summaryrefslogtreecommitdiff
path: root/source4/auth
AgeCommit message (Collapse)AuthorFilesLines
2007-10-10r13584: Another try at SPNEGO stuff. I need to write a better testsuite for ↵Andrew Bartlett1-0/+23
this. This tries to ensure that when we are a client, we cope with mechs (like GSSAPI) that only abort (unknown server) at first runtime. Andrew Bartlett (This used to be commit cb5d18c6190fa1809478aeb60e352cb93c4214f6)
2007-10-10r13583: Realise that the member server name appears in all calls that use theAndrew Bartlett1-1/+1
credentials. Consistantly rename these elements in the IDL to computer_name. Fix the server-side code to always lookup by this name. Add new, even nastier tests to RPC-SCHANNEL to prove this. Andrew Bartlett (This used to be commit 341a0abeb4a9f88d64ffd4681249cb1f643a7a5a)
2007-10-10r13481: As far as I can tell, my changes in -r 12863 were dangerously untested.Andrew Bartlett2-7/+12
We do need the gsskrb5_get_initiator_subkey() routine. But we should ensure that we do always get a valid key, to prevent any segfaults. Without this code, we get a different session key compared with Win2k3, and so kerberised smb signing fails. Andrew Bartlett (This used to be commit cfd0df16b74b0432670b33c7bf26316b741b1bde)
2007-10-10r13472: After Volker's advise, try every combination of parameters. ThisAndrew Bartlett1-4/+6
isn't every parameter on NTLMSSP, but it is most of the important ones. This showed up that we had the '128bit && LM_KEY' case messed up. This isn't supported, so we must look instead at the 56 bit flag. Andrew Bartlett (This used to be commit 990da31b5f63f1e707651af8bf1a3241a8309811)
2007-10-10r13471: With more 'try all options' testing, I found this 'simple' but in theAndrew Bartlett1-1/+1
NTLM2 signing code. Andrew Bartlett (This used to be commit 16e5c968756c40b8595503da47a1adb9cb09c447)
2007-10-10r13470: Thanks to a report from VL:Andrew Bartlett4-25/+39
We were causing mayhem by weakening the keys at the wrong point in time. I think this is the correct place to do it. The session key for SMB signing, and the 'smb session key' (used for encrypting password sets) is never weakened. The session key used for bulk data encryption/signing is weakened. This also makes more sense, when we look at the NTLM2 code. Andrew Bartlett (This used to be commit 3fd32a12094ff2b6df52f5ab2af7c0ffceb5a4a0)
2007-10-10r13467: Add new parametric options (for testing) controlling LM_KEY and 56-bitAndrew Bartlett1-5/+13
encryption behaviour. Andrew Bartlett (This used to be commit 2b3b2f33a4c531f2b0f65521cc352e6d762e95bd)
2007-10-10r13402: Make Samba4 pass a nastier RPC-SCHANNEL test.Andrew Bartlett3-50/+89
The new RPC-SCHANNEL test shows that the full credentials state must be kept in some shared memory, for some length of time. In particular, clients will reconnect with SCHANNEL (after loosing all connections) and expect that the credentials chain will remain in the same place. To achive this, we do the server-side crypto in a transaction, including the fetch/store of the shared state. Andrew Bartlett (This used to be commit 982a6aa871c9fce17410a9712cd9fa726025ff90)
2007-10-10r13344: Trust SASL to have subtle distinctions between NULL and zero-lengthAndrew Bartlett1-10/+24
responses... Also trust OpenLDAP to be pedantic about it, breaking connections to AD. In any case, we now get this 'right' (by nasty overloading hacks, but hey), and we can now use system-supplied OpenLDAP libs and SASL/GSSAPI to talk to Samba4. Andrew Bartlett (This used to be commit 0cbe18211a95f811b51865bc0e8729e9a302ad25)
2007-10-10r13342: Make the GSSAPI SASL mech actually work, by (shock horror) reading ↵Andrew Bartlett2-73/+436
the spec. GSSAPI differs from GSS-SPNEGO in an additional 3 packets, negotiating a buffer size and what integrity protection/privacy should be used. I worked off draft-ietf-sasl-gssapi-03, and this works against Win2k3. I'm doing this in the hope that Apple clients as well as SASL-based LDAP tools may get a bit further. I still can't get ldapsearch to work, it fails with the ever-helpful 'Local error'. Andrew Bartlett (This used to be commit 3e462897754b30306c1983af2d137329dd937ad6)
2007-10-10r13252: Cleanup, both in code, comments and talloc use:Andrew Bartlett3-21/+60
In particular, I've used the --leak-report-full option to smbd to track down memory that shouldn't be on a long-term context. This is now talloc_free()ed much earlier. Andrew Bartlett (This used to be commit c6eb74f42989d62c82d2a219251837b09df8491c)
2007-10-10r13250: I missed a couple of talloc_free()'sAndrew Bartlett1-0/+2
Andrew Bartlett (This used to be commit 3570a62876dcd656b328bf8c2c1be617ae9a8fd7)
2007-10-10r13247: Try to make better use of talloc in the auth/ and auth/gensec code.Andrew Bartlett3-17/+35
We don't want temporary memory hanging around on the long-term contexts. Andrew Bartlett (This used to be commit 85b3f6ebddfb655fdd08d1799752e562a6ff9cb1)
2007-10-10r13245: Don't segfault if we don't have a credentials structure on this gensecAndrew Bartlett1-3/+6
context. Andrew Bartlett (This used to be commit 1e840aa43679ceccb2a3afc694a5de0828147e8c)
2007-10-10r13206: This patch finally re-adds a -k option that works reasonably.Andrew Bartlett10-136/+175
From here we can add tests to Samba for kerberos, forcing it on and off. In the process, I also remove the dependency of credentials on GENSEC. This also picks up on the idea of bringing 'set_boolean' into general code from jpeach's cifsdd patch. Andrew Bartlett (This used to be commit 1ac7976ea6e3ad6184c911de5df624c44e7c5228)
2007-10-10r13170: Remove some dependencies on -1 implying the size of pstringJelmer Vernooij1-6/+4
(This used to be commit f7c28d31481f6479f258cd878d173cbc42ed9de0)
2007-10-10r13107: Follow the lead of Heimdal's kpasswdd and use the HDB (hdb-ldb in ourAndrew Bartlett4-20/+29
case) as the keytab. This avoids issues in replicated setups, as we will replicate the kpasswd key correctly (including from windows, which is why I care at the moment). Andrew Bartlett (This used to be commit 849500d1aa658817052423051b1f5d0b7a1db8e0)
2007-10-10r12971: Fix spelling.Tim Potter1-1/+1
(This used to be commit e9ec3a379c45ea210a810b1cb5d65b966b7319cc)
2007-10-10r12927: Fix typo.Andrew Bartlett1-1/+1
(This used to be commit 01e98966ca955e86ec46f8bce3892899e2717df9)
2007-10-10r12919: Ensure we never 'extend' the session key length, or fill in past theAndrew Bartlett1-1/+5
length of the (possibly null) pointer. In reality this should come to us either 16 or 0 bytes in length, but this is the safest test. This is bug 3401 in Samba3, thanks to Yau Lam Yiu <yiuext at cs.ust.hk> Andrew Bartlett (This used to be commit f3aa702944ed7086d93bf05075f910e7e4617d9c)
2007-10-10r12899: - fix warnings on AIXStefan Metzmacher1-1/+2
- fix compilation of auth/kerberos/krb5_init_context.c on AIX metze (This used to be commit 0e1ad08a8515056f4ed0923889bef04d85b84964)
2007-10-10r12863: As lha suggested to me a while back, it appears that theAndrew Bartlett2-12/+7
gsskrb5_get_initiator_subkey() routine is bougs. We can indeed use gss_krb5_get_subkey(). This is fortunate, as there was a segfault bug in 'initiator' version. Andrew Bartlett (This used to be commit ec11870ca1f9231dd3eeae792fc3268b31477e11)
2007-10-10r12824: Another typo.Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit 08f8b2aadbc815f91fbe50a5ebcbf33504bcd7cc)
2007-10-10r12821: Fix typos.Andrew Bartlett1-3/+3
Andrew Bartlett (This used to be commit f4386f7af17add82e88373adb1d585261d13355c)
2007-10-10r12816: Ugly hacks to the auth_unix code to make a SYSTEM token for root. IfAndrew Bartlett2-62/+90
we are going to try and have a 'real' NT token for these users, it is going to get messy fast. I want to go down the idmap road, but we don't have the infrustucure for that yet. Andrew Bartlett (This used to be commit c90d5e82ff4836765f328b2acf20fd09ec91189b)
2007-10-10r12808: Actually, with that we can avoid roken compleatly.Andrew Bartlett1-1/+0
Andrew Bartlett (This used to be commit 37f342b01095787d4a63a419c6ab3657680c2637)
2007-10-10r12807: I'm wondering if this might fix AIX on the build farm...Andrew Bartlett1-1/+1
Andrew Bartlett (This used to be commit 8f70d6270a788494dd07430f778ee90a51551e66)
2007-10-10r12804: This patch reworks the Samba4 sockets layer to use a socket_addressAndrew Bartlett7-89/+31
structure that is more generic than just 'IP/port'. It now passes make test, and has been reviewed and updated by metze. (Thankyou *very* much). This passes 'make test' as well as kerberos use (not currently in the testsuite). The original purpose of this patch was to have Samba able to pass a socket address stucture from the BSD layer into the kerberos routines and back again. It also removes nbt_peer_addr, which was being used for a similar purpose. It is a large change, but worthwhile I feel. Andrew Bartlett (This used to be commit 88198c4881d8620a37086f80e4da5a5b71c5bbb2)
2007-10-10r12795: remember the gensec_security contextStefan Metzmacher2-0/+3
metze (This used to be commit ec1a7b5cefc32172ea97338a7101fe8416071b69)
2007-10-10r12718: We don't use unicodePwd directly any more.Andrew Bartlett1-1/+0
Andrew Bartlett (This used to be commit c10491fb9be1eb8a13f03ed16fd3ed799315287e)
2007-10-10r12694: Move some headers to the directory of the subsystem they belong to.Jelmer Vernooij4-3/+4
(This used to be commit c722f665c90103f3ed57621c460e32ad33e7a8a3)
2007-10-10r12682: This patch finally fixes our kpasswdd implementation to be compatibleAndrew Bartlett3-8/+146
with clients compiled against the MIT Kerberos implementation. (Which checks for address in KRB-PRIV packets, hence my comments on socket functions earlier today). It also fixes the 'set password' operation to behave correctly (it was previously a no-op). This allows Samba3 to join Samba4. Some winbindd operations even work, which I think is a good step forward. There is naturally a lot of work to do, but I wanted at least the very basics of Samba3 domain membership to be available for the tech preview. Andrew Bartlett (This used to be commit 4e80a557f9c68b01ac6d5bb05716fe5b3fd400d4)
2007-10-10r12670: Make a couple of dependencies stricterJelmer Vernooij3-3/+3
Re-introduce and use the OUTPUT_TYPE property for MODULEs to force specific modules to always be included (This used to be commit f9eede3d40098eddc3618ee48f9253cdddb94a6f)
2007-10-10r12628: Prevent double registration warningsJelmer Vernooij1-1/+1
(This used to be commit 98ec52beeed47c71861c284c7aae66269c074e66)
2007-10-10r12627: This magic comment keeps minimal_includes.pl from suggesting theAndrew Bartlett1-1/+1
removal of this header. Andrew Bartlett (This used to be commit 17d4d49fe13831a4b9092b57a6279c128e10d36b)
2007-10-10r12621: INIT_FUNCTION no longer has to be set on librariesJelmer Vernooij1-1/+0
(This used to be commit 7ff1ecdc6fa9e360dedf9737da6ce1941ad5033e)
2007-10-10r12620: Get rid of automatically generated lists of init functions of ↵Jelmer Vernooij1-0/+5
subsystems. This allows Samba libraries to be used by other projects (and parts of Samba to be built as shared libraries). (This used to be commit 44f0aba715bfedc7e1ee3d07e9a101a91dbd84b3)
2007-10-10r12610: we need struct passwd on some systemsStefan Metzmacher1-0/+1
metze (This used to be commit fd7812beb21ccd14a0e7fd9db0a6eba22ebab0b2)
2007-10-10r12608: Remove some unused #include lines.Jelmer Vernooij14-26/+0
(This used to be commit 70e7449318aa0e9d2639c76730a7d1683b2f4981)
2007-10-10r12599: This new LDB module (and associated changes) allows Samba4 to operateAndrew Bartlett1-0/+1
using pre-calculated passwords for all kerberos key types. (Previously we could only use these for the NT# type). The module handles all of the hash/string2key tasks for all parts of Samba, which was previously in the rpc_server/samr/samr_password.c code. We also update the msDS-KeyVersionNumber, and the password history. This new module can be called at provision time, which ensures we start with a database that is consistent in this respect. By ensuring that the krb5key attribute is the only one we need to retrieve, this also simplifies the run-time KDC logic. (Each value of the multi-valued attribute is encoded as a 'Key' in ASN.1, using the definition from Heimdal's HDB. This simplfies the KDC code.). It is hoped that this will speed up the KDC enough that it can again operate under valgrind. (This used to be commit e9022743210b59f19f370d772e532e0f08bfebd9)
2007-10-10r12594: Jelmer pushed some proposed header reductions to the list today. ThisAndrew Bartlett6-22/+2
commits some of these that I know to be correct in the kerberos area. Andrew Bartlett (This used to be commit 6787b3737c27f5136152b007b0ee2ae314efac3c)
2007-10-10r12592: Remove some useless dependenciesJelmer Vernooij3-3/+4
(This used to be commit ca8db1a0cd77682ac2c6dc4718f5d753a4fcc4db)
2007-10-10r12542: Move some more prototypes out to seperate headersJelmer Vernooij9-1/+11
(This used to be commit 0aca5fd5130d980d07398f3291d294202aefe3c2)
2007-10-10r12499: Move smb_build.h out of includes.hJelmer Vernooij2-0/+2
(This used to be commit c92ace494f92084ddf178626cdf392d151043bc7)
2007-10-10r12498: Eliminate INIT_OBJ_FILES and ADD_OBJ_FILES. We were not usingJelmer Vernooij5-30/+25
the difference between these at all, and in the future the fact that INIT_OBJ_FILES include smb_build.h will be sufficient to have recompiles at the right time. (This used to be commit b24f2583edee38abafa58578d8b5c4b43e517def)
2007-10-10r12494: Support loading modules from .so files for most subsystems.Jelmer Vernooij2-0/+16
We now use a different system for initializing the modules for a subsystem. Most subsystems now have an init function that looks something like this: init_module_fn static_init[] = STATIC_AUTH_MODULES; init_module_fn *shared_init = load_samba_modules(NULL, "auth"); run_init_functions(static_init); run_init_functions(shared_init); talloc_free(shared_init); I hope to eliminate the other init functions later on (the init_programname_subsystems; defines). (This used to be commit b6d2ad4ce0a91c4be790dd258820c492ff1787ea)
2007-10-10r12439: No need to keep walking this list if we find the match.Andrew Bartlett1-0/+1
Andrew Bartlett (This used to be commit cf1883c3cc1feecf3ddd7f36dbbca3bdf068bee2)
2007-10-10r12436: Fix Samba4 as a server to Win2000 for the domain join.Andrew Bartlett1-46/+74
We still have Win2000 issues, but now we correctly handle the case where NTLMSSP is chosen as an authentication mech, but the OID list still contains Kerberos as a later option. Andrew Bartlett (This used to be commit dc2b2c33f89b84bd221c9009750a22ff42fc462d)
2007-10-10r12422: Some kerberos comments and clarifications.Andrew Bartlett2-11/+22
Andrew Bartlett (This used to be commit 31046cd22b45de6c62c9f122a81cfc898e818308)
2007-10-10r12411: Add 'net samdump keytab <keytab>'.Andrew Bartlett3-44/+45
This extracts a remote windows domain into a keytab, suitable for use in ethereal for kerberos decryption. For the moment, like net samdump and net samsync, the 'password server' smb.conf option must be set to the binding string for the server. eg: password server = ncacn_np:mypdc Andrew Bartlett (This used to be commit 272013438f53bb168f74e09eb70fc96112b84772)
generated by cgit (git 2.34.1) at 2024-11-29 09:28:31 +0000