Age | Commit message (Collapse) | Author | Files | Lines |
|
not have some of the issues of talloc_reference().
Andrew Bartlett
(This used to be commit 2fb413355a7cd7b5cee02237d2fbff91381435e5)
|
|
With this fix, I can request tickets from our built-in KDC!
Andrew Bartlett
(This used to be commit d7cd76013bdf000831790b29b9d0b401151bf5c2)
|
|
Andrew Bartlett
(This used to be commit fdd964582a4b102978fbc29dbf71de52bd30a155)
|
|
(This used to be commit 4444585f06cf8a061a615002107cbb7560604f7f)
|
|
Using current lorikeet/heimdal, and with the KDC module enabled (it is
disabled by default), I almost get the KDC to link.
(To enable the KDC for testing, comment out the only line in
smbd/config.m4, and add 'kdc' to the 'server services' line in
smb.conf).
(This used to be commit 26cd4b4f68a370390e08263067402c6c70e49ec8)
|
|
Andrew Bartlett
(This used to be commit 35877387c8e345d30d7598d1a139067a26cc1f7f)
|
|
(This used to be commit 6a5e48c35cba801b16172cf6ff06b1d4116fb018)
|
|
enables us to authenticate against system users (only PAM support right now)
(This used to be commit 0c894de58b7850a2905b73eb17c42d7e87cb9f87)
|
|
(This used to be commit e40c44e9cdc0be7c52207f8479568804e7d9cff2)
|
|
Andrew Bartlett
(This used to be commit 3dd730fbc880ddc4f2efc6105cd21ec45f4afdd5)
|
|
Andrew Bartlett
(This used to be commit 1f68cf7d0eb5de18da7f9d14c729caf314740601)
|
|
(This used to be commit e077d9948f1406c61982d49c2fd925852fdf6553)
|
|
and long names for a domain.
Add servicePrincipalName mapping table (administrator configurable),
in the same spot as microsoft uses.
Andrew Bartlett
(This used to be commit c25e78b4b34384a3a79a920f50f01be696a048ba)
|
|
Heimdal.
Andrew Bartlett
(This used to be commit f2e926192595c74bd9cc8a3343e0fcf27a1de38b)
|
|
done by setting:
OUTPUT_TYPE = SHARED_LIBRARY
in the [SUBSYSTEM::...] section belonging to a subsystem.
The idea is to allow multiple values to OUTPUT_TYPE simultaneously
(e.g. OUTPUT_TYPE = SHARED_LIBRARY, STATIC_LIBRARY, OBJLIST )
(This used to be commit b9d0ae93ba86fec0115f58e7940b2a6c908bc809)
|
|
Make the build system give a proper warning about this in the future
(This used to be commit 2d980465af87d25ce17b8340c6b5f662ef29edd3)
|
|
Andrew Bartlett
(This used to be commit dbd845998723987c75dc0e6a427330116dce0bf4)
|
|
config.mk and config.m4 to be consistent with the rest of Samba.
(This used to be commit f377c71e4f0d60684326906dfb65e4581294ec34)
|
|
(This used to be commit a02e07739781eb00b521d050ab06d6b0aedf47bc)
|
|
should allow us to ditch the local static storage for OIDs, as well as
fix the build on non-heimdal platforms.
Andrew Bartlett
(This used to be commit a7e2ecfac9aaacd673e3583b62139e4f4e114429)
|
|
Andrew Bartlett
(This used to be commit c8e8fa129ed0c80bcd289445935047c28d48da64)
|
|
Finally remove the distinction between 'krb5' and 'ms_krb5'. We now
don't do kerberos stuff twice on failure. The solution to this is
slightly more general than perhaps was really required (as this is a
special case), but it works, and I'm happy with the cleanup I achived
in the process. All modules have been updated to supply a
NULL-terminated list of OIDs.
In that process, SPNEGO code has been generalised, as I realised that
two of the functions should have been identical in behaviour.
Over in the actual modules, I have worked to remove the 'kinit' code
from gensec_krb5, and placed it in kerberos/kerberos_util.c.
The GSSAPI module has been extended to use this, so no longer requires
a manual kinit at the command line. It will soon loose the
requirement for a on-disk keytab too.
The general kerberos code has also been updated to move from
error_message() to our routine which gets the Heimdal error string
(which may be much more useful) when available.
Andrew Bartlett
(This used to be commit 0101728d8e2ed9419eb31fe95047944a718ba135)
|
|
this out by asking GENSEC, just like everybody else.
Andrew Bartlett
(This used to be commit 0268d6c46b73bf2097247639df2532b5e8591531)
|
|
rafal
(This used to be commit 0f9a2aef6c87bd53c962b33bf78bf773d2319b97)
|
|
features merged back into gensec_gssapi.
(Removed because I've made some API changes, and it isn't worth
'fixing' the rudundent code to cope with changes)
Andrew Bartlett
(This used to be commit e8cf3d58ec956e41fc8d3e38363db3d5d838fe1d)
|
|
(This used to be commit 46509eb89980bfe6dabd71264d570ea356ee5a22)
|
|
(This used to be commit f5956d150154cb4393dc323ae8ae1f936adee355)
|
|
soon-to-be-depricated 'realm'.
Add torture test for this behaviour.
Andrew Bartlet
(This used to be commit 6b9020661a13fd5ec6c5d1e21344d9f654978987)
|
|
back to the other options.
Andrew Bartlett
(This used to be commit 9153d7306124d5e4ffc0467728210e2e2235059f)
|
|
kerberos, and how Microsoft constructs their kerberos implementation.
Andrew Bartlett
(This used to be commit 5fa9be75d987af106fd798f6d5379b637a170b00)
|
|
(This used to be commit 45a0692be10a03032f9a4e26da3de08696c03464)
|
|
(This used to be commit 6d15e9511115cc30ee213ec91320a2dccde15b8f)
|
|
This also includes other changes to reduce memory use by GENSEC when
not being used for sign/seal operations. This should lower tridge's K
'per connection' benchmark further.
Andrew Bartlett
(This used to be commit 4a5829401b20c10091185bbd93236477523459b2)
|
|
Andrew Bartlett
(This used to be commit 77d054c65aeecfc0d1156d750f7b8025cb154d3a)
|
|
same time, but with different names. This just helps me avoid
conflicts when I merge up my other changes.
Andrew Bartlett
(This used to be commit 27e6a853a5160cb1ad595bea25e891eeae439662)
|
|
metze
(This used to be commit 0c1cd40bcea748d65938bb2dc8160ea07e9ec851)
|
|
metze
(This used to be commit 3536029e8fb1da1ca689e0b7aa1f3edfb7967790)
|
|
metze
(This used to be commit 491d7804f5f5bdfb43ae09b81c2cbc34fab2246d)
|
|
Andrew Bartlett
(This used to be commit 400899995b2c2ed54a114f8f55e5fb36592298b9)
|
|
must register the 'MS' OID for the domain join to progress.
Andrew Bartlett
(This used to be commit c8fbda6bfd96d5d57cd52bc15d8695547effe2e3)
|
|
This patch allows a suitably patched Heimdal GSSAPI library (detected
in configure) to supply to us the session keys, and further compleats
the gensec_gssapi module. This is tested for CIFS, but fails for LDAP
at this point (that is what I'll work on next).
We currently fill out the 'session info' from the SAM, like
gensec_krb5 does, but both will need to use the PAC extraction
functions in the near future.
Andrew Bartlett
(This used to be commit 937ee361615a487af9e0279145e75b6c27720a6b)
|
|
code, which is certainly not in the form of machine$.
Rework the default salt to match what I just added to the heimdal
server (Samba4 is back on speaking terms with lorikeet heimdal now),
from Luke Howard's post to samba-technical in Nov 2004.
Now to test compatability with MS...
Andrew Bartlett
(This used to be commit d719a0093bfe37fc62f28c7c02f17f93eec16abf)
|
|
a different
order than a strict request - reply sequence
Note: we should also fix the client code...
metze
(This used to be commit 0a61d1f65150546f7a7582512ca010d156f963bf)
|
|
metze
(This used to be commit 9d86314c44ae8e1ec21653b21cc267bfac573445)
|
|
metze
(This used to be commit 333f9bdf585db3df455009667d94deae568be02a)
|
|
client credentials code to read the secrets.ldb.
Also clean up error handling, and ensure to always set the
last_error_message stuff.
Andrew Bartlett
(This used to be commit 435d229e5d1da349f00d80a36b599ae70468e99d)
|
|
no longer done globally.
This keeps MIT client libraries happy, because otherwise the windows
KDC will return a different case to what was requested.
Andrew Bartlett
(This used to be commit 9098b9321f938473c367f906cfe2f001ca1d8e6a)
|
|
(This used to be commit 250f1f69dd719a7981ec4c1698942b31826888d2)
|
|
is required after updating to this version).
(This used to be commit 258d03ef9248b2827db18269e4f0883c73839084)
|
|
We need to pass the 'secure channel type' to the NETLOGON layer, which
must match the account type.
(Yes, jelmer objects to this inclusion of the kitchen sink ;-)
Andrew Bartlett
(This used to be commit 8ee208a926d2b15fdc42753b1f9ee586564c6248)
|