summaryrefslogtreecommitdiff
path: root/source4/auth/credentials/credentials.c
AgeCommit message (Collapse)AuthorFilesLines
2008-05-05Allow an NTLM response to be specified into the auth subsystem.Andrew Bartlett1-18/+2
This allows it to be proxied for NTLM pass-though authentication (aka security=server and associated man-in-the-middle attacks). Andrew Bartlett (This used to be commit 6ffabb38d03ad90d8731ab3e0eb692438db967ee)
2008-04-17Remove event context tracking from the credentials struct.Jelmer Vernooij1-21/+1
(This used to be commit 4d7fc946b2ec50e774689c9036423b6feef99b8e)
2008-04-02Install public header files again and include required prototypes.Jelmer Vernooij1-35/+35
(This used to be commit 47ffbbf67435904754469544390b67d34c958343)
2007-12-21r26430: require explicit specification of loadparm context.Jelmer Vernooij1-8/+15
(This used to be commit 1b947fe0e6e16318e5a8127bb4932d6b5d20bcf6)
2007-12-21r26385: Integrate gensec-socket into gensec.Jelmer Vernooij1-0/+1
(This used to be commit 78bb444b4b73df9a84f8702814f9b30b32ffd885)
2007-12-21r26382: Remove more uses of global_loadparm.Jelmer Vernooij1-1/+1
(This used to be commit 6d4c59853481855c232e7cf97264a391f40af2b5)
2007-12-21r26274: Some syntax fixes, remove more global_loadparm instances.Jelmer Vernooij1-1/+1
(This used to be commit 3809113d86dbd35b906356a05bb481a1e2bfe4b7)
2007-12-21r26270: Require specifying the loadparm_context or NULL to ↵Jelmer Vernooij1-2/+5
cli_credentials_guess(). (This used to be commit e52710d6794a25ba697f8c26b43784226964f9cb)
2007-12-21r26269: Fix a couple more references to global_loadparm.Jelmer Vernooij1-1/+1
(This used to be commit 1cb849dfba21b9b5d00b20ba8201f0e142bfeb07)
2007-12-21r26205: Pass loadparm_context to secrets_db_connect() rather than using ↵Jelmer Vernooij1-1/+0
global context. (This used to be commit 5718b6cfee86ddfc9cf405c98c68ba848df4d9d7)
2007-10-10r25552: Convert to standard bool type.Jelmer Vernooij1-71/+71
(This used to be commit b8d6b82f1248d36a0aa91a1c58d06b4f7c66d245)
2007-10-10r25398: Parse loadparm context to all lp_*() functions.Jelmer Vernooij1-7/+9
(This used to be commit 3fcc960839c6e5ca4de2c3c042f12f369ac5f238)
2007-10-10r25026: Move param/param.h out of includes.hJelmer Vernooij1-0/+1
(This used to be commit abe8349f9b4387961ff3665d8c589d61cd2edf31)
2007-10-10r23792: convert Samba4 to GPLv3Andrew Tridgell1-3/+2
There are still a few tidyups of old FSF addresses to come (in both s3 and s4). More commits soon. (This used to be commit fcf38a38ac691abd0fa51b89dc951a08e89fdafa)
2007-10-10r23063: Make sure to invalidate the ccache when we set aAndrew Bartlett1-0/+14
username/password/realm/etc from the command line. Also make sure it can't 'come back' from a later call to cli_credentials_guess(), buy setting a threshold. This should fix the issues with the build farm... Andrew Bartlett (This used to be commit 3b1dfb9306beb9f40d85d38cf6786ef161ec63f1)
2007-10-10r22969: fix some more places where we could end up with more than one eventAndrew Tridgell1-0/+21
context. We now have an event context on the torture_context, and we can also get one from the cli_credentials structure (This used to be commit c0f65eb6562e13530337c23e3447a6aa6eb8fc17)
2007-10-10r22115: I don't like the DOMAIN environment variable. It really isn't a goodAndrew Bartlett1-4/+0
match for what we are using it for here. Andrew Bartlett (This used to be commit 305d1421efff3f01db1dce499568874965058e79)
2007-10-10r21736: Fix the smbclient test to do something more interesting with the lastAndrew Bartlett1-2/+3
few authentication tests. Now that the tests correctly 'fail', I was able to fix the credentials subsystem to honour USER and PASSWD. To get --machine-pass working, I needed ldb to always load it's static modules, so I put this in ldb_connect(). Andrew Bartlett (This used to be commit 3430d8c072407a1c33c32229095fc9db2142b6fa)
2007-10-10r21668: Add SMB_QFS_POSIX_WHOAMI to trans2.h so it's easy to find. AddJames Peach1-0/+15
convenience API to create an anonymous credential. Don't clobber cmdline_credentials in the UNIX-WHOAMI test. (This used to be commit 73cea4e0c66f57057ed12b07bbb94b4e783ba6bf)
2007-10-10r21451: if kerberos is requested ( -k yes ), we should use authentificated ↵Stefan Metzmacher1-0/+5
connections metze (This used to be commit 426238eb45f0cc41d99961ac554c2528fd8e96f5)
2007-10-10r21135: Instead of having hooks to update keytabs as an explicit thing, updateAndrew Bartlett1-2/+6
them as a hook on ldb modify, via a module. This should allow the secrets.ldb to be edited by the admin, and to have things update in the on-disk keytab just as an in-memory keytab would. This isn't really a dsdb plugin, but I don't have any other good ideas about where to put it. Andrew Bartlett (This used to be commit 6ce557a1aff4754d2622be8f1c6695d9ee788d54)
2007-10-10r20135: attach default gensec features to the cli_credentials structure,Stefan Metzmacher1-0/+11
so make it possible to force encryption or signing. metze (This used to be commit a91dc4a02a46370c52f59cbd4dea9580fa6efafa)
2007-10-10r19598: Ahead of a merge to current lorikeet-heimdal:Andrew Bartlett1-1/+2
Break up auth/auth.h not to include the world. Add credentials_krb5.h with the kerberos dependent prototypes. Andrew Bartlett (This used to be commit 2b569c42e0fbb596ea82484d0e1cb22e193037b9)
2007-10-10r16218: If a connection is forced as 'anonymous', don't treat it asAndrew Bartlett1-2/+2
'authentication requested'... Andrew Bartlett (This used to be commit d5fc88c93697dbcab13b2356ef4e5d1d2a7d59eb)
2007-10-10r15498: Initialise the callback_running field, and get the flag set/clear theAndrew Bartlett1-4/+5
right way around for all the callers. Andrew Bartlett (This used to be commit f9bcfb04aa3ec93eed7076dbb1fed50cf1edb424)
2007-10-10r15422: Fix issues with functions being called recursively in the credentialsJelmer Vernooij1-6/+24
callback code. (This used to be commit edf0701e877592695bd69124e528338c27f24efd)
2007-10-10r15421: Correct function comments.Andrew Bartlett1-4/+3
Andrew Bartlett (This used to be commit f9899277898ee7ef1118cbc49f5f277623ff7444)
2007-10-10r15420: Add a new function to print a the 'unparsed' string format for ↵Andrew Bartlett1-3/+37
usernames. This is used in the password prompt, and should be reversable by the parse string function. Also, don't look at the ccache, even for the guess code, if kerberos is disabled. Andrew Bartlett (This used to be commit 4c4b8e4b396ca44270a0456c732d3b9c3c34d69d)
2007-10-10r15415: Use Jelmer's new credentials 'wrong password' code to give the user 3Andrew Bartlett1-1/+3
attempts for the password, when talking to a remote CIFS server. Andrew Bartlett (This used to be commit 3a4ddc8f5978210ab3ad79f0332cee80a0d6e6c9)
2007-10-10r15414: Support retrying different username/password combinationsJelmer Vernooij1-0/+21
(This used to be commit 5de894fb8bac8efa5bff004dbfc2e8b386d4003b)
2007-10-10r14464: Don't include ndr_BASENAME.h files unless strictly required, insteadJelmer Vernooij1-1/+1
try to include just the BASENAME.h files (containing only structs) (This used to be commit 3dd477ca5147f28a962b8437e2611a8222d706bd)
2007-10-10r14380: Reduce the size of structs.hJelmer Vernooij1-1/+1
(This used to be commit 1a16a6f1dfa66499af43a6b88b3ea69a6a75f1fe)
2007-10-10r13924: Split more prototypes out of include/proto.h + initial work on headerJelmer Vernooij1-0/+1
file dependencies (This used to be commit 122835876748a3eaf5e8d31ad1abddab9acb8781)
2007-10-10r13206: This patch finally re-adds a -k option that works reasonably.Andrew Bartlett1-2/+15
From here we can add tests to Samba for kerberos, forcing it on and off. In the process, I also remove the dependency of credentials on GENSEC. This also picks up on the idea of bringing 'set_boolean' into general code from jpeach's cifsdd patch. Andrew Bartlett (This used to be commit 1ac7976ea6e3ad6184c911de5df624c44e7c5228)
2007-10-10r12608: Remove some unused #include lines.Jelmer Vernooij1-1/+0
(This used to be commit 70e7449318aa0e9d2639c76730a7d1683b2f4981)
2007-10-10r12310: Link simple bind support in our internal LDAP libs to LDB and theAndrew Bartlett1-0/+23
command line processing system. This is a little ugly at the moment, but works. What I cannot manage to get to work is the extraction and propogation of command line credentials into the js interface to ldb. Andrew Bartlett (This used to be commit f34ede763e7f80507d06224d114cf6b5ac7c8f7d)
2007-10-10r12227: I realised that I wasn't yet seeing authenticated LDAP for the ldbAndrew Bartlett1-0/+4
backend. The idea is that every time we open an LDB, we can provide a session_info and/or credentials. This would allow any ldb to be remote to LDAP. We should also support provisioning to a authenticated ldap server. (They are separate so we can say authenticate as foo for remote, but here we just want a token of SYSTEM). Andrew Bartlett (This used to be commit ae2f3a64ee0b07575624120db45299c65204210b)
2007-10-10r12060: Work towards allowing the credentials system to allow/deny certainAndrew Bartlett1-0/+1
GENSEC mechansims. This will allow a machine join to an NT4 domain to avoid even trying kerberos, or a sensitive operation to require it. Andrew Bartlett (This used to be commit 11c7a89e523f85afd728d5e5f03bb084dc620244)
2007-10-10r11995: A big kerberos-related update.Andrew Bartlett1-3/+24
This merges Samba4 up to current lorikeet-heimdal, which includes a replacement for some Samba-specific hacks. In particular, the credentials system now supplies GSS client and server credentials. These are imported into GSS with gss_krb5_import_creds(). Unfortunetly this can't take an MEMORY keytab, so we now create a FILE based keytab as provision and join time. Because the keytab is now created in advance, we don't spend .4s at negprot doing sha1 s2k calls. Also, because the keytab is read in real time, any change in the server key will be correctly picked up by the the krb5 code. To mark entries in the secrets which should be exported to a keytab, there is a new kerberosSecret objectClass. The new routine cli_credentials_update_all_keytabs() searches for these, and updates the keytabs. This is called in the provision.js via the ejs wrapper credentials_update_all_keytabs(). We can now (in theory) use a system-provided /etc/krb5.keytab, if krb5Keytab: FILE:/etc/krb5.keytab is added to the secrets.ldb record. By default the attribute privateKeytab: secrets.keytab is set, pointing to allow the whole private directory to be moved without breaking the internal links. (This used to be commit 6b75573df49c6210e1b9d71e108a9490976bd41d)
2007-10-10r11452: Update Heimdal to current lorikeet, including removing the ccache sideAndrew Bartlett1-0/+1
of the gsskrb5_acquire_cred hack. Add support for delegated credentials into the auth and credentials subsystem, and specifically into gensec_gssapi. Add the CIFS NTVFS handler as a consumer of delegated credentials, when no user/domain/password is specified. Andrew Bartlett (This used to be commit 55b89899adb692d90e63873ccdf80b9f94a6b448)
2007-10-10r11401: A simple hack to have our central credentials system deny sending LMAndrew Bartlett1-0/+1
authentication for user@realm logins and machine account logins. This should avoid various protocol downgrade attacks. Andrew Bartlett (This used to be commit 76c2d204d0a1ec66d1ef3c935688c7571b051f46)
2007-10-10r11358: Ensure domains are always upper-case as well. Helps NTLMv2.Andrew Bartlett1-1/+4
Andrew Bartlett (This used to be commit 82527491b2212d34b676be1e26cc875ae2828e42)
2007-10-10r11220: Add the ability to handle the salt prinicpal as part of theAndrew Bartlett1-0/+1
credentials. This works with the setup/secrets.ldif change from the previous patch, and pretty much just re-invents the keytab. Needed for kpasswdd work. Andrew Bartlett (This used to be commit cc9d167bab280eaeb793a5e7dfdf1f31be47fbf5)
2007-10-10r11200: Reposition the creation of the kerberos keytab for GSSAPI and Krb5Andrew Bartlett1-0/+27
authentication. This pulls the creating of the keytab back to the credentials code, and removes the special case of 'use keberos keytab = yes' for now. This allows (and requires) the callers to specify the credentials for the server credentails to GENSEC. This allows kpasswdd (soon to be added) to use a different set of kerberos credentials. The 'use kerberos keytab' code will be moved into the credentials layer, as the layers below now expect a keytab. We also now allow for the old secret to be stored into the credentials, allowing service password changes. Andrew Bartlett (This used to be commit 205f77c579ac8680c85f713a76de5767189c627b)
2007-10-10r11058: remove useless talloc contextStefan Metzmacher1-4/+1
metze (This used to be commit d9d3fe1b8aa34f5d87b73b94253b4230303cba76)
2007-10-10r10981: Pull code to decide between and implement NTLMv2, NTLM and LMAndrew Bartlett1-13/+0
authentication out of the various callers and into the kitchen sink.. err, credentials subsystem. This should ensure consistant logic, as well as get us one step closer to security=server operation in future. Andrew Bartlett (This used to be commit 09c95763301c0f7770d56462e8af4169b8c171fb)
2007-10-10r10596: Move the credentials code into it's own subsystem, and push it under ↵Andrew Bartlett1-0/+562
auth/ Andrew Bartlett (This used to be commit 2e76a4b8efd59c496d64241d654538d3222545c6)
generated by cgit (git 2.34.1) at 2024-12-22 21:14:44 +0000