summaryrefslogtreecommitdiff
path: root/source4/dsdb/samdb/ldb_modules/acl.c
AgeCommit message (Collapse)AuthorFilesLines
2010-06-29Fixed incorrect use of cn instead of lDAPDisplayNameNadezhda Ivanova1-2/+2
2010-06-28s4:acl LDB module - fix counter typeMatthias Dieter Wallnöfer1-1/+2
2010-06-28Implementation of self membership validated right.Nadezhda Ivanova1-1/+100
When this right is granted, the user can add or remove themselves from a group even if they dont have write property right.
2010-06-07s4:acl LDB module - LDB attribute names should be compared using ↵Matthias Dieter Wallnöfer1-2/+2
"ldb_attr_cmp" or "strcasecmp"
2010-06-07s4:acl LDB module - adaption for "objectclass_attrs" moduleMatthias Dieter Wallnöfer1-5/+15
Since the attribute schema checking code moved back we need to give here the "LDB_ERR_NO_SUCH_ATTRIBUTE" error.
2010-06-06s4:acl LDB module - fix counter types where appropriateMatthias Dieter Wallnöfer1-2/+4
2010-05-10s4:acl ldb module - fix typosMatthias Dieter Wallnöfer1-3/+3
2010-04-16s4:Replaced dsdb_get_dom_sid_from_ldb_message() with samdb_result_dom_sid()Nadezhda Ivanova1-24/+5
2010-04-13s4:acl/descriptor LDB module - distinguish between root and default basednMatthias Dieter Wallnöfer1-0/+6
The first is the forest base DN, the second the domain base DN. At the moment we assume that they are both the same but it hasn't to be so. Nadia, I would invite you to fix the outstanding parts regarding this (I added comments).
2010-03-16s4:dsdb/acl Reduce calls to dsdb_get_schema() and add memory contextAndrew Bartlett1-24/+46
dsdb_get_schema() isn't a very cheap call, due to the use of LDB opaque pointers. We need to call it less, and instead pass it as a parameter where possible. This also changes to the new API with a talloc context. Andrew Bartlett
2010-03-12Split the dsdb_access_check_on_dn.Nadezhda Ivanova1-5/+44
Split the dsdb_access_check_on_dn so it can be reused for checks from both within the module stack and outside it.
2010-03-12Fixed ACL module to use dsdb_module_* API.Nadezhda Ivanova1-9/+9
2010-03-12Moved access_check_on_dn from acl module as an utility.Nadezhda Ivanova1-156/+19
Made this an utility function so it can be used for access checking outside of the acl ldb module, such as checking validated writes and control access rights in other protocols (e. g drs)
2010-03-09Added a check for permissions to modify the RDN attribute on rename.Nadezhda Ivanova1-0/+12
Necessary because rdn module will be moved lower than acl in the stack.
2010-03-07s4:acl LDB module - change counter variable to "unsigned"Matthias Dieter Wallnöfer1-1/+1
2010-02-13s4-dsdb: use TYPESAFE_QSORT() in dsdb codeAndrew Tridgell1-9/+3
2010-02-04s4:mark the SYSTEM control always as non-criticalMatthias Dieter Wallnöfer1-0/+29
It is needed to not break the various LDAP backends. For reference look at bug #7040.
2010-01-08s4-dsdb: fixed const misuse in acl moduleAndrew Tridgell1-4/+4
2010-01-08s4-dsdb: use dsdb_module_am_system() in acl moduleAndrew Tridgell1-19/+11
2009-12-21Adapted acl module to skip checks if as_system control is provided.Nadezhda Ivanova1-7/+17
Signed-off-by: Andrew Tridgell <tridge@samba.org>
2009-12-18s4-dsdb: Add a check to prevent acl_modify from debuging a NULL messageBrendan Powers1-1/+5
Check to see if there were any messages passed to acl_modify before debugging the first one. I think I caused this by some malformed LDIF. Signed-off-by: Andrew Bartlett <abartlet@samba.org>
2009-12-17Fixed incorrect checking of PRINCIPAL_SELF permissions.Nadezhda Ivanova1-11/+86
If an ace has the PRINCIPAL_SELF as trustee, this sid has to be replaced with the onjectSid of the object being checked. PRINCIPAL_SELF is the way to grant rights to an account over itself.
2009-12-15Fixed a problem with duplicate values of allowedAttributesEffective.Nadezhda Ivanova1-1/+3
2009-12-10Implementation of sDRightsEffective, allowedAttributesEffective and ↵Nadezhda Ivanova1-40/+610
allowedChildClassesEffective. Behavior as documented in WSPP and tested. Needs optimisation though.
2009-11-15Fixed some major bugs in inheritance and access checks.Nadezhda Ivanova1-28/+53
Fixed sd creation not working on LDAP modify. Fixed incorrect replacement of CO and CG. Fixed incorrect access check on modify for SD modification. Fixed failing sec_descriptor test and enabled it. Fixed failing sd add test in ldap.python
2009-11-05Version 1.0 of the directory service acls module.Nadezhda Ivanova1-961/+344
At this point, support for checks on LDAP add, delete, rename and modify. Old kludge_acl is still there to handle the searches. This module is synchronous as the async version was impossible to debug, will be converted to async after some user testing.
2009-10-06s4:acl module - intendation fix and comment enhancementMatthias Dieter Wallnöfer1-1/+2
2009-09-21Initial Implementation of the DS objects access checks.Nadezhda Ivanova1-0/+1151
Currently disabled. The search will be greatly modified, also the object tree stuff will be simplified.