Age | Commit message (Collapse) | Author | Files | Lines |
|
Details: Reset the "new password prompt required" state whenever
we do a new auth. In more detail, in pam_sm_authenticate, if not
settting PAM_WINBIND_NEW_AUTHTOK_REQD, then clean any potentially
present PAM_WINBIND_NEW_AUTHTOK_REQD.
(This used to be commit 402e8594759b42c1986f4f8d69273f68ec5160af)
|
|
ntlm_auth
(This used to be commit 2d877e41d1fdf71b45074f257930062539e379d8)
|
|
Patch details:
Support most options in pam_winbind.conf; support comma-separated names in
require-membership-of. Details below:
1) Provides support for almost all config options in pam_winbind.conf
(all except for use_first_pass, use_authtok, and unknown_ok).
- That allows us to work well when invoked via call_modules from
pam_unix2.conf as well as allowing use of spaces in names used
w/require_membership_of.
2) Support for comma-separated list of names or SID strings in
require_membership_of/require-membership-of.
- Increased require_membership_of field in winbind request from fstring
(256) to pstring (1024).
- In PAM side, parse out multiple names or SID strings and convert
all of them to SID strings.
- In Winbind side, support membership check against multiple SID strings.
(This used to be commit 4aca9864896b3e0890ffc9a6980d7ef1311138f7)
|
|
all other uses - merge from 3_0_24
(This used to be commit 99172f56c0041d43890167150cfc575d7c1b59f1)
|
|
Volker
(This used to be commit 70c589a8323637ff8e1f96a56f8acaf550a58dc4)
|
|
sharemodes in gpfs.
(This used to be commit 61841b225c2a09dcdb4b1242cb0ad0429ec1948e)
|
|
Guenther
(This used to be commit fb5830f87a16dbec16893348080bcdfc61e27ab0)
|
|
(This used to be commit 9d23cf0cc4a8974bf0cf74b219a1138383083360)
|
|
problems in the nss_info interface when HAVE_LDAP is undefined.
* Revert previous ifdef HAVE_ADS brakets
* Remove an unused init function wrapper.
(This used to be commit 2ba353848b6d8d36520e7fd82576653a39c602cd)
|
|
(This used to be commit a5a1c8c785939e7cf6108adb573ac277726f584b)
|
|
(This used to be commit 91fdbd4cf5f8fe44adcbe8dc8ef38579a8306c39)
|
|
(This used to be commit 8052a18f29d32f37c52868b17143af8d76bf5e6e)
|
|
(This used to be commit 8c23158f053b181421cb6206db7c8030ddcc2cea)
|
|
(This used to be commit 7011a1b5abc7d56da5beba904e3328014f315f0d)
|
|
nss_info_methods API)
(This used to be commit 4982be312151c4d9b97f06afe88c30d8065be4be)
|
|
This allows a provider to supply the homedirectory, etc...
attributes for a user without requiring support in core
winbindd code. The idmap_ad.c module has been modified
to provide the idmap 'ad' library as well as the rfc2307 and sfu
"winbind nss info" support.
The SID/id mapping is working in idmap_ad but the nss_info
still has a few quirks that I'm in the process of resolving.
(This used to be commit aaec0115e2c96935499052d9a637a20c6445986e)
|
|
'pdbedit -L -w'
(This used to be commit 2a7311db272b5a504e2db672d92adbb3cf2bea15)
|
|
(This used to be commit 4984b0627c84cc192868238c0936ca1a38628cd8)
|
|
Guenther
(This used to be commit 5d4747fdf2e5874cb5d2238ee62e4fcac1676134)
|
|
are in daemon mode. If we are in inetd mode, there's really no point
in rechecking it so soon.
(This used to be commit 029d4bb5e3ea02a8a396adc3ca564a714bcdfdb8)
|
|
(This used to be commit 0eb19b57286f176dd4b7e86504d004e1450f6a10)
|
|
domain SID lookups through the struct winbindd_domain *domain_list
by searching by name.
Refactor the order lookup when searching for the correct idmap_domain
to a single function and remove the requirement that the default
domain be listed first in the config file.
I would still like to make the idmap_domain array a linked list and
remove the existing code which makes use of indexes into the list.
Basic testing with tdb pans out ok.
(This used to be commit e6c300829ff08dd354f6e9460d396261681e4809)
|
|
(This used to be commit 4587d8097255c8b8fb8990bc8a13f8145986d29d)
|
|
from being
complete, in particular the various mask bits are not correctly supported
yet. Checkin in now, I want to see how the build farm likes it.
Volker
(This used to be commit c9a5d011a91359b242f6c26f46e96ecea6a44a3b)
|
|
event-driven
based approach. The only remaining hook into the backend is now
void *(*notify_add)(TALLOC_CTX *mem_ctx,
struct event_context *event_ctx,
files_struct *fsp, uint32 *filter);
(Should we put this through the VFS, so that others can more easily plug in?)
The trick here is that the backend can pick filter bits that the main smbd
should not handle anymore. Thanks to tridge for this idea.
The backend can notify the main smbd process via
void notify_fsp(files_struct *fsp, uint32 action, char *name);
The core patch is not big, what makes this more than 1800 lines are the
individual backends that are considerably changed but can be reviewed
one by one.
Based on this I'll continue with inotify now.
Volker
(This used to be commit 9cd6a8a82792b7b6967141565d043b6337836a5d)
|
|
<ying.li2@hp.com>
Jeremy.
(This used to be commit 78387b3cd2e4eff8f09b6c498ca37b016ed9ecbc)
|
|
with -DDEVELOPER.
Jeremy.
(This used to be commit 7f817067a70930ee3502ea3373173e0c23733253)
|
|
Jeremy.
(This used to be commit 018d7805b5ecb17e21e1a55b6cc65efaab4b3f63)
|
|
Jeremy.
(This used to be commit a2222a565c658fe5154d9321edab69a95ddeed15)
|
|
Jeremy.
(This used to be commit dce98dae2d18126d8380f92595f315b96d48a7df)
|
|
moving events around.
Jeremy.
(This used to be commit 6fee874ab420b4c406e38b5e189a6d6ea8594fc9)
|
|
(This used to be commit e635bad00ecf083c34da339e3616c945a140e478)
|
|
chnage fails due to policy settings where as 2003 (the chgpasswd3()
request) fails with NT_STATUS_PASSWORD_RESTRICTION. Thunk down
to the same return code so we correctly retreive the password policy
in both cases.
(This used to be commit 262bb80e9cf7fb6dbf93144ae0b939c84ec0ea04)
|
|
is sharing the IDL for the SAMR pipe with Windows 2003
but returning NT_STATUS_NOT_SUPPORTED rather than a DCE/RCE
fault. We need to catch this in the general sense
by looking at the returned PDU size. But this immediate
change fixes password changes via pam_winbind against Windows 2000
DCs.
(This used to be commit a3602cc6d4926852a21b13d4b731419f70477f5c)
|
|
(This used to be commit ff8f27108d247aa9e46176f2b29fc8d2da103906)
|
|
works - even with the strange "initial delete on close"
semantics. The "initial delete on close" flag isn't
committed to the share mode db until the handle is
closed, and is discarded if any real "delete on close"
was set. This allows me to remove the "initial_delete_on_close"
flag from the share db, and move it into a BOOL in files_struct.
Warning ! You must do a make clean after this. Cope with
the wrinkle in directory delete on close which is done
differently from files. We now pass all Samba4 smbtortute
BASE-DELETE tests except for the one checking that files
can't be created in a directory which has the delete on
close set (possibly expensive to fix).
Jeremy.
(This used to be commit f2df77a1497958c1ea791f1d2f4446b5fc3389b3)
|
|
close Guenther, then you forgot to use "key" :-) :-).
Jeremy.
(This used to be commit 56842b59d00d531b0c9c22639603dc721eab50b4)
|
|
(This used to be commit eb14d0ea83273c60aee900557aa5dceb77bb8127)
|
|
(This used to be commit 2f1bfc53733ac3debc6a8b51642ab191869cd792)
|
|
(This used to be commit a7a66eb4eb2e518007b791457694c39dfff90705)
|
|
separate arguments.
This makes it a bit more similar to the Samba4 code.
(This used to be commit 0596badb410a58e7a715e2b17bc0bef0489a2448)
|
|
the stored client sitename with the sitename from each sucessfull CLDAP
connection.
Guenther
(This used to be commit 6a13e878b5d299cb3b3d7cb33ee0d51089d9228d)
|
|
Allow us to correctly refuse to set delete on close on a
non-empty directory. There are still some delete-on-close
wrinkles to be fixed, but I understand how to do that better
now. I'll fix this tomorrow.
Jeremy.
(This used to be commit 029635885825a5562e7974a6f5675cce3bf1b5dc)
|
|
less DNS query. This speeds up offline detection slightly.
Guenther
(This used to be commit eda76ecf07a4d2f9bb5544e2c031cfad14d93e85)
|
|
for a PDC.
Guenther
(This used to be commit 0944c7861004bee2a9d0ac787f022f5bf1d181ac)
|
|
ask for the list of DCs twice.
Guenther
(This used to be commit a9baf27e1348dd6dadd7a2fafdf9c269087b80ac)
|
|
(This used to be commit a1d0644d156c360d52fb837d3eecddb202135ebe)
|
|
site support in a network where many DC's are down.
I heard via Volker there is still a bug w.r.t the
wrong site being chosen with trusted domains but
we'll have to layer that fix on top of this.
Gd - complain if this doesn't work for you.
Jeremy.
(This used to be commit 97e248f89ac6548274f03f2ae7583a255da5ddb3)
|
|
(This used to be commit beecef0c70521d28dd88552d661281d9c585eb22)
|
|
make sense
again :-)
Volker
(This used to be commit 5533cdeec1b0cdee39b1d89e2320587dc9281ee6)
|