summaryrefslogtreecommitdiff
path: root/source3/winbindd
AgeCommit message (Collapse)AuthorFilesLines
2012-12-03s3:winbindd: remove unused function idmap_backends_sid_to_unixid()Michael Adam2-43/+0
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:idmap_autorid: force mapping type to ID_TYPE_BOTH for sid->unixid mappingMichael Adam1-0/+3
This is to remove problems with the same unix-id being used both as a uid and a gid. The autorid backend will map a given number to the same SID, no matter whether this is a uid or a gid. This will prime the idmap cache with mappings. The sid-to-u/gid mapping, when not going through the cache, instead checks for the type of the sid and only allows unix ids of the corresponding type. Hence the rid backend will give different results, depending on whether the cache is filled or not. This patch lets the autorid backend always create sid->id mappings of type both. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:idmap_rid: force mapping type to ID_TYPE_BOTH for sid->unixid mappingMichael Adam1-0/+2
This is to remove problems with the same unix-id being used both as a uid and a gid. The rid backend will map a given number to the same SID, no matter whether this is a uid or a gid. This will prime the idmap cache with mappings. The sid-to-u/gid mapping, when not going through the cache, instead checks for the type of the sid and only allows unix ids of the corresponding type. Hence the rid backend will give different results, depending on whether the cache is filled or not. This patch lets the rid backend always create sid->id mappings of type both. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: remove unused idmap_sid_to_gid()Michael Adam2-75/+0
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: remove unused idmap_sid_to_uid()Michael Adam2-75/+0
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: remove unused server implementation of wbint_Sid2Gid()Michael Adam1-14/+0
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: remove unused server implementation of wbint_Sid2Uid()Michael Adam1-14/+0
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: remove now unused wb_sid2uid and wb_sid2gid modulesMichael Adam3-342/+0
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: change winbindd_getgroups to use wb_sids2xids instead of wb_sid2gidMichael Adam1-5/+14
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: change wb_getgrsid to use wb_sids2xids instead of wb_sid2gidMichael Adam1-2/+17
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: change wb_fill_pwent to use wb_sids2xids instead of wb_sid2[ug]idMichael Adam1-4/+32
We can optimize this later and just do one wb_sids2xids_send/recv call. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: make idmap_find_domain() static.Michael Adam2-2/+1
idmap_find_domain_with_sid() should be used instead Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: also use idmap_passdb for own sam and builtin in ↵Michael Adam1-3/+3
wbint_Sids2UnixIDs() This is the way the singular calls work and how they should (currently) work. The two code paths need to give the same results. It is important to use the passdb backend, otherwise groups don't work. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: add idmap_find_domain_with_sid()Michael Adam2-0/+18
This will return the passdb domain if the given sid is in our sam or builtin or is the domain sid of those domains. Otherwise it returns the idmap domain that results from the idmap configuration. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: rename idmap_init_passdb_domain() -> idmap_passdb_domain()Michael Adam1-3/+3
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: use struct unixid instead of uint64 in Sids2Xids parent<->childMichael Adam2-4/+7
This implicitly also hands the type of the resulting unix-id that the idmap backend has created back to the caller. This is important for backends that would set a broader type than the requested one, e.g. rid backend returning BOTH instead of UID or GID. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: add an explanatory comment to _wbint_Sids2UnixIDs()Michael Adam1-0/+3
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: add an explanatory comment to _wbint_Sids2UnixIDs()Michael Adam1-0/+5
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: use wb_sids2xids instead of wb_sid2gid in winbindd_sid_to_gidMichael Adam1-2/+16
The main purpose of the change is to hand the sid into the idmap backend and handle responsiblity for handling the sid-type correctly to the idmap backend instead of failing directly when the sid is not of group type. Hence backends like rid who are sid-type agnostic, can return gids also for sids of other types. This is an important fix to make sid_to_gid behave the consistently with and without the presence of cache entries. We need to additionally filter the result for id type GID or more general (BOTH) to keep the behaviour. This is a step towards using only one codepath to id_mapping. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: use wb_sids2xids instead of wb_sid2uid in winbindd_sid_to_uidMichael Adam1-2/+16
The main purpose of the change is to hand the sid into the idmap backend and handle responsiblity for handling the sid-type correctly to the idmap backend instead of failing directly when the sid is not of type user. Hence backends like rid who are sid-type agnostic, can return uids also for sids of other types. This is an important fix to make sid_to_uid behave the consistently with and without the presence of cache entries. We need to additionally filter the result for id type UID or more general (BOTH) to keep the behaviour. This is a step towards using only one codepath to id_mapping. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: factor winbindd_sids_to_xids into external and internal partMichael Adam3-165/+284
- external part takes winbindd request/reponse structs (with sid strings) - internal part takes sid lists The new internal part implements functions wb_sids2xids_* that are moved into the new module wb_sids2xids.c. The purpose of this change is to use wb_sids2xids in winbindd_sid_to_uid and winbindd_sid_to_gid instead of the currently used wb_sid2uid and wb_sid2gid. We should just have one code path into id mapping and not several that behave differently. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: convert some spaces to tabs in winbindd_sids_to_xids_send()Michael Adam1-4/+4
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: add explaining comment winbindd_sids_to_xids_send()Michael Adam1-0/+5
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: factor lsa_SidType_to_id_type() out of ↵Michael Adam1-14/+25
winbindd_sids_to_xids_lookupsids_done() for readability Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd: simplify winbindd_sids_to_xids_recv() a bit.Michael Adam1-40/+25
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-12-03s3:winbindd:util: add a comment explaining the function parse_sidlist()Michael Adam1-0/+9
Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-11-30s3-winbind: use new reconnect logic in rpc_lookup_sids() also.Günther Deschner1-16/+7
Volker, please check. Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-30s3-winbindd: rework reconnect logic in winbindd_lookup_names().Günther Deschner1-12/+13
Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-30s3-winbindd: rework reconnect logic in winbindd_lookup_sids().Günther Deschner1-12/+14
Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-30s3-winbindd: remove lookup_sids_fn_t.Günther Deschner1-21/+12
Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-30s3-winbindd: remove lookup_names_fn_t.Günther Deschner1-23/+13
Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-30s3-winbindd: add cm_connect_lsat().Günther Deschner2-0/+35
Guenther Signed-off-by: Günther Deschner <gd@samba.org> Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-28BUG 9436: Fix leaking sockets of SMB connections to a DC.Andreas Schneider1-0/+4
As this is a burst of 3 unbound sockets with each try to reach a DC we're running out of file descriptors pretty fast. So winbind is then mostly spinning in an accept loop failing with EMFILE. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Jim McDonough <jmcd@samba.org> Autobuild-User(master): Jim McDonough <jmcd@samba.org> Autobuild-Date(master): Wed Nov 28 17:17:21 CET 2012 on sn-devel-104
2012-11-26s3: Do not free a string where we should notVolker Lendecke1-1/+1
Reviewed by: Jeremy Allison <jra@samba.org> Autobuild-User(master): Jeremy Allison <jra@samba.org> Autobuild-Date(master): Mon Nov 26 22:03:05 CET 2012 on sn-devel-104
2012-11-26s3: Do not free a string where we should notVolker Lendecke1-1/+1
Reviewed by: Jeremy Allison <jra@samba.org>
2012-11-12s3:winbind: BUG 9386: Failover if netlogon pipe is not available.Andreas Schneider1-13/+39
Samba continues to query a broken DC while the DC did not finish to rebuild Sysvol (after a Windows crash, for example). It causes end users to received strange codes while trying to authenticate, even if there is a secondary DC available. Signed-off-by: Andreas Schneider <asn@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org> Autobuild-User(master): Stefan Metzmacher <metze@samba.org> Autobuild-Date(master): Mon Nov 12 18:57:18 CET 2012 on sn-devel-104
2012-11-09Revert "s3-winbindd: make sure we obey the -n switch also for samlogon cache ↵David Disseldorp4-13/+3
access." This reverts commit ae6a779bf9f816680e724ede37324b7f5355996b. Bug 9125 analysis from Volker: The problem is that there are no network calls possible at all that would do what the samlogon cache does for us. There is just no way to retrieve the group membership in a complex trusted environment. If you have just a single domain with Samba as domain controller it might be possible, but even within a single domain it is not possible to correctly retrieve all group memberships using LDAP calls due to ACLs on directory objects. The call to get that is called NetSamLogon on the NETLOGON pipe. But this call requires user credentials and might trigger updating counts on the server. So to correctly implement wbinfo -r after a user has logged in, you have two alternatives: Save the info3 struct or the PAC in the netsamlogon cache. If you insist on doing network calls, you need to cache the user credentials somewhere to re-do the NetSamLogon call every time the wbinfo -r is requested. Reviewed-by: Andreas Schneider <asn@samba.org>
2012-11-01s3:winbindd: use PROTOCOL_LATEST instead of PROTOCOL_SMB2_02 (bug #9175)Stefan Metzmacher1-1/+1
We should use the latest supported dialect. Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewd-by: Michael Adam <obnox@samba.org> Autobuild-User(master): Michael Adam <obnox@samba.org> Autobuild-Date(master): Thu Nov 1 18:11:27 CET 2012 on sn-devel-104
2012-11-01s3:winbindd: disconnection after getting NETWORK_SESSION_EXPIRED (bug #9175)Stefan Metzmacher1-0/+11
Signed-off-by: Stefan Metzmacher <metze@samba.org> Reviewed-by: Michael Adam <obnox@samba.org>
2012-11-01s3:winbindd:cache: fix offline logons with cached credentials (bug #9321)Michael Adam1-0/+7
The removal of consumption of the time field from the centry as "removal of unused variable" in 21528da9cd12a4f5c3792a482a5d18fe946a6f7a had the side effect of changing the offset for reading the following nt password hash, so the read password hash was wrong. This patch re-installs the consumption of the time, thereby fixing the bug without changing the disk format of the cache. Signed-off-by: Michael Adam <obnox@samba.org> Reviewed-by: Stefan Metzmacher <metze@samba.org>
2012-10-19s3: Remove a call to procid_self()Volker Lendecke1-1/+1
Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Fri Oct 19 23:15:04 CEST 2012 on sn-devel-104
2012-10-19s3: Add "msg_ctx" param to winbindd_register_handlers()Volker Lendecke1-12/+13
2012-10-19s3: Make winbindd_register_handlers staticVolker Lendecke2-2/+1
2012-09-29s3-winbindd: Adjust error code loop logic in rpc_trusted_domains().Günther Deschner1-1/+1
Guenther Autobuild-User(master): Günther Deschner <gd@samba.org> Autobuild-Date(master): Sat Sep 29 00:34:04 CEST 2012 on sn-devel-104
2012-09-28s3-winbindd: Allow DNS resolution of trusted domains if DNS name is avaliableSumit Bose3-25/+58
Signed-off-by: Günther Deschner <gd@samba.org>
2012-09-27s3: Fix some blank line endingsVolker Lendecke1-4/+4
Autobuild-User(master): Volker Lendecke <vl@samba.org> Autobuild-Date(master): Thu Sep 27 07:57:03 CEST 2012 on sn-devel-104
2012-09-24s3:winbindd fix a compiler warningChristian Ambach1-1/+1
about type potentially being used uninitialized Autobuild-User(master): Christian Ambach <ambi@samba.org> Autobuild-Date(master): Mon Sep 24 03:49:53 CEST 2012 on sn-devel-104
2012-09-22s3:winbindd fix a compiler warningChristian Ambach1-1/+1
about result being potentially uninitialized
2012-09-22build: Fix enabled handling for HAVE_LDAP, we need to use bld.CONFIG_SETAndrew Bartlett1-6/+6
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org> Autobuild-Date(master): Sat Sep 22 09:09:17 CEST 2012 on sn-devel-104
2012-09-20winbind: Extend wbcAuthenticateUserEx to provide PACChristof Schmitt3-6/+153
With this new interface, external applications that have authenticated to an ADS can pass the PAC from the Kerberos ticket to wbcAuthenticateUserEx. winbindd decodes and extracts the info3 information for the external application. If winbindd can verify the PAC signature, the info3 from the PACis also added to the netsamlogon_cache. The info3 data can be used by the external application to get the uid and primary gid. The data in netsamlogon_cache allows to retrieve the complete group list through the NSS function getgrouplist. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
generated by cgit (git 2.34.1) at 2024-11-09 01:21:17 +0000