Age | Commit message (Collapse) | Author | Files | Lines |
|
This updates the module to handle both SID allocation and nextRid
updating while importing users. (As imported users already have a
SID, so don't go via the allocation step). We also ensure that SIDs
in the database are unquie at create time.
Furthermore, at allocation time, we double-check the SID isn't already
in use, and that we don't create a foriegnSecurityPrincipal for a
'local' sid.
Also create random samAccountName entries for users without one (we
were setting $000000-000000000000).
We may want to seperate the uniqueness code from the rest of samldb,
and into a module with the objectguid code, which needs similar
checks. These checks also need to apply to modification, or those
modifications denied outright.
Also update part of the testsuite to validate this.
Andrew Bartlett
(This used to be commit 7a9c8eee4bea88f5f0bb7c62f701476384b7dc84)
|
|
Andrew Bartlett
(This used to be commit 4d69eae382a789910d24ecadfb08b8d95a3c04b0)
|
|
than a hardcoded SID.
Fix the samldb module to return the what *was* the nextrid, rather
than the new nextrid (that is for next time).
Andrew Bartlett
(This used to be commit ffe9042e15cebbc7ff1bac90ec39835753d6caa7)
|
|
err, they save time at least. The correct use of an error string in
this case quickly pinpoited an overzealous check, and saved me hours
of painful debugging.
Andrew Bartlett
(This used to be commit 26946c90e87a94453a5ad3e9e26ef19b36656237)
|
|
Andrew Bartlett
(This used to be commit daa4b76800024c1494eeda675c46af3790fac788)
|
|
(This used to be commit 61ae77beecd573809d917dd86d1fac6cc40e967d)
|
|
metze
(This used to be commit 976052c6561dee7232c1a10fb977b1c4776825a2)
|
|
the error message.
Andrew Bartlett
(This used to be commit 36c1f67f12d5ac83a7a205c0ec152a79c4a8ba4b)
|
|
metze
(This used to be commit 1253784c923b569593b5207c14567c637f3a7ae7)
|
|
Simo.
(This used to be commit 2f0c7b896274e5e15e150c70d7ebe70355f6c4c0)
|
|
request handler, you really have to watch the recursion issues...
Andrew Bartlett
(This used to be commit 46628e86a2be6d334b2d0427e7052517c7ab1d4c)
|
|
passwords) be moved into the database, and not be hard-coded in the
module source.
Andrew Bartlett
(This used to be commit 1fbe09ce818ac1603bd747610262865b8698fe04)
|
|
This should be replaced with real ACLs, which tridge is working on.
In the meantime, the rules are very simple:
- SYSTEM and Administrators can read all.
- Users and anonymous cannot read passwords, can read everything else
- list of 'password' attributes is hard-coded
Most of the difficult work in this was fighting with the C/js
interface to add a system_session() all, as it still doesn't get on
with me :-)
Andrew Bartlett
(This used to be commit be9d0cae8989429ef47a713d8f0a82f12966fc78)
|
|
a second_stage_init private function for modules that need a second stage init.
Simo.
(This used to be commit 5e8b365fa2d93801a5de1d9ea76ce9d5546bd248)
|
|
There's still lot of work to do but the patch is stable
enough to be pushed into the main samba4 tree.
Simo.
(This used to be commit 77125feaff252cab44d26593093a9c211c846ce8)
|
|
sambaNTPassword. Likewise lmPwdHistory -> sambaLMPwdHistory.
The idea here is to avoid having conflicting formats when we get to
replication. We know the base data matches, but we may need to use a
module to munge formats.
Andrew Bartlett
(This used to be commit 8e608dd4bf4f108e02274a9977ced04a0a270570)
|
|
Because we don't know the syntax of unicodePwd, we want to avoid using
that attribute name. It may cause problems later when we get
replication form windows.
I'm doing this before the tech preview, so we don't get too many
supprises as folks upgrade databases into later versions.
Andrew Bartlett
(This used to be commit 097d9d0b7fd3b1a10fb7039f0671fd459bed2d1b)
|
|
be a valid talloc() pointer, as other modules may rely on this.
Andrew Bartlett
(This used to be commit 356c8c56090a7c4254609c0cc138c994b618fa55)
|
|
supportedSASLMechanism in the rootdse. (Second half of a patch
commited earlier today).
Andrew Bartlett
(This used to be commit 4b67b5d688493c385e12734fd2c0c9dbc1b238e4)
|
|
Re-introduce and use the OUTPUT_TYPE property for MODULEs to force
specific modules to always be included
(This used to be commit f9eede3d40098eddc3618ee48f9253cdddb94a6f)
|
|
(This used to be commit c297c93faf3b748de68679f5a4be50845ebe25fe)
|
|
(This used to be commit 70e7449318aa0e9d2639c76730a7d1683b2f4981)
|
|
using pre-calculated passwords for all kerberos key types.
(Previously we could only use these for the NT# type).
The module handles all of the hash/string2key tasks for all parts of
Samba, which was previously in the rpc_server/samr/samr_password.c
code. We also update the msDS-KeyVersionNumber, and the password
history. This new module can be called at provision time, which
ensures we start with a database that is consistent in this respect.
By ensuring that the krb5key attribute is the only one we need to
retrieve, this also simplifies the run-time KDC logic. (Each value of
the multi-valued attribute is encoded as a 'Key' in ASN.1, using the
definition from Heimdal's HDB. This simplfies the KDC code.).
It is hoped that this will speed up the KDC enough that it can again
operate under valgrind.
(This used to be commit e9022743210b59f19f370d772e532e0f08bfebd9)
|
|
We need to add to the multivalued objectClass, not ignore it because
the user has already specified a value.
Also rename the template again.
This was caught by more stringent tests in the unicodePwd module, but
breaks MMC. A later commit will sort the objectClass.
Andrew Bartlett
(This used to be commit 0aaff059ba76c7eee86f37bfd74735c1c365d55f)
|
|
(This used to be commit ca8db1a0cd77682ac2c6dc4718f5d753a4fcc4db)
|
|
(This used to be commit 0aca5fd5130d980d07398f3291d294202aefe3c2)
|
|
the difference between these at all, and in the future the
fact that INIT_OBJ_FILES include smb_build.h will be sufficient to
have recompiles at the right time.
(This used to be commit b24f2583edee38abafa58578d8b5c4b43e517def)
|
|
different computer account types. (Earlier code changes removed the
BDC case).
We don't use the TemplateDomainController, so just have a
TemplateServer in provision_templates.ldif
Andrew Bartlett
(This used to be commit c4520ba2e6fad42a137983a2e1dbcd9c26db74e9)
|
|
Andrew Bartlett
(This used to be commit d61817ebb754c2a7a6783415fdf5267eaad460e9)
|
|
Andrew Bartlett
(This used to be commit 5ac4178e36fade330fccb2dbb0607f524fe1f6ae)
|
|
- the objectClass needs to be added to the list of attributes to make
the check for objectClass=computer work
- the short version of the name needs to be used for the 'cn' in
cracknames
(This used to be commit 53f0fb77c3c1bd15620f1dbb12e0d8f9fededf4b)
|
|
This is for use on user-supplied arguments to printf style format
strings which will become ldb filters. I have used it on LSA, SAMR
and the auth/ code so far.
Also add comments to cracknames code.
Andrew Bartlett
(This used to be commit 8308cf6e0472790c1c9d521d19322557907f4418)
|
|
Needs changes to our client code for automated testing.
Andrew Bartlett
(This used to be commit e751d814149d847ff1699542a4fa81eb8ca129ec)
|
|
backend.
The idea is that every time we open an LDB, we can provide a
session_info and/or credentials. This would allow any ldb to be remote
to LDAP. We should also support provisioning to a authenticated ldap
server.
(They are separate so we can say authenticate as foo for remote, but
here we just want a token of SYSTEM).
Andrew Bartlett
(This used to be commit ae2f3a64ee0b07575624120db45299c65204210b)
|
|
(This used to be commit 82d87d62614a33ec9d2ed20e63d80a7af64e8678)
|
|
up the rootDomainNamingContext in the rootdse, then getting the
objectsid from the root of the domain
(This used to be commit 152590101e64ec260304e4b34cb1e2ef64333a02)
|
|
(This used to be commit 9c4436a124f874ae240feaf590141d48c33a635f)
|
|
- removed an unnecessary level of pointer in ldb_search structure
(This used to be commit b8d4afb14a18dfd8bac79882a035e74d3ed312bd)
|
|
(This used to be commit 8ca85842579a8a1d8f60259812d04eb7ee27d7aa)
|
|
the ldap server. The reason for the change is that ldb modules need
some way to get at the static info stored in the rootDSE (such as the
location of the schema) but they can't do that right now
(This used to be commit 7e226383f2cd2ce9bb3983ab6a3de454649f8a15)
|
|
after being freed)
(This used to be commit 5c7f3fef3e2324f0d1edda0f0f06f662bbcf7e08)
|
|
This patch changes the way lsb_search is called and the meaning of the returned integer.
The last argument of ldb_search is changed from struct ldb_message to struct ldb_result
which contains a pointer to a struct ldb_message list and a count of the number of messages.
The return is not the count of messages anymore but instead it is an ldb error value.
I tryed to keep the patch as tiny as possible bu as you can guess I had to change a good
amount of places. I also tried to double check all my changes being sure that the calling
functions would still behave as before. But this patch is big enough that I fear some bug
may have been introduced anyway even if it passes the test suite. So if you are currently
working on any file being touched please give it a deep look and blame me for any error.
Simo.
(This used to be commit 22c8c97e6fb466b41859e090e959d7f1134be780)
|
|
servicePrincipalName with a realm, which always returns 'domain only',
with the realm as the domain.
Andrew Bartlett
(This used to be commit 476cd0c649d69f682dee27c1ae2a73b870b300d0)
|
|
Andrew Bartlett
(This used to be commit 0a5bf9348ae179698daa291b94546c893e258097)
|
|
Support installing libraries.
Get rid of pkg-config file (will be autogenerated later on).
(This used to be commit b4745032a2c55752c527026feb221ccc3dce10c8)
|
|
I'm sure this will not be the final resting place, but it will do for
now.
Use the cracknames code in auth/ for creating a server_info given a
principal name only (should avoid assumtions about spliting a
user@realm principal).
Andrew Bartlett
(This used to be commit c9d5d8e45dd7b7c99b6cf35b087bc18012f31222)
|
|
(This used to be commit 24e10300906c380919d2d631bfb3b8fd6b3f54ba)
|
|
http://lists.samba.org/archive/samba-technical/2005-October/043443.html)
(This used to be commit 7fffc5c9178158249be632ac0ca179c13bd1f98f)
|
|
before the bad merge
metze
(This used to be commit 471c0ca4abb17fb5f73c0efed195c67628c1c06e)
|
|
(This used to be commit 6913e338405a5aca5c70cf6e022532c596ed0a36)
|