summaryrefslogtreecommitdiff
path: root/source3/utils/ntlm_auth.c
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r17981: Hmmm. Don't break helper functions that don't needJeremy Allison1-5/+7
the username by forcing it to be specified. Still split out domain \ user for the ones that do use it. Jeremy. (This used to be commit c097e107391cd97dd829c19b672b6a7adece504f)
2007-10-10r17979: Make ntlm_auth more intelligent about figuring out it'sJeremy Allison1-14/+31
domain and user args. if only given a parameter of the form --username DOMAIN\user. When called by firefox or other user apps they may not know what the domain is (and they don't care). They just want to pass the contents of $USERNAME without having to parse it or guess a domain. Jeremy. (This used to be commit 5f51417916ed8bfc0dd08f44e669cb044fc83d01)
2007-10-10r17921: Comment is obsolte. This is now implemented in winbindd.Jeremy Allison1-3/+1
Jeremy. (This used to be commit 37c636eb480e3736b143653231d73620152eb470)
2007-10-10r17903: Fix null deref caught by Stanford checker. Don'tJeremy Allison1-1/+0
call ntlmssp_end on a null pointer ! (Doh !). Jeremy. (This used to be commit 7b53932b5190c78b2b483f36af95174fe38ed45e)
2007-10-10r17610: Added the ability for firefox to drive the winbinddJeremy Allison1-10/+99
ntlm_auth module to allow it to use winbindd cached credentials.The credentials are currently only stored in a krb5 MIT environment - we need to add an option to winbindd to allow passwords to be stored even in an NTLM-only environment. Patch from Robert O'Callahan, modified with some fixes by me. Jeremy. (This used to be commit ae7cc298a113d8984557684bd6ad216cbb27cff3)
2007-10-10r17446: Fix some C++ warnings and two memleaks found by Coverity, IDs 304 ↵Volker Lendecke1-7/+13
and 305. Volker (This used to be commit 4f6605a4880f54f2c7d1f3c7554408d893bc623c)
2007-10-10r17216: From Kai Blin <kai.blin@gmail.com>:Andrew Bartlett1-0/+71
A patch to make ntlm_auth recognize three new commands in ntlmssp-client-1 and squid-2.5-ntlmssp: The commands are the following: Command: SF <hex number> Reply: OK Description: Takes feature request flags similar to samba4's gensec_want_feature() call. So far, only NTLMSSP_FEATURE_SESSION_KEY, NTLMSSP_FEATURE_SIGN and NTLMSSP_FEATURE_SEAL are implemented, using the same values as the corresponding GENSEC_FEATURE_* flags in samba4. Command: GF Reply: GF <hex number> Description: Returns the negotiated flags. Command: GK Reply: GK <base64 encoded session key> Description: Returns the negotiated session key. (These commands assist a wine project to use ntlm_auth for signing and sealing of bulk data). Andrew Bartlett (This used to be commit bd3e06a0e4435f1c48fa3b7862333efe273119ee)
2007-10-10r17005: Add a new helper mode to ntlm_auth: ntlm-change-password-1Andrew Bartlett1-1/+295
This mode proxies pre-calculated blobs from a remote (probably VPN) client into the domain. This allows clients to change their password over a PPTP connection (where they would not be able to connect to SAMR directly). The precalculated blobs do not reveal the plaintext password. Original patch by Alexey Kobozev <cobedump@gmail.com> (This used to be commit 967292b7136c5100c0b9a2783c34b1948b16dad4)
2007-10-10r16945: Sync trunk -> 3.0 for 3.0.24 code. Still needJeremy Allison1-1/+1
to do the upper layer directories but this is what everyone is waiting for.... Jeremy. (This used to be commit 9dafb7f48ca3e7af956b0a7d1720c2546fc4cfb8)
2007-10-10r15523: Honour the time_offset also when verifying kerberos tickets. ThisGünther Deschner1-1/+1
prevents a nasty failure condition in winbindd's pam_auth where a tgt and a service ticket could have been succefully retrieved, but just not validated. Guenther (This used to be commit a75dd80c6210d01aff104a86b0a9d39d65f2c348)
2007-10-10r15053: fix portabilities issues between 32-bit winbind clients and a 64-bit ↵Gerald Carter1-1/+1
winbindd server (This used to be commit a95d11345e76948b147bbc1f29a05c978d99a47a)
2007-10-10r14585: Tighten argument list of kerberos_kinit_password again,Günther Deschner1-2/+1
kerberos_kinit_password_ext provides access to more options. Guenther (This used to be commit afc519530f94b420b305fc28f83c16db671d0d7f)
2007-10-10r14033: Fix Coverity bug # 126Volker Lendecke1-0/+1
(This used to be commit bb6d678575faac050376607a5c778b8a10805061)
2007-10-10r13571: Replace all calls to talloc_free() with thye TALLOC_FREE()Gerald Carter1-4/+4
macro which sets the freed pointer to NULL. (This used to be commit b65be8874a2efe5a4b167448960a4fcf6bd995e2)
2007-10-10r13316: Let the carnage begin....Gerald Carter1-3/+3
Sync with trunk as off r13315 (This used to be commit 17e63ac4ed8325c0d44fe62b2442449f3298559f)
2007-10-10r13212: r12414@cabra: derrell | 2006-01-28 17:52:17 -0500Derrell Lipman1-1/+1
lp_load() could not be called multiple times to modify parameter settings based on reading from multiple configuration settings. Each time, it initialized all of the settings back to their defaults before reading the specified configuration file. This patch adds a parameter to lp_load() specifying whether the settings should be initialized. It does, however, still force the settings to be initialized the first time, even if the request was to not initialize them. (Not doing so could wreak havoc due to uninitialized values.) (This used to be commit f2a24de769d1b2266e576597c57a8e3b1e2a2b51)
2007-10-10r12555: Fix more load_case_table swegfaults. Arggg.Jeremy Allison1-0/+1
What I'd give for a global constructor... Jeremy. (This used to be commit c970d7d0a5ba225465dfb0980989b8817b17c643)
2007-10-10r11573: Adding Andrew Bartlett's patch to make machine accountJeremy Allison1-0/+2
logons work if the client gives the MSV1_0_ALLOW_SERVER_TRUST_ACCOUNT or MSV1_0_ALLOW_WORKSTATION_TRUST_ACCOUNT flags. This changes the auth module interface to 2 (from 1). The effect of this is that clients can access resources as a machine account if they set these flags. This is the same as Windows (think of a VPN where the vpn client authenticates itself to a VPN server using machine account credentials - the vpn server checks that the machine password was valid by performing a machine account check with the PDC in the same was as it would a user account check. I may add in a restriction (parameter) to allow this behaviour to be turned off (as it was previously). That may be on by default. Andrew Bartlett please review this change carefully. Jeremy. (This used to be commit d1caef866326346fb191f8129d13d98379f18cd8)
2007-10-10r11232: Added ab's POSIX statvfs vfs call. Sorry for the delay ab.Jeremy Allison1-1/+1
Jeremy. (This used to be commit af8545806770a7530eecc184bdd230ca14999884)
2007-10-10r11137: Compile with only 2 warnings (I'm still working on that code) on a gcc4Jeremy Allison1-2/+2
x86_64 box. Jeremy. (This used to be commit d720867a788c735e56d53d63265255830ec21208)
2007-10-10r10656: BIG merge from trunk. Features not copied overGerald Carter1-13/+18
* \PIPE\unixinfo * winbindd's {group,alias}membership new functions * winbindd's lookupsids() functionality * swat (trunk changes to be reverted as per discussion with Deryck) (This used to be commit 939c3cb5d78e3a2236209b296aa8aba8bdce32d3)
2007-10-10r9198: Convert hex_encode and strhex_to_data_blob to take a talloc context.Volker Lendecke1-22/+20
Volker (This used to be commit c7d10e2c834d8d5136e2d01dea1ad286757deddb)
2007-10-10r7882: Looks like a large patch - but what it actually does is make SambaJeremy Allison1-6/+6
safe for using our headers and linking with C++ modules. Stops us from using C++ reserved keywords in our code. Jeremy (This used to be commit 9506b8e145982b1160a2f0aee5c9b7a54980940a)
2007-10-10r6450: * fix typo in htlm_auth help messageGerald Carter1-2/+2
* add synonym for idmap_rid in better lining with other idmap backend names * remove old debug messages when idmap {uid|gid} options are not defined (This used to be commit 03ebf3ebfe83897d8c18e57ed378154d1377874b)
2007-10-10r4259: Fix cast in SMB_XMALLOC_ARRAY. Bugzilla #2168.Tim Potter1-1/+1
(This used to be commit 0c3bb181e8f4d10d446f9211904d53f42ddcbaeb)
2007-10-10r4088: Get medieval on our ass about malloc.... :-). Take control of all our ↵Jeremy Allison1-14/+14
allocation functions so we can funnel through some well known functions. Should help greatly with malloc checking. HEAD patch to follow. Jeremy. (This used to be commit 620f2e608f70ba92f032720c031283d295c5c06a)
2007-10-10r3377: Merge in first part of modified patch from Nalin Dahyabhai ↵Jeremy Allison1-1/+1
<nalin@redhat.com> for bug #1717.The rest of the code needed to call this patch has not yet been checked in (that's my next task). This has not yet been tested - I'll do this once the rest of the patch is integrated. Jeremy. (This used to be commit 7565019286cf44f43c8066c005b1cd5c1556435f)
2007-10-10r3273: Ensure we're consistent in the use of strchr_m for '@'.Jeremy Allison1-1/+1
Jeremy. (This used to be commit 0f3f7b035b37bfc51d3a59d0472003c3d4ac1511)
2007-10-10r2835: Since we always have -I. and -I$(srcdir) in CFLAGS, we can get rid ofTim Potter1-1/+1
'..' from all #include preprocessor commands. This fixes bugzilla #1880 where OpenVMS gets confused about the '.' characters. (This used to be commit 7f161702fa4916979602cc0295919b541912acd6)
2007-10-10r2762: Remove silly conversion to and from UTF8 on the winbind pipe. Fix theAndrew Bartlett1-28/+16
naming of the require_membership_of parameter in pam_winbind and fix the error code for 'you didn't specify a domain' in ntlm_auth. Andrew Bartlett (This used to be commit 4bf0b94011fe6bfbec5635e58cafbfe3dc898569)
2007-10-10r2147: Fix utility name in error message (pre-emptivly merged to trunk ;-)Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit 657bb14789bcec65668d072fec0f954d1e5322ef)
2007-10-10r1582: On failure, print the length of the right variable.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit 5bd6abb54e12aee2031d48bc5b240bb4f127bf5a)
2007-10-10r1492: Rework our random number generation system.Andrew Bartlett1-1/+1
On systems with /dev/urandom, this avoids a change to secrets.tdb for every fork(). For other systems, we now only re-seed after a fork, and on startup. No need to do it per-operation. This removes the 'need_reseed' parameter from generate_random_buffer(). Andrew Bartlett (This used to be commit 36741d3cf53a7bd17d361251f2bb50851cdb035f)
2007-10-10r1128: The end-of-file is not the end of the world, so don't make a load ↵Andrew Bartlett1-3/+7
DEBUG() about it. Andrew Bartlett (This used to be commit 4da976dbd07e70726055cc4251fd1c26f63b3b2c)
2007-10-10r1126: Allow more flexible GSS-SPENGO client and server operation. TheAndrew Bartlett1-16/+18
client now falls back to NTLMSSP, and the server allows the client to start, without first asking for a mech list. Andrew Bartlett (This used to be commit feccc3daca7b2e9091b81fbbb93dc7284baedb99)
2007-10-10r1124: ntlm_auth memory leak fixes by James Wilkinson - ↵Andrew Bartlett1-0/+4
jwilk@alumni.cse.ucsc.edu Andrew Bartlett (This used to be commit 94c0827ce20d8d1084703f6f5e4ad3b3c33151f8)
2007-10-10r517: Remove wrong commit I did by mistakeAlexander Bokovoy1-6/+0
(This used to be commit 72d30ea06612461bdf19916fa40ca459f0c37acc)
2007-10-10r516: On GNU/Linux distributions which allow to use both 2.4 and 2.6 kernelsAlexander Bokovoy1-0/+6
there is SYS_utimes syscall defined at compile time in glibc-kernheaders but it is available on 2.6 kernels only. Therefore, we can't rely on syscall at compile time but have to check that behaviour during program execution. An easy workaround is to have replacement for utimes() implemented within our wrapper and do not rely on syscall at all. Thus, if REPLACE_UTIME is defined already (by packager), skip these syscall shortcuts. (This used to be commit e278e2e6e095b1c01eab307d55edf2cde48dcba2)
2007-10-10r240: I'm pretty happy with the 'ntlm-server-1' helper protocol now, and asAndrew Bartlett1-2/+0
there is now a public patch that uses it, make it always available. (It was #ifdef DEVELOPER) Andrew Bartlett (This used to be commit aa3bc79835c79652199ce5aaf2f3981f8211c9bd)
2007-10-10r201: Fix bugs in the --helper-protocol=ntlm-server-1 implementation.Andrew Bartlett1-8/+9
(allow the use of base64 encoded strings, LM or NT passwords) Andrew Bartlett (This used to be commit 57a5563b421b0684e7bb40d10c2168916c59c89d)
2007-10-10r191: Only send the ntlm_auth 'ntlm-server-1' helper client a '.' after theAndrew Bartlett1-2/+1
server had said something (such as an error). Andrew Bartlett (This used to be commit c05016a2f750960c40387c1d6aba9f6841f66a3b)
2007-10-10r188: Add a new 'helper protocol' to ntlm_auth.Andrew Bartlett1-2/+202
This protocol looks rather like SMTP headers/LDAP: NT-Domain: TESTWG Username: abartlet ... Password: foo Challenge-response passwords are in hexideciaml, while any 'plain' string can be base64 encoded when like this: Password:: Zm9vCg== (the :: indicates it, just like LDAP - I hope) The protocol is not final, so it is #ifdef DEVELOPER for now (so nobody starts to rely on it until I'm happy), but we may as well get this into subversion. My intention is to use this to power the next version of my PPP/ntlm_auth plugin, and hopefully entice a FreeRadius plugin out of the woods. Andrew Bartlett (This used to be commit 8efdd957ba8310515242ba2979ff07130a0b1a3a)
2007-10-10r177: Split ntlm_auth --diagnostics into a seperate file, so as not to clutterAndrew Bartlett1-599/+30
the main ntlm_auth program. It quite possibly should belong in smbtorture, but relies on the winbind client for now. Andrew Bartlett (This used to be commit 6e1b7a8848062a184ee293cf688135b851f2bd8d)
2007-10-10r171: Continue the 'rename nt_session_key' work. This attempts to renameAndrew Bartlett1-88/+76
this variable to 'user_session_key', where possible. The command line parameter is currently unchanged). Andrew Bartlett (This used to be commit da4177209d1058af8e121c34f9928728f491b22e)
2007-10-10r104: Fix ntlm_auth by adding the new strhex_to_data_blob() call.Andrew Bartlett1-6/+0
Andrew Bartlett (This used to be commit 0693b9e79fabd58491f8aaec11dbbc71fab34f80)
2007-10-10r87: Fix the build that Andrew Bartlett broke. Andrew - don't check ↵Jeremy Allison1-0/+6
*ANYTHING* in unless you have done a make clean; make. Jeremy. (This used to be commit 09d82a0bef2dd5759e5430c4faea413b5a64ac11)
2007-10-10r84: Implement --required-membership-of=, an ntlm_auth option that restrictsAndrew Bartlett1-38/+113
all authentication to members of this particular group. Also implement an option to allow ntlm_auth to get 'squashed' error codes, which are safer to communicate to remote network clients. Andrew Bartlett (This used to be commit eb1c1b5eb086f49a230142ad2de45dc0e9691df3)
2007-10-10r69: Global rename of 'nt_session_key' -> 'user_session_key'. The session ↵Andrew Bartlett1-22/+22
key could be anything, and may not be based on anything 'NT'. This is also what microsoft calls it. (This used to be commit 724e8d3f33719543146280062435c69a835c491e)
2004-04-03Fix most of bug #169.Andrew Bartlett1-0/+1
For a (very) long time, we have had a bug in Samba were an NTLMv2-only PDC would fail, because it converted the password into NTLM format for checking. This patch performs the direct comparison required for interactive logons to function in this situation. It also removes the 'auth flags', which simply where not ever used. Natrually, this plays with the size of structures, so rebuild, rebuild rebuild... Andrew Bartlett (This used to be commit 9598593bcf2d877b1d08cd6a7323ee0bc160d4ba)
2004-03-24Fix bugzilla # 1208Jim McDonough1-1/+2
Winbind tickets expired. We now check the expiration time, and acquire new tickets. We couln't rely on renewing them, because if we didn't get a request before they expired, we wouldn't have renewed them. Also, there is a one-week limit in MS on renewal life, so new tickets would have been needed after a week anyway. Default is 10 hours, so we should only be acquiring them that often, unless the configuration on the DC is changed (and the minimum is 1 hour). (This used to be commit c2436c433afaab4006554a86307f76b6689d6929)
generated by cgit (git 2.34.1) at 2024-11-17 03:47:47 +0000