summaryrefslogtreecommitdiff
path: root/source4/auth/sam.c
AgeCommit message (Collapse)AuthorFilesLines
2011-06-24s4:kdc: implement samba_kdc_check_s4u2proxy()Stefan Metzmacher1-0/+1
metze
2011-02-09s4-auth Rework auth subsystem to remove struct auth_serversupplied_infoAndrew Bartlett1-80/+84
This changes auth_serversupplied_info into the IDL-defined struct auth_user_info_dc. This then in turn contains a struct auth_user_info, which is the only part of the structure that is mainted into the struct session_info. The idea here is to avoid keeping the incomplete results of the authentication (such as session keys, lists of SID memberships etc) in a namespace where it may be confused for the finalised results. Andrew Barltett
2011-01-20s4-auth Remove special case for account_sid from auth_serversupplied_infoAndrew Bartlett1-37/+31
This makes everything reference a server_info->sids list, which is now a struct dom_sid *, not a struct dom_sid **. This is in keeping with the other sid lists in the security_token etc. In the process, I also tidy up the talloc tree (move more structures under their logical parents) and check for some possible overflows in situations with a pathological number of sids. Andrew Bartlett
2011-01-14s4-auth Add function to obtain any user's session_info from a given LDBAndrew Bartlett1-0/+84
This will be a building block for a tokenGroups test, which can compare against a remote server (in particular the rootDSE) against what we would calculate the tokenGroups to be. (this meant moving some parts out of the auth_sam code into the containing library) Andrew Bartlett
2011-01-14s4-auth use new dsdb_expand_nested_groups()Andrew Bartlett1-146/+5
This isn't quite as good as using tokenGroups, but that is only available for BASE searches, and this isn't how the all the callers work at the moment. Andrew Bartlett
2010-12-04s4:dsdb/common/util_samr.c and auth/sam.c - fix error messageMatthias Dieter Wallnöfer1-1/+1
2010-12-03s4:auth/sam.c - when printing out a string buffer we don't strictly need the ↵Matthias Dieter Wallnöfer1-2/+2
width The precision (maximum numbers of characters) should be enough. Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Fri Dec 3 10:26:39 CET 2010 on sn-devel-104
2010-12-03s4:auth/sam.c - the check for the SAMDB needs to be on the top of the callMatthias Dieter Wallnöfer1-6/+5
Otherwise it's really useless.
2010-12-03s4:auth/sam.c - fix the free of memory contextsMatthias Dieter Wallnöfer1-1/+1
"tmp_ctx" needs always to be freed ("res" is freed implicitly)
2010-12-03s4:auth/sam.c - specify the SID ignore case betterMatthias Dieter Wallnöfer1-1/+7
As per suggestion by metze.
2010-12-02s4:auth/sam.c-"authsam_expand_nested_groups" - don't fail if we've ↵Matthias Dieter Wallnöfer1-4/+4
memberships on non-SAM objects This can be expected (think at a membership of a "groupOfNames" group) and we shouldn't blame about it. This fixes a bug reported on the technical mailing list. Autobuild-User: Matthias Dieter Wallnöfer <mdw@samba.org> Autobuild-Date: Thu Dec 2 17:17:56 CET 2010 on sn-devel-104
2010-10-19s4-auth Add DEBUG() for invalid DNs and errors expanding user groups.Andrew Bartlett1-0/+5
Against the OpenLDAP backend, I currently get failures. This makes it possible to debug those failures. Andrew Bartlett
2010-10-15s4:dsdb - remove "samdb_result_uint", "samdb_result_int64", ↵Matthias Dieter Wallnöfer1-10/+10
"samdb_result_uint64" and "samdb_result_string" We have ldb_msg_find_attr_as_* calls which do exactly the same. Therefore this reduces only code redundancies. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-09-29s4-sam: added DOMAIN_RID_ENTERPRISE_READONLY_DCS for RODCs in the PACAndrew Tridgell1-0/+16
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-28s4-sam: fixed termination of krbtgt_attrs (comma and NULL)Andrew Tridgell1-4/+4
Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-09-29s4-kdc Use msDS-SecondaryKrbTgtNumber to fill in the full KVNOAndrew Bartlett1-0/+1
Andrew Bartlett
2010-09-26s4-auth: fixed the SID list for DCs in the PACAndrew Tridgell1-0/+16
the S-1-5-9 SID is added in the PAC by the KDC, not on the server that receives the PAC Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org> Pair-Programmed-With: Stefan Metzmacher <metze@samba.org> Autobuild-User: Andrew Tridgell <tridge@samba.org> Autobuild-Date: Sun Sep 26 07:09:08 UTC 2010 on sn-devel-104
2010-09-02s4-auth: make the disabled acct messages a bit less verboseAndrew Tridgell1-6/+6
raise the debug level Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-08-18s4:auth Avoid doing database lookups for NT AUTHORITY usersAndrew Bartlett1-0/+6
2010-06-29Revert "s4/auth: Fixed authsam_expand_nested_groups() to find entry SID if ↵Matthias Dieter Wallnöfer1-21/+4
not available in the DN." This reverts commit fa9557fee3ca546878d99b77f1ff37f724c37024. See post "Endi's Bug 7530 patches (LDAP backend)" on samba-technical.
2010-06-29s4:auth Query LDB for msds-SupportedEncryptionTypes for the KDCAndrew Bartlett1-0/+1
The KDC needs this to determine what encryption types an entry supports Andrew Bartlett
2010-06-28s4:auth/sam.c - "authsam_expand_nested_groups" - small performance improvementMatthias Dieter Wallnöfer1-3/+7
We can save one search operation if "only_childs" is false and when we had no SID passed as extended DN component.
2010-06-28s4:auth/sam.c - "authsam_expand_nested_groups" - cosmetic/commentsMatthias Dieter Wallnöfer1-9/+11
2010-06-28s4:auth/sam.c - "authsam_expand_nested_groups" - use "dsdb_search_dn" where ↵Matthias Dieter Wallnöfer1-3/+11
possible And always catch LDB errors
2010-06-28s4/auth: Fixed authsam_expand_nested_groups() to find entry SID if not ↵Endi S. Dewata1-1/+8
available in the DN. Signed-off-by: Matthias Dieter Wallnöfer <mdw@samba.org>
2010-05-21s4:auth Remove un-needed headers.Andrew Bartlett1-4/+0
2010-05-21s4:auth Fix previous commit - segfault in determinging a user's groupsAndrew Bartlett1-5/+3
The previous commit didn't include these vital fixes. Andrew Bartlett
2010-05-21s4:auth Error out when a memberOf DN does not have a SIDAndrew Bartlett1-13/+8
We previously segfaulted if this was not the case. Andrew Bartlett
2010-05-20s4:auth handle addition of nested aliases of domain groups.Andrew Bartlett1-8/+8
The challenge here is that we are asked not to add the domain groups again, but we need to search inside them for any aliases that we need to add. So, we can't short-circuit the operation just because we found the domain group. Andrew Bartlett
2010-05-20s4:auth Move BUILTIN group addition into session.cAndrew Bartlett1-72/+110
The group list in the PAC does not include 'enterprise DCs' and BUILTIN groups, so we should generate it on each server, not in the list we pass around in the PAC or SamLogon reply. Andrew Bartlett
2010-04-14s4:auth Change auth_generate_session_info to take an auth contextAndrew Bartlett1-0/+1
The auth context was in the past only for NTLM authentication, but we need a SAM, an event context and and loadparm context for calculating the local groups too, so re-use that infrustructure we already have in place. However, to avoid problems where we may not have an auth_context (in torture tests, for example), allow a simpler 'session_info' to be generated, by passing this via an indirection in gensec and an generate_session_info() function pointer in the struct auth_context. In the smb_server (for old-style session setups) we need to change the async context to a new 'struct sesssetup_context'. This allows us to use the auth_context in processing the authentication reply . Andrew Bartlett
2010-03-04s4:auth/sam.c - change base context for the "tmp_ctx" context in ↵Matthias Dieter Wallnöfer1-1/+1
"authsam_expand_nested_groups" Better use the "res_sids_ctx" as base context for the "tmp_ctx" and not the long-living "sam_ctx"/"ldb" context to prevent memory leaks.
2010-03-04s4:sam.c - make "authsam_expand_nested_groups" publicMatthias Dieter Wallnöfer1-1/+1
This is needed by the "tokenGroups" work in the operational LDB module.
2010-03-04s4:sam.c - cosmetic indentation fixMatthias Dieter Wallnöfer1-2/+1
2010-03-04s4:sam.c - change variable types to unsigned in "sids_contains_sid"Matthias Dieter Wallnöfer1-3/+4
Should also be unsigned - no need for a signed "i" and "num_sids" here.
2010-02-25s4:auth - make some parts "signed-safe"Matthias Dieter Wallnöfer1-3/+4
Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2010-02-22Spelling fixes for source4/auth.Brad Hards1-1/+1
The comment for USER_INFO_INTERACTIVE_LOGON looks like a cut-n-paste from the line above. Signed-off-by: Matthias Dieter Wallnöfer <mwallnoefer@yahoo.de>
2010-02-16s4-dsdb: removed gendb_search_single_extended_dn()Andrew Tridgell1-2/+3
Use dsdb_search_one() instead, which allows for arbitrary controls Pair-Programmed-With: Andrew Bartlett <abartlet@samba.org>
2010-01-29s4:auth_sam: avoid usage of data_blob_talloc_reference() and copy the ↵Stefan Metzmacher1-4/+14
session keys metze
2009-09-19s4-auth: add SID_NT_ENTERPRISE_DCS is a server trust accountAndrew Tridgell1-1/+13
2009-09-17s4-sam: add a note about the solaris clientAndrew Tridgell1-0/+2
2009-09-07s4:sam - Implement also here the right primary group behaviourMatthias Dieter Wallnöfer1-46/+71
We have not only to expand the additional groups but *also* the primary group to gain all rights of a user account. Also, remove an unneeded context (tmp_ctx) and "talloc_steal".
2009-08-04s4: Change my nested groups patch to don't include user's SID itself in the ↵Matthias Dieter Wallnöfer1-17/+24
"groupSID"s structure
2009-08-03Return infinite time for last last logoff when last logoff = 0Matthieu Patou1-1/+1
2009-07-31s4:auth: make sure we have elements returned at all in ↵Stefan Metzmacher1-0/+6
authsam_expand_nested_groups() metze
2009-07-31s4: Patch to implement nested group and privilegesMatthias Dieter Wallnöfer1-34/+100
This patch adds a function "authsam_expand_nested_groups" (calculation of rights through expanding groups of a certain SID) which basically collects all memberships through "memberOf" attributes. It works with either user or group SIDs. For avoiding loops it tests on each call if the SID hasn't been added yet (through the helper function "sids_contains_sid"). The function itself is called by "authsam_make_server_info".
2009-07-28s4:kerberos Add support for user principal names in certificatesAndrew Bartlett1-2/+4
This extends the PKINIT code in Heimdal to ask the HDB layer if the User Principal Name name in the certificate is an alias (perhaps just by case change) of the name given in the AS-REQ. (This was a TODO in the Heimdal KDC) The testsuite is extended to test this behaviour, and the other PKINIT certficate (using the standard method to specify a principal name in a certificate) is updated to use a Administrator (not administrator). (This fixes the kinit test). Andrew Bartlett
2009-07-17s4:kdc Rework KDC to pull in less attributes for krbtgt lookupsAndrew Bartlett1-15/+27
Each attribute we request from LDB comes with a small cost, so don't lookup any more than we must for the (very) frequent krbtgt lookup case. Similarly, we don't need to build a PAC for a server (as a target), so don't ask for the PAC attributes here either. Andrew Bartlett
2009-06-18Remove unused variableAndrew Bartlett1-3/+0
2009-06-18s4:kdc Allow a password change when the password is expiredAndrew Bartlett1-5/+6
This requires a rework on Heimdal's windc plugin layer, as we want full control over what tickets Heimdal will issue. (In particular, in case our requirements become more complex in future). The original problem was that Heimdal's check would permit the ticket, but Samba would then deny it, not knowing it was for kadmin/changepw Also (in hdb-samba4) be a bit more careful on what entries we will make the 'change_pw' service mark that this depends on. Andrew Bartlett
generated by cgit (git 2.34.1) at 2024-11-06 00:10:11 +0000