; patch from Jianliang Lu <j.lu@tiesse.com>
(This used to be commit 19a8dd523a4ee50ba9066efd60a29cf3ba9ae419)
|
|
(This used to be commit 9359a6ea80d1228e87ea825a100a2d289c37162d)
|
|
* don't fall back to unmapped UNIX group for
get_local_group_from_sid()
* remove an extra become/unbecome_root() pair
from group enumeration
(This used to be commit da12bbdb0dd9179b1ed457fa009679e2da4a8440)
|
|
account flags of 0.
Andrew Bartlett
(This used to be commit 601120f335b69e5b8a003038dfac00f3f234a5c1)
|
|
(This used to be commit 68283407e0f366d8315f4be6caed67eb6fe84b85)
|
|
DES based krb5 logins).
Andrew Bartlett
(This used to be commit 240b0d178e1b4a3556207bdf2e342c70155f64ee)
|
|
- NTLM2 support in the server
- KEY_EXCH support in the server
- variable length session keys.
In detail:
- NTLM2 is an extension of NTLMv1, that is compatible with existing
domain controllers (unlike NTLMv2, which requires a DC upgrade).
* This is known as 'NTLMv2 session security' *
(This is not yet implemented on the RPC pipes however, so there may
well still be issues for PDC setups, particuarly around password
changes. We do not fully understand the sign/seal implications of
NTLM2 on RPC pipes.)
This requires modifications to our authentication subsystem, as we
must handle the 'challege' input into the challenge-response algorithm
being changed. This also needs to be turned off for
'security=server', which does not support this.
- KEY_EXCH is another 'security' mechanism, whereby the session key
actually used by the server is sent by the client, rather than being
the shared-secret directly or indirectly.
- As both these methods change the session key, the auth subsystem
needed to be changed, to 'override' session keys provided by the
backend.
- There has also been a major overhaul of the NTLMSSP subsystem, to merge the 'client' and 'server' functions, so they both operate on a single structure. This should help the SPNEGO implementation.
- The 'names blob' in NTLMSSP is always in unicode - never in ascii.
Don't make an ascii version ever.
- The other big change is to allow variable length session keys. We
have always assumed that session keys are 16 bytes long - and padded
to this length if shorter. However, Kerberos session keys are 8 bytes
long, when the krb5 login uses DES.
* This fix allows SMB signging on machines not yet running MIT KRB5 1.3.1. *
- Add better DEBUG() messages to ntlm_auth, warning administrators of
misconfigurations that prevent access to the privileged pipe. This
should help reduce some of the 'it just doesn't work' issues.
- Fix data_blob_talloc() to behave the same way data_blob() does when
passed a NULL data pointer. (just allocate)
REMEMBER to make clean after this commit - I have changed plenty of data structures...
(This used to be commit f3bbc87b0dac63426cda6fac7a295d3aad810ecc)
|
|
(not /etc/group) even when doing local aliases
* remove "hide local users" parameter; we have this
behavior built into 3.0
(This used to be commit a7685a069766ac720f0b26fe01b0e17fc388fca3)
|
|
* revert the change that prevent the guest
account from being added to a passdb backend
since it broke the build farm.
* apply patch from Alex Deiter to fix the
"smbldap_open: cannot access when not root
error" messages when looking up group
information (bug 281)
(This used to be commit 9b8bf6a950186bd95abe952af4a7d35829b34ff8)
|
|
<adegremont@idealx.com>with memory leak fixes by me.
Jeremy.
(This used to be commit e591854eda8568ed1a4ad6b9de64e523c02b4392)
|
|
but a flags field. We were assuming that 2*strlen(mb_string) == length of ucs2-le string.
This is not the case. Count it after conversion.
Jeremy.
(This used to be commit f82c273a42f930c7152cfab84394781744815e0e)
|
|
me to expose a type arguement to make_sec_desc(). We weren't copying
the SE_DESC_DACL_AUTO_INHERITED flag which could cause errors on
auto inherited checks.
Jeremy.
(This used to be commit 28b315a7501f42928d73efaa75f74146ba95cf2d)
|
|
ensure the desired access is read from the incoming RPC request.
Jeremy.
(This used to be commit fdc5dda44f0190af4e4b0782cb2c5c7de3506d12)
|
|
(This used to be commit f4ca4aae8ad0496b76c710cf79c791724bdaa4ec)
|
|
call.
(This used to be commit dd2cf4897ec3db25c24a2724ffdef4f905625f6a)
|
|
(This used to be commit a6a39c61e8228c8b3b7552ab3c61ec3a6a639143)
|
|
Fixed by storing the access requested on the anonymous samr connect.
Restricted this to enum_domain|open_domain.
Added become/unbecome_root() around pdb_enum_group_mapping()
enum domain groups samr call.
(This used to be commit 36fc199e5f573fea9b7e2c1cf01ad42744a42f08)
|
|
(This used to be commit a2bd8f0bfa12f2a1e33c96bc9dabcc0e2171700d)
|
|
(This used to be commit 15d2bc47854df75f8b2644ccbc887d0357d9cd27)
|
|
to allow UNIX password change scripts to work correctly. This is safe as
the old password has been checked as correct before invoking this.
Jeremy.
(This used to be commit 1734d43eb55561d46a6ffb5d806afedfd3746f9f)
|
|
time. )-:
(This used to be commit 59dae1da66a5eb7e128263bd578f167d8746e9f0)
|
|
(This used to be commit ba4d334b822248d8ab929c9568533431603d967e)
|